mcp-scraper 0.95.2 → 0.96.0

package/dist/chunk-HNNYXMSI.js

@@ -0,0 +1 @@
+import{createHash as s}from"crypto";var e=class extends Error{constructor(r){super(r),this.name="OperationInputError"}},o=class extends Error{constructor(){super("This idempotency key was already used with different normalized inputs."),this.name="OperationIdempotencyConflictError"}};function u(t){return s("sha256").update(t).digest("hex")}function i(t){return Array.isArray(t)?t.map(i):t&&typeof t=="object"?Object.fromEntries(Object.entries(t).sort(([r],[n])=>r.localeCompare(n)).map(([r,n])=>[r,i(n)])):t}function l(t){return JSON.stringify(i(t??{}))}function d(t,r){let n=t.trim();if(!n)throw new Error(`${r} is required`);return n}function p(t,r){if(!Number.isSafeInteger(r.userId)||r.userId<=0||r.userId!==t.userId||!r.tool||r.tool!==t.tool||!r.jobId||r.jobId!==t.jobId||typeof r.sql!="string"||!r.sql.trim()||r.sql.length>64*1024||!Array.isArray(r.args)||r.args.length>512)throw new e("Store gate must match the operation principal, tool and job")}export{e as a,o as b,u as c,l as d,d as e,p as f};

package/dist/chunk-HUNSEGUN.js

@@ -0,0 +1,57 @@
+import{c as S}from"./chunk-4ZVO6GX4.js";import{a}from"./chunk-WNUXMPVX.js";import{b as E,c as f,d as A,e as m,f as c}from"./chunk-HNNYXMSI.js";import{randomUUID as w}from"crypto";var u="(CAST(strftime('%s', 'now') AS INTEGER) * 1000)",N=e=>{if(!Number.isSafeInteger(e)||e<1e3||e>36e5)throw Error("Execution lease must be between one second and one hour")};async function p(e,t,n){return(await e.execute({sql:`SELECT e.*, r.status AS run_status, r.tool, r.job_id, ${u} AS now_ms FROM operation_executions e
+      JOIN operation_runs r ON r.id = e.run_id WHERE e.run_id = ? AND r.user_id = ?`,args:[t,n]})).rows[0]}async function R(e,t,n,r,o=a(),s){N(r),s&&c({userId:t,tool:s.tool,jobId:s.jobId},s);let i=await p(o,e,t);return i?(i.phase==="claimed"&&Number(i.expires_at_ms)<=Number(i.now_ms)&&(await o.execute({sql:`UPDATE operation_executions SET claim_token = ?, expires_at_ms = ${u} + ?
+        WHERE run_id = ? AND phase = 'claimed' AND expires_at_ms <= ${u}
+          AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status = 'running' AND (? = 1 OR json_extract(normalized_flags_json,'$._storeGateRequired') IS NOT 1)${s?" AND tool = ? AND job_id = ?":""})
+          ${s?`AND (${s.sql})`:""}`,args:[n,r,e,e,t,s?1:0,...s?[s.tool,s.jobId,...s.args]:[]]}),i=await p(o,e,t)),i?.phase==="effects_started"&&Number(i.expires_at_ms)<=Number(i.now_ms)&&(await o.batch([{sql:`UPDATE operation_executions SET phase = 'unknown' WHERE run_id = ?
+          AND phase = 'effects_started' AND expires_at_ms <= ${u}
+          AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ?)`,args:[e,e,t]},{sql:`UPDATE operation_runs SET status = 'unknown', failure_class = 'execution_expired_after_effects',
+          ended_at = datetime('now'), updated_at = datetime('now') WHERE id = ? AND user_id = ? AND status = 'running'
+          AND EXISTS (SELECT 1 FROM operation_executions WHERE run_id = ? AND phase = 'unknown')`,args:[e,t,e]}],"write"),i=await p(o,e,t)),i?.phase==="published"&&i.run_status===i.result_status?{kind:"replay",runId:e,result:{json:String(i.result_json),status:i.result_status}}:i?.phase==="unknown"||i?.run_status!=="running"?{kind:"unknown",runId:e}:i.phase==="claimed"&&i.claim_token===n&&Number(i.expires_at_ms)>Number(i.now_ms)?{kind:"claimed",claim:{runId:e,userId:t,token:n}}:{kind:"pending",runId:e}):{kind:"unknown",runId:e}}async function b(e,t){return t&&c({userId:e.userId,tool:t.tool,jobId:t.jobId},t),(await a().execute({sql:`UPDATE operation_executions SET phase = 'effects_started' WHERE run_id = ? AND claim_token = ?
+      AND phase = 'claimed' AND expires_at_ms > ${u}
+      AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status = 'running' AND (? = 1 OR json_extract(normalized_flags_json,'$._storeGateRequired') IS NOT 1)${t?" AND tool = ? AND job_id = ?":""})
+      ${t?`AND (${t.sql})`:""}`,args:[e.runId,e.token,e.runId,e.userId,t?1:0,...t?[t.tool,t.jobId,...t.args]:[]]})).rowsAffected===1}async function y(e,t){return N(t),(await a().execute({sql:`UPDATE operation_executions SET expires_at_ms = ${u} + ? WHERE run_id = ? AND claim_token = ?
+      AND phase IN ('claimed', 'effects_started') AND expires_at_ms > ${u}
+      AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status = 'running')`,args:[t,e.runId,e.token,e.runId,e.userId]})).rowsAffected===1}async function C(e,t,n=3e5){if(N(n),!Number.isSafeInteger(t)||t<=0)throw Error("Authenticated recovery principal is required");let r=a(),o=w(),s;try{await r.batch([{sql:`UPDATE operation_executions SET phase = 'unknown', claim_token = ?, expires_at_ms = ${u} + ?
+        WHERE run_id = ? AND phase IN ('effects_started', 'unknown') AND expires_at_ms <= ${u}
+          AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status IN ('running', 'unknown'))`,args:[o,n,e,e,t]},{sql:`UPDATE operation_runs SET status = 'unknown', failure_class = 'execution_expired_after_effects',
+        ended_at = datetime('now'), updated_at = datetime('now') WHERE id = ? AND user_id = ? AND status = 'running'
+          AND EXISTS (SELECT 1 FROM operation_executions WHERE run_id = ? AND phase = 'unknown' AND claim_token = ?)`,args:[e,t,e,o]}],"write")}catch(_){s=_}let i;try{i=await p(r,e,t)}catch(_){throw s??_}if(i?.phase==="unknown"&&i.run_status==="unknown"&&i.claim_token===o&&Number(i.expires_at_ms)>Number(i.now_ms))return{runId:e,userId:t,token:o};if(s)throw s;return null}async function D(e,t,n,r){r&&c({userId:e.userId,tool:r.tool,jobId:r.jobId},r);let o=n?"unknown":"effects_started",s=n?"unknown":"running";if(JSON.parse(t.json),Buffer.byteLength(t.json)>16*1024*1024)throw Error("Operation result exceeds 16 MiB");let i=a(),_;try{await i.batch([{sql:`UPDATE operation_executions SET phase = 'published', result_json = ?, result_status = ?
+          WHERE run_id = ? AND claim_token = ? AND phase = ? AND expires_at_ms > ${u}
+            AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status = ?)
+            AND (? = 0 OR NOT EXISTS (
+              SELECT 1 FROM operation_debit_plans p JOIN billing_debits d ON d.idempotency_key = p.debit_key
+              WHERE p.run_id = operation_executions.run_id AND d.status IN ('applying', 'applied')
+                AND NOT EXISTS (SELECT 1 FROM billing_events b WHERE b.user_id = d.user_id
+                  AND b.billing_class = 'wallet_hold_settlement' AND b.source_surface = p.source_surface
+                  AND b.status = 'settled' AND (b.amount_mc = 0${r?" OR EXISTS(SELECT 1 FROM operation_final_settlements s WHERE s.run_id=p.run_id AND s.debit_key=p.debit_key AND s.user_id=d.user_id AND s.final_amount_mc=b.amount_mc AND s.refund_operation=p.refund_operation AND s.source_surface=p.source_surface)":""})
+                  AND json_extract(b.metadata, '$.debitIdempotencyKey') = p.debit_key
+                  AND json_extract(b.metadata, '$.refundOperation') = p.refund_operation)
+            ))${r?` AND (${r.sql}) AND EXISTS(SELECT 1 FROM operation_runs g WHERE g.id=operation_executions.run_id AND g.tool=? AND g.job_id=?)`:""}`,args:[t.json,t.status,e.runId,e.token,o,e.runId,e.userId,s,n?1:0,...r?[...r.args,r.tool,r.jobId]:[]]},{sql:`UPDATE operation_runs SET status = ?, ended_at = datetime('now'), updated_at = datetime('now')
+          WHERE id = ? AND user_id = ? AND status = ?
+            AND EXISTS (SELECT 1 FROM operation_executions WHERE run_id = ? AND claim_token = ?
+              AND phase = 'published' AND result_json = ? AND result_status = ?)`,args:[t.status,e.runId,e.userId,s,e.runId,e.token,t.json,t.status]}],"write")}catch(l){_=l}let d=await p(i,e.runId,e.userId);if(d?.phase==="published"&&d.claim_token===e.token&&d.result_json===t.json&&d.result_status===t.status&&d.run_status===t.status)return!0;if(_)throw _;return!1}async function q(e,t){return D(e,t,!1)}async function $(e,t,n){if(t.status!=="unknown")throw Error("Recovery cannot publish a known execution outcome");return D(e,t,!0,n)}async function j(e){await a().execute({sql:`UPDATE operation_executions SET expires_at_ms = ${u}
+    WHERE run_id = ? AND claim_token = ? AND phase = 'claimed'
+      AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status = 'running')`,args:[e.runId,e.token,e.runId,e.userId]})}async function H(e){await a().batch([{sql:`UPDATE operation_executions SET phase = 'unknown', expires_at_ms = ${u}
+      WHERE run_id = ? AND claim_token = ? AND phase IN ('effects_started', 'unknown') AND expires_at_ms > ${u}
+        AND EXISTS (SELECT 1 FROM operation_runs WHERE id = ? AND user_id = ? AND status IN ('running', 'unknown'))`,args:[e.runId,e.token,e.runId,e.userId]},{sql:`UPDATE operation_runs SET status = 'unknown', failure_class = 'execution_outcome_unavailable',
+        ended_at = datetime('now'), updated_at = datetime('now') WHERE id = ? AND user_id = ? AND status IN ('running', 'unknown')
+        AND EXISTS (SELECT 1 FROM operation_executions WHERE run_id = ? AND phase = 'unknown' AND claim_token = ?)`,args:[e.runId,e.userId,e.runId,e.token]}],"write")}async function F(e){let t=await p(a(),e.runId,e.userId);return t?.phase==="effects_started"&&t.run_status==="running"&&t.claim_token===e.token&&Number(t.expires_at_ms)>Number(t.now_ms)}function x(e){let t=m(e.tool,"tool"),n=m(e.ownerScope,"ownerScope"),r=e.idempotencyKey?.trim()||null,o=e.requestFingerprint?.trim()||null;if(r==null!=(o==null))throw Error("idempotencyKey and requestFingerprint must be supplied together");let s=r?f(`${n}\0${t}\0${r}`):null,i=e.id??w(),_=[i,e.userId??null,f(n),t,s,o,e.jobId??null,e.requestId??S()?.requestId??null,e.deploymentCommit??null,A(e.normalizedFlags),e.startedAt??new Date().toISOString()];return{id:i,scopeHash:s,requestFingerprint:o,statement:{sql:`INSERT${s?" OR IGNORE":""} INTO operation_runs
+      (id, user_id, owner_scope_hash, tool, idempotency_scope_hash, request_fingerprint,
+       job_id, request_id, deployment_commit, normalized_flags_json, started_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,args:_}}}async function O(e,t){let n=(await e.execute({sql:t.scopeHash?"SELECT id, request_fingerprint FROM operation_runs WHERE idempotency_scope_hash = ?":"SELECT id, request_fingerprint FROM operation_runs WHERE id = ?",args:[t.scopeHash??t.id]})).rows[0];if(!n)throw Error("Operation run insert did not produce an idempotency receipt");if(t.scopeHash&&String(n.request_fingerprint)!==t.requestFingerprint)throw new E;return{id:String(n.id),replayed:String(n.id)!==t.id}}async function W(e){let t=a(),n=x(e);return await t.execute(n.statement),n.scopeHash?O(t,n):{id:n.id,replayed:!1}}async function L(e,t,n,r){N(n),r&&c(e,r);let o=a(),s=x(r?{...e,normalizedFlags:{...e.normalizedFlags,_storeGateRequired:!0}}:e),i=r?{sql:s.statement.sql.replace("VALUES (","SELECT ").replace(/\)$/,"")+` WHERE (${r.sql})`,args:[...s.statement.args,...r.args]}:s.statement,_;try{await o.batch([i,{sql:`INSERT INTO operation_executions (run_id, claim_token, expires_at_ms, phase)
+          SELECT id, ?, ${u} + ?, 'claimed' FROM operation_runs
+          WHERE id = ? AND user_id = ? AND status = 'running' AND changes() = 1`,args:[t,n,s.id,e.userId]}],"write")}catch(l){_=l}let d;try{d=await O(o,s)}catch(l){if(l instanceof E)throw l;if(r&&!_)return{kind:"unknown",runId:s.id};throw _??l}return R(d.id,e.userId,t,n,o,r)}async function P(e){let t=a(),n=e.endedAt??new Date().toISOString(),r=e.failureClass==null?null:e.failureClass.slice(0,200);if((await t.execute({sql:`UPDATE operation_runs SET status = ?, failure_class = ?, ended_at = ?, updated_at = ?
+      WHERE id = ? AND status = 'running'
+        AND NOT EXISTS (SELECT 1 FROM operation_executions WHERE run_id = ?)`,args:[e.status,r,n,n,e.runId,e.runId]})).rowsAffected===1)return;let s=(await t.execute({sql:"SELECT status, failure_class FROM operation_runs WHERE id = ?",args:[e.runId]})).rows[0];if(!s)throw Error(`Unknown operation run: ${e.runId}`);if(s.status==="running")throw Error("Claimed operation runs require fenced result publication");let i=s.failure_class==null?null:String(s.failure_class);if(String(s.status)!==e.status||i!==r)throw Error(`Operation run ${e.runId} is already terminal as ${String(s.status)}`)}function M(e,t){if(!Number.isSafeInteger(e.userId)||e.userId<=0||!e.runId||!e.token||!t.tool||!t.jobId)throw Error("Invalid operation write fence");let n=t.recovery?"unknown":"effects_started",r=t.recovery?"unknown":"running";return{sql:`EXISTS (SELECT 1 FROM operation_executions x JOIN operation_runs r ON r.id=x.run_id
+    WHERE x.run_id=? AND x.claim_token=? AND x.phase=? AND x.expires_at_ms > ${u}
+      AND r.user_id=? AND r.status=? AND r.tool=? AND r.job_id=?)`,args:[e.runId,e.token,n,e.userId,r,t.tool,t.jobId]}}async function v(e,t,n){let o=(await a().execute({sql:`SELECT r.id,r.request_fingerprint,r.status,x.phase,x.result_json,x.result_status
+    FROM operation_runs r LEFT JOIN operation_executions x ON x.run_id=r.id
+    WHERE r.user_id=? AND r.idempotency_scope_hash=?`,args:[e,t]})).rows[0];if(!o)return null;if(String(o.request_fingerprint)!==n)throw new E;return o.phase!=="published"||o.status!==o.result_status?null:{runId:String(o.id),result:{json:String(o.result_json),status:o.result_status}}}async function U(e,t){return!!await p(a(),e,t)}async function X(e,t,n){return(await a().execute({sql:`SELECT 1 FROM operation_runs r JOIN operation_executions x ON x.run_id=r.id
+    WHERE r.job_id=? AND r.user_id=? AND r.tool=? AND (x.phase='unknown' OR r.status='unknown') LIMIT 1`,args:[e,t,n]})).rows.length>0}function G(e,t,n,r){if(![e,t].every(s=>/^[a-z_.]+$/.test(s))||!/^[a-z_]+$/.test(n))throw Error("Invalid operation group fence");if(r!=null&&(!r.trim()||r.length>512))throw Error("Invalid operation group exclusion");let o=r==null?"":`AND x.run_id <> '${r.replace(/'/g,"''")}'`;return`NOT EXISTS (SELECT 1 FROM operation_runs r JOIN operation_executions x ON x.run_id=r.id
+    WHERE r.job_id=${e} AND r.user_id=${t} AND r.tool='${n}'
+      AND x.phase IN ('claimed','effects_started') AND x.expires_at_ms > ${u} AND r.status='running' ${o})`}async function z(e,t){c({userId:e.userId,tool:t.tool,jobId:t.jobId},t);try{return await b(e,t)}catch(n){let r=await p(a(),e.runId,e.userId).catch(()=>null);if(r?.phase==="effects_started"&&r.claim_token===e.token&&r.run_status==="running"&&r.tool===t.tool&&r.job_id===t.jobId&&Number(r.expires_at_ms)>Number(r.now_ms))return!0;throw n}}async function J(e,t,n,r){if(!Number.isSafeInteger(t)||t<=0||!e||!n||!r)return null;let o=(await a().execute({sql:`SELECT r.id,r.status,r.normalized_flags_json,r.request_fingerprint,r.started_at,
+      e.phase,e.expires_at_ms,${u} AS now_ms FROM operation_runs r JOIN operation_executions e ON e.run_id=r.id
+    WHERE r.id=? AND r.user_id=? AND r.tool=? AND r.job_id=?
+      AND json_extract(r.normalized_flags_json,'$._storeGateRequired') IS 1`,args:[e,t,n,r]})).rows[0];return o?{runId:String(o.id),status:String(o.status),phase:String(o.phase),flags:JSON.parse(String(o.normalized_flags_json)),fingerprint:String(o.request_fingerprint),startedAt:String(o.started_at),expiresAtMs:Number(o.expires_at_ms),nowMs:Number(o.now_ms)}:null}function V(e,t,n){if(![e,t].every(r=>/^[a-z_.]+$/.test(r))||!/^[a-z_]+$/.test(n))throw Error("Invalid unresolved operation fence");return`NOT EXISTS (SELECT 1 FROM operation_runs r JOIN operation_executions e ON e.run_id=r.id
+    WHERE r.job_id=${e} AND r.user_id=${t} AND r.tool='${n}'
+      AND (e.phase IN ('effects_started','unknown') OR r.status='unknown'))`}export{R as a,b,y as c,C as d,q as e,$ as f,j as g,H as h,F as i,W as j,L as k,P as l,M as m,v as n,U as o,X as p,G as q,z as r,J as s,V as t};

package/dist/chunk-IFPION5D.js

@@ -0,0 +1,121 @@
+import{a as I}from"./chunk-7POHNTVW.js";import{b as S}from"./chunk-4ZVO6GX4.js";import{a as R}from"./chunk-WNUXMPVX.js";import{randomUUID as X}from"crypto";import{createMiddleware as b}from"hono/factory";async function j(e){await e.execute(`CREATE TABLE IF NOT EXISTS mcp_analytics_requests (
+    id TEXT PRIMARY KEY, parent_request_id TEXT, user_id INTEGER NOT NULL REFERENCES users(id),
+    service TEXT NOT NULL, method TEXT NOT NULL, http_status INTEGER NOT NULL,
+    duration_ms INTEGER NOT NULL, client_surface TEXT NOT NULL,
+    install_channel TEXT NOT NULL, ai_client TEXT, ai_model TEXT,
+    attribution_basis TEXT NOT NULL, started_at TEXT NOT NULL, deployment_commit TEXT
+  )`),(await e.execute("PRAGMA table_info(mcp_analytics_requests)")).rows.some(n=>n.name==="parent_request_id")||await e.execute("ALTER TABLE mcp_analytics_requests ADD COLUMN parent_request_id TEXT"),await e.execute("CREATE INDEX IF NOT EXISTS mcp_analytics_requests_user_started ON mcp_analytics_requests(user_id, started_at)"),await e.execute("CREATE INDEX IF NOT EXISTS mcp_analytics_requests_started ON mcp_analytics_requests(started_at)")}var k=new Set(["npx","npm","sdk","frontend","mcp-stdio","mcp-http","rest"]),D=new Set(["npx","npm","mcpb","source"]),v=new Set(["claude","claude-desktop","claude-code","chatgpt","codex","cursor","gemini","other"]);function y(e,t){return e&&t.has(e.toLowerCase())?e.toLowerCase():null}function A(e,t=!1){let n=y(e.get("x-mcp-client-surface")??void 0,k),s=e.get("x-mcp-ai-model")??"";return{surface:t?"frontend":n??"unknown",installChannel:y(e.get("x-mcp-install-channel")??void 0,D)??"unknown",aiClient:y(e.get("x-mcp-ai-client")??void 0,v),aiModel:/^[a-zA-Z0-9][a-zA-Z0-9._:/-]{0,79}$/.test(s)?s:null,basis:t?"session_authenticated":n?"caller_declared":"unknown"}}async function q(e,t=50){let n;try{await Promise.race([e,new Promise((s,a)=>{n=setTimeout(()=>a(new Error("analytics_write_budget_exceeded")),t)})])}finally{n&&clearTimeout(n)}}function F(e=2){let t=0;return async n=>{if(t>=e)return!1;t++;let s=Promise.resolve().then(n).finally(()=>{t--});return await q(s),!0}}var H=F();function z(e){return b(async(t,n)=>{let s=X(),a=new Date().toISOString(),o=performance.now(),r=new URL(t.req.url).pathname,d=e(r),i=d??(r==="/mcp"?"mcp_http":"other_authenticated_http"),f={op:i,probeRunId:t.req.header("x-cost-probe-id")??null,requestId:s},_=A(t.req.raw.headers),c={};_.surface!=="unknown"&&(c["x-mcp-client-surface"]=_.surface),new URL(t.req.url).pathname==="/mcp"&&!c["x-mcp-client-surface"]&&(c["x-mcp-client-surface"]="mcp-http"),_.installChannel!=="unknown"&&(c["x-mcp-install-channel"]=_.installChannel),_.aiClient&&(c["x-mcp-ai-client"]=_.aiClient),_.aiModel&&(c["x-mcp-ai-model"]=_.aiModel);let l=t.req.header("x-mcp-parent-request-id"),N=l&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(l)?l:null;return I({requestId:s,headers:c},()=>S(f,async()=>{t.header("x-mcp-request-id",s);try{await n()}finally{t.header("x-mcp-request-id",s);let T=t.get("user"),x=t.get("sessionUser"),O=Number(T?.id??x?.id),w=/\/(?:jobs|status|progress|events|history|balance|usage)(?:\/|$)/.test(r);if(process.env.MCP_ANALYTICS_CAPTURE==="1"&&!w&&t.req.method!=="HEAD"&&t.req.method!=="OPTIONS"&&(d!==null||r==="/mcp"&&t.req.method==="POST")&&Number.isSafeInteger(O)&&O>0){let E=A(t.req.raw.headers,!!x?.id);new URL(t.req.url).pathname==="/mcp"&&E.surface==="unknown"&&(E.surface="mcp-http",E.basis="hosted_mcp_route");try{await H(()=>R().execute({sql:`INSERT INTO mcp_analytics_requests
+                (id,parent_request_id,user_id,service,method,http_status,duration_ms,client_surface,install_channel,
+                 ai_client,ai_model,attribution_basis,started_at,deployment_commit)
+                VALUES (?,?,?,?,?,?,?,?,?,?,?,?,?,?)`,args:[s,N,O,i,t.req.method,t.error?500:t.res.status,Math.max(0,Math.round(performance.now()-o)),E.surface,E.installChannel,E.aiClient,E.aiModel,E.basis,a,process.env.VERCEL_GIT_COMMIT_SHA??null]}))}catch{console.warn("[mcp-analytics] request observation unavailable")}}}}))})}var m=["oauth_store_metadata","oauth_clients","oauth_client_redirect_uris","oauth_codes","oauth_code_exchanges","oauth_refresh_families","oauth_refresh_tokens","oauth_refresh_rotations","oauth_security_events","oauth_rate_limit_buckets"],h=["oauth_clients_inactivity_idx","oauth_clients_cleanup_idx","oauth_codes_expiry_idx","oauth_codes_client_idx","oauth_code_exchanges_replay_expiry_idx","oauth_refresh_families_lifecycle_idx","oauth_refresh_families_user_status_idx","oauth_refresh_families_client_idx","oauth_refresh_families_cleanup_idx","oauth_refresh_tokens_expiry_idx","oauth_refresh_rotations_replay_expiry_idx","oauth_security_events_retention_idx","oauth_rate_limit_buckets_expiry_idx"],C={oauth_clients:"oauth_clients_legacy_raw",oauth_codes:"oauth_codes_legacy_raw",oauth_tokens:"oauth_tokens_legacy_raw"},u="strftime('%Y-%m-%dT%H:%M:%fZ','now')";async function p(e,t,n=!1){try{await e.execute(t)}catch(s){let a=s.code;if(!n||a!=="SQL_PARSE_ERROR")throw s}}var M=[`CREATE TABLE IF NOT EXISTS oauth_store_metadata (
+    id INTEGER PRIMARY KEY CHECK (id = 1),
+    store_id TEXT NOT NULL UNIQUE,
+    schema_version INTEGER NOT NULL CHECK (schema_version > 0),
+    authority_epoch INTEGER NOT NULL CHECK (authority_epoch > 0),
+    authority_state TEXT NOT NULL CHECK (authority_state IN ('ready','authoritative','retired')),
+    updated_at TEXT NOT NULL DEFAULT (${u})
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_clients (
+    client_id TEXT PRIMARY KEY,
+    client_name TEXT NOT NULL,
+    client_type TEXT NOT NULL CHECK (client_type = 'public'),
+    token_endpoint_auth_method TEXT NOT NULL CHECK (token_endpoint_auth_method = 'none'),
+    status TEXT NOT NULL CHECK (status IN ('active','disabled','expired')),
+    created_at TEXT NOT NULL DEFAULT (${u}),
+    last_used_at TEXT,
+    expires_at TEXT
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_client_redirect_uris (
+    client_id TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE CASCADE,
+    redirect_uri TEXT NOT NULL,
+    redirect_kind TEXT NOT NULL CHECK (redirect_kind IN ('https','loopback','private_scheme')),
+    PRIMARY KEY (client_id, redirect_uri)
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_codes (
+    code_digest BLOB PRIMARY KEY,
+    lookup_key_id TEXT NOT NULL,
+    client_id TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE RESTRICT,
+    redirect_uri TEXT NOT NULL,
+    code_challenge TEXT NOT NULL,
+    challenge_method TEXT NOT NULL CHECK (challenge_method = 'S256'),
+    user_id TEXT NOT NULL,
+    scope TEXT NOT NULL,
+    resource TEXT,
+    issued_at TEXT NOT NULL DEFAULT (${u}),
+    expires_at TEXT NOT NULL
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_code_exchanges (
+    code_digest BLOB PRIMARY KEY,
+    request_fingerprint BLOB NOT NULL UNIQUE,
+    client_id TEXT NOT NULL,
+    family_id TEXT NOT NULL UNIQUE,
+    grant_scope TEXT NOT NULL,
+    grant_resource TEXT,
+    scope TEXT NOT NULL,
+    resource TEXT,
+    sealed_refresh BLOB NOT NULL,
+    sealed_nonce BLOB NOT NULL,
+    sealed_tag BLOB NOT NULL,
+    replay_key_id TEXT NOT NULL,
+    completed_at TEXT NOT NULL DEFAULT (${u}),
+    replay_expires_at TEXT NOT NULL
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_refresh_families (
+    family_id TEXT PRIMARY KEY,
+    user_id TEXT NOT NULL,
+    client_id TEXT NOT NULL REFERENCES oauth_clients(client_id) ON DELETE RESTRICT,
+    issuer TEXT NOT NULL,
+    scope TEXT NOT NULL,
+    resource TEXT,
+    status TEXT NOT NULL CHECK (status IN ('active','revoked','compromised','expired')),
+    current_generation INTEGER NOT NULL CHECK (current_generation > 0),
+    created_at TEXT NOT NULL DEFAULT (${u}),
+    expires_at TEXT NOT NULL,
+    revoked_at TEXT,
+    compromised_at TEXT,
+    UNIQUE (family_id, client_id),
+    FOREIGN KEY (family_id, current_generation)
+      REFERENCES oauth_refresh_tokens(family_id, generation)
+      DEFERRABLE INITIALLY DEFERRED
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_refresh_tokens (
+    family_id TEXT NOT NULL REFERENCES oauth_refresh_families(family_id) ON DELETE CASCADE,
+    generation INTEGER NOT NULL CHECK (generation > 0),
+    token_digest BLOB NOT NULL UNIQUE,
+    lookup_key_id TEXT NOT NULL,
+    token_prefix TEXT NOT NULL,
+    predecessor_generation INTEGER,
+    issued_at TEXT NOT NULL DEFAULT (${u}),
+    expires_at TEXT NOT NULL,
+    used_at TEXT,
+    revoked_at TEXT,
+    PRIMARY KEY (family_id, generation),
+    CHECK (predecessor_generation IS NULL OR (predecessor_generation > 0 AND predecessor_generation < generation))
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_refresh_rotations (
+    family_id TEXT NOT NULL REFERENCES oauth_refresh_families(family_id) ON DELETE CASCADE,
+    predecessor_generation INTEGER NOT NULL,
+    request_fingerprint BLOB NOT NULL,
+    successor_generation INTEGER NOT NULL,
+    sealed_successor BLOB NOT NULL,
+    sealed_nonce BLOB NOT NULL,
+    sealed_tag BLOB NOT NULL,
+    replay_key_id TEXT NOT NULL,
+    rotated_at TEXT NOT NULL DEFAULT (${u}),
+    replay_expires_at TEXT NOT NULL,
+    PRIMARY KEY (family_id, predecessor_generation),
+    UNIQUE (family_id, successor_generation),
+    CHECK (successor_generation = predecessor_generation + 1)
+  ) STRICT`,`CREATE TABLE IF NOT EXISTS oauth_security_events (
+    event_id TEXT PRIMARY KEY,
+    family_id TEXT NOT NULL,
+    event_type TEXT NOT NULL CHECK (event_type IN ('reuse','binding_mismatch','manual_revoke','expiry')),
+    reason_code TEXT NOT NULL,
+    occurred_at TEXT NOT NULL DEFAULT (${u}),
+    retain_until TEXT NOT NULL
+  ) STRICT`,"CREATE INDEX IF NOT EXISTS oauth_clients_inactivity_idx ON oauth_clients(status, last_used_at, client_id)","CREATE INDEX IF NOT EXISTS oauth_codes_expiry_idx ON oauth_codes(expires_at, code_digest)","CREATE INDEX IF NOT EXISTS oauth_code_exchanges_replay_expiry_idx ON oauth_code_exchanges(replay_expires_at, code_digest)","CREATE INDEX IF NOT EXISTS oauth_refresh_families_lifecycle_idx ON oauth_refresh_families(status, expires_at, family_id)","CREATE INDEX IF NOT EXISTS oauth_refresh_families_user_status_idx ON oauth_refresh_families(user_id, status)","CREATE INDEX IF NOT EXISTS oauth_refresh_tokens_expiry_idx ON oauth_refresh_tokens(expires_at, family_id, generation)","CREATE INDEX IF NOT EXISTS oauth_refresh_rotations_replay_expiry_idx ON oauth_refresh_rotations(replay_expires_at, family_id, predecessor_generation)","CREATE INDEX IF NOT EXISTS oauth_security_events_retention_idx ON oauth_security_events(retain_until, event_id)"],U=["CREATE INDEX IF NOT EXISTS oauth_clients_cleanup_idx ON oauth_clients(COALESCE(last_used_at,created_at), client_id)","CREATE INDEX IF NOT EXISTS oauth_codes_client_idx ON oauth_codes(client_id, code_digest)","CREATE INDEX IF NOT EXISTS oauth_refresh_families_client_idx ON oauth_refresh_families(client_id, family_id)",`CREATE INDEX IF NOT EXISTS oauth_refresh_families_cleanup_idx
+    ON oauth_refresh_families(COALESCE(compromised_at,revoked_at,expires_at), family_id)
+    WHERE status!='active'`],g=[`CREATE TABLE IF NOT EXISTS oauth_rate_limit_buckets (
+    scope TEXT NOT NULL CHECK (length(scope) BETWEEN 1 AND 80),
+    key_digest BLOB NOT NULL CHECK (typeof(key_digest) = 'blob' AND length(key_digest) = 32),
+    window_start INTEGER NOT NULL CHECK (window_start >= 0),
+    window_seconds INTEGER NOT NULL CHECK (window_seconds BETWEEN 1 AND 604800),
+    count INTEGER NOT NULL CHECK (count >= 1),
+    expires_at INTEGER NOT NULL CHECK (expires_at = window_start + window_seconds),
+    updated_at TEXT NOT NULL DEFAULT (${u}),
+    PRIMARY KEY (scope, key_digest, window_start, window_seconds)
+  ) STRICT`,`CREATE INDEX IF NOT EXISTS oauth_rate_limit_buckets_expiry_idx
+    ON oauth_rate_limit_buckets(expires_at, scope, key_digest, window_start, window_seconds)`],L=[...M,...U,...g];async function B(e){if(await p(e,"PRAGMA foreign_keys = ON"),await p(e,"PRAGMA busy_timeout = 5000",!0),(await e.execute("SELECT name FROM pragma_table_info('oauth_codes')")).rows.some(r=>String(r.name)==="code"))throw new Error("Legacy raw OAuth tables require the explicit maintenance-mode coexistence migration");let s=(await e.execute("SELECT 1 present FROM sqlite_master WHERE type='table' AND name='oauth_store_metadata'")).rows.length>0?await e.execute("SELECT schema_version FROM oauth_store_metadata WHERE id=1"):void 0,a=s?.rows[0]?.schema_version==null?void 0:Number(s.rows[0].schema_version);if(a!==void 0&&(!Number.isSafeInteger(a)||a<1||a>3))throw new Error("OAuth store schema version cannot be migrated by this runtime");let o=a===void 0?L:a===1?[...U,...g]:a===2?g:[];for(let r of o)await e.execute(r);if(a!==void 0&&a<3&&(await e.execute({sql:`UPDATE oauth_store_metadata SET schema_version=?,updated_at=${u} WHERE id=1 AND schema_version=?`,args:[3,a]})).rowsAffected!==1)throw new Error("OAuth store schema version changed during migration");await p(e,"PRAGMA optimize",!0)}async function Z(e){await p(e,"PRAGMA foreign_keys = ON"),await p(e,"PRAGMA busy_timeout = 5000",!0);let t=await e.execute("SELECT name FROM pragma_table_info('oauth_codes')");if(!t.rows.some(o=>String(o.name)==="code")){let o=t.rows.some(r=>String(r.name)==="code_digest");return await B(e),o?"current":"created"}if((await e.execute({sql:"SELECT name FROM sqlite_master WHERE type='table' AND name IN (?,?,?)",args:Object.values(C)})).rows.length>0)throw new Error("Legacy OAuth archive names already exist; refusing ambiguous migration");let a=await e.transaction("write");try{for(let[o,r]of Object.entries(C))(await a.execute({sql:"SELECT 1 present FROM sqlite_master WHERE type='table' AND name=?",args:[o]})).rows.length>0&&await a.execute({sql:`ALTER TABLE ${o} RENAME TO ${r}`,args:[]});for(let o of L)await a.execute({sql:o,args:[]});await a.commit()}finally{a.close()}return"archived_legacy"}var P={oauth_store_metadata:["id","store_id","schema_version","authority_epoch","authority_state","updated_at"],oauth_clients:["client_id","client_name","client_type","token_endpoint_auth_method","status","created_at","last_used_at","expires_at"],oauth_client_redirect_uris:["client_id","redirect_uri","redirect_kind"],oauth_codes:["code_digest","lookup_key_id","client_id","redirect_uri","code_challenge","challenge_method","user_id","scope","resource","issued_at","expires_at"],oauth_code_exchanges:["code_digest","request_fingerprint","client_id","family_id","grant_scope","grant_resource","scope","resource","sealed_refresh","sealed_nonce","sealed_tag","replay_key_id","completed_at","replay_expires_at"],oauth_refresh_families:["family_id","user_id","client_id","issuer","scope","resource","status","current_generation","created_at","expires_at","revoked_at","compromised_at"],oauth_refresh_tokens:["family_id","generation","token_digest","lookup_key_id","token_prefix","predecessor_generation","issued_at","expires_at","used_at","revoked_at"],oauth_refresh_rotations:["family_id","predecessor_generation","request_fingerprint","successor_generation","sealed_successor","sealed_nonce","sealed_tag","replay_key_id","rotated_at","replay_expires_at"],oauth_security_events:["event_id","family_id","event_type","reason_code","occurred_at","retain_until"],oauth_rate_limit_buckets:["scope","key_digest","window_start","window_seconds","count","expires_at","updated_at"]},K={oauth_clients_inactivity_idx:["status","last_used_at","client_id"],oauth_clients_cleanup_idx:[null,"client_id"],oauth_codes_expiry_idx:["expires_at","code_digest"],oauth_codes_client_idx:["client_id","code_digest"],oauth_code_exchanges_replay_expiry_idx:["replay_expires_at","code_digest"],oauth_refresh_families_lifecycle_idx:["status","expires_at","family_id"],oauth_refresh_families_user_status_idx:["user_id","status"],oauth_refresh_families_client_idx:["client_id","family_id"],oauth_refresh_families_cleanup_idx:[null,"family_id"],oauth_refresh_tokens_expiry_idx:["expires_at","family_id","generation"],oauth_refresh_rotations_replay_expiry_idx:["replay_expires_at","family_id","predecessor_generation"],oauth_security_events_retention_idx:["retain_until","event_id"],oauth_rate_limit_buckets_expiry_idx:["expires_at","scope","key_digest","window_start","window_seconds"]};async function ee(e){let t=await e.execute({sql:`SELECT name FROM sqlite_master WHERE type = 'table' AND name IN (${m.map(()=>"?").join(",")})`,args:[...m]}),n=await e.execute({sql:`SELECT name FROM sqlite_master WHERE type = 'index' AND name IN (${h.map(()=>"?").join(",")})`,args:[...h]}),s=new Set(t.rows.map(i=>String(i.name))),a=new Set(n.rows.map(i=>String(i.name))),o=await e.execute("PRAGMA foreign_keys"),r=[],d=i=>i.replace(/\bIF\s+NOT\s+EXISTS\b/gi,"").replace(/\s+/g," ").trim().toLowerCase();for(let i of m){if(!s.has(i))continue;let _=(await e.execute(`PRAGMA table_info('${i}')`)).rows.map(T=>String(T.name));JSON.stringify(_)!==JSON.stringify(P[i])&&r.push(`${i}:columns`);let c=await e.execute({sql:"SELECT sql FROM sqlite_master WHERE type='table' AND name=?",args:[i]}),l=String(c.rows[0]?.sql??""),N=L.find(T=>d(T).startsWith(`create table ${i} `));(!N||d(l)!==d(N))&&r.push(`${i}:definition`)}for(let i of h){if(!a.has(i))continue;let _=(await e.execute(`PRAGMA index_info('${i}')`)).rows.map(T=>T.name==null?null:String(T.name));JSON.stringify(_)!==JSON.stringify(K[i])&&r.push(`${i}:columns`);let c=await e.execute({sql:"SELECT sql FROM sqlite_master WHERE type='index' AND name=?",args:[i]}),l=String(c.rows[0]?.sql??""),N=L.find(T=>d(T).startsWith(`create index ${i} `));(!N||d(l)!==d(N))&&r.push(`${i}:definition`)}return{ok:m.every(i=>s.has(i))&&h.every(i=>a.has(i))&&Number(o.rows[0]?.foreign_keys??0)===1&&r.length===0,missingTables:m.filter(i=>!s.has(i)),missingIndexes:h.filter(i=>!a.has(i)),foreignKeysEnabled:Number(o.rows[0]?.foreign_keys??0)===1,problems:r}}export{j as a,z as b,Z as c,ee as d};