@adminiumjs/meta 0.2.1 → 0.2.2

package/dist/repos/password-resets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password-resets.d.ts","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGvE,eAAO,MAAM,eAAe;;;EAA8B,CAAC;AAC3D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAEpE,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;kBAGvB,wBAAwB,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,CAAC;IAc9F,oCAAoC;oCACE,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAWrG,qDAAqD;gBACnC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUpE,0EAA0E;YAC7D,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC"}
+{"version":3,"file":"password-resets.d.ts","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,2BAA2B,EAAE,MAAM,qBAAqB,CAAC;AAGvE,eAAO,MAAM,eAAe;;;EAA8B,CAAC;AAC3D,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAEpE,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,oEAAoE;IACpE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;kBAGvB,wBAAwB,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,CAAC;IAc9F,oCAAoC;oCACE,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAWrG,qDAAqD;gBACnC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUpE,0EAA0E;YAC7D,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/repos/password-resets.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: AGPL-3.0-only
 /**
  * passwordResetsRepo — adminium_password_resets (07-meta-store.md §3.6).
  * Carries both reset and invite-activation tokens; single-use.

package/dist/repos/password-resets.js.map

@@ -1 +1 @@
-{"version":3,"file":"password-resets.js","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAa3D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA+B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAkB;gBACzB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,oCAAoC;QACpC,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC/C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,0BAA0B,CAAC;iBACvC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;iBACnB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,EAAE,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvF,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"password-resets.js","sourceRoot":"","sources":["../../src/repos/password-resets.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;GAGG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAEnC,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AAa3D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA+B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAkB;gBACzB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,eAAe,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;gBACvC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,IAAI;gBACZ,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,oCAAoC;QACpC,KAAK,CAAC,oBAAoB,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,OAAO,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC/C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,0BAA0B,CAAC;iBACvC,GAAG,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;iBACnB,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,EAAE,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;iBACvF,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/permissions.d.ts

@@ -17,6 +17,21 @@ export declare function permissionsRepo(meta: MetaDb): {
     /** Upsert one matrix row keyed by (role, kind, ref). */
     grant(roleId: string, resourceKind: ResourceKind, resourceRef: string, actions: PermissionActions): Promise<RolePermission>;
     revoke(roleId: string, resourceKind: ResourceKind, resourceRef: string): Promise<boolean>;
+    /**
+     * Drop every role's grants for one resource — the cleanup a page delete
+     * owes.
+     *
+     * `resource_ref` is polymorphic across the three kinds, so it is a plain
+     * `varchar(255)` with no foreign key; nothing cascades page grants the way
+     * `adminium_views` and `adminium_scheduled_reports` cascade. Without this,
+     * deleting a page leaves dead `page:<id>:*` rows behind forever — and page
+     * ids are deterministic for generated pages, so a page later regenerated
+     * at the same id would silently inherit the deleted page's access list.
+     * Returns the number of rows removed.
+     */
+    revokeAllForResource(resourceKind: ResourceKind, resourceRef: string): Promise<number>;
+    /** Every role that holds a grant on one resource (page-access editor). */
+    listForResource(resourceKind: ResourceKind, resourceRef: string): Promise<RolePermission[]>;
     listForRole(roleId: string): Promise<RolePermission[]>;
     /**
      * Single matrix-cell check: `action` is `read`/`update`/… for tables,

package/dist/repos/permissions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM;mBAGd,MAAM,gBAAgB,YAAY,eAAe,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAsBlH,wDAAwD;kBAE9C,MAAM,gBACA,YAAY,eACb,MAAM,WACV,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;mBAsBL,MAAM,gBAAgB,YAAY,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;wBAUrE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoB5D;;;OAGG;sBACqB,MAAM,gBAAgB,YAAY,eAAe,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAStH;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}
+{"version":3,"file":"permissions.d.ts","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AACA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EAGL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAClB,MAAM,4BAA4B,CAAC;AAGpC,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,YAAY,CAAC;IAC3B,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,iBAAiB,CAAC;CAC5B;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM;mBAGd,MAAM,gBAAgB,YAAY,eAAe,MAAM,KAAG,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC;IAsBlH,wDAAwD;kBAE9C,MAAM,gBACA,YAAY,eACb,MAAM,WACV,iBAAiB,GACzB,OAAO,CAAC,cAAc,CAAC;mBAsBL,MAAM,gBAAgB,YAAY,eAAe,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAU/F;;;;;;;;;;;OAWG;uCACsC,YAAY,eAAe,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAS5F,0EAA0E;kCAE1D,YAAY,eACb,MAAM,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC;wBAkBF,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC;IAoB5D;;;OAGG;sBACqB,MAAM,gBAAgB,YAAY,eAAe,MAAM,WAAW,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAStH;AAED,MAAM,MAAM,eAAe,GAAG,UAAU,CAAC,OAAO,eAAe,CAAC,CAAC"}

package/dist/repos/permissions.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: AGPL-3.0-only
 /**
  * permissionsRepo — adminium_role_permissions (07-meta-store.md §3.9).
  * The `actions` JSON is Zod-validated per resource kind and never queried in
@@ -61,6 +62,44 @@ export function permissionsRepo(meta) {
                 .executeTakeFirst();
             return Number(res.numDeletedRows) === 1;
         },
+        /**
+         * Drop every role's grants for one resource — the cleanup a page delete
+         * owes.
+         *
+         * `resource_ref` is polymorphic across the three kinds, so it is a plain
+         * `varchar(255)` with no foreign key; nothing cascades page grants the way
+         * `adminium_views` and `adminium_scheduled_reports` cascade. Without this,
+         * deleting a page leaves dead `page:<id>:*` rows behind forever — and page
+         * ids are deterministic for generated pages, so a page later regenerated
+         * at the same id would silently inherit the deleted page's access list.
+         * Returns the number of rows removed.
+         */
+        async revokeAllForResource(resourceKind, resourceRef) {
+            const res = await db
+                .deleteFrom('adminium_role_permissions')
+                .where('resourceKind', '=', resourceKindSchema.parse(resourceKind))
+                .where('resourceRef', '=', resourceRef)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows ?? 0n);
+        },
+        /** Every role that holds a grant on one resource (page-access editor). */
+        async listForResource(resourceKind, resourceRef) {
+            const kind = resourceKindSchema.parse(resourceKind);
+            const rows = await db
+                .selectFrom('adminium_role_permissions')
+                .selectAll()
+                .where('resourceKind', '=', kind)
+                .where('resourceRef', '=', resourceRef)
+                .orderBy('roleId', 'asc')
+                .execute();
+            return rows.map((row) => ({
+                id: row.id,
+                roleId: row.roleId,
+                resourceKind: kind,
+                resourceRef: row.resourceRef,
+                actions: permissionActionsSchemaFor(kind).parse(readJson(row.actions)),
+            }));
+        },
         async listForRole(roleId) {
             const rows = await db
                 .selectFrom('adminium_role_permissions')

package/dist/repos/permissions.js.map

@@ -1 +1 @@
-{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GAGnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU/C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;QACjF,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,2BAA2B,CAAC;aACvC,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;aACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;aACtC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QAEJ,wDAAwD;QACxD,KAAK,CAAC,KAAK,CACT,MAAc,EACd,YAA0B,EAC1B,WAAmB,EACnB,OAA0B;YAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,2BAA2B,CAAC;iBACxC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;iBACvB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC;iBAChC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,EAAE;qBACL,UAAU,CAAC,2BAA2B,CAAC;qBACvC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;qBACtF,OAAO,EAAE,CAAC;YACf,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;YAC1E,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;iBAC9B,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;iBACvE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB,EAAE,MAAe;YAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,YAAY,KAAK,QAAQ;gBAAE,OAAQ,GAAG,CAAC,OAAgC,CAAC,OAAO,CAAC;YACpF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,KAAK,GAAI,GAAG,CAAC,OAAmC,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../src/repos/permissions.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;GAIG;AAGH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,GAGnB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAU/C,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,IAAI,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;QACjF,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,2BAA2B,CAAC;aACvC,SAAS,EAAE;aACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;aAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;aACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;aACtC,gBAAgB,EAAE,CAAC;QACtB,IAAI,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACxD,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,YAAY,EAAE,IAAI;YAClB,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;SACvE,CAAC;IACJ,CAAC;IAED,OAAO;QACL,IAAI;QAEJ,wDAAwD;QACxD,KAAK,CAAC,KAAK,CACT,MAAc,EACd,YAA0B,EAC1B,WAAmB,EACnB,OAA0B;YAE1B,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,SAAS,GAAG,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YAClE,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;YAClC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,2BAA2B,CAAC;iBACxC,GAAG,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;iBACvB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC;iBAChC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,IAAI,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrC,MAAM,EAAE;qBACL,UAAU,CAAC,2BAA2B,CAAC;qBACvC,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;qBACtF,OAAO,EAAE,CAAC;YACf,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,CAAC;YAClD,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACrE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB;YAC1E,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,oBAAoB,CAAC,YAA0B,EAAE,WAAmB;YACxE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;iBAClE,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;QAED,0EAA0E;QAC1E,KAAK,CAAC,eAAe,CACnB,YAA0B,EAC1B,WAAmB;YAEnB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpD,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,SAAS,EAAE;iBACX,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,IAAI,CAAC;iBAChC,KAAK,CAAC,aAAa,EAAE,GAAG,EAAE,WAAW,CAAC;iBACtC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;gBACxB,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,YAAY,EAAE,IAAI;gBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;aACvE,CAAC,CAAC,CAAC;QACN,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAc;YAC9B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,2BAA2B,CAAC;iBACvC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,cAAc,EAAE,KAAK,CAAC;iBAC9B,OAAO,CAAC,aAAa,EAAE,KAAK,CAAC;iBAC7B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACtB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;gBACxD,OAAO;oBACL,EAAE,EAAE,GAAG,CAAC,EAAE;oBACV,MAAM,EAAE,GAAG,CAAC,MAAM;oBAClB,YAAY,EAAE,IAAI;oBAClB,WAAW,EAAE,GAAG,CAAC,WAAW;oBAC5B,OAAO,EAAE,0BAA0B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;iBACvE,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,SAAS,CAAC,MAAc,EAAE,YAA0B,EAAE,WAAmB,EAAE,MAAe;YAC9F,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,YAAY,EAAE,WAAW,CAAC,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,OAAO,KAAK,CAAC;YACvB,IAAI,YAAY,KAAK,QAAQ;gBAAE,OAAQ,GAAG,CAAC,OAAgC,CAAC,OAAO,CAAC;YACpF,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACvC,MAAM,KAAK,GAAI,GAAG,CAAC,OAAmC,CAAC,MAAM,CAAC,CAAC;YAC/D,OAAO,KAAK,KAAK,IAAI,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/public-api.d.ts

@@ -0,0 +1,116 @@
+/**
+ * publicScopesRepo / publicKeysRepo — the public surface's meta rows
+ * (28-public-surface.md §3.2–§3.3, migration `0014_public_surface`).
+ *
+ * Deliberately NOT part of `apiKeysRepo`. A publishable key differs from an
+ * `adm_sk_` key in two ways that both reach the storage layer: its secret is
+ * re-readable, and it must never be resolvable as an `RbacPrincipal` (D3).
+ * Sharing a repo would put both kinds one `where` clause apart, which is how a
+ * later "unify the key lookup" change would quietly break the property the
+ * whole off switch rests on.
+ */
+import type { Selectable } from 'kysely';
+import type { MetaDb } from '../connect.js';
+import type { AdminiumPublicKeysTable, AdminiumPublicScopesTable, AdminiumPublicSessionsTable } from '../schema/tables.js';
+export type PublicScope = Selectable<AdminiumPublicScopesTable>;
+export type PublicKey = Selectable<AdminiumPublicKeysTable>;
+export type PublicSession = Selectable<AdminiumPublicSessionsTable>;
+export interface CreatePublicScopeInput {
+    connectionId: string;
+    side: string;
+    name: string;
+    /** Canonical IANA zone; the compiler refuses anything else. */
+    timezone: string;
+    /** The scope document, already serialized. */
+    document: string;
+    proposedFromManifest?: string | null;
+    createdBy?: string | null;
+}
+export declare function publicScopesRepo(meta: MetaDb): {
+    create(input: CreatePublicScopeInput, at?: number): Promise<PublicScope>;
+    findById(id: string): Promise<PublicScope | null>;
+    list(): Promise<PublicScope[]>;
+    listByConnection(connectionId: string): Promise<PublicScope[]>;
+    update(id: string, patch: {
+        name?: string;
+        timezone?: string;
+        document?: string;
+    }, at?: number): Promise<boolean>;
+    /**
+     * Deleting a scope is refused while a key points at it — the FK is
+     * `restrict`, so this surfaces the constraint as `false` rather than as a
+     * driver error. Revoking the key first is the intended order, because it
+     * makes the operator see what they are about to break.
+     */
+    remove(id: string): Promise<boolean>;
+};
+export interface CreatePublicKeyInput {
+    name: string;
+    /** Display/lookup fragment, e.g. `adm_pub_4f2a91cd`. */
+    prefix: string;
+    tokenHash: string;
+    /** AES-GCM envelope of the full token — the re-readable copy. */
+    tokenEncrypted: string;
+    scopeId: string;
+    side: string;
+    /** JSON array narrowing the instance origin list; `[]` = no narrowing. */
+    origins?: string[];
+    createdBy?: string | null;
+    expiresAt?: number | null;
+}
+export declare function publicKeysRepo(meta: MetaDb): {
+    create(input: CreatePublicKeyInput, at?: number): Promise<PublicKey>;
+    /**
+     * The AUTH lookup, by prefix.
+     *
+     * Returns every candidate rather than filtering on the hash in SQL, because
+     * the caller compares hashes in CONSTANT TIME. A `where tokenHash = ?`
+     * makes the database do a byte comparison whose timing an attacker can
+     * measure; the prefix is a public display fragment and leaks nothing.
+     *
+     * Revocation and expiry are NOT filtered here either — the caller decides,
+     * so it can answer every failure identically on the wire (§3.2) instead of
+     * letting "no row" and "revoked row" take different code paths.
+     */
+    findByPrefix(prefix: string): Promise<PublicKey[]>;
+    findById(id: string): Promise<PublicKey | null>;
+    listByScope(scopeId: string): Promise<PublicKey[]>;
+    list(): Promise<PublicKey[]>;
+    /** Rotation: a new secret against the same row, keeping scope and origins. */
+    rotate(id: string, next: {
+        prefix: string;
+        tokenHash: string;
+        tokenEncrypted: string;
+    }, at?: number): Promise<boolean>;
+    revoke(id: string, at?: number): Promise<boolean>;
+    /** Throttled by the caller, like session and api-key touches. */
+    touchLastUsed(id: string, at?: number): Promise<void>;
+};
+export interface CreatePublicSessionInput {
+    keyId: string;
+    tokenHash: string;
+    /** The RESOLVED claim — see the table comment on why it is not re-derived. */
+    grants: string;
+    expiresAt: number;
+}
+export declare function publicSessionsRepo(meta: MetaDb): {
+    create(input: CreatePublicSessionInput, at?: number): Promise<PublicSession>;
+    /**
+     * Resolve a session token.
+     *
+     * Unlike `publicKeysRepo.findByPrefix`, matching on the hash in SQL is fine
+     * here: a session token has no public display fragment to look up by, so
+     * there is nothing to narrow on first. Expiry IS filtered, because an
+     * expired session and an unknown one are the same thing to the caller and
+     * there is no reason to carry the difference back up.
+     */
+    findValid(tokenHash: string, at?: number): Promise<PublicSession | null>;
+    touch(id: string, at?: number): Promise<void>;
+    remove(tokenHash: string): Promise<boolean>;
+    /** Housekeeping: drop everything that has lapsed. */
+    purgeExpired(at?: number): Promise<number>;
+};
+export type PublicSessionsRepo = ReturnType<typeof publicSessionsRepo>;
+export type PublicScopesRepo = ReturnType<typeof publicScopesRepo>;
+export type PublicKeysRepo = ReturnType<typeof publicKeysRepo>;
+//# sourceMappingURL=public-api.d.ts.map

package/dist/repos/public-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api.d.ts","sourceRoot":"","sources":["../../src/repos/public-api.ts"],"names":[],"mappings":"AACA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EACV,uBAAuB,EACvB,yBAAyB,EACzB,2BAA2B,EAC5B,MAAM,qBAAqB,CAAC;AAE7B,MAAM,MAAM,WAAW,GAAG,UAAU,CAAC,yBAAyB,CAAC,CAAC;AAChE,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,uBAAuB,CAAC,CAAC;AAC5D,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,2BAA2B,CAAC,CAAC;AAEpE,MAAM,WAAW,sBAAsB;IACrC,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAyBD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM;kBAGrB,sBAAsB,OAAM,MAAM,GAAgB,OAAO,CAAC,WAAW,CAAC;iBAiBvE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;YASzC,OAAO,CAAC,WAAW,EAAE,CAAC;mCASC,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;eAW9D,MAAM,SACH;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,OAC1D,MAAM,GACT,OAAO,CAAC,OAAO,CAAC;IASnB;;;;;OAKG;eACc,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;EAc7C;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,iEAAiE;IACjE,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM;kBAGnB,oBAAoB,OAAM,MAAM,GAAgB,OAAO,CAAC,SAAS,CAAC;IAqBtF;;;;;;;;;;;OAWG;yBACwB,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;iBAQrC,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC;yBAS1B,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YAS1C,OAAO,CAAC,SAAS,EAAE,CAAC;IAIlC,8EAA8E;eAExE,MAAM,QACJ;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,MAAM,CAAA;KAAE,OAC/D,MAAM,GACT,OAAO,CAAC,OAAO,CAAC;eAUF,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAUnE,iEAAiE;sBACzC,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;EAI1E;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;IAClB,8EAA8E;IAC9E,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM;kBAGvB,wBAAwB,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,CAAC;IAc9F;;;;;;;;OAQG;yBACwB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;cAU1E,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;sBAIvC,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQjD,qDAAqD;sBAC9B,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQ/D;AAED,MAAM,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACvE,MAAM,MAAM,gBAAgB,GAAG,UAAU,CAAC,OAAO,gBAAgB,CAAC,CAAC;AACnE,MAAM,MAAM,cAAc,GAAG,UAAU,CAAC,OAAO,cAAc,CAAC,CAAC"}

package/dist/repos/public-api.js

@@ -0,0 +1,249 @@
+// SPDX-License-Identifier: AGPL-3.0-only
+/**
+ * publicScopesRepo / publicKeysRepo — the public surface's meta rows
+ * (28-public-surface.md §3.2–§3.3, migration `0014_public_surface`).
+ *
+ * Deliberately NOT part of `apiKeysRepo`. A publishable key differs from an
+ * `adm_sk_` key in two ways that both reach the storage layer: its secret is
+ * re-readable, and it must never be resolvable as an `RbacPrincipal` (D3).
+ * Sharing a repo would put both kinds one `where` clause apart, which is how a
+ * later "unify the key lookup" change would quietly break the property the
+ * whole off switch rests on.
+ */
+import { newId } from '../ids.js';
+/**
+ * A `json` column does not come back the same shape on every store.
+ *
+ * postgres and mysql hand back a PARSED value; sqlite hands back the text it
+ * stored. `PublicScope.document` is declared `string` and every caller treats
+ * it as one — `resolve.ts` calls `JSON.parse` on it, and the admin route
+ * returns it under a `z.string()` response schema — so on the two production
+ * stores that parse threw and that response failed validation, while the whole
+ * suite stayed green on sqlite. Found by CI, which runs all three; the local
+ * run skipped 334 store-gated tests.
+ *
+ * Normalising here rather than at each caller is the point of a repo layer:
+ * the driver difference is this file's business and nobody else's.
+ */
+function jsonText(value) {
+    return typeof value === "string" ? value : JSON.stringify(value);
+}
+/** One scope row, with its document normalised to text whatever the store did. */
+function scopeRow(row) {
+    return { ...row, document: jsonText(row.document) };
+}
+export function publicScopesRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('psc'),
+                connectionId: input.connectionId,
+                side: input.side,
+                name: input.name,
+                timezone: input.timezone,
+                document: input.document,
+                proposedFromManifest: input.proposedFromManifest ?? null,
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_public_scopes').values(row).execute();
+            return row;
+        },
+        async findById(id) {
+            const row = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return row === undefined ? null : scopeRow(row);
+        },
+        async list() {
+            const rows = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .orderBy('createdAt', 'desc')
+                .execute();
+            return rows.map(scopeRow);
+        },
+        async listByConnection(connectionId) {
+            const rows = await db
+                .selectFrom('adminium_public_scopes')
+                .selectAll()
+                .where('connectionId', '=', connectionId)
+                .orderBy('createdAt', 'desc')
+                .execute();
+            return rows.map(scopeRow);
+        },
+        async update(id, patch, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_scopes')
+                .set({ ...patch, updatedAt: at })
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /**
+         * Deleting a scope is refused while a key points at it — the FK is
+         * `restrict`, so this surfaces the constraint as `false` rather than as a
+         * driver error. Revoking the key first is the intended order, because it
+         * makes the operator see what they are about to break.
+         */
+        async remove(id) {
+            const attached = await db
+                .selectFrom('adminium_public_keys')
+                .select('id')
+                .where('scopeId', '=', id)
+                .executeTakeFirst();
+            if (attached !== undefined)
+                return false;
+            const res = await db
+                .deleteFrom('adminium_public_scopes')
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) === 1;
+        },
+    };
+}
+export function publicKeysRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('pbk'),
+                name: input.name,
+                prefix: input.prefix,
+                tokenHash: input.tokenHash,
+                tokenEncrypted: input.tokenEncrypted,
+                scopeId: input.scopeId,
+                side: input.side,
+                origins: JSON.stringify(input.origins ?? []),
+                expiresAt: input.expiresAt ?? null,
+                revokedAt: null,
+                lastUsedAt: null,
+                createdBy: input.createdBy ?? null,
+                createdAt: at,
+                updatedAt: at,
+            };
+            await db.insertInto('adminium_public_keys').values(row).execute();
+            return row;
+        },
+        /**
+         * The AUTH lookup, by prefix.
+         *
+         * Returns every candidate rather than filtering on the hash in SQL, because
+         * the caller compares hashes in CONSTANT TIME. A `where tokenHash = ?`
+         * makes the database do a byte comparison whose timing an attacker can
+         * measure; the prefix is a public display fragment and leaks nothing.
+         *
+         * Revocation and expiry are NOT filtered here either — the caller decides,
+         * so it can answer every failure identically on the wire (§3.2) instead of
+         * letting "no row" and "revoked row" take different code paths.
+         */
+        async findByPrefix(prefix) {
+            return db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('prefix', '=', prefix)
+                .execute();
+        },
+        async findById(id) {
+            const row = await db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('id', '=', id)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async listByScope(scopeId) {
+            return db
+                .selectFrom('adminium_public_keys')
+                .selectAll()
+                .where('scopeId', '=', scopeId)
+                .orderBy('createdAt', 'desc')
+                .execute();
+        },
+        async list() {
+            return db.selectFrom('adminium_public_keys').selectAll().orderBy('createdAt', 'desc').execute();
+        },
+        /** Rotation: a new secret against the same row, keeping scope and origins. */
+        async rotate(id, next, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_keys')
+                .set({ ...next, updatedAt: at })
+                .where('id', '=', id)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        async revoke(id, at = Date.now()) {
+            const res = await db
+                .updateTable('adminium_public_keys')
+                .set({ revokedAt: at, updatedAt: at })
+                .where('id', '=', id)
+                .where('revokedAt', 'is', null)
+                .executeTakeFirst();
+            return Number(res.numUpdatedRows) === 1;
+        },
+        /** Throttled by the caller, like session and api-key touches. */
+        async touchLastUsed(id, at = Date.now()) {
+            await db.updateTable('adminium_public_keys').set({ lastUsedAt: at }).where('id', '=', id).execute();
+        },
+    };
+}
+export function publicSessionsRepo(meta) {
+    const { db } = meta;
+    return {
+        async create(input, at = Date.now()) {
+            const row = {
+                id: newId('pss'),
+                keyId: input.keyId,
+                tokenHash: input.tokenHash,
+                grants: input.grants,
+                expiresAt: input.expiresAt,
+                createdAt: at,
+                lastSeenAt: null,
+            };
+            await db.insertInto('adminium_public_sessions').values(row).execute();
+            return row;
+        },
+        /**
+         * Resolve a session token.
+         *
+         * Unlike `publicKeysRepo.findByPrefix`, matching on the hash in SQL is fine
+         * here: a session token has no public display fragment to look up by, so
+         * there is nothing to narrow on first. Expiry IS filtered, because an
+         * expired session and an unknown one are the same thing to the caller and
+         * there is no reason to carry the difference back up.
+         */
+        async findValid(tokenHash, at = Date.now()) {
+            const row = await db
+                .selectFrom('adminium_public_sessions')
+                .selectAll()
+                .where('tokenHash', '=', tokenHash)
+                .where('expiresAt', '>', at)
+                .executeTakeFirst();
+            return row ?? null;
+        },
+        async touch(id, at = Date.now()) {
+            await db.updateTable('adminium_public_sessions').set({ lastSeenAt: at }).where('id', '=', id).execute();
+        },
+        async remove(tokenHash) {
+            const res = await db
+                .deleteFrom('adminium_public_sessions')
+                .where('tokenHash', '=', tokenHash)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows) > 0;
+        },
+        /** Housekeeping: drop everything that has lapsed. */
+        async purgeExpired(at = Date.now()) {
+            const res = await db
+                .deleteFrom('adminium_public_sessions')
+                .where('expiresAt', '<=', at)
+                .executeTakeFirst();
+            return Number(res.numDeletedRows);
+        },
+    };
+}
+//# sourceMappingURL=public-api.js.map

package/dist/repos/public-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public-api.js","sourceRoot":"","sources":["../../src/repos/public-api.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;GAUG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAuBlC;;;;;;;;;;;;;GAaG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;AACnE,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,GAAgB;IAChC,OAAO,EAAE,GAAG,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AACtD,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA6B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACjE,MAAM,GAAG,GAAgB;gBACvB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,oBAAoB,EAAE,KAAK,CAAC,oBAAoB,IAAI,IAAI;gBACxD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,wBAAwB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACpE,OAAO,GAAG,CAAC;QACb,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,gBAAgB,CAAC,YAAoB;YACzC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,SAAS,EAAE;iBACX,KAAK,CAAC,cAAc,EAAE,GAAG,EAAE,YAAY,CAAC;iBACxC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAA8D,EAC9D,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,wBAAwB,CAAC;iBACrC,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAChC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,MAAM,CAAC,IAAI,CAAC;iBACZ,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC;iBACzB,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACzC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,wBAAwB,CAAC;iBACpC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;KACF,CAAC;AACJ,CAAC;AAiBD,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA2B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC/D,MAAM,GAAG,GAAc;gBACrB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,cAAc,EAAE,KAAK,CAAC,cAAc;gBACpC,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;gBAC5C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAClE,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;;;;WAWG;QACH,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,OAAO,EAAE;iBACN,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,OAAe;YAC/B,OAAO,EAAE;iBACN,UAAU,CAAC,sBAAsB,CAAC;iBAClC,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC;iBAC9B,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,IAAI;YACR,OAAO,EAAE,CAAC,UAAU,CAAC,sBAAsB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC;QAClG,CAAC;QAED,8EAA8E;QAC9E,KAAK,CAAC,MAAM,CACV,EAAU,EACV,IAAmE,EACnE,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,sBAAsB,CAAC;iBACnC,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC/B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC9C,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,sBAAsB,CAAC;iBACnC,GAAG,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACrC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,CAAC;iBAC9B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,iEAAiE;QACjE,KAAK,CAAC,aAAa,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrD,MAAM,EAAE,CAAC,WAAW,CAAC,sBAAsB,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QACtG,CAAC;KACF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAA+B,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACnE,MAAM,GAAG,GAAkB;gBACzB,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,EAAE;gBACb,UAAU,EAAE,IAAI;aACjB,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACtE,OAAO,GAAG,CAAC;QACb,CAAC;QAED;;;;;;;;WAQG;QACH,KAAK,CAAC,SAAS,CAAC,SAAiB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACxD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,SAAS,EAAE;iBACX,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;iBAC3B,gBAAgB,EAAE,CAAC;YACtB,OAAO,GAAG,IAAI,IAAI,CAAC;QACrB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC7C,MAAM,EAAE,CAAC,WAAW,CAAC,0BAA0B,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1G,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,SAAiB;YAC5B,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,SAAS,CAAC;iBAClC,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;QACxC,CAAC;QAED,qDAAqD;QACrD,KAAK,CAAC,YAAY,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YACxC,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,0BAA0B,CAAC;iBACtC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/roles.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAK5C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM;kBAGd,eAAe,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;qBAcrD,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;iBAKjC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAKlC,OAAO,CAAC,IAAI,EAAE,CAAC;mBAKR,MAAM,QAAQ,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IASrF,4CAA4C;yBACjB,MAAM,UAAU,MAAM,cAAa,MAAM,GAAG,IAAI,OAAa,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;2BAc9F,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;yBAS3C,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;EAWtD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC"}
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AACA;;;GAGG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAK5C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAcD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM;kBAGd,eAAe,OAAM,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;qBAcrD,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;iBAKjC,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;YAKlC,OAAO,CAAC,IAAI,EAAE,CAAC;mBAKR,MAAM,QAAQ,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IASrF,4CAA4C;yBACjB,MAAM,UAAU,MAAM,cAAa,MAAM,GAAG,IAAI,OAAa,MAAM,GAAgB,OAAO,CAAC,IAAI,CAAC;2BAc9F,MAAM,UAAU,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;yBAS3C,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;EAWtD;AAED,MAAM,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC"}

package/dist/repos/roles.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: AGPL-3.0-only
 /**
  * rolesRepo — adminium_roles + adminium_user_roles
  * (07-meta-store.md §3.8, §3.10).

package/dist/repos/roles.js.map

@@ -1 +1 @@
-{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAmBhD,SAAS,OAAO,CAAC,GAAmC;IAClD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAsB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC1D,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;gBACpD,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAqC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAY;YAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1G,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACtG,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAChE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC5B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,4CAA4C;QAC5C,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,YAA2B,IAAI,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACzG,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,EAAE;iBACL,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACpD,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,MAAc;YACjD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC;iBAC9E,SAAS,CAAC,gBAAgB,CAAC;iBAC3B,KAAK,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC;iBAChD,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC;iBACrC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/repos/roles.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;GAGG;AAKH,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAElC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAmBhD,SAAS,OAAO,CAAC,GAAmC;IAClD,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,SAAS,EAAE,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC;QAClC,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IACpB,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAsB,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAC1D,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,MAAM,CAAC;gBACjB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,WAAW,EAAE,KAAK,CAAC,WAAW,IAAI,IAAI;gBACtC,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC;gBACpD,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YAC5D,OAAO,OAAO,CAAC,GAAqC,CAAC,CAAC;QACxD,CAAC;QAED,KAAK,CAAC,UAAU,CAAC,IAAY;YAC3B,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC,gBAAgB,EAAE,CAAC;YAC1G,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,QAAQ,CAAC,EAAU;YACvB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,EAAE,CAAC;YACtG,OAAO,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QACnC,CAAC;QAED,KAAK,CAAC,IAAI;YACR,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,SAAS,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;YAChG,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,MAAc,EAAE,IAAY,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YAChE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,gBAAgB,CAAC;iBAC7B,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBAC5B,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC;iBACxB,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,4CAA4C;QAC5C,KAAK,CAAC,YAAY,CAAC,MAAc,EAAE,MAAc,EAAE,YAA2B,IAAI,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACzG,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,QAAQ,CAAC;iBAChB,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ;gBAAE,OAAO;YACrB,MAAM,EAAE;iBACL,UAAU,CAAC,qBAAqB,CAAC;iBACjC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;iBACpD,OAAO,EAAE,CAAC;QACf,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,MAAc,EAAE,MAAc;YACjD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,KAAK,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,CAAC;iBAC5B,gBAAgB,EAAE,CAAC;YACtB,OAAO,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC1C,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAc;YAC/B,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,qBAAqB,CAAC;iBACjC,SAAS,CAAC,gBAAgB,EAAE,mBAAmB,EAAE,4BAA4B,CAAC;iBAC9E,SAAS,CAAC,gBAAgB,CAAC;iBAC3B,KAAK,CAAC,4BAA4B,EAAE,GAAG,EAAE,MAAM,CAAC;iBAChD,OAAO,CAAC,qBAAqB,EAAE,KAAK,CAAC;iBACrC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/scheduled-reports.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scheduled-reports.d.ts","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,kBAAkB,EAElB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAmBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM;mBAGnB,MAAM,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;kBAY9C,0BAA0B,OAAM,MAAM,GAAgB,OAAO,CAAC,eAAe,CAAC;IAmBlG,sEAAsE;gBACrD;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,eAAe,EAAE,CAAC;eAYnF,MAAM,SACH,0BAA0B,OAC7B,MAAM,GACT,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;eAoBjB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ1C,wEAAwE;kBAElE,MAAM,OACL;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACnD,OAAO,CAAC,OAAO,CAAC;IASnB,4EAA4E;iBAC1D,MAAM,GAAgB,OAAO,CAAC,eAAe,EAAE,CAAC;EAYrE;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
+{"version":3,"file":"scheduled-reports.d.ts","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AACA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,EACL,kBAAkB,EAElB,oBAAoB,EACrB,MAAM,4BAA4B,CAAC;AAIpC,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,cAAc,CAAC;IACzB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,iEAAiE;IACjE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAED,MAAM,WAAW,0BAA0B;IACzC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,cAAc,GAAG,SAAS,CAAC;IACtC,UAAU,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClC,MAAM,CAAC,EAAE,YAAY,GAAG,SAAS,CAAC;IAClC,OAAO,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC9B,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;CACvC;AAmBD,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM;mBAGnB,MAAM,KAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;kBAY9C,0BAA0B,OAAM,MAAM,GAAgB,OAAO,CAAC,eAAe,CAAC;IAmBlG,sEAAsE;gBACrD;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAQ,OAAO,CAAC,eAAe,EAAE,CAAC;eAYnF,MAAM,SACH,0BAA0B,OAC7B,MAAM,GACT,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;eAoBjB,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAQ1C,wEAAwE;kBAElE,MAAM,OACL;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACnD,OAAO,CAAC,OAAO,CAAC;IASnB,4EAA4E;iBAC1D,MAAM,GAAgB,OAAO,CAAC,eAAe,EAAE,CAAC;EAYrE;AAED,MAAM,MAAM,oBAAoB,GAAG,UAAU,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/repos/scheduled-reports.js

@@ -1,3 +1,4 @@
+// SPDX-License-Identifier: AGPL-3.0-only
 /**
  * scheduledReportsRepo — adminium_scheduled_reports (07-meta-store.md §3.24):
  * one row per recurring report. The row stores WHAT and WHEN (`schedule` per

package/dist/repos/scheduled-reports.js.map

@@ -1 +1 @@
-{"version":3,"file":"scheduled-reports.js","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA2C9E,SAAS,MAAM,CAAC,GAA8C;IAC5D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,4BAA4B,CAAC;aACxC,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,OAAO;QACL,QAAQ;QAER,KAAK,CAAC,MAAM,CAAC,KAAiC,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrE,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC9D,UAAU,EAAE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACpE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9C,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;gBAC/C,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,GAA2D,CAAC,CAAC;QAC7E,CAAC;QAED,sEAAsE;QACtE,KAAK,CAAC,IAAI,CAAC,OAA+C,EAAE;YAC1D,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC;YACpE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,KAAK;iBACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;iBACrB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAAiC,EACjC,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAA4B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,GAAG,CAAC;iBACR,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAoC,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,SAAS,CACb,EAAU,EACV,GAAoD;YAEpD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACrF,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBAC5C,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;iBAC5B,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"scheduled-reports.js","sourceRoot":"","sources":["../../src/repos/scheduled-reports.ts"],"names":[],"mappings":"AAAA,yCAAyC;AACzC;;;;;;;;;;;;GAYG;AAGH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,4BAA4B,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA2C9E,SAAS,MAAM,CAAC,GAA8C;IAC5D,OAAO;QACL,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,oBAAoB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5D,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAClE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;QAC5C,OAAO,EAAE,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC;QAC9B,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;QACxB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,CAAC;IAEpB,KAAK,UAAU,QAAQ,CAAC,EAAU;QAChC,MAAM,GAAG,GAAG,MAAM,EAAE;aACjB,UAAU,CAAC,4BAA4B,CAAC;aACxC,SAAS,EAAE;aACX,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;aACpB,gBAAgB,EAAE,CAAC;QACtB,OAAO,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,OAAO;QACL,QAAQ;QAER,KAAK,CAAC,MAAM,CAAC,KAAiC,EAAE,KAAa,IAAI,CAAC,GAAG,EAAE;YACrE,MAAM,GAAG,GAAG;gBACV,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,QAAQ,EAAE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBAC9D,UAAU,EAAE,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;gBACpE,MAAM,EAAE,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;gBAC9C,OAAO,EAAE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC;gBAC/C,SAAS,EAAE,IAAI;gBACf,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,SAAS,EAAE,EAAE;gBACb,SAAS,EAAE,EAAE;aACd,CAAC;YACF,MAAM,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;YACxE,OAAO,MAAM,CAAC,GAA2D,CAAC,CAAC;QAC7E,CAAC;QAED,sEAAsE;QACtE,KAAK,CAAC,IAAI,CAAC,OAA+C,EAAE;YAC1D,IAAI,KAAK,GAAG,EAAE,CAAC,UAAU,CAAC,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC;YACpE,IAAI,IAAI,CAAC,SAAS,KAAK,SAAS;gBAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACxF,MAAM,IAAI,GAAG,MAAM,KAAK;iBACrB,OAAO,CAAC,WAAW,EAAE,MAAM,CAAC;iBAC5B,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;iBACrB,KAAK,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC;iBACxB,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;QAED,KAAK,CAAC,MAAM,CACV,EAAU,EACV,KAAiC,EACjC,KAAa,IAAI,CAAC,GAAG,EAAE;YAEvB,MAAM,GAAG,GAA4B,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;YACvD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;gBAAE,GAAG,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YAC7D,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;gBAAE,GAAG,CAAC,UAAU,CAAC,GAAG,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC;YACzG,IAAI,KAAK,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;gBACnC,GAAG,CAAC,YAAY,CAAC,GAAG,QAAQ,CAAC,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;YAC/E,CAAC;YACD,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,GAAG,CAAC,QAAQ,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YACvF,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;gBAAE,GAAG,CAAC,SAAS,CAAC,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;YACjF,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;gBAAE,GAAG,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;YACtE,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,GAAG,CAAC;iBACR,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,IAAI,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACpD,OAAO,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,EAAU;YACrB,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAoC,CAAC,KAAK,CAAC,CAAC;QAClE,CAAC;QAED,wEAAwE;QACxE,KAAK,CAAC,SAAS,CACb,EAAU,EACV,GAAoD;YAEpD,MAAM,GAAG,GAAG,MAAM,EAAE;iBACjB,WAAW,CAAC,4BAA4B,CAAC;iBACzC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;iBACrF,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC;iBACpB,gBAAgB,EAAE,CAAC;YACtB,OAAO,QAAQ,CAAC,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;QAC5C,CAAC;QAED,4EAA4E;QAC5E,KAAK,CAAC,OAAO,CAAC,KAAa,IAAI,CAAC,GAAG,EAAE;YACnC,MAAM,IAAI,GAAG,MAAM,EAAE;iBAClB,UAAU,CAAC,4BAA4B,CAAC;iBACxC,SAAS,EAAE;iBACX,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;iBAC5C,KAAK,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,CAAC;iBAClC,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;iBAC5B,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC;iBAC3B,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/repos/sessions.d.ts

@@ -17,6 +17,15 @@ export interface CreateSessionInput {
 }
 export declare function sessionsRepo(meta: MetaDb): {
     create(input: CreateSessionInput, at?: number): Promise<Session>;
+    /** One row by id, in whatever state it is — revoked and expired included. */
+    findById(sessionId: string): Promise<Session | null>;
+    /**
+     * A user's live rows (un-revoked, unexpired at `at`), most recently active
+     * first — the "where am I signed in" list. Absolute expiry only: the
+     * sliding idle window and the 2FA-challenge rows that share this table are
+     * the server's vocabulary, so it filters those on top (auth/sessions.ts).
+     */
+    listForUser(userId: string, at?: number): Promise<Session[]>;
     /** A session is valid when un-revoked and unexpired at `at`. */
     findValidByTokenHash(tokenHash: string, at?: number): Promise<Session | null>;
     /**

package/dist/repos/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/repos/sessions.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM;kBAGjB,kBAAkB,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAgBlF,gEAAgE;oCAC1B,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW/F;;;OAGG;qBACoB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;sBAUjD,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;6BAU3C,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;IAUhF,sEAAsE;YACzD,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/repos/sessions.ts"],"names":[],"mappings":"AACA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEzC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAE5C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAGjE,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,QAAS,CAAC;AAEhD,MAAM,MAAM,OAAO,GAAG,UAAU,CAAC,qBAAqB,CAAC,CAAC;AAExD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM;kBAGjB,kBAAkB,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;IAgBlF,6EAA6E;wBACnD,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAS1D;;;;;OAKG;wBACuB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,EAAE,CAAC;IAW9E,gEAAgE;oCAC1B,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAW/F;;;OAGG;qBACoB,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;sBAUjD,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,OAAO,CAAC;6BAU3C,MAAM,OAAM,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;IAUhF,sEAAsE;YACzD,MAAM,GAAgB,OAAO,CAAC,MAAM,CAAC;EAQrD;AAED,MAAM,MAAM,YAAY,GAAG,UAAU,CAAC,OAAO,YAAY,CAAC,CAAC"}