@antelopejs/interface-dms 0.3.5 → 0.4.0

package/CHANGELOG.md

@@ -1,5 +1,51 @@
 # Changelog
 
+## v0.4.0
+
+[compare changes](https://github.com/AntelopeJS/dms/compare/interface-v0.3.6...v0.4.0)
+
+### 🩹 Fixes
+
+- **interface-dms:** ⚠️  Release the breaking changes of #119 as 0.4.0 ([#166](https://github.com/AntelopeJS/dms/pull/166), [#119](https://github.com/AntelopeJS/dms/issues/119))
+
+#### ⚠️ Breaking Changes
+
+- **interface-dms:** ⚠️  Release the breaking changes of #119 as 0.4.0 ([#166](https://github.com/AntelopeJS/dms/pull/166), [#119](https://github.com/AntelopeJS/dms/issues/119))
+
+### ❤️ Contributors
+
+- Antony Rizzitelli <rizzitelli.antony@pm.me>
+
+## v0.3.6
+
+[compare changes](https://github.com/AntelopeJS/dms/compare/interface-v0.3.5...v0.3.6)
+
+> [!WARNING]
+> 0.3.6 was unpublished from npm: it shipped the breaking changes of [#119](https://github.com/AntelopeJS/dms/pull/119) under a patch version: changelogen 0.5 only reads a breaking change from a `!` in the commit header, not from a `BREAKING CHANGE:` footer. Use 0.4.0.
+
+### 🚀 Enhancements
+
+- **dms:** Port the v2 design across the dashboard ([#119](https://github.com/AntelopeJS/dms/pull/119))
+
+### 🩹 Fixes
+
+- **layout:** Hold the in-flight modules listing fetch on the DMS app ([#121](https://github.com/AntelopeJS/dms/pull/121))
+- **tab:** Space the blocks of a tab like the page spaces its own ([#98](https://github.com/AntelopeJS/dms/pull/98))
+- **dev-reload:** End the reload streams when the module stops ([#125](https://github.com/AntelopeJS/dms/pull/125))
+
+### 🏡 Chore
+
+- **release:** @antelopejs/dms v0.5.4 ([a301255](https://github.com/AntelopeJS/dms/commit/a301255))
+- **release:** @antelopejs/dms v0.5.5 ([2eb0e86](https://github.com/AntelopeJS/dms/commit/2eb0e86))
+- **release:** @antelopejs/dms v0.5.6 ([76d9ee3](https://github.com/AntelopeJS/dms/commit/76d9ee3))
+
+### ❤️ Contributors
+
+- Maxime Westhoven ([@mwesto](http://github.com/mwesto))
+- Antony Rizzitelli <rizzitelli.antony@pm.me>
+- Glastis ([@Glastis](http://github.com/Glastis))
+- Alessandro Aloisio ([@alessaloisio](http://github.com/alessaloisio))
+
 ## v0.3.5
 
 [compare changes](https://github.com/AntelopeJS/dms/compare/interface-v0.3.4...v0.3.5)

package/README.md

@@ -64,8 +64,8 @@ be used as a key: `RegisteringProxy` looks its entries up by object reference,
 so unregistering with the view a module holds matches nothing and leaves the
 registration live -- silently, exactly like a second copy would. `RegisterPage`
 and `RegisterCategory` resolve their argument through `RegistrationIdentity`
-(`page/registry`) for that reason; anything else keyed on a value that crossed
-the boundary has to do the same. The same trap catches structural comparisons:
+(`page/internal/registry`) for that reason; anything else keyed on a value
+that crossed the boundary has to do the same. The same trap catches structural comparisons:
 `isDeepStrictEqual` and `assert.deepStrictEqual` both refuse two views that hold
 equal values, so compare plain data, field by field or after a JSON round trip.
 

package/dist/attachments.d.ts

@@ -1,6 +1,7 @@
 import type { RequestContext } from "@antelopejs/interface-api";
-import type { DataControllerCallback } from "@antelopejs/interface-data-api";
 import type { FileMetadata, UploadConstraints } from "@antelopejs/interface-file-storage";
+import type { TableViewAttachmentSaveRequest } from "./internal/attachments";
+/** A server-declared file field; ids must match the form's attachmentField. */
 export interface AttachmentField {
     id: string;
     key: string;
@@ -9,10 +10,12 @@ export interface AttachmentField {
     visibility?: "private" | "public";
     constraints?: UploadConstraints;
 }
+/** The actual saved values used to clean removed native files. */
 export interface AttachmentSaveResult<T> {
     document: Record<string, unknown>;
     result: T;
 }
+/** Context supplied by an authorized server-side write route, never by its client. */
 export interface AttachmentSaveRequest {
     context: RequestContext;
     componentIds: string[];
@@ -20,19 +23,25 @@ export interface AttachmentSaveRequest {
     submitted: Record<string, unknown>;
     before: Record<string, unknown>;
 }
-export interface TableViewAttachmentSaveRequest {
-    controller: unknown;
-    route: DataControllerCallback;
-    context: RequestContext;
-    params: unknown;
-    args: unknown[];
-    mode: "save" | "delete";
-    componentIds: string[];
-}
+/** @internal */
 export declare namespace internal {
     const SaveTableViewAttachments: (request: TableViewAttachmentSaveRequest) => Promise<unknown>;
 }
 type AttachmentSaver = <T>(request: AttachmentSaveRequest, save: (promoted: Record<string, unknown>) => Promise<AttachmentSaveResult<T>>) => Promise<T>;
+/**
+ * Validate native-file provenance, promote staging keys, then save once.
+ * Call after write authorization with the trusted component identity and fields.
+ * Staged retries require trusted provider promotion replay; canonical metadata
+ * is validated before save. Failed saves never move or delete promoted objects:
+ * another save may reference them. Retained objects keep their declared visibility.
+ * Removed files are deleted after successful persistence; cleanup errors are logged.
+ * This is not reference-counted cleanup: callers own the risk of shared keys.
+ */
 export declare const SaveComponentFiles: AttachmentSaver;
+/**
+ * Resolve prepared metadata for field validators; unknown references return undefined.
+ *
+ * @internal
+ */
 export declare const GetAttachmentValidationMetadata: (key: string, storage?: string | undefined) => Promise<FileMetadata | undefined>;
 export {};

package/dist/attachments.js

@@ -2,10 +2,25 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.GetAttachmentValidationMetadata = exports.SaveComponentFiles = exports.internal = void 0;
 const interface_core_1 = require("@antelopejs/interface-core");
+/** @internal */
 var internal;
 (function (internal) {
     internal.SaveTableViewAttachments = (0, interface_core_1.InterfaceFunction)();
 })(internal || (exports.internal = internal = {}));
+/**
+ * Validate native-file provenance, promote staging keys, then save once.
+ * Call after write authorization with the trusted component identity and fields.
+ * Staged retries require trusted provider promotion replay; canonical metadata
+ * is validated before save. Failed saves never move or delete promoted objects:
+ * another save may reference them. Retained objects keep their declared visibility.
+ * Removed files are deleted after successful persistence; cleanup errors are logged.
+ * This is not reference-counted cleanup: callers own the risk of shared keys.
+ */
 exports.SaveComponentFiles = (0, interface_core_1.InterfaceFunction)();
+/**
+ * Resolve prepared metadata for field validators; unknown references return undefined.
+ *
+ * @internal
+ */
 exports.GetAttachmentValidationMetadata = (0, interface_core_1.InterfaceFunction)();
 //# sourceMappingURL=attachments.js.map

package/dist/attachments.js.map

@@ -1 +1 @@
-{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":";;;AACA,+DAA+D;AA4C/D,IAAiB,QAAQ,CAKxB;AALD,WAAiB,QAAQ;IACV,iCAAwB,GACnC,IAAA,kCAAiB,GAEd,CAAC;AACR,CAAC,EALgB,QAAQ,wBAAR,QAAQ,QAKxB;AAgBY,QAAA,kBAAkB,GAC7B,IAAA,kCAAiB,GAAsC,CAAC;AAG7C,QAAA,+BAA+B,GAC1C,IAAA,kCAAiB,GAEd,CAAC"}
+{"version":3,"file":"attachments.js","sourceRoot":"","sources":["../src/attachments.ts"],"names":[],"mappings":";;;AACA,+DAA+D;AAgC/D,gBAAgB;AAChB,IAAiB,QAAQ,CAKxB;AALD,WAAiB,QAAQ;IACV,iCAAwB,GACnC,IAAA,kCAAiB,GAEd,CAAC;AACR,CAAC,EALgB,QAAQ,wBAAR,QAAQ,QAKxB;AAOD;;;;;;;;GAQG;AACU,QAAA,kBAAkB,GAC7B,IAAA,kCAAiB,GAAsC,CAAC;AAE1D;;;;GAIG;AACU,QAAA,+BAA+B,GAC1C,IAAA,kCAAiB,GAEd,CAAC"}

package/dist/auth/db/internal/sessions.model.d.ts

@@ -0,0 +1,9 @@
+import type { Session } from "../tables/sessions.table";
+/** @internal */
+export declare function hashRefreshToken(token: string): string;
+/** @internal */
+export declare function hashesMatch(left: string, right: string): boolean;
+/** @internal */
+export declare const REFRESH_TOKEN_PREDECESSOR_GRACE_MS = 15000;
+/** @internal */
+export declare function isImmediateRefreshTokenPredecessor(session: Session, presentedToken: string, now: Date): boolean;

package/dist/auth/db/internal/sessions.model.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS = void 0;
+exports.hashRefreshToken = hashRefreshToken;
+exports.hashesMatch = hashesMatch;
+exports.isImmediateRefreshTokenPredecessor = isImmediateRefreshTokenPredecessor;
+const node_crypto_1 = require("node:crypto");
+/** @internal */
+function hashRefreshToken(token) {
+    return (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
+}
+/** @internal */
+function hashesMatch(left, right) {
+    const leftBuffer = Buffer.from(left, "hex");
+    const rightBuffer = Buffer.from(right, "hex");
+    return (leftBuffer.length === rightBuffer.length &&
+        (0, node_crypto_1.timingSafeEqual)(leftBuffer, rightBuffer));
+}
+/** @internal */
+exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS = 15_000;
+/** @internal */
+function isImmediateRefreshTokenPredecessor(session, presentedToken, now) {
+    if (!session.previousRefreshTokenHash || !session.refreshTokenRotatedAt) {
+        return false;
+    }
+    const age = now.getTime() - session.refreshTokenRotatedAt.getTime();
+    if (Math.abs(age) > exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS)
+        return false;
+    return hashesMatch(session.previousRefreshTokenHash, hashRefreshToken(presentedToken));
+}
+//# sourceMappingURL=sessions.model.js.map

package/dist/auth/db/internal/sessions.model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.model.js","sourceRoot":"","sources":["../../../../src/auth/db/internal/sessions.model.ts"],"names":[],"mappings":";;;AAIA,4CAEC;AAGD,kCAOC;AAMD,gFAcC;AApCD,6CAA0D;AAG1D,gBAAgB;AAChB,SAAgB,gBAAgB,CAAC,KAAa;IAC5C,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,gBAAgB;AAChB,SAAgB,WAAW,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,IAAA,6BAAe,EAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,gBAAgB;AACH,QAAA,kCAAkC,GAAG,MAAM,CAAC;AAEzD,gBAAgB;AAChB,SAAgB,kCAAkC,CAChD,OAAgB,EAChB,cAAsB,EACtB,GAAS;IAET,IAAI,CAAC,OAAO,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,0CAAkC;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,WAAW,CAChB,OAAO,CAAC,wBAAwB,EAChC,gBAAgB,CAAC,cAAc,CAAC,CACjC,CAAC;AACJ,CAAC"}

package/dist/auth/db/models/sessions.model.d.ts

@@ -1,7 +1,12 @@
 import { Session } from "../tables/sessions.table";
-export declare const REFRESH_TOKEN_PREDECESSOR_GRACE_MS = 15000;
+/**
+ * Whether a presented refresh token is the session's current one.
+ *
+ * @param session The session the token claims
+ * @param presentedToken Token the client presented
+ * @returns True when the token is the session's current refresh token
+ */
 export declare function isCurrentRefreshToken(session: Session, presentedToken: string): boolean;
-export declare function isImmediateRefreshTokenPredecessor(session: Session, presentedToken: string, now: Date): boolean;
 declare const SessionModel_base: {
     new (database: import("@antelopejs/interface-database").SchemaInstance<any>): {
         readonly table: import("@antelopejs/interface-database").Table<Session>;
@@ -21,8 +26,17 @@ declare const SessionModel_base: {
     validate(obj: unknown, options?: import("@antelopejs/interface-database-decorators").ValidateInputOptions): import("@antelopejs/interface-database-decorators").ValidationResult;
 };
 export declare class SessionModel extends SessionModel_base {
+    /** Atomically rotates a token or resolves its immediate predecessor. */
     rotateRefreshToken(sessionId: string, presentedToken: string, refreshToken: string, rotatedAt?: Date): Promise<string | null>;
+    /** Replaces a refresh token without retaining predecessor eligibility. */
     replaceRefreshToken(sessionId: string, refreshToken: string): Promise<void>;
+    /**
+     * Deletes the sessions nobody has used since a date. A session's current
+     * refresh token is issued no later than its last activity, so once that
+     * activity is older than the refresh token lifetime, no token can revive it.
+     *
+     * @param threshold Sessions last active before this date are deleted
+     */
     deleteInactiveSince(threshold: Date): Promise<void>;
     getByUserId(userId: string): Promise<Session[]>;
     deleteByUserId(userId: string): Promise<void>;

package/dist/auth/db/models/sessions.model.js

@@ -1,12 +1,11 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.SessionModel = exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS = void 0;
+exports.SessionModel = void 0;
 exports.isCurrentRefreshToken = isCurrentRefreshToken;
-exports.isImmediateRefreshTokenPredecessor = isImmediateRefreshTokenPredecessor;
 const node_crypto_1 = require("node:crypto");
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const sessions_table_1 = require("../tables/sessions.table");
-exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS = 15_000;
+const sessions_model_1 = require("../internal/sessions.model");
 function updatedRows(result) {
     if (typeof result === "number")
         return result;
@@ -20,15 +19,11 @@ const SEAL_SEPARATOR = ".";
 const SEAL_KEY_DOMAIN = "dms-refresh-successor:";
 const LAST_ACTIVE_AT_INDEX = "lastActiveAt";
 const EPOCH_LOWER_BOUND = new Date(0);
-function hashRefreshToken(token) {
-    return (0, node_crypto_1.createHash)("sha256").update(token).digest("hex");
-}
-function hashesMatch(left, right) {
-    const leftBuffer = Buffer.from(left, "hex");
-    const rightBuffer = Buffer.from(right, "hex");
-    return (leftBuffer.length === rightBuffer.length &&
-        (0, node_crypto_1.timingSafeEqual)(leftBuffer, rightBuffer));
-}
+// The grace window must hand the current token back to a client that still
+// holds its predecessor, so the current token is sealed under a key derived
+// from that predecessor. Only a holder of the predecessor can derive it: the
+// stored `previousRefreshTokenHash` is a hash of the bare token, and the domain
+// prefix keeps the two derivations apart, so the database alone opens nothing.
 function sealKey(predecessor) {
     return (0, node_crypto_1.createHash)("sha256")
         .update(SEAL_KEY_DOMAIN + predecessor)
@@ -60,42 +55,32 @@ function openRefreshToken(sealed, predecessor) {
         return null;
     }
 }
+/**
+ * Whether a presented refresh token is the session's current one.
+ *
+ * @param session The session the token claims
+ * @param presentedToken Token the client presented
+ * @returns True when the token is the session's current refresh token
+ */
 function isCurrentRefreshToken(session, presentedToken) {
-    const presentedHash = hashRefreshToken(presentedToken);
-    if (session.refreshTokenHash) {
-        return hashesMatch(session.refreshTokenHash, presentedHash);
-    }
-    return (!!session.refreshToken &&
-        hashesMatch(hashRefreshToken(session.refreshToken), presentedHash));
-}
-function isImmediateRefreshTokenPredecessor(session, presentedToken, now) {
-    if (!session.previousRefreshTokenHash || !session.refreshTokenRotatedAt) {
-        return false;
-    }
-    const age = now.getTime() - session.refreshTokenRotatedAt.getTime();
-    if (Math.abs(age) > exports.REFRESH_TOKEN_PREDECESSOR_GRACE_MS)
-        return false;
-    return hashesMatch(session.previousRefreshTokenHash, hashRefreshToken(presentedToken));
+    return (!!session.refreshTokenHash &&
+        (0, sessions_model_1.hashesMatch)(session.refreshTokenHash, (0, sessions_model_1.hashRefreshToken)(presentedToken)));
 }
 function recoverSuccessor(session, presentedToken) {
-    if (session.sealedRefreshToken) {
-        return openRefreshToken(session.sealedRefreshToken, presentedToken);
-    }
-    return session.refreshToken || null;
+    if (!session.sealedRefreshToken)
+        return null;
+    return openRefreshToken(session.sealedRefreshToken, presentedToken);
 }
 class SessionModel extends (0, interface_database_decorators_1.BasicDataModel)(sessions_table_1.Session, sessions_table_1.SESSIONS_TABLE_NAME) {
+    /** Atomically rotates a token or resolves its immediate predecessor. */
     async rotateRefreshToken(sessionId, presentedToken, refreshToken, rotatedAt = new Date()) {
         const result = await this.table
             .getAll(sessionId)
-            .filter((row) => row
-            .key("refreshTokenHash")
-            .eq(hashRefreshToken(presentedToken))
-            .or(row.key("refreshToken").eq(presentedToken)))
+            .filter((row) => row.key("refreshTokenHash").eq((0, sessions_model_1.hashRefreshToken)(presentedToken)))
             .update({
-            refreshToken: "",
-            refreshTokenHash: hashRefreshToken(refreshToken),
+            refreshTokenHash: (0, sessions_model_1.hashRefreshToken)(refreshToken),
             sealedRefreshToken: sealRefreshToken(refreshToken, presentedToken),
-            previousRefreshTokenHash: hashRefreshToken(presentedToken),
+            previousRefreshTokenHash: (0, sessions_model_1.hashRefreshToken)(presentedToken),
             refreshTokenRotatedAt: rotatedAt,
             lastActiveAt: rotatedAt,
         })
@@ -104,20 +89,27 @@ class SessionModel extends (0, interface_database_decorators_1.BasicDataModel)(s
             return refreshToken;
         const session = await this.get(sessionId);
         if (!session ||
-            !isImmediateRefreshTokenPredecessor(session, presentedToken, rotatedAt)) {
+            !(0, sessions_model_1.isImmediateRefreshTokenPredecessor)(session, presentedToken, rotatedAt)) {
             return null;
         }
         return recoverSuccessor(session, presentedToken);
     }
+    /** Replaces a refresh token without retaining predecessor eligibility. */
     async replaceRefreshToken(sessionId, refreshToken) {
         await this.update(sessionId, {
-            refreshToken: "",
-            refreshTokenHash: hashRefreshToken(refreshToken),
+            refreshTokenHash: (0, sessions_model_1.hashRefreshToken)(refreshToken),
             sealedRefreshToken: null,
             previousRefreshTokenHash: null,
             refreshTokenRotatedAt: null,
         });
     }
+    /**
+     * Deletes the sessions nobody has used since a date. A session's current
+     * refresh token is issued no later than its last activity, so once that
+     * activity is older than the refresh token lifetime, no token can revive it.
+     *
+     * @param threshold Sessions last active before this date are deleted
+     */
     async deleteInactiveSince(threshold) {
         await this.table
             .between(LAST_ACTIVE_AT_INDEX, EPOCH_LOWER_BOUND, threshold)

package/dist/auth/db/models/sessions.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/sessions.model.ts"],"names":[],"mappings":";;;AAyFA,sDAYC;AAED,gFAcC;AArHD,6CAMqB;AACrB,6FAA2E;AAC3E,6DAAwE;AAE3D,QAAA,kCAAkC,GAAG,MAAM,CAAC;AAOzD,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAkC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEtC,SAAS,gBAAgB,CAAC,KAAa;IACrC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,KAAa;IAC9C,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,CACL,UAAU,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM;QACxC,IAAA,6BAAe,EAAC,UAAU,EAAE,WAAW,CAAC,CACzC,CAAC;AACJ,CAAC;AAOD,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,GAAG,WAAW,CAAC;SACrC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,WAAmB;IAC1D,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC;SACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;SAC3C,IAAI,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,WAAmB;IAC3D,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM;SACrC,KAAK,CAAC,cAAc,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAUD,SAAgB,qBAAqB,CACnC,OAAgB,EAChB,cAAsB;IAEtB,MAAM,aAAa,GAAG,gBAAgB,CAAC,cAAc,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,OAAO,WAAW,CAAC,OAAO,CAAC,gBAAgB,EAAE,aAAa,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,YAAY;QACtB,WAAW,CAAC,gBAAgB,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,CACnE,CAAC;AACJ,CAAC;AAED,SAAgB,kCAAkC,CAChD,OAAgB,EAChB,cAAsB,EACtB,GAAS;IAET,IAAI,CAAC,OAAO,CAAC,wBAAwB,IAAI,CAAC,OAAO,CAAC,qBAAqB,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC,OAAO,EAAE,CAAC;IACpE,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,0CAAkC;QAAE,OAAO,KAAK,CAAC;IACrE,OAAO,WAAW,CAChB,OAAO,CAAC,wBAAwB,EAChC,gBAAgB,CAAC,cAAc,CAAC,CACjC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAgB,EAChB,cAAsB;IAEtB,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,OAAO,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IAED,OAAO,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC;AACtC,CAAC;AAED,MAAa,YAAa,SAAQ,IAAA,8CAAc,EAAC,wBAAO,EAAE,oCAAmB,CAAC;IAE5E,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,cAAsB,EACtB,YAAoB,EACpB,SAAS,GAAG,IAAI,IAAI,EAAE;QAEtB,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,KAAK;aACrC,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,GAAG;aACA,GAAG,CAAC,kBAAkB,CAAC;aACvB,EAAE,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;aACpC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,cAAc,CAAC,CAAC,CAClD;aACA,MAAM,CAAC;YACN,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAChD,kBAAkB,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;YAClE,wBAAwB,EAAE,gBAAgB,CAAC,cAAc,CAAC;YAC1D,qBAAqB,EAAE,SAAS;YAChC,YAAY,EAAE,SAAS;SACxB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IACE,CAAC,OAAO;YACR,CAAC,kCAAkC,CAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,EACvE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAGD,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,YAAoB;QAEpB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;YAC3B,YAAY,EAAE,EAAE;YAChB,gBAAgB,EAAE,gBAAgB,CAAC,YAAY,CAAC;YAChD,kBAAkB,EAAE,IAAI;YACxB,wBAAwB,EAAE,IAAI;YAC9B,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IASD,KAAK,CAAC,mBAAmB,CAAC,SAAe;QACvC,MAAM,IAAI,CAAC,KAAK;aACb,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,SAAS,CAAC;aAC3D,MAAM,EAAE;aACR,GAAG,EAAE,CAAC;IACX,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAClC,CAAC;IACN,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AAnFD,oCAmFC"}
+{"version":3,"file":"sessions.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/sessions.model.ts"],"names":[],"mappings":";;;AA6EA,sDAQC;AArFD,6CAKqB;AACrB,6FAA2E;AAC3E,6DAAwE;AACxE,+DAIoC;AAOpC,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,MAAM,MAAM,GAAG,MAAkC,CAAC;IAClD,OAAO,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,MAAM,EAAE,aAAa,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,cAAc,GAAG,aAAa,CAAC;AACrC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,aAAa,GAAG,QAAQ,CAAC;AAC/B,MAAM,cAAc,GAAG,GAAG,CAAC;AAC3B,MAAM,eAAe,GAAG,wBAAwB,CAAC;AACjD,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAC5C,MAAM,iBAAiB,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AAEtC,2EAA2E;AAC3E,4EAA4E;AAC5E,6EAA6E;AAC7E,gFAAgF;AAChF,+EAA+E;AAC/E,SAAS,OAAO,CAAC,WAAmB;IAClC,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CAAC,eAAe,GAAG,WAAW,CAAC;SACrC,MAAM,EAAE,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,WAAmB;IAC1D,MAAM,EAAE,GAAG,IAAA,yBAAW,EAAC,aAAa,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,IAAA,4BAAc,EAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;IACxE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC7E,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,MAAM,CAAC;SACrC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;SAC3C,IAAI,CAAC,cAAc,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc,EAAE,WAAmB;IAC3D,MAAM,CAAC,EAAE,EAAE,OAAO,EAAE,UAAU,CAAC,GAAG,MAAM;SACrC,KAAK,CAAC,cAAc,CAAC;SACrB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,EAAE,IAAI,CAAC,OAAO,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAChD,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,IAAA,8BAAgB,EAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,OAAO,MAAM,CAAC,MAAM,CAAC;YACnB,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC;YAC3B,QAAQ,CAAC,KAAK,EAAE;SACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,qBAAqB,CACnC,OAAgB,EAChB,cAAsB;IAEtB,OAAO,CACL,CAAC,CAAC,OAAO,CAAC,gBAAgB;QAC1B,IAAA,4BAAW,EAAC,OAAO,CAAC,gBAAgB,EAAE,IAAA,iCAAgB,EAAC,cAAc,CAAC,CAAC,CACxE,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,OAAgB,EAChB,cAAsB;IAEtB,IAAI,CAAC,OAAO,CAAC,kBAAkB;QAAE,OAAO,IAAI,CAAC;IAC7C,OAAO,gBAAgB,CAAC,OAAO,CAAC,kBAAkB,EAAE,cAAc,CAAC,CAAC;AACtE,CAAC;AAED,MAAa,YAAa,SAAQ,IAAA,8CAAc,EAAC,wBAAO,EAAE,oCAAmB,CAAC;IAC5E,wEAAwE;IACxE,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,cAAsB,EACtB,YAAoB,EACpB,SAAS,GAAG,IAAI,IAAI,EAAE;QAEtB,MAAM,MAAM,GAAY,MAAM,IAAI,CAAC,KAAK;aACrC,MAAM,CAAC,SAAS,CAAC;aACjB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CACd,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,EAAE,CAAC,IAAA,iCAAgB,EAAC,cAAc,CAAC,CAAC,CACjE;aACA,MAAM,CAAC;YACN,gBAAgB,EAAE,IAAA,iCAAgB,EAAC,YAAY,CAAC;YAChD,kBAAkB,EAAE,gBAAgB,CAAC,YAAY,EAAE,cAAc,CAAC;YAClE,wBAAwB,EAAE,IAAA,iCAAgB,EAAC,cAAc,CAAC;YAC1D,qBAAqB,EAAE,SAAS;YAChC,YAAY,EAAE,SAAS;SACxB,CAAC;aACD,GAAG,EAAE,CAAC;QACT,IAAI,WAAW,CAAC,MAAM,CAAC,GAAG,CAAC;YAAE,OAAO,YAAY,CAAC;QAEjD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,IACE,CAAC,OAAO;YACR,CAAC,IAAA,mDAAkC,EAAC,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,EACvE,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,gBAAgB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnD,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,mBAAmB,CACvB,SAAiB,EACjB,YAAoB;QAEpB,MAAM,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE;YAC3B,gBAAgB,EAAE,IAAA,iCAAgB,EAAC,YAAY,CAAC;YAChD,kBAAkB,EAAE,IAAI;YACxB,wBAAwB,EAAE,IAAI;YAC9B,qBAAqB,EAAE,IAAI;SAC5B,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,mBAAmB,CAAC,SAAe;QACvC,MAAM,IAAI,CAAC,KAAK;aACb,OAAO,CAAC,oBAAoB,EAAE,iBAAiB,EAAE,SAAS,CAAC;aAC3D,MAAM,EAAE;aACR,GAAG,EAAE,CAAC;IACX,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG;aACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;aACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAClC,CAAC;IACN,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AA9ED,oCA8EC"}

package/dist/auth/db/models/userExternalIdentities.model.d.ts

@@ -1,4 +1,8 @@
 import { UserExternalIdentity } from "../tables/userExternalIdentities.table";
+/**
+ * Deterministic row id of a provider account binding. Being the primary key,
+ * it is what makes the binding unique — see the table's TSDoc.
+ */
 export declare function buildExternalIdentityId(provider: string, providerAccountId: string): string;
 declare const UserExternalIdentityModel_base: {
     new (database: import("@antelopejs/interface-database").SchemaInstance<any>): {
@@ -19,6 +23,13 @@ declare const UserExternalIdentityModel_base: {
     validate(obj: unknown, options?: import("@antelopejs/interface-database-decorators").ValidateInputOptions): import("@antelopejs/interface-database-decorators").ValidationResult;
 };
 export declare class UserExternalIdentityModel extends UserExternalIdentityModel_base {
+    /**
+     * Resolve the identity a provider account is bound to.
+     *
+     * @param provider Provider identifier
+     * @param providerAccountId Account identifier on the provider side
+     * @returns The bound identity, or undefined when the account is unknown
+     */
     getByProviderAccount(provider: string, providerAccountId: string): Promise<UserExternalIdentity | undefined>;
     getByUserId(userId: string): Promise<UserExternalIdentity[]>;
     deleteByUserId(userId: string): Promise<void>;

package/dist/auth/db/models/userExternalIdentities.model.js

@@ -4,10 +4,21 @@ exports.UserExternalIdentityModel = void 0;
 exports.buildExternalIdentityId = buildExternalIdentityId;
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const userExternalIdentities_table_1 = require("../tables/userExternalIdentities.table");
+/**
+ * Deterministic row id of a provider account binding. Being the primary key,
+ * it is what makes the binding unique — see the table's TSDoc.
+ */
 function buildExternalIdentityId(provider, providerAccountId) {
     return `${provider}:${providerAccountId}`;
 }
 class UserExternalIdentityModel extends (0, interface_database_decorators_1.BasicDataModel)(userExternalIdentities_table_1.UserExternalIdentity, userExternalIdentities_table_1.USER_EXTERNAL_IDENTITIES_TABLE_NAME) {
+    /**
+     * Resolve the identity a provider account is bound to.
+     *
+     * @param provider Provider identifier
+     * @param providerAccountId Account identifier on the provider side
+     * @returns The bound identity, or undefined when the account is unknown
+     */
     async getByProviderAccount(provider, providerAccountId) {
         return await this.get(buildExternalIdentityId(provider, providerAccountId));
     }

package/dist/auth/db/models/userExternalIdentities.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"userExternalIdentities.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/userExternalIdentities.model.ts"],"names":[],"mappings":";;;AAUA,0DAKC;AAfD,6FAA2E;AAC3E,yFAGgD;AAMhD,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,iBAAyB;IAEzB,OAAO,GAAG,QAAQ,IAAI,iBAAiB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAa,yBAA0B,SAAQ,IAAA,8CAAc,EAC3D,mDAAoB,EACpB,kEAAmC,CACpC;IAQC,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,IAAI;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAChD,CAAC;IACN,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AApCD,8DAoCC"}
+{"version":3,"file":"userExternalIdentities.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/userExternalIdentities.model.ts"],"names":[],"mappings":";;;AAUA,0DAKC;AAfD,6FAA2E;AAC3E,yFAGgD;AAEhD;;;GAGG;AACH,SAAgB,uBAAuB,CACrC,QAAgB,EAChB,iBAAyB;IAEzB,OAAO,GAAG,QAAQ,IAAI,iBAAiB,EAAE,CAAC;AAC5C,CAAC;AAED,MAAa,yBAA0B,SAAQ,IAAA,8CAAc,EAC3D,mDAAoB,EACpB,kEAAmC,CACpC;IACC;;;;;;OAMG;IACH,KAAK,CAAC,oBAAoB,CACxB,QAAgB,EAChB,iBAAyB;QAEzB,OAAO,MAAM,IAAI,CAAC,GAAG,CAAC,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9E,CAAC;IAED,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CACb,IAAI;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;aACzD,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,KAAK,SAAS,CAAC,CAChD,CAAC;IACN,CAAC;IAED,cAAc,CAAC,MAAc;QAC3B,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC;aACxB,MAAM,EAAE;aACR,GAAG,EAAE;aACL,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC3B,CAAC;CACF;AApCD,8DAoCC"}

package/dist/auth/db/models/users.model.d.ts

@@ -1,4 +1,11 @@
 import { User } from "../tables/users.table";
+/**
+ * Canonical form of an e-mail address as stored and looked up: accounts are
+ * written lowercased, so a lookup must not depend on the caller's casing.
+ *
+ * @param email The e-mail as typed
+ * @returns The trimmed, lowercased e-mail
+ */
 export declare function normalizeEmail(email: string): string;
 declare const UserModel_base: {
     new (database: import("@antelopejs/interface-database").SchemaInstance<any>): {
@@ -19,6 +26,12 @@ declare const UserModel_base: {
     validate(obj: unknown, options?: import("@antelopejs/interface-database-decorators").ValidateInputOptions): import("@antelopejs/interface-database-decorators").ValidationResult;
 };
 export declare class UserModel extends UserModel_base {
+    /**
+     * Get the user by their email
+     *
+     * @param email The email of the user
+     * @returns The user or undefined if not found
+     */
     getByEmail(email: string): Promise<User | undefined>;
     getOwners(): Promise<User[]>;
     countOwnersExcluding(excludedIds: string[]): Promise<number>;

package/dist/auth/db/models/users.model.js

@@ -5,10 +5,23 @@ exports.normalizeEmail = normalizeEmail;
 const interface_database_1 = require("@antelopejs/interface-database");
 const interface_database_decorators_1 = require("@antelopejs/interface-database-decorators");
 const users_table_1 = require("../tables/users.table");
+/**
+ * Canonical form of an e-mail address as stored and looked up: accounts are
+ * written lowercased, so a lookup must not depend on the caller's casing.
+ *
+ * @param email The e-mail as typed
+ * @returns The trimmed, lowercased e-mail
+ */
 function normalizeEmail(email) {
     return email.trim().toLowerCase();
 }
 class UserModel extends (0, interface_database_decorators_1.BasicDataModel)(users_table_1.User, users_table_1.USERS_TABLE_NAME) {
+    /**
+     * Get the user by their email
+     *
+     * @param email The email of the user
+     * @returns The user or undefined if not found
+     */
     getByEmail(email) {
         return this.table
             .getAll(normalizeEmail(email), "email")

package/dist/auth/db/models/users.model.js.map

@@ -1 +1 @@
-{"version":3,"file":"users.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/users.model.ts"],"names":[],"mappings":";;;AAWA,wCAEC;AAbD,uEAA4D;AAC5D,6FAA2E;AAC3E,uDAA+D;AAS/D,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAa,SAAU,SAAQ,IAAA,8CAAc,EAAC,kBAAI,EAAE,8BAAgB,CAAC;IAOnE,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC;aACN,OAAO,CAAC,SAAS,CAAC;aAClB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,MAAM,IAAI,CAAC,KAAK;aACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC3C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAqB;QAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK;iBACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;iBAC5C,KAAK,EAAE;iBACP,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI;aACD,GAAG,CAAC,OAAO,CAAC;aACZ,EAAE,CAAC,IAAI,CAAC;aACR,GAAG,CACF,+BAAU,CAAC,QAAQ,CAAW,WAAW,CAAC;aACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;aACzB,GAAG,EAAE,CACT,CACJ;aACA,KAAK,EAAE;aACP,GAAG,EAAE,CAAC;IACX,CAAC;CACF;AAhDD,8BAgDC"}
+{"version":3,"file":"users.model.js","sourceRoot":"","sources":["../../../../src/auth/db/models/users.model.ts"],"names":[],"mappings":";;;AAWA,wCAEC;AAbD,uEAA4D;AAC5D,6FAA2E;AAC3E,uDAA+D;AAE/D;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAa,SAAU,SAAQ,IAAA,8CAAc,EAAC,kBAAI,EAAE,8BAAgB,CAAC;IACnE;;;;;OAKG;IACH,UAAU,CAAC,KAAa;QACtB,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;aACtC,GAAG,CAAC,CAAC,CAAC;aACN,OAAO,CAAC,SAAS,CAAC;aAClB,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,SAAS;QACb,OAAO,MAAM,IAAI,CAAC,KAAK;aACpB,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;aAC5C,GAAG,EAAE;aACL,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CACZ,GAAG;aACA,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;aAC3C,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC,CACxC,CAAC;IACN,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,WAAqB;QAC9C,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO,IAAI,CAAC,KAAK;iBACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;iBAC5C,KAAK,EAAE;iBACP,GAAG,EAAE,CAAC;QACX,CAAC;QACD,OAAO,IAAI,CAAC,KAAK;aACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CACf,IAAI;aACD,GAAG,CAAC,OAAO,CAAC;aACZ,EAAE,CAAC,IAAI,CAAC;aACR,GAAG,CACF,+BAAU,CAAC,QAAQ,CAAW,WAAW,CAAC;aACvC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;aACzB,GAAG,EAAE,CACT,CACJ;aACA,KAAK,EAAE;aACP,GAAG,EAAE,CAAC;IACX,CAAC;CACF;AAhDD,8BAgDC"}

package/dist/auth/db/tables/sessions.table.d.ts

@@ -3,8 +3,13 @@ export declare const SESSIONS_TABLE_NAME = "sessions";
 export declare class Session extends Table {
     _id: string;
     userId: string;
-    refreshToken: string;
+    /** sha256 of the current refresh token: the token itself is never stored. */
     refreshTokenHash?: string | null;
+    /**
+     * The current refresh token sealed under a key only its predecessor
+     * derives, so the rotation grace window can hand it back to a client that
+     * still holds the predecessor without the token being readable at rest.
+     */
     sealedRefreshToken?: string | null;
     previousRefreshTokenHash?: string | null;
     refreshTokenRotatedAt?: Date | null;

package/dist/auth/db/tables/sessions.table.js

@@ -27,10 +27,6 @@ __decorate([
     (0, interface_database_decorators_1.Relation)({ to: () => users_table_1.User }),
     __metadata("design:type", String)
 ], Session.prototype, "userId", void 0);
-__decorate([
-    (0, interface_database_decorators_1.Field)("string"),
-    __metadata("design:type", String)
-], Session.prototype, "refreshToken", void 0);
 __decorate([
     (0, interface_database_decorators_1.Field)("string"),
     __metadata("design:type", Object)

package/dist/auth/db/tables/sessions.table.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/sessions.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FAOmD;AACnD,kDAAsD;AACtD,+CAAqC;AAExB,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAGvC,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,qCAAK;CA+DjC,CAAA;AA/DY,0BAAO;AAEV;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;oCACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;IACf,IAAA,wCAAQ,EAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,kBAAI,EAAE,CAAC;;uCACN;AAUf;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;6CACa;AAIrB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDACyB;AAQjC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mDAC2B;AAGnC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;yDACiC;AAGzC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;sDAC8B;AAGpC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;0CACU;AAGlB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACG;AAGX;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;wCACQ;AAGhB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACG;AAGX;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;2CACW;AAGnB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;yCACS;AAKjB;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;0CAAC;AAIhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACQ,IAAI;6CAAC;kBA9DhB,OAAO;IADnB,IAAA,6CAAa,EAAC,2BAAmB,EAAE,4BAAgB,CAAC;GACxC,OAAO,CA+DnB"}
+{"version":3,"file":"sessions.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/sessions.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FAOmD;AACnD,kDAAsD;AACtD,+CAAqC;AAExB,QAAA,mBAAmB,GAAG,UAAU,CAAC;AAGvC,IAAM,OAAO,GAAb,MAAM,OAAQ,SAAQ,qCAAK;CAqDjC,CAAA;AArDY,0BAAO;AAEV;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;oCACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;IACf,IAAA,wCAAQ,EAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,kBAAI,EAAE,CAAC;;uCACN;AAIf;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDACyB;AAQjC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mDAC2B;AAGnC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;yDACiC;AAGzC;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;;sDAC8B;AAGpC;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;0CACU;AAGlB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACG;AAGX;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;wCACQ;AAGhB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mCACG;AAGX;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;2CACW;AAGnB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;yCACS;AAKjB;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;0CAAC;AAIhB;IAFP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACQ,IAAI;6CAAC;kBApDhB,OAAO;IADnB,IAAA,6CAAa,EAAC,2BAAmB,EAAE,4BAAgB,CAAC;GACxC,OAAO,CAqDnB"}

package/dist/auth/db/tables/userExternalIdentities.table.d.ts

@@ -1,10 +1,34 @@
 import { Table } from "@antelopejs/interface-database-decorators";
 export declare const USER_EXTERNAL_IDENTITIES_TABLE_NAME = "user_external_identities";
+/**
+ * An identity a user owns on an external login provider (GitHub, Google, ...).
+ *
+ * The row id is the deterministic `<provider>:<providerAccountId>`, so the
+ * primary key is what guarantees one row per provider account — the schema
+ * layer offers no unique secondary index, and concurrent logins for the same
+ * account must collide instead of duplicating (same pattern as
+ * `TenantMember`).
+ *
+ * Scoped to authentication only: integrations that connect a provider for
+ * product features (repository access, deployments) own their own storage and
+ * must never be inferred from this table.
+ */
 export declare class UserExternalIdentity extends Table {
     _id: string;
     userId: string;
+    /**
+     * Provider identifier, as declared in the instance OAuth configuration.
+     */
     provider: string;
+    /**
+     * Immutable account identifier on the provider side. Never the e-mail: users
+     * change their provider e-mail without changing account.
+     */
     providerAccountId: string;
+    /**
+     * E-mail reported by the provider at the last successful login, kept for
+     * support and audit only. Account resolution never reads it back.
+     */
     email: string;
     createdAt: Date;
     lastLoginAt: Date;

package/dist/auth/db/tables/userExternalIdentities.table.js

@@ -14,6 +14,19 @@ const interface_database_decorators_1 = require("@antelopejs/interface-database-
 const constants_1 = require("../../../constants");
 const users_table_1 = require("./users.table");
 exports.USER_EXTERNAL_IDENTITIES_TABLE_NAME = "user_external_identities";
+/**
+ * An identity a user owns on an external login provider (GitHub, Google, ...).
+ *
+ * The row id is the deterministic `<provider>:<providerAccountId>`, so the
+ * primary key is what guarantees one row per provider account — the schema
+ * layer offers no unique secondary index, and concurrent logins for the same
+ * account must collide instead of duplicating (same pattern as
+ * `TenantMember`).
+ *
+ * Scoped to authentication only: integrations that connect a provider for
+ * product features (repository access, deployments) own their own storage and
+ * must never be inferred from this table.
+ */
 let UserExternalIdentity = class UserExternalIdentity extends interface_database_decorators_1.Table {
 };
 exports.UserExternalIdentity = UserExternalIdentity;

package/dist/auth/db/tables/userExternalIdentities.table.js.map

@@ -1 +1 @@
-{"version":3,"file":"userExternalIdentities.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/userExternalIdentities.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FAOmD;AACnD,kDAAsD;AACtD,+CAAqC;AAExB,QAAA,mCAAmC,GAAG,0BAA0B,CAAC;AAgBvE,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qCAAK;CAoC9C,CAAA;AApCY,oDAAoB;AAEvB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;IACf,IAAA,wCAAQ,EAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,kBAAI,EAAE,CAAC;;oDACN;AAMf;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sDACS;AAOjB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;+DACkB;AAO1B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mDACM;AAKd;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uDAAC;AAGhB;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACO,IAAI;yDAAC;+BAnCf,oBAAoB;IADhC,IAAA,6CAAa,EAAC,2CAAmC,EAAE,4BAAgB,CAAC;GACxD,oBAAoB,CAoChC"}
+{"version":3,"file":"userExternalIdentities.table.js","sourceRoot":"","sources":["../../../../src/auth/db/tables/userExternalIdentities.table.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6FAOmD;AACnD,kDAAsD;AACtD,+CAAqC;AAExB,QAAA,mCAAmC,GAAG,0BAA0B,CAAC;AAE9E;;;;;;;;;;;;GAYG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,qCAAK;CAoC9C,CAAA;AApCY,oDAAoB;AAEvB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;iDACI;AAKZ;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,qCAAK,EAAC,QAAQ,CAAC;IACf,IAAA,wCAAQ,EAAC,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,kBAAI,EAAE,CAAC;;oDACN;AAMf;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;sDACS;AAOjB;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;+DACkB;AAO1B;IADP,IAAA,qCAAK,EAAC,QAAQ,CAAC;;mDACM;AAKd;IAHP,IAAA,qCAAK,GAAE;IACP,IAAA,4CAAY,GAAE;IACd,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACK,IAAI;uDAAC;AAGhB;IADP,IAAA,qCAAK,EAAC,MAAM,CAAC;8BACO,IAAI;yDAAC;+BAnCf,oBAAoB;IADhC,IAAA,6CAAa,EAAC,2CAAmC,EAAE,4BAAgB,CAAC;GACxD,oBAAoB,CAoChC"}