@bevel-software/platform-core-backend 0.1.0 → 0.2.0

package/dist/modules/auth/oidc-auth-provider.js

@@ -0,0 +1,189 @@
+import { createHash, randomBytes } from 'node:crypto';
+import { AUTH_COOKIE_MAX_AGE_S } from './auth.routes.js';
+import { AUTH_COOKIE_NAME } from './auth.middleware.js';
+// Short-lived CSRF state + PKCE verifier for the OAuth round-trip: set before
+// redirecting to the provider, verified/consumed on callback.
+const OAUTH_STATE_COOKIE = 'oidc_oauth_state';
+const OAUTH_STATE_MAX_AGE_S = 10 * 60;
+/** Read one named cookie from the raw header (no cookie-parser dep, matching auth.middleware). */
+function readCookie(req, name) {
+    const header = req.headers.cookie;
+    if (!header)
+        return null;
+    for (const segment of header.split(';')) {
+        const trimmed = segment.trim();
+        if (!trimmed.startsWith(`${name}=`))
+            continue;
+        const value = trimmed.slice(name.length + 1);
+        if (!value)
+            return null;
+        try {
+            return decodeURIComponent(value);
+        }
+        catch {
+            return value;
+        }
+    }
+    return null;
+}
+/**
+ * Generic OIDC single sign-on as an {@link AuthProviderPlugin} — works with
+ * any spec-compliant provider (Entra, Okta, Auth0, Keycloak, Google, …),
+ * configured purely from the environment (see CoreConfig `oidc*`).
+ *
+ * Flow: authorization-code with PKCE (S256) as a confidential client.
+ * Identity claims come from the `userinfo` endpoint called with the freshly
+ * exchanged access token — the token arrived over TLS directly from the
+ * issuer's token endpoint, so no local id_token signature verification (and
+ * no JWKS handling) is needed to trust it.
+ *
+ * Register `<PUBLIC_BACKEND_URL>/api/auth/oidc/callback` as the redirect URI
+ * with the provider.
+ */
+export class OidcAuthProvider {
+    opts;
+    key = 'oidc';
+    label;
+    startPath = '/api/auth/oidc/login';
+    fetchImpl;
+    discovery = null;
+    constructor(opts) {
+        this.opts = opts;
+        this.label = opts.label;
+        this.fetchImpl = opts.fetchImpl ?? fetch;
+    }
+    /**
+     * Fetch + cache the issuer's discovery document. Resolved lazily (not at
+     * boot) so a temporarily unreachable issuer delays the first login instead
+     * of failing the whole deployment; a failed attempt is not cached.
+     */
+    async discover() {
+        if (this.discovery)
+            return this.discovery;
+        const url = `${this.opts.issuerUrl}/.well-known/openid-configuration`;
+        const res = await this.fetchImpl(url);
+        if (!res.ok)
+            throw new Error(`OIDC discovery failed: ${res.status} ${url}`);
+        const doc = (await res.json());
+        if (!doc.authorization_endpoint || !doc.token_endpoint || !doc.userinfo_endpoint) {
+            throw new Error('OIDC discovery document is missing required endpoints');
+        }
+        this.discovery = {
+            authorization_endpoint: doc.authorization_endpoint,
+            token_endpoint: doc.token_endpoint,
+            userinfo_endpoint: doc.userinfo_endpoint,
+        };
+        return this.discovery;
+    }
+    redirectUri() {
+        return `${this.opts.publicBackendUrl}/api/auth/oidc/callback`;
+    }
+    mountRoutes(router, authService) {
+        const { publicFrontendUrl, cookieSecure } = this.opts;
+        // GET /api/auth/oidc/login — start the round-trip: mint state + PKCE
+        // verifier (both in one short-lived HttpOnly cookie), redirect to the
+        // provider's authorization endpoint.
+        router.get('/auth/oidc/login', async (_req, res) => {
+            try {
+                const discovery = await this.discover();
+                const state = randomBytes(16).toString('hex');
+                const verifier = randomBytes(32).toString('base64url');
+                const challenge = createHash('sha256').update(verifier).digest('base64url');
+                res.cookie(OAUTH_STATE_COOKIE, `${state}.${verifier}`, {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    secure: cookieSecure,
+                    maxAge: OAUTH_STATE_MAX_AGE_S * 1000,
+                    path: '/',
+                });
+                const url = new URL(discovery.authorization_endpoint);
+                url.searchParams.set('response_type', 'code');
+                url.searchParams.set('client_id', this.opts.clientId);
+                url.searchParams.set('redirect_uri', this.redirectUri());
+                url.searchParams.set('scope', this.opts.scopes);
+                url.searchParams.set('state', state);
+                url.searchParams.set('code_challenge', challenge);
+                url.searchParams.set('code_challenge_method', 'S256');
+                res.redirect(url.toString());
+            }
+            catch (error) {
+                console.error('OIDC start error:', error instanceof Error ? error.message : error);
+                res.redirect(`${publicFrontendUrl}/auth/oidc/callback#error=start`);
+            }
+        });
+        // GET /api/auth/oidc/callback — verify state, exchange the code (PKCE +
+        // client secret), read identity from userinfo, issue the app JWT, and hand
+        // it to the frontend in the URL fragment (kept out of query/logs/Referer).
+        router.get('/auth/oidc/callback', async (req, res) => {
+            const fail = (reason) => res.redirect(`${publicFrontendUrl}/auth/oidc/callback#error=${reason}`);
+            try {
+                const { code, state } = req.query;
+                const cookie = readCookie(req, OAUTH_STATE_COOKIE);
+                res.clearCookie(OAUTH_STATE_COOKIE, { path: '/' });
+                const [expectedState, verifier] = cookie?.split('.') ?? [];
+                if (!code || !state || !expectedState || !verifier || state !== expectedState) {
+                    fail('state');
+                    return;
+                }
+                const discovery = await this.discover();
+                const basic = Buffer.from(`${encodeURIComponent(this.opts.clientId)}:${encodeURIComponent(this.opts.clientSecret)}`, 'utf8').toString('base64');
+                const tokenRes = await this.fetchImpl(discovery.token_endpoint, {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/x-www-form-urlencoded',
+                        Authorization: `Basic ${basic}`,
+                    },
+                    body: new URLSearchParams({
+                        grant_type: 'authorization_code',
+                        code,
+                        redirect_uri: this.redirectUri(),
+                        code_verifier: verifier,
+                    }).toString(),
+                });
+                if (!tokenRes.ok) {
+                    console.error('OIDC token exchange failed:', tokenRes.status, await tokenRes.text().catch(() => ''));
+                    fail('auth');
+                    return;
+                }
+                const tokens = (await tokenRes.json());
+                if (!tokens.access_token) {
+                    fail('auth');
+                    return;
+                }
+                const infoRes = await this.fetchImpl(discovery.userinfo_endpoint, {
+                    headers: { Authorization: `Bearer ${tokens.access_token}` },
+                });
+                if (!infoRes.ok) {
+                    console.error('OIDC userinfo failed:', infoRes.status);
+                    fail('auth');
+                    return;
+                }
+                const claims = (await infoRes.json());
+                if (!claims.email) {
+                    // Most likely a missing `email` scope / claim mapping at the provider.
+                    console.error('OIDC userinfo returned no email claim');
+                    fail('auth');
+                    return;
+                }
+                const name = claims.name ??
+                    [claims.given_name, claims.family_name].filter(Boolean).join(' ').trim() ??
+                    claims.preferred_username ??
+                    '';
+                const { token } = await authService.loginWithSso(claims.email, name);
+                res.cookie(AUTH_COOKIE_NAME, token, {
+                    httpOnly: true,
+                    sameSite: 'lax',
+                    secure: cookieSecure,
+                    maxAge: AUTH_COOKIE_MAX_AGE_S * 1000,
+                    path: '/',
+                });
+                res.redirect(`${publicFrontendUrl}/auth/oidc/callback#token=${encodeURIComponent(token)}`);
+            }
+            catch (error) {
+                console.error('OIDC callback error:', error instanceof Error ? error.message : error);
+                fail('auth');
+            }
+        });
+    }
+}
+//# sourceMappingURL=oidc-auth-provider.js.map

package/dist/modules/auth/oidc-auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-auth-provider.js","sourceRoot":"","sources":["../../../src/modules/auth/oidc-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGtD,OAAO,EAAE,qBAAqB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,8EAA8E;AAC9E,8DAA8D;AAC9D,MAAM,kBAAkB,GAAG,kBAAkB,CAAC;AAC9C,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AA0BtC,kGAAkG;AAClG,SAAS,UAAU,CAAC,GAAoB,EAAE,IAAY;IACpD,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC;IAClC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,IAAI,GAAG,CAAC;YAAE,SAAS;QAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,OAAO,gBAAgB;IAQE;IAPpB,GAAG,GAAG,MAAM,CAAC;IACb,KAAK,CAAS;IACd,SAAS,GAAG,sBAAsB,CAAC;IAE3B,SAAS,CAAe;IACjC,SAAS,GAAyB,IAAI,CAAC;IAE/C,YAA6B,IAA6B;QAA7B,SAAI,GAAJ,IAAI,CAAyB;QACxD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,QAAQ;QACpB,IAAI,IAAI,CAAC,SAAS;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,mCAAmC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5E,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;QACzD,IAAI,CAAC,GAAG,CAAC,sBAAsB,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,CAAC,GAAG,CAAC,iBAAiB,EAAE,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,CAAC,SAAS,GAAG;YACf,sBAAsB,EAAE,GAAG,CAAC,sBAAsB;YAClD,cAAc,EAAE,GAAG,CAAC,cAAc;YAClC,iBAAiB,EAAE,GAAG,CAAC,iBAAiB;SACzC,CAAC;QACF,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAEO,WAAW;QACjB,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,gBAAgB,yBAAyB,CAAC;IAChE,CAAC;IAED,WAAW,CAAC,MAAsB,EAAE,WAAwB;QAC1D,MAAM,EAAE,iBAAiB,EAAE,YAAY,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;QAEtD,qEAAqE;QACrE,sEAAsE;QACtE,qCAAqC;QACrC,MAAM,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE;YACjD,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;gBAC9C,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;gBACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBAC5E,GAAG,CAAC,MAAM,CAAC,kBAAkB,EAAE,GAAG,KAAK,IAAI,QAAQ,EAAE,EAAE;oBACrD,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,sBAAsB,CAAC,CAAC;gBACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;gBAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;gBACtD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;gBAChD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;gBAClD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;gBACtD,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACnF,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,iCAAiC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,wEAAwE;QACxE,2EAA2E;QAC3E,2EAA2E;QAC3E,MAAM,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,EAAE,CAC9B,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,MAAM,EAAE,CAAC,CAAC;YAC1E,IAAI,CAAC;gBACH,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,GAAG,CAAC,KAA0C,CAAC;gBACvE,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACnD,GAAG,CAAC,WAAW,CAAC,kBAAkB,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBACnD,MAAM,CAAC,aAAa,EAAE,QAAQ,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC3D,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBAC9E,IAAI,CAAC,OAAO,CAAC,CAAC;oBACd,OAAO;gBACT,CAAC;gBAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CACvB,GAAG,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,EACzF,MAAM,CACP,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACrB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE;oBAC9D,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE;wBACP,cAAc,EAAE,mCAAmC;wBACnD,aAAa,EAAE,SAAS,KAAK,EAAE;qBAChC;oBACD,IAAI,EAAE,IAAI,eAAe,CAAC;wBACxB,UAAU,EAAE,oBAAoB;wBAChC,IAAI;wBACJ,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE;wBAChC,aAAa,EAAE,QAAQ;qBACxB,CAAC,CAAC,QAAQ,EAAE;iBACd,CAAC,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;oBACjB,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;oBACrG,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;gBACpE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;oBACzB,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,iBAAiB,EAAE;oBAChE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE;iBAC5D,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;oBAChB,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;oBACvD,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,MAAM,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,EAAE,CAMnC,CAAC;gBACF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;oBAClB,uEAAuE;oBACvE,OAAO,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;oBACvD,IAAI,CAAC,MAAM,CAAC,CAAC;oBACb,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GACR,MAAM,CAAC,IAAI;oBACX,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE;oBACxE,MAAM,CAAC,kBAAkB;oBACzB,EAAE,CAAC;gBAEL,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,WAAW,CAAC,YAAY,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;gBACrE,GAAG,CAAC,MAAM,CAAC,gBAAgB,EAAE,KAAK,EAAE;oBAClC,QAAQ,EAAE,IAAI;oBACd,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,YAAY;oBACpB,MAAM,EAAE,qBAAqB,GAAG,IAAI;oBACpC,IAAI,EAAE,GAAG;iBACV,CAAC,CAAC;gBACH,GAAG,CAAC,QAAQ,CAAC,GAAG,iBAAiB,6BAA6B,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC7F,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,OAAO,CAAC,KAAK,CAAC,sBAAsB,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;gBACtF,IAAI,CAAC,MAAM,CAAC,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/modules/auth/password-hash.d.ts

@@ -0,0 +1,12 @@
+/** Guard rail surfaced by the routes as a 400 — not a silent truncation. */
+export declare const MIN_PASSWORD_LENGTH = 8;
+export declare function hashPassword(password: string): Promise<string>;
+/** Constant-time verify of `password` against a stored {@link hashPassword} string. */
+export declare function verifyPassword(password: string, stored: string): Promise<boolean>;
+/**
+ * Constant-time comparison of two plaintext secrets (the env bootstrap-admin
+ * check). Pads to a common length so a length mismatch doesn't return early
+ * and leak the expected secret's length via timing.
+ */
+export declare function timingSafeStringEqual(provided: string, expected: string): boolean;
+//# sourceMappingURL=password-hash.d.ts.map

package/dist/modules/auth/password-hash.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/password-hash.ts"],"names":[],"mappings":"AAkBA,4EAA4E;AAC5E,eAAO,MAAM,mBAAmB,IAAI,CAAC;AAoBrC,wBAAsB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAIpE;AAED,uFAAuF;AACvF,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAiBvF;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CASjF"}

package/dist/modules/auth/password-hash.js

@@ -0,0 +1,67 @@
+import { randomBytes, scrypt, timingSafeEqual } from 'node:crypto';
+/**
+ * Password hashing for per-user accounts: scrypt via node:crypto — memory-hard
+ * (unlike sha/hmac), built in (no native bcrypt/argon dependency), async so a
+ * login burst doesn't block the event loop.
+ *
+ * Stored format: `scrypt:N=<cost>,r=<block>,p=<par>:<salt b64url>:<key b64url>`
+ * — parameters travel with the hash, so costs can be raised later while old
+ * hashes keep verifying (and get re-hashed on next successful login/change).
+ */
+const SCRYPT_N = 16384;
+const SCRYPT_R = 8;
+const SCRYPT_P = 1;
+const KEY_LEN = 32;
+const SALT_LEN = 16;
+/** Guard rail surfaced by the routes as a 400 — not a silent truncation. */
+export const MIN_PASSWORD_LENGTH = 8;
+function scryptAsync(password, salt, params) {
+    return new Promise((resolve, reject) => {
+        scrypt(password, salt, KEY_LEN, 
+        // maxmem must accommodate 128*N*r bytes; default (32 MiB) is exactly at
+        // the boundary for N=16384,r=8 — give it headroom.
+        { N: params.N, r: params.r, p: params.p, maxmem: 128 * params.N * params.r * 2 }, (err, key) => (err ? reject(err) : resolve(key)));
+    });
+}
+export async function hashPassword(password) {
+    const salt = randomBytes(SALT_LEN);
+    const key = await scryptAsync(password, salt, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P });
+    return `scrypt:N=${SCRYPT_N},r=${SCRYPT_R},p=${SCRYPT_P}:${salt.toString('base64url')}:${key.toString('base64url')}`;
+}
+/** Constant-time verify of `password` against a stored {@link hashPassword} string. */
+export async function verifyPassword(password, stored) {
+    const match = /^scrypt:N=(\d+),r=(\d+),p=(\d+):([A-Za-z0-9_-]+):([A-Za-z0-9_-]+)$/.exec(stored);
+    if (!match)
+        return false;
+    const [, n, r, p, saltB64, keyB64] = match;
+    const salt = Buffer.from(saltB64, 'base64url');
+    const expected = Buffer.from(keyB64, 'base64url');
+    try {
+        const actual = await scryptAsync(password, salt, {
+            N: Number(n),
+            r: Number(r),
+            p: Number(p),
+        });
+        return actual.length === expected.length && timingSafeEqual(actual, expected);
+    }
+    catch {
+        // Absurd parameters (corrupted row / DoS-shaped input) — fail closed.
+        return false;
+    }
+}
+/**
+ * Constant-time comparison of two plaintext secrets (the env bootstrap-admin
+ * check). Pads to a common length so a length mismatch doesn't return early
+ * and leak the expected secret's length via timing.
+ */
+export function timingSafeStringEqual(provided, expected) {
+    const a = Buffer.from(provided, 'utf8');
+    const b = Buffer.from(expected, 'utf8');
+    const len = Math.max(a.length, b.length, 1);
+    const aPadded = Buffer.alloc(len);
+    const bPadded = Buffer.alloc(len);
+    a.copy(aPadded);
+    b.copy(bPadded);
+    return timingSafeEqual(aPadded, bPadded) && a.length === b.length;
+}
+//# sourceMappingURL=password-hash.js.map

package/dist/modules/auth/password-hash.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-hash.js","sourceRoot":"","sources":["../../../src/modules/auth/password-hash.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE;;;;;;;;GAQG;AAEH,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,OAAO,GAAG,EAAE,CAAC;AACnB,MAAM,QAAQ,GAAG,EAAE,CAAC;AAEpB,4EAA4E;AAC5E,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAErC,SAAS,WAAW,CAClB,QAAgB,EAChB,IAAY,EACZ,MAA2C;IAE3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,QAAQ,EACR,IAAI,EACJ,OAAO;QACP,wEAAwE;QACxE,mDAAmD;QACnD,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,GAAG,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,GAAG,CAAC,EAAE,EAChF,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CACjD,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,QAAgB;IACjD,MAAM,IAAI,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACzF,OAAO,YAAY,QAAQ,MAAM,QAAQ,MAAM,QAAQ,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AACvH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,MAAc;IACnE,MAAM,KAAK,GAAG,oEAAoE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChG,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,KAAK,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAClD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE;YAC/C,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACZ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;SACb,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;IAChF,CAAC;IAAC,MAAM,CAAC;QACP,sEAAsE;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,QAAgB,EAAE,QAAgB;IACtE,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChB,OAAO,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;AACpE,CAAC"}

package/dist/modules/auth/rate-limit.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Tiny fixed-window in-memory rate limiter for the password endpoints —
+ * brute-force / scrypt-DoS protection, not traffic shaping. In-memory is the
+ * right scope for the single-instance deployment model (same assumption as
+ * the MCP session store); a multi-replica future moves this behind a shared
+ * store.
+ *
+ * Expired windows are pruned opportunistically on each hit so the map stays
+ * bounded by the number of DISTINCT active keys per window.
+ */
+export declare class FixedWindowRateLimiter {
+    /** Attempts allowed per window per key. */
+    private readonly max;
+    private readonly windowMs;
+    /** Injectable clock for tests. */
+    private readonly now;
+    private readonly hits;
+    constructor(
+    /** Attempts allowed per window per key. */
+    max: number, windowMs: number, 
+    /** Injectable clock for tests. */
+    now?: () => number);
+    /**
+     * Record one attempt for `key`; returns true when the attempt is ALLOWED
+     * (i.e. the key is within its budget for the current window).
+     */
+    consume(key: string): boolean;
+    /** Clear a key's window — called after a SUCCESSFUL login so legitimate
+     * users who fumbled a few attempts aren't locked out of their next visit. */
+    reset(key: string): void;
+}
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/modules/auth/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,qBAAa,sBAAsB;IAI/B,2CAA2C;IAC3C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,kCAAkC;IAClC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAPtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAyD;;IAG5E,2CAA2C;IAC1B,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM;IACjC,kCAAkC;IACjB,GAAG,GAAE,MAAM,MAAiB;IAG/C;;;OAGG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAc7B;iFAC6E;IAC7E,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGzB"}

package/dist/modules/auth/rate-limit.js

@@ -0,0 +1,49 @@
+/**
+ * Tiny fixed-window in-memory rate limiter for the password endpoints —
+ * brute-force / scrypt-DoS protection, not traffic shaping. In-memory is the
+ * right scope for the single-instance deployment model (same assumption as
+ * the MCP session store); a multi-replica future moves this behind a shared
+ * store.
+ *
+ * Expired windows are pruned opportunistically on each hit so the map stays
+ * bounded by the number of DISTINCT active keys per window.
+ */
+export class FixedWindowRateLimiter {
+    max;
+    windowMs;
+    now;
+    hits = new Map();
+    constructor(
+    /** Attempts allowed per window per key. */
+    max, windowMs, 
+    /** Injectable clock for tests. */
+    now = Date.now) {
+        this.max = max;
+        this.windowMs = windowMs;
+        this.now = now;
+    }
+    /**
+     * Record one attempt for `key`; returns true when the attempt is ALLOWED
+     * (i.e. the key is within its budget for the current window).
+     */
+    consume(key) {
+        const now = this.now();
+        for (const [k, entry] of this.hits) {
+            if (entry.resetAt <= now)
+                this.hits.delete(k);
+        }
+        const entry = this.hits.get(key);
+        if (!entry || entry.resetAt <= now) {
+            this.hits.set(key, { count: 1, resetAt: now + this.windowMs });
+            return true;
+        }
+        entry.count += 1;
+        return entry.count <= this.max;
+    }
+    /** Clear a key's window — called after a SUCCESSFUL login so legitimate
+     * users who fumbled a few attempts aren't locked out of their next visit. */
+    reset(key) {
+        this.hits.delete(key);
+    }
+}
+//# sourceMappingURL=rate-limit.js.map

package/dist/modules/auth/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.js","sourceRoot":"","sources":["../../../src/modules/auth/rate-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,OAAO,sBAAsB;IAKd;IACA;IAEA;IAPF,IAAI,GAAG,IAAI,GAAG,EAA8C,CAAC;IAE9E;IACE,2CAA2C;IAC1B,GAAW,EACX,QAAgB;IACjC,kCAAkC;IACjB,MAAoB,IAAI,CAAC,GAAG;QAH5B,QAAG,GAAH,GAAG,CAAQ;QACX,aAAQ,GAAR,QAAQ,CAAQ;QAEhB,QAAG,GAAH,GAAG,CAAyB;IAC5C,CAAC;IAEJ;;;OAGG;IACH,OAAO,CAAC,GAAW;QACjB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;gBAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QACd,CAAC;QACD,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC;QACjB,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,CAAC;IAED;iFAC6E;IAC7E,KAAK,CAAC,GAAW;QACf,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;CACF"}

package/dist/modules/database/core-schema.d.ts

@@ -70,6 +70,23 @@ export declare const users: import("drizzle-orm/pg-core").PgTableWithColumns<{
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        passwordHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "password_hash";
+            tableName: "users";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "users";

package/dist/modules/database/core-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAOhB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC"}
+{"version":3,"file":"core-schema.d.ts","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAeA,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAahB,CAAC;AAEH;;;;;;;;;;GAUG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAczB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAapB,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,UAAU;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAepB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BxB,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUzB,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAenB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkCxB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoBjB,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EASvB,CAAC;AAEH;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAexB,CAAC;AAEJ;;;;;;GAMG;AACH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBrB,CAAC;AAEJ,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAUhC,CAAC"}

package/dist/modules/database/core-schema.js

@@ -17,6 +17,12 @@ export const users = pgTable('users', {
     email: text('email').notNull().unique(),
     name: text('name').notNull(),
     avatarUrl: text('avatar_url'),
+    /**
+     * scrypt hash for password login (see auth/password-hash.ts). NULL for
+     * accounts that only ever signed in via SSO — password login refuses them
+     * until an admin (or the user, from their Account page) sets one.
+     */
+    passwordHash: text('password_hash'),
     createdAt: timestamp('created_at').defaultNow().notNull(),
     updatedAt: timestamp('updated_at').defaultNow().notNull(),
 });

package/dist/modules/database/core-schema.js.map

@@ -1 +1 @@
-{"version":3,"file":"core-schema.js","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErI,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACzE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC5D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,EAAE,WAAW,CAAC,uBAAuB,CAAC;SACtC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACnD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC;CACvC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE;IAC/C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;CACxE,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,yBAAyB,EAAE;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,uBAAuB;IACpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,+BAA+B;IAC/E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;CACjC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW,EAAE,WAAW,CAAC,+BAA+B,CAAC;SACtD,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;SAClC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,UAAU,EAAE,KAAK,CACf,6BAA6B,EAC7B,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,kCAAkC,CAChD;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE;IAC7C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC3D,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACtE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,wCAAwC;IACxC,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACrE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACvD,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,sEAAsE;IACtE,iBAAiB,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC7F,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC;IAC5E,gEAAgE;IAChE,YAAY,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,KAAK,CAChB,wBAAwB,EACxB,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,+CAA+C,CAC9D;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,oCAAoC;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,4EAA4E;IAC5E,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAA2B;IAC/D,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;IACnE,iFAAiF;IACjF,YAAY,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC;CAC9F,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC1F,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACrF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAChG,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACxD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE;IACjD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7D,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,8DAA8D;IAC9D,WAAW,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7E,CAAC,CAAC,CAAC"}
+{"version":3,"file":"core-schema.js","sourceRoot":"","sources":["../../../src/modules/database/core-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAErI,MAAM,CAAC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE;IACpC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IACvC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B;;;;OAIG;IACH,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC;IACnC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,mBAAmB,EAAE;IAC1D,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACzE,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC5D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,8EAA8E;IAC9E,0EAA0E;IAC1E,GAAG,EAAE,WAAW,CAAC,uBAAuB,CAAC;SACtC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,CAAC,CAAC,OAAO,CAAC;IACrD,IAAI,EAAE,KAAK,CAAC,yBAAyB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACtD,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,cAAc,EAAE;IAChD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,OAAO,EAAE;IACtD,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACpD,cAAc,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE;IACnD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,SAAS,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,WAAW,EAAE,SAAS,CAAC,cAAc,CAAC;CACvC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG,OAAO,CAAC,aAAa,EAAE;IAC/C,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC;IACrB,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACnC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;IAC3B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,IAAI,EAAE,KAAK,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;IAC/C,QAAQ,EAAE,KAAK,CAAC,uBAAuB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;CACxE,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,yBAAyB,EAAE;IACrD,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,YAAY,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE;IAC7C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACxC,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAE,uBAAuB;IACpE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,+BAA+B;IAC/E,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;IAC7B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC;CACjC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,SAAS,EAAE,WAAW,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IACjE,4EAA4E;IAC5E,6EAA6E;IAC7E,wEAAwE;IACxE,WAAW,EAAE,WAAW,CAAC,+BAA+B,CAAC;SACtD,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC;SAClC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,WAAW,CAAC;IAClC,OAAO,EAAE,KAAK,CAAC,0BAA0B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;IACtD,UAAU,EAAE,KAAK,CACf,6BAA6B,EAC7B,GAAG,CAAA,GAAG,CAAC,CAAC,KAAK,kCAAkC,CAChD;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,OAAO,CAAC,YAAY,EAAE;IACnD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAChD,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE;IAC9B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;CACnC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,oBAAoB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;CACjD,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,SAAS,GAAG,OAAO,CAAC,YAAY,EAAE;IAC7C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,YAAY,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IAC3D,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACtE,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;CAC7C,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;IAC9D,sEAAsE;IACtE,wCAAwC;IACxC,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACvD,QAAQ,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;CAC3D,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE;IACvD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE;IAChC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,2EAA2E;IAC3E,2EAA2E;IAC3E,oDAAoD;IACpD,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE,EAAG,uBAAuB;IACrE,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE;IACzC,QAAQ,EAAE,SAAS,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACvD,qEAAqE;IACrE,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnD,QAAQ,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,oEAAoE;IACpE,+DAA+D;IAC/D,kEAAkE;IAClE,iBAAiB,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC;IACtE,eAAe,EAAE,SAAS,CAAC,mBAAmB,CAAC;IAC/C,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC;CAC9B,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,sEAAsE;IACtE,iBAAiB,EAAE,KAAK,CAAC,qCAAqC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC;IAC7F,8FAA8F;IAC9F,QAAQ,EAAE,KAAK,CAAC,2BAA2B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,eAAe,CAAC;IAC5E,gEAAgE;IAChE,YAAY,EAAE,KAAK,CAAC,gCAAgC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClE,WAAW,EAAE,KAAK,CAChB,wBAAwB,EACxB,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,+CAA+C,CAC9D;CACF,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,EAAE;IACxC,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,wEAAwE;IACxE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE;IAC1B,0BAA0B;IAC1B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC;IAC9C,oCAAoC;IACpC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,uFAAuF;IACvF,cAAc,EAAE,IAAI,CAAC,iBAAiB,CAAC,CAAC,OAAO,EAAE;IACjD,4EAA4E;IAC5E,SAAS,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC,KAAK,EAA2B;IAC/D,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;IACzD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAC7C,UAAU,EAAE,WAAW,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC;IACnE,iFAAiF;IACjF,YAAY,EAAE,WAAW,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAA,GAAG,CAAC,CAAC,MAAM,UAAU,CAAC;CAC9F,CAAC,CAAC,CAAC;AAEJ;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE;IACnD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,UAAU,EAAE;IACxC,qBAAqB,EAAE,IAAI,CAAC,yBAAyB,CAAC;IACtD,qBAAqB,EAAE,SAAS,CAAC,0BAA0B,CAAC;IAC5D,YAAY,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAAY,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAC1F,uBAAuB,EAAE,IAAI,CAAC,4BAA4B,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;IACrF,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC;IAC/B,QAAQ,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC,KAAK,EAA2B,CAAC,OAAO,CAAC,GAAG,CAAA,aAAa,CAAC;IAChG,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,CAAC,CAAC;AAEH;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,OAAO,CAAC,kBAAkB,EAAE;IACxD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC9C,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC,OAAO,EAAE;IAC3C,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,UAAU,EAAE,SAAS,CAAC,aAAa,CAAC;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,gDAAgD;IAChD,QAAQ,EAAE,KAAK,CAAC,4BAA4B,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC9D,CAAC,CAAC,CAAC;AAEJ;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE;IACjD,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,CAAC,UAAU,EAAE;IAC3C,eAAe,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAC7D,gBAAgB,EAAE,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,EAAE;IACrD,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC;IAC7E,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;IAC5D,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC;IACpB,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC;IAC1B,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IAC5C,gBAAgB,EAAE,SAAS,CAAC,oBAAoB,CAAC;IACjD,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC;IAClC,UAAU,EAAE,SAAS,CAAC,cAAc,CAAC;IACrC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,MAAM,EAAE,KAAK,CAAC,sBAAsB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;IAClD,QAAQ,EAAE,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC1D,CAAC,CAAC,CAAC;AAEJ,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC,0BAA0B,EAAE;IACxE,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE;IACvC,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE;IACpC,SAAS,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAC,OAAO,EAAE;CAC1D,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACT,2EAA2E;IAC3E,0EAA0E;IAC1E,EAAE,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;IACtD,8DAA8D;IAC9D,WAAW,EAAE,KAAK,CAAC,wCAAwC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;CAC7E,CAAC,CAAC,CAAC"}

package/dist/modules/tool-auth/internal-token.service.d.ts

@@ -26,6 +26,16 @@ export interface InternalTokenClaim {
      */
     externalProxy?: boolean;
 }
+/**
+ * Derive the stable internal-token HMAC key from the deployment's JWT secret.
+ * Domain-separated (the constant label), so the two token systems never share
+ * key material and neither key reveals the other. A STABLE key — rather than
+ * the per-boot random default — is what lets a sibling process that shares the
+ * deployment env (the enterprise routine CLI, a second replica) mint tokens
+ * this server verifies; the composition root uses this whenever
+ * `INTERNAL_TOKEN_SECRET` is not set explicitly.
+ */
+export declare function deriveInternalTokenSecret(jwtSecret: string): string;
 /**
  * Mints + verifies stateless HMAC internal tokens. No DB: the token is
  * self-contained `(claim, exp)` signed with a process secret, so it is

package/dist/modules/tool-auth/internal-token.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAaD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA2BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}
+{"version":3,"file":"internal-token.service.d.ts","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAEA;;;;;;GAMG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AASD;;;;;;;;GAQG;AACH,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEnE;AAMD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAoB;IAC/B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAS;IAC/B,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;gBAG9B,IAAI,GAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAO;IAarF,6FAA6F;IAC7F,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAK,EAAE,kBAAkB,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM;IAOvD,sEAAsE;IACtE,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,kBAAkB,GAAG,IAAI;IA2BhD,uFAAuF;IACvF,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI9C,OAAO,CAAC,IAAI;CAGb"}

package/dist/modules/tool-auth/internal-token.service.js

@@ -1,5 +1,17 @@
 import { createHmac, randomBytes, timingSafeEqual } from 'node:crypto';
 const DEFAULT_PREFIX = 'bevel-int_';
+/**
+ * Derive the stable internal-token HMAC key from the deployment's JWT secret.
+ * Domain-separated (the constant label), so the two token systems never share
+ * key material and neither key reveals the other. A STABLE key — rather than
+ * the per-boot random default — is what lets a sibling process that shares the
+ * deployment env (the enterprise routine CLI, a second replica) mint tokens
+ * this server verifies; the composition root uses this whenever
+ * `INTERNAL_TOKEN_SECRET` is not set explicitly.
+ */
+export function deriveInternalTokenSecret(jwtSecret) {
+    return createHmac('sha256', jwtSecret).update('bevel-internal-token').digest('hex');
+}
 function b64url(buf) {
     return buf.toString('base64url');
 }

package/dist/modules/tool-auth/internal-token.service.js.map

@@ -1 +1 @@
-{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoCvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}
+{"version":3,"file":"internal-token.service.js","sourceRoot":"","sources":["../../../src/modules/tool-auth/internal-token.service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAoCvE,MAAM,cAAc,GAAG,YAAY,CAAC;AAEpC;;;;;;;;GAQG;AACH,MAAM,UAAU,yBAAyB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,MAAM,CAAC,GAAW;IACzB,OAAO,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,OAAO,oBAAoB;IACd,MAAM,CAAS;IACf,KAAK,CAAS;IACd,GAAG,CAAe;IAClB,MAAM,CAAS;IAEhC,YACE,OAAiF,EAAE;QAEnF,uEAAuE;QACvE,4EAA4E;QAC5E,0CAA0C;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,KAAK;QAChD,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QAChC,8DAA8D;QAC9D,mFAAmF;QACnF,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,cAAc,CAAC;IAC9C,CAAC;IAED,6FAA6F;IAC7F,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;8EAC0E;IAC1E,IAAI,CAAC,KAAyB,EAAE,KAAc;QAC5C,MAAM,OAAO,GAAkB,EAAE,GAAG,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACrF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACpC,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,CAAC;IACxC,CAAC;IAED,sEAAsE;IACtE,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAEhC,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAChD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QAE3E,IAAI,OAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpD,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,CAAC,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,OAAO,CAAC,aAAa,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;IACJ,CAAC;IAED,uFAAuF;IACvF,sBAAsB,CAAC,KAAa;QAClC,OAAO,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAEO,IAAI,CAAC,IAAY;QACvB,OAAO,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IACjE,CAAC;CACF"}

package/migrations/0001_user_password_hash.sql

@@ -0,0 +1,4 @@
+-- Per-user password login: scrypt hash column (NULL = SSO-only account).
+-- Idempotent like the init — a database that somehow already carries the
+-- column (e.g. a re-run after a partial failure) no-ops.
+ALTER TABLE "users" ADD COLUMN IF NOT EXISTS "password_hash" text;

package/migrations/meta/_journal.json

@@ -1,13 +1,20 @@
-{
-  "version": "7",
-  "dialect": "postgresql",
-  "entries": [
-    {
-      "idx": 0,
-      "version": "7",
-      "when": 1785448203355,
-      "tag": "0000_core_init",
-      "breakpoints": true
-    }
-  ]
-}
+{
+  "version": "7",
+  "dialect": "postgresql",
+  "entries": [
+    {
+      "idx": 0,
+      "version": "7",
+      "when": 1785448203355,
+      "tag": "0000_core_init",
+      "breakpoints": true
+    },
+    {
+      "idx": 1,
+      "version": "7",
+      "when": 1785534603355,
+      "tag": "0001_user_password_hash",
+      "breakpoints": true
+    }
+  ]
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bevel-software/platform-core-backend",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Open-source core backend of the Bevel platform: git-backed knowledge workspace, workflow (branches/change requests/locks/SSE), skills, tools, secrets vault, access control and the remote MCP surface.",
   "type": "module",
   "main": "./dist/index.js",
@@ -45,7 +45,7 @@
     "pg": "^8.20.0",
     "yaml": "^2.9.0",
     "zod": "^3.24.0",
-    "@bevel-software/platform-shared": "0.1.0"
+    "@bevel-software/platform-shared": "0.2.0"
   },
   "devDependencies": {
     "@types/adm-zip": "^0.5.8",