@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/types/model/dtos/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/dtos/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/dtos/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}

package/dist/types/model/index.d.ts

@@ -1,10 +1,10 @@
-export * from './authorization';
-export * from './commands';
-export * from './dtos';
-export * from './queries';
-export * from './mailing';
-export * from './service';
-export * from './type';
-export * from './providers';
-export * from './utils';
+export * from './authorization/index.js';
+export * from './commands/index.js';
+export * from './dtos/index.js';
+export * from './queries/index.js';
+export * from './mailing/index.js';
+export * from './service/index.js';
+export * from './type/index.js';
+export * from './providers.js';
+export * from './utils/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/model/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,YAAY,CAAA;AAC1B,cAAc,QAAQ,CAAA;AACtB,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,WAAW,CAAA;AACzB,cAAc,QAAQ,CAAA;AACtB,cAAc,aAAa,CAAA;AAC3B,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/model/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,qBAAqB,CAAA;AACnC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,oBAAoB,CAAA;AAClC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,kBAAkB,CAAA"}

package/dist/types/model/mailing/UserMailer.d.ts

@@ -1,5 +1,5 @@
-import { Mailer, TemplateRenderer } from '../../utils';
-import { DatabaseContext } from '../utils';
+import { Mailer, TemplateRenderer } from '../../utils/index.js';
+import { DatabaseContext } from '../utils/index.js';
 import { Acl } from '@contember/schema';
 export declare class UserMailer {
     private readonly mailer;
@@ -34,6 +34,40 @@ export declare class UserMailer {
         projectId: string | null;
         variant: string;
     }): Promise<void>;
+    sendForcedSignOutEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        reason: string | null;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
+    sendEmailVerificationEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        token: string;
+        project?: string;
+        projectSlug?: string;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
+    sendEmailChangeVerifyEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        token: string;
+        project?: string;
+        projectSlug?: string;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
+    sendEmailChangeNotifyEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        newEmail: string;
+        project?: string;
+        projectSlug?: string;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
     sendPasswordlessEmail(dbContext: DatabaseContext, mailArguments: {
         email: string;
         token: string;
@@ -45,6 +79,29 @@ export declare class UserMailer {
         projectId: string | null;
         variant: string;
     }): Promise<void>;
+    sendEmailOtpEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        code: string;
+        project?: string;
+        projectSlug?: string;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
+    sendBackupCodesExhaustedEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
+    sendUnusualLoginEmail(dbContext: DatabaseContext, mailArguments: {
+        email: string;
+        geoCountry: string | null;
+        ipAddress: string | null;
+    }, customMailOptions: {
+        projectId: string | null;
+        variant: string;
+    }): Promise<void>;
     private sendMail;
     private getCustomTemplate;
 }

package/dist/types/model/mailing/UserMailer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"UserMailer.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/UserMailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAQtD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAC1C,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBADhB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB;IAG9C,sBAAsB,CAC3B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;KACtC,EACD,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,IAAI,CAAC;IAUV,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;KAAE,EAC9G,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,IAAI,CAAC;IAUV,sBAAsB,CAC3B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,qBAAqB,CAC1B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EACxH,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;YAUF,QAAQ;YAoBR,iBAAiB;CAa/B"}
+{"version":3,"file":"UserMailer.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/UserMailer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAA;AAe/D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,qBAAa,UAAU;IAErB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;gBADhB,MAAM,EAAE,MAAM,EACd,gBAAgB,EAAE,gBAAgB;IAG9C,sBAAsB,CAC3B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QACd,KAAK,EAAE,MAAM,CAAA;QACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAA;QACvB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;QACpB,OAAO,EAAE,MAAM,CAAA;QACf,WAAW,EAAE,MAAM,CAAA;QACnB,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;KACtC,EACD,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,IAAI,CAAC;IAUV,4BAA4B,CACjC,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,SAAS,GAAG,CAAC,UAAU,EAAE,CAAA;KAAE,EAC9G,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GACvD,OAAO,CAAC,IAAI,CAAC;IAUV,sBAAsB,CAC3B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,sBAAsB,CAC3B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EACvD,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,0BAA0B,CAC/B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,0BAA0B,CAC/B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACvF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,0BAA0B,CAC/B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EAC1F,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,qBAAqB,CAC1B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,EACxH,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,iBAAiB,CACtB,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,EACtF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,6BAA6B,CAClC,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,EAChC,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;IAUV,qBAAqB,CAC1B,SAAS,EAAE,eAAe,EAC1B,aAAa,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EACrF,iBAAiB,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,IAAI,CAAC;YAUF,QAAQ;YAoBR,iBAAiB;CAa/B"}

package/dist/types/model/mailing/index.d.ts

@@ -1,3 +1,3 @@
-export * from './UserMailer';
-export * from './type';
+export * from './UserMailer.js';
+export * from './type.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/mailing/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/index.ts"],"names":[],"mappings":"AAAA,cAAc,cAAc,CAAA;AAC5B,cAAc,QAAQ,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA;AAC/B,cAAc,WAAW,CAAA"}

package/dist/types/model/mailing/templates/BackupCodesExhausted.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=BackupCodesExhausted.mustache.d.ts.map

package/dist/types/model/mailing/templates/BackupCodesExhausted.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodesExhausted.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/BackupCodesExhausted.mustache.ts"],"names":[],"mappings":";AAEA,wBAUE"}

package/dist/types/model/mailing/templates/EmailChangeNotify.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=EmailChangeNotify.mustache.d.ts.map

package/dist/types/model/mailing/templates/EmailChangeNotify.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeNotify.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/EmailChangeNotify.mustache.ts"],"names":[],"mappings":";AAEA,wBAOE"}

package/dist/types/model/mailing/templates/EmailChangeVerify.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=EmailChangeVerify.mustache.d.ts.map

package/dist/types/model/mailing/templates/EmailChangeVerify.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeVerify.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/EmailChangeVerify.mustache.ts"],"names":[],"mappings":";AAEA,wBASE"}

package/dist/types/model/mailing/templates/EmailOtp.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=EmailOtp.mustache.d.ts.map

package/dist/types/model/mailing/templates/EmailOtp.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtp.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/EmailOtp.mustache.ts"],"names":[],"mappings":";AAEA,wBAUE"}

package/dist/types/model/mailing/templates/EmailVerification.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=EmailVerification.mustache.d.ts.map

package/dist/types/model/mailing/templates/EmailVerification.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailVerification.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/EmailVerification.mustache.ts"],"names":[],"mappings":";AAEA,wBAOE"}

package/dist/types/model/mailing/templates/ForcedSignOut.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=ForcedSignOut.mustache.d.ts.map

package/dist/types/model/mailing/templates/ForcedSignOut.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ForcedSignOut.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/ForcedSignOut.mustache.ts"],"names":[],"mappings":";AAEA,wBAOE"}

package/dist/types/model/mailing/templates/UnusualLogin.mustache.d.ts

@@ -0,0 +1,3 @@
+declare const _default: string;
+export default _default;
+//# sourceMappingURL=UnusualLogin.mustache.d.ts.map

package/dist/types/model/mailing/templates/UnusualLogin.mustache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"UnusualLogin.mustache.d.ts","sourceRoot":"","sources":["../../../../../src/model/mailing/templates/UnusualLogin.mustache.ts"],"names":[],"mappings":";AAEA,wBAcE"}

package/dist/types/model/mailing/type.d.ts

@@ -1,9 +1,16 @@
-import { MailType as SchemaMailType } from '../../schema';
+import { MailType as SchemaMailType } from '../../schema/index.js';
 export declare enum MailType {
     existingUserInvited = "existingUserInvited",
     newUserInvited = "newUserInvited",
     passwordReset = "passwordReset",
-    passwordlessSignIn = "passwordlessSignIn"
+    passwordlessSignIn = "passwordlessSignIn",
+    forcedSignOut = "forcedSignOut",
+    emailOtp = "emailOtp",
+    backupCodesExhausted = "backupCodesExhausted",
+    emailVerification = "emailVerification",
+    emailChangeVerify = "emailChangeVerify",
+    emailChangeNotify = "emailChangeNotify",
+    unusualLogin = "unusualLogin"
 }
 export declare const mailTypeFromSchemaToDb: (type: SchemaMailType) => MailType;
 export declare const mailTypeFromDbToSchema: (type: MailType) => SchemaMailType;

package/dist/types/model/mailing/type.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,cAAc,CAAA;AAEzD,oBAAY,QAAQ;IACnB,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;CACzC;AAED,eAAO,MAAM,sBAAsB,GAAI,MAAM,cAAc,KAAG,QAO7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,MAAM,QAAQ,KAAG,cAOvD,CAAA;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,sBAAsB,EAAE,gBAAgB;CAAG"}
+{"version":3,"file":"type.d.ts","sourceRoot":"","sources":["../../../../src/model/mailing/type.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,IAAI,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAElE,oBAAY,QAAQ;IACnB,mBAAmB,wBAAwB;IAC3C,cAAc,mBAAmB;IACjC,aAAa,kBAAkB;IAC/B,kBAAkB,uBAAuB;IACzC,aAAa,kBAAkB;IAC/B,QAAQ,aAAa;IACrB,oBAAoB,yBAAyB;IAC7C,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,iBAAiB,sBAAsB;IACvC,YAAY,iBAAiB;CAC7B;AAED,eAAO,MAAM,sBAAsB,GAAI,MAAM,cAAc,KAAG,QAc7D,CAAA;AAED,eAAO,MAAM,sBAAsB,GAAI,MAAM,QAAQ,KAAG,cAcvD,CAAA;AAED,MAAM,WAAW,sBAAsB;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,IAAI,EAAE,QAAQ,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,gBAAgB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,OAAO,CAAA;IAClB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;CACtB;AAED,MAAM,WAAW,YAAa,SAAQ,sBAAsB,EAAE,gBAAgB;CAAG"}

package/dist/types/model/providers.d.ts

@@ -14,5 +14,13 @@ export interface Providers {
         value: Buffer;
         needsReEncrypt: boolean;
     }>;
+    /**
+     * Whether an encryption key is configured. When false, `encrypt` throws, so
+     * secrets that can fall back to plaintext-at-rest (TOTP) must do so (version 0),
+     * preserving pre-encryption behavior on deployments without a key. For the same
+     * reason, token-bearing IdP sessions are skipped when no key is configured, since
+     * refresh tokens must be encrypted at rest and must never be stored in plaintext.
+     */
+    encryptionEnabled: boolean;
 }
 //# sourceMappingURL=providers.d.ts.map

package/dist/types/model/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/model/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,IAAI,CAAA;IACf,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1C,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAEjD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;CAChG"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../../src/model/providers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAExC,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,MAAM,MAAM,CAAA;IAClB,GAAG,EAAE,MAAM,IAAI,CAAA;IACf,WAAW,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/C,MAAM,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAC1C,aAAa,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE,IAAI,EAAE,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IAEjD,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IACvE,OAAO,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,cAAc,EAAE,OAAO,CAAA;KAAE,CAAC,CAAA;IAChG;;;;;;OAMG;IACH,iBAAiB,EAAE,OAAO,CAAA;CAC1B"}

package/dist/types/model/queries/apiKey/ApiKeyListQuery.d.ts

@@ -0,0 +1,23 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { ApiKey } from '../../type/index.js';
+export interface ApiKeyListRow {
+    readonly id: string;
+    readonly type: ApiKey.Type;
+    readonly disabled_at: Date | null;
+    readonly created_at: Date;
+    readonly last_used_at: Date | null;
+    readonly expires_at: Date | null;
+    readonly identity_id: string;
+    readonly description: string | null;
+}
+/** Permanent API keys whose identity is a member of the given project. */
+export declare class ProjectApiKeysQuery extends DatabaseQuery<ApiKeyListRow[]> {
+    private readonly projectId;
+    constructor(projectId: string);
+    fetch({ db }: DatabaseQueryable): Promise<ApiKeyListRow[]>;
+}
+/** Permanent API keys whose identity has no project membership — i.e. global keys from createGlobalApiKey. */
+export declare class GlobalApiKeysQuery extends DatabaseQuery<ApiKeyListRow[]> {
+    fetch({ db }: DatabaseQueryable): Promise<ApiKeyListRow[]>;
+}
+//# sourceMappingURL=ApiKeyListQuery.d.ts.map

package/dist/types/model/queries/apiKey/ApiKeyListQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeyListQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/ApiKeyListQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CACnC;AAmBD,0EAA0E;AAC1E,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAIxC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAYhE;AAED,8GAA8G;AAC9G,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;IAC/D,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAahE"}

package/dist/types/model/queries/apiKey/ApiKeyQuery.d.ts

@@ -1,5 +1,6 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { ApiKey } from '../../type';
+import { ApiKey } from '../../type/index.js';
+import { IPostgresInterval } from 'postgres-interval';
 export declare class ApiKeyByIdQuery extends DatabaseQuery<null | ApiKeyRow> {
     private readonly apiKeyId;
     constructor(apiKeyId: string);
@@ -19,5 +20,12 @@ export type ApiKeyRow = {
     readonly expiration: number | null;
     readonly roles: string[];
     readonly person_id: string | null;
+    readonly last_ip: string | null;
+    readonly last_user_agent: string | null;
+    readonly last_used_at: Date | null;
+    readonly trust_forwarded_info: boolean;
+    readonly issued_at: Date | null;
+    readonly idle_timeout: IPostgresInterval | null;
+    readonly max_expires_at: Date | null;
 };
 //# sourceMappingURL=ApiKeyQuery.d.ts.map

package/dist/types/model/queries/apiKey/ApiKeyQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ApiKeyQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/ApiKeyQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,YAAY,CAAA;AAGnC,qBAAa,eAAgB,SAAQ,aAAa,CAAC,IAAI,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAIvC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;CASjE;AAED,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,MAAM;IAIpC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;CAQjE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACjC,CAAA"}
+{"version":3,"file":"ApiKeyQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/ApiKeyQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAE5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAA;AAErD,qBAAa,eAAgB,SAAQ,aAAa,CAAC,IAAI,GAAG,SAAS,CAAC;IACvD,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAIvC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;CASjE;AAED,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,IAAI,GAAG,SAAS,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,MAAM;IAIpC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;CAQjE;AAED,MAAM,MAAM,SAAS,GAAG;IACvB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;IACtC,QAAQ,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,YAAY,EAAE,iBAAiB,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,cAAc,EAAE,IAAI,GAAG,IAAI,CAAA;CACpC,CAAA"}

package/dist/types/model/queries/apiKey/ApiKeySessionsQuery.d.ts

@@ -0,0 +1,21 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export type ApiKeySessionRow = {
+    readonly id: string;
+    readonly created_at: Date;
+    readonly expires_at: Date | null;
+    readonly last_used_at: Date | null;
+    readonly last_ip: string | null;
+    readonly last_user_agent: string | null;
+    readonly created_ip: string | null;
+    readonly created_user_agent: string | null;
+    readonly trust_forwarded_info: boolean;
+};
+export declare class ApiKeySessionsByIdentityQuery extends DatabaseQuery<readonly ApiKeySessionRow[]> {
+    private readonly identityId;
+    private readonly options;
+    constructor(identityId: string, options: {
+        now: Date;
+    });
+    fetch({ db }: DatabaseQueryable): Promise<readonly ApiKeySessionRow[]>;
+}
+//# sourceMappingURL=ApiKeySessionsQuery.d.ts.map

package/dist/types/model/queries/apiKey/ApiKeySessionsQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ApiKeySessionsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/ApiKeySessionsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAG/F,MAAM,MAAM,gBAAgB,GAAG;IAC9B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,IAAI,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,oBAAoB,EAAE,OAAO,CAAA;CACtC,CAAA;AAED,qBAAa,6BAA8B,SAAQ,aAAa,CAAC,SAAS,gBAAgB,EAAE,CAAC;IAE3F,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,OAAO;gBADP,UAAU,EAAE,MAAM,EAClB,OAAO,EAAE;QAAE,GAAG,EAAE,IAAI,CAAA;KAAE;IAKlC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,gBAAgB,EAAE,CAAC;CA0B5E"}

package/dist/types/model/queries/apiKey/index.d.ts

@@ -1,2 +1,4 @@
-export * from './ApiKeyQuery';
+export * from './ApiKeyQuery.js';
+export * from './ApiKeyListQuery.js';
+export * from './ApiKeySessionsQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/apiKey/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/apiKey/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAA;AAChC,cAAc,sBAAsB,CAAA;AACpC,cAAc,0BAA0B,CAAA"}

package/dist/types/model/queries/authLog/AuthLogQuery.d.ts

@@ -0,0 +1,48 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { JSONValue } from '@contember/schema';
+import { AuthActionType } from '../../type/AuthLog.js';
+export type AuthLogEntryRow = {
+    readonly id: string;
+    readonly created_at: Date;
+    readonly type: AuthActionType;
+    readonly success: boolean;
+    readonly invoked_by_id: string | null;
+    readonly person_id: string | null;
+    readonly target_person_id: string | null;
+    readonly person_input_identifier: string | null;
+    readonly error_code: string | null;
+    readonly error_message: string | null;
+    readonly ip_address: string | null;
+    readonly user_agent: string | null;
+    readonly identity_provider_id: string | null;
+    readonly metadata: JSONValue | null;
+    readonly event_data: JSONValue | null;
+};
+export type AuthLogFilter = {
+    readonly types?: readonly AuthActionType[];
+    readonly success?: boolean;
+    readonly invokedByIdentityId?: string;
+    readonly personId?: string;
+    readonly targetPersonId?: string;
+    readonly personInputIdentifier?: string;
+    readonly createdAfter?: Date;
+    readonly createdBefore?: Date;
+};
+/**
+ * Reads `person_auth_log`. Returns one row beyond the requested limit when
+ * available so the resolver can set `hasMore` without a separate COUNT(*).
+ * Caller (resolver) is responsible for permission gating — this query does
+ * not enforce any visibility rules.
+ */
+export declare class AuthLogQuery extends DatabaseQuery<readonly AuthLogEntryRow[]> {
+    private readonly filter;
+    private readonly pagination;
+    constructor(filter: AuthLogFilter, pagination: {
+        limit?: number;
+        offset?: number;
+    });
+    fetch({ db }: DatabaseQueryable): Promise<readonly AuthLogEntryRow[]>;
+    static get hardLimit(): number;
+    static get defaultLimit(): number;
+}
+//# sourceMappingURL=AuthLogQuery.d.ts.map

package/dist/types/model/queries/authLog/AuthLogQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthLogQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/authLog/AuthLogQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAA;IAC7B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAA;IACxC,QAAQ,CAAC,uBAAuB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/C,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,QAAQ,EAAE,SAAS,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,UAAU,EAAE,SAAS,GAAG,IAAI,CAAA;CACrC,CAAA;AAED,MAAM,MAAM,aAAa,GAAG;IAC3B,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,cAAc,EAAE,CAAA;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;IAC1B,QAAQ,CAAC,mBAAmB,CAAC,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;IAChC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAA;IACvC,QAAQ,CAAC,YAAY,CAAC,EAAE,IAAI,CAAA;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,IAAI,CAAA;CAC7B,CAAA;AAKD;;;;;GAKG;AACH,qBAAa,YAAa,SAAQ,aAAa,CAAC,SAAS,eAAe,EAAE,CAAC;IAEzE,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,UAAU;gBADV,MAAM,EAAE,aAAa,EACrB,UAAU,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE;IAK3D,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,eAAe,EAAE,CAAC;IAsD3E,MAAM,KAAK,SAAS,IAAI,MAAM,CAE7B;IAED,MAAM,KAAK,YAAY,IAAI,MAAM,CAEhC;CACD"}

package/dist/types/model/queries/authLog/NextMailAttemptQuery.d.ts

@@ -0,0 +1,21 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { AuthActionType } from '../../type/AuthLog.js';
+/**
+ * Per-email exponential backoff for mail-sending init flows (password reset,
+ * passwordless sign-in). Mirrors {@link NextLoginAttemptQuery} but counts
+ * *successful* init events (= mails actually sent) against the same email, and
+ * treats a successful completion (`completionType`) as the cutoff that resets
+ * the backoff to zero.
+ *
+ * Reuses the existing `login_base_backoff` / `login_max_backoff` /
+ * `login_attempt_window` knobs — see ConfigRateLimits docstring for the
+ * rationale.
+ */
+export declare class NextMailAttemptQuery extends DatabaseQuery<Date> {
+    private readonly email;
+    private readonly initType;
+    private readonly completionType;
+    constructor(email: string, initType: AuthActionType, completionType: AuthActionType);
+    fetch({ db }: DatabaseQueryable): Promise<Date>;
+}
+//# sourceMappingURL=NextMailAttemptQuery.d.ts.map

package/dist/types/model/queries/authLog/NextMailAttemptQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"NextMailAttemptQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/authLog/NextMailAttemptQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD;;;;;;;;;;GAUG;AACH,qBAAa,oBAAqB,SAAQ,aAAa,CAAC,IAAI,CAAC;IAE3D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,cAAc;gBAFd,KAAK,EAAE,MAAM,EACb,QAAQ,EAAE,cAAc,EACxB,cAAc,EAAE,cAAc;IAK1C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;CAwDrD"}

package/dist/types/model/queries/authPolicy/AuthPoliciesQuery.d.ts

@@ -0,0 +1,15 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { AuthPolicyRow } from '../../type/index.js';
+/**
+ * Lists `auth_policy` rows. Optionally filters to a single project (or to the
+ * global scope when `projectId` is explicitly `null`); with no filter, returns
+ * every row. Intervals are returned as IPostgresInterval, like ConfigRow.
+ */
+export declare class AuthPoliciesQuery extends DatabaseQuery<AuthPolicyRow[]> {
+    private readonly filter?;
+    constructor(filter?: {
+        projectId: string | null;
+    } | undefined);
+    fetch({ db }: DatabaseQueryable): Promise<AuthPolicyRow[]>;
+}
+//# sourceMappingURL=AuthPoliciesQuery.d.ts.map

package/dist/types/model/queries/authPolicy/AuthPoliciesQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPoliciesQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/authPolicy/AuthPoliciesQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD;;;;GAIG;AACH,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAP,MAAM,CAAC,EAAE;QAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,YAAA;IAI5D,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;CAUhE"}

package/dist/types/model/queries/authPolicy/index.d.ts

@@ -0,0 +1,2 @@
+export * from './AuthPoliciesQuery.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/authPolicy/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/authPolicy/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA"}

package/dist/types/model/queries/configuration/ConfigurationQuery.d.ts

@@ -1,6 +1,9 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { Config } from '../../type/Config';
+import { Config } from '../../type/Config.js';
+import { Providers } from '../../providers.js';
 export declare class ConfigurationQuery extends DatabaseQuery<Config> {
+    private readonly providers;
+    constructor(providers: Providers);
     fetch({ db }: DatabaseQueryable): Promise<Config>;
 }
 //# sourceMappingURL=ConfigurationQuery.d.ts.map

package/dist/types/model/queries/configuration/ConfigurationQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/configuration/ConfigurationQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,MAAM,EAAa,MAAM,mBAAmB,CAAA;AAErD,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,MAAM,CAAC;IACtD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;CAmCvD"}
+{"version":3,"file":"ConfigurationQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/configuration/ConfigurationQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,MAAM,EAAa,MAAM,sBAAsB,CAAA;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,MAAM,CAAC;IAChD,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,SAAS;IAI3C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;CA2FvD"}

package/dist/types/model/queries/configuration/index.d.ts

@@ -1,2 +1,2 @@
-export * from './ConfigurationQuery';
+export * from './ConfigurationQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/configuration/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/configuration/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/configuration/index.ts"],"names":[],"mappings":"AAAA,cAAc,yBAAyB,CAAA"}

package/dist/types/model/queries/identity/index.d.ts

@@ -1,2 +1,2 @@
-export * from './IdentityQuery';
+export * from './IdentityQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA"}

package/dist/types/model/queries/idp/IdentityProviderBySlugQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { IdentityProviderRow } from './types';
+import { IdentityProviderRow } from './types.js';
 export declare class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {
     private readonly slug;
     constructor(slug: string);

package/dist/types/model/queries/idp/IdentityProviderBySlugQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAE7C,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC7E,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAS3E"}
+{"version":3,"file":"IdentityProviderBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC7E,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAS3E"}

package/dist/types/model/queries/idp/IdentityProvidersQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { IdentityProviderDto } from './types';
+import { IdentityProviderDto } from './types.js';
 export declare class IdentityProvidersQuery extends DatabaseQuery<IdentityProviderDto[]> {
     fetch({ db }: DatabaseQueryable): Promise<IdentityProviderDto[]>;
 }

package/dist/types/model/queries/idp/IdentityProvidersQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAuB,MAAM,SAAS,CAAA;AAElE,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACzE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAKtE"}
+{"version":3,"file":"IdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAA;AAErE,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACzE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAKtE"}

package/dist/types/model/queries/idp/IdpSessionByApiKeyQuery.d.ts

@@ -0,0 +1,28 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { Providers } from '../../providers.js';
+import type { IDPSessionState } from '../../service/idp/index.js';
+export type IdpSessionRow = {
+    id: string;
+    identityProviderId: string;
+    providerType: string;
+    providerConfiguration: Record<string, unknown>;
+    providerDisabledAt: Date | null;
+    session: IDPSessionState;
+    /** When the current access token was obtained (sign-in / last refresh) — drives the soft-refresh threshold. */
+    tokenObtainedAt: Date | null;
+    lastValidatedAt: Date;
+    createdAt: Date;
+};
+/**
+ * Fetch the federated-session state bound to a session API key (if any), joined with its
+ * identity provider (type + configuration), and decrypt the stored tokens. Returns null for
+ * password sessions / IdPs without revalidation. Used on the verify hot path, so it pulls
+ * everything the re-validation hook needs in a single round trip.
+ */
+export declare class IdpSessionByApiKeyQuery extends DatabaseQuery<IdpSessionRow | null> {
+    private readonly apiKeyId;
+    private readonly providers;
+    constructor(apiKeyId: string, providers: Providers);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionRow | null>;
+}
+//# sourceMappingURL=IdpSessionByApiKeyQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionByApiKeyQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionByApiKeyQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionByApiKeyQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAEjE,MAAM,MAAM,aAAa,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,eAAe,CAAA;IACxB,+GAA+G;IAC/G,eAAe,EAAE,IAAI,GAAG,IAAI,CAAA;IAC5B,eAAe,EAAE,IAAI,CAAA;IACrB,SAAS,EAAE,IAAI,CAAA;CACf,CAAA;AAiBD;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,aAAa,GAAG,IAAI,CAAC;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAA5C,QAAQ,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS;IAI9E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;CAgDrE"}

package/dist/types/model/queries/idp/IdpSessionsBySidQuery.d.ts

@@ -0,0 +1,18 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export type IdpSessionBySidRow = {
+    id: string;
+    apiKeyId: string;
+};
+/**
+ * Find the federated sessions established for a given IdP session id (`sid`) under a specific
+ * identity provider — the lookup an OIDC back-channel logout performs to map the IdP's `sid` to the
+ * local session(s) to revoke (A10). Hits the `(identity_provider_id, idp_session_id)` index added by
+ * A24. A single `sid` can in principle back more than one local session, so this returns all matches.
+ */
+export declare class IdpSessionsBySidQuery extends DatabaseQuery<IdpSessionBySidRow[]> {
+    private readonly identityProviderId;
+    private readonly sid;
+    constructor(identityProviderId: string, sid: string);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionBySidRow[]>;
+}
+//# sourceMappingURL=IdpSessionsBySidQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionsBySidQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionsBySidQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionsBySidQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,MAAM,kBAAkB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM;IAKvB,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAarE"}