@contember/engine-tenant-api 2.1.0-beta.1 → 2.2.0-alpha.1

package/dist/types/model/queries/idp/IdpSessionsBySubQuery.d.ts

@@ -0,0 +1,24 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { IdpSessionBySidRow } from './IdpSessionsBySidQuery.js';
+/**
+ * Find the federated sessions for a given subject (`sub`) under a specific identity provider — the
+ * lookup an OIDC back-channel logout performs when the IdP sends a `sub`-only logout token (no `sid`),
+ * which targets *all* of that subject's sessions (OIDC Back-Channel Logout 1.0 §2.4). The subject is
+ * the `external_identifier` recorded in `person_identity_provider` at sign-in, so we walk
+ * `idp_session → api_key → person → person_identity_provider` to map `sub` to the local session(s) to
+ * revoke. Both the session row and the `person_identity_provider` row are constrained to the same
+ * provider so a `sub` is only ever interpreted under the IdP that asserted it.
+ *
+ * Assumption: a person maps to a single subject per provider (the normal case — one IdP link per
+ * person). `idp_session` stores no `sub` of its own, so once a person is matched we revoke *all* of
+ * that person's sessions under the provider. If a person were ever linked to the same IdP under two
+ * subjects, a logout for one subject would also revoke the other's sessions — over-revocation, which
+ * is the safe direction for a logout (it never leaves a session the IdP asked to terminate alive).
+ */
+export declare class IdpSessionsBySubQuery extends DatabaseQuery<IdpSessionBySidRow[]> {
+    private readonly identityProviderId;
+    private readonly sub;
+    constructor(identityProviderId: string, sub: string);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionBySidRow[]>;
+}
+//# sourceMappingURL=IdpSessionsBySubQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionsBySubQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionsBySubQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionsBySubQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG;gBADH,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM;IAKvB,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;CAkBrE"}

package/dist/types/model/queries/idp/PersonIdentityProvidersQuery.d.ts

@@ -0,0 +1,20 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export interface PersonIdentityProviderRow {
+    readonly id: string;
+    readonly createdAt: Date;
+    readonly externalIdentifier: string;
+    readonly identityProviderSlug: string;
+    readonly identityProviderType: string;
+    readonly identityProviderDisabledAt: Date | null;
+}
+/**
+ * Lists the external IdP connections of a single person, joined with the
+ * identity provider they belong to. Used by the `Person.identityProviders`
+ * field and by the disconnect flow to enforce ownership and lock-out protection.
+ */
+export declare class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {
+    private readonly personId;
+    constructor(personId: string);
+    fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]>;
+}
+//# sourceMappingURL=PersonIdentityProvidersQuery.d.ts.map

package/dist/types/model/queries/idp/PersonIdentityProvidersQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,0BAA0B,EAAE,IAAI,GAAG,IAAI,CAAA;CAChD;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,aAAa,CAAC,yBAAyB,EAAE,CAAC;IAE1F,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,MAAM;IAK5B,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC;CAmB5E"}

package/dist/types/model/queries/idp/helpers.d.ts

@@ -1,5 +1,5 @@
 import { SelectBuilder } from '@contember/database';
-import { IdentityProviderDto, IdentityProviderRow } from './types';
+import { IdentityProviderDto, IdentityProviderRow } from './types.js';
 export declare const createBaseIdpQuery: () => SelectBuilder<IdentityProviderRow>;
-export declare const createIdpDto: ({ exclusive, autoSignUp, initReturnsConfig, ...row }: IdentityProviderRow) => IdentityProviderDto;
+export declare const createIdpDto: ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, ...row }: IdentityProviderRow) => IdentityProviderDto;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/types/model/queries/idp/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAElE,eAAO,MAAM,kBAAkB,0CAUH,CAAA;AAE5B,eAAO,MAAM,YAAY,GAAI,sDAAsD,mBAAmB,KAAG,mBAKxG,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErE,eAAO,MAAM,kBAAkB,0CAYH,CAAA;AAE5B,eAAO,MAAM,YAAY,GACxB,iGAAiG,mBAAmB,KAClH,mBAKF,CAAA"}

package/dist/types/model/queries/idp/index.d.ts

@@ -1,3 +1,7 @@
-export * from './IdentityProviderBySlugQuery';
-export * from './IdentityProvidersQuery';
+export * from './IdentityProviderBySlugQuery.js';
+export * from './IdentityProvidersQuery.js';
+export * from './IdpSessionByApiKeyQuery.js';
+export * from './IdpSessionsBySidQuery.js';
+export * from './IdpSessionsBySubQuery.js';
+export * from './PersonIdentityProvidersQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/idp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAA;AAC7C,cAAc,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAA;AAChD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,mCAAmC,CAAA"}

package/dist/types/model/queries/idp/types.d.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderData } from '../../type';
+import { IdentityProviderData } from '../../type/index.js';
 export type IdentityProviderRow = {
     id: string;
     slug: string;
@@ -8,6 +8,8 @@ export type IdentityProviderRow = {
     autoSignUp: boolean;
     exclusive: boolean;
     initReturnsConfig: boolean;
+    requireVerifiedEmail: boolean;
+    assumeEmailVerified: boolean;
 };
 export type IdentityProviderDto = {
     id: string;

package/dist/types/model/queries/idp/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,MAAM,mBAAmB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC5B;IACD,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB,GACC,oBAAoB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,MAAM,mBAAmB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;CAC5B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC5B;IACD,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB,GACC,oBAAoB,CAAA"}

package/dist/types/model/queries/index.d.ts

@@ -1,9 +1,11 @@
-export * from './apiKey';
-export * from './configuration';
-export * from './mailTemplate';
-export * from './membership';
-export * from './person';
-export * from './identity';
-export * from './idp';
-export * from './project';
+export * from './apiKey/index.js';
+export * from './authPolicy/index.js';
+export * from './configuration/index.js';
+export * from './mailTemplate/index.js';
+export * from './membership/index.js';
+export * from './person/index.js';
+export * from './identity/index.js';
+export * from './idp/index.js';
+export * from './project/index.js';
+export * from './rateLimit/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/queries/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,OAAO,CAAA;AACrB,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/queries/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,yBAAyB,CAAA;AACvC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA"}

package/dist/types/model/queries/mailTemplate/MailTemplateListQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MailTemplateRow } from './helpers';
+import { MailTemplateRow } from './helpers.js';
 export type MailTemplateListRow = MailTemplateRow & {
     projectSlug: string | null;
 };

package/dist/types/model/queries/mailTemplate/MailTemplateListQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateListQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateListQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAA2B,eAAe,EAAE,MAAM,WAAW,CAAA;AAEpE,MAAM,MAAM,mBAAmB,GAC5B,eAAe,GACf;IACD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAA;AACF,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAMtE"}
+{"version":3,"file":"MailTemplateListQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateListQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAA;AAEvE,MAAM,MAAM,mBAAmB,GAC5B,eAAe,GACf;IACD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAA;AACF,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAMtE"}

package/dist/types/model/queries/mailTemplate/MailTemplateQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MailTemplateIdentifier } from '../../mailing';
-import { MailTemplateRow } from './helpers';
+import { MailTemplateIdentifier } from '../../mailing/index.js';
+import { MailTemplateRow } from './helpers.js';
 export declare class MailTemplateQuery extends DatabaseQuery<MailTemplateRow | null> {
     private mailTemplateIdentifier;
     constructor(mailTemplateIdentifier: MailTemplateIdentifier);

package/dist/types/model/queries/mailTemplate/MailTemplateQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAA2B,eAAe,EAAE,MAAM,WAAW,CAAA;AAEpE,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,eAAe,GAAG,IAAI,CAAC;IAE1E,OAAO,CAAC,sBAAsB;gBAAtB,sBAAsB,EAAE,sBAAsB;IAKjD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAWvE"}
+{"version":3,"file":"MailTemplateQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAA;AAEvE,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,eAAe,GAAG,IAAI,CAAC;IAE1E,OAAO,CAAC,sBAAsB;gBAAtB,sBAAsB,EAAE,sBAAsB;IAKjD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAWvE"}

package/dist/types/model/queries/mailTemplate/helpers.d.ts

@@ -1,5 +1,5 @@
 import { SelectBuilder } from '@contember/database';
-import { MailTemplateData, MailTemplateIdentifier } from '../../mailing';
+import { MailTemplateData, MailTemplateIdentifier } from '../../mailing/index.js';
 export type MailTemplateRow = {
     readonly id: string;
 } & MailTemplateData & MailTemplateIdentifier;

package/dist/types/model/queries/mailTemplate/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAExE,MAAM,MAAM,eAAe,GACxB;IACD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACnB,GACC,gBAAgB,GAChB,sBAAsB,CAAA;AAEzB,eAAO,MAAM,uBAAuB,GAAI,CAAC,SAAS,eAAe,uBAUzC,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEjF,MAAM,MAAM,eAAe,GACxB;IACD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACnB,GACC,gBAAgB,GAChB,sBAAsB,CAAA;AAEzB,eAAO,MAAM,uBAAuB,GAAI,CAAC,SAAS,eAAe,uBAUzC,CAAA"}

package/dist/types/model/queries/mailTemplate/index.d.ts

@@ -1,3 +1,3 @@
-export * from './MailTemplateQuery';
-export * from './MailTemplateListQuery';
+export * from './MailTemplateQuery.js';
+export * from './MailTemplateListQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/mailTemplate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AACnC,cAAc,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA"}

package/dist/types/model/queries/membership/AllProjectRolesByIdentityQuery.d.ts

@@ -0,0 +1,24 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+/**
+ * Returns every (project_id, role) pair the identity holds across ALL projects.
+ *
+ * Unlike {@link ProjectRolesByIdentityQuery}, which is scoped to a single
+ * project, this aggregates over the identity's entire project-membership set.
+ * Required by {@link AuthPolicyResolver}, because signIn issues a project-agnostic
+ * (global) session and must evaluate MFA / session policy against the whole role
+ * set.
+ */
+declare class AllProjectRolesByIdentityQuery extends DatabaseQuery<AllProjectRolesByIdentityQuery.Result> {
+    private readonly identityId;
+    constructor(identityId: string);
+    fetch({ db }: DatabaseQueryable): Promise<AllProjectRolesByIdentityQuery.Result>;
+}
+declare namespace AllProjectRolesByIdentityQuery {
+    type Row = {
+        projectId: string;
+        role: string;
+    };
+    type Result = readonly Row[];
+}
+export { AllProjectRolesByIdentityQuery };
+//# sourceMappingURL=AllProjectRolesByIdentityQuery.d.ts.map

package/dist/types/model/queries/membership/AllProjectRolesByIdentityQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AllProjectRolesByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/AllProjectRolesByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF;;;;;;;;GAQG;AACH,cAAM,8BAA+B,SAAQ,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC;IACpF,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAV,UAAU,EAAE,MAAM;IAIzC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC;CAYtF;AAED,kBAAU,8BAA8B,CAAC;IACxC,KAAY,GAAG,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD,KAAY,MAAM,GAAG,SAAS,GAAG,EAAE,CAAA;CACnC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAA"}

package/dist/types/model/queries/membership/ProjectMembersQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { ProjectMembersInput } from '../../../schema';
+import { ProjectMembersInput } from '../../../schema/index.js';
 export declare class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {
     private readonly projectId;
     private readonly projectMemberInput;

package/dist/types/model/queries/membership/ProjectMembersQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAc,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGjE,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IAE/E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,mBAAmB;IAKnD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CA2C1E;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,EAAE,CAAA"}
+{"version":3,"file":"ProjectMembersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAc,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAG1E,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IAE/E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,mBAAmB;IAKnD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CA2C1E;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,EAAE,CAAA"}

package/dist/types/model/queries/membership/index.d.ts

@@ -1,4 +1,5 @@
-export * from './ProjectMembershipByIdentityQuery';
-export * from './ProjectMembersQuery';
-export * from './ProjectRolesByIdentityQuery';
+export * from './AllProjectRolesByIdentityQuery.js';
+export * from './ProjectMembershipByIdentityQuery.js';
+export * from './ProjectMembersQuery.js';
+export * from './ProjectRolesByIdentityQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/membership/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAA;AAClD,cAAc,uBAAuB,CAAA;AACrC,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAA;AACnD,cAAc,uCAAuC,CAAA;AACrD,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA"}

package/dist/types/model/queries/person/PersonByIdPQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MaybePersonRow } from './types';
+import { MaybePersonRow } from './types.js';
 declare class PersonByIdPQuery extends DatabaseQuery<MaybePersonRow> {
     private readonly identityProviderId;
     private readonly externalIdentifier;

package/dist/types/model/queries/person/PersonByIdPQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonByIdPQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdPQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAGxC,cAAM,gBAAiB,SAAQ,aAAa,CAAC,cAAc,CAAC;IAE1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM;IAKtC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAW/D;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"PersonByIdPQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdPQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG3C,cAAM,gBAAiB,SAAQ,aAAa,CAAC,cAAc,CAAC;IAE1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM;IAKtC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAW/D;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/types/model/queries/person/PersonByIdentityBatchQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PersonRow } from './types';
+import { PersonRow } from './types.js';
 export declare class PersonByIdentityBatchQuery extends DatabaseQuery<PersonRow[]> {
     private identityIds;
     constructor(identityIds: string[]);

package/dist/types/model/queries/person/PersonByIdentityBatchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonByIdentityBatchQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdentityBatchQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAGnC,qBAAa,0BAA2B,SAAQ,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7D,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM,EAAE;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"PersonByIdentityBatchQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdentityBatchQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAGtC,qBAAa,0BAA2B,SAAQ,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7D,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM,EAAE;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAO5D"}

package/dist/types/model/queries/person/PersonQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MaybePersonRow } from './types';
+import { MaybePersonRow } from './types.js';
 export type PersonUniqueIdentifier = {
     type: 'id';
     id: string;

package/dist/types/model/queries/person/PersonQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiD,MAAM,qBAAqB,CAAA;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAIxC,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnC,cAAM,WAAY,SAAQ,aAAa,CAAC,cAAc,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO;IAIP,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,aAAa,CAAC,cAAc,CAAC;IAW5F,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW;IAIpC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC;IAI5D,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAI/C,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW;IAI7C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/D;AAuBD,OAAO,EAAE,WAAW,EAAE,CAAA"}
+{"version":3,"file":"PersonQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiD,MAAM,qBAAqB,CAAA;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnC,cAAM,WAAY,SAAQ,aAAa,CAAC,cAAc,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO;IAIP,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,aAAa,CAAC,cAAc,CAAC;IAW5F,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW;IAIpC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC;IAI5D,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAI/C,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW;IAI7C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/D;AAuBD,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/types/model/queries/person/PersonQueryBuilderFactory.d.ts

@@ -1,6 +1,12 @@
-import { PersonRow } from './types';
+import { PersonListRow, PersonRow } from './types.js';
 import { SelectBuilder } from '@contember/database';
 export declare class PersonQueryBuilderFactory {
+    /**
+     * Slim builder for listings — selects only the columns surfaced by
+     * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`
+     * and the `identity` join that the full builder needs only for `roles`.
+     */
+    static createPersonListQueryBuilder(): SelectBuilder<PersonListRow>;
     static createPersonQueryBuilder(): SelectBuilder<PersonRow>;
 }
 //# sourceMappingURL=PersonQueryBuilderFactory.d.ts.map

package/dist/types/model/queries/person/PersonQueryBuilderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQueryBuilderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,qBAAa,yBAAyB;WACvB,wBAAwB;CAetC"}
+{"version":3,"file":"PersonQueryBuilderFactory.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQueryBuilderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,qBAAa,yBAAyB;IACrC;;;;OAIG;WACW,4BAA4B;WAc5B,wBAAwB;CAwBtC"}

package/dist/types/model/queries/person/PersonsQuery.d.ts

@@ -0,0 +1,25 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { PersonListRow } from './types.js';
+export interface PersonsQueryFilter {
+    readonly email?: string | null;
+    readonly personId?: string | null;
+    readonly identityId?: string | null;
+    /**
+     * When set, restricts the result to persons with one of these identity ids.
+     * Used to scope the listing for non-SUPER_ADMIN callers to exactly the members
+     * they may see (resolved via the same per-role filtering as `project.members`).
+     * An empty array therefore matches nobody — callers should short-circuit
+     * instead of issuing the query.
+     */
+    readonly identityIds?: readonly string[];
+}
+export declare class PersonsQuery extends DatabaseQuery<PersonListRow[]> {
+    private readonly filter;
+    private readonly limit?;
+    private readonly offset?;
+    constructor(filter?: PersonsQueryFilter, limit?: number | null | undefined, offset?: number | null | undefined);
+    fetch({ db }: DatabaseQueryable): Promise<PersonListRow[]>;
+    static get defaultLimit(): number;
+    static get maxLimit(): number;
+}
+//# sourceMappingURL=PersonsQuery.d.ts.map

package/dist/types/model/queries/person/PersonsQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAY,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG1C,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAKD,qBAAa,YAAa,SAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAFP,MAAM,GAAE,kBAAuB,EAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA;IAKlC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAgBhE,MAAM,KAAK,YAAY,IAAI,MAAM,CAEhC;IAED,MAAM,KAAK,QAAQ,IAAI,MAAM,CAE5B;CACD"}

package/dist/types/model/queries/person/index.d.ts

@@ -1,5 +1,6 @@
-export * from './PersonByIdentityBatchQuery';
-export * from './PersonByIdPQuery';
-export * from './PersonQuery';
-export * from './types';
+export * from './PersonByIdentityBatchQuery.js';
+export * from './PersonByIdPQuery.js';
+export * from './PersonQuery.js';
+export * from './PersonsQuery.js';
+export * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/person/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA"}

package/dist/types/model/queries/person/types.d.ts

@@ -2,13 +2,37 @@ export interface PersonRow {
     readonly id: string;
     readonly password_hash: string | null;
     readonly identity_id: string;
-    readonly otp_uri: string | null;
+    readonly otp_secret: Buffer | null;
+    readonly otp_secret_version: number | null;
     readonly otp_activated_at: Date | null;
+    readonly otp_pending_secret: Buffer | null;
+    readonly otp_pending_version: number | null;
+    readonly otp_pending_created_at: Date | null;
+    readonly email_otp_enabled: boolean;
     readonly email: string | null;
     readonly name: string | null;
     readonly roles: string[];
     readonly disabled_at: Date | null;
     readonly passwordless_enabled: boolean | null;
+    readonly mfa_grace_until: Date | null;
+    readonly email_verified_at: Date | null;
+    readonly email_verification_required: boolean;
 }
 export type MaybePersonRow = PersonRow | null;
+/**
+ * Slim row for person listings — only the columns {@link PersonResponseFactory}
+ * surfaces. Deliberately excludes auth/secret material (`password_hash`,
+ * `totp_secret*`) that the full {@link PersonRow} carries, so a bulk listing
+ * never drags credentials into memory.
+ */
+export interface PersonListRow {
+    readonly id: string;
+    readonly identity_id: string;
+    readonly email: string | null;
+    readonly name: string | null;
+    readonly otp_activated_at: Date | null;
+    readonly email_otp_enabled: boolean;
+    readonly passwordless_enabled: boolean | null;
+    readonly email_verified_at: Date | null;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types/model/queries/person/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,sBAAsB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAA;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAA;CACvC"}

package/dist/types/model/queries/personToken/PersonTokenQuery.d.ts

@@ -1,12 +1,15 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PersonToken } from '../../type';
+import { PersonToken } from '../../type/index.js';
 export declare class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {
     private readonly identifierType;
     private readonly identifier;
     private readonly type;
+    private readonly latestUnusedOnly;
     private constructor();
     static byId(id: string, type: PersonToken.Type): PersonTokenQuery;
     static byToken(token: string, type: PersonToken.Type): PersonTokenQuery;
+    /** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */
+    static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery;
     fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null>;
 }
 //# sourceMappingURL=PersonTokenQuery.d.ts.map

package/dist/types/model/queries/personToken/PersonTokenQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTokenQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/personToken/PersonTokenQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGxC,qBAAa,gBAAiB,SAAQ,aAAa,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;IAEzE,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHtB,OAAO;WAQO,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;WAI1D,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;IAKxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;CAWvE"}
+{"version":3,"file":"PersonTokenQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/personToken/PersonTokenQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAGjD,qBAAa,gBAAiB,SAAQ,aAAa,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;IAEzE,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAJlC,OAAO;WASO,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;WAI1D,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;IAK9E,sGAAsG;WACxF,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;IAIxF,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;CAiBvE"}

package/dist/types/model/queries/project/ProjectBySlugQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery } from '@contember/database';
 import { DatabaseQueryable } from '@contember/database';
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare class ProjectBySlugQuery extends DatabaseQuery<(Project & {
     updatedAt: Date;
 }) | null> {

package/dist/types/model/queries/project/ProjectBySlugQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,CAAC,OAAO,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAU,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAA3C,WAAW,EAAE,MAAM,EAAmB,KAAK,UAAQ;IAI1E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,OAAO,GAAG;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAsBvF"}
+{"version":3,"file":"ProjectBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,CAAC,OAAO,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAU,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAA3C,WAAW,EAAE,MAAM,EAAmB,KAAK,UAAQ;IAI1E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,OAAO,GAAG;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAsBvF"}

package/dist/types/model/queries/project/ProjectSecretKeysQuery.d.ts

@@ -0,0 +1,17 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export interface ProjectSecretInfoRow {
+    readonly key: string;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+}
+/**
+ * Lists a project's secret KEYS (and timestamps) without ever reading the
+ * encrypted values — used to show which secrets exist. For reading values use
+ * {@link ProjectSecretsQuery} via SecretsManager.readSecrets.
+ */
+export declare class ProjectSecretKeysQuery extends DatabaseQuery<ProjectSecretInfoRow[]> {
+    private readonly projectId;
+    constructor(projectId: string);
+    fetch({ db }: DatabaseQueryable): Promise<ProjectSecretInfoRow[]>;
+}
+//# sourceMappingURL=ProjectSecretKeysQuery.d.ts.map

package/dist/types/model/queries/project/ProjectSecretKeysQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectSecretKeysQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretKeysQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,oBAAoB,EAAE,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAAT,SAAS,EAAE,MAAM;IAIxC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;CAUvE"}

package/dist/types/model/queries/project/ProjectSecretsQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { Providers } from '../../providers';
+import { Providers } from '../../providers.js';
 type ProjectSecretsQueryResult = {
     key: string;
     value: Buffer;

package/dist/types/model/queries/project/ProjectSecretsQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectSecretsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,KAAK,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,EAAE,CAAA;AAE1F,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAA7C,SAAS,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS;IAI/E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAmB1E"}
+{"version":3,"file":"ProjectSecretsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,KAAK,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,EAAE,CAAA;AAE1F,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAA7C,SAAS,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS;IAI/E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAmB1E"}

package/dist/types/model/queries/project/ProjectsByIdentityQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PermissionContext } from '../../authorization';
-import { Project } from '../../type';
+import { PermissionContext } from '../../authorization/index.js';
+import { Project } from '../../type/index.js';
 export declare class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {
     private readonly identityId;
     private readonly permissionContext;

package/dist/types/model/queries/project/ProjectsByIdentityQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAqB,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAAtD,UAAU,EAAE,MAAM,EAAmB,iBAAiB,EAAE,iBAAiB;IAIhG,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAwC7D"}
+{"version":3,"file":"ProjectsByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAqB,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAAtD,UAAU,EAAE,MAAM,EAAmB,iBAAiB,EAAE,iBAAiB;IAIhG,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAwC7D"}

package/dist/types/model/queries/project/ProjectsQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare class ProjectsQuery extends DatabaseQuery<Project[]> {
     fetch({ db }: DatabaseQueryable): Promise<Project[]>;
 }

package/dist/types/model/queries/project/ProjectsQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,aAAc,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAU1D"}
+{"version":3,"file":"ProjectsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,aAAc,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAU1D"}

package/dist/types/model/queries/project/index.d.ts

@@ -1,6 +1,7 @@
-export * from './ProjectSecretsQuery';
-export * from './ProjectBySlugQuery';
-export * from './ProjectsByIdentityQuery';
-export * from './ProjectsQuery';
-export * from './ProjectUpdateTimestampQuery';
+export * from './ProjectSecretsQuery.js';
+export * from './ProjectSecretKeysQuery.js';
+export * from './ProjectBySlugQuery.js';
+export * from './ProjectsByIdentityQuery.js';
+export * from './ProjectsQuery.js';
+export * from './ProjectUpdateTimestampQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oBAAoB,CAAA;AAClC,cAAc,kCAAkC,CAAA"}

package/dist/types/model/queries/rateLimit/RateLimitCountQuery.d.ts

@@ -0,0 +1,10 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { RateLimitScope } from '../../type/RateLimit.js';
+export declare class RateLimitCountQuery extends DatabaseQuery<number> {
+    private readonly scope;
+    private readonly keyHash;
+    private readonly windowStart;
+    constructor(scope: RateLimitScope, keyHash: Buffer, windowStart: Date);
+    fetch({ db }: DatabaseQueryable): Promise<number>;
+}
+//# sourceMappingURL=RateLimitCountQuery.d.ts.map

package/dist/types/model/queries/rateLimit/RateLimitCountQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitCountQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/rateLimit/RateLimitCountQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAFX,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,IAAI;IAK7B,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC;CASvD"}

package/dist/types/model/queries/rateLimit/index.d.ts

@@ -0,0 +1,2 @@
+export * from './RateLimitCountQuery.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/rateLimit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/rateLimit/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA"}