@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/queries/identity/IdentityQuery.d.ts

@@ -1,7 +1,8 @@
-import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { DatabaseQuery, DatabaseQueryable, LockType } from '@contember/database';
 export declare class IdentityQuery extends DatabaseQuery<IdentityQueryResult[]> {
     private readonly ids;
-    constructor(ids: string[]);
+    private readonly lock?;
+    constructor(ids: string[], lock?: LockType | undefined);
     fetch(queryable: DatabaseQueryable): Promise<IdentityQueryResult[]>;
 }
 export interface IdentityQueryResult {

package/dist/types/model/queries/identity/IdentityQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/IdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,qBAAa,aAAc,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IAC1D,OAAO,CAAC,QAAQ,CAAC,GAAG;gBAAH,GAAG,EAAE,MAAM,EAAE;IAIpC,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAWzE;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,EAAE,CAAA;CACf"}
+{"version":3,"file":"IdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/IdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAiB,MAAM,qBAAqB,CAAA;AAE/F,qBAAa,aAAc,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IAErE,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;IAFvB,YACkB,GAAG,EAAE,MAAM,EAAE,EACb,IAAI,CAAC,EAAE,QAAQ,YAAA,EAGhC;IAEK,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAaxE;CACD;AAED,MAAM,WAAW,mBAAmB;IACnC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,MAAM,EAAE,CAAA;CACf"}

package/dist/types/model/queries/identity/index.d.ts

@@ -1,2 +1,3 @@
-export * from './IdentityQuery';
+export * from './IdentityQuery.js';
+export * from './IdentitiesHoldingRoleCountQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/identity/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/identity/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAA;AAClC,cAAc,sCAAsC,CAAA"}

package/dist/types/model/queries/idp/IdentityProviderBySlugQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { IdentityProviderRow } from './types';
+import { IdentityProviderRow } from './types.js';
 export declare class IdentityProviderBySlugQuery extends DatabaseQuery<IdentityProviderRow | null> {
     private readonly slug;
     constructor(slug: string);

package/dist/types/model/queries/idp/IdentityProviderBySlugQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProviderBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAE7C,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC7E,OAAO,CAAC,QAAQ,CAAC,IAAI;gBAAJ,IAAI,EAAE,MAAM;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC;CAS3E"}
+{"version":3,"file":"IdentityProviderBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProviderBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAEhD,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,mBAAmB,GAAG,IAAI,CAAC;IAC7E,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,MAAM,EAExC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAQ1E;CACD"}

package/dist/types/model/queries/idp/IdentityProvidersQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { IdentityProviderDto } from './types';
+import { IdentityProviderDto } from './types.js';
 export declare class IdentityProvidersQuery extends DatabaseQuery<IdentityProviderDto[]> {
     fetch({ db }: DatabaseQueryable): Promise<IdentityProviderDto[]>;
 }

package/dist/types/model/queries/idp/IdentityProvidersQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"IdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAuB,MAAM,SAAS,CAAA;AAElE,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACzE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAKtE"}
+{"version":3,"file":"IdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAEtE,OAAO,EAAE,mBAAmB,EAAuB,MAAM,YAAY,CAAA;AAErE,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACzE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAIrE;CACD"}

package/dist/types/model/queries/idp/IdpSessionByApiKeyQuery.d.ts

@@ -0,0 +1,28 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { Providers } from '../../providers.js';
+import type { IDPSessionState } from '../../service/idp/index.js';
+export type IdpSessionRow = {
+    id: string;
+    identityProviderId: string;
+    providerType: string;
+    providerConfiguration: Record<string, unknown>;
+    providerDisabledAt: Date | null;
+    session: IDPSessionState;
+    /** When the current access token was obtained (sign-in / last refresh) — drives the soft-refresh threshold. */
+    tokenObtainedAt: Date | null;
+    lastValidatedAt: Date;
+    createdAt: Date;
+};
+/**
+ * Fetch the federated-session state bound to a session API key (if any), joined with its
+ * identity provider (type + configuration), and decrypt the stored tokens. Returns null for
+ * password sessions / IdPs without revalidation. Used on the verify hot path, so it pulls
+ * everything the re-validation hook needs in a single round trip.
+ */
+export declare class IdpSessionByApiKeyQuery extends DatabaseQuery<IdpSessionRow | null> {
+    private readonly apiKeyId;
+    private readonly providers;
+    constructor(apiKeyId: string, providers: Providers);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionRow | null>;
+}
+//# sourceMappingURL=IdpSessionByApiKeyQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionByApiKeyQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionByApiKeyQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionByApiKeyQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAC9C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAA;AAEjE,MAAM,MAAM,aAAa,GAAG;IAC3B,EAAE,EAAE,MAAM,CAAA;IACV,kBAAkB,EAAE,MAAM,CAAA;IAC1B,YAAY,EAAE,MAAM,CAAA;IACpB,qBAAqB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC9C,kBAAkB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC/B,OAAO,EAAE,eAAe,CAAA;IACxB,+GAA+G;IAC/G,eAAe,EAAE,IAAI,GAAG,IAAI,CAAA;IAC5B,eAAe,EAAE,IAAI,CAAA;IACrB,SAAS,EAAE,IAAI,CAAA;CACf,CAAA;AAiBD;;;;;GAKG;AACH,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,aAAa,GAAG,IAAI,CAAC;IACnE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAzE,YAA6B,QAAQ,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS,EAEnF;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CA+CpE;CACD"}

package/dist/types/model/queries/idp/IdpSessionsBySidQuery.d.ts

@@ -0,0 +1,18 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export type IdpSessionBySidRow = {
+    id: string;
+    apiKeyId: string;
+};
+/**
+ * Find the federated sessions established for a given IdP session id (`sid`) under a specific
+ * identity provider — the lookup an OIDC back-channel logout performs to map the IdP's `sid` to the
+ * local session(s) to revoke (A10). Hits the `(identity_provider_id, idp_session_id)` index added by
+ * A24. A single `sid` can in principle back more than one local session, so this returns all matches.
+ */
+export declare class IdpSessionsBySidQuery extends DatabaseQuery<IdpSessionBySidRow[]> {
+    private readonly identityProviderId;
+    private readonly sid;
+    constructor(identityProviderId: string, sid: string);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionBySidRow[]>;
+}
+//# sourceMappingURL=IdpSessionsBySidQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionsBySidQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionsBySidQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionsBySidQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,MAAM,kBAAkB,GAAG;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;CAChB,CAAA;AAED;;;;;GAKG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFrB,YACkB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EAG5B;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAYpE;CACD"}

package/dist/types/model/queries/idp/IdpSessionsBySubQuery.d.ts

@@ -0,0 +1,24 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { IdpSessionBySidRow } from './IdpSessionsBySidQuery.js';
+/**
+ * Find the federated sessions for a given subject (`sub`) under a specific identity provider — the
+ * lookup an OIDC back-channel logout performs when the IdP sends a `sub`-only logout token (no `sid`),
+ * which targets *all* of that subject's sessions (OIDC Back-Channel Logout 1.0 §2.4). The subject is
+ * the `external_identifier` recorded in `person_identity_provider` at sign-in, so we walk
+ * `idp_session → api_key → person → person_identity_provider` to map `sub` to the local session(s) to
+ * revoke. Both the session row and the `person_identity_provider` row are constrained to the same
+ * provider so a `sub` is only ever interpreted under the IdP that asserted it.
+ *
+ * Assumption: a person maps to a single subject per provider (the normal case — one IdP link per
+ * person). `idp_session` stores no `sub` of its own, so once a person is matched we revoke *all* of
+ * that person's sessions under the provider. If a person were ever linked to the same IdP under two
+ * subjects, a logout for one subject would also revoke the other's sessions — over-revocation, which
+ * is the safe direction for a logout (it never leaves a session the IdP asked to terminate alive).
+ */
+export declare class IdpSessionsBySubQuery extends DatabaseQuery<IdpSessionBySidRow[]> {
+    private readonly identityProviderId;
+    private readonly sub;
+    constructor(identityProviderId: string, sub: string);
+    fetch({ db }: DatabaseQueryable): Promise<IdpSessionBySidRow[]>;
+}
+//# sourceMappingURL=IdpSessionsBySubQuery.d.ts.map

package/dist/types/model/queries/idp/IdpSessionsBySubQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdpSessionsBySubQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/IdpSessionsBySubQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAC/F,OAAO,EAAE,kBAAkB,EAAE,MAAM,4BAA4B,CAAA;AAE/D;;;;;;;;;;;;;;GAcG;AACH,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,kBAAkB,EAAE,CAAC;IAE5E,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG;IAFrB,YACkB,kBAAkB,EAAE,MAAM,EAC1B,GAAG,EAAE,MAAM,EAG5B;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAiBpE;CACD"}

package/dist/types/model/queries/idp/LocalAuthDisablingIdpsQuery.d.ts

@@ -0,0 +1,18 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+/**
+ * Slugs of the identity providers that forbid this person every local
+ * authentication method — password sign-in, passwordless sign-in and the
+ * password-reset mail. Empty means local authentication is available.
+ *
+ * The IdP link is the marker, so this also covers a person who predates the
+ * provider and was linked to it by e-mail matching, not only one created by
+ * auto-sign-up. A DISABLED provider does not count: turning the provider off
+ * hands local authentication back to everyone linked to it, which is the
+ * break-glass when the IdP is unreachable.
+ */
+export declare class LocalAuthDisablingIdpsQuery extends DatabaseQuery<string[]> {
+    private readonly personId;
+    constructor(personId: string);
+    fetch({ db }: DatabaseQueryable): Promise<string[]>;
+}
+//# sourceMappingURL=LocalAuthDisablingIdpsQuery.d.ts.map

package/dist/types/model/queries/idp/LocalAuthDisablingIdpsQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"LocalAuthDisablingIdpsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/LocalAuthDisablingIdpsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA2B,MAAM,qBAAqB,CAAA;AAE/F;;;;;;;;;;GAUG;AACH,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,MAAM,EAAE,CAAC;IAEtE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAD1B,YACkB,QAAQ,EAAE,MAAM,EAGjC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAmBxD;CACD"}

package/dist/types/model/queries/idp/PersonIdentityProvidersQuery.d.ts

@@ -0,0 +1,21 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export interface PersonIdentityProviderRow {
+    readonly id: string;
+    readonly createdAt: Date;
+    readonly externalIdentifier: string;
+    readonly identityProviderSlug: string;
+    readonly identityProviderType: string;
+    readonly identityProviderDisabledAt: Date | null;
+    readonly identityProviderDisableLocalAuthentication: boolean;
+}
+/**
+ * Lists the external IdP connections of a single person, joined with the
+ * identity provider they belong to. Used by the `Person.identityProviders`
+ * field and by the disconnect flow to enforce ownership and lock-out protection.
+ */
+export declare class PersonIdentityProvidersQuery extends DatabaseQuery<PersonIdentityProviderRow[]> {
+    private readonly personId;
+    constructor(personId: string);
+    fetch({ db }: DatabaseQueryable): Promise<PersonIdentityProviderRow[]>;
+}
+//# sourceMappingURL=PersonIdentityProvidersQuery.d.ts.map

package/dist/types/model/queries/idp/PersonIdentityProvidersQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonIdentityProvidersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/PersonIdentityProvidersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,WAAW,yBAAyB;IACzC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,oBAAoB,EAAE,MAAM,CAAA;IACrC,QAAQ,CAAC,0BAA0B,EAAE,IAAI,GAAG,IAAI,CAAA;IAChD,QAAQ,CAAC,0CAA0C,EAAE,OAAO,CAAA;CAC5D;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,aAAa,CAAC,yBAAyB,EAAE,CAAC;IAE1F,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAD1B,YACkB,QAAQ,EAAE,MAAM,EAGjC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,EAAE,CAAC,CAmB3E;CACD"}

package/dist/types/model/queries/idp/helpers.d.ts

@@ -1,5 +1,5 @@
 import { SelectBuilder } from '@contember/database';
-import { IdentityProviderDto, IdentityProviderRow } from './types';
+import { IdentityProviderDto, IdentityProviderRow } from './types.js';
 export declare const createBaseIdpQuery: () => SelectBuilder<IdentityProviderRow>;
-export declare const createIdpDto: ({ exclusive, autoSignUp, initReturnsConfig, ...row }: IdentityProviderRow) => IdentityProviderDto;
+export declare const createIdpDto: ({ exclusive, autoSignUp, initReturnsConfig, requireVerifiedEmail, assumeEmailVerified, disableLocalAuthentication, ...row }: IdentityProviderRow) => IdentityProviderDto;
 //# sourceMappingURL=helpers.d.ts.map

package/dist/types/model/queries/idp/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAA;AAElE,eAAO,MAAM,kBAAkB,0CAUH,CAAA;AAE5B,eAAO,MAAM,YAAY,GAAI,sDAAsD,mBAAmB,KAAG,mBAKxG,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErE,eAAO,MAAM,kBAAkB,0CAaH,CAAA;AAE5B,eAAO,MAAM,YAAY,gIACqG,mBAAmB,KAC9I,mBAKF,CAAA"}

package/dist/types/model/queries/idp/index.d.ts

@@ -1,3 +1,8 @@
-export * from './IdentityProviderBySlugQuery';
-export * from './IdentityProvidersQuery';
+export * from './IdentityProviderBySlugQuery.js';
+export * from './IdentityProvidersQuery.js';
+export * from './IdpSessionByApiKeyQuery.js';
+export * from './IdpSessionsBySidQuery.js';
+export * from './IdpSessionsBySubQuery.js';
+export * from './LocalAuthDisablingIdpsQuery.js';
+export * from './PersonIdentityProvidersQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/idp/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,+BAA+B,CAAA;AAC7C,cAAc,0BAA0B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/index.ts"],"names":[],"mappings":"AAAA,cAAc,kCAAkC,CAAA;AAChD,cAAc,6BAA6B,CAAA;AAC3C,cAAc,8BAA8B,CAAA;AAC5C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,4BAA4B,CAAA;AAC1C,cAAc,kCAAkC,CAAA;AAChD,cAAc,mCAAmC,CAAA"}

package/dist/types/model/queries/idp/types.d.ts

@@ -1,4 +1,4 @@
-import { IdentityProviderData } from '../../type';
+import { IdentityProviderData } from '../../type/index.js';
 export type IdentityProviderRow = {
     id: string;
     slug: string;
@@ -8,6 +8,9 @@ export type IdentityProviderRow = {
     autoSignUp: boolean;
     exclusive: boolean;
     initReturnsConfig: boolean;
+    requireVerifiedEmail: boolean;
+    assumeEmailVerified: boolean;
+    disableLocalAuthentication: boolean;
 };
 export type IdentityProviderDto = {
     id: string;

package/dist/types/model/queries/idp/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAA;AAEjD,MAAM,MAAM,mBAAmB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;CAC1B,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC5B;IACD,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB,GACC,oBAAoB,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/idp/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAE1D,MAAM,MAAM,mBAAmB,GAAG;IACjC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IACvB,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACtC,UAAU,EAAE,OAAO,CAAA;IACnB,SAAS,EAAE,OAAO,CAAA;IAClB,iBAAiB,EAAE,OAAO,CAAA;IAC1B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,mBAAmB,EAAE,OAAO,CAAA;IAC5B,0BAA0B,EAAE,OAAO,CAAA;CACnC,CAAA;AAED,MAAM,MAAM,mBAAmB,GAC5B;IACD,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;CACvB,GACC,oBAAoB,CAAA"}

package/dist/types/model/queries/index.d.ts

@@ -1,9 +1,12 @@
-export * from './apiKey';
-export * from './configuration';
-export * from './mailTemplate';
-export * from './membership';
-export * from './person';
-export * from './identity';
-export * from './idp';
-export * from './project';
+export * from './apiKey/index.js';
+export * from './authPolicy/index.js';
+export * from './customRole/index.js';
+export * from './configuration/index.js';
+export * from './mailTemplate/index.js';
+export * from './membership/index.js';
+export * from './person/index.js';
+export * from './identity/index.js';
+export * from './idp/index.js';
+export * from './project/index.js';
+export * from './rateLimit/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/queries/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAA;AACxB,cAAc,iBAAiB,CAAA;AAC/B,cAAc,gBAAgB,CAAA;AAC9B,cAAc,cAAc,CAAA;AAC5B,cAAc,UAAU,CAAA;AACxB,cAAc,YAAY,CAAA;AAC1B,cAAc,OAAO,CAAA;AACrB,cAAc,WAAW,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/model/queries/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAA;AACjC,cAAc,uBAAuB,CAAA;AACrC,cAAc,uBAAuB,CAAA;AACrC,cAAc,0BAA0B,CAAA;AACxC,cAAc,yBAAyB,CAAA;AACvC,cAAc,uBAAuB,CAAA;AACrC,cAAc,mBAAmB,CAAA;AACjC,cAAc,qBAAqB,CAAA;AACnC,cAAc,gBAAgB,CAAA;AAC9B,cAAc,oBAAoB,CAAA;AAClC,cAAc,sBAAsB,CAAA"}

package/dist/types/model/queries/mailTemplate/MailTemplateListQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MailTemplateRow } from './helpers';
+import { MailTemplateRow } from './helpers.js';
 export type MailTemplateListRow = MailTemplateRow & {
     projectSlug: string | null;
 };

package/dist/types/model/queries/mailTemplate/MailTemplateListQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateListQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateListQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAA2B,eAAe,EAAE,MAAM,WAAW,CAAA;AAEpE,MAAM,MAAM,mBAAmB,GAC5B,eAAe,GACf;IACD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAA;AACF,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;CAMtE"}
+{"version":3,"file":"MailTemplateListQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateListQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAA;AAEvE,MAAM,MAAM,mBAAmB,GAC5B,eAAe,GACf;IACD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC1B,CAAA;AACF,qBAAa,qBAAsB,SAAQ,aAAa,CAAC,mBAAmB,EAAE,CAAC;IACxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC,CAKrE;CACD"}

package/dist/types/model/queries/mailTemplate/MailTemplateQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MailTemplateIdentifier } from '../../mailing';
-import { MailTemplateRow } from './helpers';
+import { MailTemplateIdentifier } from '../../mailing/index.js';
+import { MailTemplateRow } from './helpers.js';
 export declare class MailTemplateQuery extends DatabaseQuery<MailTemplateRow | null> {
     private mailTemplateIdentifier;
     constructor(mailTemplateIdentifier: MailTemplateIdentifier);

package/dist/types/model/queries/mailTemplate/MailTemplateQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"MailTemplateQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACtD,OAAO,EAA2B,eAAe,EAAE,MAAM,WAAW,CAAA;AAEpE,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,eAAe,GAAG,IAAI,CAAC;IAE1E,OAAO,CAAC,sBAAsB;gBAAtB,sBAAsB,EAAE,sBAAsB;IAKjD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;CAWvE"}
+{"version":3,"file":"MailTemplateQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/MailTemplateQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAC/D,OAAO,EAA2B,eAAe,EAAE,MAAM,cAAc,CAAA;AAEvE,qBAAa,iBAAkB,SAAQ,aAAa,CAAC,eAAe,GAAG,IAAI,CAAC;IAE1E,OAAO,CAAC,sBAAsB;IAD/B,YACS,sBAAsB,EAAE,sBAAsB,EAGtD;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAUtE;CACD"}

package/dist/types/model/queries/mailTemplate/helpers.d.ts

@@ -1,5 +1,5 @@
 import { SelectBuilder } from '@contember/database';
-import { MailTemplateData, MailTemplateIdentifier } from '../../mailing';
+import { MailTemplateData, MailTemplateIdentifier } from '../../mailing/index.js';
 export type MailTemplateRow = {
     readonly id: string;
 } & MailTemplateData & MailTemplateIdentifier;

package/dist/types/model/queries/mailTemplate/helpers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AAExE,MAAM,MAAM,eAAe,GACxB;IACD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACnB,GACC,gBAAgB,GAChB,sBAAsB,CAAA;AAEzB,eAAO,MAAM,uBAAuB,GAAI,CAAC,SAAS,eAAe,uBAUzC,CAAA"}
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/helpers.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,gBAAgB,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAA;AAEjF,MAAM,MAAM,eAAe,GACxB;IACD,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;CACnB,GACC,gBAAgB,GAChB,sBAAsB,CAAA;AAEzB,eAAO,MAAM,uBAAuB,GAAI,CAAC,SAAS,eAAe,uBAUzC,CAAA"}

package/dist/types/model/queries/mailTemplate/index.d.ts

@@ -1,3 +1,3 @@
-export * from './MailTemplateQuery';
-export * from './MailTemplateListQuery';
+export * from './MailTemplateQuery.js';
+export * from './MailTemplateListQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/mailTemplate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/index.ts"],"names":[],"mappings":"AAAA,cAAc,qBAAqB,CAAA;AACnC,cAAc,yBAAyB,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/mailTemplate/index.ts"],"names":[],"mappings":"AAAA,cAAc,wBAAwB,CAAA;AACtC,cAAc,4BAA4B,CAAA"}

package/dist/types/model/queries/membership/AllProjectRolesByIdentityQuery.d.ts

@@ -0,0 +1,24 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+/**
+ * Returns every (project_id, role) pair the identity holds across ALL projects.
+ *
+ * Unlike {@link ProjectRolesByIdentityQuery}, which is scoped to a single
+ * project, this aggregates over the identity's entire project-membership set.
+ * Required by {@link AuthPolicyResolver}, because signIn issues a project-agnostic
+ * (global) session and must evaluate MFA / session policy against the whole role
+ * set.
+ */
+declare class AllProjectRolesByIdentityQuery extends DatabaseQuery<AllProjectRolesByIdentityQuery.Result> {
+    private readonly identityId;
+    constructor(identityId: string);
+    fetch({ db }: DatabaseQueryable): Promise<AllProjectRolesByIdentityQuery.Result>;
+}
+declare namespace AllProjectRolesByIdentityQuery {
+    type Row = {
+        projectId: string;
+        role: string;
+    };
+    type Result = readonly Row[];
+}
+export { AllProjectRolesByIdentityQuery };
+//# sourceMappingURL=AllProjectRolesByIdentityQuery.d.ts.map

package/dist/types/model/queries/membership/AllProjectRolesByIdentityQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AllProjectRolesByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/AllProjectRolesByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF;;;;;;;;GAQG;AACH,cAAM,8BAA+B,SAAQ,aAAa,CAAC,8BAA8B,CAAC,MAAM,CAAC;IACpF,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAvC,YAA6B,UAAU,EAAE,MAAM,EAE9C;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAWrF;CACD;AAED,kBAAU,8BAA8B,CAAC;IACxC,KAAY,GAAG,GAAG;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrD,KAAY,MAAM,GAAG,SAAS,GAAG,EAAE,CAAA;CACnC;AAED,OAAO,EAAE,8BAA8B,EAAE,CAAA"}

package/dist/types/model/queries/membership/IdentityHasProjectMembershipsQuery.d.ts

@@ -0,0 +1,7 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export declare class IdentityHasProjectMembershipsQuery extends DatabaseQuery<ReadonlySet<string>> {
+    private readonly identityIds;
+    constructor(identityIds: readonly string[]);
+    fetch({ db }: DatabaseQueryable): Promise<ReadonlySet<string>>;
+}
+//# sourceMappingURL=IdentityHasProjectMembershipsQuery.d.ts.map

package/dist/types/model/queries/membership/IdentityHasProjectMembershipsQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"IdentityHasProjectMembershipsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/IdentityHasProjectMembershipsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,qBAAa,kCAAmC,SAAQ,aAAa,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAC7E,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,SAAS,MAAM,EAAE,EAE1D;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAQnE;CACD"}

package/dist/types/model/queries/membership/ProjectMembersQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { ProjectMembersInput } from '../../../schema';
+import { ProjectMembersInput } from '../../../schema/index.js';
 export declare class ProjectMembersQuery extends DatabaseQuery<ProjectMembersQueryResult> {
     private readonly projectId;
     private readonly projectMemberInput;

package/dist/types/model/queries/membership/ProjectMembersQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAc,mBAAmB,EAAE,MAAM,iBAAiB,CAAA;AAGjE,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IAE/E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,mBAAmB;IAKnD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CA4C1E;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,EAAE,CAAA"}
+{"version":3,"file":"ProjectMembersQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembersQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAc,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAG1E,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IAE/E,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAFpC,YACkB,SAAS,EAAE,MAAM,EACjB,kBAAkB,EAAE,mBAAmB,EAGxD;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CA2CzE;CACD;AAED,MAAM,WAAW,sBAAsB;IACtC,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,MAAM,yBAAyB,GAAG,sBAAsB,EAAE,CAAA"}

package/dist/types/model/queries/membership/ProjectMembershipByIdentityQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectMembershipByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembershipByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,cAAM,gCAAiC,SAAQ,aAAa,CAAC,gCAAgC,CAAC,MAAM,CAAC;IACxF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAvE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAmB,UAAU,EAAE,MAAM,EAAE;IAIxG,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC,MAAM,CAAC;CAgCxF;AAED,kBAAU,gCAAgC,CAAC;IAC1C,KAAY,GAAG,GAAG,GAAG,CAAC,UAAU,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,KAAY,MAAM,GAAG,SAAS,GAAG,EAAE,CAAA;CACnC;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAA"}
+{"version":3,"file":"ProjectMembershipByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectMembershipByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAA;AAEvC,cAAM,gCAAiC,SAAQ,aAAa,CAAC,gCAAgC,CAAC,MAAM,CAAC;IACxF,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAApG,YAA6B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAmB,UAAU,EAAE,MAAM,EAAE,EAE7G;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,gCAAgC,CAAC,MAAM,CAAC,CA+BvF;CACD;AAED,kBAAU,gCAAgC,CAAC;IAC1C,KAAY,GAAG,GAAG,GAAG,CAAC,UAAU,GAAG;QAAE,UAAU,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,KAAY,MAAM,GAAG,SAAS,GAAG,EAAE,CAAA;CACnC;AAED,OAAO,EAAE,gCAAgC,EAAE,CAAA"}

package/dist/types/model/queries/membership/ProjectRolesByIdentityQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectRolesByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectRolesByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAGrF,cAAM,2BAA4B,SAAQ,aAAa,CAAC,2BAA2B,CAAC,MAAM,CAAC;IAC9E,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU;gBAAvE,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAmB,UAAU,EAAE,MAAM;IAItG,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC;CAgBnF;AAED,kBAAU,2BAA2B,CAAC;IACrC,KAAY,MAAM,GAAG;QACpB,KAAK,EAAE,MAAM,EAAE,CAAA;KACf,CAAA;CACD;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAA"}
+{"version":3,"file":"ProjectRolesByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectRolesByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAGrF,cAAM,2BAA4B,SAAQ,aAAa,CAAC,2BAA2B,CAAC,MAAM,CAAC;IAC9E,OAAO,CAAC,QAAQ,CAAC,OAAO;IAAqC,OAAO,CAAC,QAAQ,CAAC,UAAU;IAApG,YAA6B,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,EAAmB,UAAU,EAAE,MAAM,EAE3G;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,2BAA2B,CAAC,MAAM,CAAC,CAelF;CACD;AAED,kBAAU,2BAA2B,CAAC;IACrC,KAAY,MAAM,GAAG;QACpB,KAAK,EAAE,MAAM,EAAE,CAAA;KACf,CAAA;CACD;AAED,OAAO,EAAE,2BAA2B,EAAE,CAAA"}

package/dist/types/model/queries/membership/ProjectSlugSpecification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectSlugSpecification.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectSlugSpecification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAElF,eAAO,MAAM,aAAa,GAAI,MAAM,MAAM,KAAG,0BAQ6D,CAAA"}
+{"version":3,"file":"ProjectSlugSpecification.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/ProjectSlugSpecification.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,0BAA0B,EAAE,MAAM,qBAAqB,CAAA;AAElF,eAAO,MAAM,aAAa,SAAU,MAAM,KAAG,0BAQ6D,CAAA"}

package/dist/types/model/queries/membership/index.d.ts

@@ -1,4 +1,6 @@
-export * from './ProjectMembershipByIdentityQuery';
-export * from './ProjectMembersQuery';
-export * from './ProjectRolesByIdentityQuery';
+export * from './AllProjectRolesByIdentityQuery.js';
+export * from './IdentityHasProjectMembershipsQuery.js';
+export * from './ProjectMembershipByIdentityQuery.js';
+export * from './ProjectMembersQuery.js';
+export * from './ProjectRolesByIdentityQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/membership/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/index.ts"],"names":[],"mappings":"AAAA,cAAc,oCAAoC,CAAA;AAClD,cAAc,uBAAuB,CAAA;AACrC,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/membership/index.ts"],"names":[],"mappings":"AAAA,cAAc,qCAAqC,CAAA;AACnD,cAAc,yCAAyC,CAAA;AACvD,cAAc,uCAAuC,CAAA;AACrD,cAAc,0BAA0B,CAAA;AACxC,cAAc,kCAAkC,CAAA"}

package/dist/types/model/queries/person/PersonByIdPQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MaybePersonRow } from './types';
+import { MaybePersonRow } from './types.js';
 declare class PersonByIdPQuery extends DatabaseQuery<MaybePersonRow> {
     private readonly identityProviderId;
     private readonly externalIdentifier;

package/dist/types/model/queries/person/PersonByIdPQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonByIdPQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdPQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAGxC,cAAM,gBAAiB,SAAQ,aAAa,CAAC,cAAc,CAAC;IAE1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM;IAKtC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAW/D;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}
+{"version":3,"file":"PersonByIdPQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdPQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAG3C,cAAM,gBAAiB,SAAQ,aAAa,CAAC,cAAc,CAAC;IAE1D,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IAFpC,YACkB,kBAAkB,EAAE,MAAM,EAC1B,kBAAkB,EAAE,MAAM,EAG3C;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAU9D;CACD;AAED,OAAO,EAAE,gBAAgB,EAAE,CAAA"}

package/dist/types/model/queries/person/PersonByIdentityBatchQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PersonRow } from './types';
+import { PersonRow } from './types.js';
 export declare class PersonByIdentityBatchQuery extends DatabaseQuery<PersonRow[]> {
     private identityIds;
     constructor(identityIds: string[]);

package/dist/types/model/queries/person/PersonByIdentityBatchQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonByIdentityBatchQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdentityBatchQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AAGnC,qBAAa,0BAA2B,SAAQ,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7D,OAAO,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM,EAAE;IAInC,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;CAO5D"}
+{"version":3,"file":"PersonByIdentityBatchQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonByIdentityBatchQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAGtC,qBAAa,0BAA2B,SAAQ,aAAa,CAAC,SAAS,EAAE,CAAC;IAC7D,OAAO,CAAC,WAAW;IAA/B,YAAoB,WAAW,EAAE,MAAM,EAAE,EAExC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAM3D;CACD"}

package/dist/types/model/queries/person/PersonQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { MaybePersonRow } from './types';
+import { MaybePersonRow } from './types.js';
 export type PersonUniqueIdentifier = {
     type: 'id';
     id: string;

package/dist/types/model/queries/person/PersonQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiD,MAAM,qBAAqB,CAAA;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAA;AAIxC,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnC,cAAM,WAAY,SAAQ,aAAa,CAAC,cAAc,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO;IAIP,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,aAAa,CAAC,cAAc,CAAC;IAW5F,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW;IAIpC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC;IAI5D,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW;IAI/C,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW;IAI7C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC;CAO/D;AAuBD,OAAO,EAAE,WAAW,EAAE,CAAA"}
+{"version":3,"file":"PersonQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiD,MAAM,qBAAqB,CAAA;AACrH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAI3C,MAAM,MAAM,sBAAsB,GAC/B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAC1B;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,EAAE,EAAE,MAAM,CAAA;CAAE,GAChC;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEnC,cAAM,WAAY,SAAQ,aAAa,CAAC,cAAc,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAzC,OAAO,eAEN;IAED,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,sBAAsB,GAAG,aAAa,CAAC,cAAc,CAAC,CAS3F;IAED,MAAM,CAAC,IAAI,CAAC,EAAE,EAAE,MAAM,GAAG,WAAW,CAEnC;IAED,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,aAAa,CAAC,cAAc,CAAC,CAE3D;IAED,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAE9C;IAED,MAAM,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,GAAG,WAAW,CAElD;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAM9D;CACD;AAuBD,OAAO,EAAE,WAAW,EAAE,CAAA"}

package/dist/types/model/queries/person/PersonQueryBuilderFactory.d.ts

@@ -1,6 +1,12 @@
-import { PersonRow } from './types';
+import { PersonListRow, PersonRow } from './types.js';
 import { SelectBuilder } from '@contember/database';
 export declare class PersonQueryBuilderFactory {
+    /**
+     * Slim builder for listings — selects only the columns surfaced by
+     * {@link PersonResponseFactory}, omitting `password_hash` / `totp_secret*`
+     * and the `identity` join that the full builder needs only for `roles`.
+     */
+    static createPersonListQueryBuilder(): SelectBuilder<PersonListRow>;
     static createPersonQueryBuilder(): SelectBuilder<PersonRow>;
 }
 //# sourceMappingURL=PersonQueryBuilderFactory.d.ts.map

package/dist/types/model/queries/person/PersonQueryBuilderFactory.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonQueryBuilderFactory.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQueryBuilderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAA;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,qBAAa,yBAAyB;WACvB,wBAAwB;CAetC"}
+{"version":3,"file":"PersonQueryBuilderFactory.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonQueryBuilderFactory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AAEnD,qBAAa,yBAAyB;IACrC;;;;OAIG;IACH,OAAc,4BAA4B,iCAazC;IAED,OAAc,wBAAwB,6BA0BrC;CACD"}

package/dist/types/model/queries/person/PersonsQuery.d.ts

@@ -0,0 +1,25 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { PersonListRow } from './types.js';
+export interface PersonsQueryFilter {
+    readonly email?: string | null;
+    readonly personId?: string | null;
+    readonly identityId?: string | null;
+    /**
+     * When set, restricts the result to persons with one of these identity ids.
+     * Used to scope the listing for non-SUPER_ADMIN callers to exactly the members
+     * they may see (resolved via the same per-role filtering as `project.members`).
+     * An empty array therefore matches nobody — callers should short-circuit
+     * instead of issuing the query.
+     */
+    readonly identityIds?: readonly string[];
+}
+export declare class PersonsQuery extends DatabaseQuery<PersonListRow[]> {
+    private readonly filter;
+    private readonly limit?;
+    private readonly offset?;
+    constructor(filter?: PersonsQueryFilter, limit?: number | null | undefined, offset?: number | null | undefined);
+    fetch({ db }: DatabaseQueryable): Promise<PersonListRow[]>;
+    static get defaultLimit(): number;
+    static get maxLimit(): number;
+}
+//# sourceMappingURL=PersonsQuery.d.ts.map

package/dist/types/model/queries/person/PersonsQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PersonsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/PersonsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAY,MAAM,qBAAqB,CAAA;AAChF,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAA;AAG1C,MAAM,WAAW,kBAAkB;IAClC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACxC;AAKD,qBAAa,YAAa,SAAQ,aAAa,CAAC,aAAa,EAAE,CAAC;IAE9D,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC;IAHzB,YACkB,MAAM,GAAE,kBAAuB,EAC/B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EACrB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,YAAA,EAGvC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAc/D;IAED,MAAM,KAAK,YAAY,IAAI,MAAM,CAEhC;IAED,MAAM,KAAK,QAAQ,IAAI,MAAM,CAE5B;CACD"}

package/dist/types/model/queries/person/index.d.ts

@@ -1,5 +1,6 @@
-export * from './PersonByIdentityBatchQuery';
-export * from './PersonByIdPQuery';
-export * from './PersonQuery';
-export * from './types';
+export * from './PersonByIdentityBatchQuery.js';
+export * from './PersonByIdPQuery.js';
+export * from './PersonQuery.js';
+export * from './PersonsQuery.js';
+export * from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/person/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/index.ts"],"names":[],"mappings":"AAAA,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oBAAoB,CAAA;AAClC,cAAc,eAAe,CAAA;AAC7B,cAAc,SAAS,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/index.ts"],"names":[],"mappings":"AAAA,cAAc,iCAAiC,CAAA;AAC/C,cAAc,uBAAuB,CAAA;AACrC,cAAc,kBAAkB,CAAA;AAChC,cAAc,mBAAmB,CAAA;AACjC,cAAc,YAAY,CAAA"}