@contember/engine-tenant-api 2.1.0-rc.3 → 2.2.0-alpha.10

package/dist/types/model/queries/person/types.d.ts

@@ -2,13 +2,40 @@ export interface PersonRow {
     readonly id: string;
     readonly password_hash: string | null;
     readonly identity_id: string;
-    readonly otp_uri: string | null;
+    readonly otp_secret: Buffer | null;
+    readonly otp_secret_version: number | null;
     readonly otp_activated_at: Date | null;
+    readonly otp_pending_secret: Buffer | null;
+    readonly otp_pending_version: number | null;
+    readonly otp_pending_created_at: Date | null;
+    readonly email_otp_enabled: boolean;
     readonly email: string | null;
     readonly name: string | null;
     readonly roles: string[];
     readonly disabled_at: Date | null;
     readonly passwordless_enabled: boolean | null;
+    readonly mfa_grace_until: Date | null;
+    /** `mfa_grace_until > now()` computed on the DB clock — the authoritative grace-window gate. */
+    readonly is_in_grace: boolean;
+    readonly email_verified_at: Date | null;
+    readonly email_verification_required: boolean;
 }
 export type MaybePersonRow = PersonRow | null;
+/**
+ * Slim row for person listings — only the columns {@link PersonResponseFactory}
+ * surfaces. Deliberately excludes auth/secret material (`password_hash`,
+ * `totp_secret*`) that the full {@link PersonRow} carries, so a bulk listing
+ * never drags credentials into memory.
+ */
+export interface PersonListRow {
+    readonly id: string;
+    readonly identity_id: string;
+    readonly email: string | null;
+    readonly name: string | null;
+    readonly otp_activated_at: Date | null;
+    readonly email_otp_enabled: boolean;
+    readonly passwordless_enabled: boolean | null;
+    readonly email_verified_at: Date | null;
+    readonly disabled_at: Date | null;
+}
 //# sourceMappingURL=types.d.ts.map

package/dist/types/model/queries/person/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/person/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,SAAS;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IAClC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1C,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3C,QAAQ,CAAC,sBAAsB,EAAE,IAAI,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;IACjC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,eAAe,EAAE,IAAI,GAAG,IAAI,CAAA;IACrC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAA;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,2BAA2B,EAAE,OAAO,CAAA;CAC7C;AAED,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,IAAI,CAAA;AAE7C;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,IAAI,GAAG,IAAI,CAAA;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAA;IACnC,QAAQ,CAAC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAA;IAC7C,QAAQ,CAAC,iBAAiB,EAAE,IAAI,GAAG,IAAI,CAAA;IACvC,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAA;CACjC"}

package/dist/types/model/queries/personToken/PersonTokenQuery.d.ts

@@ -1,12 +1,15 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PersonToken } from '../../type';
+import { PersonToken } from '../../type/index.js';
 export declare class PersonTokenQuery extends DatabaseQuery<PersonToken.Row | null> {
     private readonly identifierType;
     private readonly identifier;
     private readonly type;
+    private readonly latestUnusedOnly;
     private constructor();
     static byId(id: string, type: PersonToken.Type): PersonTokenQuery;
     static byToken(token: string, type: PersonToken.Type): PersonTokenQuery;
+    /** Latest still-unused token of the given type for a person (e.g. the most recent email OTP code). */
+    static latestUnusedByPerson(personId: string, type: PersonToken.Type): PersonTokenQuery;
     fetch({ db }: DatabaseQueryable): Promise<PersonToken.Row | null>;
 }
 //# sourceMappingURL=PersonTokenQuery.d.ts.map

package/dist/types/model/queries/personToken/PersonTokenQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"PersonTokenQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/personToken/PersonTokenQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGxC,qBAAa,gBAAiB,SAAQ,aAAa,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;IAEzE,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IAHtB,OAAO;WAQO,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;WAI1D,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB;IAKxE,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;CAWvE"}
+{"version":3,"file":"PersonTokenQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/personToken/PersonTokenQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAGjD,qBAAa,gBAAiB,SAAQ,aAAa,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC;IAEzE,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAC3B,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IAJlC,OAAO,eAON;IAED,OAAc,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB,CAEvE;IAED,OAAc,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB,CAG7E;IAED,sGAAsG;IACtG,OAAc,oBAAoB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,GAAG,gBAAgB,CAE7F;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,GAAG,IAAI,CAAC,CAoBtE;CACD"}

package/dist/types/model/queries/project/ProjectBySlugQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery } from '@contember/database';
 import { DatabaseQueryable } from '@contember/database';
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare class ProjectBySlugQuery extends DatabaseQuery<(Project & {
     updatedAt: Date;
 }) | null> {

package/dist/types/model/queries/project/ProjectBySlugQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,CAAC,OAAO,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAU,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAA3C,WAAW,EAAE,MAAM,EAAmB,KAAK,UAAQ;IAI1E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,OAAO,GAAG;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAsBvF"}
+{"version":3,"file":"ProjectBySlugQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectBySlugQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAiB,MAAM,qBAAqB,CAAA;AAClE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,kBAAmB,SAAQ,aAAa,CAAC,CAAC,OAAO,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,CAAC,GAAG,IAAI,CAAC;IAChF,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAU,OAAO,CAAC,QAAQ,CAAC,KAAK;IAAxE,YAA6B,WAAW,EAAE,MAAM,EAAmB,KAAK,UAAQ,EAE/E;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,CAAC,OAAO,GAAG;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC,CAqBtF;CACD"}

package/dist/types/model/queries/project/ProjectSecretKeysQuery.d.ts

@@ -0,0 +1,17 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+export interface ProjectSecretInfoRow {
+    readonly key: string;
+    readonly created_at: Date;
+    readonly updated_at: Date;
+}
+/**
+ * Lists a project's secret KEYS (and timestamps) without ever reading the
+ * encrypted values — used to show which secrets exist. For reading values use
+ * {@link ProjectSecretsQuery} via SecretsManager.readSecrets.
+ */
+export declare class ProjectSecretKeysQuery extends DatabaseQuery<ProjectSecretInfoRow[]> {
+    private readonly projectId;
+    constructor(projectId: string);
+    fetch({ db }: DatabaseQueryable): Promise<ProjectSecretInfoRow[]>;
+}
+//# sourceMappingURL=ProjectSecretKeysQuery.d.ts.map

package/dist/types/model/queries/project/ProjectSecretKeysQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ProjectSecretKeysQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretKeysQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,MAAM,WAAW,oBAAoB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;CACzB;AAED;;;;GAIG;AACH,qBAAa,sBAAuB,SAAQ,aAAa,CAAC,oBAAoB,EAAE,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAtC,YAA6B,SAAS,EAAE,MAAM,EAE7C;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC,CAStE;CACD"}

package/dist/types/model/queries/project/ProjectSecretsQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { Providers } from '../../providers';
+import { Providers } from '../../providers.js';
 type ProjectSecretsQueryResult = {
     key: string;
     value: Buffer;

package/dist/types/model/queries/project/ProjectSecretsQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectSecretsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE3C,KAAK,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,EAAE,CAAA;AAE1F,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;gBAA7C,SAAS,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS;IAI/E,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAmB1E"}
+{"version":3,"file":"ProjectSecretsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectSecretsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAA;AAE9C,KAAK,yBAAyB,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,EAAE,CAAA;AAE1F,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,yBAAyB,CAAC;IACpE,OAAO,CAAC,QAAQ,CAAC,SAAS;IAAU,OAAO,CAAC,QAAQ,CAAC,SAAS;IAA1E,YAA6B,SAAS,EAAE,MAAM,EAAmB,SAAS,EAAE,SAAS,EAEpF;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,yBAAyB,CAAC,CAkBzE;CACD"}

package/dist/types/model/queries/project/ProjectUpdateTimestampQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectUpdateTimestampQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectUpdateTimestampQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW;gBAAX,WAAW,EAAE,MAAM;IAI1C,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;CAW5D"}
+{"version":3,"file":"ProjectUpdateTimestampQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectUpdateTimestampQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,qBAAa,2BAA4B,SAAQ,aAAa,CAAC,IAAI,GAAG,IAAI,CAAC;IAC9D,OAAO,CAAC,QAAQ,CAAC,WAAW;IAAxC,YAA6B,WAAW,EAAE,MAAM,EAE/C;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAU3D;CACD"}

package/dist/types/model/queries/project/ProjectsByIdentityQuery.d.ts

@@ -1,6 +1,6 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { PermissionContext } from '../../authorization';
-import { Project } from '../../type';
+import { PermissionContext } from '../../authorization/index.js';
+import { Project } from '../../type/index.js';
 export declare class ProjectsByIdentityQuery extends DatabaseQuery<Project[]> {
     private readonly identityId;
     private readonly permissionContext;

package/dist/types/model/queries/project/ProjectsByIdentityQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAqB,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,iBAAiB;gBAAtD,UAAU,EAAE,MAAM,EAAmB,iBAAiB,EAAE,iBAAiB;IAIhG,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAwC7D"}
+{"version":3,"file":"ProjectsByIdentityQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsByIdentityQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AAErF,OAAO,EAAqB,iBAAiB,EAAE,MAAM,8BAA8B,CAAA;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,uBAAwB,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACxD,OAAO,CAAC,QAAQ,CAAC,UAAU;IAAU,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAAnF,YAA6B,UAAU,EAAE,MAAM,EAAmB,iBAAiB,EAAE,iBAAiB,EAErG;IAEK,KAAK,CAAC,SAAS,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAuC5D;CACD"}

package/dist/types/model/queries/project/ProjectsQuery.d.ts

@@ -1,5 +1,5 @@
 import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
-import { Project } from '../../type';
+import { Project } from '../../type/index.js';
 export declare class ProjectsQuery extends DatabaseQuery<Project[]> {
     fetch({ db }: DatabaseQueryable): Promise<Project[]>;
 }

package/dist/types/model/queries/project/ProjectsQuery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ProjectsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpC,qBAAa,aAAc,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC;CAU1D"}
+{"version":3,"file":"ProjectsQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/ProjectsQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAiB,MAAM,qBAAqB,CAAA;AACrF,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAA;AAE7C,qBAAa,aAAc,SAAQ,aAAa,CAAC,OAAO,EAAE,CAAC;IACpD,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CASzD;CACD"}

package/dist/types/model/queries/project/index.d.ts

@@ -1,6 +1,7 @@
-export * from './ProjectSecretsQuery';
-export * from './ProjectBySlugQuery';
-export * from './ProjectsByIdentityQuery';
-export * from './ProjectsQuery';
-export * from './ProjectUpdateTimestampQuery';
+export * from './ProjectSecretsQuery.js';
+export * from './ProjectSecretKeysQuery.js';
+export * from './ProjectBySlugQuery.js';
+export * from './ProjectsByIdentityQuery.js';
+export * from './ProjectsQuery.js';
+export * from './ProjectUpdateTimestampQuery.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/project/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAA;AACrC,cAAc,sBAAsB,CAAA;AACpC,cAAc,2BAA2B,CAAA;AACzC,cAAc,iBAAiB,CAAA;AAC/B,cAAc,+BAA+B,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/project/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA;AACxC,cAAc,6BAA6B,CAAA;AAC3C,cAAc,yBAAyB,CAAA;AACvC,cAAc,8BAA8B,CAAA;AAC5C,cAAc,oBAAoB,CAAA;AAClC,cAAc,kCAAkC,CAAA"}

package/dist/types/model/queries/rateLimit/RateLimitCountQuery.d.ts

@@ -0,0 +1,10 @@
+import { DatabaseQuery, DatabaseQueryable } from '@contember/database';
+import { RateLimitScope } from '../../type/RateLimit.js';
+export declare class RateLimitCountQuery extends DatabaseQuery<number> {
+    private readonly scope;
+    private readonly keyHash;
+    private readonly windowSeconds;
+    constructor(scope: RateLimitScope, keyHash: Buffer, windowSeconds: number);
+    fetch({ db }: DatabaseQueryable): Promise<number>;
+}
+//# sourceMappingURL=RateLimitCountQuery.d.ts.map

package/dist/types/model/queries/rateLimit/RateLimitCountQuery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RateLimitCountQuery.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/rateLimit/RateLimitCountQuery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAA0B,MAAM,qBAAqB,CAAA;AAC9F,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAA;AAExD,qBAAa,mBAAoB,SAAQ,aAAa,CAAC,MAAM,CAAC;IAE5D,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO;IACxB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAH/B,YACkB,KAAK,EAAE,cAAc,EACrB,OAAO,EAAE,MAAM,EACf,aAAa,EAAE,MAAM,EAGtC;IAEK,KAAK,CAAC,EAAE,EAAE,EAAE,EAAE,iBAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWtD;CACD"}

package/dist/types/model/queries/rateLimit/index.d.ts

@@ -0,0 +1,2 @@
+export * from './RateLimitCountQuery.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/types/model/queries/rateLimit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../src/model/queries/rateLimit/index.ts"],"names":[],"mappings":"AAAA,cAAc,0BAA0B,CAAA"}

package/dist/types/model/service/AuthLogService.d.ts

@@ -1,12 +1,33 @@
-import { DatabaseContext } from '../utils';
-import { Response } from '../utils/Response';
-import { AuthActionType } from '../type/AuthLog';
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { AuthActionType } from '../type/AuthLog.js';
+import { JSONValue } from '@contember/schema';
 declare class AuthLogService {
     logAuthAction(db: DatabaseContext, ctx: {
         identityId: string;
         clientIp?: string;
         userAgent?: string;
+        forwarderIp?: string;
+        forwarderUserAgent?: string;
+        /** A03: country from the trusted reverse-proxy geo header, when present. */
+        geoCountry?: string;
+        /** A03: hash of the client user-agent, recorded for the next sign-in's history comparison. */
+        deviceFingerprint?: string;
     }, data: AuthLogService.LogArgs): Promise<void>;
+    /**
+     * Focused, response-agnostic emit for internal auth-path events (A19) that
+     * originate outside the resolver layer (e.g. `ApiKeyManager` on the HTTP auth
+     * hot path). Unlike `logAuthAction`, it does not require a GraphQL `Response`.
+     */
+    logSessionEvent(db: DatabaseContext, entry: {
+        type: AuthActionType;
+        identityId: string;
+        personId?: string | null;
+        ipAddress?: string;
+        userAgent?: string;
+        success: boolean;
+        eventData?: JSONValue;
+    }): Promise<void>;
 }
 declare namespace AuthLogService {
     export const Key: unique symbol;
@@ -15,6 +36,9 @@ declare namespace AuthLogService {
         personInput?: string;
         tokenId?: string;
         identityProviderId?: string;
+        targetPersonId?: string;
+        metadata?: JSONValue;
+        eventData?: JSONValue;
     };
     export type LogArgs = {
         response: Response<null | {

package/dist/types/model/service/AuthLogService.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"AuthLogService.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthLogService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,cAAM,cAAc;IACb,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,EAClE,IAAI,EAAE,cAAc,CAAC,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC;CAyBhB;AAED,kBAAU,cAAc,CAAC;IACxB,MAAM,CAAC,MAAM,GAAG,eAAwB,CAAA;IACxC,KAAK,IAAI,GAAG;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;IAED,MAAM,MAAM,OAAO,GAAG;QACrB,QAAQ,EAAE,QAAQ,CACjB,IAAI,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,EACtB,GAAG,EACH,EAAE,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,CACpB,CAAA;QACD,IAAI,EAAE,cAAc,CAAA;KACpB,GAAG,IAAI,CAAA;IAER,MAAM,OAAO,GAAG;iBAEE,IAAI,EAAE,IAAI;oBAAV,IAAI,EAAE,IAAI;KAG3B;;CACD;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}
+{"version":3,"file":"AuthLogService.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthLogService.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAC/C,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAA;AAc7C,cAAM,cAAc;IACb,aAAa,CAClB,EAAE,EAAE,eAAe,EACnB,GAAG,EAAE;QACJ,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,4EAA4E;QAC5E,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,8FAA8F;QAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAA;KAC1B,EACD,IAAI,EAAE,cAAc,CAAC,OAAO,GAC1B,OAAO,CAAC,IAAI,CAAC,CAyCf;IAED;;;;OAIG;IACG,eAAe,CACpB,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE;QACN,IAAI,EAAE,cAAc,CAAA;QACpB,UAAU,EAAE,MAAM,CAAA;QAClB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;QACxB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,OAAO,EAAE,OAAO,CAAA;QAChB,SAAS,CAAC,EAAE,SAAS,CAAA;KACrB,GACC,OAAO,CAAC,IAAI,CAAC,CAcf;CACD;AAED,kBAAU,cAAc,CAAC;IACxB,MAAM,CAAC,MAAM,GAAG,eAAwB,CAAA;IACxC,KAAK,IAAI,GAAG;QACX,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB,kBAAkB,CAAC,EAAE,MAAM,CAAA;QAC3B,cAAc,CAAC,EAAE,MAAM,CAAA;QACvB,QAAQ,CAAC,EAAE,SAAS,CAAA;QACpB,SAAS,CAAC,EAAE,SAAS,CAAA;KACrB,CAAA;IAED,MAAM,MAAM,OAAO,GAAG;QACrB,QAAQ,EAAE,QAAQ,CACjB,IAAI,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,EACtB,GAAG,EACH,EAAE,GAAG;YAAE,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAA;SAAE,CACpB,CAAA;QACD,IAAI,EAAE,cAAc,CAAA;KACpB,GAAG,IAAI,CAAA;IAER,MAAM,OAAO,GAAG;iBAEE,IAAI,EAAE,IAAI;QAD3B,YACiB,IAAI,EAAE,IAAI,EAE1B;KACD;;CACD;AAED,OAAO,EAAE,cAAc,EAAE,CAAA"}

package/dist/types/model/service/AuthPolicyManager.d.ts

@@ -0,0 +1,37 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { ProjectManager } from './ProjectManager.js';
+import { AuthPolicyRow, AuthPolicyScope } from '../type/index.js';
+import { CreateAuthPolicyErrorCode, DeleteAuthPolicyErrorCode, UpdateAuthPolicyErrorCode } from '../../schema/index.js';
+export type AuthPolicyInputValues = {
+    scope: AuthPolicyScope;
+    /** Project slug; resolved to project_id. Required for scope='project', forbidden for scope='global'. */
+    project?: string | null;
+    roles: string[];
+    mfaRequired?: boolean | null;
+    tokenExpiration?: string | null;
+    idleTimeout?: string | null;
+    graceDuration?: string | null;
+    rememberMeAllowed?: boolean | null;
+};
+/**
+ * CRUD over the `auth_policy` table (shared infra reused by A19). Project is
+ * always addressed by slug in the API and resolved to project_id here.
+ */
+export declare class AuthPolicyManager {
+    private readonly projectManager;
+    constructor(projectManager: ProjectManager);
+    listPolicies(db: DatabaseContext): Promise<AuthPolicyRow[]>;
+    createPolicy(db: DatabaseContext, input: AuthPolicyInputValues): Promise<Response<{
+        id: string;
+    }, CreateAuthPolicyErrorCode>>;
+    updatePolicy(db: DatabaseContext, id: string, input: AuthPolicyInputValues): Promise<Response<null, UpdateAuthPolicyErrorCode>>;
+    deletePolicy(db: DatabaseContext, id: string): Promise<Response<null, DeleteAuthPolicyErrorCode>>;
+    /**
+     * Validates scope/project consistency and resolves a slug to project_id.
+     * `scope='project'` requires a project (which must exist); `scope='global'`
+     * forbids one.
+     */
+    private resolveProjectId;
+}
+//# sourceMappingURL=AuthPolicyManager.d.ts.map

package/dist/types/model/service/AuthPolicyManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthPolicyManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAGpD,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAA;AACjE,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AAEvH,MAAM,MAAM,qBAAqB,GAAG;IACnC,KAAK,EAAE,eAAe,CAAA;IACtB,wGAAwG;IACxG,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;IAC5B,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC/B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC7B,iBAAiB,CAAC,EAAE,OAAO,GAAG,IAAI,CAAA;CAClC,CAAA;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IADhC,YACkB,cAAc,EAAE,cAAc,EAC5C;IAEE,YAAY,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEhE;IAEK,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,yBAAyB,CAAC,CAAC,CAkBlI;IAEK,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAqBpI;IAEK,YAAY,CAAC,EAAE,EAAE,eAAe,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,yBAAyB,CAAC,CAAC,CAMtG;IAED;;;;OAIG;YACW,gBAAgB;CA2B9B"}

package/dist/types/model/service/AuthPolicyResolver.d.ts

@@ -0,0 +1,25 @@
+import { DatabaseContext } from '../utils/index.js';
+import { EffectivePolicy } from '../type/index.js';
+/**
+ * Resolves the effective auth policy for an identity by aggregating all matching
+ * `auth_policy` rows across the identity's entire role set (global roles + every
+ * project-membership role across all projects).
+ *
+ * Shared by A06 (consumes `mfaRequired`) and A19 (consumes the session fields).
+ *
+ * Aggregation:
+ * - `mfaRequired` = OR of every matched row's `mfa_required` (NULL = no opinion).
+ * - session fields = strictest wins: the shortest `tokenExpiration` / `idleTimeout`
+ *   and the logical AND of `rememberMeAllowed` (any matched `false` wins).
+ *
+ * When nothing matches, the result is the inert baseline
+ * (`mfaRequired=false`, session fields null) — i.e. today's behavior.
+ */
+export declare class AuthPolicyResolver {
+    resolveForIdentity(db: DatabaseContext, identityId: string, globalRoles: readonly string[]): Promise<EffectivePolicy>;
+    private matches;
+    private aggregate;
+    /** Strictest wins: returns the shorter of two intervals (NULL = unconstrained). */
+    private shortest;
+}
+//# sourceMappingURL=AuthPolicyResolver.d.ts.map

package/dist/types/model/service/AuthPolicyResolver.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthPolicyResolver.d.ts","sourceRoot":"","sources":["../../../../src/model/service/AuthPolicyResolver.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAiB,eAAe,EAAE,MAAM,kBAAkB,CAAA;AAIjE;;;;;;;;;;;;;;GAcG;AACH,qBAAa,kBAAkB;IACxB,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,eAAe,CAAC,CAyB1H;IAED,OAAO,CAAC,OAAO;IAiBf,OAAO,CAAC,SAAS;IAwBjB,mFAAmF;IACnF,OAAO,CAAC,QAAQ;CAShB"}

package/dist/types/model/service/BackupCodeManager.d.ts

@@ -0,0 +1,36 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+/**
+ * Manages MFA backup/recovery codes (the `person_backup_code` table).
+ *
+ * Codes only exist for a person who has enrolled TOTP. Behavior for everyone
+ * else is unchanged. Plaintext codes are shown exactly once (on generation);
+ * only their sha256 hashes are stored.
+ */
+export declare class BackupCodeManager {
+    private readonly mailer;
+    private readonly providers;
+    constructor(mailer: UserMailer, providers: Pick<Providers, 'uuid' | 'now' | 'randomBytes'>);
+    /**
+     * Replaces the whole set: deletes any existing codes for the person, issues
+     * {@link BACKUP_CODE_COUNT} fresh ones, stores their hashes and returns the
+     * formatted plaintext codes (to be shown once).
+     */
+    generate(dbContext: DatabaseContext, personId: string): Promise<string[]>;
+    /**
+     * Normalizes the supplied code, then atomically consumes a single unused
+     * matching code. Returns whether a code was actually consumed. Safe against
+     * double-spend (see {@link ConsumeBackupCodeCommand}).
+     */
+    verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean>;
+    deleteForPerson(dbContext: DatabaseContext, personId: string): Promise<void>;
+    /** Number of still-usable backup codes for the person. */
+    countUnused(dbContext: DatabaseContext, personId: string): Promise<number>;
+    /** Strips formatting (hyphens/whitespace) and lowercases — display formatting must not affect verification. */
+    private normalize;
+    private hash;
+    private generateCode;
+}
+//# sourceMappingURL=BackupCodeManager.d.ts.map

package/dist/types/model/service/BackupCodeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"BackupCodeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/BackupCodeManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAG3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAY/C;;;;;;GAMG;AACH,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAF3B,YACkB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,KAAK,GAAG,aAAa,CAAC,EACxE;IAEJ;;;;OAIG;IACG,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAgB9E;IAED;;;;OAIG;IACG,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBpG;IAEK,eAAe,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEjF;IAED,0DAA0D;IACpD,WAAW,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ/E;IAED,+GAA+G;IAC/G,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,IAAI;YAIE,YAAY;CAU1B"}

package/dist/types/model/service/ConfigurationManager.d.ts

@@ -1,6 +1,6 @@
-import { ConfigInput, ConfigureErrorCode } from '../../schema';
-import { Response } from '../utils/Response';
-import { DatabaseContext } from '../utils';
+import { ConfigInput, ConfigureErrorCode } from '../../schema/index.js';
+import { Response } from '../utils/Response.js';
+import { DatabaseContext } from '../utils/index.js';
 export declare class ConfigurationManager {
     updateConfiguration(db: DatabaseContext, configuration: ConfigInput): Promise<Response<null, ConfigureErrorCode>>;
 }

package/dist/types/model/service/ConfigurationManager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ConfigurationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ConfigurationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAA;AAC9D,OAAO,EAAE,QAAQ,EAAc,MAAM,mBAAmB,CAAA;AACxD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAG1C,qBAAa,oBAAoB;IACnB,mBAAmB,CAAC,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;CAO9H"}
+{"version":3,"file":"ConfigurationManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/ConfigurationManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AACvE,OAAO,EAAE,QAAQ,EAAc,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAGnD,qBAAa,oBAAoB;IACnB,mBAAmB,CAAC,EAAE,EAAE,eAAe,EAAE,aAAa,EAAE,WAAW,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAM7H;CACD"}

package/dist/types/model/service/CustomRoleManager.d.ts

@@ -0,0 +1,46 @@
+import { DatabaseContext } from '../utils/index.js';
+import { Response } from '../utils/Response.js';
+import { CanonicalCustomRoleGrant } from '../authorization/CustomRolePermissions.js';
+import { CreateCustomRoleErrorCode, DeleteCustomRoleErrorCode, UpdateCustomRoleErrorCode } from '../../schema/index.js';
+import { GlobalRoleValidator } from './GlobalRoleValidator.js';
+export type CustomRoleState = {
+    readonly slug: string;
+    readonly description: string | null;
+    readonly grants: readonly CanonicalCustomRoleGrant[];
+};
+type CreateResult = {
+    readonly id: string;
+    readonly role: CustomRoleState;
+};
+type UpdateResult = {
+    readonly before: CustomRoleState;
+    readonly after: CustomRoleState;
+};
+type DeleteResult = {
+    readonly before: CustomRoleState;
+    readonly removedAssignments: number;
+    /** Which identities lost the role — a count alone cannot answer "who lost what" after the fact. */
+    readonly removedAssignmentIdentityIds: readonly string[];
+};
+export declare class CustomRoleManager {
+    private readonly globalRoleValidator;
+    constructor(globalRoleValidator?: GlobalRoleValidator);
+    listRoles(db: DatabaseContext): Promise<CustomRoleState[]>;
+    createRole(db: DatabaseContext, input: {
+        slug: string;
+        description: string | null;
+        grants: unknown;
+    }): Promise<Response<CreateResult, CreateCustomRoleErrorCode>>;
+    /** Maps the racing-insert failure the transaction could not report itself. */
+    static isSlugConflict(error: unknown): boolean;
+    updateRole(db: DatabaseContext, slug: string, input: {
+        description?: string | null;
+        grants?: unknown;
+    }): Promise<Response<UpdateResult, UpdateCustomRoleErrorCode>>;
+    deleteRole(db: DatabaseContext, slug: string): Promise<Response<DeleteResult, DeleteCustomRoleErrorCode>>;
+    private parseGrants;
+    private validateReferences;
+    private toState;
+}
+export {};
+//# sourceMappingURL=CustomRoleManager.d.ts.map

package/dist/types/model/service/CustomRoleManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CustomRoleManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/CustomRoleManager.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AACnD,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAI1E,OAAO,EAEN,wBAAwB,EAKxB,MAAM,2CAA2C,CAAA;AAElD,OAAO,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAA;AACvH,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAA;AAI9D,MAAM,MAAM,eAAe,GAAG;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;IACnC,QAAQ,CAAC,MAAM,EAAE,SAAS,wBAAwB,EAAE,CAAA;CACpD,CAAA;AAED,KAAK,YAAY,GAAG;IACnB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;CAC9B,CAAA;AAED,KAAK,YAAY,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;CAC/B,CAAA;AAED,KAAK,YAAY,GAAG;IACnB,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAA;IAChC,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,mGAAmG;IACnG,QAAQ,CAAC,4BAA4B,EAAE,SAAS,MAAM,EAAE,CAAA;CACxD,CAAA;AAED,qBAAa,iBAAiB;IAE5B,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IADrC,YACkB,mBAAmB,GAAE,mBAA+C,EAErF;IAEK,SAAS,CAAC,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,CAAC,CAG/D;IAEK,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,EAAE,OAAO,CAAA;KAAE,GAClE,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC,CA6C5D;IAED,8EAA8E;IAC9E,MAAM,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAE7C;IAEK,UAAU,CACf,EAAE,EAAE,eAAe,EACnB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,GACtD,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC,CAmC5D;IAEK,UAAU,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC,CA4B9G;IAED,OAAO,CAAC,WAAW;YAaL,kBAAkB;IAoBhC,OAAO,CAAC,OAAO;CAOf"}

package/dist/types/model/service/EmailChangeManager.d.ts

@@ -0,0 +1,41 @@
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext, PermissionContextFactory } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { ApiKeyManager } from './apiKey/index.js';
+import { EmailValidator, EmailValidatorError } from './EmailValidator.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
+interface MailOptions {
+    project?: string;
+    mailVariant?: string;
+}
+export declare class EmailChangeManager {
+    private readonly mailer;
+    private readonly projectManager;
+    private readonly emailValidator;
+    private readonly apiKeyManager;
+    private readonly permissionContextFactory;
+    constructor(mailer: UserMailer, projectManager: ProjectManager, emailValidator: EmailValidator, apiKeyManager: ApiKeyManager, permissionContextFactory: PermissionContextFactory);
+    /**
+     * Request an e-mail change. Validation and rate-limiting run BEFORE any
+     * write, so a rejected request never leaves a half-applied profile (e.g. a
+     * persisted name change without the e-mail change going through). Any
+     * immediate side-changes the caller wants applied atomically with the token
+     * (the name change) are passed via `applyWithinTransaction`.
+     */
+    requestEmailChange(dbContext: DatabaseContext, permissionContext: PermissionContext, person: PersonRow, newEmail: string, mailOptions?: MailOptions, applyWithinTransaction?: (db: DatabaseContext) => Promise<void>): Promise<RequestEmailChangeResponse>;
+    confirmEmailChange(dbContext: DatabaseContext, token: string): Promise<ConfirmEmailChangeResponse>;
+}
+export type RequestEmailChangeResponse = Response<null, EmailValidatorError | 'RATE_LIMIT_EXCEEDED'>;
+export type ConfirmEmailChangeResponse = Response<{
+    personId: string;
+    newEmail: string;
+    [AuthLogService.Key]: AuthLogService.Bag;
+}, PersonToken.TokenValidationError | EmailValidatorError, {
+    [AuthLogService.Key]: AuthLogService.Bag;
+}>;
+export {};
+//# sourceMappingURL=EmailChangeManager.d.ts.map

package/dist/types/model/service/EmailChangeManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailChangeManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailChangeManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAA6B,MAAM,sBAAsB,CAAA;AAC1E,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC5D,OAAO,EAAE,iBAAiB,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAA;AACvF,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAA;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAQnD,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,UAAU,WAAW;IACpB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,WAAW,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,qBAAa,kBAAkB;IAE7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAL1C,YACkB,MAAM,EAAE,UAAU,EAClB,cAAc,EAAE,cAAc,EAC9B,cAAc,EAAE,cAAc,EAC9B,aAAa,EAAE,aAAa,EAC5B,wBAAwB,EAAE,wBAAwB,EAChE;IAEJ;;;;;;OAMG;IACU,kBAAkB,CAC9B,SAAS,EAAE,eAAe,EAC1B,iBAAiB,EAAE,iBAAiB,EACpC,MAAM,EAAE,SAAS,EACjB,QAAQ,EAAE,MAAM,EAChB,WAAW,GAAE,WAAgB,EAC7B,sBAAsB,CAAC,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,IAAI,CAAC,GAC7D,OAAO,CAAC,0BAA0B,CAAC,CA8CrC;IAEY,kBAAkB,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,0BAA0B,CAAC,CA4E9G;CACD;AAED,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,qBAAqB,CAAC,CAAA;AAEpG,MAAM,MAAM,0BAA0B,GAAG,QAAQ,CAChD;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,EAChF,WAAW,CAAC,oBAAoB,GAAG,mBAAmB,EACtD;IAAE,CAAC,cAAc,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,GAAG,CAAA;CAAE,CAC5C,CAAA"}

package/dist/types/model/service/EmailOtpManager.d.ts

@@ -0,0 +1,45 @@
+import { PersonRow } from '../queries/index.js';
+import { DatabaseContext } from '../utils/index.js';
+import { Providers } from '../providers.js';
+import { UserMailer } from '../mailing/index.js';
+import { RateLimitDecision, RateLimiter } from './RateLimiter.js';
+import { Config } from '../type/Config.js';
+/**
+ * Email OTP as a second factor (A05). Opt-in per person via
+ * `person_mfa.email_otp_enabled`. The emitted code is a 6-digit numeric code,
+ * transported through a short-lived `mfa_email_otp` person_token (the code's hash
+ * lives in `otp_hash`), validated through the shared `'otp'` token path (max 3
+ * attempts). Behavior for anyone who hasn't enabled it is unchanged.
+ */
+export declare class EmailOtpManager {
+    private readonly mailer;
+    private readonly providers;
+    private readonly rateLimiter;
+    constructor(mailer: UserMailer, providers: Pick<Providers, 'randomBytes' | 'now' | 'uuid'>, rateLimiter: RateLimiter);
+    /**
+     * Generates a fresh code, invalidates any prior unused email-OTP tokens for the
+     * person, persists the new one and emails the code. Must run inside the request's
+     * db context (it issues commands + sends mail).
+     *
+     * Gated by the per-person `email_otp_per_person` rate limit so an attacker who
+     * knows the password cannot re-issue codes to reset the per-code 3-attempt
+     * counter, nor email-bomb a person. When the limit is hit nothing is sent and
+     * the returned decision is `ok: false` (the caller decides how to surface it);
+     * a previously emailed, still-valid code remains usable.
+     */
+    sendCode(dbContext: DatabaseContext, person: PersonRow, config: Config): Promise<RateLimitDecision>;
+    /**
+     * Fetches the latest unused email-OTP token for the person and validates the
+     * supplied code via the shared `'otp'` path; on success, consumes (invalidates)
+     * the token. Returns whether the code was accepted.
+     *
+     * The per-code attempt budget is reserved up front via {@link ClaimOtpAttemptCommand}
+     * — a single conditional UPDATE that increments `otp_attempts` only while it is
+     * still below {@link MAX_OTP_ATTEMPTS}. Because that UPDATE serializes concurrent
+     * writers on the row, N parallel guesses can never collectively exceed the cap;
+     * a plain read-then-increment let them all pass with a stale counter.
+     */
+    verifyAndConsume(dbContext: DatabaseContext, person: PersonRow, code: string): Promise<boolean>;
+    private generateCode;
+}
+//# sourceMappingURL=EmailOtpManager.d.ts.map

package/dist/types/model/service/EmailOtpManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"EmailOtpManager.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailOtpManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,EAAE,eAAe,EAAmC,MAAM,mBAAmB,CAAA;AACpF,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAGhD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAA;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAA;AAM1C;;;;;;GAMG;AACH,qBAAa,eAAe;IAE1B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,SAAS;IAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAH7B,YACkB,MAAM,EAAE,UAAU,EAClB,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,aAAa,GAAG,KAAK,GAAG,MAAM,CAAC,EAC1D,WAAW,EAAE,WAAW,EACtC;IAEJ;;;;;;;;;;OAUG;IACG,QAAQ,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiBxG;IAED;;;;;;;;;;OAUG;IACG,gBAAgB,CAAC,SAAS,EAAE,eAAe,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBpG;YAEa,YAAY;CAU1B"}

package/dist/types/model/service/EmailValidator.d.ts

@@ -1,8 +1,9 @@
-import { DatabaseContext } from '../utils';
-import { ResponseError } from '../utils/Response';
+import { DatabaseContext } from '../utils/index.js';
+import { ResponseError } from '../utils/Response.js';
+import { PersonRow } from '../queries/index.js';
 export declare class EmailValidator {
     validateEmail(db: DatabaseContext, email: string): Promise<ResponseError<EmailValidatorError> | null>;
-    private isEmailAlreadyUsed;
+    findExistingPerson(db: DatabaseContext, email: string): Promise<PersonRow | null>;
 }
 export type EmailValidatorError = 'EMAIL_ALREADY_EXISTS' | 'INVALID_EMAIL_FORMAT';
 //# sourceMappingURL=EmailValidator.d.ts.map

package/dist/types/model/service/EmailValidator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"EmailValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAA;AAE1C,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAA;AAGjD,qBAAa,cAAc;IACb,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC;YAUpG,kBAAkB;CAIhC;AAED,MAAM,MAAM,mBAAmB,GAC5B,sBAAsB,GACtB,sBAAsB,CAAA"}
+{"version":3,"file":"EmailValidator.d.ts","sourceRoot":"","sources":["../../../../src/model/service/EmailValidator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAA;AAEnD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAA;AACpD,OAAO,EAAe,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAE5D,qBAAa,cAAc;IACb,aAAa,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,mBAAmB,CAAC,GAAG,IAAI,CAAC,CAQjH;IAEY,kBAAkB,CAAC,EAAE,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAE7F;CACD;AAED,MAAM,MAAM,mBAAmB,GAC5B,sBAAsB,GACtB,sBAAsB,CAAA"}

package/dist/types/model/service/EmailVerificationManager.d.ts

@@ -0,0 +1,33 @@
+import { Response } from '../utils/Response.js';
+import { UserMailer } from '../mailing/index.js';
+import { PersonRow } from '../queries/index.js';
+import { PermissionContext } from '../authorization/index.js';
+import { ProjectManager } from './ProjectManager.js';
+import { DatabaseContext } from '../utils/index.js';
+import { PersonToken } from '../type/index.js';
+import { AuthLogService } from './AuthLogService.js';
+interface MailOptions {
+    project?: string;
+    mailVariant?: string;
+}
+export declare class EmailVerificationManager {
+    private readonly mailer;
+    private readonly projectManager;
+    constructor(mailer: UserMailer, projectManager: ProjectManager);
+    /**
+     * Sends a verification mail unless the per-email backoff says to hold off.
+     * Returns whether a mail was actually sent, so the caller only records an
+     * `email_verify_init` audit entry for mails that really went out — otherwise
+     * a throttled attempt would both tell the user to check their inbox and log
+     * a phantom init that pushes the backoff out further.
+     */
+    sendVerificationEmail(dbContext: DatabaseContext, permissionContext: PermissionContext, person: PersonRow, mailOptions?: MailOptions): Promise<boolean>;
+    verifyEmail(dbContext: DatabaseContext, token: string): Promise<VerifyEmailResponse>;
+}
+export type VerifyEmailResponse = Response<{
+    [AuthLogService.Key]: AuthLogService.Bag;
+}, PersonToken.TokenValidationError, {
+    [AuthLogService.Key]: AuthLogService.Bag;
+}>;
+export {};
+//# sourceMappingURL=EmailVerificationManager.d.ts.map