@fonoster/identity 0.27.0 → 0.31.0

package/dist/generated/@prisma/client/wasm.js

@@ -100,6 +100,8 @@ exports.Prisma.UserScalarFieldEnum = {
   email: 'email',
   emailVerified: 'emailVerified',
   password: 'password',
+  passwordDigest: 'passwordDigest',
+  mustChangePassword: 'mustChangePassword',
   phoneNumber: 'phoneNumber',
   phoneNumberVerified: 'phoneNumberVerified',
   avatar: 'avatar',
@@ -112,6 +114,7 @@ exports.Prisma.WorkspaceScalarFieldEnum = {
   ref: 'ref',
   accessKeyId: 'accessKeyId',
   name: 'name',
+  region: 'region',
   createdAt: 'createdAt',
   updatedAt: 'updatedAt',
   ownerRef: 'ownerRef'
@@ -138,12 +141,30 @@ exports.Prisma.ApiKeyScalarFieldEnum = {
   workspaceRef: 'workspaceRef'
 };
 
+exports.Prisma.RateLimitWindowScalarFieldEnum = {
+  key: 'key',
+  startedAt: 'startedAt',
+  count: 'count'
+};
+
 exports.Prisma.VerificationCodeScalarFieldEnum = {
   ref: 'ref',
   type: 'type',
   code: 'code',
   value: 'value',
   expiresAt: 'expiresAt',
+  attempts: 'attempts',
+  consumedAt: 'consumedAt',
+  createdAt: 'createdAt'
+};
+
+exports.Prisma.RefreshTokenScalarFieldEnum = {
+  jti: 'jti',
+  familyId: 'familyId',
+  accessKeyId: 'accessKeyId',
+  expiresAt: 'expiresAt',
+  usedAt: 'usedAt',
+  revokedAt: 'revokedAt',
   createdAt: 'createdAt'
 };
 
@@ -194,7 +215,9 @@ exports.Prisma.ModelName = {
   Workspace: 'Workspace',
   WorkspaceMember: 'WorkspaceMember',
   ApiKey: 'ApiKey',
-  VerificationCode: 'VerificationCode'
+  RateLimitWindow: 'RateLimitWindow',
+  VerificationCode: 'VerificationCode',
+  RefreshToken: 'RefreshToken'
 };
 /**
  * Create the Client
@@ -244,13 +267,13 @@ const config = {
       }
     }
   },
-  "inlineSchema": "generator client {\n  provider = \"prisma-client-js\"\n  output   = \"src/generated/@prisma/client\"\n}\n\ndatasource db {\n  provider = \"postgresql\"\n  url      = env(\"APISERVER_IDENTITY_DATABASE_URL\")\n}\n\nmodel User {\n  ref                 String   @id @default(uuid())\n  accessKeyId         String   @unique @map(\"access_key_id\") @db.VarChar(255)\n  name                String   @db.VarChar(60)\n  email               String   @unique @db.VarChar(255)\n  emailVerified       Boolean  @default(false) @map(\"email_verified\")\n  password            String   @map(\"password_hash\") /// @encrypted\n  phoneNumber         String?  @map(\"phone_number\") @db.VarChar(20)\n  phoneNumberVerified Boolean  @default(false) @map(\"phone_number_verified\")\n  avatar              String?  @db.VarChar(255)\n  createdAt           DateTime @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt           DateTime @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n  extended            Json?\n\n  // Relations\n  ownedWorkspaces Workspace[] // Workspaces owned by the user\n  memberships     WorkspaceMember[] // Workspaces the user is a member of\n\n  // Indexes and maps\n  @@index([email], type: Hash)\n  @@index([accessKeyId], type: Hash)\n  @@map(\"users\")\n}\n\nmodel Workspace {\n  ref         String   @id @default(uuid())\n  accessKeyId String   @unique @map(\"access_key_id\") @db.VarChar(255)\n  name        String   @db.VarChar(60)\n  createdAt   DateTime @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt   DateTime @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n\n  // Relations\n  owner    User              @relation(fields: [ownerRef], references: [ref], onDelete: Cascade)\n  ownerRef String            @map(\"owner_ref\")\n  members  WorkspaceMember[]\n  apiKeys  ApiKey[]\n\n  // Indexes and maps\n  @@index([accessKeyId], type: Hash)\n  @@index([ownerRef], type: Hash)\n  @@map(\"workspaces\")\n}\n\nmodel WorkspaceMember {\n  ref       String                @id @default(uuid())\n  status    WorkspaceMemberStatus @default(PENDING)\n  role      Role                  @default(WORKSPACE_MEMBER)\n  createdAt DateTime              @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt DateTime              @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n\n  // Relations\n  user         User      @relation(fields: [userRef], references: [ref], onDelete: Cascade)\n  userRef      String    @map(\"user_ref\")\n  workspace    Workspace @relation(fields: [workspaceRef], references: [ref], onDelete: Cascade)\n  workspaceRef String    @map(\"workspace_ref\")\n\n  @@unique([userRef, workspaceRef])\n  @@map(\"workspace_members\")\n}\n\nmodel ApiKey {\n  ref             String    @id @default(uuid())\n  accessKeyId     String    @unique @map(\"access_key_id\") @db.VarChar(255)\n  accessKeySecret String    @map(\"access_key_secret\") @db.VarChar(255) /// @encrypted\n  role            Role      @default(WORKSPACE_MEMBER)\n  createdAt       DateTime  @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt       DateTime  @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n  expiresAt       DateTime? @map(\"expires_at\") @db.Timestamptz(3)\n\n  // Relations\n  workspace    Workspace @relation(fields: [workspaceRef], references: [ref], onDelete: Cascade)\n  workspaceRef String    @map(\"workspace_ref\")\n\n  // Indexes and maps\n  @@index([accessKeyId], type: Hash)\n  @@index([workspaceRef], type: Hash)\n  @@map(\"api_keys\")\n}\n\nmodel VerificationCode {\n  ref       String           @id @default(uuid())\n  type      VerificationType\n  code      String           @db.VarChar(6)\n  value     String           @db.VarChar(255)\n  expiresAt DateTime         @map(\"expires_at\") @db.Timestamptz(3)\n  createdAt DateTime         @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n\n  // Indexes and maps\n  @@index([code], type: Hash)\n  @@map(\"verification_codes\")\n}\n\nenum VerificationType {\n  EMAIL\n  PHONE\n}\n\nenum WorkspaceMemberStatus {\n  PENDING\n  ACTIVE\n\n  @@map(\"workspace_member_status\")\n}\n\nenum Role {\n  USER\n  WORKSPACE_ADMIN\n  WORKSPACE_OWNER\n  WORKSPACE_MEMBER\n\n  @@map(\"role\")\n}\n",
-  "inlineSchemaHash": "3c4034bb83309aca32420626a655f9903a7716403fd270cee2525246f662cb96",
+  "inlineSchema": "generator client {\n  provider = \"prisma-client-js\"\n  output   = \"src/generated/@prisma/client\"\n}\n\ndatasource db {\n  provider = \"postgresql\"\n  url      = env(\"APISERVER_IDENTITY_DATABASE_URL\")\n}\n\nmodel User {\n  ref                 String   @id @default(uuid())\n  accessKeyId         String   @unique @map(\"access_key_id\") @db.VarChar(255)\n  name                String   @db.VarChar(60)\n  email               String   @unique @db.VarChar(255)\n  emailVerified       Boolean  @default(false) @map(\"email_verified\")\n  /// Legacy reversible storage, cleared once password_digest is written.\n  password            String?  @map(\"password_hash\") /// @encrypted\n  /// scrypt digest: scrypt$N$r$p$salt$hash\n  passwordDigest      String?  @map(\"password_digest\") @db.VarChar(255)\n  /// Set for invitees holding a one-time password; cleared when they set their own.\n  mustChangePassword  Boolean  @default(false) @map(\"must_change_password\")\n  phoneNumber         String?  @map(\"phone_number\") @db.VarChar(20)\n  phoneNumberVerified Boolean  @default(false) @map(\"phone_number_verified\")\n  avatar              String?  @db.VarChar(255)\n  createdAt           DateTime @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt           DateTime @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n  extended            Json?\n\n  // Relations\n  ownedWorkspaces Workspace[] // Workspaces owned by the user\n  memberships     WorkspaceMember[] // Workspaces the user is a member of\n\n  // Indexes and maps\n  @@index([email], type: Hash)\n  @@index([accessKeyId], type: Hash)\n  @@map(\"users\")\n}\n\nmodel Workspace {\n  ref         String   @id @default(uuid())\n  accessKeyId String   @unique @map(\"access_key_id\") @db.VarChar(255)\n  name        String   @db.VarChar(60)\n  /// A public region id (`default`, `us-east-1`) or a private region ref (rg_…). Immutable.\n  region      String   @default(\"default\") @db.VarChar(64)\n  createdAt   DateTime @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt   DateTime @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n\n  // Relations\n  owner    User              @relation(fields: [ownerRef], references: [ref], onDelete: Cascade)\n  ownerRef String            @map(\"owner_ref\")\n  members  WorkspaceMember[]\n  apiKeys  ApiKey[]\n\n  // Indexes and maps\n  @@index([accessKeyId], type: Hash)\n  @@index([ownerRef], type: Hash)\n  @@map(\"workspaces\")\n}\n\nmodel WorkspaceMember {\n  ref       String                @id @default(uuid())\n  status    WorkspaceMemberStatus @default(PENDING)\n  role      Role                  @default(WORKSPACE_MEMBER)\n  createdAt DateTime              @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt DateTime              @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n\n  // Relations\n  user         User      @relation(fields: [userRef], references: [ref], onDelete: Cascade)\n  userRef      String    @map(\"user_ref\")\n  workspace    Workspace @relation(fields: [workspaceRef], references: [ref], onDelete: Cascade)\n  workspaceRef String    @map(\"workspace_ref\")\n\n  @@unique([userRef, workspaceRef])\n  @@map(\"workspace_members\")\n}\n\nmodel ApiKey {\n  ref             String    @id @default(uuid())\n  accessKeyId     String    @unique @map(\"access_key_id\") @db.VarChar(255)\n  accessKeySecret String    @map(\"access_key_secret\") @db.VarChar(255) /// @encrypted\n  role            Role      @default(WORKSPACE_MEMBER)\n  createdAt       DateTime  @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n  updatedAt       DateTime  @default(now()) @map(\"updated_at\") @db.Timestamptz(3)\n  expiresAt       DateTime? @map(\"expires_at\") @db.Timestamptz(3)\n\n  // Relations\n  workspace    Workspace @relation(fields: [workspaceRef], references: [ref], onDelete: Cascade)\n  workspaceRef String    @map(\"workspace_ref\")\n\n  // Indexes and maps\n  @@index([accessKeyId], type: Hash)\n  @@index([workspaceRef], type: Hash)\n  @@map(\"api_keys\")\n}\n\n/// Fixed-window counters of the send and reset limits (verification codes, password resets),\n/// shared by every Identity replica (ST-4). Rows of past windows are pruned.\nmodel RateLimitWindow {\n  key       String   @id @db.VarChar(255)\n  startedAt DateTime @map(\"started_at\") @db.Timestamptz(3)\n  count     Int\n\n  @@index([startedAt])\n  @@map(\"rate_limit_windows\")\n}\n\nmodel VerificationCode {\n  ref        String           @id @default(uuid())\n  type       VerificationType\n  code       String           @db.VarChar(6)\n  value      String           @db.VarChar(255)\n  expiresAt  DateTime         @map(\"expires_at\") @db.Timestamptz(3)\n  attempts   Int              @default(0)\n  consumedAt DateTime?        @map(\"consumed_at\") @db.Timestamptz(3)\n  createdAt  DateTime         @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n\n  // Indexes and maps\n  @@index([code], type: Hash)\n  @@index([type, value])\n  @@map(\"verification_codes\")\n}\n\n/// One issued refresh token. Each is good for a single exchange (rotation); a\n/// second use of the same token revokes its whole family (reuse detection).\nmodel RefreshToken {\n  jti         String    @id @db.VarChar(64)\n  /// Every token rotated from the same sign-in shares a family.\n  familyId    String    @map(\"family_id\") @db.VarChar(64)\n  /// The user or API key the token was issued to.\n  accessKeyId String    @map(\"access_key_id\") @db.VarChar(255)\n  expiresAt   DateTime  @map(\"expires_at\") @db.Timestamptz(3)\n  usedAt      DateTime? @map(\"used_at\") @db.Timestamptz(3)\n  revokedAt   DateTime? @map(\"revoked_at\") @db.Timestamptz(3)\n  createdAt   DateTime  @default(now()) @map(\"created_at\") @db.Timestamptz(3)\n\n  // Indexes and maps\n  @@index([familyId])\n  @@index([accessKeyId])\n  @@map(\"refresh_tokens\")\n}\n\nenum VerificationType {\n  EMAIL\n  PHONE\n}\n\nenum WorkspaceMemberStatus {\n  PENDING\n  ACTIVE\n\n  @@map(\"workspace_member_status\")\n}\n\nenum Role {\n  USER\n  WORKSPACE_ADMIN\n  WORKSPACE_OWNER\n  WORKSPACE_MEMBER\n\n  @@map(\"role\")\n}\n",
+  "inlineSchemaHash": "3a64b21aca7defddf14d44df5a93bd8aaabe3640888a650ecbd3f16df4ddd4d2",
   "copyEngine": true
 }
 config.dirname = '/'
 
-config.runtimeDataModel = JSON.parse("{\"models\":{\"User\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"name\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"email\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"emailVerified\",\"kind\":\"scalar\",\"type\":\"Boolean\",\"dbName\":\"email_verified\"},{\"name\":\"password\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"password_hash\"},{\"name\":\"phoneNumber\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"phone_number\"},{\"name\":\"phoneNumberVerified\",\"kind\":\"scalar\",\"type\":\"Boolean\",\"dbName\":\"phone_number_verified\"},{\"name\":\"avatar\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"extended\",\"kind\":\"scalar\",\"type\":\"Json\"},{\"name\":\"ownedWorkspaces\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"UserToWorkspace\"},{\"name\":\"memberships\",\"kind\":\"object\",\"type\":\"WorkspaceMember\",\"relationName\":\"UserToWorkspaceMember\"}],\"dbName\":\"users\"},\"Workspace\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"name\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"owner\",\"kind\":\"object\",\"type\":\"User\",\"relationName\":\"UserToWorkspace\"},{\"name\":\"ownerRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"owner_ref\"},{\"name\":\"members\",\"kind\":\"object\",\"type\":\"WorkspaceMember\",\"relationName\":\"WorkspaceToWorkspaceMember\"},{\"name\":\"apiKeys\",\"kind\":\"object\",\"type\":\"ApiKey\",\"relationName\":\"ApiKeyToWorkspace\"}],\"dbName\":\"workspaces\"},\"WorkspaceMember\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"status\",\"kind\":\"enum\",\"type\":\"WorkspaceMemberStatus\"},{\"name\":\"role\",\"kind\":\"enum\",\"type\":\"Role\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"user\",\"kind\":\"object\",\"type\":\"User\",\"relationName\":\"UserToWorkspaceMember\"},{\"name\":\"userRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"user_ref\"},{\"name\":\"workspace\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"WorkspaceToWorkspaceMember\"},{\"name\":\"workspaceRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"workspace_ref\"}],\"dbName\":\"workspace_members\"},\"ApiKey\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"accessKeySecret\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_secret\"},{\"name\":\"role\",\"kind\":\"enum\",\"type\":\"Role\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"expiresAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"expires_at\"},{\"name\":\"workspace\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"ApiKeyToWorkspace\"},{\"name\":\"workspaceRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"workspace_ref\"}],\"dbName\":\"api_keys\"},\"VerificationCode\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"type\",\"kind\":\"enum\",\"type\":\"VerificationType\"},{\"name\":\"code\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"value\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"expiresAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"expires_at\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"}],\"dbName\":\"verification_codes\"}},\"enums\":{},\"types\":{}}")
+config.runtimeDataModel = JSON.parse("{\"models\":{\"User\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"name\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"email\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"emailVerified\",\"kind\":\"scalar\",\"type\":\"Boolean\",\"dbName\":\"email_verified\"},{\"name\":\"password\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"password_hash\"},{\"name\":\"passwordDigest\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"password_digest\"},{\"name\":\"mustChangePassword\",\"kind\":\"scalar\",\"type\":\"Boolean\",\"dbName\":\"must_change_password\"},{\"name\":\"phoneNumber\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"phone_number\"},{\"name\":\"phoneNumberVerified\",\"kind\":\"scalar\",\"type\":\"Boolean\",\"dbName\":\"phone_number_verified\"},{\"name\":\"avatar\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"extended\",\"kind\":\"scalar\",\"type\":\"Json\"},{\"name\":\"ownedWorkspaces\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"UserToWorkspace\"},{\"name\":\"memberships\",\"kind\":\"object\",\"type\":\"WorkspaceMember\",\"relationName\":\"UserToWorkspaceMember\"}],\"dbName\":\"users\"},\"Workspace\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"name\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"region\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"owner\",\"kind\":\"object\",\"type\":\"User\",\"relationName\":\"UserToWorkspace\"},{\"name\":\"ownerRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"owner_ref\"},{\"name\":\"members\",\"kind\":\"object\",\"type\":\"WorkspaceMember\",\"relationName\":\"WorkspaceToWorkspaceMember\"},{\"name\":\"apiKeys\",\"kind\":\"object\",\"type\":\"ApiKey\",\"relationName\":\"ApiKeyToWorkspace\"}],\"dbName\":\"workspaces\"},\"WorkspaceMember\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"status\",\"kind\":\"enum\",\"type\":\"WorkspaceMemberStatus\"},{\"name\":\"role\",\"kind\":\"enum\",\"type\":\"Role\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"user\",\"kind\":\"object\",\"type\":\"User\",\"relationName\":\"UserToWorkspaceMember\"},{\"name\":\"userRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"user_ref\"},{\"name\":\"workspace\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"WorkspaceToWorkspaceMember\"},{\"name\":\"workspaceRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"workspace_ref\"}],\"dbName\":\"workspace_members\"},\"ApiKey\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"accessKeySecret\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_secret\"},{\"name\":\"role\",\"kind\":\"enum\",\"type\":\"Role\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"},{\"name\":\"updatedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"updated_at\"},{\"name\":\"expiresAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"expires_at\"},{\"name\":\"workspace\",\"kind\":\"object\",\"type\":\"Workspace\",\"relationName\":\"ApiKeyToWorkspace\"},{\"name\":\"workspaceRef\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"workspace_ref\"}],\"dbName\":\"api_keys\"},\"RateLimitWindow\":{\"fields\":[{\"name\":\"key\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"startedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"started_at\"},{\"name\":\"count\",\"kind\":\"scalar\",\"type\":\"Int\"}],\"dbName\":\"rate_limit_windows\"},\"VerificationCode\":{\"fields\":[{\"name\":\"ref\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"type\",\"kind\":\"enum\",\"type\":\"VerificationType\"},{\"name\":\"code\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"value\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"expiresAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"expires_at\"},{\"name\":\"attempts\",\"kind\":\"scalar\",\"type\":\"Int\"},{\"name\":\"consumedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"consumed_at\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"}],\"dbName\":\"verification_codes\"},\"RefreshToken\":{\"fields\":[{\"name\":\"jti\",\"kind\":\"scalar\",\"type\":\"String\"},{\"name\":\"familyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"family_id\"},{\"name\":\"accessKeyId\",\"kind\":\"scalar\",\"type\":\"String\",\"dbName\":\"access_key_id\"},{\"name\":\"expiresAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"expires_at\"},{\"name\":\"usedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"used_at\"},{\"name\":\"revokedAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"revoked_at\"},{\"name\":\"createdAt\",\"kind\":\"scalar\",\"type\":\"DateTime\",\"dbName\":\"created_at\"}],\"dbName\":\"refresh_tokens\"}},\"enums\":{},\"types\":{}}")
 defineDmmfProperty(exports.Prisma, config.runtimeDataModel)
 config.engineWasm = {
   getRuntime: async () => require('./query_engine_bg.js'),

package/dist/index.d.ts

@@ -18,6 +18,7 @@
  */
 export * from "./allowList";
 export * from "./apikeys";
+export * from "./config";
 export * from "./exchanges";
 export * from "./invites";
 export * from "./service";

package/dist/index.js

@@ -34,6 +34,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
  */
 __exportStar(require("./allowList"), exports);
 __exportStar(require("./apikeys"), exports);
+__exportStar(require("./config"), exports);
 __exportStar(require("./exchanges"), exports);
 __exportStar(require("./invites"), exports);
 __exportStar(require("./service"), exports);

package/dist/server/config.d.ts

@@ -1,5 +1,12 @@
 import { z } from "zod";
-import { IdentityConfig } from "../exchanges/types";
+/**
+ * Configuration for the standalone Identity service: identity.json (or
+ * .jsonc/.yaml), found via --config, /opt/fonoster or ./config. Fields sit at
+ * the root of the file, as they always have; the same settings live under
+ * fonoster.yaml's `identity:` section when Identity is embedded in the API
+ * server. No environment variables, except ${VAR} in the database URL shared
+ * with the Postgres container.
+ */
 declare const identityServiceConfigSchema: z.ZodObject<{
     server: z.ZodDefault<z.ZodObject<{
         bindAddr: z.ZodDefault<z.ZodString>;
@@ -11,6 +18,60 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         bindAddr?: string;
         httpBridgePort?: number;
     }>>;
+    logs: z.ZodDefault<z.ZodEffects<z.ZodObject<{
+        level: z.ZodDefault<z.ZodEnum<["error", "warn", "info", "http", "verbose", "debug", "silly"]>>;
+        format: z.ZodDefault<z.ZodEnum<["json", "text"]>>;
+        transport: z.ZodDefault<z.ZodEnum<["console", "fluent"]>>;
+        fluent: z.ZodOptional<z.ZodObject<{
+            host: z.ZodString;
+            port: z.ZodDefault<z.ZodNumber>;
+            tagPrefix: z.ZodDefault<z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        }, {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        }>>;
+    }, "strip", z.ZodTypeAny, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }>, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }, {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    }>>;
     database: z.ZodObject<{
         url: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -20,8 +81,10 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>;
     encryptionKey: z.ZodString;
     issuer: z.ZodString;
-    audience: z.ZodString;
-    keys: z.ZodEffects<z.ZodObject<{
+    audience: z.ZodDefault<z.ZodString>;
+    /** Where the accept-invite bridge redirects. Defaults to the issuer. */
+    appUrl: z.ZodOptional<z.ZodString>;
+    keys: z.ZodEffects<z.ZodDefault<z.ZodObject<{
         privateKey: z.ZodOptional<z.ZodString>;
         publicKey: z.ZodOptional<z.ZodString>;
         privateKeyPath: z.ZodOptional<z.ZodString>;
@@ -36,11 +99,11 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         publicKey?: string;
         privateKeyPath?: string;
         publicKeyPath?: string;
-    }>, {
-        privateKey?: string;
-        publicKey?: string;
-        privateKeyPath?: string;
-        publicKeyPath?: string;
+    }>>, {
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
     }, {
         privateKey?: string;
         publicKey?: string;
@@ -49,15 +112,15 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>;
     tokens: z.ZodDefault<z.ZodObject<{
         accessTokenExpiresIn: z.ZodDefault<z.ZodString>;
-        refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
         idTokenExpiresIn: z.ZodDefault<z.ZodString>;
+        refreshTokenExpiresIn: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     }, {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     }>>;
     security: z.ZodDefault<z.ZodObject<{
@@ -71,8 +134,8 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         twoFactorAuthenticationRequired?: boolean;
     }>>;
     invite: z.ZodDefault<z.ZodObject<{
-        url: z.ZodDefault<z.ZodString>;
-        failUrl: z.ZodDefault<z.ZodString>;
+        url: z.ZodOptional<z.ZodString>;
+        failUrl: z.ZodOptional<z.ZodString>;
         expiration: z.ZodDefault<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         url?: string;
@@ -83,12 +146,14 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         failUrl?: string;
         expiration?: string;
     }>>;
-    appUrl: z.ZodDefault<z.ZodString>;
-    smtp: z.ZodOptional<z.ZodObject<{
+    smtp: z.ZodOptional<z.ZodObject<Omit<{
         host: z.ZodString;
-        port: z.ZodNumber;
+        port: z.ZodDefault<z.ZodNumber>;
         secure: z.ZodDefault<z.ZodBoolean>;
         sender: z.ZodString;
+        user: z.ZodDefault<z.ZodString>;
+        password: z.ZodDefault<z.ZodString>;
+    }, "user" | "password"> & {
         auth: z.ZodDefault<z.ZodObject<{
             user: z.ZodDefault<z.ZodString>;
             pass: z.ZodDefault<z.ZodString>;
@@ -118,30 +183,64 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     }>>;
+    twilio: z.ZodOptional<z.ZodObject<{
+        phoneNumber: z.ZodString;
+        accountSid: z.ZodString;
+        authToken: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    }, {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    }>>;
     oauth2: z.ZodOptional<z.ZodObject<{
         github: z.ZodObject<{
             clientId: z.ZodString;
             clientSecret: z.ZodString;
+            url: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
+            apiUrl: z.ZodEffects<z.ZodDefault<z.ZodString>, string, string>;
         }, "strip", z.ZodTypeAny, {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         }, {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         }>;
     }, "strip", z.ZodTypeAny, {
         github?: {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         };
     }, {
         github?: {
+            url?: string;
             clientId?: string;
             clientSecret?: string;
+            apiUrl?: string;
         };
     }>>;
+    /** Sign-in methods and sign-up policy (`features.auth` in fonoster.yaml). */
+    auth: z.ZodDefault<z.ZodObject<{
+        methods: z.ZodDefault<z.ZodArray<z.ZodEnum<["password", "email_code", "github"]>, "atleastone">>;
+        signup: z.ZodDefault<z.ZodEnum<["invite", "open"]>>;
+    }, "strip", z.ZodTypeAny, {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    }, {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    }>>;
     defaultUser: z.ZodOptional<z.ZodObject<{
-        name: z.ZodString;
+        name: z.ZodDefault<z.ZodString>;
         email: z.ZodString;
         password: z.ZodString;
     }, "strip", z.ZodTypeAny, {
@@ -155,36 +254,38 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     }>>;
 }, "strip", z.ZodTypeAny, {
     keys?: {
-        privateKey?: string;
-        publicKey?: string;
-        privateKeyPath?: string;
-        publicKeyPath?: string;
+        privateKey: string;
+        publicKey: string;
+        privateKeyPath: string;
+        publicKeyPath: string;
     };
-    issuer?: string;
-    audience?: string;
-    server?: {
-        bindAddr?: string;
-        httpBridgePort?: number;
+    invite?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
     };
     database?: {
         url?: string;
     };
-    encryptionKey?: string;
+    issuer?: string;
+    audience?: string;
     tokens?: {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     };
     security?: {
         contactVerificationRequired?: boolean;
         twoFactorAuthenticationRequired?: boolean;
     };
-    invite?: {
-        url?: string;
-        failUrl?: string;
-        expiration?: string;
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
     };
-    appUrl?: string;
     smtp?: {
         host?: string;
         port?: number;
@@ -195,12 +296,31 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     };
-    oauth2?: {
-        github?: {
-            clientId?: string;
-            clientSecret?: string;
+    twilio?: {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    };
+    auth?: {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    };
+    server?: {
+        bindAddr?: string;
+        httpBridgePort?: number;
+    };
+    logs?: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
         };
+        transport?: "console" | "fluent";
     };
+    encryptionKey?: string;
+    appUrl?: string;
     defaultUser?: {
         name?: string;
         email?: string;
@@ -213,31 +333,33 @@ declare const identityServiceConfigSchema: z.ZodObject<{
         privateKeyPath?: string;
         publicKeyPath?: string;
     };
-    issuer?: string;
-    audience?: string;
-    server?: {
-        bindAddr?: string;
-        httpBridgePort?: number;
+    invite?: {
+        url?: string;
+        failUrl?: string;
+        expiration?: string;
     };
     database?: {
         url?: string;
     };
-    encryptionKey?: string;
+    issuer?: string;
+    audience?: string;
     tokens?: {
-        idTokenExpiresIn?: string;
         accessTokenExpiresIn?: string;
+        idTokenExpiresIn?: string;
         refreshTokenExpiresIn?: string;
     };
     security?: {
         contactVerificationRequired?: boolean;
         twoFactorAuthenticationRequired?: boolean;
     };
-    invite?: {
-        url?: string;
-        failUrl?: string;
-        expiration?: string;
+    oauth2?: {
+        github?: {
+            url?: string;
+            clientId?: string;
+            clientSecret?: string;
+            apiUrl?: string;
+        };
     };
-    appUrl?: string;
     smtp?: {
         host?: string;
         port?: number;
@@ -248,12 +370,31 @@ declare const identityServiceConfigSchema: z.ZodObject<{
             pass?: string;
         };
     };
-    oauth2?: {
-        github?: {
-            clientId?: string;
-            clientSecret?: string;
+    twilio?: {
+        phoneNumber?: string;
+        accountSid?: string;
+        authToken?: string;
+    };
+    auth?: {
+        methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+        signup?: "invite" | "open";
+    };
+    server?: {
+        bindAddr?: string;
+        httpBridgePort?: number;
+    };
+    logs?: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
         };
+        transport?: "console" | "fluent";
     };
+    encryptionKey?: string;
+    appUrl?: string;
     defaultUser?: {
         name?: string;
         email?: string;
@@ -261,16 +402,106 @@ declare const identityServiceConfigSchema: z.ZodObject<{
     };
 }>;
 type IdentityServiceConfig = z.infer<typeof identityServiceConfigSchema>;
+/** Reads and validates the file only (no keys read), e.g. for provisioning. */
+declare function loadConfigFile(argv?: string[]): {
+    config: {
+        keys?: {
+            privateKey: string;
+            publicKey: string;
+            privateKeyPath: string;
+            publicKeyPath: string;
+        };
+        invite?: {
+            url?: string;
+            failUrl?: string;
+            expiration?: string;
+        };
+        database?: {
+            url?: string;
+        };
+        issuer?: string;
+        audience?: string;
+        tokens?: {
+            accessTokenExpiresIn?: string;
+            idTokenExpiresIn?: string;
+            refreshTokenExpiresIn?: string;
+        };
+        security?: {
+            contactVerificationRequired?: boolean;
+            twoFactorAuthenticationRequired?: boolean;
+        };
+        oauth2?: {
+            github?: {
+                url?: string;
+                clientId?: string;
+                clientSecret?: string;
+                apiUrl?: string;
+            };
+        };
+        smtp?: {
+            host?: string;
+            port?: number;
+            secure?: boolean;
+            sender?: string;
+            auth?: {
+                user?: string;
+                pass?: string;
+            };
+        };
+        twilio?: {
+            phoneNumber?: string;
+            accountSid?: string;
+            authToken?: string;
+        };
+        auth?: {
+            methods?: ["password" | "email_code" | "github", ...("password" | "email_code" | "github")[]];
+            signup?: "invite" | "open";
+        };
+        server?: {
+            bindAddr?: string;
+            httpBridgePort?: number;
+        };
+        logs?: {
+            format?: "text" | "json";
+            level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+            fluent?: {
+                host?: string;
+                port?: number;
+                tagPrefix?: string;
+            };
+            transport?: "console" | "fluent";
+        };
+        encryptionKey?: string;
+        appUrl?: string;
+        defaultUser?: {
+            name?: string;
+            email?: string;
+            password?: string;
+        };
+    };
+    databaseUrl: string;
+};
 /** Loads and validates the service configuration from the file, failing fast. */
 declare function loadConfig(argv?: string[]): {
     bindAddr: string;
     httpBridgePort: number;
     appUrl: string;
+    logs: {
+        format?: "text" | "json";
+        level?: "error" | "warn" | "info" | "http" | "verbose" | "debug" | "silly";
+        fluent?: {
+            host?: string;
+            port?: number;
+            tagPrefix?: string;
+        };
+        transport?: "console" | "fluent";
+    };
+    databaseUrl: string;
     defaultUser: {
         name?: string;
         email?: string;
         password?: string;
     };
-    identityConfig: IdentityConfig;
+    identityConfig: import("..").IdentityConfig;
 };
-export { identityServiceConfigSchema, IdentityServiceConfig, loadConfig };
+export { identityServiceConfigSchema, IdentityServiceConfig, loadConfig, loadConfigFile };