@hilbras/keystone 1.6.0 → 2.5.0

package/dist/repositories/session.js

@@ -1,6 +1,6 @@
 import { db } from "../db/index.js";
 import { userSessions, refreshTokens } from "../db/schema.js";
-import { eq, and, lt, desc } from "drizzle-orm";
+import { eq, and, isNull, lt, desc } from "drizzle-orm";
 export class SessionRepository {
     async create(input) {
         const [session] = await db.insert(userSessions).values({
@@ -60,6 +60,18 @@ export class SessionRepository {
     async revokeRefreshToken(tokenId) {
         await db.update(refreshTokens).set({ revokedAt: new Date() }).where(eq(refreshTokens.id, tokenId));
     }
+    /**
+     * Mark every active session for a user as ended. Used when a security-relevant
+     * account change (such as enabling MFA) must invalidate existing sessions.
+     */
+    async revokeAllForUser(userId) {
+        const rows = await db
+            .update(userSessions)
+            .set({ revokedAt: new Date() })
+            .where(and(eq(userSessions.userId, userId), isNull(userSessions.revokedAt)))
+            .returning({ id: userSessions.id });
+        return rows.length;
+    }
     async findRefreshTokenByHash(tokenHash) {
         const [row] = await db.select().from(refreshTokens).where(eq(refreshTokens.tokenHash, tokenHash)).limit(1);
         return row;

package/dist/repositories/session.js.map

@@ -1 +1 @@
-{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAWhD,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAsB;QAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aACtD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAc;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,cAAsB;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,oBAA6B;QAClE,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;iBAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"session.js","sourceRoot":"","sources":["../../src/repositories/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,aAAa,CAAC;AAWxD,MAAM,OAAO,iBAAiB;IAC5B,KAAK,CAAC,MAAM,CAAC,KAAyB;QACpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC;YACrD,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,cAAc,EAAE,KAAK,CAAC,cAAc;YACpC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;YAClD,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aAClC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACtC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,cAAsB;QAC/C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC;aACtD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC;aACnD,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aAC9B,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC/B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,MAAc;QACzC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aACzC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,cAAsB;QACjD,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;aAC1B,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,MAAc,EAAE,oBAA6B;QAClE,IAAI,oBAAoB,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC;iBAC1B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACxG,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,kBAAkB,CAAC,OAAe;QACtC,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC,CAAC;IACrG,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAc;QACnC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,YAAY,CAAC;aACpB,GAAG,CAAC,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;aAC9B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC,CAAC;aAC3E,SAAS,CAAC,EAAE,EAAE,EAAE,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,sBAAsB,CAAC,SAAiB;QAC5C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3G,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/repositories/types.d.ts

@@ -1,4 +1,8 @@
-import type { User, Organization, OrgMembership, Application, auditLog, Permission } from "../db/schema.js";
+import type { User, Organization, OrgMembership, Application, auditLog, MfaChallenge, Permission, ScimConnection, ScimGroup } from "../db/schema.js";
+export declare class LastOwnerInvariantError extends Error {
+    readonly code: "LAST_OWNER";
+    constructor(message?: string);
+}
 export interface CreateUserInput {
     email: string;
     username: string;
@@ -14,11 +18,12 @@ export interface UpdateUserInput {
     name?: string;
     email?: string;
     username?: string;
-    role?: string;
     emailVerified?: boolean;
     avatarUrl?: string | null;
     phoneNumber?: string | null;
     phoneVerified?: boolean;
+    isActive?: boolean;
+    accountReviewRequired?: boolean;
     metadata?: Record<string, unknown>;
 }
 export interface UserRepository {
@@ -26,14 +31,39 @@ export interface UserRepository {
     findByEmail(email: string): Promise<User | undefined>;
     create(input: CreateUserInput): Promise<User>;
     update(id: string, input: UpdateUserInput): Promise<User | undefined>;
+    updateRole(id: string, role: "owner" | "user"): Promise<User | undefined>;
     deactivate(id: string): Promise<void>;
     listByOrg(orgId: string): Promise<User[]>;
     listAll(): Promise<User[]>;
+    countByRole(role: string): Promise<number>;
     updateLastSeen(id: string): Promise<void>;
     ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
     recordFailedLogin(id: string): Promise<User | undefined>;
     resetFailedLogins(id: string): Promise<void>;
     lockAccount(id: string, until: Date): Promise<void>;
+    /** Resolve a user only through a membership in `orgId`. */
+    findByIdInOrg(orgId: string, userId: string): Promise<User | undefined>;
+    /**
+     * Update a user only when they are a member of `orgId`. Returns undefined
+     * when the user is outside the organization, so callers cannot accidentally
+     * fall back to a global update.
+     */
+    updateInOrg(orgId: string, userId: string, input: UpdateUserInput): Promise<User | undefined>;
+    /** Organizations the user belongs to. */
+    listOrgIdsForUser(userId: string): Promise<string[]>;
+    /**
+     * Remove a user from an organization as seen by SCIM.
+     *
+     * `outcome` distinguishes the two cases that matter for tenant safety:
+     *  - `membership_removed` — the user belongs to other organizations, so only
+     *    this membership is removed and the shared account is left untouched.
+     *  - `deactivated` — the organization was the user's only membership, so the
+     *    account itself is deactivated and its sessions are revoked.
+     */
+    removeFromOrg(orgId: string, userId: string): Promise<{
+        outcome: "membership_removed" | "deactivated" | "not_found" | "last_owner";
+        user?: User;
+    } | undefined>;
     setTotpSecret(userId: string, totpSecret: string): Promise<void>;
     enableTotp(userId: string): Promise<void>;
     disableTotp(userId: string): Promise<void>;
@@ -45,7 +75,7 @@ export interface CreateOrganizationInput {
     plan?: string;
 }
 export interface OrganizationRepository {
-    create(input: CreateOrganizationInput): Promise<Organization>;
+    createWithOwner(input: CreateOrganizationInput, userId: string): Promise<Organization>;
     findById(id: string): Promise<Organization | undefined>;
     findBySlug(slug: string): Promise<Organization | undefined>;
     listByUserId(userId: string): Promise<Organization[]>;
@@ -58,10 +88,10 @@ export interface OrganizationRepository {
     addMembership(input: {
         orgId: string;
         userId: string;
-        role: string;
+        role: "owner" | "admin" | "member";
     }): Promise<OrgMembership>;
     findMembership(orgId: string, userId: string): Promise<OrgMembership | undefined>;
-    updateMembershipRole(orgId: string, userId: string, role: string): Promise<OrgMembership | undefined>;
+    updateMembershipRole(orgId: string, userId: string, role: "owner" | "admin" | "member"): Promise<OrgMembership | undefined>;
     removeMembership(orgId: string, userId: string): Promise<boolean>;
     countOwners(orgId: string): Promise<number>;
     listMembers(orgId: string): Promise<{
@@ -72,6 +102,7 @@ export interface OrganizationRepository {
             username: string;
             name: string | null;
             avatarUrl: string | null;
+            platformRole: string;
         };
     }[]>;
 }
@@ -95,6 +126,82 @@ export interface IdentityRepository {
         };
     }[]>;
 }
+export type MfaFlow = "login" | "token_login";
+export type MfaChallengeStatus = "requires_mfa" | "consumed" | "failed" | "expired";
+export interface CreateMfaChallengeInput {
+    challengeHash: string;
+    userId: string;
+    flow: MfaFlow;
+    clientId?: string;
+    ipAddress?: string;
+    userAgent?: string;
+    expiresAt: Date;
+    maxAttempts: number;
+}
+export interface MfaChallengeRepository {
+    create(input: CreateMfaChallengeInput): Promise<MfaChallenge>;
+    findByHash(challengeHash: string): Promise<MfaChallenge | undefined>;
+    /** Atomically record a failed attempt; returns the updated challenge or undefined when already locked. */
+    recordFailedAttempt(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    /** Atomically consume an active challenge; returns undefined when missing, expired, or already consumed. */
+    consume(id: string, now: Date): Promise<MfaChallenge | undefined>;
+    /** Mark every outstanding challenge for a user as failed (used when a factor is enrolled/reset). */
+    invalidateUserChallenges(userId: string, now: Date): Promise<void>;
+    deleteExpired(now: Date): Promise<number>;
+}
+export interface CreateScimConnectionInput {
+    orgId: string;
+    name: string;
+    tokenHash: string;
+    tokenHint: string;
+    previousTokenHash?: string | null;
+    previousTokenValidUntil?: Date | null;
+    createdByUserId?: string | null;
+    expiresAt?: Date | null;
+}
+export interface ScimConnectionRepository {
+    create(input: CreateScimConnectionInput): Promise<ScimConnection>;
+    findById(id: string): Promise<ScimConnection | undefined>;
+    findActiveByOrg(orgId: string): Promise<ScimConnection | undefined>;
+    listByOrg(orgId: string): Promise<ScimConnection[]>;
+    listAll(): Promise<ScimConnection[]>;
+    /** Resolve a presented token; accepts the grace-period token until its deadline. */
+    findByTokenHash(tokenHash: string, now?: Date): Promise<ScimConnection | undefined>;
+    rotate(id: string, input: {
+        tokenHash: string;
+        tokenHint: string;
+        graceSeconds: number;
+        now?: Date;
+    }): Promise<ScimConnection | undefined>;
+    revoke(id: string, now?: Date): Promise<ScimConnection | undefined>;
+    touch(id: string, now?: Date): Promise<void>;
+    deleteRevokedBefore(cutoff: Date): Promise<number>;
+}
+export interface CreateScimGroupInput {
+    orgId: string;
+    displayName: string;
+    description?: string | null;
+    externalId?: string | null;
+}
+export interface ScimGroupRepository {
+    create(input: CreateScimGroupInput): Promise<ScimGroup>;
+    /** Groups are always looked up through their organization, never by id alone. */
+    findByIdInOrg(orgId: string, groupId: string): Promise<ScimGroup | undefined>;
+    listByOrg(orgId: string): Promise<ScimGroup[]>;
+    updateInOrg(orgId: string, groupId: string, input: {
+        displayName?: string;
+        description?: string | null;
+        externalId?: string | null;
+    }): Promise<ScimGroup | undefined>;
+    deleteInOrg(orgId: string, groupId: string): Promise<boolean>;
+    listMembers(orgId: string, groupId: string): Promise<{
+        userId: string;
+        email: string;
+        name: string | null;
+    }[]>;
+    addMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+    removeMember(orgId: string, groupId: string, userId: string): Promise<boolean>;
+}
 export interface AuditRepository {
     list(opts: {
         orgId?: string;
@@ -112,6 +219,10 @@ export interface CreateApplicationInput {
     allowedOrigins?: string[];
     clientId?: string;
     clientSecret?: string;
+    /** `public` clients are issued no secret and must authenticate with PKCE. */
+    clientType?: "confidential" | "public";
+    /** Scopes the client is registered to request. Empty means unrestricted. */
+    allowedScopes?: string[];
 }
 export interface UpdateApplicationInput {
     name?: string;
@@ -124,7 +235,7 @@ export interface UpdateApplicationInput {
 }
 export interface ApplicationRepository {
     create(input: CreateApplicationInput): Promise<Application & {
-        clientSecret: string;
+        clientSecret: string | null;
     }>;
     findByClientId(clientId: string): Promise<Application | undefined>;
     listByOrgId(orgId: string): Promise<Application[]>;

package/dist/repositories/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE5G,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACxD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACpH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9F,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IACtG,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC5K;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1H;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvF,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACtG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,IAAI,EACJ,YAAY,EACZ,aAAa,EACb,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,cAAc,EACd,SAAS,EACV,MAAM,iBAAiB,CAAC;AAEzB,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAG,YAAY,CAAU;IAEtC,YAAY,OAAO,SAAgD,EAGlE;CACF;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAChD,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACtE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC1E,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACxE,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD,2DAA2D;IAC3D,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IACxE;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC9F,yCAAyC;IACzC,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACrD;;;;;;;;OAQG;IACH,aAAa,CACX,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CACN;QAAE,OAAO,EAAE,oBAAoB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,GAC3F,SAAS,CACZ,CAAC;IACF,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,uBAAuB;IACtC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,eAAe,CAAC,KAAK,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACvF,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACxD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC5D,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACtD,OAAO,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACpH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7C,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACpH,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAClF,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAAC;IAC5H,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAClE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,aAAa,CAAC;QAAC,IAAI,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,KAAK,EAAE,MAAM,CAAC;YAAC,QAAQ,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAClM;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAAC;IAC5F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1H;AAED,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,aAAa,CAAC;AAC9C,MAAM,MAAM,kBAAkB,GAAG,cAAc,GAAG,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;AAEpF,MAAM,WAAW,uBAAuB;IACtC,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,OAAO,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC9D,UAAU,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IACrE,0GAA0G;IAC1G,mBAAmB,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAC9E,4GAA4G;IAC5G,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,YAAY,GAAG,SAAS,CAAC,CAAC;IAClE,oGAAoG;IACpG,wBAAwB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnE,aAAa,CAAC,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,uBAAuB,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,SAAS,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,CAAC,KAAK,EAAE,yBAAyB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IAC1D,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpE,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACpD,OAAO,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC;IACrC,oFAAoF;IACpF,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpF,MAAM,CACJ,EAAE,EAAE,MAAM,EACV,KAAK,EAAE;QAAE,SAAS,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,IAAI,CAAA;KAAE,GAChF,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACvC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,cAAc,GAAG,SAAS,CAAC,CAAC;IACpE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,mBAAmB,CAAC,MAAM,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,iFAAiF;IACjF,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAC9E,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC;IAC/C,WAAW,CACT,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,MAAM,EACf,KAAK,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GACvF,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC,CAAC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9D,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,EAAE,CAAC,CAAC;IAC/G,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5E,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CAChF;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,CAAC,IAAI,EAAE;QACT,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,GAAG,OAAO,CAAC,OAAO,QAAQ,CAAC,YAAY,EAAE,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,sBAAsB;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,UAAU,CAAC,EAAE,cAAc,GAAG,QAAQ,CAAC;IACvC,4EAA4E;IAC5E,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG;QAAE,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC9F,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACnE,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IACtG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;CACxF;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,2BAA2B,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9B,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;IACjD,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACpD,iBAAiB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACvC,MAAM,CAAC,KAAK,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/F,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAAC;IACpD,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAChE,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAChF,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACpG"}

package/dist/repositories/types.js

@@ -1,2 +1,8 @@
-export {};
+export class LastOwnerInvariantError extends Error {
+    code = "LAST_OWNER";
+    constructor(message = "The last owner cannot be removed or demoted") {
+        super(message);
+        this.name = "LastOwnerInvariantError";
+    }
+}
 //# sourceMappingURL=types.js.map

package/dist/repositories/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":""}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/repositories/types.ts"],"names":[],"mappings":"AAYA,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,GAAG,YAAqB,CAAC;IAEtC,YAAY,OAAO,GAAG,6CAA6C;QACjE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF"}

package/dist/repositories/user.d.ts

@@ -1,18 +1,40 @@
 import { type User } from "../db/schema.js";
-import type { CreateUserInput, UpdateUserInput, UserRepository } from "./types.js";
+import { type CreateUserInput, type UpdateUserInput, type UserRepository } from "./types.js";
 export declare class DrizzleUserRepository implements UserRepository {
     findById(id: string): Promise<User | undefined>;
     findByEmail(email: string): Promise<User | undefined>;
     create(input: CreateUserInput): Promise<User>;
     update(id: string, input: UpdateUserInput): Promise<User | undefined>;
+    updateRole(id: string, role: "owner" | "user"): Promise<User | undefined>;
     deactivate(id: string): Promise<void>;
     listByOrg(orgId: string): Promise<User[]>;
+    findByIdInOrg(orgId: string, userId: string): Promise<User | undefined>;
+    /**
+     * Organization-scoped update. The membership check is part of the statement,
+     * so a caller cannot update a global user row by passing a user id that is
+     * outside the organization.
+     */
+    updateInOrg(orgId: string, userId: string, input: UpdateUserInput): Promise<User | undefined>;
+    listOrgIdsForUser(userId: string): Promise<string[]>;
+    /**
+     * Remove a user from one organization without reaching outside it.
+     *
+     * A user row is global, so a blanket deactivation would revoke that person's
+     * access to every other organization they belong to — an action this
+     * credential is not authorized to take. The membership is therefore removed
+     * first, and the account is only deactivated once no membership remains.
+     */
+    removeFromOrg(orgId: string, userId: string): Promise<{
+        outcome: "membership_removed" | "deactivated" | "not_found" | "last_owner";
+        user?: User;
+    } | undefined>;
     updateLastSeen(id: string): Promise<void>;
     recordFailedLogin(id: string): Promise<User | undefined>;
     resetFailedLogins(id: string): Promise<void>;
     lockAccount(id: string, until: Date): Promise<void>;
     ensureUniqueUsername(base: string, excludeId?: string): Promise<string>;
     listAll(): Promise<User[]>;
+    countByRole(role: string): Promise<number>;
     setTotpSecret(userId: string, totpSecret: string): Promise<void>;
     enableTotp(userId: string): Promise<void>;
     disableTotp(userId: string): Promise<void>;

package/dist/repositories/user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/repositories/user.ts"],"names":[],"mappings":"AAEA,OAAO,EAA4D,KAAK,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACtG,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEnF,qBAAa,qBAAsB,YAAW,cAAc;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAK/C,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAKrD,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB7C,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IASrE,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrC,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IASzC,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IASxD,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAO5C,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAInD,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAiBvE,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;IAI1B,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIzC,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI1C,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGhD;AAED,qBAAa,yBAAyB;IAC9B,IAAI,CAAC,KAAK,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC;IAcX,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC;IAU3F,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC;CAU/H"}
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../src/repositories/user.ts"],"names":[],"mappings":"AAEA,OAAO,EASL,KAAK,IAAI,EACV,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAA2B,KAAK,eAAe,EAAE,KAAK,eAAe,EAAE,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAsBtH,qBAAa,qBAAsB,YAAW,cAAc;IACpD,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAGpD;IAEK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAG1D;IAEK,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBlD;IAEK,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAO1E;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAuB9E;IAEK,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB1C;IAEK,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAO9C;IAEK,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAQ5E;IAED;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAelG;IAEK,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAMzD;IAED;;;;;;;OAOG;IACG,aAAa,CACjB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CACN;QAAE,OAAO,EAAE,oBAAoB,GAAG,aAAa,GAAG,WAAW,GAAG,YAAY,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,GAC3F,SAAS,CACZ,CAsEA;IAEK,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAO7D;IAEK,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKjD;IAEK,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAExD;IAEK,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAe5E;IAEK,OAAO,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAE/B;IAEK,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAM/C;IAEK,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAErE;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;IAEK,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE/C;IAEK,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE9C;CACF;AAED,qBAAa,yBAAyB;IAC9B,IAAI,CAAC,KAAK,EAAE;QAChB,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,CAAC;QACrB,WAAW,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;KACnC,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;IAEK,uBAAuB,CAAC,UAAU,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAQhG;IAEK,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,GAAG,CAAC;QAAC,QAAQ,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAC;YAAC,YAAY,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,EAAE,CAAC,CAS7H;CACF"}

package/dist/repositories/user.js

@@ -1,6 +1,26 @@
-import { eq, sql } from "drizzle-orm";
+import { eq, and, isNull, sql } from "drizzle-orm";
 import { db } from "../db/index.js";
-import { users, orgMemberships, userIdentities, identityProviders } from "../db/schema.js";
+import { users, orgMemberships, userIdentities, identityProviders, refreshTokens, apiKeys, userSessions, scimGroupMembers, } from "../db/schema.js";
+import { LastOwnerInvariantError } from "./types.js";
+/**
+ * Columns a generic update may write. Both the global and the
+ * organization-scoped update path share this allowlist so they cannot drift,
+ * and so a field like `role` is never reachable through a profile update.
+ */
+function writableColumns(input) {
+    return {
+        ...(input.name !== undefined ? { name: input.name } : {}),
+        ...(input.email !== undefined ? { email: input.email } : {}),
+        ...(input.username !== undefined ? { username: input.username } : {}),
+        ...(input.emailVerified !== undefined ? { emailVerified: input.emailVerified } : {}),
+        ...(input.avatarUrl !== undefined ? { avatarUrl: input.avatarUrl } : {}),
+        ...(input.phoneNumber !== undefined ? { phoneNumber: input.phoneNumber } : {}),
+        ...(input.phoneVerified !== undefined ? { phoneVerified: input.phoneVerified } : {}),
+        ...(input.isActive !== undefined ? { isActive: input.isActive } : {}),
+        ...(input.accountReviewRequired !== undefined ? { accountReviewRequired: input.accountReviewRequired } : {}),
+        ...(input.metadata !== undefined ? { metadata: input.metadata } : {}),
+    };
+}
 export class DrizzleUserRepository {
     async findById(id) {
         const [user] = await db.select().from(users).where(eq(users.id, id)).limit(1);
@@ -30,13 +50,58 @@ export class DrizzleUserRepository {
     async update(id, input) {
         const [updated] = await db
             .update(users)
-            .set({ ...input, updatedAt: sql `now()` })
+            .set({ ...writableColumns(input), updatedAt: sql `now()` })
             .where(eq(users.id, id))
             .returning();
         return updated;
     }
+    async updateRole(id, role) {
+        if (role !== "owner" && role !== "user")
+            throw new Error("Invalid platform role");
+        return db.transaction(async (tx) => {
+            const [target] = await tx.select().from(users).where(eq(users.id, id)).limit(1);
+            if (!target)
+                return undefined;
+            if (target.role === "owner" && role === "user") {
+                const owners = await tx
+                    .select({ id: users.id })
+                    .from(users)
+                    .where(and(eq(users.role, "owner"), eq(users.isActive, true)))
+                    .for("update");
+                if (owners.length <= 1)
+                    throw new LastOwnerInvariantError("Cannot demote the last platform owner");
+            }
+            const [updated] = await tx
+                .update(users)
+                .set({ role, updatedAt: sql `now()` })
+                .where(eq(users.id, id))
+                .returning();
+            return updated;
+        });
+    }
     async deactivate(id) {
-        await db.update(users).set({ emailVerified: false, updatedAt: sql `now()` }).where(eq(users.id, id));
+        await db.transaction(async (tx) => {
+            const [target] = await tx.select().from(users).where(eq(users.id, id)).limit(1);
+            if (!target)
+                return;
+            if (target.role === "owner" && target.isActive) {
+                const owners = await tx
+                    .select({ id: users.id })
+                    .from(users)
+                    .where(and(eq(users.role, "owner"), eq(users.isActive, true)))
+                    .for("update");
+                if (owners.length <= 1)
+                    throw new LastOwnerInvariantError("Cannot deactivate the last platform owner");
+            }
+            const now = new Date();
+            await tx
+                .update(users)
+                .set({ isActive: false, accountReviewRequired: false, emailVerified: false, passwordHash: null, totpSecret: null, totpEnabled: false, updatedAt: now })
+                .where(eq(users.id, id));
+            await tx.update(refreshTokens).set({ revokedAt: now }).where(and(eq(refreshTokens.userId, id), isNull(refreshTokens.revokedAt)));
+            await tx.update(apiKeys).set({ revokedAt: now }).where(and(eq(apiKeys.userId, id), isNull(apiKeys.revokedAt)));
+            await tx.delete(userSessions).where(eq(userSessions.userId, id));
+        });
     }
     async listByOrg(orgId) {
         const rows = await db
@@ -46,6 +111,110 @@ export class DrizzleUserRepository {
             .where(eq(orgMemberships.orgId, orgId));
         return rows.map((r) => r.user);
     }
+    async findByIdInOrg(orgId, userId) {
+        const [row] = await db
+            .select({ user: users })
+            .from(users)
+            .innerJoin(orgMemberships, eq(users.id, orgMemberships.userId))
+            .where(and(eq(orgMemberships.orgId, orgId), eq(users.id, userId)))
+            .limit(1);
+        return row?.user;
+    }
+    /**
+     * Organization-scoped update. The membership check is part of the statement,
+     * so a caller cannot update a global user row by passing a user id that is
+     * outside the organization.
+     */
+    async updateInOrg(orgId, userId, input) {
+        const changes = writableColumns(input);
+        if (Object.keys(changes).length === 0)
+            return this.findByIdInOrg(orgId, userId);
+        const [updated] = await db
+            .update(users)
+            .set({ ...changes, updatedAt: sql `now()` })
+            .where(and(eq(users.id, userId), sql `exists (select 1 from ${orgMemberships} m where m.user_id = ${users.id} and m.org_id = ${orgId})`))
+            .returning();
+        return updated;
+    }
+    async listOrgIdsForUser(userId) {
+        const rows = await db
+            .select({ orgId: orgMemberships.orgId })
+            .from(orgMemberships)
+            .where(eq(orgMemberships.userId, userId));
+        return rows.map((r) => r.orgId);
+    }
+    /**
+     * Remove a user from one organization without reaching outside it.
+     *
+     * A user row is global, so a blanket deactivation would revoke that person's
+     * access to every other organization they belong to — an action this
+     * credential is not authorized to take. The membership is therefore removed
+     * first, and the account is only deactivated once no membership remains.
+     */
+    async removeFromOrg(orgId, userId) {
+        return db.transaction(async (tx) => {
+            const [row] = await tx
+                .select({ user: users, role: orgMemberships.role })
+                .from(users)
+                .innerJoin(orgMemberships, eq(users.id, orgMemberships.userId))
+                .where(and(eq(orgMemberships.orgId, orgId), eq(users.id, userId)))
+                .limit(1)
+                .for("update");
+            if (!row)
+                return { outcome: "not_found" };
+            if (row.user.role === "owner") {
+                return { outcome: "last_owner", user: row.user };
+            }
+            // The organization-owner invariant, not just the platform one. Removing
+            // the only organization owner would lock the tenant out of every
+            // owner-gated route, including SCIM connection rotation and revocation.
+            if (row.role === "owner") {
+                const owners = await tx
+                    .select({ id: orgMemberships.id })
+                    .from(orgMemberships)
+                    .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.role, "owner")))
+                    .for("update");
+                if (owners.length <= 1) {
+                    return { outcome: "last_owner", user: row.user };
+                }
+            }
+            const memberships = await tx
+                .select({ id: orgMemberships.id, orgId: orgMemberships.orgId })
+                .from(orgMemberships)
+                .where(eq(orgMemberships.userId, userId))
+                .for("update");
+            await tx
+                .delete(orgMemberships)
+                .where(and(eq(orgMemberships.orgId, orgId), eq(orgMemberships.userId, userId)));
+            // Group membership and the default-organization pointer are both scoped
+            // to a membership that no longer exists.
+            await tx.delete(scimGroupMembers).where(eq(scimGroupMembers.userId, userId));
+            await tx
+                .update(users)
+                .set({ defaultOrgId: null })
+                .where(and(eq(users.id, userId), eq(users.defaultOrgId, orgId)));
+            if (memberships.length > 1) {
+                // Still a member elsewhere: leave the shared account intact.
+                return { outcome: "membership_removed", user: row.user };
+            }
+            const now = new Date();
+            const [deactivated] = await tx
+                .update(users)
+                .set({ isActive: false, accountReviewRequired: false, emailVerified: false, passwordHash: null, totpSecret: null, totpEnabled: false, updatedAt: now })
+                .where(eq(users.id, userId))
+                .returning();
+            await tx
+                .update(refreshTokens)
+                .set({ revokedAt: now })
+                .where(and(eq(refreshTokens.userId, userId), isNull(refreshTokens.revokedAt)));
+            await tx
+                .update(apiKeys)
+                .set({ revokedAt: now })
+                .where(and(eq(apiKeys.userId, userId), isNull(apiKeys.revokedAt)));
+            await tx.delete(userSessions).where(eq(userSessions.userId, userId));
+            return { outcome: "deactivated", user: deactivated ?? row.user };
+        });
+    }
     async updateLastSeen(id) {
         await db.update(users).set({ updatedAt: sql `now()` }).where(eq(users.id, id));
     }
@@ -85,6 +254,13 @@ export class DrizzleUserRepository {
     async listAll() {
         return db.select().from(users);
     }
+    async countByRole(role) {
+        const [row] = await db
+            .select({ count: sql `count(*)`.mapWith(Number) })
+            .from(users)
+            .where(and(eq(users.role, role), eq(users.isActive, true)));
+        return row?.count ?? 0;
+    }
     async setTotpSecret(userId, totpSecret) {
         await db.update(users).set({ totpSecret, totpEnabled: false }).where(eq(users.id, userId));
     }

package/dist/repositories/user.js.map

@@ -1 +1 @@
-{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/repositories/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,iBAAiB,EAAa,MAAM,iBAAiB,CAAC;AAGtG,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;YACzC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,UAAU;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAsB;QAC7C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACxC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACvB,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACtG,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,CAAC;aACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;aAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAA,GAAG,KAAK,CAAC,mBAAmB,MAAM,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC1F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACvB,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,KAAW;QACvC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,SAAkB;QACzD,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;iBACnC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAkB;QACpD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,IAAI,CAAC,KAOV;QACC,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;SAC7B,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,UAAkB,EAAE,WAAmB;QACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAClD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,QAAQ,EAAE,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE;SACnH,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACxC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;CACF"}
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../src/repositories/user.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACnD,OAAO,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAC;AACpC,OAAO,EACL,KAAK,EACL,cAAc,EACd,cAAc,EACd,iBAAiB,EACjB,aAAa,EACb,OAAO,EACP,YAAY,EACZ,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,uBAAuB,EAAmE,MAAM,YAAY,CAAC;AAEtH;;;;GAIG;AACH,SAAS,eAAe,CAAC,KAAsB;IAC7C,OAAO;QACL,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9E,GAAG,CAAC,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrE,GAAG,CAAC,KAAK,CAAC,qBAAqB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,KAAK,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5G,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtE,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,qBAAqB;IAChC,KAAK,CAAC,QAAQ,CAAC,EAAU;QACvB,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,KAAK,CAAC;aACb,MAAM,CAAC;YACN,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE;YACvC,QAAQ,EAAE,KAAK,CAAC,QAAQ;YACxB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,KAAK,CAAC,QAAQ;YACzC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,UAAU;YACtC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;YAClC,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,EAAE;SAC/B,CAAC;aACD,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,EAAU,EAAE,KAAsB;QAC7C,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,GAAG,eAAe,CAAC,KAAK,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACzD,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACvB,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU,EAAE,IAAsB;QACjD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QAElF,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAE9B,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;qBACxB,IAAI,CAAC,KAAK,CAAC;qBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;qBAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,uCAAuC,CAAC,CAAC;YACrG,CAAC;YAED,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;iBACvB,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;iBACpC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;iBACvB,SAAS,EAAE,CAAC;YACf,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YAChC,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAChF,IAAI,CAAC,MAAM;gBAAE,OAAO;YACpB,IAAI,MAAM,CAAC,IAAI,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;gBAC/C,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;qBACxB,IAAI,CAAC,KAAK,CAAC;qBACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;qBAC7D,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC;oBAAE,MAAM,IAAI,uBAAuB,CAAC,2CAA2C,CAAC,CAAC;YACzG,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACtJ,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC3B,MAAM,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACjI,MAAM,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YAC/G,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAa;QAC3B,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,CAAC;aACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;aAC9D,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAAa,EAAE,MAAc;QAC/C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,KAAK,CAAC;aACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;aAC9D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;aACjE,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa,EAAE,MAAc,EAAE,KAAsB;QACrE,MAAM,OAAO,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;QACvC,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEhF,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC1C,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EACpB,GAAG,CAAA,yBAAyB,cAAc,wBAAwB,KAAK,CAAC,EAAE,mBAAmB,KAAK,GAAG,CACtG,CACF;aACA,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;QACpC,MAAM,IAAI,GAAG,MAAM,EAAE;aAClB,MAAM,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;aACvC,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAClC,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,MAAc;QAKd,OAAO,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;YACjC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACnB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,CAAC,IAAI,EAAE,CAAC;iBAClD,IAAI,CAAC,KAAK,CAAC;iBACX,SAAS,CAAC,cAAc,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC;iBAC9D,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;iBACjE,KAAK,CAAC,CAAC,CAAC;iBACR,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjB,IAAI,CAAC,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,WAAoB,EAAE,CAAC;YAEnD,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC9B,OAAO,EAAE,OAAO,EAAE,YAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YAC5D,CAAC;YAED,wEAAwE;YACxE,iEAAiE;YACjE,wEAAwE;YACxE,IAAI,GAAG,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACzB,MAAM,MAAM,GAAG,MAAM,EAAE;qBACpB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC;qBACjC,IAAI,CAAC,cAAc,CAAC;qBACpB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;qBAC7E,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACjB,IAAI,MAAM,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;oBACvB,OAAO,EAAE,OAAO,EAAE,YAAqB,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;gBAC5D,CAAC;YACH,CAAC;YAED,MAAM,WAAW,GAAG,MAAM,EAAE;iBACzB,MAAM,CAAC,EAAE,EAAE,EAAE,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC;iBAC9D,IAAI,CAAC,cAAc,CAAC;iBACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;iBACxC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAEjB,MAAM,EAAE;iBACL,MAAM,CAAC,cAAc,CAAC;iBACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;YAElF,wEAAwE;YACxE,yCAAyC;YACzC,MAAM,EAAE,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAC7E,MAAM,EAAE;iBACL,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;iBAC3B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAEnE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3B,6DAA6D;gBAC7D,OAAO,EAAE,OAAO,EAAE,oBAA6B,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACpE,CAAC;YAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,EAAE;iBAC3B,MAAM,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACtJ,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;iBAC3B,SAAS,EAAE,CAAC;YACf,MAAM,EAAE;iBACL,MAAM,CAAC,aAAa,CAAC;iBACrB,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACjF,MAAM,EAAE;iBACL,MAAM,CAAC,OAAO,CAAC;iBACf,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;iBACvB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACrE,MAAM,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;YAErE,OAAO,EAAE,OAAO,EAAE,aAAsB,EAAE,IAAI,EAAE,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC5E,CAAC,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,EAAU;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAChF,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;aACvB,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,mBAAmB,EAAE,GAAG,CAAA,GAAG,KAAK,CAAC,mBAAmB,MAAM,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aAC1F,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;aACvB,SAAS,EAAE,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,EAAU;QAChC,MAAM,EAAE;aACL,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,mBAAmB,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC;aACzE,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,EAAU,EAAE,KAAW;QACvC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,CAAA,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,IAAY,EAAE,SAAkB;QACzD,IAAI,QAAQ,GAAG,IAAI,IAAI,MAAM,CAAC;QAC9B,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,QAAQ,GAAG,MAAM,EAAE;iBACtB,MAAM,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;iBACxB,IAAI,CAAC,KAAK,CAAC;iBACX,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;iBACnC,KAAK,CAAC,CAAC,CAAC,CAAC;YACZ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC;YAClB,CAAC;YACD,QAAQ,GAAG,GAAG,IAAI,IAAI,OAAO,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO;QACX,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,IAAY;QAC5B,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACnB,MAAM,CAAC,EAAE,KAAK,EAAE,GAAG,CAAQ,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;aACxD,IAAI,CAAC,KAAK,CAAC;aACX,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC;QAC9D,OAAO,GAAG,EAAE,KAAK,IAAI,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,UAAkB;QACpD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC7F,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,MAAc;QAC9B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACzH,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,MAAc;QAC7B,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;IACrD,CAAC;CACF;AAED,MAAM,OAAO,yBAAyB;IACpC,KAAK,CAAC,IAAI,CAAC,KAOV;QACC,MAAM,EAAE;aACL,MAAM,CAAC,cAAc,CAAC;aACtB,MAAM,CAAC;YACN,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;SAC7B,CAAC;aACD,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,KAAK,CAAC,uBAAuB,CAAC,UAAkB,EAAE,WAAmB;QACnE,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,EAAE;aACxB,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;aACvB,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;aAClD,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;aACrD,KAAK,CAAC,CAAC,CAAC,CAAC;QACZ,OAAO,QAAQ,EAAE,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,MAAc;QAC/B,OAAO,EAAE;aACN,MAAM,CAAC;YACN,QAAQ,EAAE,cAAc;YACxB,QAAQ,EAAE,EAAE,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,IAAI,EAAE,iBAAiB,CAAC,IAAI,EAAE,YAAY,EAAE,iBAAiB,CAAC,YAAY,EAAE;SACnH,CAAC;aACD,IAAI,CAAC,cAAc,CAAC;aACpB,KAAK,CAAC,EAAE,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;aACxC,SAAS,CAAC,iBAAiB,EAAE,EAAE,CAAC,cAAc,CAAC,UAAU,EAAE,iBAAiB,CAAC,EAAE,CAAC,CAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/routes/admin/billing.js

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { requireAuthAndRole } from "./helpers.js";
+import { requireOrganizationRole } from "./helpers.js";
 import { getBillingSummary, setOrganizationPlan, provisionBillingCustomer, listPlans } from "../../services/billing.js";
 const UpdatePlanSchema = z.object({
     plan: z.enum(["free", "starter", "growth", "enterprise"]),
@@ -8,19 +8,19 @@ export default async function billingRoutes(app) {
     app.get("/billing/plans", { preHandler: [app.authenticate] }, async () => {
         return { plans: listPlans() };
     });
-    app.get("/organizations/:id/billing", { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "read" })] }, async (request) => {
+    app.get("/organizations/:id/billing", { preHandler: [requireOrganizationRole(["owner", "admin"], { resource: "billing", action: "read" })] }, async (request) => {
         const { id } = request.params;
         const summary = await getBillingSummary(id);
         return summary;
     });
-    app.patch("/organizations/:id/plan", { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] }, async (request) => {
+    app.patch("/organizations/:id/plan", { preHandler: [requireOrganizationRole(["owner", "admin"], { resource: "billing", action: "update" })] }, async (request) => {
         const { id } = request.params;
         const body = UpdatePlanSchema.parse(request.body);
         const result = await setOrganizationPlan(id, body.plan);
         await request.audit("organization_plan_updated", { orgId: id, plan: body.plan });
         return result;
     });
-    app.post("/organizations/:id/billing/customer", { preHandler: [requireAuthAndRole(["owner", "admin"], { resource: "billing", action: "update" })] }, async (request, reply) => {
+    app.post("/organizations/:id/billing/customer", { preHandler: [requireOrganizationRole(["owner", "admin"], { resource: "billing", action: "update" })] }, async (request, reply) => {
         const { id } = request.params;
         const user = request.user;
         const result = await provisionBillingCustomer(id, user.email);