@kelpie/server 0.1.0

package/dist/modules/api-keys/schema.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Both kinds of key are bound to one workspace at creation (`api.md`). A null
+ * `user_id` is a workspace key; a set one is a personal key acting as that user
+ * within that workspace.
+ */
+export declare const apiKeys: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "api_keys";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        workspaceId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "workspace_id";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "user_id";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        name: import("drizzle-orm/pg-core").PgColumn<{
+            name: "name";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        secretHash: import("drizzle-orm/pg-core").PgColumn<{
+            name: "secret_hash";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        displayPrefix: import("drizzle-orm/pg-core").PgColumn<{
+            name: "display_prefix";
+            tableName: "api_keys";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastUsedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: string;
+            tableName: "api_keys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "api_keys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        updatedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "updated_at";
+            tableName: "api_keys";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: 'pg';
+}>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/modules/api-keys/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/schema.ts"],"names":[],"mappings":"AAMA;;;;GAIG;AACH,eAAO,MAAM,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgBnB,CAAA"}

package/dist/modules/api-keys/schema.js

@@ -0,0 +1,23 @@
+import { index, pgTable, text } from 'drizzle-orm/pg-core';
+import { createdAt, moment, primaryId, updatedAt } from '../../lib/columns.js';
+import { users } from '../auth/schema.js';
+import { workspaces } from '../workspace/schema.js';
+/**
+ * Both kinds of key are bound to one workspace at creation (`api.md`). A null
+ * `user_id` is a workspace key; a set one is a personal key acting as that user
+ * within that workspace.
+ */
+export const apiKeys = pgTable('api_keys', {
+    id: primaryId(),
+    workspaceId: text('workspace_id')
+        .notNull()
+        .references(() => workspaces.id, { onDelete: 'cascade' }),
+    userId: text('user_id').references(() => users.id, { onDelete: 'cascade' }),
+    name: text('name').notNull(),
+    secretHash: text('secret_hash').notNull().unique(),
+    displayPrefix: text('display_prefix').notNull(),
+    lastUsedAt: moment('last_used_at'),
+    createdAt: createdAt(),
+    updatedAt: updatedAt(),
+}, (table) => [index('api_keys_workspace_idx').on(table.workspaceId)]);
+//# sourceMappingURL=schema.js.map

package/dist/modules/api-keys/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/modules/api-keys/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAE1D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAA;AAC9E,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAA;AAEnD;;;;GAIG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG,OAAO,CAC5B,UAAU,EACV;IACE,EAAE,EAAE,SAAS,EAAE;IACf,WAAW,EAAE,IAAI,CAAC,cAAc,CAAC;SAC9B,OAAO,EAAE;SACT,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3D,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC3E,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE;IAC5B,UAAU,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE;IAClD,aAAa,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,OAAO,EAAE;IAC/C,UAAU,EAAE,MAAM,CAAC,cAAc,CAAC;IAClC,SAAS,EAAE,SAAS,EAAE;IACtB,SAAS,EAAE,SAAS,EAAE;CACvB,EACD,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CACnE,CAAA"}

package/dist/modules/api-keys/service.d.ts

@@ -0,0 +1,37 @@
+import type { Database } from '../../lib/database.ts';
+import type { IdFactory } from '../../lib/ids.ts';
+import type { Actor } from '../auth/actor.ts';
+import type { KeyKind } from './keys.ts';
+/**
+ * API key management.
+ *
+ * A workspace key belongs to the workspace and needs admin authority to create or
+ * revoke. A personal key belongs to one member and is theirs alone: admins can
+ * see that it exists but cannot use or manage it.
+ */
+export interface ApiKeyDependencies {
+    readonly db: Database;
+    readonly createId: IdFactory;
+    readonly now: () => Date;
+    /** Injected only so tests can pin secrets. Production uses the crypto default. */
+    readonly newToken?: () => string;
+}
+export interface ApiKeyView {
+    readonly id: string;
+    readonly name: string;
+    readonly kind: KeyKind;
+    readonly displayPrefix: string;
+    readonly lastUsedAt: Date | null;
+    readonly createdAt: Date;
+}
+/** The one response that ever carries the secret. */
+export interface MintedApiKey extends ApiKeyView {
+    readonly secret: string;
+}
+export interface ApiKeyService {
+    create(actor: Actor, name: string, kind: KeyKind): Promise<MintedApiKey>;
+    list(actor: Actor, kind: KeyKind): Promise<readonly ApiKeyView[]>;
+    revoke(actor: Actor, id: string): Promise<void>;
+}
+export declare function createApiKeyService(dependencies: ApiKeyDependencies): ApiKeyService;
+//# sourceMappingURL=service.d.ts.map

package/dist/modules/api-keys/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/modules/api-keys/service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAA;AACjD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAA;AAG7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAGxC;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAA;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;IACxB,kFAAkF;IAClF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,UAAU,EAAE,IAAI,GAAG,IAAI,CAAA;IAChC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;CACzB;AAED,qDAAqD;AACrD,MAAM,WAAW,YAAa,SAAQ,UAAU;IAC9C,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,CAAA;IACxE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;IACjE,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAChD;AAaD,wBAAgB,mBAAmB,CAAC,YAAY,EAAE,kBAAkB,GAAG,aAAa,CA+FnF"}

package/dist/modules/api-keys/service.js

@@ -0,0 +1,95 @@
+import { AppError } from '../../lib/errors.js';
+import { roleAllows } from '../workspace/roles.js';
+import { mintKey } from './keys.js';
+import * as repository from './repository.js';
+function toView(record) {
+    return {
+        id: record.id,
+        name: record.name,
+        kind: record.userId === null ? 'workspace' : 'personal',
+        displayPrefix: record.displayPrefix,
+        lastUsedAt: record.lastUsedAt,
+        createdAt: record.createdAt,
+    };
+}
+export function createApiKeyService(dependencies) {
+    /**
+     * Keys are always workspace-bound, so an actor with no workspace cannot have
+     * any. That is the state between signup and the first workspace create.
+     */
+    function requireWorkspace(actor) {
+        if (actor.workspaceId === null) {
+            throw new AppError('forbidden', 'Create a workspace before creating API keys');
+        }
+        return actor.workspaceId;
+    }
+    /**
+     * Reads the role off the actor rather than re-querying the membership.
+     * `credentials.ts` resolves it from the live `workspace_members` row on every
+     * request, so it is already as fresh as a query here would be. A workspace key
+     * has no member row and carries `admin` by definition.
+     *
+     * `role` is null only for a session with no membership, which `requireWorkspace`
+     * has already refused: a session's workspace comes from that same row.
+     */
+    function requireAdmin(actor) {
+        if (actor.role === null || !roleAllows(actor.role, 'admin')) {
+            throw new AppError('forbidden', 'This action needs the admin role');
+        }
+    }
+    /** A personal key needs a person. A workspace key cannot mint or manage one. */
+    function requireUser(actor) {
+        if (actor.userId === null) {
+            throw new AppError('forbidden', 'A personal key belongs to a user, and this caller is not one');
+        }
+        return actor.userId;
+    }
+    return {
+        async create(actor, name, kind) {
+            const workspaceId = requireWorkspace(actor);
+            const userId = kind === 'workspace' ? null : requireUser(actor);
+            if (kind === 'workspace') {
+                requireAdmin(actor);
+            }
+            const minted = mintKey(kind, dependencies.newToken);
+            const record = await repository.insertApiKey(dependencies.db, {
+                id: dependencies.createId('apiKey'),
+                workspaceId,
+                userId,
+                name,
+                secretHash: minted.secretHash,
+                displayPrefix: minted.displayPrefix,
+            });
+            // The only time the secret leaves this process. Nothing stores it.
+            return { ...toView(record), secret: minted.secret };
+        },
+        async list(actor, kind) {
+            const workspaceId = requireWorkspace(actor);
+            if (kind === 'workspace') {
+                requireAdmin(actor);
+                return (await repository.listWorkspaceKeys(dependencies.db, workspaceId)).map(toView);
+            }
+            const records = await repository.listPersonalKeys(dependencies.db, workspaceId, requireUser(actor));
+            return records.map(toView);
+        },
+        async revoke(actor, id) {
+            const workspaceId = requireWorkspace(actor);
+            const record = await repository.findApiKey(dependencies.db, workspaceId, id);
+            // A key in another workspace is indistinguishable from one that never
+            // existed, per `api.md`.
+            if (record === undefined) {
+                throw AppError.notFound('API key not found');
+            }
+            if (record.userId === null) {
+                requireAdmin(actor);
+            }
+            else if (record.userId !== actor.userId) {
+                // An admin can see a colleague's personal key exists but cannot revoke it;
+                // removing their membership is how you cut off their access.
+                throw AppError.notFound('API key not found');
+            }
+            await repository.deleteApiKey(dependencies.db, workspaceId, id);
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/modules/api-keys/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/modules/api-keys/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAG9C,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAA;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAEnC,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAsC7C,SAAS,MAAM,CAAC,MAA+B;IAC7C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;QACvD,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC5B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,YAAgC;IAClE;;;OAGG;IACH,SAAS,gBAAgB,CAAC,KAAY;QACpC,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;YAC/B,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,6CAA6C,CAAC,CAAA;QAChF,CAAC;QAED,OAAO,KAAK,CAAC,WAAW,CAAA;IAC1B,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,YAAY,CAAC,KAAY;QAChC,IAAI,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAA;QACrE,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,SAAS,WAAW,CAAC,KAAY;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1B,MAAM,IAAI,QAAQ,CAAC,WAAW,EAAE,8DAA8D,CAAC,CAAA;QACjG,CAAC;QAED,OAAO,KAAK,CAAC,MAAM,CAAA;IACrB,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI;YAC5B,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,MAAM,GAAG,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YAE/D,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;YAED,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAA;YACnD,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE;gBAC5D,EAAE,EAAE,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC;gBACnC,WAAW;gBACX,MAAM;gBACN,IAAI;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,aAAa,EAAE,MAAM,CAAC,aAAa;aACpC,CAAC,CAAA;YAEF,mEAAmE;YACnE,OAAO,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAA;QACrD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI;YACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YAE3C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;gBACzB,YAAY,CAAC,KAAK,CAAC,CAAA;gBAEnB,OAAO,CAAC,MAAM,UAAU,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvF,CAAC;YAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,CAAC,CAAA;YAEnG,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC5B,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE;YACpB,MAAM,WAAW,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAA;YAC3C,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;YAE5E,sEAAsE;YACtE,yBAAyB;YACzB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;YAC9C,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBAC3B,YAAY,CAAC,KAAK,CAAC,CAAA;YACrB,CAAC;iBAAM,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC1C,2EAA2E;gBAC3E,6DAA6D;gBAC7D,MAAM,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAA;YAC9C,CAAC;YAED,MAAM,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC,EAAE,EAAE,WAAW,EAAE,EAAE,CAAC,CAAA;QACjE,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/attachedRecords.d.ts

@@ -0,0 +1,39 @@
+import type { PipelineKind } from '@kelpie/schemas';
+import type { Queryable } from '../runtime/transaction.ts';
+/**
+ * The polymorphic delete rule from `schema.md`, in one place.
+ *
+ * Notes, activities and decisions attach to a target through `target_type` plus
+ * `target_id` with no foreign key, so no cascade removes them. Whoever deletes
+ * the target deletes these, in the same transaction, or the rows outlive the
+ * record they described and reappear the day an id is reused.
+ *
+ * `plan_items` attach the same way but their check constraint allows only the
+ * four pipeline types, so they are removed only for those targets.
+ */
+/** Target types that can own attached records here. */
+export type AttachableTargetType = 'person' | 'company' | 'candidate' | PipelineKind;
+/**
+ * @param db Must be the caller's transaction. Called on its own, this deletes the
+ *   dependents of a record that still exists.
+ * @returns How many rows were removed, for the caller's activity trail.
+ */
+export declare function deleteRecordsAttachedTo(db: Queryable, workspaceId: string, targetType: AttachableTargetType, targetId: string): Promise<number>;
+/**
+ * The same cleanup for the candidacies a person's delete takes with them.
+ *
+ * `candidates.person_id` cascades, so those rows go without any service seeing
+ * them, and the interview notes attached to each would outlive the candidacy
+ * they described. This is the only link in the schema that both dies by cascade
+ * and owns attached records, which is why it is the only one with a helper here.
+ *
+ * Reads the `candidates` *table* rather than the hiring repository: the module
+ * that owns those rows registers after `people`, and `architecture.md` allows a
+ * table read where a repository import would invert the dependency.
+ *
+ * @param db Must be the caller's transaction, so a refused person delete brings
+ *   these rows back with it.
+ * @returns How many attached rows were removed.
+ */
+export declare function deleteRecordsAttachedToCandidaciesOf(db: Queryable, workspaceId: string, personId: string): Promise<number>;
+//# sourceMappingURL=attachedRecords.d.ts.map

package/dist/modules/attachedRecords.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachedRecords.d.ts","sourceRoot":"","sources":["../../src/modules/attachedRecords.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAGnD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAA;AAO1D;;;;;;;;;;GAUG;AAEH,uDAAuD;AACvD,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,SAAS,GAAG,WAAW,GAAG,YAAY,CAAA;AAIpF;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,oBAAoB,EAChC,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oCAAoC,CACxD,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAajB"}

package/dist/modules/attachedRecords.js

@@ -0,0 +1,52 @@
+import { PIPELINE_KINDS } from '@kelpie/schemas';
+import { and, eq } from 'drizzle-orm';
+import * as activityRepository from './activities/repository.js';
+import * as decisionRepository from './decisions/repository.js';
+import { candidates } from './hiring/schema.js';
+import * as noteRepository from './notes/repository.js';
+import * as planRepository from './plans/repository.js';
+const PLAN_TARGET_TYPES = new Set(PIPELINE_KINDS);
+/**
+ * @param db Must be the caller's transaction. Called on its own, this deletes the
+ *   dependents of a record that still exists.
+ * @returns How many rows were removed, for the caller's activity trail.
+ */
+export async function deleteRecordsAttachedTo(db, workspaceId, targetType, targetId) {
+    // Sequential, not concurrent: a transaction is one connection, and four
+    // statements racing down it is not something to rely on for a cheap delete.
+    const notes = await noteRepository.deleteForTarget(db, workspaceId, targetType, targetId);
+    const activities = await activityRepository.deleteForTarget(db, workspaceId, targetType, targetId);
+    const decisions = await decisionRepository.deleteForTarget(db, workspaceId, targetType, targetId);
+    const plans = PLAN_TARGET_TYPES.has(targetType)
+        ? await planRepository.deleteForTarget(db, workspaceId, targetType, targetId)
+        : 0;
+    return notes + activities + decisions + plans;
+}
+/**
+ * The same cleanup for the candidacies a person's delete takes with them.
+ *
+ * `candidates.person_id` cascades, so those rows go without any service seeing
+ * them, and the interview notes attached to each would outlive the candidacy
+ * they described. This is the only link in the schema that both dies by cascade
+ * and owns attached records, which is why it is the only one with a helper here.
+ *
+ * Reads the `candidates` *table* rather than the hiring repository: the module
+ * that owns those rows registers after `people`, and `architecture.md` allows a
+ * table read where a repository import would invert the dependency.
+ *
+ * @param db Must be the caller's transaction, so a refused person delete brings
+ *   these rows back with it.
+ * @returns How many attached rows were removed.
+ */
+export async function deleteRecordsAttachedToCandidaciesOf(db, workspaceId, personId) {
+    const held = await db
+        .select({ id: candidates.id })
+        .from(candidates)
+        .where(and(eq(candidates.workspaceId, workspaceId), eq(candidates.personId, personId)));
+    let removed = 0;
+    for (const candidacy of held) {
+        removed += await deleteRecordsAttachedTo(db, workspaceId, 'candidate', candidacy.id);
+    }
+    return removed;
+}
+//# sourceMappingURL=attachedRecords.js.map

package/dist/modules/attachedRecords.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attachedRecords.js","sourceRoot":"","sources":["../../src/modules/attachedRecords.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAEhD,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAGrC,OAAO,KAAK,kBAAkB,MAAM,4BAA4B,CAAA;AAChE,OAAO,KAAK,kBAAkB,MAAM,2BAA2B,CAAA;AAC/D,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAA;AAC/C,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAA;AACvD,OAAO,KAAK,cAAc,MAAM,uBAAuB,CAAA;AAiBvD,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAAC,cAAc,CAAC,CAAA;AAEtE;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,EAAa,EACb,WAAmB,EACnB,UAAgC,EAChC,QAAgB;IAEhB,wEAAwE;IACxE,4EAA4E;IAC5E,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACzF,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IAClG,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAA;IACjG,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,UAAU,CAAC;QAC7C,CAAC,CAAC,MAAM,cAAc,CAAC,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC;QAC7E,CAAC,CAAC,CAAC,CAAA;IAEL,OAAO,KAAK,GAAG,UAAU,GAAG,SAAS,GAAG,KAAK,CAAA;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oCAAoC,CACxD,EAAa,EACb,WAAmB,EACnB,QAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,EAAE;SAClB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC;SAC7B,IAAI,CAAC,UAAU,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAA;IAEzF,IAAI,OAAO,GAAG,CAAC,CAAA;IAEf,KAAK,MAAM,SAAS,IAAI,IAAI,EAAE,CAAC;QAC7B,OAAO,IAAI,MAAM,uBAAuB,CAAC,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,CAAC,CAAA;IACtF,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC"}

package/dist/modules/auth/actor.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The actor a module reads its caller through.
+ *
+ * The definitions moved to `lib/actor.ts` so the module runtime can name the type
+ * without importing a feature module: an MCP tool is handed its caller exactly as
+ * a route handler is (`runtime/module.ts`). Auth remains where an actor is
+ * resolved from credentials, which is why modules still import it from here.
+ */
+export { actorMemberId, actorUserId, actorWorkspaceId, requireSessionActor, requireWorkspaceId, } from '../../lib/actor.ts';
+export type { Actor, ApiKeyActor, SessionActor } from '../../lib/actor.ts';
+//# sourceMappingURL=actor.d.ts.map

package/dist/modules/auth/actor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/actor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAA;AAC3B,YAAY,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA"}

package/dist/modules/auth/actor.js

@@ -0,0 +1,10 @@
+/**
+ * The actor a module reads its caller through.
+ *
+ * The definitions moved to `lib/actor.ts` so the module runtime can name the type
+ * without importing a feature module: an MCP tool is handed its caller exactly as
+ * a route handler is (`runtime/module.ts`). Auth remains where an actor is
+ * resolved from credentials, which is why modules still import it from here.
+ */
+export { actorMemberId, actorUserId, actorWorkspaceId, requireSessionActor, requireWorkspaceId, } from '../../lib/actor.js';
+//# sourceMappingURL=actor.js.map

package/dist/modules/auth/actor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"actor.js","sourceRoot":"","sources":["../../../src/modules/auth/actor.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EACL,aAAa,EACb,WAAW,EACX,gBAAgB,EAChB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,oBAAoB,CAAA"}

package/dist/modules/auth/credentials.d.ts

@@ -0,0 +1,18 @@
+import type { Context } from 'hono';
+import type { Database } from '../../lib/database.ts';
+import type { Actor } from './actor.ts';
+export interface CredentialDependencies {
+    readonly db: Database;
+    readonly now: () => Date;
+}
+/**
+ * @throws AppError 401 when no credential is present, or the one presented is
+ *   unknown or expired.
+ */
+export declare function resolveActor(dependencies: CredentialDependencies, credentials: {
+    readonly bearer?: string | undefined;
+    readonly cookie?: string | undefined;
+}): Promise<Actor>;
+/** Reads both credential carriers off a request. */
+export declare function resolveActorFrom(dependencies: CredentialDependencies, context: Context): Promise<Actor>;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/modules/auth/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/credentials.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAEnC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAOrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AAuBvC,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;CACzB;AAwFD;;;GAGG;AACH,wBAAsB,YAAY,CAChC,YAAY,EAAE,sBAAsB,EACpC,WAAW,EAAE;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,GAC1F,OAAO,CAAC,KAAK,CAAC,CAUhB;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,sBAAsB,EACpC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,KAAK,CAAC,CAKhB"}

package/dist/modules/auth/credentials.js

@@ -0,0 +1,105 @@
+import { getCookie } from 'hono/cookie';
+import { AppError } from '../../lib/errors.js';
+import { hashToken } from '../../lib/tokens.js';
+import * as apiKeyRepository from '../api-keys/repository.js';
+import { readBearerToken } from '../api-keys/keys.js';
+import { parseMemberRole } from '../workspace/roles.js';
+import * as repository from './repository.js';
+import { SESSION_COOKIE } from './session.js';
+/**
+ * Turns credentials into an `Actor`. Two kinds are accepted, and `api.md` says
+ * they must behave identically once resolved: same endpoints, same shapes, same
+ * errors.
+ *
+ * A bearer key wins over a cookie. A client sending both is being explicit about
+ * which identity it wants.
+ */
+/**
+ * A workspace key acts with admin authority. It is created by an admin and
+ * belongs to the workspace rather than a person, so there is no member row to
+ * read a role from. Owner-only actions stay out of reach.
+ */
+const WORKSPACE_KEY_ROLE = 'admin';
+/** Writing `last_used_at` on every request would double the write load for no gain. */
+const LAST_USED_RESOLUTION_MS = 60_000;
+function roleFromMembership(role) {
+    const parsed = parseMemberRole(role);
+    if (parsed === undefined) {
+        throw new Error(`workspace_members.role holds "${role}", which its check constraint forbids`);
+    }
+    return parsed;
+}
+async function resolveSessionActor(dependencies, token) {
+    const session = await repository.findLiveSessionByTokenHash(dependencies.db, hashToken(token), dependencies.now());
+    if (session === undefined) {
+        throw AppError.unauthorized('Your session has expired');
+    }
+    const membership = session.activeWorkspaceId === null
+        ? undefined
+        : await repository.findMembership(dependencies.db, session.activeWorkspaceId, session.userId);
+    // A workspace the user has been removed from resolves to no workspace rather
+    // than an error: losing one must not lock the account out of the product.
+    return {
+        kind: 'session',
+        userId: session.userId,
+        sessionId: session.id,
+        workspaceId: membership?.workspaceId ?? null,
+        role: membership === undefined ? null : roleFromMembership(membership.role),
+        memberId: membership?.id ?? null,
+    };
+}
+async function resolveApiKeyActor(dependencies, secret) {
+    const record = await apiKeyRepository.findBySecretHash(dependencies.db, hashToken(secret));
+    if (record === undefined) {
+        throw AppError.unauthorized('That API key is not valid');
+    }
+    const now = dependencies.now();
+    if (record.lastUsedAt === null || now.getTime() - record.lastUsedAt.getTime() > LAST_USED_RESOLUTION_MS) {
+        await apiKeyRepository.touchLastUsed(dependencies.db, record.id, now);
+    }
+    if (record.userId === null) {
+        return {
+            kind: 'api_key',
+            apiKeyId: record.id,
+            userId: null,
+            workspaceId: record.workspaceId,
+            role: WORKSPACE_KEY_ROLE,
+            memberId: null,
+        };
+    }
+    const membership = await repository.findMembership(dependencies.db, record.workspaceId, record.userId);
+    // A personal key acts as its user. If they are no longer a member, it acts as
+    // nobody, so the key stops working rather than keeping stale access.
+    if (membership === undefined) {
+        throw AppError.unauthorized('That API key is not valid');
+    }
+    return {
+        kind: 'api_key',
+        apiKeyId: record.id,
+        userId: record.userId,
+        workspaceId: record.workspaceId,
+        role: roleFromMembership(membership.role),
+        memberId: membership.id,
+    };
+}
+/**
+ * @throws AppError 401 when no credential is present, or the one presented is
+ *   unknown or expired.
+ */
+export async function resolveActor(dependencies, credentials) {
+    if (credentials.bearer !== undefined && credentials.bearer.length > 0) {
+        return resolveApiKeyActor(dependencies, credentials.bearer);
+    }
+    if (credentials.cookie !== undefined && credentials.cookie.length > 0) {
+        return resolveSessionActor(dependencies, credentials.cookie);
+    }
+    throw AppError.unauthorized('Sign in or present an API key to continue');
+}
+/** Reads both credential carriers off a request. */
+export function resolveActorFrom(dependencies, context) {
+    return resolveActor(dependencies, {
+        bearer: readBearerToken(context.req.header('Authorization')),
+        cookie: getCookie(context, SESSION_COOKIE),
+    });
+}
+//# sourceMappingURL=credentials.js.map

package/dist/modules/auth/credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../../src/modules/auth/credentials.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAIvC,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAA;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAA;AAC/C,OAAO,KAAK,gBAAgB,MAAM,2BAA2B,CAAA;AAC7D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAA;AACrD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAGvD,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAA;AAE7C;;;;;;;GAOG;AAEH;;;;GAIG;AACH,MAAM,kBAAkB,GAAe,OAAO,CAAA;AAE9C,uFAAuF;AACvF,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAOtC,SAAS,kBAAkB,CAAC,IAAY;IACtC,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,CAAA;IAEpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,uCAAuC,CAAC,CAAA;IAC/F,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,YAAoC,EACpC,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,0BAA0B,CACzD,YAAY,CAAC,EAAE,EACf,SAAS,CAAC,KAAK,CAAC,EAChB,YAAY,CAAC,GAAG,EAAE,CACnB,CAAA;IAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,CAAC,YAAY,CAAC,0BAA0B,CAAC,CAAA;IACzD,CAAC;IAED,MAAM,UAAU,GACd,OAAO,CAAC,iBAAiB,KAAK,IAAI;QAChC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAEjG,6EAA6E;IAC7E,0EAA0E;IAC1E,OAAO;QACL,IAAI,EAAE,SAAS;QACf,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,WAAW,EAAE,UAAU,EAAE,WAAW,IAAI,IAAI;QAC5C,IAAI,EAAE,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3E,QAAQ,EAAE,UAAU,EAAE,EAAE,IAAI,IAAI;KACjC,CAAA;AACH,CAAC;AAED,KAAK,UAAU,kBAAkB,CAC/B,YAAoC,EACpC,MAAc;IAEd,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAA;IAE1F,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,QAAQ,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAA;IAC1D,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,EAAE,CAAA;IAE9B,IAAI,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,GAAG,CAAC,OAAO,EAAE,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,GAAG,uBAAuB,EAAE,CAAC;QACxG,MAAM,gBAAgB,CAAC,aAAa,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,CAAA;IACvE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,QAAQ,EAAE,MAAM,CAAC,EAAE;YACnB,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,IAAI;SACf,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,cAAc,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IAEtG,8EAA8E;IAC9E,qEAAqE;IACrE,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,QAAQ,CAAC,YAAY,CAAC,2BAA2B,CAAC,CAAA;IAC1D,CAAC;IAED,OAAO;QACL,IAAI,EAAE,SAAS;QACf,QAAQ,EAAE,MAAM,CAAC,EAAE;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,IAAI,EAAE,kBAAkB,CAAC,UAAU,CAAC,IAAI,CAAC;QACzC,QAAQ,EAAE,UAAU,CAAC,EAAE;KACxB,CAAA;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,YAAoC,EACpC,WAA2F;IAE3F,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC7D,CAAC;IAED,IAAI,WAAW,CAAC,MAAM,KAAK,SAAS,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtE,OAAO,mBAAmB,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,CAAC,CAAA;IAC9D,CAAC;IAED,MAAM,QAAQ,CAAC,YAAY,CAAC,2CAA2C,CAAC,CAAA;AAC1E,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAC9B,YAAoC,EACpC,OAAgB;IAEhB,OAAO,YAAY,CAAC,YAAY,EAAE;QAChC,MAAM,EAAE,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC5D,MAAM,EAAE,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC;KAC3C,CAAC,CAAA;AACJ,CAAC"}

package/dist/modules/auth/index.d.ts

@@ -0,0 +1,3 @@
+import type { KelpieModule } from '../../runtime/module.ts';
+export declare function createAuthModule(migrationsDirectory: string): KelpieModule;
+//# sourceMappingURL=index.d.ts.map

package/dist/modules/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAiB3D,wBAAgB,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CA6B1E"}