@kelpie/server 0.4.0 → 0.5.0

package/dist/lib/email.d.ts

@@ -5,9 +5,15 @@ import type { Logger } from './logger.ts';
  * and account-change notifications, nothing else. Kelpie never sends outreach
  * email.
  *
- * Roadmap decision 4: the provider is configured, never hardcoded. Core ships the
- * port and the `log` provider. Real providers ship as modules, so the open-source
- * assembly has no vendor account baked into it.
+ * Roadmap decision 4: the provider is configured, never hardcoded. Core ships
+ * the port and two providers, `log` and `smtp`. Both need no vendor account a
+ * deployment doesn't already have, which is what keeps them in core rather than
+ * a module, per `modules.md`'s split test. A provider that does need one
+ * (Resend, Postmark, Mailtrap, SendGrid) is a commercial integration under that
+ * same test and belongs in a module: it supplies its own `EmailSender` from its
+ * own config, and an assembly's entry point wires it into `services.email` in
+ * place of `createEmailSender`, the same way `kelpie-cloud/src/server.ts` wires
+ * this one today.
  */
 export interface EmailMessage {
     readonly to: string;
@@ -17,13 +23,35 @@ export interface EmailMessage {
 export interface EmailSender {
     send(message: EmailMessage): Promise<void>;
 }
-export declare const emailConfigSchema: z.ZodObject<{
-    EMAIL_PROVIDER: z.ZodEnum<{
-        log: "log";
-    }>;
+declare const smtpEmailConfigSchema: z.ZodObject<{
+    EMAIL_PROVIDER: z.ZodLiteral<"smtp">;
     EMAIL_FROM: z.ZodString;
+    SMTP_HOST: z.ZodString;
+    SMTP_PORT: z.ZodCoercedNumber<unknown>;
+    SMTP_SECURE: z.ZodPipe<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>;
+    SMTP_USER: z.ZodString;
+    SMTP_PASSWORD: z.ZodString;
 }, z.core.$strip>;
+export declare const emailConfigSchema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    EMAIL_PROVIDER: z.ZodLiteral<"log">;
+    EMAIL_FROM: z.ZodString;
+}, z.core.$strip>, z.ZodObject<{
+    EMAIL_PROVIDER: z.ZodLiteral<"smtp">;
+    EMAIL_FROM: z.ZodString;
+    SMTP_HOST: z.ZodString;
+    SMTP_PORT: z.ZodCoercedNumber<unknown>;
+    SMTP_SECURE: z.ZodPipe<z.ZodEnum<{
+        false: "false";
+        true: "true";
+    }>, z.ZodTransform<boolean, "false" | "true">>;
+    SMTP_USER: z.ZodString;
+    SMTP_PASSWORD: z.ZodString;
+}, z.core.$strip>], "EMAIL_PROVIDER">;
 export type EmailConfig = z.infer<typeof emailConfigSchema>;
+export type SmtpEmailConfig = z.infer<typeof smtpEmailConfigSchema>;
 /**
  * Writes the message to the log instead of sending it. For self-hosted
  * development, where the reset link in the log is exactly what you want.
@@ -32,11 +60,27 @@ export type EmailConfig = z.infer<typeof emailConfigSchema>;
  * so nobody reaches this provider without naming it.
  */
 export declare function createLogEmailSender(logger: Logger, from: string): EmailSender;
+/**
+ * What `createSmtpEmailSender` sends a message through. A real deployment gets
+ * one backed by `nodemailer`; a test injects one that records calls, so the
+ * sender is verifiable without a container running a real SMTP conversation.
+ */
+export interface SmtpTransport {
+    sendMail(message: {
+        from: string;
+        to: string;
+        subject: string;
+        text: string;
+    }): Promise<unknown>;
+}
+/** Sends over SMTP. `transport` defaults to a real connection built from `config`. */
+export declare function createSmtpEmailSender(config: SmtpEmailConfig, logger: Logger, transport?: SmtpTransport): EmailSender;
 /**
  * Builds the configured sender.
  *
- * @throws Never. An unknown provider cannot reach here: the config schema is an
- *   enum, so boot rejects it first.
+ * @throws Never. An unknown provider cannot reach here: the config schema is a
+ *   discriminated union, so boot rejects it first.
  */
 export declare function createEmailSender(config: EmailConfig, logger: Logger): EmailSender;
+export {};
 //# sourceMappingURL=email.d.ts.map

package/dist/lib/email.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC;;;;;;;;GAQG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAED,eAAO,MAAM,iBAAiB;;;;;iBAG5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAE3D;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAa9E;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAKlF"}
+{"version":3,"file":"email.d.ts","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAA;AAEzC;;;;;;;;;;;;;;GAcG;AAEH,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CAC3C;AAOD,QAAA,MAAM,qBAAqB;;;;;;;;;;;iBAQzB,CAAA;AAEF,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;qCAG5B,CAAA;AAEF,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAA;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAA;AAEnE;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,WAAW,CAa9E;AAED;;;;GAIG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;CACjG;AAWD,sFAAsF;AACtF,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,eAAe,EACvB,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,aAAiD,GAC3D,WAAW,CAiBb;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,GAAG,WAAW,CAOlF"}

package/dist/lib/email.js

@@ -1,8 +1,23 @@
+import nodemailer from 'nodemailer';
 import { z } from 'zod';
-export const emailConfigSchema = z.object({
-    EMAIL_PROVIDER: z.enum(['log']),
+import { describeThrown } from './errors.js';
+const logEmailConfigSchema = z.object({
+    EMAIL_PROVIDER: z.literal('log'),
     EMAIL_FROM: z.string().min(1),
 });
+const smtpEmailConfigSchema = z.object({
+    EMAIL_PROVIDER: z.literal('smtp'),
+    EMAIL_FROM: z.string().min(1),
+    SMTP_HOST: z.string().min(1),
+    SMTP_PORT: z.coerce.number().int().positive().max(65535),
+    SMTP_SECURE: z.enum(['true', 'false']).transform((value) => value === 'true'),
+    SMTP_USER: z.string().min(1),
+    SMTP_PASSWORD: z.string().min(1),
+});
+export const emailConfigSchema = z.discriminatedUnion('EMAIL_PROVIDER', [
+    logEmailConfigSchema,
+    smtpEmailConfigSchema,
+]);
 /**
  * Writes the message to the log instead of sending it. For self-hosted
  * development, where the reset link in the log is exactly what you want.
@@ -23,16 +38,46 @@ export function createLogEmailSender(logger, from) {
         },
     };
 }
+function createNodemailerTransport(config) {
+    return nodemailer.createTransport({
+        host: config.SMTP_HOST,
+        port: config.SMTP_PORT,
+        secure: config.SMTP_SECURE,
+        auth: { user: config.SMTP_USER, pass: config.SMTP_PASSWORD },
+    });
+}
+/** Sends over SMTP. `transport` defaults to a real connection built from `config`. */
+export function createSmtpEmailSender(config, logger, transport = createNodemailerTransport(config)) {
+    return {
+        async send(message) {
+            try {
+                await transport.sendMail({
+                    from: config.EMAIL_FROM,
+                    to: message.to,
+                    subject: message.subject,
+                    text: message.body,
+                });
+            }
+            catch (cause) {
+                const reason = describeThrown(cause);
+                logger.error('smtp send failed', { to: message.to, reason });
+                throw new Error(`Failed to send email to ${message.to} over SMTP: ${reason}`, { cause });
+            }
+        },
+    };
+}
 /**
  * Builds the configured sender.
  *
- * @throws Never. An unknown provider cannot reach here: the config schema is an
- *   enum, so boot rejects it first.
+ * @throws Never. An unknown provider cannot reach here: the config schema is a
+ *   discriminated union, so boot rejects it first.
  */
 export function createEmailSender(config, logger) {
     switch (config.EMAIL_PROVIDER) {
         case 'log':
             return createLogEmailSender(logger, config.EMAIL_FROM);
+        case 'smtp':
+            return createSmtpEmailSender(config, logger);
     }
 }
 //# sourceMappingURL=email.js.map

package/dist/lib/email.js.map

@@ -1 +1 @@
-{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAwBvB,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;IAC/B,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAA;AAIF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,OAAO;QACL,IAAI,CAAC,OAAO;YACV,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC/C,IAAI;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB,EAAE,MAAc;IACnE,QAAQ,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;IAC1D,CAAC;AACH,CAAC"}
+{"version":3,"file":"email.js","sourceRoot":"","sources":["../../src/lib/email.ts"],"names":[],"mappings":"AAAA,OAAO,UAAU,MAAM,YAAY,CAAA;AACnC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AA6B5C,MAAM,oBAAoB,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IAChC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC9B,CAAC,CAAA;AAEF,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IACjC,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7B,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;IACxD,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,CAAC;IAC7E,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5B,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACjC,CAAC,CAAA;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC,kBAAkB,CAAC,gBAAgB,EAAE;IACtE,oBAAoB;IACpB,qBAAqB;CACtB,CAAC,CAAA;AAKF;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,IAAY;IAC/D,OAAO;QACL,IAAI,CAAC,OAAO;YACV,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAC/C,IAAI;gBACJ,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;aACnB,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC;AAWD,SAAS,yBAAyB,CAAC,MAAuB;IACxD,OAAO,UAAU,CAAC,eAAe,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,IAAI,EAAE,MAAM,CAAC,SAAS;QACtB,MAAM,EAAE,MAAM,CAAC,WAAW;QAC1B,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,EAAE,IAAI,EAAE,MAAM,CAAC,aAAa,EAAE;KAC7D,CAAC,CAAA;AACJ,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,qBAAqB,CACnC,MAAuB,EACvB,MAAc,EACd,SAAS,GAAkB,yBAAyB,CAAC,MAAM,CAAC;IAE5D,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAO;YAChB,IAAI,CAAC;gBACH,MAAM,SAAS,CAAC,QAAQ,CAAC;oBACvB,IAAI,EAAE,MAAM,CAAC,UAAU;oBACvB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,IAAI,EAAE,OAAO,CAAC,IAAI;iBACnB,CAAC,CAAA;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,CAAA;gBACpC,MAAM,CAAC,KAAK,CAAC,kBAAkB,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAA;gBAC5D,MAAM,IAAI,KAAK,CAAC,2BAA2B,OAAO,CAAC,EAAE,eAAe,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,CAAA;YAC1F,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAmB,EAAE,MAAc;IACnE,QAAQ,MAAM,CAAC,cAAc,EAAE,CAAC;QAC9B,KAAK,KAAK;YACR,OAAO,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,CAAA;QACxD,KAAK,MAAM;YACT,OAAO,qBAAqB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChD,CAAC;AACH,CAAC"}

package/dist/lib/ids.d.ts

@@ -7,6 +7,8 @@ export declare const idPrefixes: {
     readonly user: 'usr';
     readonly session: 'ses';
     readonly passwordResetToken: 'pwr';
+    /** Never returned over the wire either, for the same reason as `passwordResetToken`. */
+    readonly emailVerificationToken: 'evt';
     readonly teamMember: 'mem';
     readonly invite: 'inv';
     readonly apiKey: 'key';

package/dist/lib/ids.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,UAAU;aACrB,SAAS,EAAE,IAAI;aACf,IAAI,EAAE,KAAK;aACX,OAAO,EAAE,KAAK;aACd,kBAAkB,EAAE,KAAK;aACzB,UAAU,EAAE,KAAK;aACjB,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,OAAO,EAAE,KAAK;aACd,QAAQ,EAAE,KAAK;aACf,aAAa,EAAE,OAAO;aACtB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,KAAK;aAClB,WAAW,EAAE,KAAK;aAClB,KAAK,EAAE,KAAK;aACZ,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,KAAK;aACf,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,KAAK;aACf,YAAY,EAAE,IAAI;aAClB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,IAAI;aACf,cAAc,EAAE,KAAK;aACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;aAC9E,eAAe,EAAE,KAAK;aACtB,iBAAiB,EAAE,IAAI;aACvB,QAAQ,EAAE,KAAK;aACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;aAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;aACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;aACH,eAAe,EAAE,IAAI;CACb,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,UAAU,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,GAAE,MAAM,MAAa,GAAG,SAAS,CAE5E"}
+{"version":3,"file":"ids.d.ts","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,UAAU;aACrB,SAAS,EAAE,IAAI;aACf,IAAI,EAAE,KAAK;aACX,OAAO,EAAE,KAAK;aACd,kBAAkB,EAAE,KAAK;IACzB,wFAAwF;aACxF,sBAAsB,EAAE,KAAK;aAC7B,UAAU,EAAE,KAAK;aACjB,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,MAAM,EAAE,KAAK;aACb,OAAO,EAAE,KAAK;aACd,QAAQ,EAAE,KAAK;aACf,aAAa,EAAE,OAAO;aACtB,IAAI,EAAE,MAAM;aACZ,WAAW,EAAE,KAAK;aAClB,WAAW,EAAE,KAAK;aAClB,KAAK,EAAE,KAAK;aACZ,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,MAAM;aACjB,QAAQ,EAAE,MAAM;aAChB,QAAQ,EAAE,KAAK;aACf,IAAI,EAAE,MAAM;aACZ,QAAQ,EAAE,KAAK;aACf,YAAY,EAAE,IAAI;aAClB,IAAI,EAAE,MAAM;aACZ,SAAS,EAAE,IAAI;aACf,cAAc,EAAE,KAAK;aACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;aAC9E,eAAe,EAAE,KAAK;aACtB,iBAAiB,EAAE,IAAI;aACvB,QAAQ,EAAE,KAAK;aACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;aAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;aACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;aACH,eAAe,EAAE,IAAI;CACb,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,MAAM,OAAO,UAAU,CAAA;AAEhD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,CAAA;AAEpD;;;GAGG;AACH,wBAAgB,eAAe,CAAC,YAAY,GAAE,MAAM,MAAa,GAAG,SAAS,CAE5E"}

package/dist/lib/ids.js

@@ -8,6 +8,8 @@ export const idPrefixes = {
     user: 'usr',
     session: 'ses',
     passwordResetToken: 'pwr',
+    /** Never returned over the wire either, for the same reason as `passwordResetToken`. */
+    emailVerificationToken: 'evt',
     teamMember: 'mem',
     invite: 'inv',
     apiKey: 'key',

package/dist/lib/ids.js.map

@@ -1 +1 @@
-{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,kBAAkB,EAAE,KAAK;IACzB,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,OAAO;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;IAC9E,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;IAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;IACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;IACH,eAAe,EAAE,IAAI;CACb,CAAA;AAMV;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,YAAY,GAAiB,IAAI;IAC/D,OAAO,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,CAAA;AAC9E,CAAC"}
+{"version":3,"file":"ids.js","sourceRoot":"","sources":["../../src/lib/ids.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAE3B;;;GAGG;AACH,MAAM,CAAC,MAAM,UAAU,GAAG;IACxB,SAAS,EAAE,IAAI;IACf,IAAI,EAAE,KAAK;IACX,OAAO,EAAE,KAAK;IACd,kBAAkB,EAAE,KAAK;IACzB,wFAAwF;IACxF,sBAAsB,EAAE,KAAK;IAC7B,UAAU,EAAE,KAAK;IACjB,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,MAAM,EAAE,KAAK;IACb,OAAO,EAAE,KAAK;IACd,QAAQ,EAAE,KAAK;IACf,aAAa,EAAE,OAAO;IACtB,IAAI,EAAE,MAAM;IACZ,WAAW,EAAE,KAAK;IAClB,WAAW,EAAE,KAAK;IAClB,KAAK,EAAE,KAAK;IACZ,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,MAAM;IACjB,QAAQ,EAAE,MAAM;IAChB,QAAQ,EAAE,KAAK;IACf,IAAI,EAAE,MAAM;IACZ,QAAQ,EAAE,KAAK;IACf,YAAY,EAAE,IAAI;IAClB,IAAI,EAAE,MAAM;IACZ,SAAS,EAAE,IAAI;IACf,cAAc,EAAE,KAAK;IACrB,OAAO,EAAE,IAAI;IACb,8EAA8E;IAC9E,eAAe,EAAE,KAAK;IACtB,iBAAiB,EAAE,IAAI;IACvB,QAAQ,EAAE,KAAK;IACf,SAAS,EAAE,KAAK;IAChB,6FAA6F;IAC7F,aAAa,EAAE,MAAM;IACrB;;;;;OAKG;IACH,cAAc,EAAE,MAAM;IACtB;;;OAGG;IACH,eAAe,EAAE,IAAI;CACb,CAAA;AAMV;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,YAAY,GAAiB,IAAI;IAC/D,OAAO,CAAC,IAAgB,EAAU,EAAE,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,CAAA;AAC9E,CAAC"}

package/dist/lib/rateLimit.d.ts

@@ -1,9 +1,9 @@
 import { z } from 'zod';
 /**
- * Budgets for the three request classes `api.md` rate-limits: public form
- * submissions, unauthenticated auth endpoints, and everything else under an
- * API key. Roadmap Phase 6: self-host packaging calls for this with nothing to
- * configure, so every variable here is optional and defaulted.
+ * Budgets for the request classes `api.md` rate-limits: public form submissions,
+ * unauthenticated auth endpoints by IP, login by account, and everything else
+ * under an API key. Roadmap Phase 6: self-host packaging calls for this with
+ * nothing to configure, so every variable here is optional and defaulted.
  */
 export interface RateLimitBudget {
     readonly limit: number;
@@ -12,6 +12,12 @@ export interface RateLimitBudget {
 export interface RateLimitConfig {
     readonly forms: RateLimitBudget;
     readonly auth: RateLimitBudget;
+    /**
+     * Login attempts for one email address, whatever IP they come from. The `auth`
+     * budget alone caps one IP, so a botnet spread across many addresses could
+     * still grind one account. This is the per-account half of that defence.
+     */
+    readonly loginAccount: RateLimitBudget;
     readonly api: RateLimitBudget;
 }
 export declare const rateLimitConfigSchema: z.ZodObject<{
@@ -19,6 +25,8 @@ export declare const rateLimitConfigSchema: z.ZodObject<{
     RATE_LIMIT_FORMS_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_AUTH_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_AUTH_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_LOGIN_ACCOUNT_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    RATE_LIMIT_LOGIN_ACCOUNT_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_API_LIMIT: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
     RATE_LIMIT_API_WINDOW_SECONDS: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
 }, z.core.$strip>;

package/dist/lib/rateLimit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;iBAOhC,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,eAAe,CAelG"}
+{"version":3,"file":"rateLimit.d.ts","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB;;;;;GAKG;AAEH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,eAAe,CAAA;IACtC,QAAQ,CAAC,GAAG,EAAE,eAAe,CAAA;CAC9B;AAED,eAAO,MAAM,qBAAqB;;;;;;;;;iBAShC,CAAA;AAEF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,GAAG,eAAe,CAmBlG"}

package/dist/lib/rateLimit.js

@@ -4,6 +4,8 @@ export const rateLimitConfigSchema = z.object({
     RATE_LIMIT_FORMS_WINDOW_SECONDS: z.coerce.number().int().positive().default(60),
     RATE_LIMIT_AUTH_LIMIT: z.coerce.number().int().positive().default(10),
     RATE_LIMIT_AUTH_WINDOW_SECONDS: z.coerce.number().int().positive().default(60),
+    RATE_LIMIT_LOGIN_ACCOUNT_LIMIT: z.coerce.number().int().positive().default(10),
+    RATE_LIMIT_LOGIN_ACCOUNT_WINDOW_SECONDS: z.coerce.number().int().positive().default(900),
     RATE_LIMIT_API_LIMIT: z.coerce.number().int().positive().default(600),
     RATE_LIMIT_API_WINDOW_SECONDS: z.coerce.number().int().positive().default(60),
 });
@@ -17,6 +19,10 @@ export function rateLimitConfigFrom(parsed) {
             limit: parsed.RATE_LIMIT_AUTH_LIMIT,
             windowMs: parsed.RATE_LIMIT_AUTH_WINDOW_SECONDS * 1000,
         },
+        loginAccount: {
+            limit: parsed.RATE_LIMIT_LOGIN_ACCOUNT_LIMIT,
+            windowMs: parsed.RATE_LIMIT_LOGIN_ACCOUNT_WINDOW_SECONDS * 1000,
+        },
         api: {
             limit: parsed.RATE_LIMIT_API_LIMIT,
             windowMs: parsed.RATE_LIMIT_API_WINDOW_SECONDS * 1000,

package/dist/lib/rateLimit.js.map

@@ -1 +1 @@
-{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAoBvB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,+BAA+B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACrE,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9E,CAAC,CAAA;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAA6C;IAC/E,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,sBAAsB;YACpC,QAAQ,EAAE,MAAM,CAAC,+BAA+B,GAAG,IAAI;SACxD;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,qBAAqB;YACnC,QAAQ,EAAE,MAAM,CAAC,8BAA8B,GAAG,IAAI;SACvD;QACD,GAAG,EAAE;YACH,KAAK,EAAE,MAAM,CAAC,oBAAoB;YAClC,QAAQ,EAAE,MAAM,CAAC,6BAA6B,GAAG,IAAI;SACtD;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"rateLimit.js","sourceRoot":"","sources":["../../src/lib/rateLimit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AA0BvB,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5C,sBAAsB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACtE,+BAA+B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC/E,qBAAqB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IACrE,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,8BAA8B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,uCAAuC,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACxF,oBAAoB,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;IACrE,6BAA6B,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAC9E,CAAC,CAAA;AAEF,MAAM,UAAU,mBAAmB,CAAC,MAA6C;IAC/E,OAAO;QACL,KAAK,EAAE;YACL,KAAK,EAAE,MAAM,CAAC,sBAAsB;YACpC,QAAQ,EAAE,MAAM,CAAC,+BAA+B,GAAG,IAAI;SACxD;QACD,IAAI,EAAE;YACJ,KAAK,EAAE,MAAM,CAAC,qBAAqB;YACnC,QAAQ,EAAE,MAAM,CAAC,8BAA8B,GAAG,IAAI;SACvD;QACD,YAAY,EAAE;YACZ,KAAK,EAAE,MAAM,CAAC,8BAA8B;YAC5C,QAAQ,EAAE,MAAM,CAAC,uCAAuC,GAAG,IAAI;SAChE;QACD,GAAG,EAAE;YACH,KAAK,EAAE,MAAM,CAAC,oBAAoB;YAClC,QAAQ,EAAE,MAAM,CAAC,6BAA6B,GAAG,IAAI;SACtD;KACF,CAAA;AACH,CAAC"}

package/dist/modules/agent-tasks/dispatch.d.ts

@@ -1,4 +1,5 @@
 import type { Database } from '../../lib/database.ts';
+import type { EgressGuard } from '../../lib/egress.ts';
 import type { Logger } from '../../lib/logger.ts';
 import type { SecretCipher } from '../../lib/secrets.ts';
 import type { AgentRecord, RunRecord } from './repository.ts';
@@ -39,9 +40,10 @@ export type SendDispatch = (request: DispatchRequest) => Promise<DispatchOutcome
  * The catch is broad because this is the process boundary: `fetch` rejects
  * with anything from a DNS failure to an abort, and turning all of it into one
  * outcome is the port's whole job. Nothing is swallowed — the reason lands on
- * the run.
+ * the run. A blocked private address (`egress.check`) reaches the same catch
+ * and lands on the run the same way.
  */
-export declare function createHttpSender(fetchImplementation?: typeof fetch): SendDispatch;
+export declare function createHttpSender(egress: EgressGuard, fetchImplementation?: typeof fetch): SendDispatch;
 export interface DispatchDependencies {
     readonly db: Database;
     readonly now: () => Date;

package/dist/modules/agent-tasks/dispatch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAEjD;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAEjF;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,mBAAmB,GAAE,OAAO,KAAa,GAAG,YAAY,CAsBxF;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,GAAG,cAAc,CA6FvF"}
+{"version":3,"file":"dispatch.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/dispatch.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAA;AAEtD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAA;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAA;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAA;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAA;AAEjD;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,eAAO,MAAM,mBAAmB,QAAS,CAAA;AAEzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACnD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAA;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,uDAAuD;IACvD,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,mEAAmE;AACnE,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,EAAE,eAAe,KAAK,OAAO,CAAC,eAAe,CAAC,CAAA;AAEjF;;;;;;;;;;GAUG;AACH,wBAAgB,gBAAgB,CAC9B,MAAM,EAAE,WAAW,EACnB,mBAAmB,GAAE,OAAO,KAAa,GACxC,YAAY,CAwBd;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAA;IACrB,QAAQ,CAAC,GAAG,EAAE,MAAM,IAAI,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxF;AAED,wBAAgB,oBAAoB,CAAC,YAAY,EAAE,oBAAoB,GAAG,cAAc,CA6FvF"}

package/dist/modules/agent-tasks/dispatch.js

@@ -24,11 +24,13 @@ export const DISPATCH_TIMEOUT_MS = 10_000;
  * The catch is broad because this is the process boundary: `fetch` rejects
  * with anything from a DNS failure to an abort, and turning all of it into one
  * outcome is the port's whole job. Nothing is swallowed — the reason lands on
- * the run.
+ * the run. A blocked private address (`egress.check`) reaches the same catch
+ * and lands on the run the same way.
  */
-export function createHttpSender(fetchImplementation = fetch) {
+export function createHttpSender(egress, fetchImplementation = fetch) {
     return async (request) => {
         try {
+            await egress.check(request.url);
             const response = await fetchImplementation(request.url, {
                 method: 'POST',
                 body: request.body,

package/dist/modules/agent-tasks/dispatch.js.map

@@ -1 +1 @@
-{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/dispatch.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAmBzC;;;;;;;;;GASG;AACH,MAAM,UAAU,gBAAgB,CAAC,mBAAmB,GAAiB,KAAK;IACxE,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACjD,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAC,EAAE;gBAChB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC5D,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;iBAC7D,CAAA;QACP,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;QAC1E,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAmBD,MAAM,UAAU,oBAAoB,CAAC,YAAkC;IACrE,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAwB;QAC3D,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE;YACjD,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAClD,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ;YACjC,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;oBAClD,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;iBAC9B,CAAC,CAAA;gBAEF,IAAI,UAA8B,CAAA;gBAElC,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;oBACvC,IAAI,CAAC;wBACH,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;oBAClE,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACxB,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,EAAE,CAAC;4BAC9C,MAAM,KAAK,CAAA;wBACb,CAAC;wBAED,+DAA+D;wBAC/D,mEAAmE;wBACnE,+CAA+C;wBAC/C,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE;4BACjE,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,KAAK,EAAE,GAAG,CAAC,EAAE;4BACb,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;yBAC7B,CAAC,CAAA;wBACF,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;4BACnB,SAAS,EAAE,KAAK;4BAChB,MAAM,EAAE,IAAI;4BACZ,MAAM,EACJ,wGAAwG;yBAC3G,CAAC,CAAA;wBAEF,OAAM;oBACR,CAAC;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;oBACtC,GAAG,EAAE,KAAK,CAAC,QAAQ;oBACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACpD,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;qBACnE;iBACF,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;wBAC7C,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,uEAAuE;gBACvE,qEAAqE;gBACrE,gCAAgC;gBAChC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC9D,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAA;gBAEF,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;wBACnB,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,IAAI;wBACZ,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC;qBAC9B,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,WAAoB,EAAE,CAAC;oBAC9B,mEAAmE;oBACnE,+DAA+D;oBAC/D,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBACvD,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC;qBACnC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"dispatch.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/dispatch.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AAEpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAE5D,OAAO,KAAK,UAAU,MAAM,iBAAiB,CAAA;AAE7C,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAA;AAG3C;;;;;;;;;;;GAWG;AAEH,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAA;AAmBzC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAmB,EACnB,mBAAmB,GAAiB,KAAK;IAEzC,OAAO,KAAK,EAAE,OAAO,EAAE,EAAE;QACvB,IAAI,CAAC;YACH,MAAM,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YAE/B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE;gBACtD,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,OAAO,EAAE,OAAO,CAAC,OAAO;gBACxB,QAAQ,EAAE,QAAQ;gBAClB,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,mBAAmB,CAAC;aACjD,CAAC,CAAA;YAEF,OAAO,QAAQ,CAAC,EAAE;gBAChB,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE;gBAC5D,CAAC,CAAC;oBACE,SAAS,EAAE,KAAK;oBAChB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,MAAM,EAAE,2BAA2B,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE;iBAC7D,CAAA;QACP,CAAC;QAAC,OAAO,KAAc,EAAE,CAAC;YACxB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAA;QAC1E,CAAC;IACH,CAAC,CAAA;AACH,CAAC;AAmBD,MAAM,UAAU,oBAAoB,CAAC,YAAkC;IACrE,KAAK,UAAU,MAAM,CAAC,KAAa,EAAE,OAAwB;QAC3D,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE;YACjD,MAAM,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ;YAClD,aAAa,EAAE,OAAO,CAAC,MAAM;YAC7B,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;SAC9B,CAAC,CAAA;IACJ,CAAC;IAED,OAAO;QACL,KAAK,CAAC,QAAQ,CAAC,GAAG,EAAE,KAAK,EAAE,QAAQ;YACjC,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,SAAS,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE;oBAClD,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,YAAY,CAAC,GAAG,EAAE;iBAC9B,CAAC,CAAA;gBAEF,IAAI,UAA8B,CAAA;gBAElC,IAAI,KAAK,CAAC,mBAAmB,KAAK,IAAI,EAAE,CAAC;oBACvC,IAAI,CAAC;wBACH,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAA;oBAClE,CAAC;oBAAC,OAAO,KAAc,EAAE,CAAC;wBACxB,IAAI,CAAC,CAAC,KAAK,YAAY,qBAAqB,CAAC,EAAE,CAAC;4BAC9C,MAAM,KAAK,CAAA;wBACb,CAAC;wBAED,+DAA+D;wBAC/D,mEAAmE;wBACnE,+CAA+C;wBAC/C,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,0CAA0C,EAAE;4BACjE,OAAO,EAAE,KAAK,CAAC,EAAE;4BACjB,KAAK,EAAE,GAAG,CAAC,EAAE;4BACb,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;yBAC7B,CAAC,CAAA;wBACF,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;4BACnB,SAAS,EAAE,KAAK;4BAChB,MAAM,EAAE,IAAI;4BACZ,MAAM,EACJ,wGAAwG;yBAC3G,CAAC,CAAA;wBAEF,OAAM;oBACR,CAAC;gBACH,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;oBACtC,GAAG,EAAE,KAAK,CAAC,QAAQ;oBACnB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;oBACpD,OAAO,EAAE;wBACP,cAAc,EAAE,kBAAkB;wBAClC,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC;qBACnE;iBACF,CAAC,CAAA;gBAEF,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;oBACvB,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE;wBAC7C,OAAO,EAAE,KAAK,CAAC,EAAE;wBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,MAAM,EAAE,GAAG,CAAC,MAAM;wBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;wBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC,CAAA;gBACJ,CAAC;gBAED,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAA;YAC/B,CAAC;YAAC,OAAO,KAAc,EAAE,CAAC;gBACxB,uEAAuE;gBACvE,qEAAqE;gBACrE,gCAAgC;gBAChC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,EAAE;oBAC9D,OAAO,EAAE,KAAK,CAAC,EAAE;oBACjB,KAAK,EAAE,GAAG,CAAC,EAAE;oBACb,KAAK,EAAE,cAAc,CAAC,KAAK,CAAC;iBAC7B,CAAC,CAAA;gBAEF,IAAI,CAAC;oBACH,MAAM,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE;wBACnB,SAAS,EAAE,KAAK;wBAChB,MAAM,EAAE,IAAI;wBACZ,MAAM,EAAE,cAAc,CAAC,KAAK,CAAC;qBAC9B,CAAC,CAAA;gBACJ,CAAC;gBAAC,OAAO,WAAoB,EAAE,CAAC;oBAC9B,mEAAmE;oBACnE,+DAA+D;oBAC/D,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,gCAAgC,EAAE;wBACvD,KAAK,EAAE,GAAG,CAAC,EAAE;wBACb,KAAK,EAAE,cAAc,CAAC,WAAW,CAAC;qBACnC,CAAC,CAAA;gBACJ,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/agent-tasks/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/index.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAKjD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAC7B;AAED,wBAAgB,sBAAsB,CACpC,mBAAmB,EAAE,MAAM,EAC3B,OAAO,GAAE,uBAA4B,GACpC,YAAY,CAqDd"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/agent-tasks/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAE3D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAKjD;;;;;;;;GAQG;AACH,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAA;CAC7B;AAED,wBAAgB,sBAAsB,CACpC,mBAAmB,EAAE,MAAM,EAC3B,OAAO,GAAE,uBAA4B,GACpC,YAAY,CAsDd"}

package/dist/modules/agent-tasks/index.js

@@ -1,3 +1,4 @@
+import { createEgressGuard, egressConfigSchema } from '../../lib/egress.js';
 import { createSecretCipher, secretEncryptionConfigSchema } from '../../lib/secrets.js';
 import { createDispatchEngine, createHttpSender } from './dispatch.js';
 import { mountAgentTasksRoutes } from './routes.js';
@@ -27,11 +28,12 @@ export function createAgentTasksModule(migrationsDirectory, options = {}) {
             // key means no stored auth header can ever be read back, and finding that
             // out when a dispatch quietly fails is far too late.
             const cipher = createSecretCipher(context.config(secretEncryptionConfigSchema));
+            const egress = createEgressGuard(context.config(egressConfigSchema));
             const engine = createDispatchEngine({
                 db: context.db,
                 now: context.now,
                 cipher,
-                send: options.send ?? createHttpSender(),
+                send: options.send ?? createHttpSender(egress),
                 log: context.log,
             });
             const service = createAgentTasksService({

package/dist/modules/agent-tasks/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEvF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAgBtD,MAAM,UAAU,sBAAsB,CACpC,mBAA2B,EAC3B,OAAO,GAA4B,EAAE;IAErC,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE;YACR,WAAW;YACX,QAAQ;YACR,WAAW;YACX,WAAW;YACX,WAAW;YACX,OAAO;YACP,eAAe;YACf,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,WAAW;YACX,OAAO;YACP,UAAU;SACX;QAED,QAAQ,CAAC,OAAO;YACd,yEAAyE;YACzE,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAA;YAE/E,MAAM,MAAM,GAAG,oBAAoB,CAAC;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB,EAAE;gBACxC,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC;gBACtC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,qBAAqB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC9E,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/agent-tasks/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAC3E,OAAO,EAAE,kBAAkB,EAAE,4BAA4B,EAAE,MAAM,sBAAsB,CAAA;AAEvF,OAAO,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAA;AAEtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAA;AACnD,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,uBAAuB,EAAE,MAAM,cAAc,CAAA;AAgBtD,MAAM,UAAU,sBAAsB,CACpC,mBAA2B,EAC3B,OAAO,GAA4B,EAAE;IAErC,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,QAAQ,EAAE;YACR,WAAW;YACX,QAAQ;YACR,WAAW;YACX,WAAW;YACX,WAAW;YACX,OAAO;YACP,eAAe;YACf,cAAc;YACd,QAAQ;YACR,QAAQ;YACR,OAAO;YACP,WAAW;YACX,OAAO;YACP,UAAU;SACX;QAED,QAAQ,CAAC,OAAO;YACd,yEAAyE;YACzE,0EAA0E;YAC1E,qDAAqD;YACrD,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,4BAA4B,CAAC,CAAC,CAAA;YAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,MAAM,CAAC,kBAAkB,CAAC,CAAC,CAAA;YAEpE,MAAM,MAAM,GAAG,oBAAoB,CAAC;gBAClC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,gBAAgB,CAAC,MAAM,CAAC;gBAC9C,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,MAAM,OAAO,GAAG,uBAAuB,CAAC;gBACtC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,MAAM;gBACN,MAAM;gBACN,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,qBAAqB,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAA;YAC9E,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAiB3D,wBAAgB,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CA6B1E"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAA;AAmB3D,wBAAgB,gBAAgB,CAAC,mBAAmB,EAAE,MAAM,GAAG,YAAY,CAiC1E"}

package/dist/modules/auth/index.js

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { appUrlConfigSchema } from '../../lib/appUrl.js';
 import { mountAuthRoutes } from './routes.js';
 import * as schema from './schema.js';
 import { createAuthService } from './service.js';
@@ -8,10 +9,12 @@ import { createAuthService } from './service.js';
  * Registers before `workspace`, because `workspace_members.user_id` references
  * `users`.
  */
-const authConfigSchema = z.object({
+const authConfigSchema = z
+    .object({
     /** Cookies go out `Secure` everywhere except development. */
     NODE_ENV: z.enum(['development', 'test', 'production']),
-});
+})
+    .merge(appUrlConfigSchema);
 export function createAuthModule(migrationsDirectory) {
     return {
         id: 'auth',
@@ -24,6 +27,7 @@ export function createAuthModule(migrationsDirectory) {
                 email: context.email,
                 createId: context.createId,
                 now: context.now,
+                appBaseUrl: config.APP_BASE_URL,
             });
             context.schema(schema, migrationsDirectory);
             context.routes((router) => {
@@ -31,7 +35,10 @@ export function createAuthModule(migrationsDirectory) {
                     db: context.db,
                     now: context.now,
                     service,
-                    cookie: { secure: config.NODE_ENV === 'production' },
+                    // `Secure` everywhere except development. A test host reaches the API
+                    // over http through a test client, which stores the cookie regardless
+                    // of the flag, so test is not excluded.
+                    cookie: { secure: config.NODE_ENV !== 'development' },
                 });
             });
             return Promise.resolve();

package/dist/modules/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;;GAKG;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC;IAChC,6DAA6D;IAC7D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;CACxD,CAAC,CAAA;AAEF,MAAM,UAAU,gBAAgB,CAAC,mBAA2B;IAC1D,OAAO;QACL,EAAE,EAAE,MAAM;QACV,UAAU,EAAE,IAAI;QAEhB,QAAQ,CAAC,OAAO;YACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,eAAe,CAAC,MAAM,EAAE;oBACtB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO;oBACP,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,YAAY,EAAE;iBACrD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/modules/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAC7C,OAAO,KAAK,MAAM,MAAM,aAAa,CAAA;AACrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD;;;;;GAKG;AAEH,MAAM,gBAAgB,GAAG,CAAC;KACvB,MAAM,CAAC;IACN,6DAA6D;IAC7D,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;CACxD,CAAC;KACD,KAAK,CAAC,kBAAkB,CAAC,CAAA;AAE5B,MAAM,UAAU,gBAAgB,CAAC,mBAA2B;IAC1D,OAAO;QACL,EAAE,EAAE,MAAM;QACV,UAAU,EAAE,IAAI;QAEhB,QAAQ,CAAC,OAAO;YACd,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAA;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC;gBAChC,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,UAAU,EAAE,MAAM,CAAC,YAAY;aAChC,CAAC,CAAA;YAEF,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAA;YAE3C,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE;gBACxB,eAAe,CAAC,MAAM,EAAE;oBACtB,EAAE,EAAE,OAAO,CAAC,EAAE;oBACd,GAAG,EAAE,OAAO,CAAC,GAAG;oBAChB,OAAO;oBACP,sEAAsE;oBACtE,sEAAsE;oBACtE,wCAAwC;oBACxC,MAAM,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,KAAK,aAAa,EAAE;iBACtD,CAAC,CAAA;YACJ,CAAC,CAAC,CAAA;YAEF,OAAO,OAAO,CAAC,OAAO,EAAE,CAAA;QAC1B,CAAC;KACF,CAAA;AACH,CAAC"}

package/dist/modules/auth/repository.d.ts

@@ -1,7 +1,7 @@
 import type { Database } from '../../lib/database.ts';
 import type { Transaction } from '../../runtime/transaction.ts';
 import { workspaceMembers } from '../workspace/schema.ts';
-import { passwordResetTokens, sessions, userPreferences, users } from './schema.ts';
+import { emailVerificationTokens, passwordResetTokens, sessions, userPreferences, users } from './schema.ts';
 /**
  * Drizzle queries for accounts and sessions. No business logic: the service
  * decides, these read and write.
@@ -47,6 +47,18 @@ export declare function insertPasswordResetToken(db: Queryable, values: typeof p
 /** Unused and unexpired. A used or stale token is not a token. */
 export declare function findUsablePasswordResetToken(db: Queryable, tokenHash: string, now: Date): Promise<typeof passwordResetTokens.$inferSelect | undefined>;
 export declare function markPasswordResetTokenUsed(db: Queryable, id: string, now: Date): Promise<void>;
+export declare function insertEmailVerificationToken(db: Queryable, values: typeof emailVerificationTokens.$inferInsert): Promise<void>;
+/** Unused and unexpired. A used or stale token is not a token. */
+export declare function findUsableEmailVerificationToken(db: Queryable, tokenHash: string, now: Date): Promise<typeof emailVerificationTokens.$inferSelect | undefined>;
+export declare function markEmailVerificationTokenUsed(db: Queryable, id: string, now: Date): Promise<void>;
+/**
+ * Sets `email_verified_at` if it is not already set.
+ *
+ * Guarded in the `WHERE` clause rather than read-then-write, so accepting a
+ * second invite or confirming a stale token after the account is already
+ * verified is a no-op instead of overwriting the original verification time.
+ */
+export declare function markEmailVerified(db: Queryable, userId: string, now: Date): Promise<void>;
 /** The membership a session's active workspace resolves to, if any. */
 export declare function findMembership(db: Queryable, workspaceId: string, userId: string): Promise<typeof workspaceMembers.$inferSelect | undefined>;
 /** The workspace a returning user lands in when their session has no active one. */

package/dist/modules/auth/repository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAEnF;;;;;;GAMG;AAEH,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACxD,MAAM,MAAM,qBAAqB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAA;AAEvE,wBAAsB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAIjG;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAQtG;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAQ5C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,eAAe,CAAC,YAAY,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAYhC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,QAAQ,CAAC,YAAY,GACnC,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED,oFAAoF;AACpF,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAQpC;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEjG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrG;AAED,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;AAED,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,mBAAmB,CAAC,YAAY,GAC9C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,kEAAkE;AAClE,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,mBAAmB,CAAC,YAAY,GAAG,SAAS,CAAC,CAc9D;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpG;AAED,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAQ3D;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAS3D"}
+{"version":3,"file":"repository.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAC/D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,EACR,eAAe,EACf,KAAK,EACN,MAAM,aAAa,CAAA;AAEpB;;;;;;GAMG;AAEH,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,WAAW,CAAA;AAE9C,MAAM,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,YAAY,CAAA;AAClD,MAAM,MAAM,aAAa,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAA;AACxD,MAAM,MAAM,qBAAqB,GAAG,OAAO,eAAe,CAAC,YAAY,CAAA;AAEvE,wBAAsB,eAAe,CAAC,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAInG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAIjG;AAED,wBAAsB,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,KAAK,CAAC,YAAY,GAAG,OAAO,CAAC,UAAU,CAAC,CAQtG;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,MAAM,EACpB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,IAAI,CAAC,CAKf;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,OAAO,EAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,EAC5D,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAQjC;AAED,wBAAsB,eAAe,CACnC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAQ5C;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,eAAe,CAAC,YAAY,GAC1C,OAAO,CAAC,qBAAqB,CAAC,CAYhC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,QAAQ,CAAC,YAAY,GACnC,OAAO,CAAC,aAAa,CAAC,CAQxB;AAED,oFAAoF;AACpF,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAQpC;AAED,wBAAsB,mBAAmB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEjG;AAED,wBAAsB,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7F;AAED,wBAAsB,aAAa,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAOrG;AAED,wBAAsB,wBAAwB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE3F;AAED,4EAA4E;AAC5E,wBAAsB,0BAA0B,CAC9C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,wBAAsB,wBAAwB,CAC5C,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,mBAAmB,CAAC,YAAY,GAC9C,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,kEAAkE;AAClE,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,mBAAmB,CAAC,YAAY,GAAG,SAAS,CAAC,CAc9D;AAED,wBAAsB,0BAA0B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKpG;AAED,wBAAsB,4BAA4B,CAChD,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,OAAO,uBAAuB,CAAC,YAAY,GAClD,OAAO,CAAC,IAAI,CAAC,CAEf;AAED,kEAAkE;AAClE,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,SAAS,EACb,SAAS,EAAE,MAAM,EACjB,GAAG,EAAE,IAAI,GACR,OAAO,CAAC,OAAO,uBAAuB,CAAC,YAAY,GAAG,SAAS,CAAC,CAclE;AAED,wBAAsB,8BAA8B,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAKxG;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAK/F;AAED,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,EAAE,EAAE,SAAS,EACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAQ3D;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,SAAS,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,gBAAgB,CAAC,YAAY,GAAG,SAAS,CAAC,CAS3D"}

package/dist/modules/auth/repository.js

@@ -1,6 +1,6 @@
 import { and, desc, eq, gt, isNull, ne } from 'drizzle-orm';
 import { workspaceMembers } from '../workspace/schema.js';
-import { passwordResetTokens, sessions, userPreferences, users } from './schema.js';
+import { emailVerificationTokens, passwordResetTokens, sessions, userPreferences, users, } from './schema.js';
 export async function findUserByEmail(db, email) {
     const [found] = await db.select().from(users).where(eq(users.email, email)).limit(1);
     return found;
@@ -115,6 +115,37 @@ export async function markPasswordResetTokenUsed(db, id, now) {
         .set({ usedAt: now })
         .where(eq(passwordResetTokens.id, id));
 }
+export async function insertEmailVerificationToken(db, values) {
+    await db.insert(emailVerificationTokens).values(values);
+}
+/** Unused and unexpired. A used or stale token is not a token. */
+export async function findUsableEmailVerificationToken(db, tokenHash, now) {
+    const [found] = await db
+        .select()
+        .from(emailVerificationTokens)
+        .where(and(eq(emailVerificationTokens.tokenHash, tokenHash), isNull(emailVerificationTokens.usedAt), gt(emailVerificationTokens.expiresAt, now)))
+        .limit(1);
+    return found;
+}
+export async function markEmailVerificationTokenUsed(db, id, now) {
+    await db
+        .update(emailVerificationTokens)
+        .set({ usedAt: now })
+        .where(eq(emailVerificationTokens.id, id));
+}
+/**
+ * Sets `email_verified_at` if it is not already set.
+ *
+ * Guarded in the `WHERE` clause rather than read-then-write, so accepting a
+ * second invite or confirming a stale token after the account is already
+ * verified is a no-op instead of overwriting the original verification time.
+ */
+export async function markEmailVerified(db, userId, now) {
+    await db
+        .update(users)
+        .set({ emailVerifiedAt: now })
+        .where(and(eq(users.id, userId), isNull(users.emailVerifiedAt)));
+}
 /** The membership a session's active workspace resolves to, if any. */
 export async function findMembership(db, workspaceId, userId) {
     const [found] = await db

package/dist/modules/auth/repository.js.map

@@ -1 +1 @@
-{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAI3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EAAE,mBAAmB,EAAE,QAAQ,EAAE,eAAe,EAAE,KAAK,EAAE,MAAM,aAAa,CAAA;AAiBnF,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,KAAa;IAChE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEpF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,MAAc;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAElF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAa,EAAE,MAAiC;IAC/E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,MAAc,EACd,YAAoB,EACpB,GAAS;IAET,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAAc,EACd,OAA4D,EAC5D,GAAS;IAET,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAA;IAEd,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAA2C;IAE3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SACnE,SAAS,EAAE,CAAA;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAa,EACb,MAAoC;IAEpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAa,EAAE,MAAc;IACrE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,SAAiB,EAAE,GAAS;IAC5E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAa,EAAE,MAAc,EAAE,SAAiB;IAClF,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAa,EAAE,MAAc;IAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,MAAc,EACd,aAAqB;IAErB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,MAA+C;IAE/C,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAClC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAa,EAAE,EAAU,EAAE,GAAS;IACnF,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAa,EACb,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC1C,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC;SAClC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC"}
+{"version":3,"file":"repository.js","sourceRoot":"","sources":["../../../src/modules/auth/repository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAI3D,OAAO,EAAE,gBAAgB,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,QAAQ,EACR,eAAe,EACf,KAAK,GACN,MAAM,aAAa,CAAA;AAiBpB,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,EAAa,EAAE,KAAa;IAChE,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEpF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,MAAc;IAC9D,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAElF,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,EAAa,EAAE,MAAiC;IAC/E,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEnE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,kBAAkB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IAChE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,MAAc,EACd,YAAoB,EACpB,GAAS;IAET,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACrC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAA;AAChC,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAAc,EACd,OAA4D,EAC5D,GAAS;IAET,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE;SACvB,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,GAAG,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC;SACnC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;SAC3B,SAAS,EAAE,CAAA;IAEd,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,eAAe,CAAC;SACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SACzC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,EAAa,EACb,MAA2C;IAE3C,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,eAAe,CAAC;SACvB,MAAM,CAAC,MAAM,CAAC;SACd,kBAAkB,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;SACnE,SAAS,EAAE,CAAA;IAEd,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,6BAA6B,MAAM,CAAC,MAAM,kBAAkB,CAAC,CAAA;IAC/E,CAAC;IAED,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAa,EACb,MAAoC;IAEpC,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAA;IAEtE,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,qBAAqB,MAAM,CAAC,EAAE,kBAAkB,CAAC,CAAA;IACnE,CAAC;IAED,OAAO,OAAO,CAAA;AAChB,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,QAAQ,CAAC;SACd,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;SAC1E,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,EAAa,EAAE,MAAc;IACrE,OAAO,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAA;AAC3G,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,EAAa,EAAE,SAAiB,EAAE,GAAS;IAC5E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACxF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,EAAa,EAAE,MAAc,EAAE,SAAiB;IAClF,MAAM,OAAO,GAAG,MAAM,EAAE;SACrB,MAAM,CAAC,QAAQ,CAAC;SAChB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SACnE,SAAS,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAA;IAEjC,OAAO,OAAO,CAAC,MAAM,CAAA;AACvB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,EAAa,EAAE,MAAc;IAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;AAC9D,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAC9C,EAAa,EACb,MAAc,EACd,aAAqB;IAErB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC,CAAA;AACnG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAa,EACb,SAAiB,EACjB,WAAmB;IAEnB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAA;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,EAAa,EACb,MAA+C;IAE/C,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,mBAAmB,CAAC;SACzB,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,SAAS,CAAC,EAC5C,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAClC,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,GAAG,CAAC,CACvC,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,EAAa,EAAE,EAAU,EAAE,GAAS;IACnF,MAAM,EAAE;SACL,MAAM,CAAC,mBAAmB,CAAC;SAC3B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,EAAa,EACb,MAAmD;IAEnD,MAAM,EAAE,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;AACzD,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,gCAAgC,CACpD,EAAa,EACb,SAAiB,EACjB,GAAS;IAET,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,uBAAuB,CAAC;SAC7B,KAAK,CACJ,GAAG,CACD,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,SAAS,CAAC,EAChD,MAAM,CAAC,uBAAuB,CAAC,MAAM,CAAC,EACtC,EAAE,CAAC,uBAAuB,CAAC,SAAS,EAAE,GAAG,CAAC,CAC3C,CACF;SACA,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,8BAA8B,CAAC,EAAa,EAAE,EAAU,EAAE,GAAS;IACvF,MAAM,EAAE;SACL,MAAM,CAAC,uBAAuB,CAAC;SAC/B,GAAG,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;SACpB,KAAK,CAAC,EAAE,CAAC,uBAAuB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,EAAa,EAAE,MAAc,EAAE,GAAS;IAC9E,MAAM,EAAE;SACL,MAAM,CAAC,KAAK,CAAC;SACb,GAAG,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC;SAC7B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAA;AACpE,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,EAAa,EACb,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;SAC9F,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC;AAED,oFAAoF;AACpF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAa,EACb,MAAc;IAEd,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,EAAE;SACrB,MAAM,EAAE;SACR,IAAI,CAAC,gBAAgB,CAAC;SACtB,KAAK,CAAC,EAAE,CAAC,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;SAC1C,OAAO,CAAC,gBAAgB,CAAC,QAAQ,CAAC;SAClC,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/modules/auth/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAQzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAO,KAAK,EAAe,WAAW,EAA8B,MAAM,cAAc,CAAA;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AAwDxD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CACtC;AAsDD,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI,CAwHxF"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/routes.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAW,IAAI,EAAE,MAAM,MAAM,CAAA;AAQzC,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAA;AAE9D,OAAO,KAAK,EAAe,WAAW,EAA8B,MAAM,cAAc,CAAA;AAExF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAA;AA0DxD,MAAM,WAAW,sBAAuB,SAAQ,sBAAsB;IACpE,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAA;IAC7B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAA;CACtC;AA2DD,wBAAgB,eAAe,CAAC,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,sBAAsB,GAAG,IAAI,CA6IxF"}