@knpkv/control-center 0.1.0

package/dist/server/server/auth/Auth.d.ts

@@ -0,0 +1,169 @@
+import type { FileSystem, Path } from "effect";
+import { Context, Crypto, Effect, Layer, Redacted, Schema } from "effect";
+import type { Actor, Role } from "../../domain/actors.js";
+import type { WorkspaceId } from "../../domain/identifiers.js";
+import type { Database } from "../persistence/Database.js";
+import { databaseLayer } from "../persistence/Database.js";
+import { AuthRepository } from "./AuthRepository.js";
+import { AuthCryptoError, AuthPermissionDeniedError, CredentialRejectedError } from "./errors.js";
+declare const Auth_base: Context.ServiceClass<Auth, "@knpkv/control-center/server/auth/Auth", {
+    bootstrapOwnerPairing: (input: {
+        readonly workspaceId: WorkspaceId;
+        readonly actor: Actor;
+    }) => Effect.Effect<{
+        pairingCode: Redacted.Redacted<string>;
+        summary: Schema.Struct.ReadonlySide<{
+            readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>, Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>]>;
+            readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+            readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+            readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly createdAt: Schema.DateTimeUtcFromString;
+            readonly expiresAt: Schema.DateTimeUtcFromString;
+            readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+            readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        }, "Type">;
+    }, CredentialRejectedError | import("./errors.js").FirstRunPairingAlreadyIssuedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    issuePairingCode: (ownerSessionToken: Redacted.Redacted<string>, input: {
+        readonly actor: Actor;
+        readonly permission: Role;
+    }) => Effect.Effect<{
+        pairingCode: Redacted.Redacted<string>;
+        summary: Schema.Struct.ReadonlySide<{
+            readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>, Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>]>;
+            readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+            readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+            readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly createdAt: Schema.DateTimeUtcFromString;
+            readonly expiresAt: Schema.DateTimeUtcFromString;
+            readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+            readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        }, "Type">;
+    }, CredentialRejectedError | AuthPermissionDeniedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    consumePairingCode: (pairingCode: Redacted.Redacted<string>) => Effect.Effect<{
+        csrfToken: Redacted.Redacted<string>;
+        session: Schema.Struct.ReadonlySide<{
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>, Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>]>;
+            readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+            readonly createdAt: Schema.DateTimeUtcFromString;
+            readonly lastSeenAt: Schema.DateTimeUtcFromString;
+            readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+            readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        }, "Type">;
+        sessionToken: Redacted.Redacted<string>;
+    }, CredentialRejectedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    authenticate: (sessionToken: Redacted.Redacted<string>) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly lastSeenAt: Schema.DateTimeUtcFromString;
+        readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, CredentialRejectedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    recoverCsrfToken: (sessionToken: Redacted.Redacted<string>) => Effect.Effect<{
+        csrfToken: Redacted.Redacted<string>;
+        session: Schema.Struct.ReadonlySide<{
+            readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>, Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>]>;
+            readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+            readonly createdAt: Schema.DateTimeUtcFromString;
+            readonly lastSeenAt: Schema.DateTimeUtcFromString;
+            readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+            readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+            readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        }, "Type">;
+    }, CredentialRejectedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    authorizeMutation: (sessionToken: Redacted.Redacted<string>, csrfToken: Redacted.Redacted<string>) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly lastSeenAt: Schema.DateTimeUtcFromString;
+        readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, CredentialRejectedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    listSessions: (ownerSessionToken: Redacted.Redacted<string>) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly lastSeenAt: Schema.DateTimeUtcFromString;
+        readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">[], CredentialRejectedError | AuthPermissionDeniedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    revokeSession: (ownerSessionToken: Redacted.Redacted<string>, sessionId: string & import("effect/Brand").Brand<"SessionId">) => Effect.Effect<void, CredentialRejectedError | AuthPermissionDeniedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    logout: (sessionToken: Redacted.Redacted<string>) => Effect.Effect<void, CredentialRejectedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    listPairingCodes: (ownerSessionToken: Redacted.Redacted<string>) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+        readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly expiresAt: Schema.DateTimeUtcFromString;
+        readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">[], CredentialRejectedError | AuthPermissionDeniedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+    revokePairingCode: (ownerSessionToken: Redacted.Redacted<string>, pairingCodeId: string & import("effect/Brand").Brand<"PairingCodeId">) => Effect.Effect<void, CredentialRejectedError | AuthPermissionDeniedError | import("./errors.js").AuthPersistenceError | AuthCryptoError, never>;
+}>;
+/** Authentication/session application service. Raw credentials stay redacted at its boundary. */
+export declare class Auth extends Auth_base {
+    /** Layer requiring the private auth repository plus Effect Crypto and Clock services. */
+    static readonly layer: Layer.Layer<Auth, never, Crypto.Crypto | AuthRepository>;
+}
+/** Build a standalone Auth service from persistence configuration. */
+export declare const authLayer: (persistenceConfigInput: unknown) => Layer.Layer<Auth, Layer.Error<ReturnType<typeof databaseLayer>>, Crypto.Crypto | FileSystem.FileSystem | Path.Path>;
+/** Build Auth from a caller-owned database so a server uses one libSQL client. */
+export declare const authLayerFromDatabase: Layer.Layer<Auth, never, Crypto.Crypto | Database>;
+export {};
+//# sourceMappingURL=Auth.d.ts.map

package/dist/server/server/auth/Auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Auth.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/Auth.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAA;AAC9C,OAAO,EAAS,OAAO,EAAE,MAAM,EAAY,MAAM,EAAY,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEpG,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAE1D,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAA;AACpD,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAA;;;8BA0JrE,WAAW;wBACjB,KAAK;;;;;;;;;;;;;;;;;;;;;;wBAcI,KAAK;6BAAuB,IAAI;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuH/D,iGAAiG;AACjG,qBAAa,IAAK,SAAQ,SAEzB;IACC,yFAAyF;IACzF,MAAM,CAAC,QAAQ,CAAC,KAAK,2DAA+B;CACrD;AAED,sEAAsE;AACtE,eAAO,MAAM,SAAS,GACpB,wBAAwB,OAAO,KAC9B,KAAK,CAAC,KAAK,CACZ,IAAI,EACJ,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,EAC7C,MAAM,CAAC,MAAM,GAAG,UAAU,CAAC,UAAU,GAAG,IAAI,CAAC,IAAI,CAQlD,CAAA;AAED,kFAAkF;AAClF,eAAO,MAAM,qBAAqB,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,GAAG,QAAQ,CAMjF,CAAA"}

package/dist/server/server/auth/AuthRepository.d.ts

@@ -0,0 +1,160 @@
+import { Context, Crypto, DateTime, Effect, Layer, Schema } from "effect";
+import { Actor, Role } from "../../domain/actors.js";
+import { WorkspaceId } from "../../domain/identifiers.js";
+import { UtcTimestamp } from "../../domain/utcTimestamp.js";
+import { Database } from "../persistence/Database.js";
+import { QuarantineRepository } from "../persistence/repositories/quarantineRepository.js";
+import { AuthPersistenceError, CredentialRejectedError, FirstRunPairingAlreadyIssuedError } from "./errors.js";
+import type { SessionSummary } from "./models.js";
+import { PairingCodeId, PairingPurpose, SessionId } from "./models.js";
+interface NewPairingCode {
+    readonly pairingCodeId: PairingCodeId;
+    readonly workspaceId: WorkspaceId;
+    readonly codeHash: string;
+    readonly purpose: PairingPurpose;
+    readonly actor: Actor;
+    readonly permission: Role;
+    readonly issuedBySessionId: SessionId | null;
+    readonly createdAt: typeof UtcTimestamp.Type;
+    readonly expiresAt: typeof UtcTimestamp.Type;
+}
+interface NewSession {
+    readonly sessionId: SessionId;
+    readonly tokenHash: string;
+    readonly csrfHash: string;
+    readonly createdAt: typeof UtcTimestamp.Type;
+    readonly idleExpiresAt: typeof UtcTimestamp.Type;
+    readonly absoluteExpiresAt: typeof UtcTimestamp.Type;
+}
+export interface AuthenticatedSessionRecord {
+    readonly csrfHash: string;
+    readonly summary: SessionSummary;
+}
+declare const makeAuthRepository: Effect.Effect<{
+    issueFirstRun: (input: NewPairingCode) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+        readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly expiresAt: Schema.DateTimeUtcFromString;
+        readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, FirstRunPairingAlreadyIssuedError | AuthPersistenceError, never>;
+    issue: (input: NewPairingCode) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+        readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly expiresAt: Schema.DateTimeUtcFromString;
+        readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, AuthPersistenceError, never>;
+    consume: (input: {
+        readonly codeHash: string;
+        readonly now: typeof UtcTimestamp.Type;
+        readonly session: NewSession;
+    }) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly lastSeenAt: Schema.DateTimeUtcFromString;
+        readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, CredentialRejectedError | AuthPersistenceError, never>;
+    authenticate: (input: {
+        readonly tokenHash: string;
+        readonly now: typeof UtcTimestamp.Type;
+        readonly idleExpiresAt: typeof UtcTimestamp.Type;
+    }) => Effect.Effect<AuthenticatedSessionRecord, CredentialRejectedError | AuthPersistenceError, never>;
+    listSessions: (workspaceId: string & import("effect/Brand").Brand<"WorkspaceId">) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly lastSeenAt: Schema.DateTimeUtcFromString;
+        readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+        readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">[], AuthPersistenceError, never>;
+    revokeSession: (input: {
+        readonly workspaceId: WorkspaceId;
+        readonly sessionId: SessionId;
+        readonly now: typeof UtcTimestamp.Type;
+    }) => Effect.Effect<void, AuthPersistenceError, never>;
+    logout: (tokenHash: string, now: DateTime.Utc) => Effect.Effect<void, AuthPersistenceError, never>;
+    listPairingCodes: (workspaceId: string & import("effect/Brand").Brand<"WorkspaceId">) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+        readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly expiresAt: Schema.DateTimeUtcFromString;
+        readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">[], AuthPersistenceError, never>;
+    revokePairingCode: (input: {
+        readonly workspaceId: WorkspaceId;
+        readonly pairingCodeId: PairingCodeId;
+        readonly now: typeof UtcTimestamp.Type;
+    }) => Effect.Effect<void, AuthPersistenceError, never>;
+    recoverOwner: (input: NewPairingCode, revokeExistingOwnerSessions: boolean) => Effect.Effect<Schema.Struct.ReadonlySide<{
+        readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+        readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+        readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+            readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+        }>, Schema.TaggedStruct<"agent", {
+            readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+        }>]>;
+        readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+        readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+        readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly createdAt: Schema.DateTimeUtcFromString;
+        readonly expiresAt: Schema.DateTimeUtcFromString;
+        readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+        readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    }, "Type">, AuthPersistenceError, never>;
+}, never, Crypto.Crypto | Database | QuarantineRepository>;
+export interface AuthRepositoryService extends Effect.Success<typeof makeAuthRepository> {
+}
+declare const AuthRepository_base: Context.ServiceClass<AuthRepository, "@knpkv/control-center/server/auth/AuthRepository", AuthRepositoryService>;
+export declare class AuthRepository extends AuthRepository_base {
+    static readonly layer: Layer.Layer<AuthRepository, never, Crypto.Crypto | Database | QuarantineRepository>;
+}
+export {};
+//# sourceMappingURL=AuthRepository.d.ts.map

package/dist/server/server/auth/AuthRepository.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthRepository.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/AuthRepository.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAA;AAEjF,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,wBAAwB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,6BAA6B,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,8BAA8B,CAAA;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,4BAA4B,CAAA;AAErD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qDAAqD,CAAA;AAC1F,OAAO,EAAE,oBAAoB,EAAE,uBAAuB,EAAE,iCAAiC,EAAE,MAAM,aAAa,CAAA;AAC9G,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAA;AACjD,OAAO,EAAE,aAAa,EAAsB,cAAc,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AA0C1F,UAAU,cAAc;IACtB,QAAQ,CAAC,aAAa,EAAE,aAAa,CAAA;IACrC,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAA;IACrB,QAAQ,CAAC,UAAU,EAAE,IAAI,CAAA;IACzB,QAAQ,CAAC,iBAAiB,EAAE,SAAS,GAAG,IAAI,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,OAAO,YAAY,CAAC,IAAI,CAAA;IAC5C,QAAQ,CAAC,SAAS,EAAE,OAAO,YAAY,CAAC,IAAI,CAAA;CAC7C;AAED,UAAU,UAAU;IAClB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAA;IAC7B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,YAAY,CAAC,IAAI,CAAA;IAC5C,QAAQ,CAAC,aAAa,EAAE,OAAO,YAAY,CAAC,IAAI,CAAA;IAChD,QAAQ,CAAC,iBAAiB,EAAE,OAAO,YAAY,CAAC,IAAI,CAAA;CACrD;AAED,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;CACjC;AA2FD,QAAA,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2BAwMC,MAAM;sBACX,OAAO,YAAY,CAAC,IAAI;0BACpB,UAAU;;;;;;;;;;;;;;;;;4BA/GV,MAAM;sBACZ,OAAO,YAAY,CAAC,IAAI;gCACd,OAAO,YAAY,CAAC,IAAI;;;;;;;;;;;;;;;;;;8BAyLxB,WAAW;4BACb,SAAS;sBACf,OAAO,YAAY,CAAC,IAAI;;;;;;;;;;;;;;;;;;;;;8BAkChB,WAAW;gCACT,aAAa;sBACvB,OAAO,YAAY,CAAC,IAAI;;;;;;;;;;;;;;;;;;;0DA2C1C,CAAA;AAEF,MAAM,WAAW,qBAAsB,SAAQ,MAAM,CAAC,OAAO,CAAC,OAAO,kBAAkB,CAAC;CAAG;;AAE3F,qBAAa,cAAe,SAAQ,mBAEnC;IACC,MAAM,CAAC,QAAQ,CAAC,KAAK,sFAAmD;CACzE"}

package/dist/server/server/auth/TerminalRecovery.d.ts

@@ -0,0 +1,35 @@
+import type { FileSystem as FileSystemType, Path as PathType } from "effect";
+import { Context, Crypto, Effect, Layer, Redacted, Schema, Stdio } from "effect";
+import { databaseLayer } from "../persistence/Database.js";
+import { AuthCryptoError, TerminalRecoveryRefusedError } from "./errors.js";
+/** Exact phrase required on standard input before terminal recovery may issue a credential. */
+export declare const TERMINAL_RECOVERY_CONFIRMATION = "ISSUE OWNER RECOVERY CODE";
+declare const TerminalRecovery_base: Context.ServiceClass<TerminalRecovery, "@knpkv/control-center/server/auth/TerminalRecovery", {
+    issueOwnerRecovery: (unknownRequest: unknown) => Effect.Effect<{
+        pairingCode: Redacted.Redacted<string>;
+        summary: Schema.Struct.ReadonlySide<{
+            readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+            readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+            readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+                readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+            }>, Schema.TaggedStruct<"agent", {
+                readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+            }>]>;
+            readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+            readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+            readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly createdAt: Schema.DateTimeUtcFromString;
+            readonly expiresAt: Schema.DateTimeUtcFromString;
+            readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+            readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+            readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+        }, "Type">;
+    }, import("./errors.js").AuthPersistenceError | AuthCryptoError | TerminalRecoveryRefusedError, Stdio.Stdio>;
+}>;
+/** Terminal-only recovery workflow; deliberately separate from the HTTP-facing Auth service. */
+export declare class TerminalRecovery extends TerminalRecovery_base {
+}
+/** Build terminal recovery from the exact canonical parent of the configured local database. */
+export declare const terminalRecoveryLayer: (persistenceConfigInput: unknown) => Layer.Layer<TerminalRecovery, Layer.Error<ReturnType<typeof databaseLayer>> | TerminalRecoveryRefusedError, Crypto.Crypto | FileSystemType.FileSystem | PathType.Path>;
+export {};
+//# sourceMappingURL=TerminalRecovery.d.ts.map

package/dist/server/server/auth/TerminalRecovery.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TerminalRecovery.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/TerminalRecovery.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,IAAI,cAAc,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,QAAQ,CAAA;AAC5E,OAAO,EAEL,OAAO,EACP,MAAM,EAEN,MAAM,EAGN,KAAK,EAGL,QAAQ,EAER,MAAM,EACN,KAAK,EAEN,MAAM,QAAQ,CAAA;AAIf,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAA;AAI1D,OAAO,EAAE,eAAe,EAAE,4BAA4B,EAAE,MAAM,aAAa,CAAA;AAG3E,+FAA+F;AAC/F,eAAO,MAAM,8BAA8B,8BAA8B,CAAA;;;;;;;;;;;;;;;;;;;;;;;AAgLzE,gGAAgG;AAChG,qBAAa,gBAAiB,SAAQ,qBAGmB;CAAG;AAE5D,gGAAgG;AAChG,eAAO,MAAM,qBAAqB,GAChC,wBAAwB,OAAO,KAC9B,KAAK,CAAC,KAAK,CACZ,gBAAgB,EAChB,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,GAAG,4BAA4B,EAC5E,MAAM,CAAC,MAAM,GAAG,cAAc,CAAC,UAAU,GAAG,QAAQ,CAAC,IAAI,CAyC1D,CAAA"}

package/dist/server/server/auth/errors.d.ts

@@ -0,0 +1,31 @@
+import * as Schema from "effect/Schema";
+declare const CredentialRejectedError_base: Schema.Class<CredentialRejectedError, Schema.TaggedStruct<"CredentialRejectedError", {}>, import("effect/Cause").YieldableError>;
+/** Deliberately indistinguishable failure for invalid, expired, replayed, or revoked credentials. */
+export declare class CredentialRejectedError extends CredentialRejectedError_base {
+}
+declare const AuthPermissionDeniedError_base: Schema.Class<AuthPermissionDeniedError, Schema.TaggedStruct<"AuthPermissionDeniedError", {}>, import("effect/Cause").YieldableError>;
+/** Authenticated actor lacks the workspace-owner permission required by an operation. */
+export declare class AuthPermissionDeniedError extends AuthPermissionDeniedError_base {
+}
+declare const FirstRunPairingAlreadyIssuedError_base: Schema.Class<FirstRunPairingAlreadyIssuedError, Schema.TaggedStruct<"FirstRunPairingAlreadyIssuedError", {}>, import("effect/Cause").YieldableError>;
+/** A workspace has already issued its unique first-run owner code. */
+export declare class FirstRunPairingAlreadyIssuedError extends FirstRunPairingAlreadyIssuedError_base {
+}
+declare const AuthPersistenceError_base: Schema.Class<AuthPersistenceError, Schema.TaggedStruct<"AuthPersistenceError", {
+    readonly operation: Schema.Literals<readonly ["issue-pairing-code", "consume-pairing-code", "authenticate-session", "list-sessions", "revoke-session", "list-pairing-codes", "revoke-pairing-code", "recover-owner"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Stable secret-free boundary error for an authentication persistence failure. */
+export declare class AuthPersistenceError extends AuthPersistenceError_base {
+}
+declare const AuthCryptoError_base: Schema.Class<AuthCryptoError, Schema.TaggedStruct<"AuthCryptoError", {}>, import("effect/Cause").YieldableError>;
+/** Platform cryptography failed before a credential could be safely issued or checked. */
+export declare class AuthCryptoError extends AuthCryptoError_base {
+}
+declare const TerminalRecoveryRefusedError_base: Schema.Class<TerminalRecoveryRefusedError, Schema.TaggedStruct<"TerminalRecoveryRefusedError", {
+    readonly reason: Schema.Literals<readonly ["invalid-input", "data-directory-unavailable", "data-directory-not-private", "data-directory-owner-mismatch", "confirmation-rejected", "terminal-io-failed"]>;
+}>, import("effect/Cause").YieldableError>;
+/** Terminal recovery refused before any credential was created. */
+export declare class TerminalRecoveryRefusedError extends TerminalRecoveryRefusedError_base {
+}
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/server/server/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAA;;AAEvC,qGAAqG;AACrG,qBAAa,uBAAwB,SAAQ,4BAG5C;CAAG;;AAEJ,yFAAyF;AACzF,qBAAa,yBAA0B,SAAQ,8BAG9C;CAAG;;AAEJ,sEAAsE;AACtE,qBAAa,iCAAkC,SAAQ,sCAGtD;CAAG;;;;AAEJ,mFAAmF;AACnF,qBAAa,oBAAqB,SAAQ,yBAczC;CAAG;;AAEJ,0FAA0F;AAC1F,qBAAa,eAAgB,SAAQ,oBAGpC;CAAG;;;;AAEJ,mEAAmE;AACnE,qBAAa,4BAA6B,SAAQ,iCAYjD;CAAG"}

package/dist/server/server/auth/index.d.ts

@@ -0,0 +1,5 @@
+export { Auth, authLayer } from "./Auth.js";
+export { AuthCryptoError, AuthPermissionDeniedError, AuthPersistenceError, CredentialRejectedError, FirstRunPairingAlreadyIssuedError, TerminalRecoveryRefusedError } from "./errors.js";
+export { type IssuedPairingCode, type IssuedSession, PAIRING_CODE_LIFETIME_MINUTES, PairingCodeId, PairingCodeSummary, PairingPurpose, SESSION_ABSOLUTE_LIFETIME_DAYS, SESSION_IDLE_LIFETIME_HOURS, SessionId, SessionSummary } from "./models.js";
+export { TERMINAL_RECOVERY_CONFIRMATION, TerminalRecovery, terminalRecoveryLayer } from "./TerminalRecovery.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/server/server/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAA;AAC3C,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACpB,uBAAuB,EACvB,iCAAiC,EACjC,4BAA4B,EAC7B,MAAM,aAAa,CAAA;AACpB,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,6BAA6B,EAC7B,aAAa,EACb,kBAAkB,EAClB,cAAc,EACd,8BAA8B,EAC9B,2BAA2B,EAC3B,SAAS,EACT,cAAc,EACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,8BAA8B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA"}

package/dist/server/server/auth/models.d.ts

@@ -0,0 +1,63 @@
+import { Schema } from "effect";
+import type * as Redacted from "effect/Redacted";
+/** Canonical identifier of a single-use pairing credential. */
+export declare const PairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+export { SessionId } from "../../domain/identifiers.js";
+export type PairingCodeId = typeof PairingCodeId.Type;
+/** Origin of a one-time pairing code. */
+export declare const PairingPurpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+export type PairingPurpose = typeof PairingPurpose.Type;
+/** Secret-free browser session metadata safe for APIs and logs. */
+export declare const SessionSummary: Schema.Struct<{
+    readonly sessionId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+        readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+    }>, Schema.TaggedStruct<"agent", {
+        readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+    }>]>;
+    readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly lastSeenAt: Schema.DateTimeUtcFromString;
+    readonly idleExpiresAt: Schema.DateTimeUtcFromString;
+    readonly absoluteExpiresAt: Schema.DateTimeUtcFromString;
+    readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>;
+export type SessionSummary = typeof SessionSummary.Type;
+/** Secret-free one-time code metadata safe for administrative views. */
+export declare const PairingCodeSummary: Schema.Struct<{
+    readonly pairingCodeId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PairingCodeId">;
+    readonly workspaceId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "WorkspaceId">;
+    readonly actor: Schema.toTaggedUnion<"_tag", readonly [Schema.TaggedStruct<"human", {
+        readonly personId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "PersonId">;
+    }>, Schema.TaggedStruct<"agent", {
+        readonly agentId: Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "AgentId">;
+    }>]>;
+    readonly permission: Schema.Literals<readonly ["workspace-owner", "workspace-approver", "release-owner", "release-approver", "change-owner", "issue-owner", "issue-assignee", "page-owner", "author", "contributor", "reviewer", "operator", "deployment-approver", "merge-approver", "watcher"]>;
+    readonly purpose: Schema.Literals<readonly ["first-run", "device", "recovery"]>;
+    readonly issuedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+    readonly createdAt: Schema.DateTimeUtcFromString;
+    readonly expiresAt: Schema.DateTimeUtcFromString;
+    readonly consumedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+    readonly consumedBySessionId: Schema.NullOr<Schema.brand<Schema.decodeTo<Schema.String, Schema.String, never, never>, "SessionId">>;
+    readonly revokedAt: Schema.NullOr<Schema.DateTimeUtcFromString>;
+}>;
+export type PairingCodeSummary = typeof PairingCodeSummary.Type;
+/** One-time pairing code returned only by explicit issuance operations. */
+export interface IssuedPairingCode {
+    readonly pairingCode: Redacted.Redacted<string>;
+    readonly summary: PairingCodeSummary;
+}
+/** Newly established session credentials returned only once. */
+export interface IssuedSession {
+    readonly csrfToken: Redacted.Redacted<string>;
+    readonly session: SessionSummary;
+    readonly sessionToken: Redacted.Redacted<string>;
+}
+/** Default validity of first-run, device, and recovery pairing codes. */
+export declare const PAIRING_CODE_LIFETIME_MINUTES = 10;
+/** Sliding idle validity of an authenticated browser session. */
+export declare const SESSION_IDLE_LIFETIME_HOURS = 12;
+/** Absolute browser-session lifetime, regardless of activity. */
+export declare const SESSION_ABSOLUTE_LIFETIME_DAYS = 30;
+//# sourceMappingURL=models.d.ts.map

package/dist/server/server/auth/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../../../src/server/auth/models.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAwB,MAAM,QAAQ,CAAA;AACrD,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAA;AAsBhD,+DAA+D;AAC/D,eAAO,MAAM,aAAa,4FAAkC,CAAA;AAE5D,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAA;AACvD,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,IAAI,CAAA;AAErD,yCAAyC;AACzC,eAAO,MAAM,cAAc,+DAAuD,CAAA;AAElF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,mEAAmE;AACnE,eAAO,MAAM,cAAc;;;;;;;;;;;;;;EAUzB,CAAA;AAEF,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,IAAI,CAAA;AAEvD,wEAAwE;AACxE,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;EAY7B,CAAA;AAEF,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,IAAI,CAAA;AAE/D,2EAA2E;AAC3E,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC/C,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAA;CACrC;AAED,gEAAgE;AAChE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAA;IAChC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;CACjD;AAED,yEAAyE;AACzE,eAAO,MAAM,6BAA6B,KAAK,CAAA;AAE/C,iEAAiE;AACjE,eAAO,MAAM,2BAA2B,KAAK,CAAA;AAE7C,iEAAiE;AACjE,eAAO,MAAM,8BAA8B,KAAK,CAAA"}

package/dist/server/server/cli.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env node
+export {};
+//# sourceMappingURL=cli.d.ts.map

package/dist/server/server/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/server/cli.ts"],"names":[],"mappings":""}