@portaidentity/server 1.7.0

package/dist/config/schema.d.ts

@@ -0,0 +1,35 @@
+import { z } from 'zod';
+export declare const configSchema: z.ZodObject<{
+    nodeEnv: z.ZodDefault<z.ZodEnum<{
+        development: "development";
+        production: "production";
+        test: "test";
+    }>>;
+    port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+    host: z.ZodDefault<z.ZodString>;
+    databaseUrl: z.ZodString;
+    redisUrl: z.ZodString;
+    issuerBaseUrl: z.ZodString;
+    cookieKeys: z.ZodArray<z.ZodString>;
+    smtp: z.ZodObject<{
+        host: z.ZodString;
+        port: z.ZodDefault<z.ZodCoercedNumber<unknown>>;
+        user: z.ZodOptional<z.ZodString>;
+        pass: z.ZodOptional<z.ZodString>;
+        from: z.ZodString;
+    }, z.core.$strip>;
+    logLevel: z.ZodDefault<z.ZodEnum<{
+        debug: "debug";
+        error: "error";
+        fatal: "fatal";
+        info: "info";
+        warn: "warn";
+    }>>;
+    trustProxy: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+    twoFactorEncryptionKey: z.ZodOptional<z.ZodString>;
+    signingKeyEncryptionKey: z.ZodString;
+    adminCorsOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    metricsEnabled: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>>, z.ZodTransform<boolean, string | boolean>>;
+}, z.core.$strip>;
+export type AppConfig = z.infer<typeof configSchema>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/config/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgFxB,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkGvB,CAAC;AAEH,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,CAAC"}

package/dist/config/schema.js

@@ -0,0 +1,167 @@
+import { z } from 'zod';
+// ---------------------------------------------------------------------------
+// Base schema — structural validation (types, formats, defaults).
+// The superRefine below adds production-specific safety checks.
+// ---------------------------------------------------------------------------
+const baseSchema = z.object({
+    nodeEnv: z.enum(['development', 'test', 'production']).default('development'),
+    port: z.coerce.number().int().positive().default(3000),
+    host: z.string().default('0.0.0.0'),
+    databaseUrl: z.string().min(1, 'DATABASE_URL is required'),
+    redisUrl: z.string().min(1, 'REDIS_URL is required'),
+    issuerBaseUrl: z.string().url('ISSUER_BASE_URL must be a valid URL'),
+    // Cookie signing keys for OIDC sessions — array of secrets for key rotation.
+    // First key is used for signing; subsequent keys are used for verification only.
+    cookieKeys: z.array(z.string().min(16)).min(1, 'At least one COOKIE_KEY is required'),
+    smtp: z.object({
+        host: z.string().min(1, 'SMTP_HOST is required'),
+        port: z.coerce.number().default(587),
+        user: z.string().optional(),
+        pass: z.string().optional(),
+        from: z.string().min(1, 'SMTP_FROM is required'),
+    }),
+    logLevel: z.enum(['debug', 'info', 'warn', 'error', 'fatal']).default('info'),
+    // AES-256-GCM encryption key for TOTP secrets — must be exactly 32 hex bytes (64 chars).
+    // Optional in dev/test (a default is used); required in production for security.
+    // Trust proxy headers (X-Forwarded-Proto, X-Forwarded-For, etc.).
+    // Default: true — all dev/test/prod environments run behind a TLS-terminating
+    // reverse proxy (nginx in dev via docker-compose, nginx/Traefik/LB in prod).
+    // Koa reads X-Forwarded-Proto when app.proxy=true, making ctx.secure accurate.
+    trustProxy: z
+        .union([z.boolean(), z.string()])
+        .default(true)
+        .transform((val) => (typeof val === 'string' ? val === 'true' || val === '1' : val)),
+    twoFactorEncryptionKey: z
+        .string()
+        .length(64, 'TWO_FACTOR_ENCRYPTION_KEY must be 64 hex characters (32 bytes)')
+        .regex(/^[0-9a-f]+$/i, 'TWO_FACTOR_ENCRYPTION_KEY must be hex-encoded')
+        .optional(),
+    // AES-256-GCM encryption key for signing key private keys at rest.
+    // Must be exactly 32 hex bytes (64 characters). Always required —
+    // Porta will not start without it.
+    signingKeyEncryptionKey: z
+        .string()
+        .length(64, 'SIGNING_KEY_ENCRYPTION_KEY must be 64 hex characters (32 bytes)')
+        .regex(/^[0-9a-f]+$/i, 'SIGNING_KEY_ENCRYPTION_KEY must be hex-encoded'),
+    // Allowed origins for the admin API CORS policy.
+    // Empty array (default) = deny all cross-origin requests.
+    // Only needed when a web admin dashboard runs on a different origin.
+    adminCorsOrigins: z.array(z.string().url()).default([]),
+    // Prometheus metrics endpoint — default OFF.
+    // When true, GET /metrics exposes process and HTTP request counters
+    // in Prometheus text format. Operators must restrict access via network
+    // policy or reverse proxy since the endpoint is unauthenticated.
+    metricsEnabled: z
+        .union([z.boolean(), z.string()])
+        .default(false)
+        .transform((val) => (typeof val === 'string' ? val === 'true' || val === '1' : val)),
+});
+// ---------------------------------------------------------------------------
+// Production safety rules — superRefine that only fires in production.
+// Rejects well-known dev placeholders and insecure defaults so that
+// deploying with .env.example values is impossible.
+//
+// Escape hatch: PORTA_SKIP_PROD_SAFETY=true skips these checks (incident
+// response only — the config loader logs an ERROR when the hatch is used).
+// ---------------------------------------------------------------------------
+/** Placeholder pattern matching "change-me", "change_me", "changeme" etc. */
+const PLACEHOLDER_RE = /change[-_]?me/i;
+/** The .env.example 2FA placeholder — 0123456789abcdef repeated 4×. */
+const TWO_FACTOR_DEV_PLACEHOLDER = '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef';
+/** The .env.example signing-key placeholder — fedcba…3210 repeated 4×. */
+const SIGNING_KEY_DEV_PLACEHOLDER = 'fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210';
+export const configSchema = baseSchema.superRefine((data, ctx) => {
+    // Only enforce in production
+    if (data.nodeEnv !== 'production')
+        return;
+    // Escape hatch for incident response — caller logs a loud error
+    if (process.env.PORTA_SKIP_PROD_SAFETY === 'true')
+        return;
+    // ── R1 + R2: Cookie key strength ──────────────────────────────────
+    data.cookieKeys.forEach((key, i) => {
+        if (PLACEHOLDER_RE.test(key)) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['cookieKeys', i],
+                message: 'COOKIE_KEYS contains a dev placeholder ("change-me" pattern); ' +
+                    'generate with `openssl rand -base64 32`',
+            });
+        }
+        if (key.length < 32) {
+            ctx.addIssue({
+                code: 'custom',
+                path: ['cookieKeys', i],
+                message: `COOKIE_KEYS[${i}] is shorter than 32 chars; production requires >= 32 chars of entropy`,
+            });
+        }
+    });
+    // ── R3 + R4: 2FA encryption key ──────────────────────────────────
+    // Any org that ever enables 2FA needs this key to decrypt existing
+    // TOTP secrets, so it is unconditionally required in production.
+    const tfe = data.twoFactorEncryptionKey;
+    if (!tfe) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['twoFactorEncryptionKey'],
+            message: 'TWO_FACTOR_ENCRYPTION_KEY is required in production',
+        });
+    }
+    else if (tfe === TWO_FACTOR_DEV_PLACEHOLDER) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['twoFactorEncryptionKey'],
+            message: 'TWO_FACTOR_ENCRYPTION_KEY still set to the dev placeholder',
+        });
+    }
+    // ── R5: Signing key encryption key placeholder ────────────────────
+    if (data.signingKeyEncryptionKey === SIGNING_KEY_DEV_PLACEHOLDER) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['signingKeyEncryptionKey'],
+            message: 'SIGNING_KEY_ENCRYPTION_KEY still set to the dev placeholder',
+        });
+    }
+    // ── R6: Database dev password ─────────────────────────────────────
+    if (/:porta_dev@/.test(data.databaseUrl)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['databaseUrl'],
+            message: 'DATABASE_URL still contains the dev password "porta_dev"',
+        });
+    }
+    // ── R7: Issuer must use HTTPS in production (unless localhost) ────
+    if (/^http:\/\//.test(data.issuerBaseUrl)) {
+        try {
+            const url = new URL(data.issuerBaseUrl);
+            const localHosts = ['localhost', '127.0.0.1', '::1'];
+            if (!localHosts.includes(url.hostname)) {
+                ctx.addIssue({
+                    code: 'custom',
+                    path: ['issuerBaseUrl'],
+                    message: 'ISSUER_BASE_URL must use HTTPS in production',
+                });
+            }
+        }
+        catch {
+            // URL parse failure — already caught by the .url() validator above
+        }
+    }
+    // ── R8: Log level too verbose ─────────────────────────────────────
+    if (data.logLevel === 'debug') {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['logLevel'],
+            message: `LOG_LEVEL=${data.logLevel} is too verbose for production; use info, warn, or error`,
+        });
+    }
+    // ── R9: SMTP pointing at dev inbox ────────────────────────────────
+    const smtpHost = data.smtp.host;
+    if (smtpHost === 'localhost' || /^127\./.test(smtpHost)) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['smtp', 'host'],
+            message: 'SMTP_HOST points at a dev inbox (MailHog); configure a real SMTP relay for production',
+        });
+    }
+});
+//# sourceMappingURL=schema.js.map

package/dist/config/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/config/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,8EAA8E;AAC9E,kEAAkE;AAClE,gEAAgE;AAChE,8EAA8E;AAC9E,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,CAAC;IAC1B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7E,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC;IACtD,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC;IACnC,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,0BAA0B,CAAC;IAC1D,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;IACpD,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC;IACpE,6EAA6E;IAC7E,iFAAiF;IACjF,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,qCAAqC,CAAC;IACrF,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;QACb,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACpC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,uBAAuB,CAAC;KACjD,CAAC;IACF,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;IAC7E,yFAAyF;IACzF,iFAAiF;IACjF,kEAAkE;IAClE,8EAA8E;IAC9E,6EAA6E;IAC7E,+EAA+E;IAC/E,UAAU,EAAE,CAAC;SACV,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,IAAI,CAAC;SACb,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtF,sBAAsB,EAAE,CAAC;SACtB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,gEAAgE,CAAC;SAC5E,KAAK,CAAC,cAAc,EAAE,+CAA+C,CAAC;SACtE,QAAQ,EAAE;IACb,mEAAmE;IACnE,kEAAkE;IAClE,mCAAmC;IACnC,uBAAuB,EAAE,CAAC;SACvB,MAAM,EAAE;SACR,MAAM,CAAC,EAAE,EAAE,iEAAiE,CAAC;SAC7E,KAAK,CAAC,cAAc,EAAE,gDAAgD,CAAC;IAC1E,iDAAiD;IACjD,0DAA0D;IAC1D,qEAAqE;IACrE,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IACvD,6CAA6C;IAC7C,oEAAoE;IACpE,wEAAwE;IACxE,iEAAiE;IACjE,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,OAAO,CAAC,KAAK,CAAC;SACd,SAAS,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;CACvF,CAAC,CAAC;AAEH,8EAA8E;AAC9E,uEAAuE;AACvE,oEAAoE;AACpE,oDAAoD;AACpD,EAAE;AACF,yEAAyE;AACzE,2EAA2E;AAC3E,8EAA8E;AAE9E,6EAA6E;AAC7E,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,uEAAuE;AACvE,MAAM,0BAA0B,GAC9B,kEAAkE,CAAC;AAErE,0EAA0E;AAC1E,MAAM,2BAA2B,GAC/B,kEAAkE,CAAC;AAErE,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;IAC/D,6BAA6B;IAC7B,IAAI,IAAI,CAAC,OAAO,KAAK,YAAY;QAAE,OAAO;IAE1C,gEAAgE;IAChE,IAAI,OAAO,CAAC,GAAG,CAAC,sBAAsB,KAAK,MAAM;QAAE,OAAO;IAE1D,qEAAqE;IACrE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACjC,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EACL,gEAAgE;oBAChE,yCAAyC;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;YACpB,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC,CAAC;gBACvB,OAAO,EAAE,eAAe,CAAC,wEAAwE;aAClG,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,oEAAoE;IACpE,mEAAmE;IACnE,iEAAiE;IACjE,MAAM,GAAG,GAAG,IAAI,CAAC,sBAAsB,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,GAAG,KAAK,0BAA0B,EAAE,CAAC;QAC9C,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,wBAAwB,CAAC;YAChC,OAAO,EAAE,4DAA4D;SACtE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,uBAAuB,KAAK,2BAA2B,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,yBAAyB,CAAC;YACjC,OAAO,EAAE,6DAA6D;SACvE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EAAE,0DAA0D;SACpE,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,IAAI,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YACxC,MAAM,UAAU,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACvC,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,IAAI,EAAE,CAAC,eAAe,CAAC;oBACvB,OAAO,EAAE,8CAA8C;iBACxD,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;QACrE,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC9B,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,UAAU,CAAC;YAClB,OAAO,EAAE,aAAa,IAAI,CAAC,QAAQ,0DAA0D;SAC9F,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;IAChC,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YACtB,OAAO,EAAE,uFAAuF;SACjG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/custom-claims/cache.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Custom claims cache — Redis-backed fast lookup layer.
+ *
+ * Caches claim definitions per application to reduce database queries
+ * during admin views and list operations. Claim values are NOT cached
+ * because they have high cardinality (per-user × per-claim) and the
+ * DB query with JOIN is already efficient for the token issuance path.
+ *
+ * Key format: `claims:defs:{applicationId}`
+ * TTL: 5 minutes (balance between freshness and performance)
+ *
+ * All Redis errors are caught and logged — cache failures never propagate
+ * to callers. The system gracefully degrades to direct database lookups
+ * when Redis is unavailable.
+ *
+ * Invalidation triggers:
+ * - Definition created/updated/deleted → invalidateDefinitionsCache()
+ */
+import type { CustomClaimDefinition } from './types.js';
+/**
+ * Get cached claim definitions for an application.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param applicationId - Application UUID
+ * @returns Cached definitions array or null on miss
+ */
+export declare function getCachedDefinitions(applicationId: string): Promise<CustomClaimDefinition[] | null>;
+/**
+ * Cache claim definitions for an application.
+ *
+ * Stores the definitions array as JSON with a 5-minute TTL.
+ * Date fields are serialized to ISO 8601 strings automatically.
+ *
+ * @param applicationId - Application UUID
+ * @param definitions - Array of definitions to cache
+ */
+export declare function setCachedDefinitions(applicationId: string, definitions: CustomClaimDefinition[]): Promise<void>;
+/**
+ * Invalidate cached claim definitions for an application.
+ *
+ * Should be called after any definition create, update, or delete.
+ *
+ * @param applicationId - Application UUID
+ */
+export declare function invalidateDefinitionsCache(applicationId: string): Promise<void>;
+//# sourceMappingURL=cache.d.ts.map

package/dist/custom-claims/cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.d.ts","sourceRoot":"","sources":["../../src/custom-claims/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAKH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,YAAY,CAAC;AAgBxD;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,qBAAqB,EAAE,GAAG,IAAI,CAAC,CAWzC;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CACxC,aAAa,EAAE,MAAM,EACrB,WAAW,EAAE,qBAAqB,EAAE,GACnC,OAAO,CAAC,IAAI,CAAC,CAef;AAED;;;;;;GAMG;AACH,wBAAsB,0BAA0B,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUrF"}

package/dist/custom-claims/cache.js

@@ -0,0 +1,122 @@
+/**
+ * Custom claims cache — Redis-backed fast lookup layer.
+ *
+ * Caches claim definitions per application to reduce database queries
+ * during admin views and list operations. Claim values are NOT cached
+ * because they have high cardinality (per-user × per-claim) and the
+ * DB query with JOIN is already efficient for the token issuance path.
+ *
+ * Key format: `claims:defs:{applicationId}`
+ * TTL: 5 minutes (balance between freshness and performance)
+ *
+ * All Redis errors are caught and logged — cache failures never propagate
+ * to callers. The system gracefully degrades to direct database lookups
+ * when Redis is unavailable.
+ *
+ * Invalidation triggers:
+ * - Definition created/updated/deleted → invalidateDefinitionsCache()
+ */
+import { getRedis } from '../lib/redis.js';
+import { logger } from '../lib/logger.js';
+import { afterDatabaseCommit } from '../lib/database.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Cache TTL in seconds (5 minutes) */
+const CACHE_TTL = 300;
+/** Key prefix for claim definitions by application ID */
+const DEFINITIONS_PREFIX = 'claims:defs:';
+// ---------------------------------------------------------------------------
+// Get / Set / Invalidate
+// ---------------------------------------------------------------------------
+/**
+ * Get cached claim definitions for an application.
+ *
+ * Returns null on cache miss, invalid JSON, or Redis error.
+ * Callers should fall back to the database on null.
+ *
+ * @param applicationId - Application UUID
+ * @returns Cached definitions array or null on miss
+ */
+export async function getCachedDefinitions(applicationId) {
+    try {
+        const redis = getRedis();
+        const data = await redis.get(`${DEFINITIONS_PREFIX}${applicationId}`);
+        if (!data)
+            return null;
+        return deserializeDefinitions(data);
+    }
+    catch {
+        // Graceful degradation — log and return null so caller falls back to DB
+        logger.warn({ event: 'claim-cache-read-failed' }, 'Claim cache read failed');
+        return null;
+    }
+}
+/**
+ * Cache claim definitions for an application.
+ *
+ * Stores the definitions array as JSON with a 5-minute TTL.
+ * Date fields are serialized to ISO 8601 strings automatically.
+ *
+ * @param applicationId - Application UUID
+ * @param definitions - Array of definitions to cache
+ */
+export async function setCachedDefinitions(applicationId, definitions) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            await redis.set(`${DEFINITIONS_PREFIX}${applicationId}`, JSON.stringify(definitions), 'EX', CACHE_TTL);
+        }
+        catch {
+            // Graceful degradation — cache write failure is non-fatal
+            logger.warn({ event: 'claim-cache-write-failed' }, 'Claim cache write failed');
+        }
+    });
+}
+/**
+ * Invalidate cached claim definitions for an application.
+ *
+ * Should be called after any definition create, update, or delete.
+ *
+ * @param applicationId - Application UUID
+ */
+export async function invalidateDefinitionsCache(applicationId) {
+    await afterDatabaseCommit(async () => {
+        try {
+            const redis = getRedis();
+            await redis.del(`${DEFINITIONS_PREFIX}${applicationId}`);
+        }
+        catch {
+            // Graceful degradation — cache invalidation failure is non-fatal
+            logger.warn({ event: 'claim-cache-invalidation-failed' }, 'Claim cache invalidation failed');
+        }
+    });
+}
+// ---------------------------------------------------------------------------
+// Serialization helpers
+// ---------------------------------------------------------------------------
+/**
+ * Deserialize a JSON string from Redis into a CustomClaimDefinition array.
+ *
+ * Converts ISO 8601 date strings back to Date objects for the
+ * createdAt and updatedAt fields on each definition.
+ *
+ * @param data - JSON string from Redis
+ * @returns Array of definition objects with proper Date instances, or null if parse fails
+ */
+function deserializeDefinitions(data) {
+    try {
+        const parsed = JSON.parse(data);
+        // Restore Date objects from ISO string serialization
+        for (const def of parsed) {
+            def.createdAt = new Date(def.createdAt);
+            def.updatedAt = new Date(def.updatedAt);
+        }
+        return parsed;
+    }
+    catch {
+        logger.warn('Failed to parse cached claim definitions JSON');
+        return null;
+    }
+}
+//# sourceMappingURL=cache.js.map

package/dist/custom-claims/cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache.js","sourceRoot":"","sources":["../../src/custom-claims/cache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAGzD,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,uCAAuC;AACvC,MAAM,SAAS,GAAG,GAAG,CAAC;AAEtB,yDAAyD;AACzD,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAE1C,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB;IAErB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,kBAAkB,GAAG,aAAa,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,OAAO,sBAAsB,CAAC,IAAI,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,yBAAyB,EAAE,EAAE,yBAAyB,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,aAAqB,EACrB,WAAoC;IAEpC,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CACb,GAAG,kBAAkB,GAAG,aAAa,EAAE,EACvC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,EAC3B,IAAI,EACJ,SAAS,CACV,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,0DAA0D;YAC1D,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0BAA0B,EAAE,EAAE,0BAA0B,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,0BAA0B,CAAC,aAAqB;IACpE,MAAM,mBAAmB,CAAC,KAAK,IAAI,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,KAAK,CAAC,GAAG,CAAC,GAAG,kBAAkB,GAAG,aAAa,EAAE,CAAC,CAAC;QAC3D,CAAC;QAAC,MAAM,CAAC;YACP,iEAAiE;YACjE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,iCAAiC,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,wBAAwB;AACxB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAS,sBAAsB,CAAC,IAAY;IAC1C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAE3D,qDAAqD;QACrD,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;YACzB,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,GAAG,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/custom-claims/errors.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Custom claims domain error types.
+ *
+ * Custom error classes for claim-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - ClaimNotFoundError    → 404
+ *   - ClaimValidationError  → 400
+ */
+/**
+ * Thrown when a claim definition or value cannot be found.
+ * Maps to HTTP 404 in route handlers.
+ */
+export declare class ClaimNotFoundError extends Error {
+    constructor(identifier: string);
+}
+/**
+ * Thrown when custom claim validation fails.
+ * Examples: reserved claim name, invalid claim name format, duplicate
+ * name within application, value type mismatch.
+ * Maps to HTTP 400 in route handlers.
+ */
+export declare class ClaimValidationError extends Error {
+    constructor(message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/custom-claims/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/custom-claims/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,UAAU,EAAE,MAAM,EAG7B;CACF;AAED;;;;;GAKG;AACH,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF"}

package/dist/custom-claims/errors.js

@@ -0,0 +1,31 @@
+/**
+ * Custom claims domain error types.
+ *
+ * Custom error classes for claim-specific business rule violations.
+ * API routes map these to appropriate HTTP status codes:
+ *   - ClaimNotFoundError    → 404
+ *   - ClaimValidationError  → 400
+ */
+/**
+ * Thrown when a claim definition or value cannot be found.
+ * Maps to HTTP 404 in route handlers.
+ */
+export class ClaimNotFoundError extends Error {
+    constructor(identifier) {
+        super(`Custom claim not found: ${identifier}`);
+        this.name = 'ClaimNotFoundError';
+    }
+}
+/**
+ * Thrown when custom claim validation fails.
+ * Examples: reserved claim name, invalid claim name format, duplicate
+ * name within application, value type mismatch.
+ * Maps to HTTP 400 in route handlers.
+ */
+export class ClaimValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'ClaimValidationError';
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/custom-claims/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/custom-claims/errors.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH;;;GAGG;AACH,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAC3C,YAAY,UAAkB;QAC5B,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,IAAI,GAAG,oBAAoB,CAAC;IACnC,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAC7C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF"}

package/dist/custom-claims/index.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Custom claims module — public API barrel export.
+ *
+ * Re-exports the types, error classes, validators, and service
+ * functions that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer.
+ */
+export type { ClaimType, TokenType, CustomClaimDefinition, CustomClaimValue, CreateClaimDefinitionInput, UpdateClaimDefinitionInput, CustomClaimWithValue, } from './types.js';
+export { mapRowToDefinition, mapRowToValue, } from './types.js';
+export { ClaimNotFoundError, ClaimValidationError } from './errors.js';
+export { RESERVED_CLAIM_NAMES, isReservedClaimName, validateClaimName, validateClaimValue, } from './validators.js';
+export { createDefinition, updateDefinition, deleteDefinition, findDefinitionById, listDefinitions, setValue, getValue, deleteValue, getValuesForUser, buildCustomClaims, } from './service.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/custom-claims/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/custom-claims/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,SAAS,EACT,SAAS,EACT,qBAAqB,EACrB,gBAAgB,EAChB,0BAA0B,EAC1B,0BAA0B,EAC1B,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAGvE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAGzB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC"}

package/dist/custom-claims/index.js

@@ -0,0 +1,17 @@
+/**
+ * Custom claims module — public API barrel export.
+ *
+ * Re-exports the types, error classes, validators, and service
+ * functions that other modules need. Internal implementation details
+ * (repository, cache) are NOT exported — they are consumed only by
+ * the service layer.
+ */
+// Row mappers
+export { mapRowToDefinition, mapRowToValue, } from './types.js';
+// Errors
+export { ClaimNotFoundError, ClaimValidationError } from './errors.js';
+// Validators
+export { RESERVED_CLAIM_NAMES, isReservedClaimName, validateClaimName, validateClaimValue, } from './validators.js';
+// Service (public API)
+export { createDefinition, updateDefinition, deleteDefinition, findDefinitionById, listDefinitions, setValue, getValue, deleteValue, getValuesForUser, buildCustomClaims, } from './service.js';
+//# sourceMappingURL=index.js.map

package/dist/custom-claims/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/custom-claims/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAaH,cAAc;AACd,OAAO,EACL,kBAAkB,EAClB,aAAa,GACd,MAAM,YAAY,CAAC;AAEpB,SAAS;AACT,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAEvE,aAAa;AACb,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,iBAAiB,CAAC;AAEzB,uBAAuB;AACvB,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,eAAe,EACf,QAAQ,EACR,QAAQ,EACR,WAAW,EACX,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,cAAc,CAAC"}

package/dist/custom-claims/repository.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Custom claims repository — PostgreSQL data access layer.
+ *
+ * Provides CRUD operations for the `custom_claim_definitions` and
+ * `custom_claim_values` tables using parameterized queries. Each function
+ * acquires the pool via `getPool()` and returns mapped objects via the
+ * type mapping functions.
+ *
+ * Definitions are scoped to an application with a unique (application_id,
+ * claim_name) constraint. Values are per-user with a unique (user_id,
+ * claim_id) constraint — upsert semantics via ON CONFLICT.
+ *
+ * Key patterns:
+ * - Dynamic UPDATE for partial definition updates
+ * - Upsert for claim values (INSERT ... ON CONFLICT DO UPDATE)
+ * - Joined query for resolving user claim values with definitions
+ *
+ * Database tables: custom_claim_definitions, custom_claim_values
+ * (see migration 007_custom_claims.sql)
+ */
+import type { CustomClaimDefinition, CreateClaimDefinitionInput, UpdateClaimDefinitionInput, CustomClaimValue, CustomClaimWithValue } from './types.js';
+/**
+ * Insert a new claim definition into the database.
+ *
+ * Uses RETURNING * to get the full row back in a single round trip.
+ * The (application_id, claim_name) pair must be unique (enforced by DB).
+ * Token inclusion flags use DB defaults when not provided.
+ *
+ * @param input - Definition data to insert
+ * @returns The newly created definition
+ * @throws If (application_id, claim_name) already exists (unique constraint)
+ */
+export declare function insertDefinition(input: CreateClaimDefinitionInput): Promise<CustomClaimDefinition>;
+/**
+ * Find a claim definition by its UUID.
+ *
+ * @param id - Definition UUID
+ * @returns Definition or null if not found
+ */
+export declare function findDefinitionById(id: string): Promise<CustomClaimDefinition | null>;
+/**
+ * Find a claim definition by application ID and claim name.
+ *
+ * Used for duplicate checking and name-based lookups.
+ *
+ * @param applicationId - Application UUID
+ * @param claimName - Claim name (unique within application)
+ * @returns Definition or null if not found
+ */
+export declare function findDefinitionByName(applicationId: string, claimName: string): Promise<CustomClaimDefinition | null>;
+/**
+ * Update a claim definition's fields using a dynamic SET clause.
+ *
+ * Only explicitly provided fields (not undefined) are included in the
+ * UPDATE statement. This allows partial updates without overwriting
+ * fields that weren't specified. Null is a valid value for description
+ * (clears it).
+ *
+ * @param id - Definition UUID
+ * @param input - Fields to update (only non-undefined fields are applied)
+ * @returns Updated definition
+ * @throws Error if definition not found or no fields provided
+ */
+export declare function updateDefinition(id: string, input: UpdateClaimDefinitionInput): Promise<CustomClaimDefinition>;
+/**
+ * Delete a claim definition by ID.
+ *
+ * CASCADE constraint automatically removes all associated claim values.
+ *
+ * @param id - Definition UUID
+ * @returns true if deleted, false if not found
+ */
+export declare function deleteDefinition(id: string): Promise<boolean>;
+/**
+ * List all claim definitions for an application, ordered by claim name.
+ *
+ * Returns a simple array (no pagination) since applications typically
+ * have a manageable number of custom claims.
+ *
+ * @param applicationId - Application UUID
+ * @returns Array of definitions for the application
+ */
+export declare function listDefinitionsByApplication(applicationId: string): Promise<CustomClaimDefinition[]>;
+/**
+ * Check if a claim name already exists for a given application.
+ *
+ * Used for uniqueness validation before insert. The optional excludeId
+ * parameter allows excluding a specific definition (for future use if
+ * name updates are ever supported).
+ *
+ * @param applicationId - Application UUID
+ * @param claimName - Claim name to check
+ * @param excludeId - Optional definition ID to exclude from the check
+ * @returns true if the claim name already exists
+ */
+export declare function claimNameExists(applicationId: string, claimName: string, excludeId?: string): Promise<boolean>;
+/**
+ * Set (upsert) a claim value for a user.
+ *
+ * Uses INSERT ... ON CONFLICT (user_id, claim_id) DO UPDATE to handle
+ * both initial value setting and subsequent updates in a single query.
+ * The value is stored as JSONB.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @param value - The claim value (must match definition's claim_type)
+ * @returns The upserted claim value
+ */
+export declare function upsertValue(userId: string, claimId: string, value: unknown): Promise<CustomClaimValue>;
+/**
+ * Get a claim value for a user and claim definition.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @returns Claim value or null if not set
+ */
+export declare function findValue(userId: string, claimId: string): Promise<CustomClaimValue | null>;
+/**
+ * Delete a claim value for a user and claim definition.
+ *
+ * @param userId - User UUID
+ * @param claimId - Definition UUID
+ * @returns true if deleted, false if not found
+ */
+export declare function deleteValue(userId: string, claimId: string): Promise<boolean>;
+/**
+ * Get all claim values for a user, joined with definitions.
+ *
+ * Returns values across all applications. Used for admin views.
+ *
+ * @param userId - User UUID
+ * @returns Array of definition+value pairs
+ */
+export declare function getValuesForUser(userId: string): Promise<CustomClaimWithValue[]>;
+/**
+ * Get all claim values for a user within a specific application.
+ *
+ * This is the token claims hot path — scoped to the client's application.
+ * Returns joined definition+value pairs so the caller can filter by
+ * token type inclusion flags.
+ *
+ * @param userId - User UUID
+ * @param applicationId - Application UUID
+ * @returns Array of definition+value pairs for the application
+ */
+export declare function getValuesForUserByApp(userId: string, applicationId: string): Promise<CustomClaimWithValue[]>;
+//# sourceMappingURL=repository.d.ts.map