@shipfox/api-auth-dto 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 8 files with swc (30.24ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,30 @@
+# @shipfox/api-auth-dto
+
+## 2.0.0
+
+### Minor Changes
+
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [1b0d344]
+  - @shipfox/api-common-dto@2.0.0
+
+## 0.1.0
+
+### Minor Changes
+
+- d02c5fd: Queues auth and workspace transactional emails through module-owned outbox events so account verification, password reset, and invitation sends retry outside request transactions.
+- c0a883c: Moves the job lease capability token codec and its claims schema from the runners packages into api-auth/api-auth-dto, renaming its config to `AUTH_JOB_LEASE_TOKEN_*`, so all signed-token codecs live with authentication. Adds a shared leased-job auth context for request-scoped lease claims, and a shared `createLeaseTokenAuthMethod` (the `leased-job` auth method) registered on the auth module so any feature module can protect routes with a lease token by name.
+- 3afb7e3: Adds job execution success expressions and execution timeouts to workflow documents.
+  Renames job execution IDs in auth, runner, workflow, and timeout event contracts to the explicit `jobExecutionId` / `job_execution_id` shape.
+- 6181819: Adds runner registration sessions with bounded label contracts, session-token auth, and lease-token heartbeat ownership.
+
+### Patch Changes
+
+- e250c4c: Propagates `projectId` end-to-end into the job lease token. Workflows sources the `{workspaceId, projectId, workflowRunId, workflowRunAttemptId, jobId, jobExecutionId}` identity tuple and threads it through the runner pending/running job tables and lease claims. This is lease-shape groundwork for per-project log-ingest authorization; the stream-stamping consumer lands separately.
+- 362b3eb: Scope runner log append authorization to the dispatched step attempt carried by the job lease token.
+- 27770eb: Tightens signup, workspace, and project display-name validation with shared trimming, control and format-character rejection, length limits, and contextual client form errors.
+- Updated dependencies [27770eb]
+  - @shipfox/api-common-dto@0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/events.d.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod';
+export declare const AUTH_EMAIL_VERIFICATION_SEND_REQUESTED: "auth.email_verification.send_requested";
+export declare const AUTH_PASSWORD_RESET_SEND_REQUESTED: "auth.password_reset.send_requested";
+export declare const authEmailVerificationSendRequestedSchema: z.ZodObject<{
+    email: z.ZodString;
+    verifyLink: z.ZodString;
+}, z.core.$strip>;
+export type AuthEmailVerificationSendRequestedEvent = z.infer<typeof authEmailVerificationSendRequestedSchema>;
+export declare const authPasswordResetSendRequestedSchema: z.ZodObject<{
+    email: z.ZodString;
+    resetLink: z.ZodString;
+    expiresInHours: z.ZodNumber;
+}, z.core.$strip>;
+export type AuthPasswordResetSendRequestedEvent = z.infer<typeof authPasswordResetSendRequestedSchema>;
+export interface AuthEventMap {
+    [AUTH_EMAIL_VERIFICATION_SEND_REQUESTED]: AuthEmailVerificationSendRequestedEvent;
+    [AUTH_PASSWORD_RESET_SEND_REQUESTED]: AuthPasswordResetSendRequestedEvent;
+}
+export declare const authEventSchemas: {
+    "auth.email_verification.send_requested": z.ZodObject<{
+        email: z.ZodString;
+        verifyLink: z.ZodString;
+    }, z.core.$strip>;
+    "auth.password_reset.send_requested": z.ZodObject<{
+        email: z.ZodString;
+        resetLink: z.ZodString;
+        expiresInHours: z.ZodNumber;
+    }, z.core.$strip>;
+};
+//# sourceMappingURL=events.d.ts.map

package/dist/events.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"events.d.ts","sourceRoot":"","sources":["../src/events.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,eAAO,MAAM,sCAAsC,EACjD,wCAAiD,CAAC;AACpD,eAAO,MAAM,kCAAkC,EAAG,oCAA6C,CAAC;AAEhG,eAAO,MAAM,wCAAwC;;;iBAGnD,CAAC;AACH,MAAM,MAAM,uCAAuC,GAAG,CAAC,CAAC,KAAK,CAC3D,OAAO,wCAAwC,CAChD,CAAC;AAEF,eAAO,MAAM,oCAAoC;;;;iBAI/C,CAAC;AACH,MAAM,MAAM,mCAAmC,GAAG,CAAC,CAAC,KAAK,CACvD,OAAO,oCAAoC,CAC5C,CAAC;AAEF,MAAM,WAAW,YAAY;IAC3B,CAAC,sCAAsC,CAAC,EAAE,uCAAuC,CAAC;IAClF,CAAC,kCAAkC,CAAC,EAAE,mCAAmC,CAAC;CAC3E;AAED,eAAO,MAAM,gBAAgB;;;;;;;;;;CAGoB,CAAC"}

package/dist/events.js

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+const emailLinkSchema = z.string().url();
+export const AUTH_EMAIL_VERIFICATION_SEND_REQUESTED = 'auth.email_verification.send_requested';
+export const AUTH_PASSWORD_RESET_SEND_REQUESTED = 'auth.password_reset.send_requested';
+export const authEmailVerificationSendRequestedSchema = z.object({
+    email: z.string().email(),
+    verifyLink: emailLinkSchema
+});
+export const authPasswordResetSendRequestedSchema = z.object({
+    email: z.string().email(),
+    resetLink: emailLinkSchema,
+    expiresInHours: z.number().int().positive()
+});
+export const authEventSchemas = {
+    [AUTH_EMAIL_VERIFICATION_SEND_REQUESTED]: authEmailVerificationSendRequestedSchema,
+    [AUTH_PASSWORD_RESET_SEND_REQUESTED]: authPasswordResetSendRequestedSchema
+};
+
+//# sourceMappingURL=events.js.map

package/dist/events.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/events.ts"],"sourcesContent":["import {z} from 'zod';\n\nconst emailLinkSchema = z.string().url();\n\nexport const AUTH_EMAIL_VERIFICATION_SEND_REQUESTED =\n  'auth.email_verification.send_requested' as const;\nexport const AUTH_PASSWORD_RESET_SEND_REQUESTED = 'auth.password_reset.send_requested' as const;\n\nexport const authEmailVerificationSendRequestedSchema = z.object({\n  email: z.string().email(),\n  verifyLink: emailLinkSchema,\n});\nexport type AuthEmailVerificationSendRequestedEvent = z.infer<\n  typeof authEmailVerificationSendRequestedSchema\n>;\n\nexport const authPasswordResetSendRequestedSchema = z.object({\n  email: z.string().email(),\n  resetLink: emailLinkSchema,\n  expiresInHours: z.number().int().positive(),\n});\nexport type AuthPasswordResetSendRequestedEvent = z.infer<\n  typeof authPasswordResetSendRequestedSchema\n>;\n\nexport interface AuthEventMap {\n  [AUTH_EMAIL_VERIFICATION_SEND_REQUESTED]: AuthEmailVerificationSendRequestedEvent;\n  [AUTH_PASSWORD_RESET_SEND_REQUESTED]: AuthPasswordResetSendRequestedEvent;\n}\n\nexport const authEventSchemas = {\n  [AUTH_EMAIL_VERIFICATION_SEND_REQUESTED]: authEmailVerificationSendRequestedSchema,\n  [AUTH_PASSWORD_RESET_SEND_REQUESTED]: authPasswordResetSendRequestedSchema,\n} satisfies Record<keyof AuthEventMap, z.ZodType>;\n"],"names":["z","emailLinkSchema","string","url","AUTH_EMAIL_VERIFICATION_SEND_REQUESTED","AUTH_PASSWORD_RESET_SEND_REQUESTED","authEmailVerificationSendRequestedSchema","object","email","verifyLink","authPasswordResetSendRequestedSchema","resetLink","expiresInHours","number","int","positive","authEventSchemas"],"mappings":"AAAA,SAAQA,CAAC,QAAO,MAAM;AAEtB,MAAMC,kBAAkBD,EAAEE,MAAM,GAAGC,GAAG;AAEtC,OAAO,MAAMC,yCACX,yCAAkD;AACpD,OAAO,MAAMC,qCAAqC,qCAA8C;AAEhG,OAAO,MAAMC,2CAA2CN,EAAEO,MAAM,CAAC;IAC/DC,OAAOR,EAAEE,MAAM,GAAGM,KAAK;IACvBC,YAAYR;AACd,GAAG;AAKH,OAAO,MAAMS,uCAAuCV,EAAEO,MAAM,CAAC;IAC3DC,OAAOR,EAAEE,MAAM,GAAGM,KAAK;IACvBG,WAAWV;IACXW,gBAAgBZ,EAAEa,MAAM,GAAGC,GAAG,GAAGC,QAAQ;AAC3C,GAAG;AAUH,OAAO,MAAMC,mBAAmB;IAC9B,CAACZ,uCAAuC,EAAEE;IAC1C,CAACD,mCAAmC,EAAEK;AACxC,EAAkD"}

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+export * from './schemas/index.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,oBAAoB,CAAC"}

package/dist/index.js

@@ -0,0 +1,3 @@
+export * from './schemas/index.js';
+
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export * from './schemas/index.js';\n"],"names":[],"mappings":"AAAA,cAAc,qBAAqB"}

package/dist/schemas/auth.d.ts

@@ -0,0 +1,166 @@
+import { z } from 'zod';
+export declare const EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS = 60;
+export declare const passwordSchema: z.ZodString;
+export declare const emailSchema: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+export declare const signupBodySchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+    name: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
+    invitation_token: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type SignupBodyDto = z.infer<typeof signupBodySchema>;
+export declare const signupAcceptErrorSchema: z.ZodObject<{
+    code: z.ZodString;
+    message: z.ZodString;
+}, z.core.$strip>;
+export type SignupAcceptErrorDto = z.infer<typeof signupAcceptErrorSchema>;
+export declare const signupMembershipSchema: z.ZodObject<{
+    id: z.ZodString;
+    user_id: z.ZodString;
+    workspace_id: z.ZodString;
+}, z.core.$strip>;
+export type SignupMembershipDto = z.infer<typeof signupMembershipSchema>;
+export declare const signupResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+    token: z.ZodOptional<z.ZodString>;
+    membership: z.ZodOptional<z.ZodNullable<z.ZodObject<{
+        id: z.ZodString;
+        user_id: z.ZodString;
+        workspace_id: z.ZodString;
+    }, z.core.$strip>>>;
+    accept_error: z.ZodOptional<z.ZodObject<{
+        code: z.ZodString;
+        message: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+export type SignupResponseDto = z.infer<typeof signupResponseSchema>;
+export declare const loginBodySchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type LoginBodyDto = z.infer<typeof loginBodySchema>;
+export declare const loginResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type LoginResponseDto = z.infer<typeof loginResponseSchema>;
+export declare const refreshResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type RefreshResponseDto = z.infer<typeof refreshResponseSchema>;
+export declare const meResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type MeResponseDto = z.infer<typeof meResponseSchema>;
+export declare const logoutBodySchema: z.ZodObject<{}, z.core.$strip>;
+export type LogoutBodyDto = z.infer<typeof logoutBodySchema>;
+export declare const changePasswordBodySchema: z.ZodObject<{
+    current_password: z.ZodString;
+    new_password: z.ZodString;
+}, z.core.$strip>;
+export type ChangePasswordBodyDto = z.infer<typeof changePasswordBodySchema>;
+export declare const passwordResetRequestBodySchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>;
+export type PasswordResetRequestBodyDto = z.infer<typeof passwordResetRequestBodySchema>;
+export declare const passwordResetConfirmBodySchema: z.ZodObject<{
+    token: z.ZodString;
+    new_password: z.ZodString;
+}, z.core.$strip>;
+export type PasswordResetConfirmBodyDto = z.infer<typeof passwordResetConfirmBodySchema>;
+export declare const passwordResetConfirmResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type PasswordResetConfirmResponseDto = z.infer<typeof passwordResetConfirmResponseSchema>;
+export declare const verifyEmailConfirmBodySchema: z.ZodObject<{
+    token: z.ZodString;
+}, z.core.$strip>;
+export type VerifyEmailConfirmBodyDto = z.infer<typeof verifyEmailConfirmBodySchema>;
+export declare const verifyEmailConfirmResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type VerifyEmailConfirmResponseDto = z.infer<typeof verifyEmailConfirmResponseSchema>;
+export declare const verifyEmailResendBodySchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+}, z.core.$strip>;
+export type VerifyEmailResendBodyDto = z.infer<typeof verifyEmailResendBodySchema>;
+export declare const verifyEmailResendResponseSchema: z.ZodObject<{
+    next_resend_available_at: z.ZodString;
+}, z.core.$strip>;
+export type VerifyEmailResendResponseDto = z.infer<typeof verifyEmailResendResponseSchema>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/schemas/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/schemas/auth.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,eAAO,MAAM,0CAA0C,KAAK,CAAC;AAE7D,eAAO,MAAM,cAAc,aAA8B,CAAC;AAC1D,eAAO,MAAM,WAAW,wDAIoB,CAAC;AAE7C,eAAO,MAAM,gBAAgB;;;;;iBAK3B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D,eAAO,MAAM,uBAAuB;;;iBAGlC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,eAAO,MAAM,sBAAsB;;;;iBAIjC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEzE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;iBAK/B,CAAC;AAEH,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAErE,eAAO,MAAM,eAAe;;;iBAG1B,CAAC;AAEH,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAE3D,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;iBAG9B,CAAC;AAEH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEnE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;iBAAsB,CAAC;AAEzD,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEvE,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;iBAE3B,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D,eAAO,MAAM,gBAAgB,gCAAe,CAAC;AAE7C,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE7D,eAAO,MAAM,wBAAwB;;;iBAGnC,CAAC;AAEH,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE7E,eAAO,MAAM,8BAA8B;;iBAEzC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEzF,eAAO,MAAM,8BAA8B;;;iBAGzC,CAAC;AAEH,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEzF,eAAO,MAAM,kCAAkC;;;;;;;;;;;;;;;iBAAsB,CAAC;AAEtE,MAAM,MAAM,+BAA+B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kCAAkC,CAAC,CAAC;AAEjG,eAAO,MAAM,4BAA4B;;iBAEvC,CAAC;AAEH,MAAM,MAAM,yBAAyB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAErF,eAAO,MAAM,gCAAgC;;;;;;;;;;;;;;;iBAAsB,CAAC;AAEpE,MAAM,MAAM,6BAA6B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gCAAgC,CAAC,CAAC;AAE7F,eAAO,MAAM,2BAA2B;;iBAEtC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEnF,eAAO,MAAM,+BAA+B;;iBAE1C,CAAC;AAEH,MAAM,MAAM,4BAA4B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,+BAA+B,CAAC,CAAC"}

package/dist/schemas/auth.js

@@ -0,0 +1,64 @@
+import { displayNameSchema } from '@shipfox/api-common-dto';
+import { z } from 'zod';
+import { userDtoSchema } from './user.js';
+export const EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS = 60;
+export const passwordSchema = z.string().min(12).max(128);
+export const emailSchema = z.string().email().max(254).transform((value)=>value.toLowerCase());
+export const signupBodySchema = z.object({
+    email: emailSchema,
+    password: passwordSchema,
+    name: displayNameSchema,
+    invitation_token: z.string().min(1).max(256).optional()
+});
+export const signupAcceptErrorSchema = z.object({
+    code: z.string(),
+    message: z.string()
+});
+export const signupMembershipSchema = z.object({
+    id: z.string().uuid(),
+    user_id: z.string().uuid(),
+    workspace_id: z.string().uuid()
+});
+export const signupResponseSchema = z.object({
+    user: userDtoSchema,
+    token: z.string().optional(),
+    membership: signupMembershipSchema.nullable().optional(),
+    accept_error: signupAcceptErrorSchema.optional()
+});
+export const loginBodySchema = z.object({
+    email: emailSchema,
+    password: z.string().min(1).max(128)
+});
+export const loginResponseSchema = z.object({
+    token: z.string(),
+    user: userDtoSchema
+});
+export const refreshResponseSchema = loginResponseSchema;
+export const meResponseSchema = z.object({
+    user: userDtoSchema
+});
+export const logoutBodySchema = z.object({});
+export const changePasswordBodySchema = z.object({
+    current_password: z.string().min(1).max(128),
+    new_password: passwordSchema
+});
+export const passwordResetRequestBodySchema = z.object({
+    email: emailSchema
+});
+export const passwordResetConfirmBodySchema = z.object({
+    token: z.string().min(1),
+    new_password: passwordSchema
+});
+export const passwordResetConfirmResponseSchema = loginResponseSchema;
+export const verifyEmailConfirmBodySchema = z.object({
+    token: z.string().min(1)
+});
+export const verifyEmailConfirmResponseSchema = loginResponseSchema;
+export const verifyEmailResendBodySchema = z.object({
+    email: emailSchema
+});
+export const verifyEmailResendResponseSchema = z.object({
+    next_resend_available_at: z.string().datetime()
+});
+
+//# sourceMappingURL=auth.js.map

package/dist/schemas/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/auth.ts"],"sourcesContent":["import {displayNameSchema} from '@shipfox/api-common-dto';\nimport {z} from 'zod';\nimport {userDtoSchema} from './user.js';\n\nexport const EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS = 60;\n\nexport const passwordSchema = z.string().min(12).max(128);\nexport const emailSchema = z\n  .string()\n  .email()\n  .max(254)\n  .transform((value) => value.toLowerCase());\n\nexport const signupBodySchema = z.object({\n  email: emailSchema,\n  password: passwordSchema,\n  name: displayNameSchema,\n  invitation_token: z.string().min(1).max(256).optional(),\n});\n\nexport type SignupBodyDto = z.infer<typeof signupBodySchema>;\n\nexport const signupAcceptErrorSchema = z.object({\n  code: z.string(),\n  message: z.string(),\n});\n\nexport type SignupAcceptErrorDto = z.infer<typeof signupAcceptErrorSchema>;\n\nexport const signupMembershipSchema = z.object({\n  id: z.string().uuid(),\n  user_id: z.string().uuid(),\n  workspace_id: z.string().uuid(),\n});\n\nexport type SignupMembershipDto = z.infer<typeof signupMembershipSchema>;\n\nexport const signupResponseSchema = z.object({\n  user: userDtoSchema,\n  token: z.string().optional(),\n  membership: signupMembershipSchema.nullable().optional(),\n  accept_error: signupAcceptErrorSchema.optional(),\n});\n\nexport type SignupResponseDto = z.infer<typeof signupResponseSchema>;\n\nexport const loginBodySchema = z.object({\n  email: emailSchema,\n  password: z.string().min(1).max(128),\n});\n\nexport type LoginBodyDto = z.infer<typeof loginBodySchema>;\n\nexport const loginResponseSchema = z.object({\n  token: z.string(),\n  user: userDtoSchema,\n});\n\nexport type LoginResponseDto = z.infer<typeof loginResponseSchema>;\n\nexport const refreshResponseSchema = loginResponseSchema;\n\nexport type RefreshResponseDto = z.infer<typeof refreshResponseSchema>;\n\nexport const meResponseSchema = z.object({\n  user: userDtoSchema,\n});\n\nexport type MeResponseDto = z.infer<typeof meResponseSchema>;\n\nexport const logoutBodySchema = z.object({});\n\nexport type LogoutBodyDto = z.infer<typeof logoutBodySchema>;\n\nexport const changePasswordBodySchema = z.object({\n  current_password: z.string().min(1).max(128),\n  new_password: passwordSchema,\n});\n\nexport type ChangePasswordBodyDto = z.infer<typeof changePasswordBodySchema>;\n\nexport const passwordResetRequestBodySchema = z.object({\n  email: emailSchema,\n});\n\nexport type PasswordResetRequestBodyDto = z.infer<typeof passwordResetRequestBodySchema>;\n\nexport const passwordResetConfirmBodySchema = z.object({\n  token: z.string().min(1),\n  new_password: passwordSchema,\n});\n\nexport type PasswordResetConfirmBodyDto = z.infer<typeof passwordResetConfirmBodySchema>;\n\nexport const passwordResetConfirmResponseSchema = loginResponseSchema;\n\nexport type PasswordResetConfirmResponseDto = z.infer<typeof passwordResetConfirmResponseSchema>;\n\nexport const verifyEmailConfirmBodySchema = z.object({\n  token: z.string().min(1),\n});\n\nexport type VerifyEmailConfirmBodyDto = z.infer<typeof verifyEmailConfirmBodySchema>;\n\nexport const verifyEmailConfirmResponseSchema = loginResponseSchema;\n\nexport type VerifyEmailConfirmResponseDto = z.infer<typeof verifyEmailConfirmResponseSchema>;\n\nexport const verifyEmailResendBodySchema = z.object({\n  email: emailSchema,\n});\n\nexport type VerifyEmailResendBodyDto = z.infer<typeof verifyEmailResendBodySchema>;\n\nexport const verifyEmailResendResponseSchema = z.object({\n  next_resend_available_at: z.string().datetime(),\n});\n\nexport type VerifyEmailResendResponseDto = z.infer<typeof verifyEmailResendResponseSchema>;\n"],"names":["displayNameSchema","z","userDtoSchema","EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS","passwordSchema","string","min","max","emailSchema","email","transform","value","toLowerCase","signupBodySchema","object","password","name","invitation_token","optional","signupAcceptErrorSchema","code","message","signupMembershipSchema","id","uuid","user_id","workspace_id","signupResponseSchema","user","token","membership","nullable","accept_error","loginBodySchema","loginResponseSchema","refreshResponseSchema","meResponseSchema","logoutBodySchema","changePasswordBodySchema","current_password","new_password","passwordResetRequestBodySchema","passwordResetConfirmBodySchema","passwordResetConfirmResponseSchema","verifyEmailConfirmBodySchema","verifyEmailConfirmResponseSchema","verifyEmailResendBodySchema","verifyEmailResendResponseSchema","next_resend_available_at","datetime"],"mappings":"AAAA,SAAQA,iBAAiB,QAAO,0BAA0B;AAC1D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,aAAa,QAAO,YAAY;AAExC,OAAO,MAAMC,6CAA6C,GAAG;AAE7D,OAAO,MAAMC,iBAAiBH,EAAEI,MAAM,GAAGC,GAAG,CAAC,IAAIC,GAAG,CAAC,KAAK;AAC1D,OAAO,MAAMC,cAAcP,EACxBI,MAAM,GACNI,KAAK,GACLF,GAAG,CAAC,KACJG,SAAS,CAAC,CAACC,QAAUA,MAAMC,WAAW,IAAI;AAE7C,OAAO,MAAMC,mBAAmBZ,EAAEa,MAAM,CAAC;IACvCL,OAAOD;IACPO,UAAUX;IACVY,MAAMhB;IACNiB,kBAAkBhB,EAAEI,MAAM,GAAGC,GAAG,CAAC,GAAGC,GAAG,CAAC,KAAKW,QAAQ;AACvD,GAAG;AAIH,OAAO,MAAMC,0BAA0BlB,EAAEa,MAAM,CAAC;IAC9CM,MAAMnB,EAAEI,MAAM;IACdgB,SAASpB,EAAEI,MAAM;AACnB,GAAG;AAIH,OAAO,MAAMiB,yBAAyBrB,EAAEa,MAAM,CAAC;IAC7CS,IAAItB,EAAEI,MAAM,GAAGmB,IAAI;IACnBC,SAASxB,EAAEI,MAAM,GAAGmB,IAAI;IACxBE,cAAczB,EAAEI,MAAM,GAAGmB,IAAI;AAC/B,GAAG;AAIH,OAAO,MAAMG,uBAAuB1B,EAAEa,MAAM,CAAC;IAC3Cc,MAAM1B;IACN2B,OAAO5B,EAAEI,MAAM,GAAGa,QAAQ;IAC1BY,YAAYR,uBAAuBS,QAAQ,GAAGb,QAAQ;IACtDc,cAAcb,wBAAwBD,QAAQ;AAChD,GAAG;AAIH,OAAO,MAAMe,kBAAkBhC,EAAEa,MAAM,CAAC;IACtCL,OAAOD;IACPO,UAAUd,EAAEI,MAAM,GAAGC,GAAG,CAAC,GAAGC,GAAG,CAAC;AAClC,GAAG;AAIH,OAAO,MAAM2B,sBAAsBjC,EAAEa,MAAM,CAAC;IAC1Ce,OAAO5B,EAAEI,MAAM;IACfuB,MAAM1B;AACR,GAAG;AAIH,OAAO,MAAMiC,wBAAwBD,oBAAoB;AAIzD,OAAO,MAAME,mBAAmBnC,EAAEa,MAAM,CAAC;IACvCc,MAAM1B;AACR,GAAG;AAIH,OAAO,MAAMmC,mBAAmBpC,EAAEa,MAAM,CAAC,CAAC,GAAG;AAI7C,OAAO,MAAMwB,2BAA2BrC,EAAEa,MAAM,CAAC;IAC/CyB,kBAAkBtC,EAAEI,MAAM,GAAGC,GAAG,CAAC,GAAGC,GAAG,CAAC;IACxCiC,cAAcpC;AAChB,GAAG;AAIH,OAAO,MAAMqC,iCAAiCxC,EAAEa,MAAM,CAAC;IACrDL,OAAOD;AACT,GAAG;AAIH,OAAO,MAAMkC,iCAAiCzC,EAAEa,MAAM,CAAC;IACrDe,OAAO5B,EAAEI,MAAM,GAAGC,GAAG,CAAC;IACtBkC,cAAcpC;AAChB,GAAG;AAIH,OAAO,MAAMuC,qCAAqCT,oBAAoB;AAItE,OAAO,MAAMU,+BAA+B3C,EAAEa,MAAM,CAAC;IACnDe,OAAO5B,EAAEI,MAAM,GAAGC,GAAG,CAAC;AACxB,GAAG;AAIH,OAAO,MAAMuC,mCAAmCX,oBAAoB;AAIpE,OAAO,MAAMY,8BAA8B7C,EAAEa,MAAM,CAAC;IAClDL,OAAOD;AACT,GAAG;AAIH,OAAO,MAAMuC,kCAAkC9C,EAAEa,MAAM,CAAC;IACtDkC,0BAA0B/C,EAAEI,MAAM,GAAG4C,QAAQ;AAC/C,GAAG"}

package/dist/schemas/e2e.d.ts

@@ -0,0 +1,52 @@
+import { z } from 'zod';
+export declare const e2eCreateUserBodySchema: z.ZodObject<{
+    email: z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>;
+    password: z.ZodString;
+    verified: z.ZodBoolean;
+    name: z.ZodOptional<z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>>;
+}, z.core.$strip>;
+export type E2eCreateUserBodyDto = z.infer<typeof e2eCreateUserBodySchema>;
+export declare const e2eCreateUserResponseSchema: z.ZodObject<{
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+    email: z.ZodString;
+    password: z.ZodString;
+}, z.core.$strip>;
+export type E2eCreateUserResponseDto = z.infer<typeof e2eCreateUserResponseSchema>;
+export declare const e2eCreateSessionBodySchema: z.ZodObject<{
+    user_id: z.ZodOptional<z.ZodString>;
+    email: z.ZodOptional<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>>;
+}, z.core.$strip>;
+export type E2eCreateSessionBodyDto = z.infer<typeof e2eCreateSessionBodySchema>;
+export declare const e2eCreateSessionResponseSchema: z.ZodObject<{
+    token: z.ZodString;
+    user: z.ZodObject<{
+        id: z.ZodString;
+        email: z.ZodString;
+        name: z.ZodNullable<z.ZodString>;
+        email_verified_at: z.ZodNullable<z.ZodString>;
+        status: z.ZodEnum<{
+            active: "active";
+            suspended: "suspended";
+            deleted: "deleted";
+        }>;
+        created_at: z.ZodString;
+        updated_at: z.ZodString;
+    }, z.core.$strip>;
+}, z.core.$strip>;
+export type E2eCreateSessionResponseDto = z.infer<typeof e2eCreateSessionResponseSchema>;
+export type E2eSessionDto = E2eCreateSessionResponseDto & {
+    setCookie: string;
+};
+//# sourceMappingURL=e2e.d.ts.map

package/dist/schemas/e2e.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"e2e.d.ts","sourceRoot":"","sources":["../../src/schemas/e2e.ts"],"names":[],"mappings":"AACA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAItB,eAAO,MAAM,uBAAuB;;;;;iBAKlC,CAAC;AAEH,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAE3E,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;iBAItC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAC;AAEnF,eAAO,MAAM,0BAA0B;;;iBAOnC,CAAC;AAEL,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAC;AAEjF,eAAO,MAAM,8BAA8B;;;;;;;;;;;;;;;iBAAsB,CAAC;AAElE,MAAM,MAAM,2BAA2B,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC;AAEzF,MAAM,MAAM,aAAa,GAAG,2BAA2B,GAAG;IACxD,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC"}

package/dist/schemas/e2e.js

@@ -0,0 +1,24 @@
+import { displayNameSchema } from '@shipfox/api-common-dto';
+import { z } from 'zod';
+import { emailSchema, loginResponseSchema, passwordSchema } from './auth.js';
+import { userDtoSchema } from './user.js';
+export const e2eCreateUserBodySchema = z.object({
+    email: emailSchema,
+    password: passwordSchema,
+    verified: z.boolean(),
+    name: displayNameSchema.optional()
+});
+export const e2eCreateUserResponseSchema = z.object({
+    user: userDtoSchema,
+    email: z.string().email(),
+    password: passwordSchema
+});
+export const e2eCreateSessionBodySchema = z.object({
+    user_id: z.string().uuid().optional(),
+    email: emailSchema.optional()
+}).refine((value)=>Boolean(value.user_id || value.email), {
+    message: 'Either user_id or email is required'
+});
+export const e2eCreateSessionResponseSchema = loginResponseSchema;
+
+//# sourceMappingURL=e2e.js.map

package/dist/schemas/e2e.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/e2e.ts"],"sourcesContent":["import {displayNameSchema} from '@shipfox/api-common-dto';\nimport {z} from 'zod';\nimport {emailSchema, loginResponseSchema, passwordSchema} from './auth.js';\nimport {userDtoSchema} from './user.js';\n\nexport const e2eCreateUserBodySchema = z.object({\n  email: emailSchema,\n  password: passwordSchema,\n  verified: z.boolean(),\n  name: displayNameSchema.optional(),\n});\n\nexport type E2eCreateUserBodyDto = z.infer<typeof e2eCreateUserBodySchema>;\n\nexport const e2eCreateUserResponseSchema = z.object({\n  user: userDtoSchema,\n  email: z.string().email(),\n  password: passwordSchema,\n});\n\nexport type E2eCreateUserResponseDto = z.infer<typeof e2eCreateUserResponseSchema>;\n\nexport const e2eCreateSessionBodySchema = z\n  .object({\n    user_id: z.string().uuid().optional(),\n    email: emailSchema.optional(),\n  })\n  .refine((value) => Boolean(value.user_id || value.email), {\n    message: 'Either user_id or email is required',\n  });\n\nexport type E2eCreateSessionBodyDto = z.infer<typeof e2eCreateSessionBodySchema>;\n\nexport const e2eCreateSessionResponseSchema = loginResponseSchema;\n\nexport type E2eCreateSessionResponseDto = z.infer<typeof e2eCreateSessionResponseSchema>;\n\nexport type E2eSessionDto = E2eCreateSessionResponseDto & {\n  setCookie: string;\n};\n"],"names":["displayNameSchema","z","emailSchema","loginResponseSchema","passwordSchema","userDtoSchema","e2eCreateUserBodySchema","object","email","password","verified","boolean","name","optional","e2eCreateUserResponseSchema","user","string","e2eCreateSessionBodySchema","user_id","uuid","refine","value","Boolean","message","e2eCreateSessionResponseSchema"],"mappings":"AAAA,SAAQA,iBAAiB,QAAO,0BAA0B;AAC1D,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,WAAW,EAAEC,mBAAmB,EAAEC,cAAc,QAAO,YAAY;AAC3E,SAAQC,aAAa,QAAO,YAAY;AAExC,OAAO,MAAMC,0BAA0BL,EAAEM,MAAM,CAAC;IAC9CC,OAAON;IACPO,UAAUL;IACVM,UAAUT,EAAEU,OAAO;IACnBC,MAAMZ,kBAAkBa,QAAQ;AAClC,GAAG;AAIH,OAAO,MAAMC,8BAA8Bb,EAAEM,MAAM,CAAC;IAClDQ,MAAMV;IACNG,OAAOP,EAAEe,MAAM,GAAGR,KAAK;IACvBC,UAAUL;AACZ,GAAG;AAIH,OAAO,MAAMa,6BAA6BhB,EACvCM,MAAM,CAAC;IACNW,SAASjB,EAAEe,MAAM,GAAGG,IAAI,GAAGN,QAAQ;IACnCL,OAAON,YAAYW,QAAQ;AAC7B,GACCO,MAAM,CAAC,CAACC,QAAUC,QAAQD,MAAMH,OAAO,IAAIG,MAAMb,KAAK,GAAG;IACxDe,SAAS;AACX,GAAG;AAIL,OAAO,MAAMC,iCAAiCrB,oBAAoB"}

package/dist/schemas/index.d.ts

@@ -0,0 +1,7 @@
+export { AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, AUTH_PASSWORD_RESET_SEND_REQUESTED, type AuthEmailVerificationSendRequestedEvent, type AuthEventMap, type AuthPasswordResetSendRequestedEvent, authEmailVerificationSendRequestedSchema, authEventSchemas, authPasswordResetSendRequestedSchema, } from '../events.js';
+export { type ChangePasswordBodyDto, changePasswordBodySchema, EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS, emailSchema, type LoginBodyDto, type LoginResponseDto, type LogoutBodyDto, loginBodySchema, loginResponseSchema, logoutBodySchema, type MeResponseDto, meResponseSchema, type PasswordResetConfirmBodyDto, type PasswordResetConfirmResponseDto, type PasswordResetRequestBodyDto, passwordResetConfirmBodySchema, passwordResetConfirmResponseSchema, passwordResetRequestBodySchema, passwordSchema, type RefreshResponseDto, refreshResponseSchema, type SignupAcceptErrorDto, type SignupBodyDto, type SignupMembershipDto, type SignupResponseDto, signupAcceptErrorSchema, signupBodySchema, signupMembershipSchema, signupResponseSchema, type VerifyEmailConfirmBodyDto, type VerifyEmailConfirmResponseDto, type VerifyEmailResendBodyDto, type VerifyEmailResendResponseDto, verifyEmailConfirmBodySchema, verifyEmailConfirmResponseSchema, verifyEmailResendBodySchema, verifyEmailResendResponseSchema, } from './auth.js';
+export { type E2eCreateSessionBodyDto, type E2eCreateSessionResponseDto, type E2eCreateUserBodyDto, type E2eCreateUserResponseDto, type E2eSessionDto, e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema, e2eCreateUserBodySchema, e2eCreateUserResponseSchema, } from './e2e.js';
+export { JOB_LEASE_TOKEN_AUDIENCE, type JobLeaseTokenClaims, jobLeaseTokenClaimsSchema, } from './job-lease-token.js';
+export { RUNNER_SESSION_TOKEN_AUDIENCE, type RunnerSessionTokenClaims, runnerSessionTokenClaimsSchema, } from './runner-session-token.js';
+export { type UserDto, userDtoSchema, userStatusSchema } from './user.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/schemas/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/schemas/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,sCAAsC,EACtC,kCAAkC,EAClC,KAAK,uCAAuC,EAC5C,KAAK,YAAY,EACjB,KAAK,mCAAmC,EACxC,wCAAwC,EACxC,gBAAgB,EAChB,oCAAoC,GACrC,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,KAAK,qBAAqB,EAC1B,wBAAwB,EACxB,0CAA0C,EAC1C,WAAW,EACX,KAAK,YAAY,EACjB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,eAAe,EACf,mBAAmB,EACnB,gBAAgB,EAChB,KAAK,aAAa,EAClB,gBAAgB,EAChB,KAAK,2BAA2B,EAChC,KAAK,+BAA+B,EACpC,KAAK,2BAA2B,EAChC,8BAA8B,EAC9B,kCAAkC,EAClC,8BAA8B,EAC9B,cAAc,EACd,KAAK,kBAAkB,EACvB,qBAAqB,EACrB,KAAK,oBAAoB,EACzB,KAAK,aAAa,EAClB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,uBAAuB,EACvB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,yBAAyB,EAC9B,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,KAAK,4BAA4B,EACjC,4BAA4B,EAC5B,gCAAgC,EAChC,2BAA2B,EAC3B,+BAA+B,GAChC,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,2BAA2B,EAChC,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,aAAa,EAClB,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,2BAA2B,GAC5B,MAAM,UAAU,CAAC;AAClB,OAAO,EACL,wBAAwB,EACxB,KAAK,mBAAmB,EACxB,yBAAyB,GAC1B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,6BAA6B,EAC7B,KAAK,wBAAwB,EAC7B,8BAA8B,GAC/B,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAC,KAAK,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAC,MAAM,WAAW,CAAC"}

package/dist/schemas/index.js

@@ -0,0 +1,8 @@
+export { AUTH_EMAIL_VERIFICATION_SEND_REQUESTED, AUTH_PASSWORD_RESET_SEND_REQUESTED, authEmailVerificationSendRequestedSchema, authEventSchemas, authPasswordResetSendRequestedSchema } from '../events.js';
+export { changePasswordBodySchema, EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS, emailSchema, loginBodySchema, loginResponseSchema, logoutBodySchema, meResponseSchema, passwordResetConfirmBodySchema, passwordResetConfirmResponseSchema, passwordResetRequestBodySchema, passwordSchema, refreshResponseSchema, signupAcceptErrorSchema, signupBodySchema, signupMembershipSchema, signupResponseSchema, verifyEmailConfirmBodySchema, verifyEmailConfirmResponseSchema, verifyEmailResendBodySchema, verifyEmailResendResponseSchema } from './auth.js';
+export { e2eCreateSessionBodySchema, e2eCreateSessionResponseSchema, e2eCreateUserBodySchema, e2eCreateUserResponseSchema } from './e2e.js';
+export { JOB_LEASE_TOKEN_AUDIENCE, jobLeaseTokenClaimsSchema } from './job-lease-token.js';
+export { RUNNER_SESSION_TOKEN_AUDIENCE, runnerSessionTokenClaimsSchema } from './runner-session-token.js';
+export { userDtoSchema, userStatusSchema } from './user.js';
+
+//# sourceMappingURL=index.js.map

package/dist/schemas/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/index.ts"],"sourcesContent":["export {\n  AUTH_EMAIL_VERIFICATION_SEND_REQUESTED,\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEmailVerificationSendRequestedEvent,\n  type AuthEventMap,\n  type AuthPasswordResetSendRequestedEvent,\n  authEmailVerificationSendRequestedSchema,\n  authEventSchemas,\n  authPasswordResetSendRequestedSchema,\n} from '../events.js';\nexport {\n  type ChangePasswordBodyDto,\n  changePasswordBodySchema,\n  EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS,\n  emailSchema,\n  type LoginBodyDto,\n  type LoginResponseDto,\n  type LogoutBodyDto,\n  loginBodySchema,\n  loginResponseSchema,\n  logoutBodySchema,\n  type MeResponseDto,\n  meResponseSchema,\n  type PasswordResetConfirmBodyDto,\n  type PasswordResetConfirmResponseDto,\n  type PasswordResetRequestBodyDto,\n  passwordResetConfirmBodySchema,\n  passwordResetConfirmResponseSchema,\n  passwordResetRequestBodySchema,\n  passwordSchema,\n  type RefreshResponseDto,\n  refreshResponseSchema,\n  type SignupAcceptErrorDto,\n  type SignupBodyDto,\n  type SignupMembershipDto,\n  type SignupResponseDto,\n  signupAcceptErrorSchema,\n  signupBodySchema,\n  signupMembershipSchema,\n  signupResponseSchema,\n  type VerifyEmailConfirmBodyDto,\n  type VerifyEmailConfirmResponseDto,\n  type VerifyEmailResendBodyDto,\n  type VerifyEmailResendResponseDto,\n  verifyEmailConfirmBodySchema,\n  verifyEmailConfirmResponseSchema,\n  verifyEmailResendBodySchema,\n  verifyEmailResendResponseSchema,\n} from './auth.js';\nexport {\n  type E2eCreateSessionBodyDto,\n  type E2eCreateSessionResponseDto,\n  type E2eCreateUserBodyDto,\n  type E2eCreateUserResponseDto,\n  type E2eSessionDto,\n  e2eCreateSessionBodySchema,\n  e2eCreateSessionResponseSchema,\n  e2eCreateUserBodySchema,\n  e2eCreateUserResponseSchema,\n} from './e2e.js';\nexport {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from './job-lease-token.js';\nexport {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from './runner-session-token.js';\nexport {type UserDto, userDtoSchema, userStatusSchema} from './user.js';\n"],"names":["AUTH_EMAIL_VERIFICATION_SEND_REQUESTED","AUTH_PASSWORD_RESET_SEND_REQUESTED","authEmailVerificationSendRequestedSchema","authEventSchemas","authPasswordResetSendRequestedSchema","changePasswordBodySchema","EMAIL_VERIFICATION_RESEND_COOLDOWN_SECONDS","emailSchema","loginBodySchema","loginResponseSchema","logoutBodySchema","meResponseSchema","passwordResetConfirmBodySchema","passwordResetConfirmResponseSchema","passwordResetRequestBodySchema","passwordSchema","refreshResponseSchema","signupAcceptErrorSchema","signupBodySchema","signupMembershipSchema","signupResponseSchema","verifyEmailConfirmBodySchema","verifyEmailConfirmResponseSchema","verifyEmailResendBodySchema","verifyEmailResendResponseSchema","e2eCreateSessionBodySchema","e2eCreateSessionResponseSchema","e2eCreateUserBodySchema","e2eCreateUserResponseSchema","JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","userDtoSchema","userStatusSchema"],"mappings":"AAAA,SACEA,sCAAsC,EACtCC,kCAAkC,EAIlCC,wCAAwC,EACxCC,gBAAgB,EAChBC,oCAAoC,QAC/B,eAAe;AACtB,SAEEC,wBAAwB,EACxBC,0CAA0C,EAC1CC,WAAW,EAIXC,eAAe,EACfC,mBAAmB,EACnBC,gBAAgB,EAEhBC,gBAAgB,EAIhBC,8BAA8B,EAC9BC,kCAAkC,EAClCC,8BAA8B,EAC9BC,cAAc,EAEdC,qBAAqB,EAKrBC,uBAAuB,EACvBC,gBAAgB,EAChBC,sBAAsB,EACtBC,oBAAoB,EAKpBC,4BAA4B,EAC5BC,gCAAgC,EAChCC,2BAA2B,EAC3BC,+BAA+B,QAC1B,YAAY;AACnB,SAMEC,0BAA0B,EAC1BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,2BAA2B,QACtB,WAAW;AAClB,SACEC,wBAAwB,EAExBC,yBAAyB,QACpB,uBAAuB;AAC9B,SACEC,6BAA6B,EAE7BC,8BAA8B,QACzB,4BAA4B;AACnC,SAAsBC,aAAa,EAAEC,gBAAgB,QAAO,YAAY"}

package/dist/schemas/job-lease-token.d.ts

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+/**
+ * Audience claim binding a token to the job-lease use case. Distinct from auth
+ * tokens (separate secret) — this is defense-in-depth so the two token classes stay
+ * non-interchangeable even if a verifier is ever misconfigured.
+ */
+export declare const JOB_LEASE_TOKEN_AUDIENCE = "runner-job-lease";
+export declare const jobLeaseTokenClaimsSchema: z.ZodObject<{
+    workflowRunId: z.ZodString;
+    workflowRunAttempt: z.ZodOptional<z.ZodNumber>;
+    workflowRunAttemptId: z.ZodString;
+    jobId: z.ZodString;
+    jobExecutionId: z.ZodString;
+    projectId: z.ZodString;
+    workspaceId: z.ZodString;
+    runnerSessionId: z.ZodString;
+    currentStepId: z.ZodOptional<z.ZodString>;
+    currentStepAttempt: z.ZodOptional<z.ZodNumber>;
+    aud: z.ZodLiteral<"runner-job-lease">;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+export type JobLeaseTokenClaims = z.infer<typeof jobLeaseTokenClaimsSchema>;
+//# sourceMappingURL=job-lease-token.d.ts.map

package/dist/schemas/job-lease-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/schemas/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,qBAAqB,CAAC;AAE3D,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;iBAepC,CAAC;AAEH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC"}

package/dist/schemas/job-lease-token.js

@@ -0,0 +1,24 @@
+import { z } from 'zod';
+/**
+ * Audience claim binding a token to the job-lease use case. Distinct from auth
+ * tokens (separate secret) — this is defense-in-depth so the two token classes stay
+ * non-interchangeable even if a verifier is ever misconfigured.
+ */ export const JOB_LEASE_TOKEN_AUDIENCE = 'runner-job-lease';
+export const jobLeaseTokenClaimsSchema = z.object({
+    workflowRunId: z.string().uuid(),
+    workflowRunAttempt: z.number().int().positive().optional(),
+    workflowRunAttemptId: z.string().uuid(),
+    jobId: z.string().uuid(),
+    jobExecutionId: z.string().uuid(),
+    projectId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    runnerSessionId: z.string().uuid(),
+    // Narrows append-log authorization to the step attempt currently dispatched to the runner.
+    currentStepId: z.string().uuid().optional(),
+    currentStepAttempt: z.number().int().positive().optional(),
+    aud: z.literal(JOB_LEASE_TOKEN_AUDIENCE),
+    iat: z.number().int(),
+    exp: z.number().int()
+});
+
+//# sourceMappingURL=job-lease-token.js.map

package/dist/schemas/job-lease-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/schemas/job-lease-token.ts"],"sourcesContent":["import {z} from 'zod';\n\n/**\n * Audience claim binding a token to the job-lease use case. Distinct from auth\n * tokens (separate secret) — this is defense-in-depth so the two token classes stay\n * non-interchangeable even if a verifier is ever misconfigured.\n */\nexport const JOB_LEASE_TOKEN_AUDIENCE = 'runner-job-lease';\n\nexport const jobLeaseTokenClaimsSchema = z.object({\n  workflowRunId: z.string().uuid(),\n  workflowRunAttempt: z.number().int().positive().optional(),\n  workflowRunAttemptId: z.string().uuid(),\n  jobId: z.string().uuid(),\n  jobExecutionId: z.string().uuid(),\n  projectId: z.string().uuid(),\n  workspaceId: z.string().uuid(),\n  runnerSessionId: z.string().uuid(),\n  // Narrows append-log authorization to the step attempt currently dispatched to the runner.\n  currentStepId: z.string().uuid().optional(),\n  currentStepAttempt: z.number().int().positive().optional(),\n  aud: z.literal(JOB_LEASE_TOKEN_AUDIENCE),\n  iat: z.number().int(),\n  exp: z.number().int(),\n});\n\nexport type JobLeaseTokenClaims = z.infer<typeof jobLeaseTokenClaimsSchema>;\n"],"names":["z","JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","object","workflowRunId","string","uuid","workflowRunAttempt","number","int","positive","optional","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","currentStepId","currentStepAttempt","aud","literal","iat","exp"],"mappings":"AAAA,SAAQA,CAAC,QAAO,MAAM;AAEtB;;;;CAIC,GACD,OAAO,MAAMC,2BAA2B,mBAAmB;AAE3D,OAAO,MAAMC,4BAA4BF,EAAEG,MAAM,CAAC;IAChDC,eAAeJ,EAAEK,MAAM,GAAGC,IAAI;IAC9BC,oBAAoBP,EAAEQ,MAAM,GAAGC,GAAG,GAAGC,QAAQ,GAAGC,QAAQ;IACxDC,sBAAsBZ,EAAEK,MAAM,GAAGC,IAAI;IACrCO,OAAOb,EAAEK,MAAM,GAAGC,IAAI;IACtBQ,gBAAgBd,EAAEK,MAAM,GAAGC,IAAI;IAC/BS,WAAWf,EAAEK,MAAM,GAAGC,IAAI;IAC1BU,aAAahB,EAAEK,MAAM,GAAGC,IAAI;IAC5BW,iBAAiBjB,EAAEK,MAAM,GAAGC,IAAI;IAChC,2FAA2F;IAC3FY,eAAelB,EAAEK,MAAM,GAAGC,IAAI,GAAGK,QAAQ;IACzCQ,oBAAoBnB,EAAEQ,MAAM,GAAGC,GAAG,GAAGC,QAAQ,GAAGC,QAAQ;IACxDS,KAAKpB,EAAEqB,OAAO,CAACpB;IACfqB,KAAKtB,EAAEQ,MAAM,GAAGC,GAAG;IACnBc,KAAKvB,EAAEQ,MAAM,GAAGC,GAAG;AACrB,GAAG"}

package/dist/schemas/runner-session-token.d.ts

@@ -0,0 +1,19 @@
+import { z } from 'zod';
+/**
+ * Audience claim binding a token to runner-session data-plane auth. Distinct from
+ * job lease tokens (separate secret) so session tokens and per-job capabilities
+ * stay non-interchangeable.
+ */
+export declare const RUNNER_SESSION_TOKEN_AUDIENCE = "runner-session";
+export declare const runnerSessionTokenClaimsSchema: z.ZodObject<{
+    runnerSessionId: z.ZodString;
+    workspaceId: z.ZodString;
+    scope: z.ZodLiteral<"workspace">;
+    labels: z.ZodArray<z.ZodString>;
+    maxClaims: z.ZodNullable<z.ZodNumber>;
+    aud: z.ZodLiteral<"runner-session">;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+export type RunnerSessionTokenClaims = z.infer<typeof runnerSessionTokenClaimsSchema>;
+//# sourceMappingURL=runner-session-token.d.ts.map

package/dist/schemas/runner-session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/schemas/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAEtB;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,mBAAmB,CAAC;AAE9D,eAAO,MAAM,8BAA8B;;;;;;;;;iBASzC,CAAC;AAEH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,8BAA8B,CAAC,CAAC"}

package/dist/schemas/runner-session-token.js

@@ -0,0 +1,18 @@
+import { z } from 'zod';
+/**
+ * Audience claim binding a token to runner-session data-plane auth. Distinct from
+ * job lease tokens (separate secret) so session tokens and per-job capabilities
+ * stay non-interchangeable.
+ */ export const RUNNER_SESSION_TOKEN_AUDIENCE = 'runner-session';
+export const runnerSessionTokenClaimsSchema = z.object({
+    runnerSessionId: z.string().uuid(),
+    workspaceId: z.string().uuid(),
+    scope: z.literal('workspace'),
+    labels: z.array(z.string()).min(1),
+    maxClaims: z.number().int().positive().nullable(),
+    aud: z.literal(RUNNER_SESSION_TOKEN_AUDIENCE),
+    iat: z.number().int(),
+    exp: z.number().int()
+});
+
+//# sourceMappingURL=runner-session-token.js.map