@shipfox/api-auth 11.0.0 → 12.2.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 67 files with swc (446.61ms)
+Successfully compiled: 67 files with swc (574.33ms)

package/CHANGELOG.md

@@ -1,5 +1,42 @@
 # @shipfox/api-auth
 
+## 12.2.0
+
+### Patch Changes
+
+- @shipfox/node-opentelemetry@0.6.4
+- @shipfox/api-email-challenges@1.1.8
+- @shipfox/node-fastify@0.4.2
+- @shipfox/node-mailer@0.2.5
+- @shipfox/node-module@1.0.6
+- @shipfox/api-auth-context@12.2.0
+
+## 12.0.0
+
+### Patch Changes
+
+- f78740d: Remove Unicode dash punctuation from package prose and source comments.
+- 9ebc5b4: Add an authenticated, rate-limited workspace slug availability endpoint.
+- Updated dependencies [f78740d]
+- Updated dependencies [94aba88]
+- Updated dependencies [f13e8bb]
+- Updated dependencies [9ebc5b4]
+- Updated dependencies [34a5639]
+- Updated dependencies [e1efaee]
+  - @shipfox/api-auth-dto@12.0.0
+  - @shipfox/api-common-dto@12.0.0
+  - @shipfox/inter-module@0.2.3
+  - @shipfox/node-fastify@0.4.1
+  - @shipfox/node-module@1.0.5
+  - @shipfox/api-workspaces-dto@12.0.0
+  - @shipfox/node-jwt@0.4.0
+  - @shipfox/node-postgres@0.5.0
+  - @shipfox/node-rate-limit@0.4.0
+  - @shipfox/api-auth-context@12.0.0
+  - @shipfox/api-email-challenges@1.1.7
+  - @shipfox/node-drizzle@0.3.5
+  - @shipfox/node-outbox@0.2.6
+
 ## 11.0.0
 
 ### Major Changes

package/README.md

@@ -60,7 +60,7 @@ Required environment:
 | `AUTH_JOB_LEASE_TOKEN_EXPIRES_IN` | `90m` | Job lease token lifetime. |
 | `AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN` | `1h` | Runner session token lifetime. |
 | `AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS` | `14` | Refresh token and cookie lifetime. |
-| `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a just-rotated refresh token during concurrent refreshes. |
+| `AUTH_REFRESH_ROTATION_GRACE_SECONDS` | `30` | Grace window for accepting a recently rotated refresh token during concurrent refreshes. |
 | `AUTH_REFRESH_COOKIE_NAME` | `shipfox_refresh_token` | HTTP cookie name for refresh sessions. |
 | `AUTH_PASSWORD_ENABLED` | `true` | Enables password and email-verification routes. Set to `false` when another module provides login. Server construction fails if no login method is available. |
 | `AUTH_SIGNUP_GATE_ENABLED` | `false` | Restricts new account creation to the configured signup email allowlist. Requires `AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS` or `AUTH_SIGNUP_ALLOWED_EMAILS` to be set. |
@@ -116,16 +116,16 @@ itself.
 - **Audience:** signed-in users on first-party clients (web app, CLI).
 - **Grants:** the user's own account routes and, downstream, any route that
   authorizes against the membership claims. Its scope is "this user, with these
-  memberships" — never a single resource.
+  memberships", never a single resource.
 - **Lifecycle:**
-  - *Emit* — issued on login, signup verification, and password reset.
-  - *Exchange* — sent on each request; a longer-lived refresh session mints a
+  - *Emit*: issued on login, signup verification, and password reset.
+  - *Exchange*: sent on each request; a longer-lived refresh session mints a
     fresh token when it expires.
-  - *Store* — held in client memory only, never persisted to disk or local
+  - *Store*: held in client memory only, never persisted to disk or local
     storage. Refresh sessions are stored server-side as hashes, never in raw form.
-  - *Discard* — expires at the configured `exp` time. Revoking the refresh
+  - *Discard*: expires at the configured `exp` time. Revoking the refresh
     session blocks renewal but does not invalidate the issued access token.
-- **Tradeoff — stale memberships:** because memberships ride in the claims, a
+- **Tradeoff: stale memberships:** because memberships ride in the claims, a
   membership or workspace-status change only takes effect on the next token
   issuance or refresh. Accepted because the recommended lifetime is 15 minutes,
   so the staleness window is bounded and a per-request membership read is avoided.
@@ -137,7 +137,7 @@ The runner exchanges its long-lived registration token at startup, then uses the
 short-lived session token to claim jobs. Heartbeat and step/report/log operations
 use the per-job lease token instead.
 
-- **Scope — one workspace's runner data plane.** The token names one runner
+- **Scope: one workspace's runner data plane.** The token names one runner
   session, one workspace, the fixed `workspace` scope, and the session's immutable
   label set. It can claim jobs for that workspace. It is not a user identity and
   does not authorize dashboard management routes.
@@ -148,7 +148,7 @@ use the per-job lease token instead.
 - **Mechanics.** Signed with HMAC-SHA256 using the derived runner-session key
   and the `runner-session` audience. The default lifetime is `1h`, short enough
   to bound the residual claim window when a registration token is revoked.
-- **Tradeoff — no per-session revocation in v1.** Claim stays stateless and does
+- **Tradeoff: no per-session revocation in v1.** Claim stays stateless and does
   not check the runner session row on each poll. Revoking the registration token
   blocks new sessions, but an existing session can keep claiming until
   `AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN` elapses. A job execution claimed before
@@ -163,7 +163,7 @@ A single-job **capability** token, not a session. It is the means by which a
 runner proves it is the legitimate holder of one specific job while it reports
 progress and drives that job to completion.
 
-- **Scope — exactly one job execution.** The token authorizes action on the
+- **Scope: exactly one job execution.** The token authorizes action on the
   single job execution it names, for the runner holding it. It is **not** a runner
   identity, it is **not** workspace-wide, and it is **not** a substitute for the
   long-lived runner credential used to claim work in the first place. The
@@ -175,9 +175,9 @@ progress and drives that job to completion.
 - **Trust boundary.** There is exactly one issuer: the scheduling side mints a
   lease when a runner claims a job execution, next-step re-scopes it to the
   dispatched step attempt, and heartbeat re-mints the same narrow capability
-  after server state accepts the heartbeat. Everything
-  downstream only *verifies* — an in-process signature check, with no callback to
-  the issuer. The runner, and the untrusted agent workload it hosts, never mints
+  after server state accepts the heartbeat. Everything downstream only *verifies*
+  the token with an in-process signature check. It makes no callback to the
+  issuer. The runner, and the untrusted agent workload it hosts, never mints
   or modifies a token; it only presents the one it was handed.
 - **Mechanics.** Signed with HMAC-SHA256 using the job-lease key derived from
   `AUTH_ROOT_KEY`. Its claims name the job, job execution, and surrounding
@@ -187,13 +187,13 @@ progress and drives that job to completion.
   execution. The root key is supplied through configuration, never embedded in
   code or committed. The raw token must **never** be written to logs, traces, or
   error payloads. There is no automatic redaction to fall back on.
-- **Defense in depth — server state is the final authority.** A valid token is
+- **Defense in depth: server state is the final authority.** A valid token is
   never sufficient on its own to advance work. On the lease's own request path the
   gate is server-side step and progression state: a report against a step that has
   already reached a terminal state (finished, failed, or cancelled) is ignored, so
   a still-valid token cannot re-drive work that is already done. Job-level
   finalization is enforced outside the lease path. Cancellation flows the other way
-  as well — the server can ask the runner to stop at any point, and that request
+  as well: the server can ask the runner to stop at any point, and that request
   rides on the response to each heartbeat rather than depending on the token.
 - **Log append scope.** A step-scoped lease is a signed membership and attempt
   check for append-log authorization. It is not an active-step proof: until the
@@ -207,7 +207,7 @@ progress and drives that job to completion.
   other workspaces. If `AUTH_ROOT_KEY` leaks, rotate it. This invalidates every
   live token and email challenge derived from the old root, including every live
   lease, and forces fresh claims.
-- **Tradeoff — no per-token revocation.** A single outstanding lease cannot be
+- **Tradeoff: no per-token revocation.** A single outstanding lease cannot be
   revoked on its own by token ID. The claiming runner's credential is not
   re-checked on each request, so a lease for already-claimed work can continue to
   be renewed by heartbeat until server state cancels, completes, times out, or
@@ -217,7 +217,7 @@ progress and drives that job to completion.
 - **Guidelines for future changes.** Keep the authority narrow: do not add claims
   that grant access beyond the single job, keep the lifetime bounded, keep a single
   issuer, and keep every other side verify-only. If the no-revocation window ever
-  proves too wide, the right fix is to bind the lease to live runner or job state —
+  proves too wide, the right fix is to bind the lease to live runner or job state,
   not to broaden what the token itself can authorize.
 
 ## Routes
@@ -433,7 +433,7 @@ unauthorized` error when the verified request context is missing, inconsistent,
 or has no refresh-session ID. It exposes neither refresh-token material nor
 storage details.
 
-## Data Model
+## Data model
 
 The module creates tables with the `auth_` prefix:
 
@@ -446,7 +446,7 @@ The module creates tables with the `auth_` prefix:
 
 Passwords use Argon2id. Password reset tokens and refresh tokens are opaque tokens stored as hashes. Email verification uses the shared email-challenges module.
 
-## Behavior Notes
+## Behavior notes
 
 - Signup sends an eight-digit verification code and returns the new user with its challenge ID.
 - Signup gating blocks account creation only. Existing users keep signing in, even when their address is not on the current allowlist.

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAM/C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;gBAEpD,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS;CAKnE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;;CAKnD;AAED,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AAED,qBAAa,6BAA8B,SAAQ,KAAK;;CAKvD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,EAAE,MAAM;CAI1B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,YAAY,WAAW,EAAE,MAAM,EAG9B;CACF;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,EAAE,EAAE,MAAM,EAGrB;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,EAAE,EAAE,MAAM,EAGrB;CACF;AAED,qBAAa,gCAAiC,SAAQ,KAAK;IACzD,cAGC;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAG9C;CACF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,SAAS,EAAE,MAAM,EAG5B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,KAAK,EAAE,MAAM,EAGxB;CACF;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,YAAY,OAAO,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,cAGC;CACF;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,cAGC;CACF;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,SAAkB,KAAK,EAAE,OAAO,CAAC;IAEjC,YAAY,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAK7C;CACF;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;IAEhE,YAAY,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS,EAIjE;CACF;AAED,qBAAa,mBAAoB,SAAQ,KAAK;IAC5C,cAGC;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,cAGC;CACF;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,cAGC;CACF;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,cAGC;CACF;AAED,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,cAGC;CACF;AAED,qBAAa,6BAA8B,SAAQ,KAAK;IACtD,cAGC;CACF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,YAAY,MAAM,CAAC,EAAE,MAAM,EAG1B;CACF;AAED,qBAAa,iBAAkB,SAAQ,KAAK;IAC1C,cAGC;CACF;AAED,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,cAGC;CACF;AAED,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,YAAY,WAAW,EAAE,MAAM,EAG9B;CACF;AAED,qBAAa,eAAgB,SAAQ,KAAK;IACxC,YAAY,WAAW,EAAE,MAAM,EAG9B;CACF;AAED,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,cAGC;CACF;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,YAAY,KAAK,EAAE,MAAM,EAGxB;CACF"}

package/dist/core/job-lease-token.d.ts

@@ -6,7 +6,7 @@ export declare function jobLeaseParamsFrom(source: JobLeaseParamSource, stepScop
     currentStepAttempt: number;
 }): IssueJobLeaseTokenParams;
 export declare function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string>;
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export declare function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null>;
 export {};
 //# sourceMappingURL=job-lease-token.d.ts.map

package/dist/core/job-lease-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/core/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,IAAI,CAC7B,mBAAmB,EACjB,eAAe,GACf,sBAAsB,GACtB,OAAO,GACP,gBAAgB,GAChB,WAAW,GACX,aAAa,GACb,iBAAiB,CACpB,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,GAC9D,wBAAwB,CAW1B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1F;AAED,qFAAqF;AACrF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAc5F"}
+{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/core/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,IAAI,CAC7B,mBAAmB,EACjB,eAAe,GACf,sBAAsB,GACtB,OAAO,GACP,gBAAgB,GAChB,WAAW,GACX,aAAa,GACb,iBAAiB,CACpB,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,GAC9D,wBAAwB,CAW1B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1F;AAED,oFAAoF;AACpF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAc5F"}

package/dist/core/job-lease-token.js

@@ -40,7 +40,7 @@ export async function issueJobLeaseToken(claims) {
     recordTokenIssued('job_lease');
     return token;
 }
-/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyJobLeaseToken(token) {
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */ export async function verifyJobLeaseToken(token) {
     try {
         const claims = await verifyHs256({
             token,

package/dist/core/job-lease-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/job-lease-token.ts"],"sourcesContent":["import {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;\n\ntype JobLeaseParamSource = Pick<\n  JobLeaseTokenClaims,\n  | 'workflowRunId'\n  | 'workflowRunAttemptId'\n  | 'jobId'\n  | 'jobExecutionId'\n  | 'projectId'\n  | 'workspaceId'\n  | 'runnerSessionId'\n>;\n\nexport function jobLeaseParamsFrom(\n  source: JobLeaseParamSource,\n  stepScope?: {currentStepId: string; currentStepAttempt: number},\n): IssueJobLeaseTokenParams {\n  return {\n    workflowRunId: source.workflowRunId,\n    workflowRunAttemptId: source.workflowRunAttemptId,\n    jobId: source.jobId,\n    jobExecutionId: source.jobExecutionId,\n    projectId: source.projectId,\n    workspaceId: source.workspaceId,\n    runnerSessionId: source.runnerSessionId,\n    ...(stepScope ? stepScope : {}),\n  };\n}\n\nexport async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      workflowRunId: claims.workflowRunId,\n      ...(claims.workflowRunAttempt === undefined\n        ? {}\n        : {workflowRunAttempt: claims.workflowRunAttempt}),\n      workflowRunAttemptId: claims.workflowRunAttemptId,\n      jobId: claims.jobId,\n      jobExecutionId: claims.jobExecutionId,\n      projectId: claims.projectId,\n      workspaceId: claims.workspaceId,\n      runnerSessionId: claims.runnerSessionId,\n      ...(claims.currentStepId && claims.currentStepAttempt !== undefined\n        ? {\n            currentStepId: claims.currentStepId,\n            currentStepAttempt: claims.currentStepAttempt,\n          }\n        : {}),\n    },\n    secret: jobLeaseTokenKey(),\n    expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,\n    audience: JOB_LEASE_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('job_lease');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: jobLeaseTokenKey(),\n      schema: jobLeaseTokenClaimsSchema,\n      audience: JOB_LEASE_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('job_lease', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('job_lease', 'rejected');\n    return null;\n  }\n}\n"],"names":["JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","jobLeaseTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","jobLeaseParamsFrom","source","stepScope","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","issueJobLeaseToken","claims","token","payload","workflowRunAttempt","undefined","currentStepId","currentStepAttempt","secret","expiresIn","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","audience","verifyJobLeaseToken","schema"],"mappings":"AAAA,SACEA,wBAAwB,EAExBC,yBAAyB,QACpB,wBAAwB;AAC/B,SAAQC,gBAAgB,QAAO,8BAA8B;AAC7D,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAgBzE,OAAO,SAASC,mBACdC,MAA2B,EAC3BC,SAA+D;IAE/D,OAAO;QACLC,eAAeF,OAAOE,aAAa;QACnCC,sBAAsBH,OAAOG,oBAAoB;QACjDC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgBL,OAAOK,cAAc;QACrCC,WAAWN,OAAOM,SAAS;QAC3BC,aAAaP,OAAOO,WAAW;QAC/BC,iBAAiBR,OAAOQ,eAAe;QACvC,GAAIP,YAAYA,YAAY,CAAC,CAAC;IAChC;AACF;AAEA,OAAO,eAAeQ,mBAAmBC,MAAgC;IACvE,MAAMC,QAAQ,MAAMjB,UAAU;QAC5BkB,SAAS;YACPV,eAAeQ,OAAOR,aAAa;YACnC,GAAIQ,OAAOG,kBAAkB,KAAKC,YAC9B,CAAC,IACD;gBAACD,oBAAoBH,OAAOG,kBAAkB;YAAA,CAAC;YACnDV,sBAAsBO,OAAOP,oBAAoB;YACjDC,OAAOM,OAAON,KAAK;YACnBC,gBAAgBK,OAAOL,cAAc;YACrCC,WAAWI,OAAOJ,SAAS;YAC3BC,aAAaG,OAAOH,WAAW;YAC/BC,iBAAiBE,OAAOF,eAAe;YACvC,GAAIE,OAAOK,aAAa,IAAIL,OAAOM,kBAAkB,KAAKF,YACtD;gBACEC,eAAeL,OAAOK,aAAa;gBACnCC,oBAAoBN,OAAOM,kBAAkB;YAC/C,IACA,CAAC,CAAC;QACR;QACAC,QAAQxB;QACRyB,WAAWtB,OAAOuB,+BAA+B;QACjDC,UAAU7B;IACZ;IACAM,kBAAkB;IAClB,OAAOc;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeU,oBAAoBV,KAAa;IACrD,IAAI;QACF,MAAMD,SAAS,MAAMf,YAAY;YAC/BgB;YACAM,QAAQxB;YACR6B,QAAQ9B;YACR4B,UAAU7B;QACZ;QACAO,oBAAoB,aAAa;QACjC,OAAOY;IACT,EAAE,OAAM;QACNZ,oBAAoB,aAAa;QACjC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/job-lease-token.ts"],"sourcesContent":["import {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {jobLeaseTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;\n\ntype JobLeaseParamSource = Pick<\n  JobLeaseTokenClaims,\n  | 'workflowRunId'\n  | 'workflowRunAttemptId'\n  | 'jobId'\n  | 'jobExecutionId'\n  | 'projectId'\n  | 'workspaceId'\n  | 'runnerSessionId'\n>;\n\nexport function jobLeaseParamsFrom(\n  source: JobLeaseParamSource,\n  stepScope?: {currentStepId: string; currentStepAttempt: number},\n): IssueJobLeaseTokenParams {\n  return {\n    workflowRunId: source.workflowRunId,\n    workflowRunAttemptId: source.workflowRunAttemptId,\n    jobId: source.jobId,\n    jobExecutionId: source.jobExecutionId,\n    projectId: source.projectId,\n    workspaceId: source.workspaceId,\n    runnerSessionId: source.runnerSessionId,\n    ...(stepScope ? stepScope : {}),\n  };\n}\n\nexport async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      workflowRunId: claims.workflowRunId,\n      ...(claims.workflowRunAttempt === undefined\n        ? {}\n        : {workflowRunAttempt: claims.workflowRunAttempt}),\n      workflowRunAttemptId: claims.workflowRunAttemptId,\n      jobId: claims.jobId,\n      jobExecutionId: claims.jobExecutionId,\n      projectId: claims.projectId,\n      workspaceId: claims.workspaceId,\n      runnerSessionId: claims.runnerSessionId,\n      ...(claims.currentStepId && claims.currentStepAttempt !== undefined\n        ? {\n            currentStepId: claims.currentStepId,\n            currentStepAttempt: claims.currentStepAttempt,\n          }\n        : {}),\n    },\n    secret: jobLeaseTokenKey(),\n    expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,\n    audience: JOB_LEASE_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('job_lease');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: jobLeaseTokenKey(),\n      schema: jobLeaseTokenClaimsSchema,\n      audience: JOB_LEASE_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('job_lease', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('job_lease', 'rejected');\n    return null;\n  }\n}\n"],"names":["JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","jobLeaseTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","jobLeaseParamsFrom","source","stepScope","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","issueJobLeaseToken","claims","token","payload","workflowRunAttempt","undefined","currentStepId","currentStepAttempt","secret","expiresIn","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","audience","verifyJobLeaseToken","schema"],"mappings":"AAAA,SACEA,wBAAwB,EAExBC,yBAAyB,QACpB,wBAAwB;AAC/B,SAAQC,gBAAgB,QAAO,8BAA8B;AAC7D,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAgBzE,OAAO,SAASC,mBACdC,MAA2B,EAC3BC,SAA+D;IAE/D,OAAO;QACLC,eAAeF,OAAOE,aAAa;QACnCC,sBAAsBH,OAAOG,oBAAoB;QACjDC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgBL,OAAOK,cAAc;QACrCC,WAAWN,OAAOM,SAAS;QAC3BC,aAAaP,OAAOO,WAAW;QAC/BC,iBAAiBR,OAAOQ,eAAe;QACvC,GAAIP,YAAYA,YAAY,CAAC,CAAC;IAChC;AACF;AAEA,OAAO,eAAeQ,mBAAmBC,MAAgC;IACvE,MAAMC,QAAQ,MAAMjB,UAAU;QAC5BkB,SAAS;YACPV,eAAeQ,OAAOR,aAAa;YACnC,GAAIQ,OAAOG,kBAAkB,KAAKC,YAC9B,CAAC,IACD;gBAACD,oBAAoBH,OAAOG,kBAAkB;YAAA,CAAC;YACnDV,sBAAsBO,OAAOP,oBAAoB;YACjDC,OAAOM,OAAON,KAAK;YACnBC,gBAAgBK,OAAOL,cAAc;YACrCC,WAAWI,OAAOJ,SAAS;YAC3BC,aAAaG,OAAOH,WAAW;YAC/BC,iBAAiBE,OAAOF,eAAe;YACvC,GAAIE,OAAOK,aAAa,IAAIL,OAAOM,kBAAkB,KAAKF,YACtD;gBACEC,eAAeL,OAAOK,aAAa;gBACnCC,oBAAoBN,OAAOM,kBAAkB;YAC/C,IACA,CAAC,CAAC;QACR;QACAC,QAAQxB;QACRyB,WAAWtB,OAAOuB,+BAA+B;QACjDC,UAAU7B;IACZ;IACAM,kBAAkB;IAClB,OAAOc;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeU,oBAAoBV,KAAa;IACrD,IAAI;QACF,MAAMD,SAAS,MAAMf,YAAY;YAC/BgB;YACAM,QAAQxB;YACR6B,QAAQ9B;YACR4B,UAAU7B;QACZ;QACAO,oBAAoB,aAAa;QACjC,OAAOY;IACT,EAAE,OAAM;QACNZ,oBAAoB,aAAa;QACjC,OAAO;IACT;AACF"}

package/dist/core/jwt.d.ts

@@ -6,8 +6,8 @@ export declare const tokenMembershipSchema: z.ZodObject<{
     }>;
     workspaceStatus: z.ZodDefault<z.ZodEnum<{
         active: "active";
-        suspended: "suspended";
         deleted: "deleted";
+        suspended: "suspended";
     }>>;
 }, z.core.$strip>;
 export type TokenMembership = z.infer<typeof tokenMembershipSchema>;
@@ -23,8 +23,8 @@ export declare const userTokenClaimsSchema: z.ZodObject<{
         }>;
         workspaceStatus: z.ZodDefault<z.ZodEnum<{
             active: "active";
-            suspended: "suspended";
             deleted: "deleted";
+            suspended: "suspended";
         }>>;
     }, z.core.$strip>>;
     iat: z.ZodNumber;

package/dist/core/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,0BAA2B,SAAQ,sBAAsB,CACpE,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAKF;AAED,qBAAa,6BAA8B,SAAQ,yBAAyB,CAC1E,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAKF;AASD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxF"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,0BAA2B,SAAQ,sBAAsB,CACpE,mBAAmB,EACnB,kBAAkB,CACnB;IACC,YAAY,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B,EAIA;CACF;AAED,qBAAa,6BAA8B,SAAQ,yBAAyB,CAC1E,mBAAmB,EACnB,kBAAkB,CACnB;IACC,YAAY,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB,EAIA;CACF;AASD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxF"}

package/dist/core/runner-session-token.d.ts

@@ -1,6 +1,6 @@
 import { type RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;
 export declare function issueRunnerSessionToken(claims: IssueRunnerSessionTokenParams): Promise<string>;
-/** Returns the claims on success, or `null` for any invalid input — never throws. */
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */
 export declare function verifyRunnerSessionToken(token: string): Promise<RunnerSessionTokenClaims | null>;
 //# sourceMappingURL=runner-session-token.d.ts.map

package/dist/core/runner-session-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,oFAAoF;AACpF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}

package/dist/core/runner-session-token.js

@@ -19,7 +19,7 @@ export async function issueRunnerSessionToken(claims) {
     recordTokenIssued('runner_session');
     return token;
 }
-/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyRunnerSessionToken(token) {
+/** Returns the claims on success, or `null` for any invalid input. Never throws. */ export async function verifyRunnerSessionToken(token) {
     try {
         const claims = await verifyHs256({
             token,

package/dist/core/runner-session-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input. Never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,kFAAkF,GAClF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}

package/dist/db/admin-user-moderation.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-user-moderation.d.ts","sourceRoot":"","sources":["../../src/db/admin-user-moderation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,yBAAyB,CAAC;AAwBvE,UAAU,2BAA2B;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,MAAM,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,yBAAyB,CAAC;CAClC;AAyGD,iBAAe,4BAA4B,CACzC,MAAM,EAAE,2BAA2B,GAAG;IACpC,SAAS,EAAE,SAAS,GAAG,YAAY,GAAG,iBAAiB,CAAC;CACzD;;;;;;;;;;;;GAuEF;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC;AAE5F,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B"}
+{"version":3,"file":"admin-user-moderation.d.ts","sourceRoot":"","sources":["../../src/db/admin-user-moderation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,yBAAyB,EAAC,MAAM,yBAAyB,CAAC;AAwBvE,UAAU,2BAA2B;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,yBAAyB,EAAE,MAAM,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,yBAAyB,CAAC;CAClC;AAyGD,iBAAe,4BAA4B,CACzC,MAAM,EAAE,2BAA2B,GAAG;IACpC,SAAS,EAAE,SAAS,GAAG,YAAY,GAAG,iBAAiB,CAAC;CACzD;;QArFG,EAAE;QACF,KAAK;QACL,IAAI;QACJ,eAAe;QACf,MAAM;QACN,SAAS;QACT,SAAS;;;;GAsJd;AAED,MAAM,MAAM,oBAAoB,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,4BAA4B,CAAC,CAAC,CAAC;AAE5F,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B;AAED,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,2BAA2B,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAE/B"}

package/dist/db/db.d.ts

@@ -107,7 +107,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "admin_command_results";
@@ -235,7 +235,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
@@ -331,7 +331,7 @@ export declare const schema: {
                 tableName: "users";
                 dataType: "string";
                 columnType: "PgEnumColumn";
-                data: "active" | "suspended" | "deleted";
+                data: "active" | "deleted" | "suspended";
                 driverParam: string;
                 notNull: true;
                 hasDefault: true;
@@ -378,7 +378,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     passwordResets: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "password_resets";
@@ -487,7 +487,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     refreshTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "refresh_tokens";
@@ -664,7 +664,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     authOutbox: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "outbox";
@@ -858,7 +858,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     authRateLimits: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "rate_limits";
@@ -1001,7 +1001,7 @@ export declare const schema: {
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
 };
 export declare function db(): NodePgDatabase<{
@@ -1112,7 +1112,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "admin_command_results";
@@ -1240,7 +1240,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
@@ -1336,7 +1336,7 @@ export declare function db(): NodePgDatabase<{
                 tableName: "users";
                 dataType: "string";
                 columnType: "PgEnumColumn";
-                data: "active" | "suspended" | "deleted";
+                data: "active" | "deleted" | "suspended";
                 driverParam: string;
                 notNull: true;
                 hasDefault: true;
@@ -1383,7 +1383,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     passwordResets: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "password_resets";
@@ -1492,7 +1492,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     refreshTokens: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "refresh_tokens";
@@ -1669,7 +1669,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     authOutbox: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "outbox";
@@ -1863,7 +1863,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
     authRateLimits: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "rate_limits";
@@ -2006,7 +2006,7 @@ export declare function db(): NodePgDatabase<{
                 generated: undefined;
             }, {}, {}>;
         };
-        dialect: "pg";
+        dialect: 'pg';
     }>;
 }>;
 export declare function closeDb(): void;

package/dist/db/rate-limits.d.ts

@@ -1,18 +1,9 @@
-export interface ConsumeAuthRateLimitParams {
-    action: string;
-    scope: string;
-    identifierHmac: string;
-    windowStart: Date;
-    expiresAt: Date;
-    timeoutMs: number;
-}
-export interface ConsumeAuthRateLimitResult {
-    count: number;
-    expiresAt: Date;
-}
-export declare function consumeAuthRateLimit(params: ConsumeAuthRateLimitParams): Promise<ConsumeAuthRateLimitResult>;
-export declare function pruneExpiredAuthRateLimits(params?: {
+import { type ConsumeRateLimitParams, type ConsumeRateLimitResult } from '@shipfox/node-rate-limit';
+export type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;
+export type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;
+export declare const consumeAuthRateLimit: (params: ConsumeRateLimitParams<string, string>) => Promise<ConsumeRateLimitResult>;
+export declare const pruneExpiredAuthRateLimits: (params?: {
     now?: Date | undefined;
     minIntervalMs?: number | undefined;
-}): Promise<number | undefined>;
+}) => Promise<number | undefined>;
 //# sourceMappingURL=rate-limits.d.ts.map

package/dist/db/rate-limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/db/rate-limits.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,IAAI,CAAC;IAClB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,0BAA0B;IACzC,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,0BAA0B,GACjC,OAAO,CAAC,0BAA0B,CAAC,CAgCrC;AAID,wBAAsB,0BAA0B,CAC9C,MAAM,GAAE;IAAC,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAAM,GACxE,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU7B"}
+{"version":3,"file":"rate-limits.d.ts","sourceRoot":"","sources":["../../src/db/rate-limits.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,sBAAsB,EAE5B,MAAM,0BAA0B,CAAC;AA+ClC,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAChF,MAAM,MAAM,0BAA0B,GAAG,sBAAsB,CAAC;AAChE,eAAO,MAAM,oBAAoB,qFAAsB,CAAC;AACxD,eAAO,MAAM,0BAA0B;;;iCAAoB,CAAC"}

package/dist/db/rate-limits.js

@@ -1,10 +1,14 @@
+import { createRateLimitPersistence } from '@shipfox/node-rate-limit';
 import { lt, sql } from 'drizzle-orm';
 import { db } from './db.js';
 import { authRateLimits } from './schema/rate-limits.js';
-export async function consumeAuthRateLimit(params) {
-    return await db().transaction(async (tx)=>{
-        await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);
-        const rows = await tx.insert(authRateLimits).values({
+const persistence = createRateLimitPersistence({
+    transaction: (callback)=>db().transaction(callback),
+    setStatementTimeout: async (transaction, timeoutMs)=>{
+        await transaction.execute(sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`);
+    },
+    consume: async (transaction, params)=>{
+        const rows = await transaction.insert(authRateLimits).values({
             action: params.action,
             scope: params.scope,
             identifierHmac: params.identifierHmac,
@@ -26,19 +30,14 @@ export async function consumeAuthRateLimit(params) {
             count: authRateLimits.count,
             expiresAt: authRateLimits.expiresAt
         });
-        const row = rows[0];
-        if (!row) throw new Error('Rate limit upsert returned no rows');
-        return row;
-    });
-}
-let nextPruneAt = 0;
-export async function pruneExpiredAuthRateLimits(params = {}) {
-    const now = params.now ?? new Date();
-    const minIntervalMs = params.minIntervalMs ?? 60_000;
-    if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;
-    nextPruneAt = now.getTime() + minIntervalMs;
-    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
-    return result.rowCount ?? 0;
-}
+        return rows[0];
+    },
+    prune: async (now)=>{
+        const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));
+        return result.rowCount ?? 0;
+    }
+});
+export const consumeAuthRateLimit = persistence.consume;
+export const pruneExpiredAuthRateLimits = persistence.prune;
 
 //# sourceMappingURL=rate-limits.js.map

package/dist/db/rate-limits.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/rate-limits.ts"],"sourcesContent":["import {lt, sql} from 'drizzle-orm';\nimport {db} from './db.js';\nimport {authRateLimits} from './schema/rate-limits.js';\n\nexport interface ConsumeAuthRateLimitParams {\n  action: string;\n  scope: string;\n  identifierHmac: string;\n  windowStart: Date;\n  expiresAt: Date;\n  timeoutMs: number;\n}\n\nexport interface ConsumeAuthRateLimitResult {\n  count: number;\n  expiresAt: Date;\n}\n\nexport async function consumeAuthRateLimit(\n  params: ConsumeAuthRateLimitParams,\n): Promise<ConsumeAuthRateLimitResult> {\n  return await db().transaction(async (tx) => {\n    await tx.execute(sql`select set_config('statement_timeout', ${`${params.timeoutMs}ms`}, true)`);\n\n    const rows = await tx\n      .insert(authRateLimits)\n      .values({\n        action: params.action,\n        scope: params.scope,\n        identifierHmac: params.identifierHmac,\n        windowStart: params.windowStart,\n        count: 1,\n        expiresAt: params.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target: [\n          authRateLimits.action,\n          authRateLimits.scope,\n          authRateLimits.identifierHmac,\n          authRateLimits.windowStart,\n        ],\n        set: {\n          count: sql`${authRateLimits.count} + 1`,\n          updatedAt: sql`now()`,\n        },\n      })\n      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});\n\n    const row = rows[0];\n    if (!row) throw new Error('Rate limit upsert returned no rows');\n    return row;\n  });\n}\n\nlet nextPruneAt = 0;\n\nexport async function pruneExpiredAuthRateLimits(\n  params: {now?: Date | undefined; minIntervalMs?: number | undefined} = {},\n): Promise<number | undefined> {\n  const now = params.now ?? new Date();\n  const minIntervalMs = params.minIntervalMs ?? 60_000;\n  if (minIntervalMs > 0 && now.getTime() < nextPruneAt) return undefined;\n\n  nextPruneAt = now.getTime() + minIntervalMs;\n\n  const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));\n\n  return result.rowCount ?? 0;\n}\n"],"names":["lt","sql","db","authRateLimits","consumeAuthRateLimit","params","transaction","tx","execute","timeoutMs","rows","insert","values","action","scope","identifierHmac","windowStart","count","expiresAt","onConflictDoUpdate","target","set","updatedAt","returning","row","Error","nextPruneAt","pruneExpiredAuthRateLimits","now","Date","minIntervalMs","getTime","undefined","result","delete","where","rowCount"],"mappings":"AAAA,SAAQA,EAAE,EAAEC,GAAG,QAAO,cAAc;AACpC,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,cAAc,QAAO,0BAA0B;AAgBvD,OAAO,eAAeC,qBACpBC,MAAkC;IAElC,OAAO,MAAMH,KAAKI,WAAW,CAAC,OAAOC;QACnC,MAAMA,GAAGC,OAAO,CAACP,GAAG,CAAC,uCAAuC,EAAE,GAAGI,OAAOI,SAAS,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;QAE9F,MAAMC,OAAO,MAAMH,GAChBI,MAAM,CAACR,gBACPS,MAAM,CAAC;YACNC,QAAQR,OAAOQ,MAAM;YACrBC,OAAOT,OAAOS,KAAK;YACnBC,gBAAgBV,OAAOU,cAAc;YACrCC,aAAaX,OAAOW,WAAW;YAC/BC,OAAO;YACPC,WAAWb,OAAOa,SAAS;QAC7B,GACCC,kBAAkB,CAAC;YAClBC,QAAQ;gBACNjB,eAAeU,MAAM;gBACrBV,eAAeW,KAAK;gBACpBX,eAAeY,cAAc;gBAC7BZ,eAAea,WAAW;aAC3B;YACDK,KAAK;gBACHJ,OAAOhB,GAAG,CAAC,EAAEE,eAAec,KAAK,CAAC,IAAI,CAAC;gBACvCK,WAAWrB,GAAG,CAAC,KAAK,CAAC;YACvB;QACF,GACCsB,SAAS,CAAC;YAACN,OAAOd,eAAec,KAAK;YAAEC,WAAWf,eAAee,SAAS;QAAA;QAE9E,MAAMM,MAAMd,IAAI,CAAC,EAAE;QACnB,IAAI,CAACc,KAAK,MAAM,IAAIC,MAAM;QAC1B,OAAOD;IACT;AACF;AAEA,IAAIE,cAAc;AAElB,OAAO,eAAeC,2BACpBtB,SAAuE,CAAC,CAAC;IAEzE,MAAMuB,MAAMvB,OAAOuB,GAAG,IAAI,IAAIC;IAC9B,MAAMC,gBAAgBzB,OAAOyB,aAAa,IAAI;IAC9C,IAAIA,gBAAgB,KAAKF,IAAIG,OAAO,KAAKL,aAAa,OAAOM;IAE7DN,cAAcE,IAAIG,OAAO,KAAKD;IAE9B,MAAMG,SAAS,MAAM/B,KAAKgC,MAAM,CAAC/B,gBAAgBgC,KAAK,CAACnC,GAAGG,eAAee,SAAS,EAAEU;IAEpF,OAAOK,OAAOG,QAAQ,IAAI;AAC5B"}
+{"version":3,"sources":["../../src/db/rate-limits.ts"],"sourcesContent":["import {\n  type ConsumeRateLimitParams,\n  type ConsumeRateLimitResult,\n  createRateLimitPersistence,\n} from '@shipfox/node-rate-limit';\nimport {lt, sql} from 'drizzle-orm';\nimport {db} from './db.js';\nimport {authRateLimits} from './schema/rate-limits.js';\n\ntype AuthRateLimitTransaction = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nconst persistence = createRateLimitPersistence<AuthRateLimitTransaction>({\n  transaction: (callback) => db().transaction(callback),\n  setStatementTimeout: async (transaction, timeoutMs) => {\n    await transaction.execute(\n      sql`select set_config('statement_timeout', ${`${timeoutMs}ms`}, true)`,\n    );\n  },\n  consume: async (transaction, params) => {\n    const rows = await transaction\n      .insert(authRateLimits)\n      .values({\n        action: params.action,\n        scope: params.scope,\n        identifierHmac: params.identifierHmac,\n        windowStart: params.windowStart,\n        count: 1,\n        expiresAt: params.expiresAt,\n      })\n      .onConflictDoUpdate({\n        target: [\n          authRateLimits.action,\n          authRateLimits.scope,\n          authRateLimits.identifierHmac,\n          authRateLimits.windowStart,\n        ],\n        set: {\n          count: sql`${authRateLimits.count} + 1`,\n          updatedAt: sql`now()`,\n        },\n      })\n      .returning({count: authRateLimits.count, expiresAt: authRateLimits.expiresAt});\n\n    return rows[0];\n  },\n  prune: async (now) => {\n    const result = await db().delete(authRateLimits).where(lt(authRateLimits.expiresAt, now));\n    return result.rowCount ?? 0;\n  },\n});\n\nexport type ConsumeAuthRateLimitParams = ConsumeRateLimitParams<string, string>;\nexport type ConsumeAuthRateLimitResult = ConsumeRateLimitResult;\nexport const consumeAuthRateLimit = persistence.consume;\nexport const pruneExpiredAuthRateLimits = persistence.prune;\n"],"names":["createRateLimitPersistence","lt","sql","db","authRateLimits","persistence","transaction","callback","setStatementTimeout","timeoutMs","execute","consume","params","rows","insert","values","action","scope","identifierHmac","windowStart","count","expiresAt","onConflictDoUpdate","target","set","updatedAt","returning","prune","now","result","delete","where","rowCount","consumeAuthRateLimit","pruneExpiredAuthRateLimits"],"mappings":"AAAA,SAGEA,0BAA0B,QACrB,2BAA2B;AAClC,SAAQC,EAAE,EAAEC,GAAG,QAAO,cAAc;AACpC,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,cAAc,QAAO,0BAA0B;AAIvD,MAAMC,cAAcL,2BAAqD;IACvEM,aAAa,CAACC,WAAaJ,KAAKG,WAAW,CAACC;IAC5CC,qBAAqB,OAAOF,aAAaG;QACvC,MAAMH,YAAYI,OAAO,CACvBR,GAAG,CAAC,uCAAuC,EAAE,GAAGO,UAAU,EAAE,CAAC,CAAC,OAAO,CAAC;IAE1E;IACAE,SAAS,OAAOL,aAAaM;QAC3B,MAAMC,OAAO,MAAMP,YAChBQ,MAAM,CAACV,gBACPW,MAAM,CAAC;YACNC,QAAQJ,OAAOI,MAAM;YACrBC,OAAOL,OAAOK,KAAK;YACnBC,gBAAgBN,OAAOM,cAAc;YACrCC,aAAaP,OAAOO,WAAW;YAC/BC,OAAO;YACPC,WAAWT,OAAOS,SAAS;QAC7B,GACCC,kBAAkB,CAAC;YAClBC,QAAQ;gBACNnB,eAAeY,MAAM;gBACrBZ,eAAea,KAAK;gBACpBb,eAAec,cAAc;gBAC7Bd,eAAee,WAAW;aAC3B;YACDK,KAAK;gBACHJ,OAAOlB,GAAG,CAAC,EAAEE,eAAegB,KAAK,CAAC,IAAI,CAAC;gBACvCK,WAAWvB,GAAG,CAAC,KAAK,CAAC;YACvB;QACF,GACCwB,SAAS,CAAC;YAACN,OAAOhB,eAAegB,KAAK;YAAEC,WAAWjB,eAAeiB,SAAS;QAAA;QAE9E,OAAOR,IAAI,CAAC,EAAE;IAChB;IACAc,OAAO,OAAOC;QACZ,MAAMC,SAAS,MAAM1B,KAAK2B,MAAM,CAAC1B,gBAAgB2B,KAAK,CAAC9B,GAAGG,eAAeiB,SAAS,EAAEO;QACpF,OAAOC,OAAOG,QAAQ,IAAI;IAC5B;AACF;AAIA,OAAO,MAAMC,uBAAuB5B,YAAYM,OAAO,CAAC;AACxD,OAAO,MAAMuB,6BAA6B7B,YAAYsB,KAAK,CAAC"}

package/dist/db/refresh-tokens.d.ts

@@ -11,7 +11,7 @@ export interface CreateRefreshTokenParams {
 export declare function createRefreshToken(params: CreateRefreshTokenParams): Promise<RefreshToken>;
 export declare function createRefreshTokenForActiveUser(params: CreateRefreshTokenParams): Promise<RefreshToken | undefined>;
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -22,8 +22,8 @@ export declare function findActiveRefreshTokenByHash(params: {
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */
 export declare function findRefreshTokenByHash(params: {
     hashedToken: string;

package/dist/db/refresh-tokens.js

@@ -35,7 +35,7 @@ export async function createRefreshTokenForActiveUser(params) {
     });
 }
 /**
- * Looks up the live session token by hash — one that can still authenticate as
+ * Looks up the live session token by hash. It can still authenticate as
  * the current session. Returns `undefined` for revoked, expired, or already
  * rotated tokens; rotated rows survive in the table only for the grace window
  * and are not "active".
@@ -48,8 +48,8 @@ export async function createRefreshTokenForActiveUser(params) {
 /**
  * Looks up a non-revoked, non-expired token by hash, including ones already
  * rotated. Rotation reads {@link RefreshToken.rotatedAt} to decide whether to
- * rotate, honour the grace window, or reject reuse, so — unlike
- * {@link findActiveRefreshTokenByHash} — it must still see rotated rows.
+ * rotate, honour the grace window, or reject reuse, so, unlike
+ * {@link findActiveRefreshTokenByHash}, it must still see rotated rows.
  */ export async function findRefreshTokenByHash(params) {
     const rows = await db().select().from(refreshTokens).where(and(eq(refreshTokens.hashedToken, params.hashedToken), isNull(refreshTokens.revokedAt), gt(refreshTokens.expiresAt, sql`now()`))).limit(1);
     const row = rows[0];