@shipfox/api-auth 18.0.0 → 19.0.0

package/dist/db/admin-user-summary.js

@@ -1,7 +1,36 @@
-import { and, eq, isNull } from 'drizzle-orm';
+import { paginateTimestampIdRows, timestampIdCursorWhere } from '@shipfox/node-drizzle';
+import { and, desc, eq, isNotNull, isNull, ne, not, or, sql } from 'drizzle-orm';
 import { highestAdminRole } from '#core/admin-role-model.js';
 import { adminGrants } from './schema/admin-grants.js';
 import { users } from './schema/users.js';
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const SEARCH_TERM_SEPARATOR = /\s+/;
+function escapeLikeTerm(term) {
+    return term.replace(/[\\%_]/g, (character)=>`\\${character}`);
+}
+function isUuid(value) {
+    return UUID_PATTERN.test(value);
+}
+function containsTerm(column, term) {
+    return sql`${column} ILIKE ${`%${escapeLikeTerm(term)}%`}`;
+}
+function addEligibilityCondition(conditions, params, activeAdminRoleUserId) {
+    const eligibleCondition = and(eq(users.status, 'active'), isNotNull(users.emailVerifiedAt), isNull(activeAdminRoleUserId), ne(users.id, params.actorId));
+    if (eligibleCondition && params.eligible === true) conditions.push(eligibleCondition);
+    if (eligibleCondition && params.eligible === false) conditions.push(not(eligibleCondition));
+}
+function addSearchConditions(conditions, search) {
+    const normalizedSearch = search?.trim() ?? '';
+    if (!normalizedSearch) return;
+    if (isUuid(normalizedSearch)) {
+        conditions.push(eq(users.id, normalizedSearch));
+        return;
+    }
+    for (const term of normalizedSearch.split(SEARCH_TERM_SEPARATOR)){
+        const termCondition = or(containsTerm(users.name, term), containsTerm(users.email, term));
+        if (termCondition) conditions.push(termCondition);
+    }
+}
 export async function findAdministratorUserSummary(executor, params) {
     const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
     const rows = await executor.select({
@@ -27,5 +56,50 @@ export async function findAdministratorUserSummary(executor, params) {
             ] : []))
     };
 }
+/**
+ * Lists a live directory view using keyset pagination.
+ *
+ * Pages are not a consistent snapshot. Each page reads current account and grant state, so
+ * inserts and account or grant changes can make consecutive pages differ. Re-run the listing
+ * before acting on a row.
+ */ export async function listAdministratorUserSummaries(executor, params) {
+    // Aggregate grants in a subquery so pagination is over users, not grants.
+    const activeAdminRoles = executor.select({
+        userId: adminGrants.userId,
+        roles: sql`json_agg(${adminGrants.role})`.as('roles')
+    }).from(adminGrants).where(isNull(adminGrants.revokedAt)).groupBy(adminGrants.userId).as('active_admin_roles');
+    const conditions = [];
+    const cursorCondition = timestampIdCursorWhere({
+        timestampColumn: users.createdAt,
+        idColumn: users.id,
+        cursor: params.cursor
+    });
+    if (cursorCondition) conditions.push(cursorCondition);
+    if (params.status) conditions.push(eq(users.status, params.status));
+    addEligibilityCondition(conditions, params, activeAdminRoles.userId);
+    addSearchConditions(conditions, params.search);
+    const rows = await executor.select({
+        id: users.id,
+        email: users.email,
+        name: users.name,
+        emailVerifiedAt: users.emailVerifiedAt,
+        status: users.status,
+        createdAt: users.createdAt,
+        adminRoles: activeAdminRoles.roles
+    }).from(users).leftJoin(activeAdminRoles, eq(activeAdminRoles.userId, users.id)).where(and(...conditions)).orderBy(desc(users.createdAt), desc(users.id)).limit(params.limit + 1);
+    const mappedRows = rows.map(({ adminRoles, ...row })=>({
+            ...row,
+            adminRole: row.status === 'active' ? highestAdminRole(adminRoles ?? []) : null
+        }));
+    const page = paginateTimestampIdRows({
+        rows: mappedRows,
+        limit: params.limit,
+        timestampKey: 'createdAt'
+    });
+    return {
+        rows: page.pageRows,
+        nextCursor: page.nextCursor
+    };
+}
 
 //# sourceMappingURL=admin-user-summary.js.map

package/dist/db/admin-user-summary.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/admin-user-summary.ts"],"sourcesContent":["import {and, eq, isNull} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport type {db} from './db.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\nexport type AdministratorUserSummaryExecutor = ReturnType<typeof db> | Tx;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUserSummary(\n  executor: AdministratorUserSummaryExecutor,\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserSummary | undefined> {\n  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);\n  const rows = await executor\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRole: adminGrants.role,\n    })\n    .from(users)\n    .leftJoin(\n      adminGrants,\n      and(\n        eq(adminGrants.userId, users.id),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    )\n    .where(identifier);\n\n  const first = rows[0];\n  if (!first) return undefined;\n\n  return {\n    id: first.id,\n    email: first.email,\n    name: first.name,\n    emailVerifiedAt: first.emailVerifiedAt,\n    status: first.status,\n    createdAt: first.createdAt,\n    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),\n  } satisfies AdministratorUserSummary;\n}\n"],"names":["and","eq","isNull","highestAdminRole","adminGrants","users","findAdministratorUserSummary","executor","params","identifier","id","email","rows","select","name","emailVerifiedAt","status","createdAt","adminRole","role","from","leftJoin","userId","revokedAt","where","first","undefined","flatMap"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,QAAO,cAAc;AAC5C,SAAQC,gBAAgB,QAAO,4BAA4B;AAG3D,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,OAAO,eAAeC,6BACpBC,QAA0C,EAC1CC,MAA+B;IAE/B,MAAMC,aAAa,QAAQD,SAASP,GAAGI,MAAMK,EAAE,EAAEF,OAAOE,EAAE,IAAIT,GAAGI,MAAMM,KAAK,EAAEH,OAAOG,KAAK;IAC1F,MAAMC,OAAO,MAAML,SAChBM,MAAM,CAAC;QACNH,IAAIL,MAAMK,EAAE;QACZC,OAAON,MAAMM,KAAK;QAClBG,MAAMT,MAAMS,IAAI;QAChBC,iBAAiBV,MAAMU,eAAe;QACtCC,QAAQX,MAAMW,MAAM;QACpBC,WAAWZ,MAAMY,SAAS;QAC1BC,WAAWd,YAAYe,IAAI;IAC7B,GACCC,IAAI,CAACf,OACLgB,QAAQ,CACPjB,aACAJ,IACEC,GAAGG,YAAYkB,MAAM,EAAEjB,MAAMK,EAAE,GAC/BR,OAAOE,YAAYmB,SAAS,GAC5BtB,GAAGI,MAAMW,MAAM,EAAE,YAGpBQ,KAAK,CAACf;IAET,MAAMgB,QAAQb,IAAI,CAAC,EAAE;IACrB,IAAI,CAACa,OAAO,OAAOC;IAEnB,OAAO;QACLhB,IAAIe,MAAMf,EAAE;QACZC,OAAOc,MAAMd,KAAK;QAClBG,MAAMW,MAAMX,IAAI;QAChBC,iBAAiBU,MAAMV,eAAe;QACtCC,QAAQS,MAAMT,MAAM;QACpBC,WAAWQ,MAAMR,SAAS;QAC1BC,WAAWf,iBAAiBS,KAAKe,OAAO,CAAC,CAAC,EAACT,SAAS,EAAC,GAAMA,YAAY;gBAACA;aAAU,GAAG,EAAE;IACzF;AACF"}
+{"version":3,"sources":["../../src/db/admin-user-summary.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {\n  paginateTimestampIdRows,\n  type TimestampIdCursor,\n  timestampIdCursorWhere,\n} from '@shipfox/node-drizzle';\nimport {\n  and,\n  desc,\n  eq,\n  isNotNull,\n  isNull,\n  ne,\n  not,\n  or,\n  type SQL,\n  type SQLWrapper,\n  sql,\n} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport type {UserStatus} from '#core/entities/user.js';\nimport type {db} from './db.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\nexport type AdministratorUserSummaryExecutor = ReturnType<typeof db> | Tx;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nconst UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst SEARCH_TERM_SEPARATOR = /\\s+/;\n\nexport interface ListAdministratorUserSummariesParams {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  search?: string | undefined;\n  status?: UserStatus | undefined;\n  eligible?: boolean | undefined;\n}\n\nexport interface ListAdministratorUserSummariesResult {\n  rows: AdministratorUserSummary[];\n  nextCursor: TimestampIdCursor | null;\n}\n\nfunction escapeLikeTerm(term: string): string {\n  return term.replace(/[\\\\%_]/g, (character) => `\\\\${character}`);\n}\n\nfunction isUuid(value: string): boolean {\n  return UUID_PATTERN.test(value);\n}\n\nfunction containsTerm(column: SQLWrapper, term: string): SQLWrapper {\n  return sql`${column} ILIKE ${`%${escapeLikeTerm(term)}%`}`;\n}\n\nfunction addEligibilityCondition(\n  conditions: SQL[],\n  params: Pick<ListAdministratorUserSummariesParams, 'actorId' | 'eligible'>,\n  activeAdminRoleUserId: SQLWrapper,\n): void {\n  const eligibleCondition = and(\n    eq(users.status, 'active'),\n    isNotNull(users.emailVerifiedAt),\n    isNull(activeAdminRoleUserId),\n    ne(users.id, params.actorId),\n  );\n  if (eligibleCondition && params.eligible === true) conditions.push(eligibleCondition);\n  if (eligibleCondition && params.eligible === false) conditions.push(not(eligibleCondition));\n}\n\nfunction addSearchConditions(conditions: SQL[], search: string | undefined): void {\n  const normalizedSearch = search?.trim() ?? '';\n  if (!normalizedSearch) return;\n  if (isUuid(normalizedSearch)) {\n    conditions.push(eq(users.id, normalizedSearch));\n    return;\n  }\n\n  for (const term of normalizedSearch.split(SEARCH_TERM_SEPARATOR)) {\n    const termCondition = or(containsTerm(users.name, term), containsTerm(users.email, term));\n    if (termCondition) conditions.push(termCondition);\n  }\n}\n\nexport async function findAdministratorUserSummary(\n  executor: AdministratorUserSummaryExecutor,\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserSummary | undefined> {\n  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);\n  const rows = await executor\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRole: adminGrants.role,\n    })\n    .from(users)\n    .leftJoin(\n      adminGrants,\n      and(\n        eq(adminGrants.userId, users.id),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    )\n    .where(identifier);\n\n  const first = rows[0];\n  if (!first) return undefined;\n\n  return {\n    id: first.id,\n    email: first.email,\n    name: first.name,\n    emailVerifiedAt: first.emailVerifiedAt,\n    status: first.status,\n    createdAt: first.createdAt,\n    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),\n  } satisfies AdministratorUserSummary;\n}\n\n/**\n * Lists a live directory view using keyset pagination.\n *\n * Pages are not a consistent snapshot. Each page reads current account and grant state, so\n * inserts and account or grant changes can make consecutive pages differ. Re-run the listing\n * before acting on a row.\n */\nexport async function listAdministratorUserSummaries(\n  executor: AdministratorUserSummaryExecutor,\n  params: ListAdministratorUserSummariesParams,\n): Promise<ListAdministratorUserSummariesResult> {\n  // Aggregate grants in a subquery so pagination is over users, not grants.\n  const activeAdminRoles = executor\n    .select({\n      userId: adminGrants.userId,\n      roles: sql<AdminRole[]>`json_agg(${adminGrants.role})`.as('roles'),\n    })\n    .from(adminGrants)\n    .where(isNull(adminGrants.revokedAt))\n    .groupBy(adminGrants.userId)\n    .as('active_admin_roles');\n\n  const conditions: SQL[] = [];\n  const cursorCondition = timestampIdCursorWhere({\n    timestampColumn: users.createdAt,\n    idColumn: users.id,\n    cursor: params.cursor,\n  });\n  if (cursorCondition) conditions.push(cursorCondition);\n  if (params.status) conditions.push(eq(users.status, params.status));\n\n  addEligibilityCondition(conditions, params, activeAdminRoles.userId);\n  addSearchConditions(conditions, params.search);\n\n  const rows = await executor\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRoles: activeAdminRoles.roles,\n    })\n    .from(users)\n    .leftJoin(activeAdminRoles, eq(activeAdminRoles.userId, users.id))\n    .where(and(...conditions))\n    .orderBy(desc(users.createdAt), desc(users.id))\n    .limit(params.limit + 1);\n\n  const mappedRows = rows.map(\n    ({adminRoles, ...row}): AdministratorUserSummary => ({\n      ...row,\n      adminRole: row.status === 'active' ? highestAdminRole(adminRoles ?? []) : null,\n    }),\n  );\n  const page = paginateTimestampIdRows({\n    rows: mappedRows,\n    limit: params.limit,\n    timestampKey: 'createdAt',\n  });\n\n  return {rows: page.pageRows, nextCursor: page.nextCursor};\n}\n"],"names":["paginateTimestampIdRows","timestampIdCursorWhere","and","desc","eq","isNotNull","isNull","ne","not","or","sql","highestAdminRole","adminGrants","users","UUID_PATTERN","SEARCH_TERM_SEPARATOR","escapeLikeTerm","term","replace","character","isUuid","value","test","containsTerm","column","addEligibilityCondition","conditions","params","activeAdminRoleUserId","eligibleCondition","status","emailVerifiedAt","id","actorId","eligible","push","addSearchConditions","search","normalizedSearch","trim","split","termCondition","name","email","findAdministratorUserSummary","executor","identifier","rows","select","createdAt","adminRole","role","from","leftJoin","userId","revokedAt","where","first","undefined","flatMap","listAdministratorUserSummaries","activeAdminRoles","roles","as","groupBy","cursorCondition","timestampColumn","idColumn","cursor","adminRoles","orderBy","limit","mappedRows","map","row","page","timestampKey","pageRows","nextCursor"],"mappings":"AACA,SACEA,uBAAuB,EAEvBC,sBAAsB,QACjB,wBAAwB;AAC/B,SACEC,GAAG,EACHC,IAAI,EACJC,EAAE,EACFC,SAAS,EACTC,MAAM,EACNC,EAAE,EACFC,GAAG,EACHC,EAAE,EAGFC,GAAG,QACE,cAAc;AACrB,SAAQC,gBAAgB,QAAO,4BAA4B;AAI3D,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,MAAMC,eAAe;AACrB,MAAMC,wBAAwB;AAgB9B,SAASC,eAAeC,IAAY;IAClC,OAAOA,KAAKC,OAAO,CAAC,WAAW,CAACC,YAAc,CAAC,EAAE,EAAEA,WAAW;AAChE;AAEA,SAASC,OAAOC,KAAa;IAC3B,OAAOP,aAAaQ,IAAI,CAACD;AAC3B;AAEA,SAASE,aAAaC,MAAkB,EAAEP,IAAY;IACpD,OAAOP,GAAG,CAAC,EAAEc,OAAO,OAAO,EAAE,CAAC,CAAC,EAAER,eAAeC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC5D;AAEA,SAASQ,wBACPC,UAAiB,EACjBC,MAA0E,EAC1EC,qBAAiC;IAEjC,MAAMC,oBAAoB3B,IACxBE,GAAGS,MAAMiB,MAAM,EAAE,WACjBzB,UAAUQ,MAAMkB,eAAe,GAC/BzB,OAAOsB,wBACPrB,GAAGM,MAAMmB,EAAE,EAAEL,OAAOM,OAAO;IAE7B,IAAIJ,qBAAqBF,OAAOO,QAAQ,KAAK,MAAMR,WAAWS,IAAI,CAACN;IACnE,IAAIA,qBAAqBF,OAAOO,QAAQ,KAAK,OAAOR,WAAWS,IAAI,CAAC3B,IAAIqB;AAC1E;AAEA,SAASO,oBAAoBV,UAAiB,EAAEW,MAA0B;IACxE,MAAMC,mBAAmBD,QAAQE,UAAU;IAC3C,IAAI,CAACD,kBAAkB;IACvB,IAAIlB,OAAOkB,mBAAmB;QAC5BZ,WAAWS,IAAI,CAAC/B,GAAGS,MAAMmB,EAAE,EAAEM;QAC7B;IACF;IAEA,KAAK,MAAMrB,QAAQqB,iBAAiBE,KAAK,CAACzB,uBAAwB;QAChE,MAAM0B,gBAAgBhC,GAAGc,aAAaV,MAAM6B,IAAI,EAAEzB,OAAOM,aAAaV,MAAM8B,KAAK,EAAE1B;QACnF,IAAIwB,eAAef,WAAWS,IAAI,CAACM;IACrC;AACF;AAEA,OAAO,eAAeG,6BACpBC,QAA0C,EAC1ClB,MAA+B;IAE/B,MAAMmB,aAAa,QAAQnB,SAASvB,GAAGS,MAAMmB,EAAE,EAAEL,OAAOK,EAAE,IAAI5B,GAAGS,MAAM8B,KAAK,EAAEhB,OAAOgB,KAAK;IAC1F,MAAMI,OAAO,MAAMF,SAChBG,MAAM,CAAC;QACNhB,IAAInB,MAAMmB,EAAE;QACZW,OAAO9B,MAAM8B,KAAK;QAClBD,MAAM7B,MAAM6B,IAAI;QAChBX,iBAAiBlB,MAAMkB,eAAe;QACtCD,QAAQjB,MAAMiB,MAAM;QACpBmB,WAAWpC,MAAMoC,SAAS;QAC1BC,WAAWtC,YAAYuC,IAAI;IAC7B,GACCC,IAAI,CAACvC,OACLwC,QAAQ,CACPzC,aACAV,IACEE,GAAGQ,YAAY0C,MAAM,EAAEzC,MAAMmB,EAAE,GAC/B1B,OAAOM,YAAY2C,SAAS,GAC5BnD,GAAGS,MAAMiB,MAAM,EAAE,YAGpB0B,KAAK,CAACV;IAET,MAAMW,QAAQV,IAAI,CAAC,EAAE;IACrB,IAAI,CAACU,OAAO,OAAOC;IAEnB,OAAO;QACL1B,IAAIyB,MAAMzB,EAAE;QACZW,OAAOc,MAAMd,KAAK;QAClBD,MAAMe,MAAMf,IAAI;QAChBX,iBAAiB0B,MAAM1B,eAAe;QACtCD,QAAQ2B,MAAM3B,MAAM;QACpBmB,WAAWQ,MAAMR,SAAS;QAC1BC,WAAWvC,iBAAiBoC,KAAKY,OAAO,CAAC,CAAC,EAACT,SAAS,EAAC,GAAMA,YAAY;gBAACA;aAAU,GAAG,EAAE;IACzF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,eAAeU,+BACpBf,QAA0C,EAC1ClB,MAA4C;IAE5C,0EAA0E;IAC1E,MAAMkC,mBAAmBhB,SACtBG,MAAM,CAAC;QACNM,QAAQ1C,YAAY0C,MAAM;QAC1BQ,OAAOpD,GAAgB,CAAC,SAAS,EAAEE,YAAYuC,IAAI,CAAC,CAAC,CAAC,CAACY,EAAE,CAAC;IAC5D,GACCX,IAAI,CAACxC,aACL4C,KAAK,CAAClD,OAAOM,YAAY2C,SAAS,GAClCS,OAAO,CAACpD,YAAY0C,MAAM,EAC1BS,EAAE,CAAC;IAEN,MAAMrC,aAAoB,EAAE;IAC5B,MAAMuC,kBAAkBhE,uBAAuB;QAC7CiE,iBAAiBrD,MAAMoC,SAAS;QAChCkB,UAAUtD,MAAMmB,EAAE;QAClBoC,QAAQzC,OAAOyC,MAAM;IACvB;IACA,IAAIH,iBAAiBvC,WAAWS,IAAI,CAAC8B;IACrC,IAAItC,OAAOG,MAAM,EAAEJ,WAAWS,IAAI,CAAC/B,GAAGS,MAAMiB,MAAM,EAAEH,OAAOG,MAAM;IAEjEL,wBAAwBC,YAAYC,QAAQkC,iBAAiBP,MAAM;IACnElB,oBAAoBV,YAAYC,OAAOU,MAAM;IAE7C,MAAMU,OAAO,MAAMF,SAChBG,MAAM,CAAC;QACNhB,IAAInB,MAAMmB,EAAE;QACZW,OAAO9B,MAAM8B,KAAK;QAClBD,MAAM7B,MAAM6B,IAAI;QAChBX,iBAAiBlB,MAAMkB,eAAe;QACtCD,QAAQjB,MAAMiB,MAAM;QACpBmB,WAAWpC,MAAMoC,SAAS;QAC1BoB,YAAYR,iBAAiBC,KAAK;IACpC,GACCV,IAAI,CAACvC,OACLwC,QAAQ,CAACQ,kBAAkBzD,GAAGyD,iBAAiBP,MAAM,EAAEzC,MAAMmB,EAAE,GAC/DwB,KAAK,CAACtD,OAAOwB,aACb4C,OAAO,CAACnE,KAAKU,MAAMoC,SAAS,GAAG9C,KAAKU,MAAMmB,EAAE,GAC5CuC,KAAK,CAAC5C,OAAO4C,KAAK,GAAG;IAExB,MAAMC,aAAazB,KAAK0B,GAAG,CACzB,CAAC,EAACJ,UAAU,EAAE,GAAGK,KAAI,GAAgC,CAAA;YACnD,GAAGA,GAAG;YACNxB,WAAWwB,IAAI5C,MAAM,KAAK,WAAWnB,iBAAiB0D,cAAc,EAAE,IAAI;QAC5E,CAAA;IAEF,MAAMM,OAAO3E,wBAAwB;QACnC+C,MAAMyB;QACND,OAAO5C,OAAO4C,KAAK;QACnBK,cAAc;IAChB;IAEA,OAAO;QAAC7B,MAAM4B,KAAKE,QAAQ;QAAEC,YAAYH,KAAKG,UAAU;IAAA;AAC1D"}

package/dist/db/admin-users.d.ts

@@ -1,4 +1,6 @@
+import type { TimestampIdCursor } from '@shipfox/node-drizzle';
 import type { AdministratorUserSummary } from '#core/entities/administrator-read-model.js';
+import { type ListAdministratorUserSummariesResult } from './admin-user-summary.js';
 export type AdministratorUserRecord = AdministratorUserSummary;
 type AdministratorUserLookup = {
     id: string;
@@ -8,5 +10,14 @@ type AdministratorUserLookup = {
     id?: never;
 };
 export declare function findAdministratorUser(params: AdministratorUserLookup): Promise<AdministratorUserRecord | undefined>;
+export interface ListAdministratorUsersParams {
+    actorId: string;
+    limit: number;
+    cursor?: TimestampIdCursor | undefined;
+    search?: string | undefined;
+    status?: AdministratorUserSummary['status'] | undefined;
+    eligible?: boolean | undefined;
+}
+export declare function listAdministratorUsers(params: ListAdministratorUsersParams): Promise<ListAdministratorUserSummariesResult>;
 export {};
 //# sourceMappingURL=admin-users.d.ts.map

package/dist/db/admin-users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/db/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,4CAA4C,CAAC;AAIzF,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAE/D,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAE9C"}
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/db/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,iBAAiB,EAAC,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAEL,KAAK,oCAAoC,EAE1C,MAAM,yBAAyB,CAAC;AAGjC,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,CAAC;AAE/D,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAE9C;AAED,MAAM,WAAW,4BAA4B;IAC3C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,iBAAiB,GAAG,SAAS,CAAC;IACvC,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GAAG,SAAS,CAAC;IACxD,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CAChC;AAED,wBAAsB,sBAAsB,CAC1C,MAAM,EAAE,4BAA4B,GACnC,OAAO,CAAC,oCAAoC,CAAC,CAE/C"}

package/dist/db/admin-users.js

@@ -1,7 +1,10 @@
-import { findAdministratorUserSummary } from './admin-user-summary.js';
+import { findAdministratorUserSummary, listAdministratorUserSummaries } from './admin-user-summary.js';
 import { db } from './db.js';
 export async function findAdministratorUser(params) {
     return await findAdministratorUserSummary(db(), params);
 }
+export async function listAdministratorUsers(params) {
+    return await listAdministratorUserSummaries(db(), params);
+}
 
 //# sourceMappingURL=admin-users.js.map

package/dist/db/admin-users.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/admin-users.ts"],"sourcesContent":["import type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport {findAdministratorUserSummary} from './admin-user-summary.js';\nimport {db} from './db.js';\n\nexport type AdministratorUserRecord = AdministratorUserSummary;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUser(\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserRecord | undefined> {\n  return await findAdministratorUserSummary(db(), params);\n}\n"],"names":["findAdministratorUserSummary","db","findAdministratorUser","params"],"mappings":"AACA,SAAQA,4BAA4B,QAAO,0BAA0B;AACrE,SAAQC,EAAE,QAAO,UAAU;AAM3B,OAAO,eAAeC,sBACpBC,MAA+B;IAE/B,OAAO,MAAMH,6BAA6BC,MAAME;AAClD"}
+{"version":3,"sources":["../../src/db/admin-users.ts"],"sourcesContent":["import type {TimestampIdCursor} from '@shipfox/node-drizzle';\nimport type {AdministratorUserSummary} from '#core/entities/administrator-read-model.js';\nimport {\n  findAdministratorUserSummary,\n  type ListAdministratorUserSummariesResult,\n  listAdministratorUserSummaries,\n} from './admin-user-summary.js';\nimport {db} from './db.js';\n\nexport type AdministratorUserRecord = AdministratorUserSummary;\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUser(\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserRecord | undefined> {\n  return await findAdministratorUserSummary(db(), params);\n}\n\nexport interface ListAdministratorUsersParams {\n  actorId: string;\n  limit: number;\n  cursor?: TimestampIdCursor | undefined;\n  search?: string | undefined;\n  status?: AdministratorUserSummary['status'] | undefined;\n  eligible?: boolean | undefined;\n}\n\nexport async function listAdministratorUsers(\n  params: ListAdministratorUsersParams,\n): Promise<ListAdministratorUserSummariesResult> {\n  return await listAdministratorUserSummaries(db(), params);\n}\n"],"names":["findAdministratorUserSummary","listAdministratorUserSummaries","db","findAdministratorUser","params","listAdministratorUsers"],"mappings":"AAEA,SACEA,4BAA4B,EAE5BC,8BAA8B,QACzB,0BAA0B;AACjC,SAAQC,EAAE,QAAO,UAAU;AAM3B,OAAO,eAAeC,sBACpBC,MAA+B;IAE/B,OAAO,MAAMJ,6BAA6BE,MAAME;AAClD;AAWA,OAAO,eAAeC,uBACpBD,MAAoC;IAEpC,OAAO,MAAMH,+BAA+BC,MAAME;AACpD"}

package/dist/db/agent-access.d.ts

@@ -0,0 +1,159 @@
+import type { AgentAuthorizationCode, AgentAuthorizationRequest, AgentClient, AgentGrant, AgentPersonalAccessToken, AgentRefreshToken } from '#core/entities/agent-access.js';
+import { db } from './db.js';
+export type AgentAccessTx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];
+type AgentAccessExecutor = ReturnType<typeof db> | AgentAccessTx;
+export interface CreateAgentClientParams {
+    clientId: string;
+    name: string;
+    redirectUris: string[];
+    kind: 'registered' | 'cimd';
+}
+export declare function createAgentClient(params: CreateAgentClientParams): Promise<AgentClient>;
+export declare function createAgentClientTx(tx: AgentAccessTx, params: CreateAgentClientParams): Promise<AgentClient>;
+export declare function findAgentClientByClientId(params: {
+    clientId: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentClient | undefined>;
+export declare function markAgentClientReferenced(tx: AgentAccessTx, params: {
+    clientUuid: string;
+}): Promise<void>;
+export declare function markAgentClientUnreferenced(tx: AgentAccessTx, params: {
+    clientUuid: string;
+}): Promise<void>;
+export interface CreateAgentAuthorizationRequestParams {
+    /** Internal `auth_agent_clients.id`, not the public OAuth `client_id`. */
+    clientId: string;
+    redirectUri: string;
+    resource: string;
+    scopes: string[];
+    codeChallenge: string;
+    state: string | null;
+    expiresAt: Date;
+}
+export declare function createAgentAuthorizationRequest(params: CreateAgentAuthorizationRequestParams): Promise<AgentAuthorizationRequest>;
+export declare function createAgentAuthorizationRequestTx(tx: AgentAccessTx, params: CreateAgentAuthorizationRequestParams): Promise<AgentAuthorizationRequest>;
+export declare function findPendingAgentAuthorizationRequest(params: {
+    id: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentAuthorizationRequest | undefined>;
+export declare function consumeAgentAuthorizationRequest(params: {
+    id: string;
+}): Promise<AgentAuthorizationRequest | undefined>;
+/**
+ * Claims a pending request in the caller's transaction. The expiry and
+ * consumed-at predicates are part of the update so concurrent approval and
+ * denial can have only one winner.
+ */
+export declare function consumeAgentAuthorizationRequestTx(tx: AgentAccessTx, params: {
+    id: string;
+}): Promise<AgentAuthorizationRequest | undefined>;
+export interface CreateAgentGrantParams {
+    userId: string;
+    workspaceId: string;
+    /** Internal `auth_agent_clients.id`, not the public OAuth `client_id`. */
+    clientId: string;
+    scopes: string[];
+}
+export declare function createAgentGrant(params: CreateAgentGrantParams): Promise<AgentGrant>;
+export declare function createAgentGrantTx(tx: AgentAccessTx, params: CreateAgentGrantParams): Promise<AgentGrant>;
+export declare function findAgentGrant(params: {
+    id: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentGrant | undefined>;
+/**
+ * Locks one grant row until the surrounding transaction ends. Code exchange
+ * and lifecycle transitions must use this same primitive before inspecting or
+ * changing grant state. Callers must keep the transaction database-only while
+ * this lock is held; external I/O must happen after commit.
+ */
+export declare function lockAgentGrant(tx: AgentAccessTx, params: {
+    grantId: string;
+}): Promise<AgentGrant | undefined>;
+export interface CreateAgentAuthorizationCodeParams {
+    grantId: string;
+    hashedCode: string;
+    codeChallenge: string;
+    redirectUri: string;
+    resource: string;
+    expiresAt: Date;
+}
+export declare function createAgentAuthorizationCode(params: CreateAgentAuthorizationCodeParams): Promise<AgentAuthorizationCode>;
+export declare function createAgentAuthorizationCodeTx(tx: AgentAccessTx, params: CreateAgentAuthorizationCodeParams): Promise<AgentAuthorizationCode>;
+export declare function findAgentAuthorizationCodeByHash(params: {
+    hashedCode: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentAuthorizationCode | undefined>;
+export declare function findActiveAgentAuthorizationCodeByHash(params: {
+    hashedCode: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentAuthorizationCode | undefined>;
+export declare function consumeAgentAuthorizationCode(params: {
+    hashedCode: string;
+}): Promise<AgentAuthorizationCode | undefined>;
+/** Claims an authorization code exactly once, including its 60-second TTL. */
+export declare function consumeAgentAuthorizationCodeTx(tx: AgentAccessTx, params: {
+    hashedCode: string;
+}): Promise<AgentAuthorizationCode | undefined>;
+export interface CreateAgentRefreshTokenParams {
+    grantId: string;
+    hashedToken: string;
+    expiresAt: Date;
+}
+export declare function createAgentRefreshToken(params: CreateAgentRefreshTokenParams): Promise<AgentRefreshToken>;
+export declare function createAgentRefreshTokenTx(tx: AgentAccessTx, params: CreateAgentRefreshTokenParams): Promise<AgentRefreshToken>;
+export declare function findAgentRefreshTokenByHash(params: {
+    hashedToken: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentRefreshToken | undefined>;
+export declare function findActiveAgentRefreshTokenByHash(params: {
+    hashedToken: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentRefreshToken | undefined>;
+/** Rotates a refresh token atomically; a concurrent rotation cannot win twice. */
+export declare function rotateAgentRefreshToken(params: {
+    hashedToken: string;
+    replacementHashedToken: string;
+    replacementExpiresAt: Date;
+}): Promise<AgentRefreshToken | undefined>;
+export declare function rotateAgentRefreshTokenTx(tx: AgentAccessTx, params: {
+    hashedToken: string;
+    replacementHashedToken: string;
+    replacementExpiresAt: Date;
+}): Promise<AgentRefreshToken | undefined>;
+export declare function revokeAgentRefreshToken(params: {
+    id: string;
+}): Promise<AgentRefreshToken | undefined>;
+export interface CreateAgentPersonalAccessTokenParams {
+    userId: string;
+    workspaceId: string;
+    hashedToken: string;
+    prefix: string;
+    name: string;
+    scopes: string[];
+    expiresAt: Date;
+}
+export declare function createAgentPersonalAccessToken(params: CreateAgentPersonalAccessTokenParams): Promise<AgentPersonalAccessToken>;
+export declare function createAgentPersonalAccessTokenTx(tx: AgentAccessTx, params: CreateAgentPersonalAccessTokenParams): Promise<AgentPersonalAccessToken>;
+export declare function findAgentPersonalAccessTokenByHash(params: {
+    hashedToken: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentPersonalAccessToken | undefined>;
+export declare function findActiveAgentPersonalAccessTokenByHash(params: {
+    hashedToken: string;
+    executor?: AgentAccessExecutor;
+}): Promise<AgentPersonalAccessToken | undefined>;
+export declare function markAgentPersonalAccessTokenUsed(params: {
+    id: string;
+}): Promise<AgentPersonalAccessToken | undefined>;
+export declare function revokeAgentPersonalAccessToken(params: {
+    id: string;
+}): Promise<AgentPersonalAccessToken | undefined>;
+export interface PruneAgentAccessParams {
+    retentionDays?: number;
+    limit?: number;
+    now?: Date;
+}
+/** Deletes terminal credentials and ephemeral authorization rows in bounded batches. */
+export declare function pruneAgentAccess(params?: PruneAgentAccessParams): Promise<number>;
+export {};
+//# sourceMappingURL=agent-access.d.ts.map

package/dist/db/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/db/agent-access.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EACX,UAAU,EACV,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,EAAE,EAAC,MAAM,SAAS,CAAC;AAgB3B,MAAM,MAAM,aAAa,GAAG,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAE/F,KAAK,mBAAmB,GAAG,UAAU,CAAC,OAAO,EAAE,CAAC,GAAG,aAAa,CAAC;AAEjE,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,IAAI,EAAE,YAAY,GAAG,MAAM,CAAC;CAC7B;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,WAAW,CAAC,CAE7F;AAED,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,WAAW,CAAC,CAgBtB;AAED,wBAAsB,yBAAyB,CAAC,MAAM,EAAE;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CASnC;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,wBAAsB,2BAA2B,CAC/C,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,GAC3B,OAAO,CAAC,IAAI,CAAC,CAKf;AAED,MAAM,WAAW,qCAAqC;IACpD,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,yBAAyB,CAAC,CAEpC;AAED,wBAAsB,iCAAiC,CACrD,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,qCAAqC,GAC5C,OAAO,CAAC,yBAAyB,CAAC,CAKpC;AAED,wBAAsB,oCAAoC,CAAC,MAAM,EAAE;IACjE,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAejD;AAED,wBAAsB,gCAAgC,CAAC,MAAM,EAAE;IAC7D,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAEjD;AAED;;;;GAIG;AACH,wBAAsB,kCAAkC,CACtD,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAC,EAAE,EAAE,MAAM,CAAA;CAAC,GACnB,OAAO,CAAC,yBAAyB,GAAG,SAAS,CAAC,CAchD;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAE1F;AAED,wBAAsB,kBAAkB,CACtC,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,sBAAsB,GAC7B,OAAO,CAAC,UAAU,CAAC,CA+BrB;AAED,wBAAsB,cAAc,CAAC,MAAM,EAAE;IAC3C,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CASlC;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GACxB,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CASjC;AAED,MAAM,WAAW,kCAAkC;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAEjC;AAED,wBAAsB,8BAA8B,CAClD,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,kCAAkC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAKjC;AAED,wBAAsB,gCAAgC,CAAC,MAAM,EAAE;IAC7D,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAS9C;AAED,wBAAsB,sCAAsC,CAAC,MAAM,EAAE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAe9C;AAED,wBAAsB,6BAA6B,CAAC,MAAM,EAAE;IAC1D,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAE9C;AAED,8EAA8E;AAC9E,wBAAsB,+BAA+B,CACnD,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IAAC,UAAU,EAAE,MAAM,CAAA;CAAC,GAC3B,OAAO,CAAC,sBAAsB,GAAG,SAAS,CAAC,CAc7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAE5B;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAK5B;AAED,wBAAsB,2BAA2B,CAAC,MAAM,EAAE;IACxD,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CASzC;AAED,wBAAsB,iCAAiC,CAAC,MAAM,EAAE;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAgBzC;AAED,kFAAkF;AAClF,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,EAAE,IAAI,CAAC;CAC5B,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAEzC;AAED,wBAAsB,yBAAyB,CAC7C,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE;IACN,WAAW,EAAE,MAAM,CAAC;IACpB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,oBAAoB,EAAE,IAAI,CAAC;CAC5B,GACA,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAqBxC;AAED,wBAAsB,uBAAuB,CAAC,MAAM,EAAE;IACpD,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAUzC;AAED,MAAM,WAAW,oCAAoC;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,oCAAoC,GAC3C,OAAO,CAAC,wBAAwB,CAAC,CAEnC;AAED,wBAAsB,gCAAgC,CACpD,EAAE,EAAE,aAAa,EACjB,MAAM,EAAE,oCAAoC,GAC3C,OAAO,CAAC,wBAAwB,CAAC,CAKnC;AAED,wBAAsB,kCAAkC,CAAC,MAAM,EAAE;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAShD;AAED,wBAAsB,wCAAwC,CAAC,MAAM,EAAE;IACrE,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,mBAAmB,CAAC;CAChC,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAehD;AAED,wBAAsB,gCAAgC,CAAC,MAAM,EAAE;IAC7D,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAQhD;AAED,wBAAsB,8BAA8B,CAAC,MAAM,EAAE;IAC3D,EAAE,EAAE,MAAM,CAAC;CACZ,GAAG,OAAO,CAAC,wBAAwB,GAAG,SAAS,CAAC,CAUhD;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,wFAAwF;AACxF,wBAAsB,gBAAgB,CAAC,MAAM,GAAE,sBAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF3F"}

package/dist/db/agent-access.js

@@ -0,0 +1,267 @@
+import { and, asc, eq, gt, inArray, isNull, lt, or, sql } from 'drizzle-orm';
+import { db } from './db.js';
+import { agentAuthorizationCodes, agentAuthorizationRequests, agentClients, agentGrants, agentPersonalAccessTokens, agentRefreshTokens, toAgentAuthorizationCode, toAgentAuthorizationRequest, toAgentClient, toAgentGrant, toAgentPersonalAccessToken, toAgentRefreshToken } from './schema/agent-access.js';
+export async function createAgentClient(params) {
+    return await db().transaction((tx)=>createAgentClientTx(tx, params));
+}
+export async function createAgentClientTx(tx, params) {
+    const rows = await tx.insert(agentClients).values(params).onConflictDoUpdate({
+        target: agentClients.clientId,
+        set: {
+            lastSeenAt: sql`now()`,
+            unreferencedAt: null,
+            updatedAt: sql`now()`
+        }
+    }).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Upsert returned no rows');
+    return toAgentClient(row);
+}
+export async function findAgentClientByClientId(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentClients).where(eq(agentClients.clientId, params.clientId)).limit(1);
+    const row = rows[0];
+    return row ? toAgentClient(row) : undefined;
+}
+export async function markAgentClientReferenced(tx, params) {
+    await tx.update(agentClients).set({
+        unreferencedAt: null,
+        lastSeenAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(eq(agentClients.id, params.clientUuid));
+}
+export async function markAgentClientUnreferenced(tx, params) {
+    await tx.update(agentClients).set({
+        unreferencedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(eq(agentClients.id, params.clientUuid));
+}
+export async function createAgentAuthorizationRequest(params) {
+    return await db().transaction((tx)=>createAgentAuthorizationRequestTx(tx, params));
+}
+export async function createAgentAuthorizationRequestTx(tx, params) {
+    const rows = await tx.insert(agentAuthorizationRequests).values(params).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toAgentAuthorizationRequest(row);
+}
+export async function findPendingAgentAuthorizationRequest(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentAuthorizationRequests).where(and(eq(agentAuthorizationRequests.id, params.id), isNull(agentAuthorizationRequests.consumedAt), gt(agentAuthorizationRequests.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    return row ? toAgentAuthorizationRequest(row) : undefined;
+}
+export async function consumeAgentAuthorizationRequest(params) {
+    return await db().transaction((tx)=>consumeAgentAuthorizationRequestTx(tx, params));
+}
+/**
+ * Claims a pending request in the caller's transaction. The expiry and
+ * consumed-at predicates are part of the update so concurrent approval and
+ * denial can have only one winner.
+ */ export async function consumeAgentAuthorizationRequestTx(tx, params) {
+    const rows = await tx.update(agentAuthorizationRequests).set({
+        consumedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(agentAuthorizationRequests.id, params.id), isNull(agentAuthorizationRequests.consumedAt), gt(agentAuthorizationRequests.expiresAt, sql`now()`))).returning();
+    const row = rows[0];
+    return row ? toAgentAuthorizationRequest(row) : undefined;
+}
+export async function createAgentGrant(params) {
+    return await db().transaction((tx)=>createAgentGrantTx(tx, params));
+}
+export async function createAgentGrantTx(tx, params) {
+    const rows = await tx.insert(agentGrants).values(params).onConflictDoUpdate({
+        target: [
+            agentGrants.userId,
+            agentGrants.workspaceId,
+            agentGrants.clientId
+        ],
+        targetWhere: sql`${agentGrants.revokedAt} IS NULL AND ${agentGrants.terminalAt} IS NULL`,
+        set: {
+            scopes: params.scopes,
+            updatedAt: sql`now()`
+        }
+    }).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Upsert returned no rows');
+    // Refresh tokens derive their scopes from the grant. Reauthorization must
+    // invalidate existing tokens before the grant's scopes can be widened.
+    await tx.update(agentRefreshTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(agentRefreshTokens.grantId, row.id), isNull(agentRefreshTokens.rotatedAt), isNull(agentRefreshTokens.revokedAt)));
+    await markAgentClientReferenced(tx, {
+        clientUuid: params.clientId
+    });
+    return toAgentGrant(row);
+}
+export async function findAgentGrant(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentGrants).where(eq(agentGrants.id, params.id)).limit(1);
+    const row = rows[0];
+    return row ? toAgentGrant(row) : undefined;
+}
+/**
+ * Locks one grant row until the surrounding transaction ends. Code exchange
+ * and lifecycle transitions must use this same primitive before inspecting or
+ * changing grant state. Callers must keep the transaction database-only while
+ * this lock is held; external I/O must happen after commit.
+ */ export async function lockAgentGrant(tx, params) {
+    const rows = await tx.select().from(agentGrants).where(eq(agentGrants.id, params.grantId)).for('update').limit(1);
+    const row = rows[0];
+    return row ? toAgentGrant(row) : undefined;
+}
+export async function createAgentAuthorizationCode(params) {
+    return await db().transaction((tx)=>createAgentAuthorizationCodeTx(tx, params));
+}
+export async function createAgentAuthorizationCodeTx(tx, params) {
+    const rows = await tx.insert(agentAuthorizationCodes).values(params).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toAgentAuthorizationCode(row);
+}
+export async function findAgentAuthorizationCodeByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentAuthorizationCodes).where(eq(agentAuthorizationCodes.hashedCode, params.hashedCode)).limit(1);
+    const row = rows[0];
+    return row ? toAgentAuthorizationCode(row) : undefined;
+}
+export async function findActiveAgentAuthorizationCodeByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentAuthorizationCodes).where(and(eq(agentAuthorizationCodes.hashedCode, params.hashedCode), isNull(agentAuthorizationCodes.consumedAt), gt(agentAuthorizationCodes.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    return row ? toAgentAuthorizationCode(row) : undefined;
+}
+export async function consumeAgentAuthorizationCode(params) {
+    return await db().transaction((tx)=>consumeAgentAuthorizationCodeTx(tx, params));
+}
+/** Claims an authorization code exactly once, including its 60-second TTL. */ export async function consumeAgentAuthorizationCodeTx(tx, params) {
+    const rows = await tx.update(agentAuthorizationCodes).set({
+        consumedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(agentAuthorizationCodes.hashedCode, params.hashedCode), isNull(agentAuthorizationCodes.consumedAt), gt(agentAuthorizationCodes.expiresAt, sql`now()`))).returning();
+    const row = rows[0];
+    return row ? toAgentAuthorizationCode(row) : undefined;
+}
+export async function createAgentRefreshToken(params) {
+    return await db().transaction((tx)=>createAgentRefreshTokenTx(tx, params));
+}
+export async function createAgentRefreshTokenTx(tx, params) {
+    const rows = await tx.insert(agentRefreshTokens).values(params).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toAgentRefreshToken(row);
+}
+export async function findAgentRefreshTokenByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentRefreshTokens).where(eq(agentRefreshTokens.hashedToken, params.hashedToken)).limit(1);
+    const row = rows[0];
+    return row ? toAgentRefreshToken(row) : undefined;
+}
+export async function findActiveAgentRefreshTokenByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentRefreshTokens).where(and(eq(agentRefreshTokens.hashedToken, params.hashedToken), isNull(agentRefreshTokens.rotatedAt), isNull(agentRefreshTokens.revokedAt), gt(agentRefreshTokens.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    return row ? toAgentRefreshToken(row) : undefined;
+}
+/** Rotates a refresh token atomically; a concurrent rotation cannot win twice. */ export async function rotateAgentRefreshToken(params) {
+    return await db().transaction((tx)=>rotateAgentRefreshTokenTx(tx, params));
+}
+export async function rotateAgentRefreshTokenTx(tx, params) {
+    const rows = await tx.update(agentRefreshTokens).set({
+        rotatedAt: sql`now()`,
+        lastUsedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(agentRefreshTokens.hashedToken, params.hashedToken), isNull(agentRefreshTokens.rotatedAt), isNull(agentRefreshTokens.revokedAt), gt(agentRefreshTokens.expiresAt, sql`now()`))).returning();
+    const row = rows[0];
+    if (!row) return undefined;
+    return await createAgentRefreshTokenTx(tx, {
+        grantId: row.grantId,
+        hashedToken: params.replacementHashedToken,
+        expiresAt: params.replacementExpiresAt
+    });
+}
+export async function revokeAgentRefreshToken(params) {
+    return await db().transaction(async (tx)=>{
+        const rows = await tx.update(agentRefreshTokens).set({
+            revokedAt: sql`now()`,
+            updatedAt: sql`now()`
+        }).where(and(eq(agentRefreshTokens.id, params.id), isNull(agentRefreshTokens.revokedAt))).returning();
+        const row = rows[0];
+        return row ? toAgentRefreshToken(row) : undefined;
+    });
+}
+export async function createAgentPersonalAccessToken(params) {
+    return await db().transaction((tx)=>createAgentPersonalAccessTokenTx(tx, params));
+}
+export async function createAgentPersonalAccessTokenTx(tx, params) {
+    const rows = await tx.insert(agentPersonalAccessTokens).values(params).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toAgentPersonalAccessToken(row);
+}
+export async function findAgentPersonalAccessTokenByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentPersonalAccessTokens).where(eq(agentPersonalAccessTokens.hashedToken, params.hashedToken)).limit(1);
+    const row = rows[0];
+    return row ? toAgentPersonalAccessToken(row) : undefined;
+}
+export async function findActiveAgentPersonalAccessTokenByHash(params) {
+    const executor = params.executor ?? db();
+    const rows = await executor.select().from(agentPersonalAccessTokens).where(and(eq(agentPersonalAccessTokens.hashedToken, params.hashedToken), isNull(agentPersonalAccessTokens.revokedAt), gt(agentPersonalAccessTokens.expiresAt, sql`now()`))).limit(1);
+    const row = rows[0];
+    return row ? toAgentPersonalAccessToken(row) : undefined;
+}
+export async function markAgentPersonalAccessTokenUsed(params) {
+    const rows = await db().update(agentPersonalAccessTokens).set({
+        lastUsedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(eq(agentPersonalAccessTokens.id, params.id)).returning();
+    const row = rows[0];
+    return row ? toAgentPersonalAccessToken(row) : undefined;
+}
+export async function revokeAgentPersonalAccessToken(params) {
+    const rows = await db().update(agentPersonalAccessTokens).set({
+        revokedAt: sql`now()`,
+        updatedAt: sql`now()`
+    }).where(and(eq(agentPersonalAccessTokens.id, params.id), isNull(agentPersonalAccessTokens.revokedAt))).returning();
+    const row = rows[0];
+    return row ? toAgentPersonalAccessToken(row) : undefined;
+}
+/** Deletes terminal credentials and ephemeral authorization rows in bounded batches. */ export async function pruneAgentAccess(params = {}) {
+    const now = params.now ?? new Date();
+    const retentionDays = params.retentionDays ?? 7;
+    const limit = params.limit ?? 1000;
+    const cutoff = new Date(now.getTime() - retentionDays * 24 * 60 * 60 * 1000);
+    return await db().transaction(async (tx)=>{
+        const requestIds = tx.select({
+            id: agentAuthorizationRequests.id
+        }).from(agentAuthorizationRequests).where(or(lt(agentAuthorizationRequests.consumedAt, cutoff), and(isNull(agentAuthorizationRequests.consumedAt), lt(agentAuthorizationRequests.expiresAt, cutoff)))).orderBy(asc(agentAuthorizationRequests.expiresAt), asc(agentAuthorizationRequests.id)).limit(limit);
+        const codeIds = tx.select({
+            id: agentAuthorizationCodes.id
+        }).from(agentAuthorizationCodes).where(or(lt(agentAuthorizationCodes.consumedAt, cutoff), and(isNull(agentAuthorizationCodes.consumedAt), lt(agentAuthorizationCodes.expiresAt, cutoff)))).orderBy(asc(agentAuthorizationCodes.expiresAt), asc(agentAuthorizationCodes.id)).limit(limit);
+        const refreshTokenIds = tx.select({
+            id: agentRefreshTokens.id
+        }).from(agentRefreshTokens).where(or(lt(agentRefreshTokens.rotatedAt, cutoff), and(isNull(agentRefreshTokens.rotatedAt), lt(agentRefreshTokens.revokedAt, cutoff)), and(isNull(agentRefreshTokens.rotatedAt), isNull(agentRefreshTokens.revokedAt), lt(agentRefreshTokens.expiresAt, cutoff)))).orderBy(asc(agentRefreshTokens.expiresAt), asc(agentRefreshTokens.id)).limit(limit);
+        const patIds = tx.select({
+            id: agentPersonalAccessTokens.id
+        }).from(agentPersonalAccessTokens).where(or(lt(agentPersonalAccessTokens.revokedAt, cutoff), and(isNull(agentPersonalAccessTokens.revokedAt), lt(agentPersonalAccessTokens.expiresAt, cutoff)))).orderBy(asc(agentPersonalAccessTokens.expiresAt), asc(agentPersonalAccessTokens.id)).limit(limit);
+        const [requests, codes, refreshTokens, pats] = await Promise.all([
+            tx.delete(agentAuthorizationRequests).where(inArray(agentAuthorizationRequests.id, requestIds)).returning({
+                id: agentAuthorizationRequests.id
+            }),
+            tx.delete(agentAuthorizationCodes).where(inArray(agentAuthorizationCodes.id, codeIds)).returning({
+                id: agentAuthorizationCodes.id
+            }),
+            tx.delete(agentRefreshTokens).where(inArray(agentRefreshTokens.id, refreshTokenIds)).returning({
+                id: agentRefreshTokens.id
+            }),
+            tx.delete(agentPersonalAccessTokens).where(inArray(agentPersonalAccessTokens.id, patIds)).returning({
+                id: agentPersonalAccessTokens.id
+            })
+        ]);
+        return requests.length + codes.length + refreshTokens.length + pats.length;
+    });
+}
+
+//# sourceMappingURL=agent-access.js.map