@shipfox/api-auth 18.0.0 → 20.0.0

package/dist/db/schema/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../../src/db/schema/agent-access.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EACV,sBAAsB,EACtB,yBAAyB,EACzB,WAAW,EAEX,UAAU,EACV,wBAAwB,EACxB,iBAAiB,EAClB,MAAM,gCAAgC,CAAC;AAIxC,eAAO,MAAM,mBAAmB,8DAA2D,CAAC;AAE5F,eAAO,MAAM,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBxB,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBtC,CAAC;AAEF,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA2BvB,CAAC;AAEF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAqBnC,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyB9B,CAAC;AAEF,eAAO,MAAM,yBAAyB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAyBrC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AAC7D,MAAM,MAAM,mBAAmB,GAAG,OAAO,YAAY,CAAC,YAAY,CAAC;AACnE,MAAM,MAAM,2BAA2B,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AACzF,MAAM,MAAM,iCAAiC,GAAG,OAAO,0BAA0B,CAAC,YAAY,CAAC;AAC/F,MAAM,MAAM,YAAY,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AAC3D,MAAM,MAAM,kBAAkB,GAAG,OAAO,WAAW,CAAC,YAAY,CAAC;AACjE,MAAM,MAAM,wBAAwB,GAAG,OAAO,uBAAuB,CAAC,YAAY,CAAC;AACnF,MAAM,MAAM,8BAA8B,GAAG,OAAO,uBAAuB,CAAC,YAAY,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AACzE,MAAM,MAAM,yBAAyB,GAAG,OAAO,kBAAkB,CAAC,YAAY,CAAC;AAC/E,MAAM,MAAM,0BAA0B,GAAG,OAAO,yBAAyB,CAAC,YAAY,CAAC;AACvF,MAAM,MAAM,gCAAgC,GAAG,OAAO,yBAAyB,CAAC,YAAY,CAAC;AAE7F,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,GAAG,WAAW,CAY7D;AAED,wBAAgB,2BAA2B,CACzC,GAAG,EAAE,2BAA2B,GAC/B,yBAAyB,CAc3B;AAED,wBAAgB,YAAY,CAAC,GAAG,EAAE,YAAY,GAAG,UAAU,CAa1D;AAED,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,wBAAwB,GAAG,sBAAsB,CAa9F;AAED,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,GAAG,iBAAiB,CAY/E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,0BAA0B,GAC9B,wBAAwB,CAe1B"}

package/dist/db/schema/agent-access.js

@@ -0,0 +1,267 @@
+import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { sql } from 'drizzle-orm';
+import { index, pgEnum, text, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+import { users } from './users.js';
+export const agentClientKindEnum = pgEnum('auth_agent_client_kind', [
+    'registered',
+    'cimd'
+]);
+export const agentClients = pgTable('agent_clients', {
+    id: uuidv7PrimaryKey(),
+    clientId: text('client_id').notNull(),
+    name: text('name').notNull(),
+    redirectUris: text('redirect_uris').array().notNull(),
+    kind: agentClientKindEnum('kind').notNull(),
+    lastSeenAt: timestamp('last_seen_at', {
+        withTimezone: true
+    }),
+    unreferencedAt: timestamp('unreferenced_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_agent_clients_client_id_unique').on(table.clientId),
+        index('auth_agent_clients_unreferenced_at_idx').on(table.unreferencedAt),
+        index('auth_agent_clients_created_at_idx').on(table.createdAt)
+    ]);
+export const agentAuthorizationRequests = pgTable('agent_authorization_requests', {
+    id: uuidv7PrimaryKey(),
+    clientId: uuid('client_id').notNull().references(()=>agentClients.id, {
+        onDelete: 'cascade'
+    }),
+    redirectUri: text('redirect_uri').notNull(),
+    resource: text('resource').notNull(),
+    scopes: text('scopes').array().notNull(),
+    codeChallenge: text('code_challenge').notNull(),
+    state: text('state'),
+    expiresAt: timestamp('expires_at', {
+        withTimezone: true
+    }).notNull(),
+    consumedAt: timestamp('consumed_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        index('auth_agent_authorization_requests_client_id_idx').on(table.clientId),
+        index('auth_agent_authorization_requests_expires_at_idx').on(table.expiresAt)
+    ]);
+export const agentGrants = pgTable('agent_grants', {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    workspaceId: uuid('workspace_id').notNull(),
+    clientId: uuid('client_id').notNull().references(()=>agentClients.id, {
+        onDelete: 'cascade'
+    }),
+    scopes: text('scopes').array().notNull(),
+    lastUsedAt: timestamp('last_used_at', {
+        withTimezone: true
+    }),
+    revokedAt: timestamp('revoked_at', {
+        withTimezone: true
+    }),
+    terminalAt: timestamp('terminal_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        index('auth_agent_grants_user_id_idx').on(table.userId),
+        index('auth_agent_grants_workspace_id_idx').on(table.workspaceId),
+        index('auth_agent_grants_client_id_idx').on(table.clientId),
+        index('auth_agent_grants_terminal_at_idx').on(table.terminalAt),
+        uniqueIndex('auth_agent_grants_active_user_workspace_client_unique').on(table.userId, table.workspaceId, table.clientId).where(sql`${table.revokedAt} IS NULL AND ${table.terminalAt} IS NULL`)
+    ]);
+export const agentAuthorizationCodes = pgTable('agent_authorization_codes', {
+    id: uuidv7PrimaryKey(),
+    grantId: uuid('grant_id').notNull().references(()=>agentGrants.id, {
+        onDelete: 'cascade'
+    }),
+    hashedCode: text('hashed_code').notNull(),
+    codeChallenge: text('code_challenge').notNull(),
+    redirectUri: text('redirect_uri').notNull(),
+    resource: text('resource').notNull(),
+    expiresAt: timestamp('expires_at', {
+        withTimezone: true
+    }).notNull(),
+    consumedAt: timestamp('consumed_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_agent_authorization_codes_hashed_code_unique').on(table.hashedCode),
+        index('auth_agent_authorization_codes_grant_id_idx').on(table.grantId),
+        index('auth_agent_authorization_codes_expires_at_idx').on(table.expiresAt)
+    ]);
+export const agentRefreshTokens = pgTable('agent_refresh_tokens', {
+    id: uuidv7PrimaryKey(),
+    grantId: uuid('grant_id').notNull().references(()=>agentGrants.id, {
+        onDelete: 'cascade'
+    }),
+    hashedToken: text('hashed_token').notNull(),
+    expiresAt: timestamp('expires_at', {
+        withTimezone: true
+    }).notNull(),
+    rotatedAt: timestamp('rotated_at', {
+        withTimezone: true
+    }),
+    revokedAt: timestamp('revoked_at', {
+        withTimezone: true
+    }),
+    lastUsedAt: timestamp('last_used_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_agent_refresh_tokens_hashed_token_unique').on(table.hashedToken),
+        uniqueIndex('auth_agent_refresh_tokens_live_grant_unique').on(table.grantId).where(sql`${table.rotatedAt} IS NULL AND ${table.revokedAt} IS NULL`),
+        index('auth_agent_refresh_tokens_grant_id_idx').on(table.grantId),
+        index('auth_agent_refresh_tokens_expires_at_idx').on(table.expiresAt),
+        index('auth_agent_refresh_tokens_rotated_at_idx').on(table.rotatedAt),
+        index('auth_agent_refresh_tokens_revoked_at_idx').on(table.revokedAt)
+    ]);
+export const agentPersonalAccessTokens = pgTable('agent_pats', {
+    id: uuidv7PrimaryKey(),
+    userId: uuid('user_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    workspaceId: uuid('workspace_id').notNull(),
+    hashedToken: text('hashed_token').notNull(),
+    prefix: text('prefix').notNull(),
+    name: text('name').notNull(),
+    scopes: text('scopes').array().notNull(),
+    expiresAt: timestamp('expires_at', {
+        withTimezone: true
+    }).notNull(),
+    lastUsedAt: timestamp('last_used_at', {
+        withTimezone: true
+    }),
+    revokedAt: timestamp('revoked_at', {
+        withTimezone: true
+    }),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_agent_pats_hashed_token_unique').on(table.hashedToken),
+        index('auth_agent_pats_user_id_idx').on(table.userId),
+        index('auth_agent_pats_workspace_id_idx').on(table.workspaceId),
+        index('auth_agent_pats_expires_at_idx').on(table.expiresAt),
+        index('auth_agent_pats_revoked_at_idx').on(table.revokedAt)
+    ]);
+export function toAgentClient(row) {
+    return {
+        id: row.id,
+        clientId: row.clientId,
+        name: row.name,
+        redirectUris: row.redirectUris,
+        kind: row.kind,
+        lastSeenAt: row.lastSeenAt,
+        unreferencedAt: row.unreferencedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export function toAgentAuthorizationRequest(row) {
+    return {
+        id: row.id,
+        clientId: row.clientId,
+        redirectUri: row.redirectUri,
+        resource: row.resource,
+        scopes: row.scopes,
+        codeChallenge: row.codeChallenge,
+        state: row.state,
+        expiresAt: row.expiresAt,
+        consumedAt: row.consumedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export function toAgentGrant(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        workspaceId: row.workspaceId,
+        clientId: row.clientId,
+        scopes: row.scopes,
+        lastUsedAt: row.lastUsedAt,
+        revokedAt: row.revokedAt,
+        terminalAt: row.terminalAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export function toAgentAuthorizationCode(row) {
+    return {
+        id: row.id,
+        grantId: row.grantId,
+        hashedCode: row.hashedCode,
+        codeChallenge: row.codeChallenge,
+        redirectUri: row.redirectUri,
+        resource: row.resource,
+        expiresAt: row.expiresAt,
+        consumedAt: row.consumedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export function toAgentRefreshToken(row) {
+    return {
+        id: row.id,
+        grantId: row.grantId,
+        hashedToken: row.hashedToken,
+        expiresAt: row.expiresAt,
+        rotatedAt: row.rotatedAt,
+        revokedAt: row.revokedAt,
+        lastUsedAt: row.lastUsedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+export function toAgentPersonalAccessToken(row) {
+    return {
+        id: row.id,
+        userId: row.userId,
+        workspaceId: row.workspaceId,
+        hashedToken: row.hashedToken,
+        prefix: row.prefix,
+        name: row.name,
+        scopes: row.scopes,
+        expiresAt: row.expiresAt,
+        lastUsedAt: row.lastUsedAt,
+        revokedAt: row.revokedAt,
+        createdAt: row.createdAt,
+        updatedAt: row.updatedAt
+    };
+}
+
+//# sourceMappingURL=agent-access.js.map

package/dist/db/schema/agent-access.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/agent-access.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {sql} from 'drizzle-orm';\nimport {index, pgEnum, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport type {\n  AgentAuthorizationCode,\n  AgentAuthorizationRequest,\n  AgentClient,\n  AgentClientKind,\n  AgentGrant,\n  AgentPersonalAccessToken,\n  AgentRefreshToken,\n} from '#core/entities/agent-access.js';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport const agentClientKindEnum = pgEnum('auth_agent_client_kind', ['registered', 'cimd']);\n\nexport const agentClients = pgTable(\n  'agent_clients',\n  {\n    id: uuidv7PrimaryKey(),\n    clientId: text('client_id').notNull(),\n    name: text('name').notNull(),\n    redirectUris: text('redirect_uris').array().notNull(),\n    kind: agentClientKindEnum('kind').notNull(),\n    lastSeenAt: timestamp('last_seen_at', {withTimezone: true}),\n    unreferencedAt: timestamp('unreferenced_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_agent_clients_client_id_unique').on(table.clientId),\n    index('auth_agent_clients_unreferenced_at_idx').on(table.unreferencedAt),\n    index('auth_agent_clients_created_at_idx').on(table.createdAt),\n  ],\n);\n\nexport const agentAuthorizationRequests = pgTable(\n  'agent_authorization_requests',\n  {\n    id: uuidv7PrimaryKey(),\n    clientId: uuid('client_id')\n      .notNull()\n      .references(() => agentClients.id, {onDelete: 'cascade'}),\n    redirectUri: text('redirect_uri').notNull(),\n    resource: text('resource').notNull(),\n    scopes: text('scopes').array().notNull(),\n    codeChallenge: text('code_challenge').notNull(),\n    state: text('state'),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    consumedAt: timestamp('consumed_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    index('auth_agent_authorization_requests_client_id_idx').on(table.clientId),\n    index('auth_agent_authorization_requests_expires_at_idx').on(table.expiresAt),\n  ],\n);\n\nexport const agentGrants = pgTable(\n  'agent_grants',\n  {\n    id: uuidv7PrimaryKey(),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    workspaceId: uuid('workspace_id').notNull(),\n    clientId: uuid('client_id')\n      .notNull()\n      .references(() => agentClients.id, {onDelete: 'cascade'}),\n    scopes: text('scopes').array().notNull(),\n    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    terminalAt: timestamp('terminal_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    index('auth_agent_grants_user_id_idx').on(table.userId),\n    index('auth_agent_grants_workspace_id_idx').on(table.workspaceId),\n    index('auth_agent_grants_client_id_idx').on(table.clientId),\n    index('auth_agent_grants_terminal_at_idx').on(table.terminalAt),\n    uniqueIndex('auth_agent_grants_active_user_workspace_client_unique')\n      .on(table.userId, table.workspaceId, table.clientId)\n      .where(sql`${table.revokedAt} IS NULL AND ${table.terminalAt} IS NULL`),\n  ],\n);\n\nexport const agentAuthorizationCodes = pgTable(\n  'agent_authorization_codes',\n  {\n    id: uuidv7PrimaryKey(),\n    grantId: uuid('grant_id')\n      .notNull()\n      .references(() => agentGrants.id, {onDelete: 'cascade'}),\n    hashedCode: text('hashed_code').notNull(),\n    codeChallenge: text('code_challenge').notNull(),\n    redirectUri: text('redirect_uri').notNull(),\n    resource: text('resource').notNull(),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    consumedAt: timestamp('consumed_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_agent_authorization_codes_hashed_code_unique').on(table.hashedCode),\n    index('auth_agent_authorization_codes_grant_id_idx').on(table.grantId),\n    index('auth_agent_authorization_codes_expires_at_idx').on(table.expiresAt),\n  ],\n);\n\nexport const agentRefreshTokens = pgTable(\n  'agent_refresh_tokens',\n  {\n    id: uuidv7PrimaryKey(),\n    grantId: uuid('grant_id')\n      .notNull()\n      .references(() => agentGrants.id, {onDelete: 'cascade'}),\n    hashedToken: text('hashed_token').notNull(),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    rotatedAt: timestamp('rotated_at', {withTimezone: true}),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_agent_refresh_tokens_hashed_token_unique').on(table.hashedToken),\n    uniqueIndex('auth_agent_refresh_tokens_live_grant_unique')\n      .on(table.grantId)\n      .where(sql`${table.rotatedAt} IS NULL AND ${table.revokedAt} IS NULL`),\n    index('auth_agent_refresh_tokens_grant_id_idx').on(table.grantId),\n    index('auth_agent_refresh_tokens_expires_at_idx').on(table.expiresAt),\n    index('auth_agent_refresh_tokens_rotated_at_idx').on(table.rotatedAt),\n    index('auth_agent_refresh_tokens_revoked_at_idx').on(table.revokedAt),\n  ],\n);\n\nexport const agentPersonalAccessTokens = pgTable(\n  'agent_pats',\n  {\n    id: uuidv7PrimaryKey(),\n    userId: uuid('user_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    workspaceId: uuid('workspace_id').notNull(),\n    hashedToken: text('hashed_token').notNull(),\n    prefix: text('prefix').notNull(),\n    name: text('name').notNull(),\n    scopes: text('scopes').array().notNull(),\n    expiresAt: timestamp('expires_at', {withTimezone: true}).notNull(),\n    lastUsedAt: timestamp('last_used_at', {withTimezone: true}),\n    revokedAt: timestamp('revoked_at', {withTimezone: true}),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_agent_pats_hashed_token_unique').on(table.hashedToken),\n    index('auth_agent_pats_user_id_idx').on(table.userId),\n    index('auth_agent_pats_workspace_id_idx').on(table.workspaceId),\n    index('auth_agent_pats_expires_at_idx').on(table.expiresAt),\n    index('auth_agent_pats_revoked_at_idx').on(table.revokedAt),\n  ],\n);\n\nexport type AgentClientDb = typeof agentClients.$inferSelect;\nexport type AgentClientCreateDb = typeof agentClients.$inferInsert;\nexport type AgentAuthorizationRequestDb = typeof agentAuthorizationRequests.$inferSelect;\nexport type AgentAuthorizationRequestCreateDb = typeof agentAuthorizationRequests.$inferInsert;\nexport type AgentGrantDb = typeof agentGrants.$inferSelect;\nexport type AgentGrantCreateDb = typeof agentGrants.$inferInsert;\nexport type AgentAuthorizationCodeDb = typeof agentAuthorizationCodes.$inferSelect;\nexport type AgentAuthorizationCodeCreateDb = typeof agentAuthorizationCodes.$inferInsert;\nexport type AgentRefreshTokenDb = typeof agentRefreshTokens.$inferSelect;\nexport type AgentRefreshTokenCreateDb = typeof agentRefreshTokens.$inferInsert;\nexport type AgentPersonalAccessTokenDb = typeof agentPersonalAccessTokens.$inferSelect;\nexport type AgentPersonalAccessTokenCreateDb = typeof agentPersonalAccessTokens.$inferInsert;\n\nexport function toAgentClient(row: AgentClientDb): AgentClient {\n  return {\n    id: row.id,\n    clientId: row.clientId,\n    name: row.name,\n    redirectUris: row.redirectUris,\n    kind: row.kind as AgentClientKind,\n    lastSeenAt: row.lastSeenAt,\n    unreferencedAt: row.unreferencedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport function toAgentAuthorizationRequest(\n  row: AgentAuthorizationRequestDb,\n): AgentAuthorizationRequest {\n  return {\n    id: row.id,\n    clientId: row.clientId,\n    redirectUri: row.redirectUri,\n    resource: row.resource,\n    scopes: row.scopes,\n    codeChallenge: row.codeChallenge,\n    state: row.state,\n    expiresAt: row.expiresAt,\n    consumedAt: row.consumedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport function toAgentGrant(row: AgentGrantDb): AgentGrant {\n  return {\n    id: row.id,\n    userId: row.userId,\n    workspaceId: row.workspaceId,\n    clientId: row.clientId,\n    scopes: row.scopes,\n    lastUsedAt: row.lastUsedAt,\n    revokedAt: row.revokedAt,\n    terminalAt: row.terminalAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport function toAgentAuthorizationCode(row: AgentAuthorizationCodeDb): AgentAuthorizationCode {\n  return {\n    id: row.id,\n    grantId: row.grantId,\n    hashedCode: row.hashedCode,\n    codeChallenge: row.codeChallenge,\n    redirectUri: row.redirectUri,\n    resource: row.resource,\n    expiresAt: row.expiresAt,\n    consumedAt: row.consumedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport function toAgentRefreshToken(row: AgentRefreshTokenDb): AgentRefreshToken {\n  return {\n    id: row.id,\n    grantId: row.grantId,\n    hashedToken: row.hashedToken,\n    expiresAt: row.expiresAt,\n    rotatedAt: row.rotatedAt,\n    revokedAt: row.revokedAt,\n    lastUsedAt: row.lastUsedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n\nexport function toAgentPersonalAccessToken(\n  row: AgentPersonalAccessTokenDb,\n): AgentPersonalAccessToken {\n  return {\n    id: row.id,\n    userId: row.userId,\n    workspaceId: row.workspaceId,\n    hashedToken: row.hashedToken,\n    prefix: row.prefix,\n    name: row.name,\n    scopes: row.scopes,\n    expiresAt: row.expiresAt,\n    lastUsedAt: row.lastUsedAt,\n    revokedAt: row.revokedAt,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","sql","index","pgEnum","text","timestamp","uniqueIndex","uuid","pgTable","users","agentClientKindEnum","agentClients","id","clientId","notNull","name","redirectUris","array","kind","lastSeenAt","withTimezone","unreferencedAt","createdAt","defaultNow","updatedAt","table","on","agentAuthorizationRequests","references","onDelete","redirectUri","resource","scopes","codeChallenge","state","expiresAt","consumedAt","agentGrants","userId","workspaceId","lastUsedAt","revokedAt","terminalAt","where","agentAuthorizationCodes","grantId","hashedCode","agentRefreshTokens","hashedToken","rotatedAt","agentPersonalAccessTokens","prefix","toAgentClient","row","toAgentAuthorizationRequest","toAgentGrant","toAgentAuthorizationCode","toAgentRefreshToken","toAgentPersonalAccessToken"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,GAAG,QAAO,cAAc;AAChC,SAAQC,KAAK,EAAEC,MAAM,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAUtF,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAEjC,OAAO,MAAMC,sBAAsBP,OAAO,0BAA0B;IAAC;IAAc;CAAO,EAAE;AAE5F,OAAO,MAAMQ,eAAeH,QAC1B,iBACA;IACEI,IAAIZ;IACJa,UAAUT,KAAK,aAAaU,OAAO;IACnCC,MAAMX,KAAK,QAAQU,OAAO;IAC1BE,cAAcZ,KAAK,iBAAiBa,KAAK,GAAGH,OAAO;IACnDI,MAAMR,oBAAoB,QAAQI,OAAO;IACzCK,YAAYd,UAAU,gBAAgB;QAACe,cAAc;IAAI;IACzDC,gBAAgBhB,UAAU,mBAAmB;QAACe,cAAc;IAAI;IAChEE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTnB,YAAY,uCAAuCoB,EAAE,CAACD,MAAMZ,QAAQ;QACpEX,MAAM,0CAA0CwB,EAAE,CAACD,MAAMJ,cAAc;QACvEnB,MAAM,qCAAqCwB,EAAE,CAACD,MAAMH,SAAS;KAC9D,EACD;AAEF,OAAO,MAAMK,6BAA6BnB,QACxC,gCACA;IACEI,IAAIZ;IACJa,UAAUN,KAAK,aACZO,OAAO,GACPc,UAAU,CAAC,IAAMjB,aAAaC,EAAE,EAAE;QAACiB,UAAU;IAAS;IACzDC,aAAa1B,KAAK,gBAAgBU,OAAO;IACzCiB,UAAU3B,KAAK,YAAYU,OAAO;IAClCkB,QAAQ5B,KAAK,UAAUa,KAAK,GAAGH,OAAO;IACtCmB,eAAe7B,KAAK,kBAAkBU,OAAO;IAC7CoB,OAAO9B,KAAK;IACZ+B,WAAW9B,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO;IAChEsB,YAAY/B,UAAU,eAAe;QAACe,cAAc;IAAI;IACxDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTvB,MAAM,mDAAmDwB,EAAE,CAACD,MAAMZ,QAAQ;QAC1EX,MAAM,oDAAoDwB,EAAE,CAACD,MAAMU,SAAS;KAC7E,EACD;AAEF,OAAO,MAAME,cAAc7B,QACzB,gBACA;IACEI,IAAIZ;IACJsC,QAAQ/B,KAAK,WACVO,OAAO,GACPc,UAAU,CAAC,IAAMnB,MAAMG,EAAE,EAAE;QAACiB,UAAU;IAAS;IAClDU,aAAahC,KAAK,gBAAgBO,OAAO;IACzCD,UAAUN,KAAK,aACZO,OAAO,GACPc,UAAU,CAAC,IAAMjB,aAAaC,EAAE,EAAE;QAACiB,UAAU;IAAS;IACzDG,QAAQ5B,KAAK,UAAUa,KAAK,GAAGH,OAAO;IACtC0B,YAAYnC,UAAU,gBAAgB;QAACe,cAAc;IAAI;IACzDqB,WAAWpC,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDsB,YAAYrC,UAAU,eAAe;QAACe,cAAc;IAAI;IACxDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTvB,MAAM,iCAAiCwB,EAAE,CAACD,MAAMa,MAAM;QACtDpC,MAAM,sCAAsCwB,EAAE,CAACD,MAAMc,WAAW;QAChErC,MAAM,mCAAmCwB,EAAE,CAACD,MAAMZ,QAAQ;QAC1DX,MAAM,qCAAqCwB,EAAE,CAACD,MAAMiB,UAAU;QAC9DpC,YAAY,yDACToB,EAAE,CAACD,MAAMa,MAAM,EAAEb,MAAMc,WAAW,EAAEd,MAAMZ,QAAQ,EAClD8B,KAAK,CAAC1C,GAAG,CAAC,EAAEwB,MAAMgB,SAAS,CAAC,aAAa,EAAEhB,MAAMiB,UAAU,CAAC,QAAQ,CAAC;KACzE,EACD;AAEF,OAAO,MAAME,0BAA0BpC,QACrC,6BACA;IACEI,IAAIZ;IACJ6C,SAAStC,KAAK,YACXO,OAAO,GACPc,UAAU,CAAC,IAAMS,YAAYzB,EAAE,EAAE;QAACiB,UAAU;IAAS;IACxDiB,YAAY1C,KAAK,eAAeU,OAAO;IACvCmB,eAAe7B,KAAK,kBAAkBU,OAAO;IAC7CgB,aAAa1B,KAAK,gBAAgBU,OAAO;IACzCiB,UAAU3B,KAAK,YAAYU,OAAO;IAClCqB,WAAW9B,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO;IAChEsB,YAAY/B,UAAU,eAAe;QAACe,cAAc;IAAI;IACxDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTnB,YAAY,qDAAqDoB,EAAE,CAACD,MAAMqB,UAAU;QACpF5C,MAAM,+CAA+CwB,EAAE,CAACD,MAAMoB,OAAO;QACrE3C,MAAM,iDAAiDwB,EAAE,CAACD,MAAMU,SAAS;KAC1E,EACD;AAEF,OAAO,MAAMY,qBAAqBvC,QAChC,wBACA;IACEI,IAAIZ;IACJ6C,SAAStC,KAAK,YACXO,OAAO,GACPc,UAAU,CAAC,IAAMS,YAAYzB,EAAE,EAAE;QAACiB,UAAU;IAAS;IACxDmB,aAAa5C,KAAK,gBAAgBU,OAAO;IACzCqB,WAAW9B,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO;IAChEmC,WAAW5C,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDqB,WAAWpC,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDoB,YAAYnC,UAAU,gBAAgB;QAACe,cAAc;IAAI;IACzDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTnB,YAAY,iDAAiDoB,EAAE,CAACD,MAAMuB,WAAW;QACjF1C,YAAY,+CACToB,EAAE,CAACD,MAAMoB,OAAO,EAChBF,KAAK,CAAC1C,GAAG,CAAC,EAAEwB,MAAMwB,SAAS,CAAC,aAAa,EAAExB,MAAMgB,SAAS,CAAC,QAAQ,CAAC;QACvEvC,MAAM,0CAA0CwB,EAAE,CAACD,MAAMoB,OAAO;QAChE3C,MAAM,4CAA4CwB,EAAE,CAACD,MAAMU,SAAS;QACpEjC,MAAM,4CAA4CwB,EAAE,CAACD,MAAMwB,SAAS;QACpE/C,MAAM,4CAA4CwB,EAAE,CAACD,MAAMgB,SAAS;KACrE,EACD;AAEF,OAAO,MAAMS,4BAA4B1C,QACvC,cACA;IACEI,IAAIZ;IACJsC,QAAQ/B,KAAK,WACVO,OAAO,GACPc,UAAU,CAAC,IAAMnB,MAAMG,EAAE,EAAE;QAACiB,UAAU;IAAS;IAClDU,aAAahC,KAAK,gBAAgBO,OAAO;IACzCkC,aAAa5C,KAAK,gBAAgBU,OAAO;IACzCqC,QAAQ/C,KAAK,UAAUU,OAAO;IAC9BC,MAAMX,KAAK,QAAQU,OAAO;IAC1BkB,QAAQ5B,KAAK,UAAUa,KAAK,GAAGH,OAAO;IACtCqB,WAAW9B,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO;IAChE0B,YAAYnC,UAAU,gBAAgB;QAACe,cAAc;IAAI;IACzDqB,WAAWpC,UAAU,cAAc;QAACe,cAAc;IAAI;IACtDE,WAAWjB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;IAC7EC,WAAWnB,UAAU,cAAc;QAACe,cAAc;IAAI,GAAGN,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTnB,YAAY,uCAAuCoB,EAAE,CAACD,MAAMuB,WAAW;QACvE9C,MAAM,+BAA+BwB,EAAE,CAACD,MAAMa,MAAM;QACpDpC,MAAM,oCAAoCwB,EAAE,CAACD,MAAMc,WAAW;QAC9DrC,MAAM,kCAAkCwB,EAAE,CAACD,MAAMU,SAAS;QAC1DjC,MAAM,kCAAkCwB,EAAE,CAACD,MAAMgB,SAAS;KAC3D,EACD;AAeF,OAAO,SAASW,cAAcC,GAAkB;IAC9C,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACVC,UAAUwC,IAAIxC,QAAQ;QACtBE,MAAMsC,IAAItC,IAAI;QACdC,cAAcqC,IAAIrC,YAAY;QAC9BE,MAAMmC,IAAInC,IAAI;QACdC,YAAYkC,IAAIlC,UAAU;QAC1BE,gBAAgBgC,IAAIhC,cAAc;QAClCC,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF;AAEA,OAAO,SAAS8B,4BACdD,GAAgC;IAEhC,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACVC,UAAUwC,IAAIxC,QAAQ;QACtBiB,aAAauB,IAAIvB,WAAW;QAC5BC,UAAUsB,IAAItB,QAAQ;QACtBC,QAAQqB,IAAIrB,MAAM;QAClBC,eAAeoB,IAAIpB,aAAa;QAChCC,OAAOmB,IAAInB,KAAK;QAChBC,WAAWkB,IAAIlB,SAAS;QACxBC,YAAYiB,IAAIjB,UAAU;QAC1Bd,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF;AAEA,OAAO,SAAS+B,aAAaF,GAAiB;IAC5C,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACV0B,QAAQe,IAAIf,MAAM;QAClBC,aAAac,IAAId,WAAW;QAC5B1B,UAAUwC,IAAIxC,QAAQ;QACtBmB,QAAQqB,IAAIrB,MAAM;QAClBQ,YAAYa,IAAIb,UAAU;QAC1BC,WAAWY,IAAIZ,SAAS;QACxBC,YAAYW,IAAIX,UAAU;QAC1BpB,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF;AAEA,OAAO,SAASgC,yBAAyBH,GAA6B;IACpE,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACViC,SAASQ,IAAIR,OAAO;QACpBC,YAAYO,IAAIP,UAAU;QAC1Bb,eAAeoB,IAAIpB,aAAa;QAChCH,aAAauB,IAAIvB,WAAW;QAC5BC,UAAUsB,IAAItB,QAAQ;QACtBI,WAAWkB,IAAIlB,SAAS;QACxBC,YAAYiB,IAAIjB,UAAU;QAC1Bd,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF;AAEA,OAAO,SAASiC,oBAAoBJ,GAAwB;IAC1D,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACViC,SAASQ,IAAIR,OAAO;QACpBG,aAAaK,IAAIL,WAAW;QAC5Bb,WAAWkB,IAAIlB,SAAS;QACxBc,WAAWI,IAAIJ,SAAS;QACxBR,WAAWY,IAAIZ,SAAS;QACxBD,YAAYa,IAAIb,UAAU;QAC1BlB,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF;AAEA,OAAO,SAASkC,2BACdL,GAA+B;IAE/B,OAAO;QACLzC,IAAIyC,IAAIzC,EAAE;QACV0B,QAAQe,IAAIf,MAAM;QAClBC,aAAac,IAAId,WAAW;QAC5BS,aAAaK,IAAIL,WAAW;QAC5BG,QAAQE,IAAIF,MAAM;QAClBpC,MAAMsC,IAAItC,IAAI;QACdiB,QAAQqB,IAAIrB,MAAM;QAClBG,WAAWkB,IAAIlB,SAAS;QACxBK,YAAYa,IAAIb,UAAU;QAC1BC,WAAWY,IAAIZ,SAAS;QACxBnB,WAAW+B,IAAI/B,SAAS;QACxBE,WAAW6B,IAAI7B,SAAS;IAC1B;AACF"}

package/dist/db/schema/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/db/schema/users.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAC,IAAI,EAAa,MAAM,wBAAwB,CAAC;AAG7D,eAAO,MAAM,cAAc,0EAAiE,CAAC;AAE7F,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAajB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAErD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAWxC"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../../src/db/schema/users.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,IAAI,EAAa,MAAM,wBAAwB,CAAC;AAG7D,eAAO,MAAM,cAAc,0EAAiE,CAAC;AAE7F,eAAO,MAAM,KAAK;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAkBjB,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAC/C,MAAM,MAAM,YAAY,GAAG,OAAO,KAAK,CAAC,YAAY,CAAC;AAErD,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAWxC"}

package/dist/db/schema/users.js

@@ -1,5 +1,6 @@
 import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
-import { pgEnum, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
+import { desc } from 'drizzle-orm';
+import { index, pgEnum, text, timestamp, uniqueIndex } from 'drizzle-orm/pg-core';
 import { pgTable } from './common.js';
 export const userStatusEnum = pgEnum('auth_user_status', [
     'active',
@@ -16,13 +17,17 @@ export const users = pgTable('users', {
     }),
     status: userStatusEnum('status').notNull().default('active'),
     createdAt: timestamp('created_at', {
-        withTimezone: true
+        withTimezone: true,
+        precision: 3
     }).notNull().defaultNow(),
     updatedAt: timestamp('updated_at', {
         withTimezone: true
     }).notNull().defaultNow()
 }, (table)=>[
-        uniqueIndex('auth_users_email_unique').on(table.email)
+        uniqueIndex('auth_users_email_unique').on(table.email),
+        index('auth_users_created_at_id_index').on(desc(table.createdAt), desc(table.id)),
+        index('auth_users_name_trgm_index').using('gin', table.name.op('gin_trgm_ops')),
+        index('auth_users_email_trgm_index').using('gin', table.email.op('gin_trgm_ops'))
     ]);
 export function toUser(row) {
     return {

package/dist/db/schema/users.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/db/schema/users.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {pgEnum, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';\nimport type {User, UserStatus} from '#core/entities/user.js';\nimport {pgTable} from './common.js';\n\nexport const userStatusEnum = pgEnum('auth_user_status', ['active', 'suspended', 'deleted']);\n\nexport const users = pgTable(\n  'users',\n  {\n    id: uuidv7PrimaryKey(),\n    email: text('email').notNull(),\n    hashedPassword: text('hashed_password'),\n    name: text('name'),\n    emailVerifiedAt: timestamp('email_verified_at', {withTimezone: true}),\n    status: userStatusEnum('status').notNull().default('active'),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [uniqueIndex('auth_users_email_unique').on(table.email)],\n);\n\nexport type UserDb = typeof users.$inferSelect;\nexport type UserCreateDb = typeof users.$inferInsert;\n\nexport function toUser(row: UserDb): User {\n  return {\n    id: row.id,\n    email: row.email,\n    hashedPassword: row.hashedPassword,\n    name: row.name,\n    emailVerifiedAt: row.emailVerifiedAt,\n    status: row.status as UserStatus,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","pgEnum","text","timestamp","uniqueIndex","pgTable","userStatusEnum","users","id","email","notNull","hashedPassword","name","emailVerifiedAt","withTimezone","status","default","createdAt","defaultNow","updatedAt","table","on","toUser","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,MAAM,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,QAAO,sBAAsB;AAEzE,SAAQC,OAAO,QAAO,cAAc;AAEpC,OAAO,MAAMC,iBAAiBL,OAAO,oBAAoB;IAAC;IAAU;IAAa;CAAU,EAAE;AAE7F,OAAO,MAAMM,QAAQF,QACnB,SACA;IACEG,IAAIR;IACJS,OAAOP,KAAK,SAASQ,OAAO;IAC5BC,gBAAgBT,KAAK;IACrBU,MAAMV,KAAK;IACXW,iBAAiBV,UAAU,qBAAqB;QAACW,cAAc;IAAI;IACnEC,QAAQT,eAAe,UAAUI,OAAO,GAAGM,OAAO,CAAC;IACnDC,WAAWd,UAAU,cAAc;QAACW,cAAc;IAAI,GAAGJ,OAAO,GAAGQ,UAAU;IAC7EC,WAAWhB,UAAU,cAAc;QAACW,cAAc;IAAI,GAAGJ,OAAO,GAAGQ,UAAU;AAC/E,GACA,CAACE,QAAU;QAAChB,YAAY,2BAA2BiB,EAAE,CAACD,MAAMX,KAAK;KAAE,EACnE;AAKF,OAAO,SAASa,OAAOC,GAAW;IAChC,OAAO;QACLf,IAAIe,IAAIf,EAAE;QACVC,OAAOc,IAAId,KAAK;QAChBE,gBAAgBY,IAAIZ,cAAc;QAClCC,MAAMW,IAAIX,IAAI;QACdC,iBAAiBU,IAAIV,eAAe;QACpCE,QAAQQ,IAAIR,MAAM;QAClBE,WAAWM,IAAIN,SAAS;QACxBE,WAAWI,IAAIJ,SAAS;IAC1B;AACF"}
+{"version":3,"sources":["../../../src/db/schema/users.ts"],"sourcesContent":["import {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {desc} from 'drizzle-orm';\nimport {index, pgEnum, text, timestamp, uniqueIndex} from 'drizzle-orm/pg-core';\nimport type {User, UserStatus} from '#core/entities/user.js';\nimport {pgTable} from './common.js';\n\nexport const userStatusEnum = pgEnum('auth_user_status', ['active', 'suspended', 'deleted']);\n\nexport const users = pgTable(\n  'users',\n  {\n    id: uuidv7PrimaryKey(),\n    email: text('email').notNull(),\n    hashedPassword: text('hashed_password'),\n    name: text('name'),\n    emailVerifiedAt: timestamp('email_verified_at', {withTimezone: true}),\n    status: userStatusEnum('status').notNull().default('active'),\n    createdAt: timestamp('created_at', {withTimezone: true, precision: 3}).notNull().defaultNow(),\n    updatedAt: timestamp('updated_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_users_email_unique').on(table.email),\n    index('auth_users_created_at_id_index').on(desc(table.createdAt), desc(table.id)),\n    index('auth_users_name_trgm_index').using('gin', table.name.op('gin_trgm_ops')),\n    index('auth_users_email_trgm_index').using('gin', table.email.op('gin_trgm_ops')),\n  ],\n);\n\nexport type UserDb = typeof users.$inferSelect;\nexport type UserCreateDb = typeof users.$inferInsert;\n\nexport function toUser(row: UserDb): User {\n  return {\n    id: row.id,\n    email: row.email,\n    hashedPassword: row.hashedPassword,\n    name: row.name,\n    emailVerifiedAt: row.emailVerifiedAt,\n    status: row.status as UserStatus,\n    createdAt: row.createdAt,\n    updatedAt: row.updatedAt,\n  };\n}\n"],"names":["uuidv7PrimaryKey","desc","index","pgEnum","text","timestamp","uniqueIndex","pgTable","userStatusEnum","users","id","email","notNull","hashedPassword","name","emailVerifiedAt","withTimezone","status","default","createdAt","precision","defaultNow","updatedAt","table","on","using","op","toUser","row"],"mappings":"AAAA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,IAAI,QAAO,cAAc;AACjC,SAAQC,KAAK,EAAEC,MAAM,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,QAAO,sBAAsB;AAEhF,SAAQC,OAAO,QAAO,cAAc;AAEpC,OAAO,MAAMC,iBAAiBL,OAAO,oBAAoB;IAAC;IAAU;IAAa;CAAU,EAAE;AAE7F,OAAO,MAAMM,QAAQF,QACnB,SACA;IACEG,IAAIV;IACJW,OAAOP,KAAK,SAASQ,OAAO;IAC5BC,gBAAgBT,KAAK;IACrBU,MAAMV,KAAK;IACXW,iBAAiBV,UAAU,qBAAqB;QAACW,cAAc;IAAI;IACnEC,QAAQT,eAAe,UAAUI,OAAO,GAAGM,OAAO,CAAC;IACnDC,WAAWd,UAAU,cAAc;QAACW,cAAc;QAAMI,WAAW;IAAC,GAAGR,OAAO,GAAGS,UAAU;IAC3FC,WAAWjB,UAAU,cAAc;QAACW,cAAc;IAAI,GAAGJ,OAAO,GAAGS,UAAU;AAC/E,GACA,CAACE,QAAU;QACTjB,YAAY,2BAA2BkB,EAAE,CAACD,MAAMZ,KAAK;QACrDT,MAAM,kCAAkCsB,EAAE,CAACvB,KAAKsB,MAAMJ,SAAS,GAAGlB,KAAKsB,MAAMb,EAAE;QAC/ER,MAAM,8BAA8BuB,KAAK,CAAC,OAAOF,MAAMT,IAAI,CAACY,EAAE,CAAC;QAC/DxB,MAAM,+BAA+BuB,KAAK,CAAC,OAAOF,MAAMZ,KAAK,CAACe,EAAE,CAAC;KAClE,EACD;AAKF,OAAO,SAASC,OAAOC,GAAW;IAChC,OAAO;QACLlB,IAAIkB,IAAIlB,EAAE;QACVC,OAAOiB,IAAIjB,KAAK;QAChBE,gBAAgBe,IAAIf,cAAc;QAClCC,MAAMc,IAAId,IAAI;QACdC,iBAAiBa,IAAIb,eAAe;QACpCE,QAAQW,IAAIX,MAAM;QAClBE,WAAWS,IAAIT,SAAS;QACxBG,WAAWM,IAAIN,SAAS;IAC1B;AACF"}

package/dist/index.d.ts

@@ -2,15 +2,22 @@ import type { ShipfoxModule } from '@shipfox/node-module';
 import type { SignupPolicy } from '#core/ports.js';
 export type { AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant, } from '#core/admin-role.js';
-export { bootstrapFirstAdminOwner, grantAdministratorRole, impersonateUser, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser, } from '#core/administration.js';
+export type { ListAdministratorUsersParams, ListAdministratorUsersResult, } from '#core/administration.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, impersonateUser, listAdministratorUsers, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser, } from '#core/administration.js';
 export type { CreateImpersonatedSessionTokenParams, CreateImpersonatedSessionTokenResult, CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createImpersonatedSessionToken, createSessionForUser, provisionUser } from '#core/auth.js';
+export type { CimdAddress, CimdAddressResolver, CimdHttpRequester, CimdHttpResponse, FetchCimdMetadataOptions, FetchedCimdMetadata, } from '#core/cimd.js';
+export { fetchClientIdMetadata, isPublicUnicastAddress, OAUTH_CIMD_FETCH_TIMEOUT_MS, OAUTH_CIMD_MAX_BODY_BYTES, } from '#core/cimd.js';
 export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';
 export { findUserByEmail } from '#core/email-owner.js';
 export type { AdminGrant } from '#core/entities/admin-grant.js';
 export type { User, UserStatus } from '#core/entities/user.js';
-export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
+export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidAdministratorUserDirectoryFilterError, InvalidCredentialsError, InvalidOAuthClientMetadataError, InvalidOAuthConfigurationError, LastAdminOwnerError, OAuthMetadataFetchError, OAuthRedirectUriNotRegisteredError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
+export type { OAuthGrantType, ValidatedOAuthClientMetadata } from '#core/oauth-client.js';
+export { assertOAuthClientMetadataMatchesRequest, assertOAuthRedirectUriRegistered, isOAuthLoopbackRedirectUri, metadataForAgentClient, OAUTH_CIMD_CACHE_MAX_AGE_SECONDS, OAUTH_CLIENT_ID_MAX_BYTES, OAUTH_CLIENT_NAME_MAX_BYTES, OAUTH_REDIRECT_URI_MAX_BYTES, OAUTH_REDIRECT_URI_MAX_COUNT, oauthRedirectUriMatches, validateOAuthClientId, validateOAuthClientMetadataDocument, validateOAuthDynamicClientRegistration, validateOAuthPublicOrigin, validateOAuthRedirectUri, } from '#core/oauth-client.js';
+export type { OAuthClientResolver, OAuthClientResolverOptions, RegisteredOAuthClient, RegisterOAuthClientParams, ResolvedOAuthClient, ResolveOAuthClientParams, } from '#core/oauth-client-resolver.js';
+export { createOAuthClientResolver, OAUTH_CIMD_CACHE_MAX_ENTRIES, registerOAuthClient, resolveOAuthClient, } from '#core/oauth-client-resolver.js';
 export type { SignupDenialMessageFormat, SignupPolicy } from '#core/ports.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken, } from '#core/runner-session-token.js';
 export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE, } from '#core/signup-policy.js';
@@ -19,6 +26,8 @@ export { type AuthenticatedSessionContext, createJwtAuthMethod, getAuthenticated
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie, } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
+export type { CreateOAuthRoutesOptions } from '#presentation/routes/oauth.js';
+export { createOAuthClientIdentificationRoutes, createOAuthMetadataRoutes, createOAuthRoutes, } from '#presentation/routes/oauth.js';
 export interface CreateAuthModuleOptions {
     workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
     signupPolicy?: SignupPolicy;

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAqBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oCAAoC,EACpC,oCAAoC,EACpC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,8BAA8B,EAAE,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClG,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,yBAAyB,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAiBzC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAyBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,eAAe,EACf,sBAAsB,EACtB,2BAA2B,EAC3B,wBAAwB,EACxB,+BAA+B,EAC/B,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,oCAAoC,EACpC,oCAAoC,EACpC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,8BAA8B,EAAE,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClG,YAAY,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,gBAAgB,EAChB,wBAAwB,EACxB,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,qBAAqB,EACrB,sBAAsB,EACtB,2BAA2B,EAC3B,yBAAyB,GAC1B,MAAM,eAAe,CAAC;AACvB,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,mCAAmC,EACnC,0BAA0B,EAC1B,qBAAqB,EACrB,0BAA0B,EAC1B,yBAAyB,EACzB,iCAAiC,EACjC,+BAA+B,EAC/B,4CAA4C,EAC5C,uBAAuB,EACvB,+BAA+B,EAC/B,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,kCAAkC,EAClC,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,cAAc,EAAE,4BAA4B,EAAC,MAAM,uBAAuB,CAAC;AACxF,OAAO,EACL,uCAAuC,EACvC,gCAAgC,EAChC,0BAA0B,EAC1B,sBAAsB,EACtB,gCAAgC,EAChC,yBAAyB,EACzB,2BAA2B,EAC3B,4BAA4B,EAC5B,4BAA4B,EAC5B,uBAAuB,EACvB,qBAAqB,EACrB,mCAAmC,EACnC,sCAAsC,EACtC,yBAAyB,EACzB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,mBAAmB,EACnB,0BAA0B,EAC1B,qBAAqB,EACrB,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,YAAY,EAAC,yBAAyB,EAAE,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAC5E,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,YAAY,EAAC,mBAAmB,EAAC,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AACxF,YAAY,EAAC,wBAAwB,EAAC,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EACL,qCAAqC,EACrC,yBAAyB,EACzB,iBAAiB,GAClB,MAAM,+BAA+B,CAAC;AAIvC,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CA+BzC"}

package/dist/index.js

@@ -1,3 +1,5 @@
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { AUTH_PASSWORD_RESET_SEND_REQUESTED, authEventSchemas } from '@shipfox/api-auth-dto';
 import { administrationActionEventSchemas } from '@shipfox/api-common-dto';
 import { subscriberFactory } from '@shipfox/node-module';
@@ -14,23 +16,31 @@ import { createAuthInterModulePresentation } from '#presentation/inter-module.js
 import { administrationBootstrapRoutes, administrationRoutes, createAdministrationUserRoutes } from '#presentation/routes/administration.js';
 import { buildAuthRoutes } from '#presentation/routes/index.js';
 import { onPasswordResetSendRequested } from '#presentation/subscribers/index.js';
+import { createAuthMaintenanceActivities } from '#temporal/activities/index.js';
+import { AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE } from '#temporal/constants.js';
 import { passwordLoginMethods } from './login-methods.js';
 const authPublisherEventSchemas = {
     ...authEventSchemas,
     ...administrationActionEventSchemas
 };
+const packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');
 export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant } from '#core/admin-role.js';
-export { bootstrapFirstAdminOwner, grantAdministratorRole, impersonateUser, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, impersonateUser, listAdministratorUsers, reactivateAdministratorUser, revokeAdministratorGrant, revokeAdministratorUserSessions, suspendAdministratorUser } from '#core/administration.js';
 export { createImpersonatedSessionToken, createSessionForUser, provisionUser } from '#core/auth.js';
+export { fetchClientIdMetadata, isPublicUnicastAddress, OAUTH_CIMD_FETCH_TIMEOUT_MS, OAUTH_CIMD_MAX_BODY_BYTES } from '#core/cimd.js';
 export { findUserByEmail } from '#core/email-owner.js';
-export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError } from '#core/errors.js';
+export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, CannotImpersonateAdministratorError, CannotImpersonateSelfError, EmailNotVerifiedError, ImpersonationDisabledError, ImpersonationExpiredError, ImpersonationTargetNotActiveError, InvalidAdminBootstrapTokenError, InvalidAdministratorUserDirectoryFilterError, InvalidCredentialsError, InvalidOAuthClientMetadataError, InvalidOAuthConfigurationError, LastAdminOwnerError, OAuthMetadataFetchError, OAuthRedirectUriNotRegisteredError, SignupNotAllowedError, UserNotFoundError } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken } from '#core/job-lease-token.js';
+export { assertOAuthClientMetadataMatchesRequest, assertOAuthRedirectUriRegistered, isOAuthLoopbackRedirectUri, metadataForAgentClient, OAUTH_CIMD_CACHE_MAX_AGE_SECONDS, OAUTH_CLIENT_ID_MAX_BYTES, OAUTH_CLIENT_NAME_MAX_BYTES, OAUTH_REDIRECT_URI_MAX_BYTES, OAUTH_REDIRECT_URI_MAX_COUNT, oauthRedirectUriMatches, validateOAuthClientId, validateOAuthClientMetadataDocument, validateOAuthDynamicClientRegistration, validateOAuthPublicOrigin, validateOAuthRedirectUri } from '#core/oauth-client.js';
+export { createOAuthClientResolver, OAUTH_CIMD_CACHE_MAX_ENTRIES, registerOAuthClient, resolveOAuthClient } from '#core/oauth-client-resolver.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken } from '#core/runner-session-token.js';
 export { createEnvironmentSignupPolicy, DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE } from '#core/signup-policy.js';
 export { createJwtAuthMethod, getAuthenticatedSessionContext } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
+export { createOAuthClientIdentificationRoutes, createOAuthMetadataRoutes, createOAuthRoutes } from '#presentation/routes/oauth.js';
 const subscriber = subscriberFactory();
 export function createAuthModule({ workspaces, signupPolicy = createEnvironmentSignupPolicy() }) {
     return {
@@ -66,6 +76,20 @@ export function createAuthModule({ workspaces, signupPolicy = createEnvironmentS
         subscribers: [
             subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)
         ],
+        workers: [
+            {
+                taskQueue: AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE,
+                workflowsPath,
+                activities: createAuthMaintenanceActivities,
+                workflows: [
+                    {
+                        name: 'agentAccessRetentionCron',
+                        id: 'auth-agent-access-retention',
+                        cronSchedule: '10 * * * *'
+                    }
+                ]
+            }
+        ],
         interModulePresentations: [
             createAuthInterModulePresentation()
         ]

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport {administrationActionEventSchemas} from '@shipfox/api-common-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {\n  administrationBootstrapRoutes,\n  administrationRoutes,\n  createAdministrationUserRoutes,\n} from '#presentation/routes/administration.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nconst authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  impersonateUser,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nexport type {\n  CreateImpersonatedSessionTokenParams,\n  CreateImpersonatedSessionTokenResult,\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createImpersonatedSessionToken, createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  CannotImpersonateAdministratorError,\n  CannotImpersonateSelfError,\n  EmailNotVerifiedError,\n  ImpersonationDisabledError,\n  ImpersonationExpiredError,\n  ImpersonationTargetNotActiveError,\n  InvalidAdminBootstrapTokenError,\n  InvalidCredentialsError,\n  LastAdminOwnerError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {SignupDenialMessageFormat, SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport type {ImpersonationResult} from '#db/impersonation.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [\n      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),\n      administrationBootstrapRoutes,\n      administrationRoutes,\n      ...createAdministrationUserRoutes(workspaces),\n    ],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","administrationActionEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","administrationBootstrapRoutes","administrationRoutes","createAdministrationUserRoutes","buildAuthRoutes","onPasswordResetSendRequested","passwordLoginMethods","authPublisherEventSchemas","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","bootstrapFirstAdminOwner","grantAdministratorRole","impersonateUser","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","createImpersonatedSessionToken","createSessionForUser","provisionUser","findUserByEmail","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","AuthDependencyUnavailableError","CannotImpersonateAdministratorError","CannotImpersonateSelfError","EmailNotVerifiedError","ImpersonationDisabledError","ImpersonationExpiredError","ImpersonationTargetNotActiveError","InvalidAdminBootstrapTokenError","InvalidCredentialsError","LastAdminOwnerError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","interModulePresentations"],"mappings":"AAAA,SACEA,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAC/B,SAAQC,gCAAgC,QAAO,0BAA0B;AAEzE,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SACEC,6BAA6B,EAC7BC,oBAAoB,EACpBC,8BAA8B,QACzB,yCAAyC;AAChD,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,MAAMC,4BAA4B;IAAC,GAAGnB,gBAAgB;IAAE,GAAGC,gCAAgC;AAAA;AAG3F,SACEmB,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAC7B,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,eAAe,EACfC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AASjC,SAAQC,8BAA8B,EAAEC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AAElG,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,8BAA8B,EAC9BC,mCAAmC,EACnCC,0BAA0B,EAC1BC,qBAAqB,EACrBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,iCAAiC,EACjCC,+BAA+B,EAC/BC,uBAAuB,EACvBC,mBAAmB,EACnBC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACEtD,6BAA6B,EAC7BuD,kCAAkC,QAC7B,yBAAyB;AAEhC,SAEEnD,mBAAmB,EACnBoD,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQnD,0BAA0B,QAAO,yCAAyC;AAClF,SACEoD,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQtD,6BAA6B,QAAO,4CAA4C;AAExF,MAAMuD,aAAa/D;AAOnB,OAAO,SAASgE,iBAAiB,EAC/BC,UAAU,EACVC,eAAehE,+BAA+B,EACtB;IACxB,OAAO;QACLiE,MAAM;QACNC,UAAU;YAACjE;YAAIC;YAAgBiE,mBAAmB;QAAM;QACxDC,MAAM;YAAChE;YAAuBC;YAA8BC;SAAgC;QAC5F+D,cAAcvD,qBAAqBf,OAAOuE,qBAAqB;QAC/DC,QAAQ;YACN3D,gBAAgBb,OAAOuE,qBAAqB,EAAEP,YAAYC;YAC1DvD;YACAC;eACGC,+BAA+BoD;SACnC;QACDS,WAAW;YAACjE,oBAAoBwD;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAOvE;gBAAYF;gBAAI0E,cAAc5D;YAAyB;SAAE;QAC5F6D,aAAa;YAACf,WAAWlE,oCAAoCkB;SAA8B;QAC3FgE,0BAA0B;YAACrE;SAAoC;IACjE;AACF"}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["import {dirname, resolve} from 'node:path';\nimport {fileURLToPath} from 'node:url';\nimport {\n  AUTH_PASSWORD_RESET_SEND_REQUESTED,\n  type AuthEventMap,\n  authEventSchemas,\n} from '@shipfox/api-auth-dto';\nimport {administrationActionEventSchemas} from '@shipfox/api-common-dto';\nimport type {ShipfoxModule} from '@shipfox/node-module';\nimport {subscriberFactory} from '@shipfox/node-module';\nimport {config} from '#config.js';\nimport type {SignupPolicy} from '#core/ports.js';\nimport {createEnvironmentSignupPolicy} from '#core/signup-policy.js';\nimport {db} from '#db/db.js';\nimport {migrationsPath} from '#db/migrations.js';\nimport {authOutbox} from '#db/schema/outbox.js';\nimport {createJwtAuthMethod} from '#presentation/auth/jwt-auth.js';\nimport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nimport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nimport {createAuthE2eRoutes} from '#presentation/e2eRoutes/index.js';\nimport {createAuthInterModulePresentation} from '#presentation/inter-module.js';\nimport {\n  administrationBootstrapRoutes,\n  administrationRoutes,\n  createAdministrationUserRoutes,\n} from '#presentation/routes/administration.js';\nimport {buildAuthRoutes} from '#presentation/routes/index.js';\nimport {onPasswordResetSendRequested} from '#presentation/subscribers/index.js';\nimport {createAuthMaintenanceActivities} from '#temporal/activities/index.js';\nimport {AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE} from '#temporal/constants.js';\nimport {passwordLoginMethods} from './login-methods.js';\n\nconst authPublisherEventSchemas = {...authEventSchemas, ...administrationActionEventSchemas};\nconst packageRoot = resolve(dirname(fileURLToPath(import.meta.url)), '..');\nconst workflowsPath = resolve(packageRoot, 'dist/temporal/workflows/index.js');\n\nexport type {AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims} from '@shipfox/api-auth-dto';\nexport {\n  ADMIN_ROLES,\n  getCurrentAdminRole,\n  hasMinimumAdminRole,\n  highestAdminRole,\n  requireAdminRole,\n  revokeAdminGrant,\n} from '#core/admin-role.js';\nexport type {\n  ListAdministratorUsersParams,\n  ListAdministratorUsersResult,\n} from '#core/administration.js';\nexport {\n  bootstrapFirstAdminOwner,\n  grantAdministratorRole,\n  impersonateUser,\n  listAdministratorUsers,\n  reactivateAdministratorUser,\n  revokeAdministratorGrant,\n  revokeAdministratorUserSessions,\n  suspendAdministratorUser,\n} from '#core/administration.js';\nexport type {\n  CreateImpersonatedSessionTokenParams,\n  CreateImpersonatedSessionTokenResult,\n  CreateSessionForUserError,\n  CreateSessionForUserParams,\n  CreateSessionForUserResult,\n  ProvisionUserParams,\n} from '#core/auth.js';\nexport {createImpersonatedSessionToken, createSessionForUser, provisionUser} from '#core/auth.js';\nexport type {\n  CimdAddress,\n  CimdAddressResolver,\n  CimdHttpRequester,\n  CimdHttpResponse,\n  FetchCimdMetadataOptions,\n  FetchedCimdMetadata,\n} from '#core/cimd.js';\nexport {\n  fetchClientIdMetadata,\n  isPublicUnicastAddress,\n  OAUTH_CIMD_FETCH_TIMEOUT_MS,\n  OAUTH_CIMD_MAX_BODY_BYTES,\n} from '#core/cimd.js';\nexport type {EmailOwner, FindUserByEmailParams} from '#core/email-owner.js';\nexport {findUserByEmail} from '#core/email-owner.js';\nexport type {AdminGrant} from '#core/entities/admin-grant.js';\nexport type {User, UserStatus} from '#core/entities/user.js';\nexport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  AdminRoleRequiredError,\n  AuthDependencyUnavailableError,\n  CannotImpersonateAdministratorError,\n  CannotImpersonateSelfError,\n  EmailNotVerifiedError,\n  ImpersonationDisabledError,\n  ImpersonationExpiredError,\n  ImpersonationTargetNotActiveError,\n  InvalidAdminBootstrapTokenError,\n  InvalidAdministratorUserDirectoryFilterError,\n  InvalidCredentialsError,\n  InvalidOAuthClientMetadataError,\n  InvalidOAuthConfigurationError,\n  LastAdminOwnerError,\n  OAuthMetadataFetchError,\n  OAuthRedirectUriNotRegisteredError,\n  SignupNotAllowedError,\n  UserNotFoundError,\n} from '#core/errors.js';\nexport {\n  issueJobLeaseToken,\n  jobLeaseParamsFrom,\n  verifyJobLeaseToken,\n} from '#core/job-lease-token.js';\nexport type {OAuthGrantType, ValidatedOAuthClientMetadata} from '#core/oauth-client.js';\nexport {\n  assertOAuthClientMetadataMatchesRequest,\n  assertOAuthRedirectUriRegistered,\n  isOAuthLoopbackRedirectUri,\n  metadataForAgentClient,\n  OAUTH_CIMD_CACHE_MAX_AGE_SECONDS,\n  OAUTH_CLIENT_ID_MAX_BYTES,\n  OAUTH_CLIENT_NAME_MAX_BYTES,\n  OAUTH_REDIRECT_URI_MAX_BYTES,\n  OAUTH_REDIRECT_URI_MAX_COUNT,\n  oauthRedirectUriMatches,\n  validateOAuthClientId,\n  validateOAuthClientMetadataDocument,\n  validateOAuthDynamicClientRegistration,\n  validateOAuthPublicOrigin,\n  validateOAuthRedirectUri,\n} from '#core/oauth-client.js';\nexport type {\n  OAuthClientResolver,\n  OAuthClientResolverOptions,\n  RegisteredOAuthClient,\n  RegisterOAuthClientParams,\n  ResolvedOAuthClient,\n  ResolveOAuthClientParams,\n} from '#core/oauth-client-resolver.js';\nexport {\n  createOAuthClientResolver,\n  OAUTH_CIMD_CACHE_MAX_ENTRIES,\n  registerOAuthClient,\n  resolveOAuthClient,\n} from '#core/oauth-client-resolver.js';\nexport type {SignupDenialMessageFormat, SignupPolicy} from '#core/ports.js';\nexport {\n  issueRunnerSessionToken,\n  verifyRunnerSessionToken,\n} from '#core/runner-session-token.js';\nexport {\n  createEnvironmentSignupPolicy,\n  DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n} from '#core/signup-policy.js';\nexport type {ImpersonationResult} from '#db/impersonation.js';\nexport {\n  type AuthenticatedSessionContext,\n  createJwtAuthMethod,\n  getAuthenticatedSessionContext,\n  type RefreshSessionId,\n  type UserId,\n} from '#presentation/auth/jwt-auth.js';\nexport {createLeaseTokenAuthMethod} from '#presentation/auth/lease-token-auth.js';\nexport {\n  authCookiePlugin,\n  clearRefreshTokenCookie,\n  getRefreshTokenCookie,\n  setRefreshTokenCookie,\n} from '#presentation/auth/refresh-cookie.js';\nexport {createRunnerSessionAuthMethod} from '#presentation/auth/runner-session-auth.js';\nexport type {CreateOAuthRoutesOptions} from '#presentation/routes/oauth.js';\nexport {\n  createOAuthClientIdentificationRoutes,\n  createOAuthMetadataRoutes,\n  createOAuthRoutes,\n} from '#presentation/routes/oauth.js';\n\nconst subscriber = subscriberFactory<AuthEventMap>();\n\nexport interface CreateAuthModuleOptions {\n  workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;\n  signupPolicy?: SignupPolicy;\n}\n\nexport function createAuthModule({\n  workspaces,\n  signupPolicy = createEnvironmentSignupPolicy(),\n}: CreateAuthModuleOptions): ShipfoxModule {\n  return {\n    name: 'auth',\n    database: {db, migrationsPath, databaseNamespace: 'auth'},\n    auth: [createJwtAuthMethod(), createLeaseTokenAuthMethod(), createRunnerSessionAuthMethod()],\n    loginMethods: passwordLoginMethods(config.AUTH_PASSWORD_ENABLED),\n    routes: [\n      buildAuthRoutes(config.AUTH_PASSWORD_ENABLED, workspaces, signupPolicy),\n      administrationBootstrapRoutes,\n      administrationRoutes,\n      ...createAdministrationUserRoutes(workspaces),\n    ],\n    e2eRoutes: [createAuthE2eRoutes(workspaces)],\n    publishers: [{name: 'auth', table: authOutbox, db, eventSchemas: authPublisherEventSchemas}],\n    subscribers: [subscriber(AUTH_PASSWORD_RESET_SEND_REQUESTED, onPasswordResetSendRequested)],\n    workers: [\n      {\n        taskQueue: AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE,\n        workflowsPath,\n        activities: createAuthMaintenanceActivities,\n        workflows: [\n          {\n            name: 'agentAccessRetentionCron',\n            id: 'auth-agent-access-retention',\n            cronSchedule: '10 * * * *',\n          },\n        ],\n      },\n    ],\n    interModulePresentations: [createAuthInterModulePresentation()],\n  };\n}\n"],"names":["dirname","resolve","fileURLToPath","AUTH_PASSWORD_RESET_SEND_REQUESTED","authEventSchemas","administrationActionEventSchemas","subscriberFactory","config","createEnvironmentSignupPolicy","db","migrationsPath","authOutbox","createJwtAuthMethod","createLeaseTokenAuthMethod","createRunnerSessionAuthMethod","createAuthE2eRoutes","createAuthInterModulePresentation","administrationBootstrapRoutes","administrationRoutes","createAdministrationUserRoutes","buildAuthRoutes","onPasswordResetSendRequested","createAuthMaintenanceActivities","AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE","passwordLoginMethods","authPublisherEventSchemas","packageRoot","url","workflowsPath","ADMIN_ROLES","getCurrentAdminRole","hasMinimumAdminRole","highestAdminRole","requireAdminRole","revokeAdminGrant","bootstrapFirstAdminOwner","grantAdministratorRole","impersonateUser","listAdministratorUsers","reactivateAdministratorUser","revokeAdministratorGrant","revokeAdministratorUserSessions","suspendAdministratorUser","createImpersonatedSessionToken","createSessionForUser","provisionUser","fetchClientIdMetadata","isPublicUnicastAddress","OAUTH_CIMD_FETCH_TIMEOUT_MS","OAUTH_CIMD_MAX_BODY_BYTES","findUserByEmail","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","AdminRoleRequiredError","AuthDependencyUnavailableError","CannotImpersonateAdministratorError","CannotImpersonateSelfError","EmailNotVerifiedError","ImpersonationDisabledError","ImpersonationExpiredError","ImpersonationTargetNotActiveError","InvalidAdminBootstrapTokenError","InvalidAdministratorUserDirectoryFilterError","InvalidCredentialsError","InvalidOAuthClientMetadataError","InvalidOAuthConfigurationError","LastAdminOwnerError","OAuthMetadataFetchError","OAuthRedirectUriNotRegisteredError","SignupNotAllowedError","UserNotFoundError","issueJobLeaseToken","jobLeaseParamsFrom","verifyJobLeaseToken","assertOAuthClientMetadataMatchesRequest","assertOAuthRedirectUriRegistered","isOAuthLoopbackRedirectUri","metadataForAgentClient","OAUTH_CIMD_CACHE_MAX_AGE_SECONDS","OAUTH_CLIENT_ID_MAX_BYTES","OAUTH_CLIENT_NAME_MAX_BYTES","OAUTH_REDIRECT_URI_MAX_BYTES","OAUTH_REDIRECT_URI_MAX_COUNT","oauthRedirectUriMatches","validateOAuthClientId","validateOAuthClientMetadataDocument","validateOAuthDynamicClientRegistration","validateOAuthPublicOrigin","validateOAuthRedirectUri","createOAuthClientResolver","OAUTH_CIMD_CACHE_MAX_ENTRIES","registerOAuthClient","resolveOAuthClient","issueRunnerSessionToken","verifyRunnerSessionToken","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","getAuthenticatedSessionContext","authCookiePlugin","clearRefreshTokenCookie","getRefreshTokenCookie","setRefreshTokenCookie","createOAuthClientIdentificationRoutes","createOAuthMetadataRoutes","createOAuthRoutes","subscriber","createAuthModule","workspaces","signupPolicy","name","database","databaseNamespace","auth","loginMethods","AUTH_PASSWORD_ENABLED","routes","e2eRoutes","publishers","table","eventSchemas","subscribers","workers","taskQueue","activities","workflows","id","cronSchedule","interModulePresentations"],"mappings":"AAAA,SAAQA,OAAO,EAAEC,OAAO,QAAO,YAAY;AAC3C,SAAQC,aAAa,QAAO,WAAW;AACvC,SACEC,kCAAkC,EAElCC,gBAAgB,QACX,wBAAwB;AAC/B,SAAQC,gCAAgC,QAAO,0BAA0B;AAEzE,SAAQC,iBAAiB,QAAO,uBAAuB;AACvD,SAAQC,MAAM,QAAO,aAAa;AAElC,SAAQC,6BAA6B,QAAO,yBAAyB;AACrE,SAAQC,EAAE,QAAO,YAAY;AAC7B,SAAQC,cAAc,QAAO,oBAAoB;AACjD,SAAQC,UAAU,QAAO,uBAAuB;AAChD,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,0BAA0B,QAAO,yCAAyC;AAClF,SAAQC,6BAA6B,QAAO,4CAA4C;AACxF,SAAQC,mBAAmB,QAAO,mCAAmC;AACrE,SAAQC,iCAAiC,QAAO,gCAAgC;AAChF,SACEC,6BAA6B,EAC7BC,oBAAoB,EACpBC,8BAA8B,QACzB,yCAAyC;AAChD,SAAQC,eAAe,QAAO,gCAAgC;AAC9D,SAAQC,4BAA4B,QAAO,qCAAqC;AAChF,SAAQC,+BAA+B,QAAO,gCAAgC;AAC9E,SAAQC,wCAAwC,QAAO,yBAAyB;AAChF,SAAQC,oBAAoB,QAAO,qBAAqB;AAExD,MAAMC,4BAA4B;IAAC,GAAGrB,gBAAgB;IAAE,GAAGC,gCAAgC;AAAA;AAC3F,MAAMqB,cAAczB,QAAQD,QAAQE,cAAc,YAAYyB,GAAG,IAAI;AACrE,MAAMC,gBAAgB3B,QAAQyB,aAAa;AAG3C,SACEG,WAAW,EACXC,mBAAmB,EACnBC,mBAAmB,EACnBC,gBAAgB,EAChBC,gBAAgB,EAChBC,gBAAgB,QACX,sBAAsB;AAK7B,SACEC,wBAAwB,EACxBC,sBAAsB,EACtBC,eAAe,EACfC,sBAAsB,EACtBC,2BAA2B,EAC3BC,wBAAwB,EACxBC,+BAA+B,EAC/BC,wBAAwB,QACnB,0BAA0B;AASjC,SAAQC,8BAA8B,EAAEC,oBAAoB,EAAEC,aAAa,QAAO,gBAAgB;AASlG,SACEC,qBAAqB,EACrBC,sBAAsB,EACtBC,2BAA2B,EAC3BC,yBAAyB,QACpB,gBAAgB;AAEvB,SAAQC,eAAe,QAAO,uBAAuB;AAGrD,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,sBAAsB,EACtBC,8BAA8B,EAC9BC,mCAAmC,EACnCC,0BAA0B,EAC1BC,qBAAqB,EACrBC,0BAA0B,EAC1BC,yBAAyB,EACzBC,iCAAiC,EACjCC,+BAA+B,EAC/BC,4CAA4C,EAC5CC,uBAAuB,EACvBC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,mBAAmB,EACnBC,uBAAuB,EACvBC,kCAAkC,EAClCC,qBAAqB,EACrBC,iBAAiB,QACZ,kBAAkB;AACzB,SACEC,kBAAkB,EAClBC,kBAAkB,EAClBC,mBAAmB,QACd,2BAA2B;AAElC,SACEC,uCAAuC,EACvCC,gCAAgC,EAChCC,0BAA0B,EAC1BC,sBAAsB,EACtBC,gCAAgC,EAChCC,yBAAyB,EACzBC,2BAA2B,EAC3BC,4BAA4B,EAC5BC,4BAA4B,EAC5BC,uBAAuB,EACvBC,qBAAqB,EACrBC,mCAAmC,EACnCC,sCAAsC,EACtCC,yBAAyB,EACzBC,wBAAwB,QACnB,wBAAwB;AAS/B,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,mBAAmB,EACnBC,kBAAkB,QACb,iCAAiC;AAExC,SACEC,uBAAuB,EACvBC,wBAAwB,QACnB,gCAAgC;AACvC,SACExF,6BAA6B,EAC7ByF,kCAAkC,QAC7B,yBAAyB;AAEhC,SAEErF,mBAAmB,EACnBsF,8BAA8B,QAGzB,iCAAiC;AACxC,SAAQrF,0BAA0B,QAAO,yCAAyC;AAClF,SACEsF,gBAAgB,EAChBC,uBAAuB,EACvBC,qBAAqB,EACrBC,qBAAqB,QAChB,uCAAuC;AAC9C,SAAQxF,6BAA6B,QAAO,4CAA4C;AAExF,SACEyF,qCAAqC,EACrCC,yBAAyB,EACzBC,iBAAiB,QACZ,gCAAgC;AAEvC,MAAMC,aAAapG;AAOnB,OAAO,SAASqG,iBAAiB,EAC/BC,UAAU,EACVC,eAAerG,+BAA+B,EACtB;IACxB,OAAO;QACLsG,MAAM;QACNC,UAAU;YAACtG;YAAIC;YAAgBsG,mBAAmB;QAAM;QACxDC,MAAM;YAACrG;YAAuBC;YAA8BC;SAAgC;QAC5FoG,cAAc1F,qBAAqBjB,OAAO4G,qBAAqB;QAC/DC,QAAQ;YACNhG,gBAAgBb,OAAO4G,qBAAqB,EAAEP,YAAYC;YAC1D5F;YACAC;eACGC,+BAA+ByF;SACnC;QACDS,WAAW;YAACtG,oBAAoB6F;SAAY;QAC5CU,YAAY;YAAC;gBAACR,MAAM;gBAAQS,OAAO5G;gBAAYF;gBAAI+G,cAAc/F;YAAyB;SAAE;QAC5FgG,aAAa;YAACf,WAAWvG,oCAAoCkB;SAA8B;QAC3FqG,SAAS;YACP;gBACEC,WAAWpG;gBACXK;gBACAgG,YAAYtG;gBACZuG,WAAW;oBACT;wBACEf,MAAM;wBACNgB,IAAI;wBACJC,cAAc;oBAChB;iBACD;YACH;SACD;QACDC,0BAA0B;YAAChH;SAAoC;IACjE;AACF"}

package/dist/metrics/instance.d.ts

@@ -1,7 +1,7 @@
 export type AuthTokenType = 'session' | 'job_lease' | 'runner_session';
 export type AuthTokenVerificationOutcome = 'ok' | 'rejected';
 export type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';
-export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap' | 'bootstrap-state' | 'lookup' | 'impersonate';
+export type AuthRateLimitAction = 'login' | 'email-send' | 'bootstrap' | 'bootstrap-state' | 'lookup' | 'directory' | 'impersonate' | 'oauth-register' | 'oauth-cimd' | 'oauth-authorize' | 'oauth-token';
 export type AuthRateLimitScope = 'ip' | 'email' | 'actor';
 export type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';
 export type AuthImpersonationOutcome = 'succeeded' | 'failed';

package/dist/metrics/instance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,YAAY,GACZ,WAAW,GACX,iBAAiB,GACjB,QAAQ,GACR,aAAa,CAAC;AAClB,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AACzE,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,QAAQ,CAAC;AA2C9D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAElF"}
+{"version":3,"file":"instance.d.ts","sourceRoot":"","sources":["../../src/metrics/instance.ts"],"names":[],"mappings":"AAEA,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,WAAW,GAAG,gBAAgB,CAAC;AACvE,MAAM,MAAM,4BAA4B,GAAG,IAAI,GAAG,UAAU,CAAC;AAC7D,MAAM,MAAM,uBAAuB,GAAG,SAAS,GAAG,OAAO,GAAG,UAAU,CAAC;AACvE,MAAM,MAAM,mBAAmB,GAC3B,OAAO,GACP,YAAY,GACZ,WAAW,GACX,iBAAiB,GACjB,QAAQ,GACR,WAAW,GACX,aAAa,GACb,gBAAgB,GAChB,YAAY,GACZ,iBAAiB,GACjB,aAAa,CAAC;AAClB,MAAM,MAAM,kBAAkB,GAAG,IAAI,GAAG,OAAO,GAAG,OAAO,CAAC;AAC1D,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,SAAS,GAAG,aAAa,CAAC;AACzE,MAAM,MAAM,wBAAwB,GAAG,WAAW,GAAG,QAAQ,CAAC;AA2C9D,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,aAAa,GAAG,IAAI,CAEhE;AAED,wBAAgB,mBAAmB,CACjC,SAAS,EAAE,aAAa,EACxB,OAAO,EAAE,4BAA4B,GACpC,IAAI,CAEN;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,uBAAuB,GAAG,IAAI,CAE3E;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,OAAO,EAAE,oBAAoB,CAAC;CAC/B,GAAG,IAAI,CAQP;AAED,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAED,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,wBAAwB,GAAG,IAAI,CAElF"}

package/dist/metrics/instance.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction =\n  | 'login'\n  | 'email-send'\n  | 'bootstrap'\n  | 'bootstrap-state'\n  | 'lookup'\n  | 'impersonate';\nexport type AuthRateLimitScope = 'ip' | 'email' | 'actor';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\nexport type AuthImpersonationOutcome = 'succeeded' | 'failed';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nconst impersonationCommandCount = meter.createCounter<{outcome: AuthImpersonationOutcome}>(\n  'auth_impersonation_commands',\n  {description: 'Impersonation mint command attempts by outcome'},\n);\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n\nexport function recordImpersonationOutcome(outcome: AuthImpersonationOutcome): void {\n  recordMetric(() => impersonationCommandCount.add(1, {outcome}));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","impersonationCommandCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure","recordImpersonationOutcome"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAgB5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,MAAMK,4BAA4BT,MAAMG,aAAa,CACnD,+BACA;IAACC,aAAa;AAAgD;AAGhE,SAASM,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMR,iBAAiBY,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAML,mBAAmBS,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMJ,oBAAoBQ,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXH,oBAAoBO,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMF,2BAA2BM,GAAG,CAAC;AACpD;AAEA,OAAO,SAASU,2BAA2BP,OAAiC;IAC1EP,aAAa,IAAMD,0BAA0BK,GAAG,CAAC,GAAG;YAACG;QAAO;AAC9D"}
+{"version":3,"sources":["../../src/metrics/instance.ts"],"sourcesContent":["import {instanceMetrics} from '@shipfox/node-opentelemetry';\n\nexport type AuthTokenType = 'session' | 'job_lease' | 'runner_session';\nexport type AuthTokenVerificationOutcome = 'ok' | 'rejected';\nexport type AuthTokenRefreshOutcome = 'rotated' | 'grace' | 'rejected';\nexport type AuthRateLimitAction =\n  | 'login'\n  | 'email-send'\n  | 'bootstrap'\n  | 'bootstrap-state'\n  | 'lookup'\n  | 'directory'\n  | 'impersonate'\n  | 'oauth-register'\n  | 'oauth-cimd'\n  | 'oauth-authorize'\n  | 'oauth-token';\nexport type AuthRateLimitScope = 'ip' | 'email' | 'actor';\nexport type AuthRateLimitOutcome = 'allowed' | 'blocked' | 'unavailable';\nexport type AuthImpersonationOutcome = 'succeeded' | 'failed';\n\nconst meter = instanceMetrics.getMeter('auth');\n\nconst tokenIssuedCount = meter.createCounter<{token_type: AuthTokenType}>('auth_token_issued', {\n  description: 'Tokens issued by token type',\n});\n\nconst tokenVerifiedCount = meter.createCounter<{\n  token_type: AuthTokenType;\n  outcome: AuthTokenVerificationOutcome;\n}>('auth_token_verified', {description: 'Token verification attempts by token type and outcome'});\n\nconst tokenRefreshedCount = meter.createCounter<{outcome: AuthTokenRefreshOutcome}>(\n  'auth_token_refreshed',\n  {description: 'Refresh-token exchanges by outcome'},\n);\n\nconst rateLimitCheckCount = meter.createCounter<{\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}>('auth_rate_limit_checks', {\n  description: 'Authentication rate limit checks by action, scope, and outcome',\n});\n\nconst rateLimitPruneFailureCount = meter.createCounter('auth_rate_limit_prune_failures', {\n  description: 'Authentication rate limit prune failures',\n});\n\nconst impersonationCommandCount = meter.createCounter<{outcome: AuthImpersonationOutcome}>(\n  'auth_impersonation_commands',\n  {description: 'Impersonation mint command attempts by outcome'},\n);\n\nfunction recordMetric(record: () => void): void {\n  try {\n    record();\n  } catch {\n    // Metrics must not affect authentication outcomes.\n  }\n}\n\nexport function recordTokenIssued(tokenType: AuthTokenType): void {\n  recordMetric(() => tokenIssuedCount.add(1, {token_type: tokenType}));\n}\n\nexport function recordTokenVerified(\n  tokenType: AuthTokenType,\n  outcome: AuthTokenVerificationOutcome,\n): void {\n  recordMetric(() => tokenVerifiedCount.add(1, {token_type: tokenType, outcome}));\n}\n\nexport function recordTokenRefreshed(outcome: AuthTokenRefreshOutcome): void {\n  recordMetric(() => tokenRefreshedCount.add(1, {outcome}));\n}\n\nexport function recordAuthRateLimitCheck(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  outcome: AuthRateLimitOutcome;\n}): void {\n  recordMetric(() =>\n    rateLimitCheckCount.add(1, {\n      action: params.action,\n      scope: params.scope,\n      outcome: params.outcome,\n    }),\n  );\n}\n\nexport function recordAuthRateLimitPruneFailure(): void {\n  recordMetric(() => rateLimitPruneFailureCount.add(1));\n}\n\nexport function recordImpersonationOutcome(outcome: AuthImpersonationOutcome): void {\n  recordMetric(() => impersonationCommandCount.add(1, {outcome}));\n}\n"],"names":["instanceMetrics","meter","getMeter","tokenIssuedCount","createCounter","description","tokenVerifiedCount","tokenRefreshedCount","rateLimitCheckCount","rateLimitPruneFailureCount","impersonationCommandCount","recordMetric","record","recordTokenIssued","tokenType","add","token_type","recordTokenVerified","outcome","recordTokenRefreshed","recordAuthRateLimitCheck","params","action","scope","recordAuthRateLimitPruneFailure","recordImpersonationOutcome"],"mappings":"AAAA,SAAQA,eAAe,QAAO,8BAA8B;AAqB5D,MAAMC,QAAQD,gBAAgBE,QAAQ,CAAC;AAEvC,MAAMC,mBAAmBF,MAAMG,aAAa,CAA8B,qBAAqB;IAC7FC,aAAa;AACf;AAEA,MAAMC,qBAAqBL,MAAMG,aAAa,CAG3C,uBAAuB;IAACC,aAAa;AAAuD;AAE/F,MAAME,sBAAsBN,MAAMG,aAAa,CAC7C,wBACA;IAACC,aAAa;AAAoC;AAGpD,MAAMG,sBAAsBP,MAAMG,aAAa,CAI5C,0BAA0B;IAC3BC,aAAa;AACf;AAEA,MAAMI,6BAA6BR,MAAMG,aAAa,CAAC,kCAAkC;IACvFC,aAAa;AACf;AAEA,MAAMK,4BAA4BT,MAAMG,aAAa,CACnD,+BACA;IAACC,aAAa;AAAgD;AAGhE,SAASM,aAAaC,MAAkB;IACtC,IAAI;QACFA;IACF,EAAE,OAAM;IACN,mDAAmD;IACrD;AACF;AAEA,OAAO,SAASC,kBAAkBC,SAAwB;IACxDH,aAAa,IAAMR,iBAAiBY,GAAG,CAAC,GAAG;YAACC,YAAYF;QAAS;AACnE;AAEA,OAAO,SAASG,oBACdH,SAAwB,EACxBI,OAAqC;IAErCP,aAAa,IAAML,mBAAmBS,GAAG,CAAC,GAAG;YAACC,YAAYF;YAAWI;QAAO;AAC9E;AAEA,OAAO,SAASC,qBAAqBD,OAAgC;IACnEP,aAAa,IAAMJ,oBAAoBQ,GAAG,CAAC,GAAG;YAACG;QAAO;AACxD;AAEA,OAAO,SAASE,yBAAyBC,MAIxC;IACCV,aAAa,IACXH,oBAAoBO,GAAG,CAAC,GAAG;YACzBO,QAAQD,OAAOC,MAAM;YACrBC,OAAOF,OAAOE,KAAK;YACnBL,SAASG,OAAOH,OAAO;QACzB;AAEJ;AAEA,OAAO,SAASM;IACdb,aAAa,IAAMF,2BAA2BM,GAAG,CAAC;AACpD;AAEA,OAAO,SAASU,2BAA2BP,OAAiC;IAC1EP,aAAa,IAAMD,0BAA0BK,GAAG,CAAC,GAAG;YAACG;QAAO;AAC9D"}

package/dist/presentation/routes/administration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/administration.ts"],"names":[],"mappings":"AA0BA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAE1F,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAmYhF,eAAO,MAAM,oBAAoB,EAAE,UAIjC,CAAC;AAEH,eAAO,MAAM,6BAA6B,EAAE,UAI1C,CAAC;AAuDH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,2BAA2B,GACtC,UAAU,EAAE,CAiBd"}
+{"version":3,"file":"administration.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/administration.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAC,2BAA2B,EAAC,MAAM,0CAA0C,CAAC;AAE1F,OAAO,EAA2B,KAAK,UAAU,EAAC,MAAM,uBAAuB,CAAC;AAqfhF,eAAO,MAAM,oBAAoB,EAAE,UAIjC,CAAC;AAEH,eAAO,MAAM,6BAA6B,EAAE,UAI1C,CAAC;AAuDH,wBAAgB,8BAA8B,CAC5C,UAAU,EAAE,2BAA2B,GACtC,UAAU,EAAE,CAuBd"}