@shipfox/api-auth 19.0.0 → 20.0.0

package/dist/presentation/routes/oauth.js

@@ -0,0 +1,150 @@
+import { oauthAuthorizationServerMetadataSchema, oauthDynamicClientRegistrationRequestSchema, oauthDynamicClientRegistrationResponseSchema, oauthProtectedResourceMetadataSchema } from '@shipfox/api-auth-dto';
+import { ClientError, defineRoute } from '@shipfox/node-fastify';
+import { InvalidOAuthClientMetadataError, InvalidOAuthConfigurationError, OAuthMetadataFetchError, OAuthRedirectUriNotRegisteredError } from '#core/errors.js';
+import { validateOAuthPublicOrigin } from '#core/oauth-client.js';
+import { registerOAuthClient } from '#core/oauth-client-resolver.js';
+import { createAuthIpRateLimitPreHandler } from './rate-limit.js';
+function apiPublicOrigin(options) {
+    return validateOAuthPublicOrigin(options.apiPublicUrl);
+}
+function translateOAuthError(error) {
+    if (error instanceof InvalidOAuthClientMetadataError || error instanceof OAuthMetadataFetchError || error instanceof OAuthRedirectUriNotRegisteredError) {
+        throw new ClientError('OAuth client metadata is invalid', 'invalid-client-metadata', {
+            status: 400
+        });
+    }
+    if (error instanceof InvalidOAuthConfigurationError) {
+        throw new ClientError('OAuth configuration is invalid', 'oauth-configuration-invalid', {
+            status: 500
+        });
+    }
+    throw error;
+}
+function registrationResponse(result) {
+    return {
+        client_id: result.metadata.clientId,
+        client_name: result.metadata.clientName,
+        redirect_uris: result.metadata.redirectUris,
+        grant_types: result.metadata.grantTypes,
+        response_types: result.metadata.responseTypes,
+        token_endpoint_auth_method: result.metadata.tokenEndpointAuthMethod,
+        scope: result.metadata.scope
+    };
+}
+function createProtectedResourceMetadataRoute(origin) {
+    return defineRoute({
+        method: 'GET',
+        path: '/.well-known/oauth-protected-resource',
+        description: 'Describe the protected MCP resource and its authorization server.',
+        schema: {
+            response: {
+                200: oauthProtectedResourceMetadataSchema
+            }
+        },
+        handler: ()=>({
+                resource: `${origin}/mcp`,
+                authorization_servers: [
+                    origin
+                ],
+                scopes_supported: [
+                    'read'
+                ]
+            })
+    });
+}
+function createAuthorizationServerMetadataRoute(origin) {
+    return defineRoute({
+        method: 'GET',
+        path: '/.well-known/oauth-authorization-server',
+        description: 'Describe the MCP OAuth authorization server.',
+        schema: {
+            response: {
+                200: oauthAuthorizationServerMetadataSchema
+            }
+        },
+        handler: ()=>({
+                issuer: origin,
+                authorization_endpoint: `${origin}/oauth/authorize`,
+                token_endpoint: `${origin}/oauth/token`,
+                registration_endpoint: `${origin}/oauth/register`,
+                response_types_supported: [
+                    'code'
+                ],
+                grant_types_supported: [
+                    'authorization_code',
+                    'refresh_token'
+                ],
+                code_challenge_methods_supported: [
+                    'S256'
+                ],
+                token_endpoint_auth_methods_supported: [
+                    'none'
+                ],
+                scopes_supported: [
+                    'read'
+                ],
+                client_id_metadata_document_supported: true
+            })
+    });
+}
+function createDynamicRegistrationRoute() {
+    return defineRoute({
+        method: 'POST',
+        path: '/oauth/register',
+        description: 'Register a public OAuth client for MCP access.',
+        options: {
+            bodyLimit: 32 * 1024
+        },
+        schema: {
+            body: oauthDynamicClientRegistrationRequestSchema,
+            response: {
+                201: oauthDynamicClientRegistrationResponseSchema
+            }
+        },
+        preHandler: createAuthIpRateLimitPreHandler('oauth-register'),
+        errorHandler: translateOAuthError,
+        handler: async (request, reply)=>{
+            const result = await registerOAuthClient({
+                clientName: request.body.client_name,
+                redirectUris: request.body.redirect_uris,
+                grantTypes: request.body.grant_types,
+                responseTypes: request.body.response_types,
+                tokenEndpointAuthMethod: request.body.token_endpoint_auth_method,
+                scope: request.body.scope
+            });
+            reply.code(201);
+            return registrationResponse(result);
+        }
+    });
+}
+export function createOAuthMetadataRoutes(options) {
+    const origin = apiPublicOrigin(options);
+    return {
+        prefix: '',
+        routes: [
+            createProtectedResourceMetadataRoute(origin),
+            createAuthorizationServerMetadataRoute(origin)
+        ]
+    };
+}
+export function createOAuthClientIdentificationRoutes() {
+    return {
+        prefix: '',
+        routes: [
+            createDynamicRegistrationRoute()
+        ]
+    };
+}
+export function createOAuthRoutes(options) {
+    const metadataRoutes = createOAuthMetadataRoutes(options);
+    const clientIdentificationRoutes = createOAuthClientIdentificationRoutes();
+    return {
+        prefix: '',
+        routes: [
+            ...metadataRoutes.routes,
+            ...clientIdentificationRoutes.routes
+        ]
+    };
+}
+
+//# sourceMappingURL=oauth.js.map

package/dist/presentation/routes/oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/presentation/routes/oauth.ts"],"sourcesContent":["import {\n  type OAuthDynamicClientRegistrationResponseDto,\n  oauthAuthorizationServerMetadataSchema,\n  oauthDynamicClientRegistrationRequestSchema,\n  oauthDynamicClientRegistrationResponseSchema,\n  oauthProtectedResourceMetadataSchema,\n} from '@shipfox/api-auth-dto';\nimport {ClientError, defineRoute, type RouteGroup} from '@shipfox/node-fastify';\nimport {\n  InvalidOAuthClientMetadataError,\n  InvalidOAuthConfigurationError,\n  OAuthMetadataFetchError,\n  OAuthRedirectUriNotRegisteredError,\n} from '#core/errors.js';\nimport {validateOAuthPublicOrigin} from '#core/oauth-client.js';\nimport {registerOAuthClient} from '#core/oauth-client-resolver.js';\nimport {createAuthIpRateLimitPreHandler} from './rate-limit.js';\n\nexport interface CreateOAuthRoutesOptions {\n  /** Validated here and deliberately injected until production composition. */\n  apiPublicUrl: string;\n}\n\nfunction apiPublicOrigin(options: CreateOAuthRoutesOptions): string {\n  return validateOAuthPublicOrigin(options.apiPublicUrl);\n}\n\nfunction translateOAuthError(error: unknown): never {\n  if (\n    error instanceof InvalidOAuthClientMetadataError ||\n    error instanceof OAuthMetadataFetchError ||\n    error instanceof OAuthRedirectUriNotRegisteredError\n  ) {\n    throw new ClientError('OAuth client metadata is invalid', 'invalid-client-metadata', {\n      status: 400,\n    });\n  }\n  if (error instanceof InvalidOAuthConfigurationError) {\n    throw new ClientError('OAuth configuration is invalid', 'oauth-configuration-invalid', {\n      status: 500,\n    });\n  }\n  throw error;\n}\n\nfunction registrationResponse(\n  result: Awaited<ReturnType<typeof registerOAuthClient>>,\n): OAuthDynamicClientRegistrationResponseDto {\n  return {\n    client_id: result.metadata.clientId,\n    client_name: result.metadata.clientName,\n    redirect_uris: result.metadata.redirectUris,\n    grant_types: result.metadata.grantTypes,\n    response_types: result.metadata.responseTypes,\n    token_endpoint_auth_method: result.metadata.tokenEndpointAuthMethod,\n    scope: result.metadata.scope,\n  };\n}\n\nfunction createProtectedResourceMetadataRoute(origin: string) {\n  return defineRoute({\n    method: 'GET',\n    path: '/.well-known/oauth-protected-resource',\n    description: 'Describe the protected MCP resource and its authorization server.',\n    schema: {response: {200: oauthProtectedResourceMetadataSchema}},\n    handler: () => ({\n      resource: `${origin}/mcp`,\n      authorization_servers: [origin],\n      scopes_supported: ['read'],\n    }),\n  });\n}\n\nfunction createAuthorizationServerMetadataRoute(origin: string) {\n  return defineRoute({\n    method: 'GET',\n    path: '/.well-known/oauth-authorization-server',\n    description: 'Describe the MCP OAuth authorization server.',\n    schema: {response: {200: oauthAuthorizationServerMetadataSchema}},\n    handler: () => ({\n      issuer: origin,\n      authorization_endpoint: `${origin}/oauth/authorize`,\n      token_endpoint: `${origin}/oauth/token`,\n      registration_endpoint: `${origin}/oauth/register`,\n      response_types_supported: ['code'],\n      grant_types_supported: ['authorization_code', 'refresh_token'],\n      code_challenge_methods_supported: ['S256'],\n      token_endpoint_auth_methods_supported: ['none'],\n      scopes_supported: ['read'],\n      client_id_metadata_document_supported: true,\n    }),\n  });\n}\n\nfunction createDynamicRegistrationRoute() {\n  return defineRoute({\n    method: 'POST',\n    path: '/oauth/register',\n    description: 'Register a public OAuth client for MCP access.',\n    options: {bodyLimit: 32 * 1024},\n    schema: {\n      body: oauthDynamicClientRegistrationRequestSchema,\n      response: {201: oauthDynamicClientRegistrationResponseSchema},\n    },\n    preHandler: createAuthIpRateLimitPreHandler('oauth-register'),\n    errorHandler: translateOAuthError,\n    handler: async (request, reply) => {\n      const result = await registerOAuthClient({\n        clientName: request.body.client_name,\n        redirectUris: request.body.redirect_uris,\n        grantTypes: request.body.grant_types,\n        responseTypes: request.body.response_types,\n        tokenEndpointAuthMethod: request.body.token_endpoint_auth_method,\n        scope: request.body.scope,\n      });\n      reply.code(201);\n      return registrationResponse(result);\n    },\n  });\n}\n\nexport function createOAuthMetadataRoutes(options: CreateOAuthRoutesOptions): RouteGroup {\n  const origin = apiPublicOrigin(options);\n  return {\n    prefix: '',\n    routes: [\n      createProtectedResourceMetadataRoute(origin),\n      createAuthorizationServerMetadataRoute(origin),\n    ],\n  };\n}\n\nexport function createOAuthClientIdentificationRoutes(): RouteGroup {\n  return {prefix: '', routes: [createDynamicRegistrationRoute()]};\n}\n\nexport function createOAuthRoutes(options: CreateOAuthRoutesOptions): RouteGroup {\n  const metadataRoutes = createOAuthMetadataRoutes(options);\n  const clientIdentificationRoutes = createOAuthClientIdentificationRoutes();\n  return {\n    prefix: '',\n    routes: [...metadataRoutes.routes, ...clientIdentificationRoutes.routes],\n  };\n}\n"],"names":["oauthAuthorizationServerMetadataSchema","oauthDynamicClientRegistrationRequestSchema","oauthDynamicClientRegistrationResponseSchema","oauthProtectedResourceMetadataSchema","ClientError","defineRoute","InvalidOAuthClientMetadataError","InvalidOAuthConfigurationError","OAuthMetadataFetchError","OAuthRedirectUriNotRegisteredError","validateOAuthPublicOrigin","registerOAuthClient","createAuthIpRateLimitPreHandler","apiPublicOrigin","options","apiPublicUrl","translateOAuthError","error","status","registrationResponse","result","client_id","metadata","clientId","client_name","clientName","redirect_uris","redirectUris","grant_types","grantTypes","response_types","responseTypes","token_endpoint_auth_method","tokenEndpointAuthMethod","scope","createProtectedResourceMetadataRoute","origin","method","path","description","schema","response","handler","resource","authorization_servers","scopes_supported","createAuthorizationServerMetadataRoute","issuer","authorization_endpoint","token_endpoint","registration_endpoint","response_types_supported","grant_types_supported","code_challenge_methods_supported","token_endpoint_auth_methods_supported","client_id_metadata_document_supported","createDynamicRegistrationRoute","bodyLimit","body","preHandler","errorHandler","request","reply","code","createOAuthMetadataRoutes","prefix","routes","createOAuthClientIdentificationRoutes","createOAuthRoutes","metadataRoutes","clientIdentificationRoutes"],"mappings":"AAAA,SAEEA,sCAAsC,EACtCC,2CAA2C,EAC3CC,4CAA4C,EAC5CC,oCAAoC,QAC/B,wBAAwB;AAC/B,SAAQC,WAAW,EAAEC,WAAW,QAAwB,wBAAwB;AAChF,SACEC,+BAA+B,EAC/BC,8BAA8B,EAC9BC,uBAAuB,EACvBC,kCAAkC,QAC7B,kBAAkB;AACzB,SAAQC,yBAAyB,QAAO,wBAAwB;AAChE,SAAQC,mBAAmB,QAAO,iCAAiC;AACnE,SAAQC,+BAA+B,QAAO,kBAAkB;AAOhE,SAASC,gBAAgBC,OAAiC;IACxD,OAAOJ,0BAA0BI,QAAQC,YAAY;AACvD;AAEA,SAASC,oBAAoBC,KAAc;IACzC,IACEA,iBAAiBX,mCACjBW,iBAAiBT,2BACjBS,iBAAiBR,oCACjB;QACA,MAAM,IAAIL,YAAY,oCAAoC,2BAA2B;YACnFc,QAAQ;QACV;IACF;IACA,IAAID,iBAAiBV,gCAAgC;QACnD,MAAM,IAAIH,YAAY,kCAAkC,+BAA+B;YACrFc,QAAQ;QACV;IACF;IACA,MAAMD;AACR;AAEA,SAASE,qBACPC,MAAuD;IAEvD,OAAO;QACLC,WAAWD,OAAOE,QAAQ,CAACC,QAAQ;QACnCC,aAAaJ,OAAOE,QAAQ,CAACG,UAAU;QACvCC,eAAeN,OAAOE,QAAQ,CAACK,YAAY;QAC3CC,aAAaR,OAAOE,QAAQ,CAACO,UAAU;QACvCC,gBAAgBV,OAAOE,QAAQ,CAACS,aAAa;QAC7CC,4BAA4BZ,OAAOE,QAAQ,CAACW,uBAAuB;QACnEC,OAAOd,OAAOE,QAAQ,CAACY,KAAK;IAC9B;AACF;AAEA,SAASC,qCAAqCC,MAAc;IAC1D,OAAO/B,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YAACC,UAAU;gBAAC,KAAKtC;YAAoC;QAAC;QAC9DuC,SAAS,IAAO,CAAA;gBACdC,UAAU,GAAGP,OAAO,IAAI,CAAC;gBACzBQ,uBAAuB;oBAACR;iBAAO;gBAC/BS,kBAAkB;oBAAC;iBAAO;YAC5B,CAAA;IACF;AACF;AAEA,SAASC,uCAAuCV,MAAc;IAC5D,OAAO/B,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbC,QAAQ;YAACC,UAAU;gBAAC,KAAKzC;YAAsC;QAAC;QAChE0C,SAAS,IAAO,CAAA;gBACdK,QAAQX;gBACRY,wBAAwB,GAAGZ,OAAO,gBAAgB,CAAC;gBACnDa,gBAAgB,GAAGb,OAAO,YAAY,CAAC;gBACvCc,uBAAuB,GAAGd,OAAO,eAAe,CAAC;gBACjDe,0BAA0B;oBAAC;iBAAO;gBAClCC,uBAAuB;oBAAC;oBAAsB;iBAAgB;gBAC9DC,kCAAkC;oBAAC;iBAAO;gBAC1CC,uCAAuC;oBAAC;iBAAO;gBAC/CT,kBAAkB;oBAAC;iBAAO;gBAC1BU,uCAAuC;YACzC,CAAA;IACF;AACF;AAEA,SAASC;IACP,OAAOnD,YAAY;QACjBgC,QAAQ;QACRC,MAAM;QACNC,aAAa;QACbzB,SAAS;YAAC2C,WAAW,KAAK;QAAI;QAC9BjB,QAAQ;YACNkB,MAAMzD;YACNwC,UAAU;gBAAC,KAAKvC;YAA4C;QAC9D;QACAyD,YAAY/C,gCAAgC;QAC5CgD,cAAc5C;QACd0B,SAAS,OAAOmB,SAASC;YACvB,MAAM1C,SAAS,MAAMT,oBAAoB;gBACvCc,YAAYoC,QAAQH,IAAI,CAAClC,WAAW;gBACpCG,cAAckC,QAAQH,IAAI,CAAChC,aAAa;gBACxCG,YAAYgC,QAAQH,IAAI,CAAC9B,WAAW;gBACpCG,eAAe8B,QAAQH,IAAI,CAAC5B,cAAc;gBAC1CG,yBAAyB4B,QAAQH,IAAI,CAAC1B,0BAA0B;gBAChEE,OAAO2B,QAAQH,IAAI,CAACxB,KAAK;YAC3B;YACA4B,MAAMC,IAAI,CAAC;YACX,OAAO5C,qBAAqBC;QAC9B;IACF;AACF;AAEA,OAAO,SAAS4C,0BAA0BlD,OAAiC;IACzE,MAAMsB,SAASvB,gBAAgBC;IAC/B,OAAO;QACLmD,QAAQ;QACRC,QAAQ;YACN/B,qCAAqCC;YACrCU,uCAAuCV;SACxC;IACH;AACF;AAEA,OAAO,SAAS+B;IACd,OAAO;QAACF,QAAQ;QAAIC,QAAQ;YAACV;SAAiC;IAAA;AAChE;AAEA,OAAO,SAASY,kBAAkBtD,OAAiC;IACjE,MAAMuD,iBAAiBL,0BAA0BlD;IACjD,MAAMwD,6BAA6BH;IACnC,OAAO;QACLF,QAAQ;QACRC,QAAQ;eAAIG,eAAeH,MAAM;eAAKI,2BAA2BJ,MAAM;SAAC;IAC1E;AACF"}

package/dist/presentation/routes/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAuC7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,aAChD,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,aAClD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,mBAAmB,aACrD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAmB3E"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../../src/presentation/routes/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAAc,KAAK,YAAY,EAAE,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAE1F,OAAO,EACL,KAAK,mBAAmB,EAIzB,MAAM,qBAAqB,CAAC;AAmD7B,UAAU,SAAS;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAgDD,wBAAgB,6BAA6B,CAAC,MAAM,EAAE,mBAAmB,aAChD,cAAc,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,CAAC,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAiB9F;AAED,wBAAgB,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,aAClD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAS3E;AAED;;;;;;GAMG;AACH,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,mBAAmB,aACrD,cAAc,SAAS,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAmB3E"}

package/dist/presentation/routes/rate-limit.js

@@ -66,6 +66,30 @@ const policies = {
             limit: 20,
             windowSeconds: 15 * 60
         }
+    },
+    'oauth-register': {
+        ip: {
+            limit: 10,
+            windowSeconds: 60 * 60
+        }
+    },
+    'oauth-cimd': {
+        ip: {
+            limit: 30,
+            windowSeconds: 60 * 60
+        }
+    },
+    'oauth-authorize': {
+        ip: {
+            limit: 30,
+            windowSeconds: 5 * 60
+        }
+    },
+    'oauth-token': {
+        ip: {
+            limit: 60,
+            windowSeconds: 5 * 60
+        }
     }
 };
 function routeName(request) {

package/dist/presentation/routes/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {getUserContext} from '@shipfox/api-auth-context';\nimport {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  'bootstrap-state': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  directory: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    actor: {limit: 60, windowSeconds: 5 * 60},\n  },\n  impersonate: {\n    // Bounds mint and probing attempts: the IP bucket bounds aggregate source\n    // traffic, and the actor bucket is a per-actor cap that prevents an actor\n    // from evading the bound by rotating IPs (every request still consumes the\n    // IP bucket first, so a shared NAT cannot exhaust it faster by pooling\n    // actors). Ladder denials by an identifiable actor role are audited as\n    // `failed` events.\n    ip: {limit: 20, windowSeconds: 15 * 60},\n    actor: {limit: 20, windowSeconds: 15 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  await enforceSharedRateLimit({\n    request: params.request,\n    reply: params.reply,\n    check: () =>\n      checkAuthRateLimit({\n        action: params.action,\n        scope: params.scope,\n        identifier: params.identifier,\n        ...policy,\n      }),\n    route: routeName(params.request),\n    unavailableCode: 'auth-rate-limit-unavailable',\n    unavailableMessage: 'Authentication rate limiter unavailable',\n    setRetryAfter: (reply, retryAfterSeconds) => {\n      reply.header('Retry-After', String(retryAfterSeconds));\n    },\n    logWarn: (request, context) => {\n      request.log.warn(context, 'Auth rate limit blocked request');\n    },\n    logError: (request, context) => {\n      request.log.error(context, 'Auth rate limiter unavailable');\n    },\n    createClientError: (presentation, cause) =>\n      new ClientError(presentation.message, presentation.code, {\n        status: presentation.status,\n        ...(presentation.details ? {details: presentation.details} : {}),\n        data: presentation.data,\n        cause,\n      }),\n  });\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n\n/**\n * Rate limits an authenticated route by source IP and by actor. Every request\n * consumes the IP bucket, which bounds aggregate source traffic; the actor\n * bucket is an additional per-actor cap that prevents an actor from evading\n * the bound by rotating IPs. Runs after authentication (auth is an `onRequest`\n * hook), so the user context is set.\n */\nexport function createAuthActorRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n    const client = getUserContext(request);\n    if (client) {\n      await enforceRateLimit({\n        request,\n        reply,\n        action,\n        scope: 'actor',\n        identifier: client.userId,\n      });\n    }\n  };\n}\n"],"names":["getUserContext","ClientError","enforceRateLimit","enforceSharedRateLimit","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","directory","actor","impersonate","routeName","request","routeOptions","url","split","params","policy","action","scope","reply","check","identifier","route","unavailableCode","unavailableMessage","setRetryAfter","retryAfterSeconds","header","String","logWarn","context","log","warn","logError","error","createClientError","presentation","cause","message","code","status","details","data","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler","createAuthActorRateLimitPreHandler","client","userId"],"mappings":"AAAA,SAAQA,cAAc,QAAO,4BAA4B;AACzD,SAAQC,WAAW,QAA+C,wBAAwB;AAC1F,SAAQC,oBAAoBC,sBAAsB,QAAO,2BAA2B;AACpF,SAIEC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAI,WAAW;QACTN,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCK,OAAO;YAACN,OAAO;YAAIC,eAAe,IAAI;QAAE;IAC1C;IACAM,aAAa;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,mBAAmB;QACnBR,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCK,OAAO;YAACN,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;AACF;AAMA,SAASO,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAelB,iBAAiBmB,MAM/B;IACC,MAAMC,SAASjB,QAAQ,CAACgB,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,MAAMnB,uBAAuB;QAC3Bc,SAASI,OAAOJ,OAAO;QACvBQ,OAAOJ,OAAOI,KAAK;QACnBC,OAAO,IACLtB,mBAAmB;gBACjBmB,QAAQF,OAAOE,MAAM;gBACrBC,OAAOH,OAAOG,KAAK;gBACnBG,YAAYN,OAAOM,UAAU;gBAC7B,GAAGL,MAAM;YACX;QACFM,OAAOZ,UAAUK,OAAOJ,OAAO;QAC/BY,iBAAiB;QACjBC,oBAAoB;QACpBC,eAAe,CAACN,OAAOO;YACrBP,MAAMQ,MAAM,CAAC,eAAeC,OAAOF;QACrC;QACAG,SAAS,CAAClB,SAASmB;YACjBnB,QAAQoB,GAAG,CAACC,IAAI,CAACF,SAAS;QAC5B;QACAG,UAAU,CAACtB,SAASmB;YAClBnB,QAAQoB,GAAG,CAACG,KAAK,CAACJ,SAAS;QAC7B;QACAK,mBAAmB,CAACC,cAAcC,QAChC,IAAI1C,YAAYyC,aAAaE,OAAO,EAAEF,aAAaG,IAAI,EAAE;gBACvDC,QAAQJ,aAAaI,MAAM;gBAC3B,GAAIJ,aAAaK,OAAO,GAAG;oBAACA,SAASL,aAAaK,OAAO;gBAAA,IAAI,CAAC,CAAC;gBAC/DC,MAAMN,aAAaM,IAAI;gBACvBL;YACF;IACJ;AACF;AAEA,OAAO,SAASM,8BAA8B1B,MAA2B;IACvE,OAAO,OAAON,SAA4CQ;QACxD,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QAEA,MAAML,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQiC,IAAI,CAACxC,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAASyC,gCAAgC5B,MAA2B;IACzE,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAAS6C,mCAAmC7B,MAA2B;IAC5E,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QACA,MAAM8C,SAASrD,eAAeiB;QAC9B,IAAIoC,QAAQ;YACV,MAAMnD,iBAAiB;gBACrBe;gBACAQ;gBACAF;gBACAC,OAAO;gBACPG,YAAY0B,OAAOC,MAAM;YAC3B;QACF;IACF;AACF"}
+{"version":3,"sources":["../../../src/presentation/routes/rate-limit.ts"],"sourcesContent":["import {getUserContext} from '@shipfox/api-auth-context';\nimport {ClientError, type FastifyReply, type FastifyRequest} from '@shipfox/node-fastify';\nimport {enforceRateLimit as enforceSharedRateLimit} from '@shipfox/node-rate-limit';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitPolicy,\n  type AuthRateLimitScope,\n  checkAuthRateLimit,\n} from '#core/rate-limit.js';\n\nconst policies: Record<\n  AuthRateLimitAction,\n  Partial<Record<AuthRateLimitScope, AuthRateLimitPolicy>>\n> = {\n  login: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    email: {limit: 10, windowSeconds: 15 * 60},\n  },\n  'email-send': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n    email: {limit: 3, windowSeconds: 60 * 60},\n  },\n  bootstrap: {\n    ip: {limit: 5, windowSeconds: 15 * 60},\n  },\n  'bootstrap-state': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  lookup: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n  directory: {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n    actor: {limit: 60, windowSeconds: 5 * 60},\n  },\n  impersonate: {\n    // Bounds mint and probing attempts: the IP bucket bounds aggregate source\n    // traffic, and the actor bucket is a per-actor cap that prevents an actor\n    // from evading the bound by rotating IPs (every request still consumes the\n    // IP bucket first, so a shared NAT cannot exhaust it faster by pooling\n    // actors). Ladder denials by an identifiable actor role are audited as\n    // `failed` events.\n    ip: {limit: 20, windowSeconds: 15 * 60},\n    actor: {limit: 20, windowSeconds: 15 * 60},\n  },\n  'oauth-register': {\n    ip: {limit: 10, windowSeconds: 60 * 60},\n  },\n  'oauth-cimd': {\n    ip: {limit: 30, windowSeconds: 60 * 60},\n  },\n  'oauth-authorize': {\n    ip: {limit: 30, windowSeconds: 5 * 60},\n  },\n  'oauth-token': {\n    ip: {limit: 60, windowSeconds: 5 * 60},\n  },\n};\n\ninterface EmailBody {\n  email: string;\n}\n\nfunction routeName(request: FastifyRequest): string {\n  return request.routeOptions.url ?? request.url.split('?')[0] ?? 'unknown';\n}\n\nasync function enforceRateLimit(params: {\n  request: FastifyRequest;\n  reply: FastifyReply;\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): Promise<void> {\n  const policy = policies[params.action][params.scope];\n  if (!policy) return;\n\n  await enforceSharedRateLimit({\n    request: params.request,\n    reply: params.reply,\n    check: () =>\n      checkAuthRateLimit({\n        action: params.action,\n        scope: params.scope,\n        identifier: params.identifier,\n        ...policy,\n      }),\n    route: routeName(params.request),\n    unavailableCode: 'auth-rate-limit-unavailable',\n    unavailableMessage: 'Authentication rate limiter unavailable',\n    setRetryAfter: (reply, retryAfterSeconds) => {\n      reply.header('Retry-After', String(retryAfterSeconds));\n    },\n    logWarn: (request, context) => {\n      request.log.warn(context, 'Auth rate limit blocked request');\n    },\n    logError: (request, context) => {\n      request.log.error(context, 'Auth rate limiter unavailable');\n    },\n    createClientError: (presentation, cause) =>\n      new ClientError(presentation.message, presentation.code, {\n        status: presentation.status,\n        ...(presentation.details ? {details: presentation.details} : {}),\n        data: presentation.data,\n        cause,\n      }),\n  });\n}\n\nexport function createAuthRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest<{Body: EmailBody}>, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'email',\n      identifier: request.body.email,\n    });\n  };\n}\n\nexport function createAuthIpRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n  };\n}\n\n/**\n * Rate limits an authenticated route by source IP and by actor. Every request\n * consumes the IP bucket, which bounds aggregate source traffic; the actor\n * bucket is an additional per-actor cap that prevents an actor from evading\n * the bound by rotating IPs. Runs after authentication (auth is an `onRequest`\n * hook), so the user context is set.\n */\nexport function createAuthActorRateLimitPreHandler(action: AuthRateLimitAction) {\n  return async (request: FastifyRequest, reply: FastifyReply): Promise<void> => {\n    await enforceRateLimit({\n      request,\n      reply,\n      action,\n      scope: 'ip',\n      identifier: request.ip,\n    });\n    const client = getUserContext(request);\n    if (client) {\n      await enforceRateLimit({\n        request,\n        reply,\n        action,\n        scope: 'actor',\n        identifier: client.userId,\n      });\n    }\n  };\n}\n"],"names":["getUserContext","ClientError","enforceRateLimit","enforceSharedRateLimit","checkAuthRateLimit","policies","login","ip","limit","windowSeconds","email","bootstrap","lookup","directory","actor","impersonate","routeName","request","routeOptions","url","split","params","policy","action","scope","reply","check","identifier","route","unavailableCode","unavailableMessage","setRetryAfter","retryAfterSeconds","header","String","logWarn","context","log","warn","logError","error","createClientError","presentation","cause","message","code","status","details","data","createAuthRateLimitPreHandler","body","createAuthIpRateLimitPreHandler","createAuthActorRateLimitPreHandler","client","userId"],"mappings":"AAAA,SAAQA,cAAc,QAAO,4BAA4B;AACzD,SAAQC,WAAW,QAA+C,wBAAwB;AAC1F,SAAQC,oBAAoBC,sBAAsB,QAAO,2BAA2B;AACpF,SAIEC,kBAAkB,QACb,sBAAsB;AAE7B,MAAMC,WAGF;IACFC,OAAO;QACLC,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCC,OAAO;YAACF,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCC,OAAO;YAACF,OAAO;YAAGC,eAAe,KAAK;QAAE;IAC1C;IACAE,WAAW;QACTJ,IAAI;YAACC,OAAO;YAAGC,eAAe,KAAK;QAAE;IACvC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAG,QAAQ;QACNL,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACAI,WAAW;QACTN,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;QACrCK,OAAO;YAACN,OAAO;YAAIC,eAAe,IAAI;QAAE;IAC1C;IACAM,aAAa;QACX,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,uEAAuE;QACvE,uEAAuE;QACvE,mBAAmB;QACnBR,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;QACtCK,OAAO;YAACN,OAAO;YAAIC,eAAe,KAAK;QAAE;IAC3C;IACA,kBAAkB;QAChBF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;IACxC;IACA,cAAc;QACZF,IAAI;YAACC,OAAO;YAAIC,eAAe,KAAK;QAAE;IACxC;IACA,mBAAmB;QACjBF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;IACA,eAAe;QACbF,IAAI;YAACC,OAAO;YAAIC,eAAe,IAAI;QAAE;IACvC;AACF;AAMA,SAASO,UAAUC,OAAuB;IACxC,OAAOA,QAAQC,YAAY,CAACC,GAAG,IAAIF,QAAQE,GAAG,CAACC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI;AAClE;AAEA,eAAelB,iBAAiBmB,MAM/B;IACC,MAAMC,SAASjB,QAAQ,CAACgB,OAAOE,MAAM,CAAC,CAACF,OAAOG,KAAK,CAAC;IACpD,IAAI,CAACF,QAAQ;IAEb,MAAMnB,uBAAuB;QAC3Bc,SAASI,OAAOJ,OAAO;QACvBQ,OAAOJ,OAAOI,KAAK;QACnBC,OAAO,IACLtB,mBAAmB;gBACjBmB,QAAQF,OAAOE,MAAM;gBACrBC,OAAOH,OAAOG,KAAK;gBACnBG,YAAYN,OAAOM,UAAU;gBAC7B,GAAGL,MAAM;YACX;QACFM,OAAOZ,UAAUK,OAAOJ,OAAO;QAC/BY,iBAAiB;QACjBC,oBAAoB;QACpBC,eAAe,CAACN,OAAOO;YACrBP,MAAMQ,MAAM,CAAC,eAAeC,OAAOF;QACrC;QACAG,SAAS,CAAClB,SAASmB;YACjBnB,QAAQoB,GAAG,CAACC,IAAI,CAACF,SAAS;QAC5B;QACAG,UAAU,CAACtB,SAASmB;YAClBnB,QAAQoB,GAAG,CAACG,KAAK,CAACJ,SAAS;QAC7B;QACAK,mBAAmB,CAACC,cAAcC,QAChC,IAAI1C,YAAYyC,aAAaE,OAAO,EAAEF,aAAaG,IAAI,EAAE;gBACvDC,QAAQJ,aAAaI,MAAM;gBAC3B,GAAIJ,aAAaK,OAAO,GAAG;oBAACA,SAASL,aAAaK,OAAO;gBAAA,IAAI,CAAC,CAAC;gBAC/DC,MAAMN,aAAaM,IAAI;gBACvBL;YACF;IACJ;AACF;AAEA,OAAO,SAASM,8BAA8B1B,MAA2B;IACvE,OAAO,OAAON,SAA4CQ;QACxD,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QAEA,MAAML,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQiC,IAAI,CAACxC,KAAK;QAChC;IACF;AACF;AAEA,OAAO,SAASyC,gCAAgC5B,MAA2B;IACzE,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;IACF;AACF;AAEA;;;;;;CAMC,GACD,OAAO,SAAS6C,mCAAmC7B,MAA2B;IAC5E,OAAO,OAAON,SAAyBQ;QACrC,MAAMvB,iBAAiB;YACrBe;YACAQ;YACAF;YACAC,OAAO;YACPG,YAAYV,QAAQV,EAAE;QACxB;QACA,MAAM8C,SAASrD,eAAeiB;QAC9B,IAAIoC,QAAQ;YACV,MAAMnD,iBAAiB;gBACrBe;gBACAQ;gBACAF;gBACAC,OAAO;gBACPG,YAAY0B,OAAOC,MAAM;YAC3B;QACF;IACF;AACF"}

package/dist/temporal/activities/agent-access-retention.d.ts

@@ -0,0 +1,13 @@
+export interface AgentAccessRetentionResult {
+    deleted: number;
+    transitioned: number;
+    iterations: number;
+    timedOut: boolean;
+}
+/**
+ * Drains bounded retention batches for the current tick. Heartbeats continue
+ * while a database batch waits on a lock, and the wall-clock budget keeps the
+ * activity inside its five-minute Temporal start-to-close timeout.
+ */
+export declare function agentAccessRetentionActivity(): Promise<AgentAccessRetentionResult>;
+//# sourceMappingURL=agent-access-retention.d.ts.map

package/dist/temporal/activities/agent-access-retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access-retention.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/agent-access-retention.ts"],"names":[],"mappings":"AAQA,MAAM,WAAW,0BAA0B;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAWD;;;;GAIG;AACH,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,0BAA0B,CAAC,CA8CxF"}

package/dist/temporal/activities/agent-access-retention.js

@@ -0,0 +1,58 @@
+import { Context } from '@temporalio/activity';
+import { pruneAgentAccessBatch } from '#db/agent-access.js';
+import { AGENT_ACCESS_RETENTION_BATCH_LIMIT, AGENT_ACCESS_RETENTION_MAX_ITERATIONS, AGENT_ACCESS_RETENTION_TIME_BUDGET_MS } from '#db/agent-access-retention.js';
+function isAgentAccessRetentionTimeout(error) {
+    if (typeof error !== 'object' || error === null) return false;
+    const details = error;
+    if (details.code === '55P03' || details.code === '57014') return true;
+    return details.cause !== undefined && details.cause !== error ? isAgentAccessRetentionTimeout(details.cause) : false;
+}
+/**
+ * Drains bounded retention batches for the current tick. Heartbeats continue
+ * while a database batch waits on a lock, and the wall-clock budget keeps the
+ * activity inside its five-minute Temporal start-to-close timeout.
+ */ export async function agentAccessRetentionActivity() {
+    const ctx = Context.current();
+    const startedAt = Date.now();
+    const deadline = startedAt + AGENT_ACCESS_RETENTION_TIME_BUDGET_MS;
+    const result = {
+        deleted: 0,
+        transitioned: 0,
+        iterations: 0,
+        timedOut: false
+    };
+    const heartbeat = ()=>ctx.heartbeat(result);
+    const heartbeatTimer = setInterval(heartbeat, 15_000);
+    try {
+        while(result.iterations < AGENT_ACCESS_RETENTION_MAX_ITERATIONS){
+            if (Date.now() >= deadline) {
+                result.timedOut = true;
+                break;
+            }
+            try {
+                const batch = await pruneAgentAccessBatch({
+                    limit: AGENT_ACCESS_RETENTION_BATCH_LIMIT,
+                    deadlineMs: deadline
+                });
+                result.deleted += batch.deleted;
+                result.transitioned += batch.transitioned;
+                result.iterations += 1;
+                heartbeat();
+                if (batch.deleted === 0 && batch.transitioned === 0) break;
+            } catch (error) {
+                if (!isAgentAccessRetentionTimeout(error)) throw error;
+                result.timedOut = true;
+                break;
+            }
+        }
+        if (result.iterations >= AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {
+            result.timedOut = true;
+        }
+        heartbeat();
+        return result;
+    } finally{
+        clearInterval(heartbeatTimer);
+    }
+}
+
+//# sourceMappingURL=agent-access-retention.js.map

package/dist/temporal/activities/agent-access-retention.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/activities/agent-access-retention.ts"],"sourcesContent":["import {Context} from '@temporalio/activity';\nimport {pruneAgentAccessBatch} from '#db/agent-access.js';\nimport {\n  AGENT_ACCESS_RETENTION_BATCH_LIMIT,\n  AGENT_ACCESS_RETENTION_MAX_ITERATIONS,\n  AGENT_ACCESS_RETENTION_TIME_BUDGET_MS,\n} from '#db/agent-access-retention.js';\n\nexport interface AgentAccessRetentionResult {\n  deleted: number;\n  transitioned: number;\n  iterations: number;\n  timedOut: boolean;\n}\n\nfunction isAgentAccessRetentionTimeout(error: unknown): boolean {\n  if (typeof error !== 'object' || error === null) return false;\n  const details = error as {cause?: unknown; code?: unknown};\n  if (details.code === '55P03' || details.code === '57014') return true;\n  return details.cause !== undefined && details.cause !== error\n    ? isAgentAccessRetentionTimeout(details.cause)\n    : false;\n}\n\n/**\n * Drains bounded retention batches for the current tick. Heartbeats continue\n * while a database batch waits on a lock, and the wall-clock budget keeps the\n * activity inside its five-minute Temporal start-to-close timeout.\n */\nexport async function agentAccessRetentionActivity(): Promise<AgentAccessRetentionResult> {\n  const ctx = Context.current();\n  const startedAt = Date.now();\n  const deadline = startedAt + AGENT_ACCESS_RETENTION_TIME_BUDGET_MS;\n  const result: AgentAccessRetentionResult = {\n    deleted: 0,\n    transitioned: 0,\n    iterations: 0,\n    timedOut: false,\n  };\n  const heartbeat = () => ctx.heartbeat(result);\n  const heartbeatTimer = setInterval(heartbeat, 15_000);\n\n  try {\n    while (result.iterations < AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {\n      if (Date.now() >= deadline) {\n        result.timedOut = true;\n        break;\n      }\n\n      try {\n        const batch = await pruneAgentAccessBatch({\n          limit: AGENT_ACCESS_RETENTION_BATCH_LIMIT,\n          deadlineMs: deadline,\n        });\n        result.deleted += batch.deleted;\n        result.transitioned += batch.transitioned;\n        result.iterations += 1;\n        heartbeat();\n\n        if (batch.deleted === 0 && batch.transitioned === 0) break;\n      } catch (error) {\n        if (!isAgentAccessRetentionTimeout(error)) throw error;\n        result.timedOut = true;\n        break;\n      }\n    }\n\n    if (result.iterations >= AGENT_ACCESS_RETENTION_MAX_ITERATIONS) {\n      result.timedOut = true;\n    }\n    heartbeat();\n    return result;\n  } finally {\n    clearInterval(heartbeatTimer);\n  }\n}\n"],"names":["Context","pruneAgentAccessBatch","AGENT_ACCESS_RETENTION_BATCH_LIMIT","AGENT_ACCESS_RETENTION_MAX_ITERATIONS","AGENT_ACCESS_RETENTION_TIME_BUDGET_MS","isAgentAccessRetentionTimeout","error","details","code","cause","undefined","agentAccessRetentionActivity","ctx","current","startedAt","Date","now","deadline","result","deleted","transitioned","iterations","timedOut","heartbeat","heartbeatTimer","setInterval","batch","limit","deadlineMs","clearInterval"],"mappings":"AAAA,SAAQA,OAAO,QAAO,uBAAuB;AAC7C,SAAQC,qBAAqB,QAAO,sBAAsB;AAC1D,SACEC,kCAAkC,EAClCC,qCAAqC,EACrCC,qCAAqC,QAChC,gCAAgC;AASvC,SAASC,8BAA8BC,KAAc;IACnD,IAAI,OAAOA,UAAU,YAAYA,UAAU,MAAM,OAAO;IACxD,MAAMC,UAAUD;IAChB,IAAIC,QAAQC,IAAI,KAAK,WAAWD,QAAQC,IAAI,KAAK,SAAS,OAAO;IACjE,OAAOD,QAAQE,KAAK,KAAKC,aAAaH,QAAQE,KAAK,KAAKH,QACpDD,8BAA8BE,QAAQE,KAAK,IAC3C;AACN;AAEA;;;;CAIC,GACD,OAAO,eAAeE;IACpB,MAAMC,MAAMZ,QAAQa,OAAO;IAC3B,MAAMC,YAAYC,KAAKC,GAAG;IAC1B,MAAMC,WAAWH,YAAYV;IAC7B,MAAMc,SAAqC;QACzCC,SAAS;QACTC,cAAc;QACdC,YAAY;QACZC,UAAU;IACZ;IACA,MAAMC,YAAY,IAAMX,IAAIW,SAAS,CAACL;IACtC,MAAMM,iBAAiBC,YAAYF,WAAW;IAE9C,IAAI;QACF,MAAOL,OAAOG,UAAU,GAAGlB,sCAAuC;YAChE,IAAIY,KAAKC,GAAG,MAAMC,UAAU;gBAC1BC,OAAOI,QAAQ,GAAG;gBAClB;YACF;YAEA,IAAI;gBACF,MAAMI,QAAQ,MAAMzB,sBAAsB;oBACxC0B,OAAOzB;oBACP0B,YAAYX;gBACd;gBACAC,OAAOC,OAAO,IAAIO,MAAMP,OAAO;gBAC/BD,OAAOE,YAAY,IAAIM,MAAMN,YAAY;gBACzCF,OAAOG,UAAU,IAAI;gBACrBE;gBAEA,IAAIG,MAAMP,OAAO,KAAK,KAAKO,MAAMN,YAAY,KAAK,GAAG;YACvD,EAAE,OAAOd,OAAO;gBACd,IAAI,CAACD,8BAA8BC,QAAQ,MAAMA;gBACjDY,OAAOI,QAAQ,GAAG;gBAClB;YACF;QACF;QAEA,IAAIJ,OAAOG,UAAU,IAAIlB,uCAAuC;YAC9De,OAAOI,QAAQ,GAAG;QACpB;QACAC;QACA,OAAOL;IACT,SAAU;QACRW,cAAcL;IAChB;AACF"}

package/dist/temporal/activities/index.d.ts

@@ -0,0 +1,5 @@
+import { agentAccessRetentionActivity } from './agent-access-retention.js';
+export declare function createAuthMaintenanceActivities(): {
+    agentAccessRetentionActivity: typeof agentAccessRetentionActivity;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/temporal/activities/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/temporal/activities/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAC,4BAA4B,EAAC,MAAM,6BAA6B,CAAC;AAEzE,wBAAgB,+BAA+B;;EAE9C"}

package/dist/temporal/activities/index.js

@@ -0,0 +1,8 @@
+import { agentAccessRetentionActivity } from './agent-access-retention.js';
+export function createAuthMaintenanceActivities() {
+    return {
+        agentAccessRetentionActivity
+    };
+}
+
+//# sourceMappingURL=index.js.map

package/dist/temporal/activities/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/activities/index.ts"],"sourcesContent":["import {agentAccessRetentionActivity} from './agent-access-retention.js';\n\nexport function createAuthMaintenanceActivities() {\n  return {agentAccessRetentionActivity};\n}\n"],"names":["agentAccessRetentionActivity","createAuthMaintenanceActivities"],"mappings":"AAAA,SAAQA,4BAA4B,QAAO,8BAA8B;AAEzE,OAAO,SAASC;IACd,OAAO;QAACD;IAA4B;AACtC"}

package/dist/temporal/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = "auth-agent-access-maintenance";
+//# sourceMappingURL=constants.d.ts.map

package/dist/temporal/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../src/temporal/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,wCAAwC,kCAAkC,CAAC"}

package/dist/temporal/constants.js

@@ -0,0 +1,3 @@
+export const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = 'auth-agent-access-maintenance';
+
+//# sourceMappingURL=constants.js.map

package/dist/temporal/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/temporal/constants.ts"],"sourcesContent":["export const AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE = 'auth-agent-access-maintenance';\n"],"names":["AUTH_AGENT_ACCESS_MAINTENANCE_TASK_QUEUE"],"mappings":"AAAA,OAAO,MAAMA,2CAA2C,gCAAgC"}

package/dist/temporal/workflows/agent-access-retention-cron.d.ts

@@ -0,0 +1,2 @@
+export declare function agentAccessRetentionCron(): Promise<void>;
+//# sourceMappingURL=agent-access-retention-cron.d.ts.map

package/dist/temporal/workflows/agent-access-retention-cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access-retention-cron.d.ts","sourceRoot":"","sources":["../../../src/temporal/workflows/agent-access-retention-cron.ts"],"names":[],"mappings":"AAYA,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,IAAI,CAAC,CAU9D"}

package/dist/temporal/workflows/agent-access-retention-cron.js

@@ -0,0 +1,22 @@
+import { log, proxyActivities } from '@temporalio/workflow';
+const { agentAccessRetentionActivity } = proxyActivities({
+    startToCloseTimeout: '5 minutes',
+    heartbeatTimeout: '1 minute',
+    // Retry on the next cron tick so a timed-out attempt cannot overlap its own sweep.
+    retry: {
+        maximumAttempts: 1
+    }
+});
+export async function agentAccessRetentionCron() {
+    const result = await agentAccessRetentionActivity();
+    if (result.deleted > 0 || result.transitioned > 0 || result.timedOut) {
+        log.info('Agent-access retention sweep complete', {
+            deleted: result.deleted,
+            transitioned: result.transitioned,
+            iterations: result.iterations,
+            timedOut: result.timedOut
+        });
+    }
+}
+
+//# sourceMappingURL=agent-access-retention-cron.js.map

package/dist/temporal/workflows/agent-access-retention-cron.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/temporal/workflows/agent-access-retention-cron.ts"],"sourcesContent":["import {log, proxyActivities} from '@temporalio/workflow';\nimport type {createAuthMaintenanceActivities} from '../activities/index.js';\n\nconst {agentAccessRetentionActivity} = proxyActivities<\n  ReturnType<typeof createAuthMaintenanceActivities>\n>({\n  startToCloseTimeout: '5 minutes',\n  heartbeatTimeout: '1 minute',\n  // Retry on the next cron tick so a timed-out attempt cannot overlap its own sweep.\n  retry: {maximumAttempts: 1},\n});\n\nexport async function agentAccessRetentionCron(): Promise<void> {\n  const result = await agentAccessRetentionActivity();\n  if (result.deleted > 0 || result.transitioned > 0 || result.timedOut) {\n    log.info('Agent-access retention sweep complete', {\n      deleted: result.deleted,\n      transitioned: result.transitioned,\n      iterations: result.iterations,\n      timedOut: result.timedOut,\n    });\n  }\n}\n"],"names":["log","proxyActivities","agentAccessRetentionActivity","startToCloseTimeout","heartbeatTimeout","retry","maximumAttempts","agentAccessRetentionCron","result","deleted","transitioned","timedOut","info","iterations"],"mappings":"AAAA,SAAQA,GAAG,EAAEC,eAAe,QAAO,uBAAuB;AAG1D,MAAM,EAACC,4BAA4B,EAAC,GAAGD,gBAErC;IACAE,qBAAqB;IACrBC,kBAAkB;IAClB,mFAAmF;IACnFC,OAAO;QAACC,iBAAiB;IAAC;AAC5B;AAEA,OAAO,eAAeC;IACpB,MAAMC,SAAS,MAAMN;IACrB,IAAIM,OAAOC,OAAO,GAAG,KAAKD,OAAOE,YAAY,GAAG,KAAKF,OAAOG,QAAQ,EAAE;QACpEX,IAAIY,IAAI,CAAC,yCAAyC;YAChDH,SAASD,OAAOC,OAAO;YACvBC,cAAcF,OAAOE,YAAY;YACjCG,YAAYL,OAAOK,UAAU;YAC7BF,UAAUH,OAAOG,QAAQ;QAC3B;IACF;AACF"}