@shipfox/api-auth 2.0.0

package/dist/core/entities/email-verification.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/email-verification.ts"],"sourcesContent":["export interface EmailVerification {\n  id: string;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n  usedAt: Date | null;\n  createdAt: Date;\n}\n"],"names":[],"mappings":"AAAA,WAOC"}

package/dist/core/entities/password-reset.d.ts

@@ -0,0 +1,9 @@
+export interface PasswordReset {
+    id: string;
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+    usedAt: Date | null;
+    createdAt: Date;
+}
+//# sourceMappingURL=password-reset.d.ts.map

package/dist/core/entities/password-reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password-reset.d.ts","sourceRoot":"","sources":["../../../src/core/entities/password-reset.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/password-reset.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=password-reset.js.map

package/dist/core/entities/password-reset.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/password-reset.ts"],"sourcesContent":["export interface PasswordReset {\n  id: string;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n  usedAt: Date | null;\n  createdAt: Date;\n}\n"],"names":[],"mappings":"AAAA,WAOC"}

package/dist/core/entities/refresh-token.d.ts

@@ -0,0 +1,12 @@
+export interface RefreshToken {
+    id: string;
+    userId: string;
+    hashedToken: string;
+    expiresAt: Date;
+    revokedAt: Date | null;
+    rotatedAt: Date | null;
+    lastUsedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=refresh-token.d.ts.map

package/dist/core/entities/refresh-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.d.ts","sourceRoot":"","sources":["../../../src/core/entities/refresh-token.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,UAAU,EAAE,IAAI,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/refresh-token.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=refresh-token.js.map

package/dist/core/entities/refresh-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/refresh-token.ts"],"sourcesContent":["export interface RefreshToken {\n  id: string;\n  userId: string;\n  hashedToken: string;\n  expiresAt: Date;\n  revokedAt: Date | null;\n  rotatedAt: Date | null;\n  lastUsedAt: Date | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAAA,WAUC"}

package/dist/core/entities/user.d.ts

@@ -0,0 +1,12 @@
+export type UserStatus = 'active' | 'suspended' | 'deleted';
+export interface User {
+    id: string;
+    email: string;
+    hashedPassword: string | null;
+    name: string | null;
+    emailVerifiedAt: Date | null;
+    status: UserStatus;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=user.d.ts.map

package/dist/core/entities/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/core/entities/user.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,WAAW,GAAG,SAAS,CAAC;AAE5D,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/user.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=user.js.map

package/dist/core/entities/user.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/user.ts"],"sourcesContent":["export type UserStatus = 'active' | 'suspended' | 'deleted';\n\nexport interface User {\n  id: string;\n  email: string;\n  hashedPassword: string | null;\n  name: string | null;\n  emailVerifiedAt: Date | null;\n  status: UserStatus;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAEA,WASC"}

package/dist/core/errors.d.ts

@@ -0,0 +1,54 @@
+export declare class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class ApiKeyNotFoundError extends Error {
+    constructor(id: string);
+}
+export declare class InvitationNotFoundError extends Error {
+    constructor(id: string);
+}
+export declare class InvitationWorkspaceMismatchError extends Error {
+    constructor();
+}
+export declare class MembershipNotFoundError extends Error {
+    constructor(userId: string, workspaceId: string);
+}
+export declare class UserNotFoundError extends Error {
+    constructor(idOrEmail: string);
+}
+export declare class EmailTakenError extends Error {
+    constructor(email: string);
+}
+export declare class InvalidCredentialsError extends Error {
+    constructor();
+}
+export declare class EmailNotVerifiedError extends Error {
+    constructor();
+}
+export declare class AuthDependencyUnavailableError extends Error {
+    readonly dependency: string;
+    readonly cause: unknown;
+    constructor(dependency: string, cause: unknown);
+}
+export declare class TokenInvalidError extends Error {
+    constructor(reason?: string);
+}
+export declare class TokenExpiredError extends Error {
+    constructor();
+}
+export declare class TokenAlreadyUsedError extends Error {
+    constructor();
+}
+export declare class MembershipRequiredError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class LastMemberError extends Error {
+    constructor(workspaceId: string);
+}
+export declare class InvitationEmailMismatchError extends Error {
+    constructor();
+}
+export declare class OpenInvitationExistsError extends Error {
+    constructor(email: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/core/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAM/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,EAAE,MAAM;CAI1B"}

package/dist/core/errors.js

@@ -0,0 +1,106 @@
+export class WorkspaceNotFoundError extends Error {
+    constructor(workspaceId){
+        super(`Workspace not found: ${workspaceId}`);
+        this.name = 'WorkspaceNotFoundError';
+    }
+}
+export class ApiKeyNotFoundError extends Error {
+    constructor(id){
+        super(`API key not found: ${id}`);
+        this.name = 'ApiKeyNotFoundError';
+    }
+}
+export class InvitationNotFoundError extends Error {
+    constructor(id){
+        super(`Invitation not found: ${id}`);
+        this.name = 'InvitationNotFoundError';
+    }
+}
+export class InvitationWorkspaceMismatchError extends Error {
+    constructor(){
+        super('Invitation does not belong to this workspace');
+        this.name = 'InvitationWorkspaceMismatchError';
+    }
+}
+export class MembershipNotFoundError extends Error {
+    constructor(userId, workspaceId){
+        super(`Membership not found for user ${userId} in workspace ${workspaceId}`);
+        this.name = 'MembershipNotFoundError';
+    }
+}
+export class UserNotFoundError extends Error {
+    constructor(idOrEmail){
+        super(`User not found: ${idOrEmail}`);
+        this.name = 'UserNotFoundError';
+    }
+}
+export class EmailTakenError extends Error {
+    constructor(email){
+        super(`Email already registered: ${email}`);
+        this.name = 'EmailTakenError';
+    }
+}
+export class InvalidCredentialsError extends Error {
+    constructor(){
+        super('Invalid credentials');
+        this.name = 'InvalidCredentialsError';
+    }
+}
+export class EmailNotVerifiedError extends Error {
+    constructor(){
+        super('Email not verified');
+        this.name = 'EmailNotVerifiedError';
+    }
+}
+export class AuthDependencyUnavailableError extends Error {
+    constructor(dependency, cause){
+        super(`Authentication dependency unavailable: ${dependency}`);
+        this.name = 'AuthDependencyUnavailableError';
+        this.dependency = dependency;
+        this.cause = cause;
+    }
+}
+export class TokenInvalidError extends Error {
+    constructor(reason){
+        super(reason ? `Invalid token: ${reason}` : 'Invalid token');
+        this.name = 'TokenInvalidError';
+    }
+}
+export class TokenExpiredError extends Error {
+    constructor(){
+        super('Token has expired');
+        this.name = 'TokenExpiredError';
+    }
+}
+export class TokenAlreadyUsedError extends Error {
+    constructor(){
+        super('Token has already been used');
+        this.name = 'TokenAlreadyUsedError';
+    }
+}
+export class MembershipRequiredError extends Error {
+    constructor(workspaceId){
+        super(`Membership required for workspace: ${workspaceId}`);
+        this.name = 'MembershipRequiredError';
+    }
+}
+export class LastMemberError extends Error {
+    constructor(workspaceId){
+        super(`Cannot remove the last member of workspace: ${workspaceId}`);
+        this.name = 'LastMemberError';
+    }
+}
+export class InvitationEmailMismatchError extends Error {
+    constructor(){
+        super('Invitation email does not match authenticated user');
+        this.name = 'InvitationEmailMismatchError';
+    }
+}
+export class OpenInvitationExistsError extends Error {
+    constructor(email){
+        super(`An open invitation already exists for: ${email}`);
+        this.name = 'OpenInvitationExistsError';
+    }
+}
+
+//# sourceMappingURL=errors.js.map

package/dist/core/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class ApiKeyNotFoundError extends Error {\n  constructor(id: string) {\n    super(`API key not found: ${id}`);\n    this.name = 'ApiKeyNotFoundError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class AuthDependencyUnavailableError extends Error {\n  readonly dependency: string;\n  override readonly cause: unknown;\n\n  constructor(dependency: string, cause: unknown) {\n    super(`Authentication dependency unavailable: ${dependency}`);\n    this.name = 'AuthDependencyUnavailableError';\n    this.dependency = dependency;\n    this.cause = cause;\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","ApiKeyNotFoundError","id","InvitationNotFoundError","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","InvalidCredentialsError","EmailNotVerifiedError","AuthDependencyUnavailableError","dependency","cause","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4BAA4BH;IACvC,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,mBAAmB,EAAEA,IAAI;QAChC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMG,gCAAgCL;IAC3C,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,gCAAgCb;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMY,8BAA8Bd;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,uCAAuCf;IAIlD,YAAYgB,UAAkB,EAAEC,KAAc,CAAE;QAC9C,KAAK,CAAC,CAAC,uCAAuC,EAAED,YAAY;QAC5D,IAAI,CAACd,IAAI,GAAG;QACZ,IAAI,CAACc,UAAU,GAAGA;QAClB,IAAI,CAACC,KAAK,GAAGA;IACf;AACF;AAEA,OAAO,MAAMC,0BAA0BlB;IACrC,YAAYmB,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAACjB,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMkB,0BAA0BpB;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMmB,8BAA8BrB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMoB,gCAAgCtB;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,wBAAwBvB;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMsB,qCAAqCxB;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMuB,kCAAkCzB;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}

package/dist/core/job-lease-token.d.ts

@@ -0,0 +1,12 @@
+import { type JobLeaseTokenClaims } from '@shipfox/api-auth-dto';
+export type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;
+type JobLeaseParamSource = Pick<JobLeaseTokenClaims, 'workflowRunId' | 'workflowRunAttemptId' | 'jobId' | 'jobExecutionId' | 'projectId' | 'workspaceId' | 'runnerSessionId'>;
+export declare function jobLeaseParamsFrom(source: JobLeaseParamSource, stepScope?: {
+    currentStepId: string;
+    currentStepAttempt: number;
+}): IssueJobLeaseTokenParams;
+export declare function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string>;
+/** Returns the claims on success, or `null` for any invalid input — never throws. */
+export declare function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null>;
+export {};
+//# sourceMappingURL=job-lease-token.d.ts.map

package/dist/core/job-lease-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"job-lease-token.d.ts","sourceRoot":"","sources":["../../src/core/job-lease-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,mBAAmB,EAEzB,MAAM,uBAAuB,CAAC;AAM/B,MAAM,MAAM,wBAAwB,GAAG,IAAI,CAAC,mBAAmB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAExF,KAAK,mBAAmB,GAAG,IAAI,CAC7B,mBAAmB,EACjB,eAAe,GACf,sBAAsB,GACtB,OAAO,GACP,gBAAgB,GAChB,WAAW,GACX,aAAa,GACb,iBAAiB,CACpB,CAAC;AAEF,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,mBAAmB,EAC3B,SAAS,CAAC,EAAE;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,kBAAkB,EAAE,MAAM,CAAA;CAAC,GAC9D,wBAAwB,CAW1B;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA0B1F;AAED,qFAAqF;AACrF,wBAAsB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAc5F"}

package/dist/core/job-lease-token.js

@@ -0,0 +1,58 @@
+import { JOB_LEASE_TOKEN_AUDIENCE, jobLeaseTokenClaimsSchema } from '@shipfox/api-auth-dto';
+import { signHs256, verifyHs256 } from '@shipfox/node-jwt';
+import { config } from '#config.js';
+import { recordTokenIssued, recordTokenVerified } from '#metrics/index.js';
+export function jobLeaseParamsFrom(source, stepScope) {
+    return {
+        workflowRunId: source.workflowRunId,
+        workflowRunAttemptId: source.workflowRunAttemptId,
+        jobId: source.jobId,
+        jobExecutionId: source.jobExecutionId,
+        projectId: source.projectId,
+        workspaceId: source.workspaceId,
+        runnerSessionId: source.runnerSessionId,
+        ...stepScope ? stepScope : {}
+    };
+}
+export async function issueJobLeaseToken(claims) {
+    const token = await signHs256({
+        payload: {
+            workflowRunId: claims.workflowRunId,
+            ...claims.workflowRunAttempt === undefined ? {} : {
+                workflowRunAttempt: claims.workflowRunAttempt
+            },
+            workflowRunAttemptId: claims.workflowRunAttemptId,
+            jobId: claims.jobId,
+            jobExecutionId: claims.jobExecutionId,
+            projectId: claims.projectId,
+            workspaceId: claims.workspaceId,
+            runnerSessionId: claims.runnerSessionId,
+            ...claims.currentStepId && claims.currentStepAttempt !== undefined ? {
+                currentStepId: claims.currentStepId,
+                currentStepAttempt: claims.currentStepAttempt
+            } : {}
+        },
+        secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,
+        expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,
+        audience: JOB_LEASE_TOKEN_AUDIENCE
+    });
+    recordTokenIssued('job_lease');
+    return token;
+}
+/** Returns the claims on success, or `null` for any invalid input — never throws. */ export async function verifyJobLeaseToken(token) {
+    try {
+        const claims = await verifyHs256({
+            token,
+            secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,
+            schema: jobLeaseTokenClaimsSchema,
+            audience: JOB_LEASE_TOKEN_AUDIENCE
+        });
+        recordTokenVerified('job_lease', 'ok');
+        return claims;
+    } catch  {
+        recordTokenVerified('job_lease', 'rejected');
+        return null;
+    }
+}
+
+//# sourceMappingURL=job-lease-token.js.map

package/dist/core/job-lease-token.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/job-lease-token.ts"],"sourcesContent":["import {\n  JOB_LEASE_TOKEN_AUDIENCE,\n  type JobLeaseTokenClaims,\n  jobLeaseTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueJobLeaseTokenParams = Omit<JobLeaseTokenClaims, 'aud' | 'iat' | 'exp'>;\n\ntype JobLeaseParamSource = Pick<\n  JobLeaseTokenClaims,\n  | 'workflowRunId'\n  | 'workflowRunAttemptId'\n  | 'jobId'\n  | 'jobExecutionId'\n  | 'projectId'\n  | 'workspaceId'\n  | 'runnerSessionId'\n>;\n\nexport function jobLeaseParamsFrom(\n  source: JobLeaseParamSource,\n  stepScope?: {currentStepId: string; currentStepAttempt: number},\n): IssueJobLeaseTokenParams {\n  return {\n    workflowRunId: source.workflowRunId,\n    workflowRunAttemptId: source.workflowRunAttemptId,\n    jobId: source.jobId,\n    jobExecutionId: source.jobExecutionId,\n    projectId: source.projectId,\n    workspaceId: source.workspaceId,\n    runnerSessionId: source.runnerSessionId,\n    ...(stepScope ? stepScope : {}),\n  };\n}\n\nexport async function issueJobLeaseToken(claims: IssueJobLeaseTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      workflowRunId: claims.workflowRunId,\n      ...(claims.workflowRunAttempt === undefined\n        ? {}\n        : {workflowRunAttempt: claims.workflowRunAttempt}),\n      workflowRunAttemptId: claims.workflowRunAttemptId,\n      jobId: claims.jobId,\n      jobExecutionId: claims.jobExecutionId,\n      projectId: claims.projectId,\n      workspaceId: claims.workspaceId,\n      runnerSessionId: claims.runnerSessionId,\n      ...(claims.currentStepId && claims.currentStepAttempt !== undefined\n        ? {\n            currentStepId: claims.currentStepId,\n            currentStepAttempt: claims.currentStepAttempt,\n          }\n        : {}),\n    },\n    secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,\n    expiresIn: config.AUTH_JOB_LEASE_TOKEN_EXPIRES_IN,\n    audience: JOB_LEASE_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('job_lease');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyJobLeaseToken(token: string): Promise<JobLeaseTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: config.AUTH_JOB_LEASE_TOKEN_SECRET,\n      schema: jobLeaseTokenClaimsSchema,\n      audience: JOB_LEASE_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('job_lease', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('job_lease', 'rejected');\n    return null;\n  }\n}\n"],"names":["JOB_LEASE_TOKEN_AUDIENCE","jobLeaseTokenClaimsSchema","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","jobLeaseParamsFrom","source","stepScope","workflowRunId","workflowRunAttemptId","jobId","jobExecutionId","projectId","workspaceId","runnerSessionId","issueJobLeaseToken","claims","token","payload","workflowRunAttempt","undefined","currentStepId","currentStepAttempt","secret","AUTH_JOB_LEASE_TOKEN_SECRET","expiresIn","AUTH_JOB_LEASE_TOKEN_EXPIRES_IN","audience","verifyJobLeaseToken","schema"],"mappings":"AAAA,SACEA,wBAAwB,EAExBC,yBAAyB,QACpB,wBAAwB;AAC/B,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAgBzE,OAAO,SAASC,mBACdC,MAA2B,EAC3BC,SAA+D;IAE/D,OAAO;QACLC,eAAeF,OAAOE,aAAa;QACnCC,sBAAsBH,OAAOG,oBAAoB;QACjDC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgBL,OAAOK,cAAc;QACrCC,WAAWN,OAAOM,SAAS;QAC3BC,aAAaP,OAAOO,WAAW;QAC/BC,iBAAiBR,OAAOQ,eAAe;QACvC,GAAIP,YAAYA,YAAY,CAAC,CAAC;IAChC;AACF;AAEA,OAAO,eAAeQ,mBAAmBC,MAAgC;IACvE,MAAMC,QAAQ,MAAMjB,UAAU;QAC5BkB,SAAS;YACPV,eAAeQ,OAAOR,aAAa;YACnC,GAAIQ,OAAOG,kBAAkB,KAAKC,YAC9B,CAAC,IACD;gBAACD,oBAAoBH,OAAOG,kBAAkB;YAAA,CAAC;YACnDV,sBAAsBO,OAAOP,oBAAoB;YACjDC,OAAOM,OAAON,KAAK;YACnBC,gBAAgBK,OAAOL,cAAc;YACrCC,WAAWI,OAAOJ,SAAS;YAC3BC,aAAaG,OAAOH,WAAW;YAC/BC,iBAAiBE,OAAOF,eAAe;YACvC,GAAIE,OAAOK,aAAa,IAAIL,OAAOM,kBAAkB,KAAKF,YACtD;gBACEC,eAAeL,OAAOK,aAAa;gBACnCC,oBAAoBN,OAAOM,kBAAkB;YAC/C,IACA,CAAC,CAAC;QACR;QACAC,QAAQrB,OAAOsB,2BAA2B;QAC1CC,WAAWvB,OAAOwB,+BAA+B;QACjDC,UAAU7B;IACZ;IACAK,kBAAkB;IAClB,OAAOc;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeW,oBAAoBX,KAAa;IACrD,IAAI;QACF,MAAMD,SAAS,MAAMf,YAAY;YAC/BgB;YACAM,QAAQrB,OAAOsB,2BAA2B;YAC1CK,QAAQ9B;YACR4B,UAAU7B;QACZ;QACAM,oBAAoB,aAAa;QACjC,OAAOY;IACT,EAAE,OAAM;QACNZ,oBAAoB,aAAa;QACjC,OAAO;IACT;AACF"}

package/dist/core/jwt.d.ts

@@ -0,0 +1,37 @@
+import { z } from 'zod';
+export declare const tokenMembershipSchema: z.ZodObject<{
+    workspaceId: z.ZodString;
+    role: z.ZodEnum<{
+        admin: "admin";
+    }>;
+}, z.core.$strip>;
+export type TokenMembership = z.infer<typeof tokenMembershipSchema>;
+export declare const userTokenClaimsSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    memberships: z.ZodArray<z.ZodObject<{
+        workspaceId: z.ZodString;
+        role: z.ZodEnum<{
+            admin: "admin";
+        }>;
+    }, z.core.$strip>>;
+    iat: z.ZodNumber;
+    exp: z.ZodNumber;
+}, z.core.$strip>;
+export type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;
+export interface SignUserTokenParams {
+    userId: string;
+    email: string;
+    name?: string | null | undefined;
+    memberships: TokenMembership[];
+    secret: string;
+    expiresIn: string;
+}
+export interface VerifyUserTokenParams {
+    token: string;
+    secret: string;
+}
+export declare function signUserToken(params: SignUserTokenParams): Promise<string>;
+export declare function verifyUserToken(params: VerifyUserTokenParams): Promise<UserTokenClaims>;
+//# sourceMappingURL=jwt.d.ts.map

package/dist/core/jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/core/jwt.ts"],"names":[],"mappings":"AAEA,OAAO,EAAC,CAAC,EAAC,MAAM,KAAK,CAAC;AAGtB,eAAO,MAAM,qBAAqB;;;;;iBAGhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,eAAO,MAAM,qBAAqB;;;;;;;;;;;;iBAOhC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAEpE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACjC,WAAW,EAAE,eAAe,EAAE,CAAC;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAahF;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE,qBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC,CAa7F"}

package/dist/core/jwt.js

@@ -0,0 +1,46 @@
+import { workspaceRoleSchema } from '@shipfox/api-workspaces-dto';
+import { signHs256, verifyHs256 } from '@shipfox/node-jwt';
+import { z } from 'zod';
+import { recordTokenIssued, recordTokenVerified } from '#metrics/index.js';
+export const tokenMembershipSchema = z.object({
+    workspaceId: z.string().uuid(),
+    role: workspaceRoleSchema
+});
+export const userTokenClaimsSchema = z.object({
+    sub: z.string().uuid(),
+    email: z.string().email(),
+    name: z.string().nullable().optional(),
+    memberships: z.array(tokenMembershipSchema),
+    iat: z.number().int(),
+    exp: z.number().int()
+});
+export async function signUserToken(params) {
+    const token = await signHs256({
+        payload: {
+            email: params.email,
+            name: params.name ?? null,
+            memberships: params.memberships
+        },
+        secret: params.secret,
+        expiresIn: params.expiresIn,
+        subject: params.userId
+    });
+    recordTokenIssued('session');
+    return token;
+}
+export async function verifyUserToken(params) {
+    try {
+        const claims = await verifyHs256({
+            token: params.token,
+            secret: params.secret,
+            schema: userTokenClaimsSchema
+        });
+        recordTokenVerified('session', 'ok');
+        return claims;
+    } catch (error) {
+        recordTokenVerified('session', 'rejected');
+        throw error;
+    }
+}
+
+//# sourceMappingURL=jwt.js.map

package/dist/core/jwt.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/jwt.ts"],"sourcesContent":["import {workspaceRoleSchema} from '@shipfox/api-workspaces-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {z} from 'zod';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\nexport const tokenMembershipSchema = z.object({\n  workspaceId: z.string().uuid(),\n  role: workspaceRoleSchema,\n});\n\nexport type TokenMembership = z.infer<typeof tokenMembershipSchema>;\n\nexport const userTokenClaimsSchema = z.object({\n  sub: z.string().uuid(),\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  memberships: z.array(tokenMembershipSchema),\n  iat: z.number().int(),\n  exp: z.number().int(),\n});\n\nexport type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;\n\nexport interface SignUserTokenParams {\n  userId: string;\n  email: string;\n  name?: string | null | undefined;\n  memberships: TokenMembership[];\n  secret: string;\n  expiresIn: string;\n}\n\nexport interface VerifyUserTokenParams {\n  token: string;\n  secret: string;\n}\n\nexport async function signUserToken(params: SignUserTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      email: params.email,\n      name: params.name ?? null,\n      memberships: params.memberships,\n    },\n    secret: params.secret,\n    expiresIn: params.expiresIn,\n    subject: params.userId,\n  });\n  recordTokenIssued('session');\n  return token;\n}\n\nexport async function verifyUserToken(params: VerifyUserTokenParams): Promise<UserTokenClaims> {\n  try {\n    const claims = await verifyHs256({\n      token: params.token,\n      secret: params.secret,\n      schema: userTokenClaimsSchema,\n    });\n    recordTokenVerified('session', 'ok');\n    return claims;\n  } catch (error) {\n    recordTokenVerified('session', 'rejected');\n    throw error;\n  }\n}\n"],"names":["workspaceRoleSchema","signHs256","verifyHs256","z","recordTokenIssued","recordTokenVerified","tokenMembershipSchema","object","workspaceId","string","uuid","role","userTokenClaimsSchema","sub","email","name","nullable","optional","memberships","array","iat","number","int","exp","signUserToken","params","token","payload","secret","expiresIn","subject","userId","verifyUserToken","claims","schema","error"],"mappings":"AAAA,SAAQA,mBAAmB,QAAO,8BAA8B;AAChE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAEzE,OAAO,MAAMC,wBAAwBH,EAAEI,MAAM,CAAC;IAC5CC,aAAaL,EAAEM,MAAM,GAAGC,IAAI;IAC5BC,MAAMX;AACR,GAAG;AAIH,OAAO,MAAMY,wBAAwBT,EAAEI,MAAM,CAAC;IAC5CM,KAAKV,EAAEM,MAAM,GAAGC,IAAI;IACpBI,OAAOX,EAAEM,MAAM,GAAGK,KAAK;IACvBC,MAAMZ,EAAEM,MAAM,GAAGO,QAAQ,GAAGC,QAAQ;IACpCC,aAAaf,EAAEgB,KAAK,CAACb;IACrBc,KAAKjB,EAAEkB,MAAM,GAAGC,GAAG;IACnBC,KAAKpB,EAAEkB,MAAM,GAAGC,GAAG;AACrB,GAAG;AAkBH,OAAO,eAAeE,cAAcC,MAA2B;IAC7D,MAAMC,QAAQ,MAAMzB,UAAU;QAC5B0B,SAAS;YACPb,OAAOW,OAAOX,KAAK;YACnBC,MAAMU,OAAOV,IAAI,IAAI;YACrBG,aAAaO,OAAOP,WAAW;QACjC;QACAU,QAAQH,OAAOG,MAAM;QACrBC,WAAWJ,OAAOI,SAAS;QAC3BC,SAASL,OAAOM,MAAM;IACxB;IACA3B,kBAAkB;IAClB,OAAOsB;AACT;AAEA,OAAO,eAAeM,gBAAgBP,MAA6B;IACjE,IAAI;QACF,MAAMQ,SAAS,MAAM/B,YAAY;YAC/BwB,OAAOD,OAAOC,KAAK;YACnBE,QAAQH,OAAOG,MAAM;YACrBM,QAAQtB;QACV;QACAP,oBAAoB,WAAW;QAC/B,OAAO4B;IACT,EAAE,OAAOE,OAAO;QACd9B,oBAAoB,WAAW;QAC/B,MAAM8B;IACR;AACF"}

package/dist/core/password.d.ts

@@ -0,0 +1,10 @@
+export interface HashPasswordParams {
+    password: string;
+}
+export interface VerifyPasswordParams {
+    password: string;
+    hash: string;
+}
+export declare function hashPassword(params: HashPasswordParams): Promise<string>;
+export declare function verifyPassword(params: VerifyPasswordParams): Promise<boolean>;
+//# sourceMappingURL=password.d.ts.map

package/dist/core/password.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/core/password.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC,CAExE;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,OAAO,CAAC,CAE7E"}

package/dist/core/password.js

@@ -0,0 +1,13 @@
+import { hash, verify } from '@node-rs/argon2';
+// Algorithm.Argon2id = 2; using literal here to avoid const-enum import under verbatimModuleSyntax.
+const HASH_OPTIONS = {
+    algorithm: 2
+};
+export function hashPassword(params) {
+    return hash(params.password, HASH_OPTIONS);
+}
+export function verifyPassword(params) {
+    return verify(params.hash, params.password);
+}
+
+//# sourceMappingURL=password.js.map

package/dist/core/password.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/password.ts"],"sourcesContent":["import {hash, verify} from '@node-rs/argon2';\n\nexport interface HashPasswordParams {\n  password: string;\n}\n\nexport interface VerifyPasswordParams {\n  password: string;\n  hash: string;\n}\n\n// Algorithm.Argon2id = 2; using literal here to avoid const-enum import under verbatimModuleSyntax.\nconst HASH_OPTIONS = {algorithm: 2} as const;\n\nexport function hashPassword(params: HashPasswordParams): Promise<string> {\n  return hash(params.password, HASH_OPTIONS);\n}\n\nexport function verifyPassword(params: VerifyPasswordParams): Promise<boolean> {\n  return verify(params.hash, params.password);\n}\n"],"names":["hash","verify","HASH_OPTIONS","algorithm","hashPassword","params","password","verifyPassword"],"mappings":"AAAA,SAAQA,IAAI,EAAEC,MAAM,QAAO,kBAAkB;AAW7C,oGAAoG;AACpG,MAAMC,eAAe;IAACC,WAAW;AAAC;AAElC,OAAO,SAASC,aAAaC,MAA0B;IACrD,OAAOL,KAAKK,OAAOC,QAAQ,EAAEJ;AAC/B;AAEA,OAAO,SAASK,eAAeF,MAA4B;IACzD,OAAOJ,OAAOI,OAAOL,IAAI,EAAEK,OAAOC,QAAQ;AAC5C"}

package/dist/core/rate-limit.d.ts

@@ -0,0 +1,34 @@
+import { RateLimitExceededError, type RateLimitPolicy, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
+import { type AuthRateLimitAction, type AuthRateLimitScope } from '#metrics/index.js';
+export type { AuthRateLimitAction, AuthRateLimitOutcome, AuthRateLimitScope, } from '#metrics/index.js';
+export type AuthRateLimitPolicy = RateLimitPolicy;
+export interface CheckAuthRateLimitParams extends AuthRateLimitPolicy {
+    action: AuthRateLimitAction;
+    scope: AuthRateLimitScope;
+    identifier: string;
+    now?: Date | undefined;
+    timeoutMs?: number | undefined;
+}
+export declare class AuthRateLimitExceededError extends RateLimitExceededError<AuthRateLimitAction, AuthRateLimitScope> {
+    constructor(params: {
+        action: AuthRateLimitAction;
+        scope: AuthRateLimitScope;
+        retryAfterSeconds: number;
+        identifierHmacPrefix: string;
+    });
+}
+export declare class AuthRateLimitUnavailableError extends RateLimitUnavailableError<AuthRateLimitAction, AuthRateLimitScope> {
+    constructor(params: {
+        action: AuthRateLimitAction;
+        scope: AuthRateLimitScope;
+        identifierHmacPrefix: string;
+        cause: unknown;
+    });
+}
+export declare function hashAuthRateLimitIdentifier(params: {
+    action: AuthRateLimitAction;
+    scope: AuthRateLimitScope;
+    identifier: string;
+}): string;
+export declare function checkAuthRateLimit(params: CheckAuthRateLimitParams): Promise<void>;
+//# sourceMappingURL=rate-limit.d.ts.map

package/dist/core/rate-limit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,0BAA2B,SAAQ,sBAAsB,CACpE,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAKF;AAED,qBAAa,6BAA8B,SAAQ,yBAAyB,CAC1E,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAKF;AAgBD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxF"}

package/dist/core/rate-limit.js

@@ -0,0 +1,76 @@
+import { createHmac } from 'node:crypto';
+import { checkRateLimit, hashRateLimitIdentifier, RateLimitExceededError, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
+import { config } from '#config.js';
+import { consumeAuthRateLimit, pruneExpiredAuthRateLimits } from '#db/rate-limits.js';
+import { recordAuthRateLimitCheck, recordAuthRateLimitPruneFailure } from '#metrics/index.js';
+export class AuthRateLimitExceededError extends RateLimitExceededError {
+    constructor(params){
+        super(params);
+        this.name = 'AuthRateLimitExceededError';
+        this.message = 'Authentication rate limit exceeded';
+    }
+}
+export class AuthRateLimitUnavailableError extends RateLimitUnavailableError {
+    constructor(params){
+        super(params);
+        this.name = 'AuthRateLimitUnavailableError';
+        this.message = 'Authentication rate limiter unavailable';
+    }
+}
+const DEFAULT_TIMEOUT_MS = 250;
+const IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.auth.rate-limit.identifier-secret.v1';
+const IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';
+function effectiveIdentifierSecret() {
+    if (config.RATE_LIMIT_IDENTIFIER_SECRET) {
+        return config.RATE_LIMIT_IDENTIFIER_SECRET;
+    }
+    return createHmac('sha256', config.AUTH_JWT_SECRET).update(IDENTIFIER_SECRET_DERIVATION_DOMAIN).digest();
+}
+export function hashAuthRateLimitIdentifier(params) {
+    return hashRateLimitIdentifier({
+        action: params.action,
+        scope: params.scope,
+        identifier: params.identifier,
+        secret: effectiveIdentifierSecret(),
+        domain: IDENTIFIER_HASH_DOMAIN
+    });
+}
+export async function checkAuthRateLimit(params) {
+    try {
+        await checkRateLimit({
+            action: params.action,
+            scope: params.scope,
+            identifier: params.identifier,
+            limit: params.limit,
+            windowSeconds: params.windowSeconds,
+            identifierSecret: effectiveIdentifierSecret(),
+            identifierHashDomain: IDENTIFIER_HASH_DOMAIN,
+            consume: consumeAuthRateLimit,
+            prune: pruneExpiredAuthRateLimits,
+            onCheck: recordAuthRateLimitCheck,
+            onPruneFailure: recordAuthRateLimitPruneFailure,
+            now: params.now,
+            timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS
+        });
+    } catch (error) {
+        if (error instanceof RateLimitExceededError) {
+            throw new AuthRateLimitExceededError({
+                action: error.action,
+                scope: error.scope,
+                retryAfterSeconds: error.retryAfterSeconds,
+                identifierHmacPrefix: error.identifierHmacPrefix
+            });
+        }
+        if (error instanceof RateLimitUnavailableError) {
+            throw new AuthRateLimitUnavailableError({
+                action: error.action,
+                scope: error.scope,
+                identifierHmacPrefix: error.identifierHmacPrefix,
+                cause: error.cause
+            });
+        }
+        throw error;
+    }
+}
+
+//# sourceMappingURL=rate-limit.js.map

package/dist/core/rate-limit.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {config} from '#config.js';\nimport {consumeAuthRateLimit, pruneExpiredAuthRateLimits} from '#db/rate-limits.js';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitScope,\n  recordAuthRateLimitCheck,\n  recordAuthRateLimitPruneFailure,\n} from '#metrics/index.js';\n\nexport type {\n  AuthRateLimitAction,\n  AuthRateLimitOutcome,\n  AuthRateLimitScope,\n} from '#metrics/index.js';\n\nexport type AuthRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckAuthRateLimitParams extends AuthRateLimitPolicy {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class AuthRateLimitExceededError extends RateLimitExceededError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitExceededError';\n    this.message = 'Authentication rate limit exceeded';\n  }\n}\n\nexport class AuthRateLimitUnavailableError extends RateLimitUnavailableError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitUnavailableError';\n    this.message = 'Authentication rate limiter unavailable';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 250;\nconst IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.auth.rate-limit.identifier-secret.v1';\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';\n\nfunction effectiveIdentifierSecret(): Buffer | string {\n  if (config.RATE_LIMIT_IDENTIFIER_SECRET) {\n    return config.RATE_LIMIT_IDENTIFIER_SECRET;\n  }\n\n  return createHmac('sha256', config.AUTH_JWT_SECRET)\n    .update(IDENTIFIER_SECRET_DERIVATION_DOMAIN)\n    .digest();\n}\n\nexport function hashAuthRateLimitIdentifier(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkAuthRateLimit(params: CheckAuthRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeAuthRateLimit,\n      prune: pruneExpiredAuthRateLimits,\n      onCheck: recordAuthRateLimitCheck,\n      onPruneFailure: recordAuthRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new AuthRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new AuthRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n"],"names":["createHmac","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","config","consumeAuthRateLimit","pruneExpiredAuthRateLimits","recordAuthRateLimitCheck","recordAuthRateLimitPruneFailure","AuthRateLimitExceededError","params","name","message","AuthRateLimitUnavailableError","DEFAULT_TIMEOUT_MS","IDENTIFIER_SECRET_DERIVATION_DOMAIN","IDENTIFIER_HASH_DOMAIN","effectiveIdentifierSecret","RATE_LIMIT_IDENTIFIER_SECRET","AUTH_JWT_SECRET","update","digest","hashAuthRateLimitIdentifier","action","scope","identifier","secret","domain","checkAuthRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","error","retryAfterSeconds","identifierHmacPrefix","cause"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAEtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,0BAA0B,QAAO,qBAAqB;AACpF,SAGEC,wBAAwB,EACxBC,+BAA+B,QAC1B,oBAAoB;AAkB3B,OAAO,MAAMC,mCAAmCP;IAI9C,YAAYQ,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,OAAO,MAAMC,sCAAsCV;IAIjD,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,MAAME,qBAAqB;AAC3B,MAAMC,sCAAsC;AAC5C,MAAMC,yBAAyB;AAE/B,SAASC;IACP,IAAIb,OAAOc,4BAA4B,EAAE;QACvC,OAAOd,OAAOc,4BAA4B;IAC5C;IAEA,OAAOnB,WAAW,UAAUK,OAAOe,eAAe,EAC/CC,MAAM,CAACL,qCACPM,MAAM;AACX;AAEA,OAAO,SAASC,4BAA4BZ,MAI3C;IACC,OAAOT,wBAAwB;QAC7BsB,QAAQb,OAAOa,MAAM;QACrBC,OAAOd,OAAOc,KAAK;QACnBC,YAAYf,OAAOe,UAAU;QAC7BC,QAAQT;QACRU,QAAQX;IACV;AACF;AAEA,OAAO,eAAeY,mBAAmBlB,MAAgC;IACvE,IAAI;QACF,MAAMV,eAAe;YACnBuB,QAAQb,OAAOa,MAAM;YACrBC,OAAOd,OAAOc,KAAK;YACnBC,YAAYf,OAAOe,UAAU;YAC7BI,OAAOnB,OAAOmB,KAAK;YACnBC,eAAepB,OAAOoB,aAAa;YACnCC,kBAAkBd;YAClBe,sBAAsBhB;YACtBiB,SAAS5B;YACT6B,OAAO5B;YACP6B,SAAS5B;YACT6B,gBAAgB5B;YAChB6B,KAAK3B,OAAO2B,GAAG;YACfC,WAAW5B,OAAO4B,SAAS,IAAIxB;QACjC;IACF,EAAE,OAAOyB,OAAO;QACd,IAAIA,iBAAiBrC,wBAAwB;YAC3C,MAAM,IAAIO,2BAA2B;gBACnCc,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBgB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiBpC,2BAA2B;YAC9C,MAAM,IAAIU,8BAA8B;gBACtCU,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBiB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF"}

package/dist/core/runner-session-token.d.ts

@@ -0,0 +1,6 @@
+import { type RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
+export type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;
+export declare function issueRunnerSessionToken(claims: IssueRunnerSessionTokenParams): Promise<string>;
+/** Returns the claims on success, or `null` for any invalid input — never throws. */
+export declare function verifyRunnerSessionToken(token: string): Promise<RunnerSessionTokenClaims | null>;
+//# sourceMappingURL=runner-session-token.d.ts.map

package/dist/core/runner-session-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAM/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}