@shipfox/api-auth 5.0.0 → 6.0.0

package/dist/core/jwt.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/jwt.ts"],"sourcesContent":["import {workspaceRoleSchema} from '@shipfox/api-workspaces-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {z} from 'zod';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\nexport const tokenMembershipSchema = z.object({\n  workspaceId: z.string().uuid(),\n  role: workspaceRoleSchema,\n});\n\nexport type TokenMembership = z.infer<typeof tokenMembershipSchema>;\n\nexport const userTokenClaimsSchema = z.object({\n  sub: z.string().uuid(),\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  memberships: z.array(tokenMembershipSchema),\n  iat: z.number().int(),\n  exp: z.number().int(),\n});\n\nexport type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;\n\nexport interface SignUserTokenParams {\n  userId: string;\n  email: string;\n  name?: string | null | undefined;\n  memberships: TokenMembership[];\n  secret: string;\n  expiresIn: string;\n}\n\nexport interface VerifyUserTokenParams {\n  token: string;\n  secret: string;\n}\n\nexport async function signUserToken(params: SignUserTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      email: params.email,\n      name: params.name ?? null,\n      memberships: params.memberships,\n    },\n    secret: params.secret,\n    expiresIn: params.expiresIn,\n    subject: params.userId,\n  });\n  recordTokenIssued('session');\n  return token;\n}\n\nexport async function verifyUserToken(params: VerifyUserTokenParams): Promise<UserTokenClaims> {\n  try {\n    const claims = await verifyHs256({\n      token: params.token,\n      secret: params.secret,\n      schema: userTokenClaimsSchema,\n    });\n    recordTokenVerified('session', 'ok');\n    return claims;\n  } catch (error) {\n    recordTokenVerified('session', 'rejected');\n    throw error;\n  }\n}\n"],"names":["workspaceRoleSchema","signHs256","verifyHs256","z","recordTokenIssued","recordTokenVerified","tokenMembershipSchema","object","workspaceId","string","uuid","role","userTokenClaimsSchema","sub","email","name","nullable","optional","memberships","array","iat","number","int","exp","signUserToken","params","token","payload","secret","expiresIn","subject","userId","verifyUserToken","claims","schema","error"],"mappings":"AAAA,SAAQA,mBAAmB,QAAO,8BAA8B;AAChE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAEzE,OAAO,MAAMC,wBAAwBH,EAAEI,MAAM,CAAC;IAC5CC,aAAaL,EAAEM,MAAM,GAAGC,IAAI;IAC5BC,MAAMX;AACR,GAAG;AAIH,OAAO,MAAMY,wBAAwBT,EAAEI,MAAM,CAAC;IAC5CM,KAAKV,EAAEM,MAAM,GAAGC,IAAI;IACpBI,OAAOX,EAAEM,MAAM,GAAGK,KAAK;IACvBC,MAAMZ,EAAEM,MAAM,GAAGO,QAAQ,GAAGC,QAAQ;IACpCC,aAAaf,EAAEgB,KAAK,CAACb;IACrBc,KAAKjB,EAAEkB,MAAM,GAAGC,GAAG;IACnBC,KAAKpB,EAAEkB,MAAM,GAAGC,GAAG;AACrB,GAAG;AAkBH,OAAO,eAAeE,cAAcC,MAA2B;IAC7D,MAAMC,QAAQ,MAAMzB,UAAU;QAC5B0B,SAAS;YACPb,OAAOW,OAAOX,KAAK;YACnBC,MAAMU,OAAOV,IAAI,IAAI;YACrBG,aAAaO,OAAOP,WAAW;QACjC;QACAU,QAAQH,OAAOG,MAAM;QACrBC,WAAWJ,OAAOI,SAAS;QAC3BC,SAASL,OAAOM,MAAM;IACxB;IACA3B,kBAAkB;IAClB,OAAOsB;AACT;AAEA,OAAO,eAAeM,gBAAgBP,MAA6B;IACjE,IAAI;QACF,MAAMQ,SAAS,MAAM/B,YAAY;YAC/BwB,OAAOD,OAAOC,KAAK;YACnBE,QAAQH,OAAOG,MAAM;YACrBM,QAAQtB;QACV;QACAP,oBAAoB,WAAW;QAC/B,OAAO4B;IACT,EAAE,OAAOE,OAAO;QACd9B,oBAAoB,WAAW;QAC/B,MAAM8B;IACR;AACF"}
+{"version":3,"sources":["../../src/core/jwt.ts"],"sourcesContent":["import {workspaceRoleSchema} from '@shipfox/api-workspaces-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {z} from 'zod';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\nexport const tokenMembershipSchema = z.object({\n  workspaceId: z.string().uuid(),\n  role: workspaceRoleSchema,\n});\n\nexport type TokenMembership = z.infer<typeof tokenMembershipSchema>;\n\nexport const userTokenClaimsSchema = z.object({\n  sub: z.string().uuid(),\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  memberships: z.array(tokenMembershipSchema),\n  iat: z.number().int(),\n  exp: z.number().int(),\n});\n\nexport type UserTokenClaims = z.infer<typeof userTokenClaimsSchema>;\n\nexport interface SignUserTokenParams {\n  userId: string;\n  email: string;\n  name?: string | null | undefined;\n  memberships: TokenMembership[];\n  secret: string | Uint8Array;\n  expiresIn: string;\n}\n\nexport interface VerifyUserTokenParams {\n  token: string;\n  secret: string | Uint8Array;\n}\n\nexport async function signUserToken(params: SignUserTokenParams): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      email: params.email,\n      name: params.name ?? null,\n      memberships: params.memberships,\n    },\n    secret: params.secret,\n    expiresIn: params.expiresIn,\n    subject: params.userId,\n  });\n  recordTokenIssued('session');\n  return token;\n}\n\nexport async function verifyUserToken(params: VerifyUserTokenParams): Promise<UserTokenClaims> {\n  try {\n    const claims = await verifyHs256({\n      token: params.token,\n      secret: params.secret,\n      schema: userTokenClaimsSchema,\n    });\n    recordTokenVerified('session', 'ok');\n    return claims;\n  } catch (error) {\n    recordTokenVerified('session', 'rejected');\n    throw error;\n  }\n}\n"],"names":["workspaceRoleSchema","signHs256","verifyHs256","z","recordTokenIssued","recordTokenVerified","tokenMembershipSchema","object","workspaceId","string","uuid","role","userTokenClaimsSchema","sub","email","name","nullable","optional","memberships","array","iat","number","int","exp","signUserToken","params","token","payload","secret","expiresIn","subject","userId","verifyUserToken","claims","schema","error"],"mappings":"AAAA,SAAQA,mBAAmB,QAAO,8BAA8B;AAChE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,CAAC,QAAO,MAAM;AACtB,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAEzE,OAAO,MAAMC,wBAAwBH,EAAEI,MAAM,CAAC;IAC5CC,aAAaL,EAAEM,MAAM,GAAGC,IAAI;IAC5BC,MAAMX;AACR,GAAG;AAIH,OAAO,MAAMY,wBAAwBT,EAAEI,MAAM,CAAC;IAC5CM,KAAKV,EAAEM,MAAM,GAAGC,IAAI;IACpBI,OAAOX,EAAEM,MAAM,GAAGK,KAAK;IACvBC,MAAMZ,EAAEM,MAAM,GAAGO,QAAQ,GAAGC,QAAQ;IACpCC,aAAaf,EAAEgB,KAAK,CAACb;IACrBc,KAAKjB,EAAEkB,MAAM,GAAGC,GAAG;IACnBC,KAAKpB,EAAEkB,MAAM,GAAGC,GAAG;AACrB,GAAG;AAkBH,OAAO,eAAeE,cAAcC,MAA2B;IAC7D,MAAMC,QAAQ,MAAMzB,UAAU;QAC5B0B,SAAS;YACPb,OAAOW,OAAOX,KAAK;YACnBC,MAAMU,OAAOV,IAAI,IAAI;YACrBG,aAAaO,OAAOP,WAAW;QACjC;QACAU,QAAQH,OAAOG,MAAM;QACrBC,WAAWJ,OAAOI,SAAS;QAC3BC,SAASL,OAAOM,MAAM;IACxB;IACA3B,kBAAkB;IAClB,OAAOsB;AACT;AAEA,OAAO,eAAeM,gBAAgBP,MAA6B;IACjE,IAAI;QACF,MAAMQ,SAAS,MAAM/B,YAAY;YAC/BwB,OAAOD,OAAOC,KAAK;YACnBE,QAAQH,OAAOG,MAAM;YACrBM,QAAQtB;QACV;QACAP,oBAAoB,WAAW;QAC/B,OAAO4B;IACT,EAAE,OAAOE,OAAO;QACd9B,oBAAoB,WAAW;QAC/B,MAAM8B;IACR;AACF"}

package/dist/core/rate-limit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAGlC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,0BAA2B,SAAQ,sBAAsB,CACpE,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAKF;AAED,qBAAa,6BAA8B,SAAQ,yBAAyB,CAC1E,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAKF;AAgBD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxF"}
+{"version":3,"file":"rate-limit.d.ts","sourceRoot":"","sources":["../../src/core/rate-limit.ts"],"names":[],"mappings":"AACA,OAAO,EAGL,sBAAsB,EACtB,KAAK,eAAe,EACpB,yBAAyB,EAC1B,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,kBAAkB,EAGxB,MAAM,mBAAmB,CAAC;AAE3B,YAAY,EACV,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAElD,MAAM,WAAW,wBAAyB,SAAQ,mBAAmB;IACnE,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAChC;AAED,qBAAa,0BAA2B,SAAQ,sBAAsB,CACpE,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;KAC9B;CAKF;AAED,qBAAa,6BAA8B,SAAQ,yBAAyB,CAC1E,mBAAmB,EACnB,kBAAkB,CACnB;gBACa,MAAM,EAAE;QAClB,MAAM,EAAE,mBAAmB,CAAC;QAC5B,KAAK,EAAE,kBAAkB,CAAC;QAC1B,oBAAoB,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,OAAO,CAAC;KAChB;CAKF;AASD,wBAAgB,2BAA2B,CAAC,MAAM,EAAE;IAClD,MAAM,EAAE,mBAAmB,CAAC;IAC5B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;CACpB,GAAG,MAAM,CAQT;AAED,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,wBAAwB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxF"}

package/dist/core/rate-limit.js

@@ -1,6 +1,5 @@
-import { createHmac } from 'node:crypto';
+import { rateLimitIdentifierKey } from '@shipfox/node-auth-root-key';
 import { checkRateLimit, hashRateLimitIdentifier, RateLimitExceededError, RateLimitUnavailableError } from '@shipfox/node-rate-limit';
-import { config } from '#config.js';
 import { consumeAuthRateLimit, pruneExpiredAuthRateLimits } from '#db/rate-limits.js';
 import { recordAuthRateLimitCheck, recordAuthRateLimitPruneFailure } from '#metrics/index.js';
 export class AuthRateLimitExceededError extends RateLimitExceededError {
@@ -18,13 +17,9 @@ export class AuthRateLimitUnavailableError extends RateLimitUnavailableError {
     }
 }
 const DEFAULT_TIMEOUT_MS = 250;
-const IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.auth.rate-limit.identifier-secret.v1';
 const IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';
 function effectiveIdentifierSecret() {
-    if (config.RATE_LIMIT_IDENTIFIER_SECRET) {
-        return config.RATE_LIMIT_IDENTIFIER_SECRET;
-    }
-    return createHmac('sha256', config.AUTH_JWT_SECRET).update(IDENTIFIER_SECRET_DERIVATION_DOMAIN).digest();
+    return rateLimitIdentifierKey();
 }
 export function hashAuthRateLimitIdentifier(params) {
     return hashRateLimitIdentifier({

package/dist/core/rate-limit.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {createHmac} from 'node:crypto';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {config} from '#config.js';\nimport {consumeAuthRateLimit, pruneExpiredAuthRateLimits} from '#db/rate-limits.js';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitScope,\n  recordAuthRateLimitCheck,\n  recordAuthRateLimitPruneFailure,\n} from '#metrics/index.js';\n\nexport type {\n  AuthRateLimitAction,\n  AuthRateLimitOutcome,\n  AuthRateLimitScope,\n} from '#metrics/index.js';\n\nexport type AuthRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckAuthRateLimitParams extends AuthRateLimitPolicy {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class AuthRateLimitExceededError extends RateLimitExceededError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitExceededError';\n    this.message = 'Authentication rate limit exceeded';\n  }\n}\n\nexport class AuthRateLimitUnavailableError extends RateLimitUnavailableError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitUnavailableError';\n    this.message = 'Authentication rate limiter unavailable';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 250;\nconst IDENTIFIER_SECRET_DERIVATION_DOMAIN = 'shipfox.auth.rate-limit.identifier-secret.v1';\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';\n\nfunction effectiveIdentifierSecret(): Buffer | string {\n  if (config.RATE_LIMIT_IDENTIFIER_SECRET) {\n    return config.RATE_LIMIT_IDENTIFIER_SECRET;\n  }\n\n  return createHmac('sha256', config.AUTH_JWT_SECRET)\n    .update(IDENTIFIER_SECRET_DERIVATION_DOMAIN)\n    .digest();\n}\n\nexport function hashAuthRateLimitIdentifier(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkAuthRateLimit(params: CheckAuthRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeAuthRateLimit,\n      prune: pruneExpiredAuthRateLimits,\n      onCheck: recordAuthRateLimitCheck,\n      onPruneFailure: recordAuthRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new AuthRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new AuthRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n"],"names":["createHmac","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","config","consumeAuthRateLimit","pruneExpiredAuthRateLimits","recordAuthRateLimitCheck","recordAuthRateLimitPruneFailure","AuthRateLimitExceededError","params","name","message","AuthRateLimitUnavailableError","DEFAULT_TIMEOUT_MS","IDENTIFIER_SECRET_DERIVATION_DOMAIN","IDENTIFIER_HASH_DOMAIN","effectiveIdentifierSecret","RATE_LIMIT_IDENTIFIER_SECRET","AUTH_JWT_SECRET","update","digest","hashAuthRateLimitIdentifier","action","scope","identifier","secret","domain","checkAuthRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","error","retryAfterSeconds","identifierHmacPrefix","cause"],"mappings":"AAAA,SAAQA,UAAU,QAAO,cAAc;AACvC,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAEtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,0BAA0B,QAAO,qBAAqB;AACpF,SAGEC,wBAAwB,EACxBC,+BAA+B,QAC1B,oBAAoB;AAkB3B,OAAO,MAAMC,mCAAmCP;IAI9C,YAAYQ,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,OAAO,MAAMC,sCAAsCV;IAIjD,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,MAAME,qBAAqB;AAC3B,MAAMC,sCAAsC;AAC5C,MAAMC,yBAAyB;AAE/B,SAASC;IACP,IAAIb,OAAOc,4BAA4B,EAAE;QACvC,OAAOd,OAAOc,4BAA4B;IAC5C;IAEA,OAAOnB,WAAW,UAAUK,OAAOe,eAAe,EAC/CC,MAAM,CAACL,qCACPM,MAAM;AACX;AAEA,OAAO,SAASC,4BAA4BZ,MAI3C;IACC,OAAOT,wBAAwB;QAC7BsB,QAAQb,OAAOa,MAAM;QACrBC,OAAOd,OAAOc,KAAK;QACnBC,YAAYf,OAAOe,UAAU;QAC7BC,QAAQT;QACRU,QAAQX;IACV;AACF;AAEA,OAAO,eAAeY,mBAAmBlB,MAAgC;IACvE,IAAI;QACF,MAAMV,eAAe;YACnBuB,QAAQb,OAAOa,MAAM;YACrBC,OAAOd,OAAOc,KAAK;YACnBC,YAAYf,OAAOe,UAAU;YAC7BI,OAAOnB,OAAOmB,KAAK;YACnBC,eAAepB,OAAOoB,aAAa;YACnCC,kBAAkBd;YAClBe,sBAAsBhB;YACtBiB,SAAS5B;YACT6B,OAAO5B;YACP6B,SAAS5B;YACT6B,gBAAgB5B;YAChB6B,KAAK3B,OAAO2B,GAAG;YACfC,WAAW5B,OAAO4B,SAAS,IAAIxB;QACjC;IACF,EAAE,OAAOyB,OAAO;QACd,IAAIA,iBAAiBrC,wBAAwB;YAC3C,MAAM,IAAIO,2BAA2B;gBACnCc,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBgB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiBpC,2BAA2B;YAC9C,MAAM,IAAIU,8BAA8B;gBACtCU,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBiB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF"}
+{"version":3,"sources":["../../src/core/rate-limit.ts"],"sourcesContent":["import {rateLimitIdentifierKey} from '@shipfox/node-auth-root-key';\nimport {\n  checkRateLimit,\n  hashRateLimitIdentifier,\n  RateLimitExceededError,\n  type RateLimitPolicy,\n  RateLimitUnavailableError,\n} from '@shipfox/node-rate-limit';\nimport {consumeAuthRateLimit, pruneExpiredAuthRateLimits} from '#db/rate-limits.js';\nimport {\n  type AuthRateLimitAction,\n  type AuthRateLimitScope,\n  recordAuthRateLimitCheck,\n  recordAuthRateLimitPruneFailure,\n} from '#metrics/index.js';\n\nexport type {\n  AuthRateLimitAction,\n  AuthRateLimitOutcome,\n  AuthRateLimitScope,\n} from '#metrics/index.js';\n\nexport type AuthRateLimitPolicy = RateLimitPolicy;\n\nexport interface CheckAuthRateLimitParams extends AuthRateLimitPolicy {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n  now?: Date | undefined;\n  timeoutMs?: number | undefined;\n}\n\nexport class AuthRateLimitExceededError extends RateLimitExceededError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    retryAfterSeconds: number;\n    identifierHmacPrefix: string;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitExceededError';\n    this.message = 'Authentication rate limit exceeded';\n  }\n}\n\nexport class AuthRateLimitUnavailableError extends RateLimitUnavailableError<\n  AuthRateLimitAction,\n  AuthRateLimitScope\n> {\n  constructor(params: {\n    action: AuthRateLimitAction;\n    scope: AuthRateLimitScope;\n    identifierHmacPrefix: string;\n    cause: unknown;\n  }) {\n    super(params);\n    this.name = 'AuthRateLimitUnavailableError';\n    this.message = 'Authentication rate limiter unavailable';\n  }\n}\n\nconst DEFAULT_TIMEOUT_MS = 250;\nconst IDENTIFIER_HASH_DOMAIN = 'shipfox.auth.rate-limit.identifier.v1';\n\nfunction effectiveIdentifierSecret(): Uint8Array {\n  return rateLimitIdentifierKey();\n}\n\nexport function hashAuthRateLimitIdentifier(params: {\n  action: AuthRateLimitAction;\n  scope: AuthRateLimitScope;\n  identifier: string;\n}): string {\n  return hashRateLimitIdentifier({\n    action: params.action,\n    scope: params.scope,\n    identifier: params.identifier,\n    secret: effectiveIdentifierSecret(),\n    domain: IDENTIFIER_HASH_DOMAIN,\n  });\n}\n\nexport async function checkAuthRateLimit(params: CheckAuthRateLimitParams): Promise<void> {\n  try {\n    await checkRateLimit({\n      action: params.action,\n      scope: params.scope,\n      identifier: params.identifier,\n      limit: params.limit,\n      windowSeconds: params.windowSeconds,\n      identifierSecret: effectiveIdentifierSecret(),\n      identifierHashDomain: IDENTIFIER_HASH_DOMAIN,\n      consume: consumeAuthRateLimit,\n      prune: pruneExpiredAuthRateLimits,\n      onCheck: recordAuthRateLimitCheck,\n      onPruneFailure: recordAuthRateLimitPruneFailure,\n      now: params.now,\n      timeoutMs: params.timeoutMs ?? DEFAULT_TIMEOUT_MS,\n    });\n  } catch (error) {\n    if (error instanceof RateLimitExceededError) {\n      throw new AuthRateLimitExceededError({\n        action: error.action,\n        scope: error.scope,\n        retryAfterSeconds: error.retryAfterSeconds,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n      });\n    }\n    if (error instanceof RateLimitUnavailableError) {\n      throw new AuthRateLimitUnavailableError({\n        action: error.action,\n        scope: error.scope,\n        identifierHmacPrefix: error.identifierHmacPrefix,\n        cause: error.cause,\n      });\n    }\n    throw error;\n  }\n}\n"],"names":["rateLimitIdentifierKey","checkRateLimit","hashRateLimitIdentifier","RateLimitExceededError","RateLimitUnavailableError","consumeAuthRateLimit","pruneExpiredAuthRateLimits","recordAuthRateLimitCheck","recordAuthRateLimitPruneFailure","AuthRateLimitExceededError","params","name","message","AuthRateLimitUnavailableError","DEFAULT_TIMEOUT_MS","IDENTIFIER_HASH_DOMAIN","effectiveIdentifierSecret","hashAuthRateLimitIdentifier","action","scope","identifier","secret","domain","checkAuthRateLimit","limit","windowSeconds","identifierSecret","identifierHashDomain","consume","prune","onCheck","onPruneFailure","now","timeoutMs","error","retryAfterSeconds","identifierHmacPrefix","cause"],"mappings":"AAAA,SAAQA,sBAAsB,QAAO,8BAA8B;AACnE,SACEC,cAAc,EACdC,uBAAuB,EACvBC,sBAAsB,EAEtBC,yBAAyB,QACpB,2BAA2B;AAClC,SAAQC,oBAAoB,EAAEC,0BAA0B,QAAO,qBAAqB;AACpF,SAGEC,wBAAwB,EACxBC,+BAA+B,QAC1B,oBAAoB;AAkB3B,OAAO,MAAMC,mCAAmCN;IAI9C,YAAYO,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,OAAO,MAAMC,sCAAsCT;IAIjD,YAAYM,MAKX,CAAE;QACD,KAAK,CAACA;QACN,IAAI,CAACC,IAAI,GAAG;QACZ,IAAI,CAACC,OAAO,GAAG;IACjB;AACF;AAEA,MAAME,qBAAqB;AAC3B,MAAMC,yBAAyB;AAE/B,SAASC;IACP,OAAOhB;AACT;AAEA,OAAO,SAASiB,4BAA4BP,MAI3C;IACC,OAAOR,wBAAwB;QAC7BgB,QAAQR,OAAOQ,MAAM;QACrBC,OAAOT,OAAOS,KAAK;QACnBC,YAAYV,OAAOU,UAAU;QAC7BC,QAAQL;QACRM,QAAQP;IACV;AACF;AAEA,OAAO,eAAeQ,mBAAmBb,MAAgC;IACvE,IAAI;QACF,MAAMT,eAAe;YACnBiB,QAAQR,OAAOQ,MAAM;YACrBC,OAAOT,OAAOS,KAAK;YACnBC,YAAYV,OAAOU,UAAU;YAC7BI,OAAOd,OAAOc,KAAK;YACnBC,eAAef,OAAOe,aAAa;YACnCC,kBAAkBV;YAClBW,sBAAsBZ;YACtBa,SAASvB;YACTwB,OAAOvB;YACPwB,SAASvB;YACTwB,gBAAgBvB;YAChBwB,KAAKtB,OAAOsB,GAAG;YACfC,WAAWvB,OAAOuB,SAAS,IAAInB;QACjC;IACF,EAAE,OAAOoB,OAAO;QACd,IAAIA,iBAAiB/B,wBAAwB;YAC3C,MAAM,IAAIM,2BAA2B;gBACnCS,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBgB,mBAAmBD,MAAMC,iBAAiB;gBAC1CC,sBAAsBF,MAAME,oBAAoB;YAClD;QACF;QACA,IAAIF,iBAAiB9B,2BAA2B;YAC9C,MAAM,IAAIS,8BAA8B;gBACtCK,QAAQgB,MAAMhB,MAAM;gBACpBC,OAAOe,MAAMf,KAAK;gBAClBiB,sBAAsBF,MAAME,oBAAoB;gBAChDC,OAAOH,MAAMG,KAAK;YACpB;QACF;QACA,MAAMH;IACR;AACF"}

package/dist/core/runner-session-token.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAM/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}
+{"version":3,"file":"runner-session-token.d.ts","sourceRoot":"","sources":["../../src/core/runner-session-token.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,KAAK,wBAAwB,EAE9B,MAAM,uBAAuB,CAAC;AAO/B,MAAM,MAAM,6BAA6B,GAAG,IAAI,CAAC,wBAAwB,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC,CAAC;AAElG,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,6BAA6B,GACpC,OAAO,CAAC,MAAM,CAAC,CAejB;AAED,qFAAqF;AACrF,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAc1C"}

package/dist/core/runner-session-token.js

@@ -1,4 +1,5 @@
 import { RUNNER_SESSION_TOKEN_AUDIENCE, runnerSessionTokenClaimsSchema } from '@shipfox/api-auth-dto';
+import { runnerSessionTokenKey } from '@shipfox/node-auth-root-key';
 import { signHs256, verifyHs256 } from '@shipfox/node-jwt';
 import { config } from '#config.js';
 import { recordTokenIssued, recordTokenVerified } from '#metrics/index.js';
@@ -11,7 +12,7 @@ export async function issueRunnerSessionToken(claims) {
             labels: claims.labels,
             maxClaims: claims.maxClaims
         },
-        secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+        secret: runnerSessionTokenKey(),
         expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,
         audience: RUNNER_SESSION_TOKEN_AUDIENCE
     });
@@ -22,7 +23,7 @@ export async function issueRunnerSessionToken(claims) {
     try {
         const claims = await verifyHs256({
             token,
-            secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,
+            secret: runnerSessionTokenKey(),
             schema: runnerSessionTokenClaimsSchema,
             audience: RUNNER_SESSION_TOKEN_AUDIENCE
         });

package/dist/core/runner-session-token.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: config.AUTH_RUNNER_SESSION_TOKEN_SECRET,\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","AUTH_RUNNER_SESSION_TOKEN_SECRET","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQZ,OAAOa,gCAAgC;QAC/CC,WAAWd,OAAOe,oCAAoC;QACtDC,UAAUpB;IACZ;IACAK,kBAAkB;IAClB,OAAOI;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeY,yBACpBZ,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQZ,OAAOa,gCAAgC;YAC/CK,QAAQrB;YACRmB,UAAUpB;QACZ;QACAM,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}
+{"version":3,"sources":["../../src/core/runner-session-token.ts"],"sourcesContent":["import {\n  RUNNER_SESSION_TOKEN_AUDIENCE,\n  type RunnerSessionTokenClaims,\n  runnerSessionTokenClaimsSchema,\n} from '@shipfox/api-auth-dto';\nimport {runnerSessionTokenKey} from '@shipfox/node-auth-root-key';\nimport {signHs256, verifyHs256} from '@shipfox/node-jwt';\nimport {config} from '#config.js';\nimport {recordTokenIssued, recordTokenVerified} from '#metrics/index.js';\n\n// `aud`, `iat` and `exp` are set by the codec (jose); callers supply the business ids only.\nexport type IssueRunnerSessionTokenParams = Omit<RunnerSessionTokenClaims, 'aud' | 'iat' | 'exp'>;\n\nexport async function issueRunnerSessionToken(\n  claims: IssueRunnerSessionTokenParams,\n): Promise<string> {\n  const token = await signHs256({\n    payload: {\n      runnerSessionId: claims.runnerSessionId,\n      workspaceId: claims.workspaceId,\n      scope: claims.scope,\n      labels: claims.labels,\n      maxClaims: claims.maxClaims,\n    },\n    secret: runnerSessionTokenKey(),\n    expiresIn: config.AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN,\n    audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n  });\n  recordTokenIssued('runner_session');\n  return token;\n}\n\n/** Returns the claims on success, or `null` for any invalid input — never throws. */\nexport async function verifyRunnerSessionToken(\n  token: string,\n): Promise<RunnerSessionTokenClaims | null> {\n  try {\n    const claims = await verifyHs256({\n      token,\n      secret: runnerSessionTokenKey(),\n      schema: runnerSessionTokenClaimsSchema,\n      audience: RUNNER_SESSION_TOKEN_AUDIENCE,\n    });\n    recordTokenVerified('runner_session', 'ok');\n    return claims;\n  } catch {\n    recordTokenVerified('runner_session', 'rejected');\n    return null;\n  }\n}\n"],"names":["RUNNER_SESSION_TOKEN_AUDIENCE","runnerSessionTokenClaimsSchema","runnerSessionTokenKey","signHs256","verifyHs256","config","recordTokenIssued","recordTokenVerified","issueRunnerSessionToken","claims","token","payload","runnerSessionId","workspaceId","scope","labels","maxClaims","secret","expiresIn","AUTH_RUNNER_SESSION_TOKEN_EXPIRES_IN","audience","verifyRunnerSessionToken","schema"],"mappings":"AAAA,SACEA,6BAA6B,EAE7BC,8BAA8B,QACzB,wBAAwB;AAC/B,SAAQC,qBAAqB,QAAO,8BAA8B;AAClE,SAAQC,SAAS,EAAEC,WAAW,QAAO,oBAAoB;AACzD,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,iBAAiB,EAAEC,mBAAmB,QAAO,oBAAoB;AAKzE,OAAO,eAAeC,wBACpBC,MAAqC;IAErC,MAAMC,QAAQ,MAAMP,UAAU;QAC5BQ,SAAS;YACPC,iBAAiBH,OAAOG,eAAe;YACvCC,aAAaJ,OAAOI,WAAW;YAC/BC,OAAOL,OAAOK,KAAK;YACnBC,QAAQN,OAAOM,MAAM;YACrBC,WAAWP,OAAOO,SAAS;QAC7B;QACAC,QAAQf;QACRgB,WAAWb,OAAOc,oCAAoC;QACtDC,UAAUpB;IACZ;IACAM,kBAAkB;IAClB,OAAOI;AACT;AAEA,mFAAmF,GACnF,OAAO,eAAeW,yBACpBX,KAAa;IAEb,IAAI;QACF,MAAMD,SAAS,MAAML,YAAY;YAC/BM;YACAO,QAAQf;YACRoB,QAAQrB;YACRmB,UAAUpB;QACZ;QACAO,oBAAoB,kBAAkB;QACtC,OAAOE;IACT,EAAE,OAAM;QACNF,oBAAoB,kBAAkB;QACtC,OAAO;IACT;AACF"}

package/dist/db/db.d.ts

@@ -412,115 +412,6 @@ export declare const schema: {
         };
         dialect: "pg";
     }>;
-    emailVerifications: import("drizzle-orm/pg-core").PgTableWithColumns<{
-        name: "email_verifications";
-        schema: undefined;
-        columns: {
-            id: import("drizzle-orm/pg-core").PgColumn<{
-                name: "id";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgUUID";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: true;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgUUID";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            hashedToken: import("drizzle-orm/pg-core").PgColumn<{
-                name: "hashed_token";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "expires_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            usedAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "used_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            createdAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "created_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-        };
-        dialect: "pg";
-    }>;
     authOutbox: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "outbox";
         schema: undefined;
@@ -1272,115 +1163,6 @@ export declare function db(): NodePgDatabase<{
         };
         dialect: "pg";
     }>;
-    emailVerifications: import("drizzle-orm/pg-core").PgTableWithColumns<{
-        name: "email_verifications";
-        schema: undefined;
-        columns: {
-            id: import("drizzle-orm/pg-core").PgColumn<{
-                name: "id";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgUUID";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: true;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            userId: import("drizzle-orm/pg-core").PgColumn<{
-                name: "user_id";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgUUID";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            hashedToken: import("drizzle-orm/pg-core").PgColumn<{
-                name: "hashed_token";
-                tableName: "email_verifications";
-                dataType: "string";
-                columnType: "PgText";
-                data: string;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: [string, ...string[]];
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            expiresAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "expires_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: true;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            usedAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "used_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: false;
-                hasDefault: false;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-            createdAt: import("drizzle-orm/pg-core").PgColumn<{
-                name: "created_at";
-                tableName: "email_verifications";
-                dataType: "date";
-                columnType: "PgTimestamp";
-                data: Date;
-                driverParam: string;
-                notNull: true;
-                hasDefault: true;
-                isPrimaryKey: false;
-                isAutoincrement: false;
-                hasRuntimeDefault: false;
-                enumValues: undefined;
-                baseColumn: never;
-                identity: undefined;
-                generated: undefined;
-            }, {}, {}>;
-        };
-        dialect: "pg";
-    }>;
     authOutbox: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "outbox";
         schema: undefined;

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AASnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAQnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAMlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -1,6 +1,5 @@
 import { drizzle } from '@shipfox/node-drizzle';
 import { pgClient } from '@shipfox/node-postgres';
-import { emailVerifications } from './schema/email-verifications.js';
 import { authOutbox } from './schema/outbox.js';
 import { passwordResets } from './schema/password-resets.js';
 import { authRateLimits } from './schema/rate-limits.js';
@@ -10,7 +9,6 @@ export const schema = {
     users,
     passwordResets,
     refreshTokens,
-    emailVerifications,
     authOutbox,
     authRateLimits
 };

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {emailVerifications} from './schema/email-verifications.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  users,\n  passwordResets,\n  refreshTokens,\n  emailVerifications,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","emailVerifications","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,kBAAkB,QAAO,kCAAkC;AACnE,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBD;IACAH;IACAE;IACAJ;IACAC;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMT,QAAQC,YAAY;QAACO;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBD;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMR,QAAQC,YAAY;QAACM;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/users.d.ts

@@ -4,6 +4,9 @@ export interface CreateUserParams {
     hashedPassword: string | null;
     name?: string | null;
     emailVerifiedAt?: Date | null;
+    signedUp?: {
+        viaInvitation: boolean;
+    };
 }
 export interface ProvisionUserParams {
     email: string;

package/dist/db/users.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/db/users.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAKjD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAcD,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAsBxE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB9E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAKxF;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE;IAAC,EAAE,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAKlF;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAa3B;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAU3F"}
+{"version":3,"file":"users.d.ts","sourceRoot":"","sources":["../../src/db/users.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAC,IAAI,EAAC,MAAM,wBAAwB,CAAC;AAMjD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,eAAe,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,EAAE;QAAC,aAAa,EAAE,OAAO,CAAA;KAAC,CAAC;CACrC;AAED,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAcD,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoCxE;AAED,wBAAsB,aAAa,CAAC,MAAM,EAAE,mBAAmB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkB9E;AAED,wBAAsB,eAAe,CAAC,MAAM,EAAE;IAAC,KAAK,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAKxF;AAED,wBAAsB,YAAY,CAAC,MAAM,EAAE;IAAC,EAAE,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAKlF;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,wBAAwB,GAC/B,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAa3B;AAED,wBAAsB,iBAAiB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,IAAI,GAAG,SAAS,CAAC,CAU3F"}

package/dist/db/users.js

@@ -1,6 +1,9 @@
+import { AUTH_USER_SIGNED_UP } from '@shipfox/api-auth-dto';
+import { writeOutboxEvent } from '@shipfox/node-outbox';
 import { eq } from 'drizzle-orm';
 import { EmailTakenError } from '#core/errors.js';
 import { db } from './db.js';
+import { authOutbox } from './schema/outbox.js';
 import { toUser, users } from './schema/users.js';
 // Drizzle wraps the underlying Postgres error; walk `.cause` to reach it.
 function isAuthUsersEmailUniqueViolation(error) {
@@ -14,23 +17,38 @@ function isAuthUsersEmailUniqueViolation(error) {
     return false;
 }
 export async function createUser(params) {
-    let rows;
     try {
-        rows = await db().insert(users).values({
-            email: params.email,
-            hashedPassword: params.hashedPassword,
-            name: params.name ?? null,
-            emailVerifiedAt: params.emailVerifiedAt ?? null
-        }).returning();
+        return await db().transaction(async (tx)=>{
+            const rows = await tx.insert(users).values({
+                email: params.email,
+                hashedPassword: params.hashedPassword,
+                name: params.name ?? null,
+                emailVerifiedAt: params.emailVerifiedAt ?? null
+            }).returning();
+            const row = rows[0];
+            if (!row) throw new Error('Insert returned no rows');
+            const user = toUser(row);
+            if (params.signedUp) {
+                await writeOutboxEvent(tx, authOutbox, {
+                    type: AUTH_USER_SIGNED_UP,
+                    payload: {
+                        userId: user.id,
+                        email: user.email,
+                        ...user.name ? {
+                            name: user.name
+                        } : {},
+                        viaInvitation: params.signedUp.viaInvitation
+                    }
+                });
+            }
+            return user;
+        });
     } catch (error) {
         if (isAuthUsersEmailUniqueViolation(error)) {
             throw new EmailTakenError(params.email);
         }
         throw error;
     }
-    const row = rows[0];
-    if (!row) throw new Error('Insert returned no rows');
-    return toUser(row);
 }
 export async function provisionUser(params) {
     const rows = await db().insert(users).values({

package/dist/db/users.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/users.ts"],"sourcesContent":["import {eq} from 'drizzle-orm';\nimport type {User} from '#core/entities/user.js';\nimport {EmailTakenError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {toUser, type UserDb, users} from './schema/users.js';\n\nexport interface CreateUserParams {\n  email: string;\n  hashedPassword: string | null;\n  name?: string | null;\n  emailVerifiedAt?: Date | null;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null;\n}\n\n// Drizzle wraps the underlying Postgres error; walk `.cause` to reach it.\nfunction isAuthUsersEmailUniqueViolation(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; depth < 5 && current != null; depth += 1) {\n    if (typeof current !== 'object') return false;\n    const {code, constraint} = current as {code?: unknown; constraint?: unknown};\n    if (code === '23505' && constraint === 'auth_users_email_unique') return true;\n    current = (current as {cause?: unknown}).cause;\n  }\n  return false;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  let rows: UserDb[];\n  try {\n    rows = await db()\n      .insert(users)\n      .values({\n        email: params.email,\n        hashedPassword: params.hashedPassword,\n        name: params.name ?? null,\n        emailVerifiedAt: params.emailVerifiedAt ?? null,\n      })\n      .returning();\n  } catch (error) {\n    if (isAuthUsersEmailUniqueViolation(error)) {\n      throw new EmailTakenError(params.email);\n    }\n    throw error;\n  }\n\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toUser(row);\n}\n\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  const rows = await db()\n    .insert(users)\n    .values({\n      email: params.email,\n      hashedPassword: null,\n      name: params.name ?? null,\n      emailVerifiedAt: new Date(),\n    })\n    .onConflictDoNothing({target: users.email})\n    .returning();\n\n  const row = rows[0];\n  if (row) return toUser(row);\n\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) return existing;\n  throw new Error('Provisioning user conflict returned no user');\n}\n\nexport async function findUserByEmail(params: {email: string}): Promise<User | undefined> {\n  const rows = await db().select().from(users).where(eq(users.email, params.email)).limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport async function findUserById(params: {id: string}): Promise<User | undefined> {\n  const rows = await db().select().from(users).where(eq(users.id, params.id)).limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport interface UpdateUserPasswordParams {\n  userId: string;\n  hashedPassword: string;\n}\n\nexport async function updateUserPassword(\n  params: UpdateUserPasswordParams,\n): Promise<User | undefined> {\n  const rows = await db()\n    .update(users)\n    .set({\n      hashedPassword: params.hashedPassword,\n      updatedAt: new Date(),\n    })\n    .where(eq(users.id, params.userId))\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport async function markEmailVerified(params: {userId: string}): Promise<User | undefined> {\n  const rows = await db()\n    .update(users)\n    .set({emailVerifiedAt: new Date(), updatedAt: new Date()})\n    .where(eq(users.id, params.userId))\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n"],"names":["eq","EmailTakenError","db","toUser","users","isAuthUsersEmailUniqueViolation","error","current","depth","code","constraint","cause","createUser","params","rows","insert","values","email","hashedPassword","name","emailVerifiedAt","returning","row","Error","provisionUser","Date","onConflictDoNothing","target","existing","findUserByEmail","select","from","where","limit","undefined","findUserById","id","updateUserPassword","update","set","updatedAt","userId","markEmailVerified"],"mappings":"AAAA,SAAQA,EAAE,QAAO,cAAc;AAE/B,SAAQC,eAAe,QAAO,kBAAkB;AAChD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,MAAM,EAAeC,KAAK,QAAO,oBAAoB;AAc7D,0EAA0E;AAC1E,SAASC,gCAAgCC,KAAc;IACrD,IAAIC,UAAmBD;IACvB,IAAK,IAAIE,QAAQ,GAAGA,QAAQ,KAAKD,WAAW,MAAMC,SAAS,EAAG;QAC5D,IAAI,OAAOD,YAAY,UAAU,OAAO;QACxC,MAAM,EAACE,IAAI,EAAEC,UAAU,EAAC,GAAGH;QAC3B,IAAIE,SAAS,WAAWC,eAAe,2BAA2B,OAAO;QACzEH,UAAU,AAACA,QAA8BI,KAAK;IAChD;IACA,OAAO;AACT;AAEA,OAAO,eAAeC,WAAWC,MAAwB;IACvD,IAAIC;IACJ,IAAI;QACFA,OAAO,MAAMZ,KACVa,MAAM,CAACX,OACPY,MAAM,CAAC;YACNC,OAAOJ,OAAOI,KAAK;YACnBC,gBAAgBL,OAAOK,cAAc;YACrCC,MAAMN,OAAOM,IAAI,IAAI;YACrBC,iBAAiBP,OAAOO,eAAe,IAAI;QAC7C,GACCC,SAAS;IACd,EAAE,OAAOf,OAAO;QACd,IAAID,gCAAgCC,QAAQ;YAC1C,MAAM,IAAIL,gBAAgBY,OAAOI,KAAK;QACxC;QACA,MAAMX;IACR;IAEA,MAAMgB,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOpB,OAAOmB;AAChB;AAEA,OAAO,eAAeE,cAAcX,MAA2B;IAC7D,MAAMC,OAAO,MAAMZ,KAChBa,MAAM,CAACX,OACPY,MAAM,CAAC;QACNC,OAAOJ,OAAOI,KAAK;QACnBC,gBAAgB;QAChBC,MAAMN,OAAOM,IAAI,IAAI;QACrBC,iBAAiB,IAAIK;IACvB,GACCC,mBAAmB,CAAC;QAACC,QAAQvB,MAAMa,KAAK;IAAA,GACxCI,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAIQ,KAAK,OAAOnB,OAAOmB;IAEvB,MAAMM,WAAW,MAAMC,gBAAgB;QAACZ,OAAOJ,OAAOI,KAAK;IAAA;IAC3D,IAAIW,UAAU,OAAOA;IACrB,MAAM,IAAIL,MAAM;AAClB;AAEA,OAAO,eAAeM,gBAAgBhB,MAAuB;IAC3D,MAAMC,OAAO,MAAMZ,KAAK4B,MAAM,GAAGC,IAAI,CAAC3B,OAAO4B,KAAK,CAAChC,GAAGI,MAAMa,KAAK,EAAEJ,OAAOI,KAAK,GAAGgB,KAAK,CAAC;IACxF,MAAMX,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOY;IACjB,OAAO/B,OAAOmB;AAChB;AAEA,OAAO,eAAea,aAAatB,MAAoB;IACrD,MAAMC,OAAO,MAAMZ,KAAK4B,MAAM,GAAGC,IAAI,CAAC3B,OAAO4B,KAAK,CAAChC,GAAGI,MAAMgC,EAAE,EAAEvB,OAAOuB,EAAE,GAAGH,KAAK,CAAC;IAClF,MAAMX,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOY;IACjB,OAAO/B,OAAOmB;AAChB;AAOA,OAAO,eAAee,mBACpBxB,MAAgC;IAEhC,MAAMC,OAAO,MAAMZ,KAChBoC,MAAM,CAAClC,OACPmC,GAAG,CAAC;QACHrB,gBAAgBL,OAAOK,cAAc;QACrCsB,WAAW,IAAIf;IACjB,GACCO,KAAK,CAAChC,GAAGI,MAAMgC,EAAE,EAAEvB,OAAO4B,MAAM,GAChCpB,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOY;IACjB,OAAO/B,OAAOmB;AAChB;AAEA,OAAO,eAAeoB,kBAAkB7B,MAAwB;IAC9D,MAAMC,OAAO,MAAMZ,KAChBoC,MAAM,CAAClC,OACPmC,GAAG,CAAC;QAACnB,iBAAiB,IAAIK;QAAQe,WAAW,IAAIf;IAAM,GACvDO,KAAK,CAAChC,GAAGI,MAAMgC,EAAE,EAAEvB,OAAO4B,MAAM,GAChCpB,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOY;IACjB,OAAO/B,OAAOmB;AAChB"}
+{"version":3,"sources":["../../src/db/users.ts"],"sourcesContent":["import {AUTH_USER_SIGNED_UP, type AuthEventMap} from '@shipfox/api-auth-dto';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {eq} from 'drizzle-orm';\nimport type {User} from '#core/entities/user.js';\nimport {EmailTakenError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {toUser, type UserDb, users} from './schema/users.js';\n\nexport interface CreateUserParams {\n  email: string;\n  hashedPassword: string | null;\n  name?: string | null;\n  emailVerifiedAt?: Date | null;\n  signedUp?: {viaInvitation: boolean};\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null;\n}\n\n// Drizzle wraps the underlying Postgres error; walk `.cause` to reach it.\nfunction isAuthUsersEmailUniqueViolation(error: unknown): boolean {\n  let current: unknown = error;\n  for (let depth = 0; depth < 5 && current != null; depth += 1) {\n    if (typeof current !== 'object') return false;\n    const {code, constraint} = current as {code?: unknown; constraint?: unknown};\n    if (code === '23505' && constraint === 'auth_users_email_unique') return true;\n    current = (current as {cause?: unknown}).cause;\n  }\n  return false;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  try {\n    return await db().transaction(async (tx) => {\n      const rows: UserDb[] = await tx\n        .insert(users)\n        .values({\n          email: params.email,\n          hashedPassword: params.hashedPassword,\n          name: params.name ?? null,\n          emailVerifiedAt: params.emailVerifiedAt ?? null,\n        })\n        .returning();\n\n      const row = rows[0];\n      if (!row) throw new Error('Insert returned no rows');\n\n      const user = toUser(row);\n      if (params.signedUp) {\n        await writeOutboxEvent<AuthEventMap>(tx, authOutbox, {\n          type: AUTH_USER_SIGNED_UP,\n          payload: {\n            userId: user.id,\n            email: user.email,\n            ...(user.name ? {name: user.name} : {}),\n            viaInvitation: params.signedUp.viaInvitation,\n          },\n        });\n      }\n      return user;\n    });\n  } catch (error) {\n    if (isAuthUsersEmailUniqueViolation(error)) {\n      throw new EmailTakenError(params.email);\n    }\n    throw error;\n  }\n}\n\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  const rows = await db()\n    .insert(users)\n    .values({\n      email: params.email,\n      hashedPassword: null,\n      name: params.name ?? null,\n      emailVerifiedAt: new Date(),\n    })\n    .onConflictDoNothing({target: users.email})\n    .returning();\n\n  const row = rows[0];\n  if (row) return toUser(row);\n\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) return existing;\n  throw new Error('Provisioning user conflict returned no user');\n}\n\nexport async function findUserByEmail(params: {email: string}): Promise<User | undefined> {\n  const rows = await db().select().from(users).where(eq(users.email, params.email)).limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport async function findUserById(params: {id: string}): Promise<User | undefined> {\n  const rows = await db().select().from(users).where(eq(users.id, params.id)).limit(1);\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport interface UpdateUserPasswordParams {\n  userId: string;\n  hashedPassword: string;\n}\n\nexport async function updateUserPassword(\n  params: UpdateUserPasswordParams,\n): Promise<User | undefined> {\n  const rows = await db()\n    .update(users)\n    .set({\n      hashedPassword: params.hashedPassword,\n      updatedAt: new Date(),\n    })\n    .where(eq(users.id, params.userId))\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n\nexport async function markEmailVerified(params: {userId: string}): Promise<User | undefined> {\n  const rows = await db()\n    .update(users)\n    .set({emailVerifiedAt: new Date(), updatedAt: new Date()})\n    .where(eq(users.id, params.userId))\n    .returning();\n\n  const row = rows[0];\n  if (!row) return undefined;\n  return toUser(row);\n}\n"],"names":["AUTH_USER_SIGNED_UP","writeOutboxEvent","eq","EmailTakenError","db","authOutbox","toUser","users","isAuthUsersEmailUniqueViolation","error","current","depth","code","constraint","cause","createUser","params","transaction","tx","rows","insert","values","email","hashedPassword","name","emailVerifiedAt","returning","row","Error","user","signedUp","type","payload","userId","id","viaInvitation","provisionUser","Date","onConflictDoNothing","target","existing","findUserByEmail","select","from","where","limit","undefined","findUserById","updateUserPassword","update","set","updatedAt","markEmailVerified"],"mappings":"AAAA,SAAQA,mBAAmB,QAA0B,wBAAwB;AAC7E,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,EAAE,QAAO,cAAc;AAE/B,SAAQC,eAAe,QAAO,kBAAkB;AAChD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,MAAM,EAAeC,KAAK,QAAO,oBAAoB;AAe7D,0EAA0E;AAC1E,SAASC,gCAAgCC,KAAc;IACrD,IAAIC,UAAmBD;IACvB,IAAK,IAAIE,QAAQ,GAAGA,QAAQ,KAAKD,WAAW,MAAMC,SAAS,EAAG;QAC5D,IAAI,OAAOD,YAAY,UAAU,OAAO;QACxC,MAAM,EAACE,IAAI,EAAEC,UAAU,EAAC,GAAGH;QAC3B,IAAIE,SAAS,WAAWC,eAAe,2BAA2B,OAAO;QACzEH,UAAU,AAACA,QAA8BI,KAAK;IAChD;IACA,OAAO;AACT;AAEA,OAAO,eAAeC,WAAWC,MAAwB;IACvD,IAAI;QACF,OAAO,MAAMZ,KAAKa,WAAW,CAAC,OAAOC;YACnC,MAAMC,OAAiB,MAAMD,GAC1BE,MAAM,CAACb,OACPc,MAAM,CAAC;gBACNC,OAAON,OAAOM,KAAK;gBACnBC,gBAAgBP,OAAOO,cAAc;gBACrCC,MAAMR,OAAOQ,IAAI,IAAI;gBACrBC,iBAAiBT,OAAOS,eAAe,IAAI;YAC7C,GACCC,SAAS;YAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;YACnB,IAAI,CAACQ,KAAK,MAAM,IAAIC,MAAM;YAE1B,MAAMC,OAAOvB,OAAOqB;YACpB,IAAIX,OAAOc,QAAQ,EAAE;gBACnB,MAAM7B,iBAA+BiB,IAAIb,YAAY;oBACnD0B,MAAM/B;oBACNgC,SAAS;wBACPC,QAAQJ,KAAKK,EAAE;wBACfZ,OAAOO,KAAKP,KAAK;wBACjB,GAAIO,KAAKL,IAAI,GAAG;4BAACA,MAAMK,KAAKL,IAAI;wBAAA,IAAI,CAAC,CAAC;wBACtCW,eAAenB,OAAOc,QAAQ,CAACK,aAAa;oBAC9C;gBACF;YACF;YACA,OAAON;QACT;IACF,EAAE,OAAOpB,OAAO;QACd,IAAID,gCAAgCC,QAAQ;YAC1C,MAAM,IAAIN,gBAAgBa,OAAOM,KAAK;QACxC;QACA,MAAMb;IACR;AACF;AAEA,OAAO,eAAe2B,cAAcpB,MAA2B;IAC7D,MAAMG,OAAO,MAAMf,KAChBgB,MAAM,CAACb,OACPc,MAAM,CAAC;QACNC,OAAON,OAAOM,KAAK;QACnBC,gBAAgB;QAChBC,MAAMR,OAAOQ,IAAI,IAAI;QACrBC,iBAAiB,IAAIY;IACvB,GACCC,mBAAmB,CAAC;QAACC,QAAQhC,MAAMe,KAAK;IAAA,GACxCI,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAIQ,KAAK,OAAOrB,OAAOqB;IAEvB,MAAMa,WAAW,MAAMC,gBAAgB;QAACnB,OAAON,OAAOM,KAAK;IAAA;IAC3D,IAAIkB,UAAU,OAAOA;IACrB,MAAM,IAAIZ,MAAM;AAClB;AAEA,OAAO,eAAea,gBAAgBzB,MAAuB;IAC3D,MAAMG,OAAO,MAAMf,KAAKsC,MAAM,GAAGC,IAAI,CAACpC,OAAOqC,KAAK,CAAC1C,GAAGK,MAAMe,KAAK,EAAEN,OAAOM,KAAK,GAAGuB,KAAK,CAAC;IACxF,MAAMlB,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOmB;IACjB,OAAOxC,OAAOqB;AAChB;AAEA,OAAO,eAAeoB,aAAa/B,MAAoB;IACrD,MAAMG,OAAO,MAAMf,KAAKsC,MAAM,GAAGC,IAAI,CAACpC,OAAOqC,KAAK,CAAC1C,GAAGK,MAAM2B,EAAE,EAAElB,OAAOkB,EAAE,GAAGW,KAAK,CAAC;IAClF,MAAMlB,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOmB;IACjB,OAAOxC,OAAOqB;AAChB;AAOA,OAAO,eAAeqB,mBACpBhC,MAAgC;IAEhC,MAAMG,OAAO,MAAMf,KAChB6C,MAAM,CAAC1C,OACP2C,GAAG,CAAC;QACH3B,gBAAgBP,OAAOO,cAAc;QACrC4B,WAAW,IAAId;IACjB,GACCO,KAAK,CAAC1C,GAAGK,MAAM2B,EAAE,EAAElB,OAAOiB,MAAM,GAChCP,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOmB;IACjB,OAAOxC,OAAOqB;AAChB;AAEA,OAAO,eAAeyB,kBAAkBpC,MAAwB;IAC9D,MAAMG,OAAO,MAAMf,KAChB6C,MAAM,CAAC1C,OACP2C,GAAG,CAAC;QAACzB,iBAAiB,IAAIY;QAAQc,WAAW,IAAId;IAAM,GACvDO,KAAK,CAAC1C,GAAGK,MAAM2B,EAAE,EAAElB,OAAOiB,MAAM,GAChCP,SAAS;IAEZ,MAAMC,MAAMR,IAAI,CAAC,EAAE;IACnB,IAAI,CAACQ,KAAK,OAAOmB;IACjB,OAAOxC,OAAOqB;AAChB"}

package/dist/index.d.ts

@@ -2,6 +2,8 @@ import type { ShipfoxModule } from '@shipfox/node-module';
 export type { JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export type { CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
+export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';
+export { findUserByEmail } from '#core/email-owner.js';
 export type { User, UserStatus } from '#core/entities/user.js';
 export { AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
@@ -10,5 +12,7 @@ export { createJwtAuthMethod } from '#presentation/auth/jwt-auth.js';
 export { createLeaseTokenAuthMethod } from '#presentation/auth/lease-token-auth.js';
 export { authCookiePlugin, clearRefreshTokenCookie, getRefreshTokenCookie, setRefreshTokenCookie, } from '#presentation/auth/refresh-cookie.js';
 export { createRunnerSessionAuthMethod } from '#presentation/auth/runner-session-auth.js';
-export declare const authModule: ShipfoxModule;
+export declare function createAuthModule({ workspaces, }: {
+    workspaces: import('@shipfox/api-workspaces-dto/inter-module').WorkspacesInterModuleClient;
+}): ShipfoxModule;
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAiBxD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,mBAAmB,EAAC,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,eAAO,MAAM,UAAU,EAAE,aAYxB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAexD,YAAY,EAAC,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACzF,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EAAC,mBAAmB,EAAC,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,GACX,EAAE;IACD,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;CAC5F,GAAG,aAAa,CAYhB"}