@shipfox/api-auth 9.1.0 → 9.2.0

package/dist/core/auth.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["import {emailSchema} from '@shipfox/api-auth-dto';\nimport {\n  confirmEmailChallenge,\n  consumeEmailChallengeProof,\n  createEmailChallenge,\n  resendEmailChallenge,\n} from '@shipfox/api-email-challenges';\nimport {\n  type WorkspacesInterModuleClient,\n  workspacesInterModuleContract,\n} from '@shipfox/api-workspaces-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';\nimport {\n  createRefreshToken,\n  findActiveRefreshTokenByHash,\n  findRefreshTokenByHash,\n  revokeRefreshSession,\n  revokeRefreshTokensForUser,\n  rotateRefreshToken,\n} from '#db/refresh-tokens.js';\nimport {\n  createUser as createDbUser,\n  findUserByEmail,\n  findUserById,\n  markEmailVerified,\n  provisionUser as provisionDbUser,\n  updateUserPassword,\n} from '#db/users.js';\nimport {type AuthTokenRefreshOutcome, recordTokenRefreshed} from '#metrics/index.js';\nimport type {RefreshToken} from './entities/refresh-token.js';\nimport type {User} from './entities/user.js';\nimport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  EmailTakenError,\n  InvalidCredentialsError,\n  InvitationEmailMismatchError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n  UserNotFoundError,\n} from './errors.js';\nimport {signUserToken} from './jwt.js';\nimport {hashPassword, verifyPassword} from './password.js';\n\nconst RESET_TTL_HOURS = 1;\nconst PASSWORD_VERIFICATION_PURPOSE = 'password-verification';\n\nlet dummyHashCache: string | undefined;\nasync function getDummyHash(): Promise<string> {\n  if (!dummyHashCache) {\n    dummyHashCache = await hashPassword({password: 'dummy-for-timing-parity'});\n  }\n  return dummyHashCache;\n}\n\nfunction hoursFromNow(hours: number): Date {\n  return new Date(Date.now() + hours * 60 * 60 * 1000);\n}\n\nfunction daysFromNow(days: number): Date {\n  return new Date(Date.now() + days * 24 * 60 * 60 * 1000);\n}\n\nfunction recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {\n  recordTokenRefreshed(outcome);\n}\n\nasync function signAccessToken(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n  refreshSessionId: string,\n): Promise<string> {\n  const memberships = await workspaces\n    .listMembershipsForTokenClaims({userId: user.id})\n    .catch((error: unknown) => {\n      throw new AuthDependencyUnavailableError('workspaces', error);\n    });\n  return await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships: memberships.memberships,\n    refreshSessionId,\n    secret: userAccessTokenKey(),\n    expiresIn: config.AUTH_JWT_EXPIRES_IN,\n  });\n}\n\nfunction isWithinRotationGrace(refreshToken: RefreshToken): boolean {\n  if (!refreshToken.rotatedAt) return false;\n  const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;\n  return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;\n}\n\nasync function createRefreshSession(\n  user: User,\n  refreshSessionId: string,\n): Promise<{refreshToken: string; refreshSessionId: string}> {\n  const refreshToken = generateOpaqueToken('refreshToken');\n  const session = await createRefreshToken({\n    sessionId: refreshSessionId,\n    userId: user.id,\n    hashedToken: hashOpaqueToken(refreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  return {refreshToken, refreshSessionId: session.sessionId};\n}\n\nasync function createSessionTokens(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<{token: string; refreshToken: string}> {\n  const refreshSessionId = crypto.randomUUID();\n  const token = await signAccessToken(user, workspaces, refreshSessionId);\n  const {refreshToken} = await createRefreshSession(user, refreshSessionId);\n  return {token, refreshToken};\n}\n\nfunction passwordResetLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;\n}\n\nfunction invitationErrorFromKnownError(\n  error: unknown,\n  method: 'preflightInvitationAcceptance' | 'acceptInvitation',\n): Error {\n  const contractMethod = workspacesInterModuleContract.methods[method];\n  if (!isInterModuleKnownError(contractMethod, error)) return error as Error;\n\n  if (error.code === 'invitation-token-invalid')\n    return new TokenInvalidError('Invitation token is invalid');\n  if (error.code === 'invitation-token-used') return new TokenAlreadyUsedError();\n  if (error.code === 'invitation-token-expired') return new TokenExpiredError();\n  return new InvitationEmailMismatchError();\n}\n\nfunction invitationErrorMessage(\n  code:\n    | 'invitation-token-invalid'\n    | 'invitation-token-used'\n    | 'invitation-token-expired'\n    | 'invitation-email-mismatch',\n): string {\n  if (code === 'invitation-token-invalid') return 'Invitation token is invalid';\n  if (code === 'invitation-token-used') return 'Invitation has already been accepted';\n  if (code === 'invitation-token-expired') return 'Invitation has expired';\n  return 'Signup email does not match the invitation';\n}\n\nexport interface SignupParams {\n  email: string;\n  password: string;\n  name?: string | undefined;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null | undefined;\n}\n\n/**\n * Creates a verified, password-less user for an external identity provider.\n * Existing users are returned unchanged, including their password and profile.\n */\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  return await provisionDbUser({\n    email: emailSchema.parse(params.email),\n    name: params.name ?? null,\n  });\n}\n\nexport type SignupResult = User & {\n  emailChallenge: {id: string; nextResendAvailableAt: Date};\n};\n\nexport async function signup(params: SignupParams & {sourceIp?: string}): Promise<SignupResult> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    const canResumeVerification =\n      existing.status === 'active' &&\n      existing.emailVerifiedAt === null &&\n      existing.hashedPassword !== null &&\n      (await verifyPassword({password: params.password, hash: existing.hashedPassword}));\n    if (canResumeVerification) {\n      const emailChallenge = await createEmailChallenge({\n        email: existing.email,\n        purpose: PASSWORD_VERIFICATION_PURPOSE,\n        continuation: existing.id,\n        idempotencyKey: existing.id,\n        sourceIp: params.sourceIp ?? '0.0.0.0',\n      });\n      return {...existing, emailChallenge};\n    }\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    signedUp: {viaInvitation: false},\n  });\n\n  const emailChallenge = await createEmailChallenge({\n    email: user.email,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n    idempotencyKey: user.id,\n    sourceIp: params.sourceIp ?? '0.0.0.0',\n  });\n\n  return {...user, emailChallenge};\n}\n\nexport interface SignupWithInvitationParams extends SignupParams {\n  invitationToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface SignupWithInvitationResult extends LoginResult {\n  membership: {id: string; userId: string; workspaceId: string} | null;\n  acceptError?: {code: string; message: string};\n}\n\nexport async function signupWithInvitation(\n  params: SignupWithInvitationParams,\n): Promise<SignupWithInvitationResult> {\n  // Step 1: Pre-validate the invitation BEFORE any user write so an invalid\n  // token never produces an orphan user. Re-validation happens again inside\n  // acceptWorkspaceInvitation (race-safe) after the user is created.\n  try {\n    await params.workspaces.preflightInvitationAcceptance({\n      token: params.invitationToken,\n      email: params.email,\n    });\n  } catch (error) {\n    throw invitationErrorFromKnownError(error, 'preflightInvitationAcceptance');\n  }\n\n  // Step 2: Create the user as verified. The invitation email is the proof of\n  // ownership, and this avoids a second auth-table write just to mark verified.\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: new Date(),\n    signedUp: {viaInvitation: true},\n  });\n\n  // Step 3: Accept the invitation through the workspaces module boundary.\n  // This is intentionally not one database transaction with auth; treat it like\n  // calling another service. If it fails after user creation, return a verified\n  // signed-in user and an explicit retryable accept error.\n  let membership: SignupWithInvitationResult['membership'] = null;\n  let acceptError: SignupWithInvitationResult['acceptError'];\n  try {\n    const result = await params.workspaces.acceptInvitation({\n      token: params.invitationToken,\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n    });\n    membership = {\n      id: result.membership.id,\n      userId: result.membership.userId,\n      workspaceId: result.membership.workspaceId,\n    };\n  } catch (error) {\n    if (isInterModuleKnownError(workspacesInterModuleContract.methods.acceptInvitation, error)) {\n      acceptError = {code: error.code, message: invitationErrorMessage(error.code)};\n    } else {\n      acceptError = {\n        code: 'AcceptFailed',\n        message: 'Could not accept the invitation; please retry from the invite link.',\n      };\n    }\n  }\n\n  // Step 4: Issue session. signAccessToken reads memberships through the\n  // workspaces module API, so a successful accept is reflected in the JWT.\n  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);\n\n  if (acceptError) {\n    return {token, refreshToken, user, membership, acceptError};\n  }\n  return {token, refreshToken, user, membership};\n}\n\nexport interface CreateUserParams extends SignupParams {\n  verified: boolean;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: params.verified ? new Date() : null,\n  });\n\n  return user;\n}\n\nexport interface LoginParams {\n  email: string;\n  password: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface LoginResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport async function login(params: LoginParams): Promise<LoginResult> {\n  const user = await findUserByEmail({email: params.email});\n\n  if (!user) {\n    await verifyPassword({password: params.password, hash: await getDummyHash()});\n    throw new InvalidCredentialsError();\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.password,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok || user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n\n  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user};\n}\n\nexport interface CreateSessionForUserParams {\n  userId?: string | undefined;\n  email?: string | undefined;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface CreateSessionForUserResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport type CreateSessionForUserError =\n  | AuthDependencyUnavailableError\n  | EmailNotVerifiedError\n  | InvalidCredentialsError\n  | UserNotFoundError;\n\nexport async function createSessionForUser(\n  params: CreateSessionForUserParams,\n): Promise<CreateSessionForUserResult> {\n  const user = params.userId\n    ? await findUserById({id: params.userId})\n    : params.email\n      ? await findUserByEmail({email: emailSchema.parse(params.email)})\n      : undefined;\n\n  if (!user) {\n    throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user};\n}\n\nexport interface RefreshAccessTokenResult {\n  token: string;\n  /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */\n  refreshToken: string | undefined;\n  user: User;\n}\n\nexport async function refreshAccessToken(params: {\n  refreshToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<RefreshAccessTokenResult> {\n  const currentHashedToken = hashOpaqueToken(params.refreshToken);\n  const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n  if (!current) {\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  const user = await findUserById({id: current.userId});\n  if (user?.status !== 'active') {\n    await revokeRefreshSession({sessionId: current.sessionId, userId: current.userId});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  // Within the grace window a rotated token means a concurrent refresh (e.g. a\n  // second tab); past it, reuse of a retired token means a compromised session.\n  if (current.rotatedAt) {\n    if (isWithinRotationGrace(current)) {\n      const token = await signAccessToken(user, params.workspaces, current.sessionId);\n      recordRefreshOutcome('grace');\n      return {token, refreshToken: undefined, user};\n    }\n    await revokeRefreshTokensForUser({userId: user.id});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token reused after rotation');\n  }\n\n  // Losing the CAS requires a state check: another request may have rotated,\n  // revoked, or expired the token before this refresh could claim it.\n  const nextRefreshToken = generateOpaqueToken('refreshToken');\n  const rotated = await rotateRefreshToken({\n    id: current.id,\n    currentHashedToken,\n    nextHashedToken: hashOpaqueToken(nextRefreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!rotated) {\n    const latest = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n    if (!latest || !isWithinRotationGrace(latest)) {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const token = await signAccessToken(user, params.workspaces, latest.sessionId);\n    recordRefreshOutcome('grace');\n    return {token, refreshToken: undefined, user};\n  }\n\n  const token = await signAccessToken(user, params.workspaces, current.sessionId);\n  recordRefreshOutcome('rotated');\n  return {token, refreshToken: nextRefreshToken, user};\n}\n\nexport interface ConfirmEmailVerificationResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport interface ResendEmailVerificationResult {\n  nextResendAvailableAt: Date;\n}\n\nexport async function confirmEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  code: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user) throw new TokenInvalidError('Verification code is invalid or expired');\n  await confirmEmailChallenge({id: params.challengeId, code: params.code, continuation: user.id});\n  await consumeEmailChallengeProof({\n    id: params.challengeId,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n  });\n\n  const verifiedUser = await markEmailVerified({userId: user.id});\n  if (verifiedUser?.status !== 'active') {\n    throw new TokenInvalidError('Verification code is invalid or expired');\n  }\n\n  const {token, refreshToken} = await createSessionTokens(verifiedUser, params.workspaces);\n\n  return {token, refreshToken, user: verifiedUser};\n}\n\nexport async function resendEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  sourceIp: string;\n}): Promise<ResendEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user || user.emailVerifiedAt || user.status !== 'active') {\n    return {nextResendAvailableAt: new Date()};\n  }\n  const result = await resendEmailChallenge({\n    id: params.challengeId,\n    continuation: user.id,\n    sourceIp: params.sourceIp,\n  });\n\n  return {nextResendAvailableAt: result.nextResendAvailableAt};\n}\n\nexport async function requestPasswordReset(params: {email: string}): Promise<void> {\n  const user = await findUserByEmail({email: params.email});\n  if (user?.status !== 'active' || user.hashedPassword === null) {\n    return;\n  }\n\n  const rawToken = generateOpaqueToken('passwordReset');\n  await createPasswordReset({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(RESET_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      resetLink: passwordResetLink(rawToken),\n      expiresInHours: RESET_TTL_HOURS,\n    },\n  });\n}\n\nexport interface ConfirmPasswordResetResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n}\n\nexport async function confirmPasswordReset(params: {\n  token: string;\n  newPassword: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmPasswordResetResult> {\n  const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const existingUser = await findUserById({id: consumed.userId});\n  if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const user = await updateUserPassword({userId: consumed.userId, hashedPassword});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  await revokeRefreshTokensForUser({userId: consumed.userId});\n\n  const {token, refreshToken} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user};\n}\n\nexport async function changePassword(params: {\n  userId: string;\n  currentPassword: string;\n  newPassword: string;\n  refreshToken?: string | undefined;\n}): Promise<void> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.currentPassword,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok) {\n    throw new InvalidCredentialsError();\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const currentRefreshSession = params.refreshToken\n    ? await findActiveRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)})\n    : undefined;\n  const exceptRefreshTokenId =\n    currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;\n\n  await updateUserPassword({userId: user.id, hashedPassword});\n  await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId});\n}\n\nexport async function logout(params: {refreshToken?: string | undefined}): Promise<void> {\n  if (!params.refreshToken) return;\n  const refreshToken = await findRefreshTokenByHash({\n    hashedToken: hashOpaqueToken(params.refreshToken),\n  });\n  if (!refreshToken) return;\n  await revokeRefreshSession({sessionId: refreshToken.sessionId, userId: refreshToken.userId});\n}\n\nexport interface GetCurrentUserResult {\n  user: User;\n}\n\nexport async function getCurrentUser(params: {userId: string}): Promise<GetCurrentUserResult> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  return {user};\n}\n"],"names":["emailSchema","confirmEmailChallenge","consumeEmailChallengeProof","createEmailChallenge","resendEmailChallenge","workspacesInterModuleContract","isInterModuleKnownError","userAccessTokenKey","generateOpaqueToken","hashOpaqueToken","config","consumePasswordReset","createPasswordReset","createRefreshToken","findActiveRefreshTokenByHash","findRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","rotateRefreshToken","createUser","createDbUser","findUserByEmail","findUserById","markEmailVerified","provisionUser","provisionDbUser","updateUserPassword","recordTokenRefreshed","AuthDependencyUnavailableError","EmailNotVerifiedError","EmailTakenError","InvalidCredentialsError","InvitationEmailMismatchError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","UserNotFoundError","signUserToken","hashPassword","verifyPassword","RESET_TTL_HOURS","PASSWORD_VERIFICATION_PURPOSE","dummyHashCache","getDummyHash","password","hoursFromNow","hours","Date","now","daysFromNow","days","recordRefreshOutcome","outcome","signAccessToken","user","workspaces","refreshSessionId","memberships","listMembershipsForTokenClaims","userId","id","catch","error","email","name","secret","expiresIn","AUTH_JWT_EXPIRES_IN","isWithinRotationGrace","refreshToken","rotatedAt","graceMs","AUTH_REFRESH_ROTATION_GRACE_SECONDS","getTime","createRefreshSession","session","sessionId","hashedToken","expiresAt","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","createSessionTokens","crypto","randomUUID","token","passwordResetLink","rawToken","CLIENT_BASE_URL","invitationErrorFromKnownError","method","contractMethod","methods","code","invitationErrorMessage","params","parse","signup","existing","canResumeVerification","status","emailVerifiedAt","hashedPassword","hash","emailChallenge","purpose","continuation","idempotencyKey","sourceIp","signedUp","viaInvitation","signupWithInvitation","preflightInvitationAcceptance","invitationToken","membership","acceptError","result","acceptInvitation","workspaceId","message","verified","login","hasPassword","ok","createSessionForUser","undefined","refreshAccessToken","currentHashedToken","current","nextRefreshToken","rotated","nextHashedToken","latest","confirmEmailVerification","challengeId","verifiedUser","resendEmailVerification","nextResendAvailableAt","requestPasswordReset","sendEmail","resetLink","expiresInHours","confirmPasswordReset","consumed","existingUser","newPassword","changePassword","currentPassword","currentRefreshSession","exceptRefreshTokenId","logout","getCurrentUser"],"mappings":"AAAA,SAAQA,WAAW,QAAO,wBAAwB;AAClD,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,oBAAoB,EACpBC,oBAAoB,QACf,gCAAgC;AACvC,SAEEC,6BAA6B,QACxB,2CAA2C;AAClD,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAQC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAC1E,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,mBAAmB,QAAO,yBAAyB;AACjF,SACEC,kBAAkB,EAClBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,QACb,wBAAwB;AAC/B,SACEC,cAAcC,YAAY,EAC1BC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiBC,eAAe,EAChCC,kBAAkB,QACb,eAAe;AACtB,SAAsCC,oBAAoB,QAAO,oBAAoB;AAGrF,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,eAAe,EACfC,uBAAuB,EACvBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,QACZ,cAAc;AACrB,SAAQC,aAAa,QAAO,WAAW;AACvC,SAAQC,YAAY,EAAEC,cAAc,QAAO,gBAAgB;AAE3D,MAAMC,kBAAkB;AACxB,MAAMC,gCAAgC;AAEtC,IAAIC;AACJ,eAAeC;IACb,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,MAAMJ,aAAa;YAACM,UAAU;QAAyB;IAC1E;IACA,OAAOF;AACT;AAEA,SAASG,aAAaC,KAAa;IACjC,OAAO,IAAIC,KAAKA,KAAKC,GAAG,KAAKF,QAAQ,KAAK,KAAK;AACjD;AAEA,SAASG,YAAYC,IAAY;IAC/B,OAAO,IAAIH,KAAKA,KAAKC,GAAG,KAAKE,OAAO,KAAK,KAAK,KAAK;AACrD;AAEA,SAASC,qBAAqBC,OAAgC;IAC5DzB,qBAAqByB;AACvB;AAEA,eAAeC,gBACbC,IAAU,EACVC,UAAuC,EACvCC,gBAAwB;IAExB,MAAMC,cAAc,MAAMF,WACvBG,6BAA6B,CAAC;QAACC,QAAQL,KAAKM,EAAE;IAAA,GAC9CC,KAAK,CAAC,CAACC;QACN,MAAM,IAAIlC,+BAA+B,cAAckC;IACzD;IACF,OAAO,MAAMzB,cAAc;QACzBsB,QAAQL,KAAKM,EAAE;QACfG,OAAOT,KAAKS,KAAK;QACjBC,MAAMV,KAAKU,IAAI;QACfP,aAAaA,YAAYA,WAAW;QACpCD;QACAS,QAAQ1D;QACR2D,WAAWxD,OAAOyD,mBAAmB;IACvC;AACF;AAEA,SAASC,sBAAsBC,YAA0B;IACvD,IAAI,CAACA,aAAaC,SAAS,EAAE,OAAO;IACpC,MAAMC,UAAU7D,OAAO8D,mCAAmC,GAAG;IAC7D,OAAOzB,KAAKC,GAAG,KAAKqB,aAAaC,SAAS,CAACG,OAAO,MAAMF;AAC1D;AAEA,eAAeG,qBACbpB,IAAU,EACVE,gBAAwB;IAExB,MAAMa,eAAe7D,oBAAoB;IACzC,MAAMmE,UAAU,MAAM9D,mBAAmB;QACvC+D,WAAWpB;QACXG,QAAQL,KAAKM,EAAE;QACfiB,aAAapE,gBAAgB4D;QAC7BS,WAAW7B,YAAYvC,OAAOqE,kCAAkC;IAClE;IACA,OAAO;QAACV;QAAcb,kBAAkBmB,QAAQC,SAAS;IAAA;AAC3D;AAEA,eAAeI,oBACb1B,IAAU,EACVC,UAAuC;IAEvC,MAAMC,mBAAmByB,OAAOC,UAAU;IAC1C,MAAMC,QAAQ,MAAM9B,gBAAgBC,MAAMC,YAAYC;IACtD,MAAM,EAACa,YAAY,EAAC,GAAG,MAAMK,qBAAqBpB,MAAME;IACxD,OAAO;QAAC2B;QAAOd;IAAY;AAC7B;AAEA,SAASe,kBAAkBC,QAAgB;IACzC,OAAO,GAAG3E,OAAO4E,eAAe,CAAC,kBAAkB,EAAED,UAAU;AACjE;AAEA,SAASE,8BACPzB,KAAc,EACd0B,MAA4D;IAE5D,MAAMC,iBAAiBpF,8BAA8BqF,OAAO,CAACF,OAAO;IACpE,IAAI,CAAClF,wBAAwBmF,gBAAgB3B,QAAQ,OAAOA;IAE5D,IAAIA,MAAM6B,IAAI,KAAK,4BACjB,OAAO,IAAIxD,kBAAkB;IAC/B,IAAI2B,MAAM6B,IAAI,KAAK,yBAAyB,OAAO,IAAI1D;IACvD,IAAI6B,MAAM6B,IAAI,KAAK,4BAA4B,OAAO,IAAIzD;IAC1D,OAAO,IAAIF;AACb;AAEA,SAAS4D,uBACPD,IAI+B;IAE/B,IAAIA,SAAS,4BAA4B,OAAO;IAChD,IAAIA,SAAS,yBAAyB,OAAO;IAC7C,IAAIA,SAAS,4BAA4B,OAAO;IAChD,OAAO;AACT;AAaA;;;CAGC,GACD,OAAO,eAAenE,cAAcqE,MAA2B;IAC7D,OAAO,MAAMpE,gBAAgB;QAC3BsC,OAAO/D,YAAY8F,KAAK,CAACD,OAAO9B,KAAK;QACrCC,MAAM6B,OAAO7B,IAAI,IAAI;IACvB;AACF;AAMA,OAAO,eAAe+B,OAAOF,MAA0C;IACrE,MAAMG,WAAW,MAAM3E,gBAAgB;QAAC0C,OAAO8B,OAAO9B,KAAK;IAAA;IAC3D,IAAIiC,UAAU;QACZ,MAAMC,wBACJD,SAASE,MAAM,KAAK,YACpBF,SAASG,eAAe,KAAK,QAC7BH,SAASI,cAAc,KAAK,QAC3B,MAAM7D,eAAe;YAACK,UAAUiD,OAAOjD,QAAQ;YAAEyD,MAAML,SAASI,cAAc;QAAA;QACjF,IAAIH,uBAAuB;YACzB,MAAMK,iBAAiB,MAAMnG,qBAAqB;gBAChD4D,OAAOiC,SAASjC,KAAK;gBACrBwC,SAAS9D;gBACT+D,cAAcR,SAASpC,EAAE;gBACzB6C,gBAAgBT,SAASpC,EAAE;gBAC3B8C,UAAUb,OAAOa,QAAQ,IAAI;YAC/B;YACA,OAAO;gBAAC,GAAGV,QAAQ;gBAAEM;YAAc;QACrC;QACA,MAAM,IAAIxE,gBAAgB+D,OAAO9B,KAAK;IACxC;IAEA,MAAMqC,iBAAiB,MAAM9D,aAAa;QAACM,UAAUiD,OAAOjD,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMlC,aAAa;QAC9B2C,OAAO8B,OAAO9B,KAAK;QACnBqC;QACApC,MAAM6B,OAAO7B,IAAI,IAAI;QACrB2C,UAAU;YAACC,eAAe;QAAK;IACjC;IAEA,MAAMN,iBAAiB,MAAMnG,qBAAqB;QAChD4D,OAAOT,KAAKS,KAAK;QACjBwC,SAAS9D;QACT+D,cAAclD,KAAKM,EAAE;QACrB6C,gBAAgBnD,KAAKM,EAAE;QACvB8C,UAAUb,OAAOa,QAAQ,IAAI;IAC/B;IAEA,OAAO;QAAC,GAAGpD,IAAI;QAAEgD;IAAc;AACjC;AAYA,OAAO,eAAeO,qBACpBhB,MAAkC;IAElC,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI;QACF,MAAMA,OAAOtC,UAAU,CAACuD,6BAA6B,CAAC;YACpD3B,OAAOU,OAAOkB,eAAe;YAC7BhD,OAAO8B,OAAO9B,KAAK;QACrB;IACF,EAAE,OAAOD,OAAO;QACd,MAAMyB,8BAA8BzB,OAAO;IAC7C;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMkC,WAAW,MAAM3E,gBAAgB;QAAC0C,OAAO8B,OAAO9B,KAAK;IAAA;IAC3D,IAAIiC,UAAU;QACZ,MAAM,IAAIlE,gBAAgB+D,OAAO9B,KAAK;IACxC;IACA,MAAMqC,iBAAiB,MAAM9D,aAAa;QAACM,UAAUiD,OAAOjD,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMlC,aAAa;QAC9B2C,OAAO8B,OAAO9B,KAAK;QACnBqC;QACApC,MAAM6B,OAAO7B,IAAI,IAAI;QACrBmC,iBAAiB,IAAIpD;QACrB4D,UAAU;YAACC,eAAe;QAAI;IAChC;IAEA,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAII,aAAuD;IAC3D,IAAIC;IACJ,IAAI;QACF,MAAMC,SAAS,MAAMrB,OAAOtC,UAAU,CAAC4D,gBAAgB,CAAC;YACtDhC,OAAOU,OAAOkB,eAAe;YAC7BpD,QAAQL,KAAKM,EAAE;YACfG,OAAOT,KAAKS,KAAK;YACjBC,MAAMV,KAAKU,IAAI;QACjB;QACAgD,aAAa;YACXpD,IAAIsD,OAAOF,UAAU,CAACpD,EAAE;YACxBD,QAAQuD,OAAOF,UAAU,CAACrD,MAAM;YAChCyD,aAAaF,OAAOF,UAAU,CAACI,WAAW;QAC5C;IACF,EAAE,OAAOtD,OAAO;QACd,IAAIxD,wBAAwBD,8BAA8BqF,OAAO,CAACyB,gBAAgB,EAAErD,QAAQ;YAC1FmD,cAAc;gBAACtB,MAAM7B,MAAM6B,IAAI;gBAAE0B,SAASzB,uBAAuB9B,MAAM6B,IAAI;YAAC;QAC9E,OAAO;YACLsB,cAAc;gBACZtB,MAAM;gBACN0B,SAAS;YACX;QACF;IACF;IAEA,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,EAAClC,KAAK,EAAEd,YAAY,EAAC,GAAG,MAAMW,oBAAoB1B,MAAMuC,OAAOtC,UAAU;IAE/E,IAAI0D,aAAa;QACf,OAAO;YAAC9B;YAAOd;YAAcf;YAAM0D;YAAYC;QAAW;IAC5D;IACA,OAAO;QAAC9B;QAAOd;QAAcf;QAAM0D;IAAU;AAC/C;AAMA,OAAO,eAAe7F,WAAW0E,MAAwB;IACvD,MAAMG,WAAW,MAAM3E,gBAAgB;QAAC0C,OAAO8B,OAAO9B,KAAK;IAAA;IAC3D,IAAIiC,UAAU;QACZ,MAAM,IAAIlE,gBAAgB+D,OAAO9B,KAAK;IACxC;IAEA,MAAMqC,iBAAiB,MAAM9D,aAAa;QAACM,UAAUiD,OAAOjD,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMlC,aAAa;QAC9B2C,OAAO8B,OAAO9B,KAAK;QACnBqC;QACApC,MAAM6B,OAAO7B,IAAI,IAAI;QACrBmC,iBAAiBN,OAAOyB,QAAQ,GAAG,IAAIvE,SAAS;IAClD;IAEA,OAAOO;AACT;AAcA,OAAO,eAAeiE,MAAM1B,MAAmB;IAC7C,MAAMvC,OAAO,MAAMjC,gBAAgB;QAAC0C,OAAO8B,OAAO9B,KAAK;IAAA;IAEvD,IAAI,CAACT,MAAM;QACT,MAAMf,eAAe;YAACK,UAAUiD,OAAOjD,QAAQ;YAAEyD,MAAM,MAAM1D;QAAc;QAC3E,MAAM,IAAIZ;IACZ;IAEA,MAAMyF,cAAclE,KAAK8C,cAAc,KAAK;IAC5C,MAAMqB,KAAK,MAAMlF,eAAe;QAC9BK,UAAUiD,OAAOjD,QAAQ;QACzByD,MAAM/C,KAAK8C,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC6E,eAAe,CAACC,MAAMnE,KAAK4C,MAAM,KAAK,UAAU;QACnD,MAAM,IAAInE;IACZ;IAEA,IAAIuB,KAAK6C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAItE;IACZ;IAEA,MAAM,EAACsD,KAAK,EAAEd,YAAY,EAAC,GAAG,MAAMW,oBAAoB1B,MAAMuC,OAAOtC,UAAU;IAE/E,OAAO;QAAC4B;QAAOd;QAAcf;IAAI;AACnC;AAoBA,OAAO,eAAeoE,qBACpB7B,MAAkC;IAElC,MAAMvC,OAAOuC,OAAOlC,MAAM,GACtB,MAAMrC,aAAa;QAACsC,IAAIiC,OAAOlC,MAAM;IAAA,KACrCkC,OAAO9B,KAAK,GACV,MAAM1C,gBAAgB;QAAC0C,OAAO/D,YAAY8F,KAAK,CAACD,OAAO9B,KAAK;IAAC,KAC7D4D;IAEN,IAAI,CAACrE,MAAM;QACT,MAAM,IAAIlB,kBAAkByD,OAAOlC,MAAM,IAAIkC,OAAO9B,KAAK,IAAI;IAC/D;IACA,IAAIT,KAAK6C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAItE;IACZ;IACA,IAAIyB,KAAK4C,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAInE;IACZ;IAEA,MAAM,EAACoD,KAAK,EAAEd,YAAY,EAAC,GAAG,MAAMW,oBAAoB1B,MAAMuC,OAAOtC,UAAU;IAE/E,OAAO;QAAC4B;QAAOd;QAAcf;IAAI;AACnC;AASA,OAAO,eAAesE,mBAAmB/B,MAGxC;IACC,MAAMgC,qBAAqBpH,gBAAgBoF,OAAOxB,YAAY;IAC9D,MAAMyD,UAAU,MAAM/G,uBAAuB;QAAC8D,aAAagD;IAAkB;IAC7E,IAAI,CAACC,SAAS;QACZ3E,qBAAqB;QACrB,MAAM,IAAIhB,kBAAkB;IAC9B;IAEA,MAAMmB,OAAO,MAAMhC,aAAa;QAACsC,IAAIkE,QAAQnE,MAAM;IAAA;IACnD,IAAIL,MAAM4C,WAAW,UAAU;QAC7B,MAAMlF,qBAAqB;YAAC4D,WAAWkD,QAAQlD,SAAS;YAAEjB,QAAQmE,QAAQnE,MAAM;QAAA;QAChFR,qBAAqB;QACrB,MAAM,IAAIhB,kBAAkB;IAC9B;IAEA,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI2F,QAAQxD,SAAS,EAAE;QACrB,IAAIF,sBAAsB0D,UAAU;YAClC,MAAM3C,QAAQ,MAAM9B,gBAAgBC,MAAMuC,OAAOtC,UAAU,EAAEuE,QAAQlD,SAAS;YAC9EzB,qBAAqB;YACrB,OAAO;gBAACgC;gBAAOd,cAAcsD;gBAAWrE;YAAI;QAC9C;QACA,MAAMrC,2BAA2B;YAAC0C,QAAQL,KAAKM,EAAE;QAAA;QACjDT,qBAAqB;QACrB,MAAM,IAAIhB,kBAAkB;IAC9B;IAEA,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM4F,mBAAmBvH,oBAAoB;IAC7C,MAAMwH,UAAU,MAAM9G,mBAAmB;QACvC0C,IAAIkE,QAAQlE,EAAE;QACdiE;QACAI,iBAAiBxH,gBAAgBsH;QACjCjD,WAAW7B,YAAYvC,OAAOqE,kCAAkC;IAClE;IACA,IAAI,CAACiD,SAAS;QACZ,MAAME,SAAS,MAAMnH,uBAAuB;YAAC8D,aAAagD;QAAkB;QAC5E,IAAI,CAACK,UAAU,CAAC9D,sBAAsB8D,SAAS;YAC7C/E,qBAAqB;YACrB,MAAM,IAAIhB,kBAAkB;QAC9B;QACA,MAAMgD,QAAQ,MAAM9B,gBAAgBC,MAAMuC,OAAOtC,UAAU,EAAE2E,OAAOtD,SAAS;QAC7EzB,qBAAqB;QACrB,OAAO;YAACgC;YAAOd,cAAcsD;YAAWrE;QAAI;IAC9C;IAEA,MAAM6B,QAAQ,MAAM9B,gBAAgBC,MAAMuC,OAAOtC,UAAU,EAAEuE,QAAQlD,SAAS;IAC9EzB,qBAAqB;IACrB,OAAO;QAACgC;QAAOd,cAAc0D;QAAkBzE;IAAI;AACrD;AAYA,OAAO,eAAe6E,yBAAyBtC,MAK9C;IACC,MAAMvC,OAAO,MAAMjC,gBAAgB;QAAC0C,OAAO/D,YAAY8F,KAAK,CAACD,OAAO9B,KAAK;IAAC;IAC1E,IAAI,CAACT,MAAM,MAAM,IAAInB,kBAAkB;IACvC,MAAMlC,sBAAsB;QAAC2D,IAAIiC,OAAOuC,WAAW;QAAEzC,MAAME,OAAOF,IAAI;QAAEa,cAAclD,KAAKM,EAAE;IAAA;IAC7F,MAAM1D,2BAA2B;QAC/B0D,IAAIiC,OAAOuC,WAAW;QACtB7B,SAAS9D;QACT+D,cAAclD,KAAKM,EAAE;IACvB;IAEA,MAAMyE,eAAe,MAAM9G,kBAAkB;QAACoC,QAAQL,KAAKM,EAAE;IAAA;IAC7D,IAAIyE,cAAcnC,WAAW,UAAU;QACrC,MAAM,IAAI/D,kBAAkB;IAC9B;IAEA,MAAM,EAACgD,KAAK,EAAEd,YAAY,EAAC,GAAG,MAAMW,oBAAoBqD,cAAcxC,OAAOtC,UAAU;IAEvF,OAAO;QAAC4B;QAAOd;QAAcf,MAAM+E;IAAY;AACjD;AAEA,OAAO,eAAeC,wBAAwBzC,MAI7C;IACC,MAAMvC,OAAO,MAAMjC,gBAAgB;QAAC0C,OAAO/D,YAAY8F,KAAK,CAACD,OAAO9B,KAAK;IAAC;IAC1E,IAAI,CAACT,QAAQA,KAAK6C,eAAe,IAAI7C,KAAK4C,MAAM,KAAK,UAAU;QAC7D,OAAO;YAACqC,uBAAuB,IAAIxF;QAAM;IAC3C;IACA,MAAMmE,SAAS,MAAM9G,qBAAqB;QACxCwD,IAAIiC,OAAOuC,WAAW;QACtB5B,cAAclD,KAAKM,EAAE;QACrB8C,UAAUb,OAAOa,QAAQ;IAC3B;IAEA,OAAO;QAAC6B,uBAAuBrB,OAAOqB,qBAAqB;IAAA;AAC7D;AAEA,OAAO,eAAeC,qBAAqB3C,MAAuB;IAChE,MAAMvC,OAAO,MAAMjC,gBAAgB;QAAC0C,OAAO8B,OAAO9B,KAAK;IAAA;IACvD,IAAIT,MAAM4C,WAAW,YAAY5C,KAAK8C,cAAc,KAAK,MAAM;QAC7D;IACF;IAEA,MAAMf,WAAW7E,oBAAoB;IACrC,MAAMI,oBAAoB;QACxB+C,QAAQL,KAAKM,EAAE;QACfiB,aAAapE,gBAAgB4E;QAC7BP,WAAWjC,aAAaL;QACxBiG,WAAW;YACT1E,OAAOT,KAAKS,KAAK;YACjB2E,WAAWtD,kBAAkBC;YAC7BsD,gBAAgBnG;QAClB;IACF;AACF;AAQA,OAAO,eAAeoG,qBAAqB/C,MAI1C;IACC,MAAMgD,WAAW,MAAMlI,qBAAqB;QAACkE,aAAapE,gBAAgBoF,OAAOV,KAAK;IAAC;IACvF,IAAI,CAAC0D,UAAU;QACb,MAAM,IAAI1G,kBAAkB;IAC9B;IAEA,MAAM2G,eAAe,MAAMxH,aAAa;QAACsC,IAAIiF,SAASlF,MAAM;IAAA;IAC5D,IAAImF,cAAc5C,WAAW,YAAY4C,aAAa1C,cAAc,KAAK,MAAM;QAC7E,MAAM,IAAIjE,kBAAkB;IAC9B;IAEA,MAAMiE,iBAAiB,MAAM9D,aAAa;QAACM,UAAUiD,OAAOkD,WAAW;IAAA;IACvE,MAAMzF,OAAO,MAAM5B,mBAAmB;QAACiC,QAAQkF,SAASlF,MAAM;QAAEyC;IAAc;IAC9E,IAAI9C,MAAM4C,WAAW,UAAU;QAC7B,MAAM,IAAI/D,kBAAkB;IAC9B;IAEA,MAAMlB,2BAA2B;QAAC0C,QAAQkF,SAASlF,MAAM;IAAA;IAEzD,MAAM,EAACwB,KAAK,EAAEd,YAAY,EAAC,GAAG,MAAMW,oBAAoB1B,MAAMuC,OAAOtC,UAAU;IAE/E,OAAO;QAAC4B;QAAOd;QAAcf;IAAI;AACnC;AAEA,OAAO,eAAe0F,eAAenD,MAKpC;IACC,MAAMvC,OAAO,MAAMhC,aAAa;QAACsC,IAAIiC,OAAOlC,MAAM;IAAA;IAClD,IAAI,CAACL,MAAM;QACT,MAAM,IAAIlB,kBAAkByD,OAAOlC,MAAM;IAC3C;IAEA,MAAM6D,cAAclE,KAAK8C,cAAc,KAAK;IAC5C,MAAMqB,KAAK,MAAMlF,eAAe;QAC9BK,UAAUiD,OAAOoD,eAAe;QAChC5C,MAAM/C,KAAK8C,cAAc,IAAK,MAAMzD;IACtC;IACA,IAAI,CAAC6E,eAAe,CAACC,IAAI;QACvB,MAAM,IAAI1F;IACZ;IAEA,MAAMqE,iBAAiB,MAAM9D,aAAa;QAACM,UAAUiD,OAAOkD,WAAW;IAAA;IACvE,MAAMG,wBAAwBrD,OAAOxB,YAAY,GAC7C,MAAMvD,6BAA6B;QAAC+D,aAAapE,gBAAgBoF,OAAOxB,YAAY;IAAC,KACrFsD;IACJ,MAAMwB,uBACJD,uBAAuBvF,WAAWL,KAAKM,EAAE,GAAGsF,sBAAsBtF,EAAE,GAAG+D;IAEzE,MAAMjG,mBAAmB;QAACiC,QAAQL,KAAKM,EAAE;QAAEwC;IAAc;IACzD,MAAMnF,2BAA2B;QAAC0C,QAAQL,KAAKM,EAAE;QAAEuF;IAAoB;AACzE;AAEA,OAAO,eAAeC,OAAOvD,MAA2C;IACtE,IAAI,CAACA,OAAOxB,YAAY,EAAE;IAC1B,MAAMA,eAAe,MAAMtD,uBAAuB;QAChD8D,aAAapE,gBAAgBoF,OAAOxB,YAAY;IAClD;IACA,IAAI,CAACA,cAAc;IACnB,MAAMrD,qBAAqB;QAAC4D,WAAWP,aAAaO,SAAS;QAAEjB,QAAQU,aAAaV,MAAM;IAAA;AAC5F;AAMA,OAAO,eAAe0F,eAAexD,MAAwB;IAC3D,MAAMvC,OAAO,MAAMhC,aAAa;QAACsC,IAAIiC,OAAOlC,MAAM;IAAA;IAClD,IAAI,CAACL,MAAM;QACT,MAAM,IAAIlB,kBAAkByD,OAAOlC,MAAM;IAC3C;IAEA,OAAO;QAACL;IAAI;AACd"}
+{"version":3,"sources":["../../src/core/auth.ts"],"sourcesContent":["import {type AdminRole, emailSchema} from '@shipfox/api-auth-dto';\nimport {\n  confirmEmailChallenge,\n  consumeEmailChallengeProof,\n  createEmailChallenge,\n  resendEmailChallenge,\n} from '@shipfox/api-email-challenges';\nimport {\n  type WorkspacesInterModuleClient,\n  workspacesInterModuleContract,\n} from '@shipfox/api-workspaces-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {userAccessTokenKey} from '@shipfox/node-auth-root-key';\nimport {generateOpaqueToken, hashOpaqueToken} from '@shipfox/node-tokens';\nimport {config} from '#config.js';\nimport {consumePasswordReset, createPasswordReset} from '#db/password-resets.js';\nimport {\n  createRefreshToken,\n  findActiveRefreshTokenByHash,\n  findRefreshTokenByHash,\n  revokeRefreshSession,\n  revokeRefreshTokensForUser,\n  rotateRefreshToken,\n} from '#db/refresh-tokens.js';\nimport {\n  createUser as createDbUser,\n  findUserByEmail,\n  findUserById,\n  markEmailVerified,\n  provisionUser as provisionDbUser,\n  updateUserPassword,\n} from '#db/users.js';\nimport {type AuthTokenRefreshOutcome, recordTokenRefreshed} from '#metrics/index.js';\nimport {getCurrentAdminRole} from './admin-role.js';\nimport type {RefreshToken} from './entities/refresh-token.js';\nimport type {User} from './entities/user.js';\nimport {\n  AuthDependencyUnavailableError,\n  EmailNotVerifiedError,\n  EmailTakenError,\n  InvalidCredentialsError,\n  InvitationEmailMismatchError,\n  SignupNotAllowedError,\n  TokenAlreadyUsedError,\n  TokenExpiredError,\n  TokenInvalidError,\n  UserNotFoundError,\n} from './errors.js';\nimport {signUserToken} from './jwt.js';\nimport {hashPassword, verifyPassword} from './password.js';\nimport type {SignupPolicy} from './ports.js';\n\nconst RESET_TTL_HOURS = 1;\nconst PASSWORD_VERIFICATION_PURPOSE = 'password-verification';\nconst DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE =\n  'This Shipfox deployment does not accept new accounts right now.';\n\nconst defaultSignupPolicy: SignupPolicy = {\n  isSignupAllowed: async () => ({allowed: true}),\n};\n\nasync function assertSignupAllowed(params: {\n  signupPolicy?: SignupPolicy | undefined;\n  email: string;\n  emailVerified: boolean;\n  source: string;\n}): Promise<void> {\n  const result = await (params.signupPolicy ?? defaultSignupPolicy).isSignupAllowed({\n    email: params.email,\n    emailVerified: params.emailVerified,\n    source: params.source,\n  });\n\n  if (!result.allowed) {\n    throw new SignupNotAllowedError(result.message ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE);\n  }\n}\n\nlet dummyHashCache: string | undefined;\nasync function getDummyHash(): Promise<string> {\n  if (!dummyHashCache) {\n    dummyHashCache = await hashPassword({password: 'dummy-for-timing-parity'});\n  }\n  return dummyHashCache;\n}\n\nfunction hoursFromNow(hours: number): Date {\n  return new Date(Date.now() + hours * 60 * 60 * 1000);\n}\n\nfunction daysFromNow(days: number): Date {\n  return new Date(Date.now() + days * 24 * 60 * 60 * 1000);\n}\n\nfunction recordRefreshOutcome(outcome: AuthTokenRefreshOutcome): void {\n  recordTokenRefreshed(outcome);\n}\n\nasync function signAccessToken(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n  refreshSessionId: string,\n): Promise<string> {\n  const memberships = await workspaces\n    .listMembershipsForTokenClaims({userId: user.id})\n    .catch((error: unknown) => {\n      throw new AuthDependencyUnavailableError('workspaces', error);\n    });\n  return await signUserToken({\n    userId: user.id,\n    email: user.email,\n    name: user.name,\n    memberships: memberships.memberships,\n    refreshSessionId,\n    secret: userAccessTokenKey(),\n    expiresIn: config.AUTH_JWT_EXPIRES_IN,\n  });\n}\n\nfunction isWithinRotationGrace(refreshToken: RefreshToken): boolean {\n  if (!refreshToken.rotatedAt) return false;\n  const graceMs = config.AUTH_REFRESH_ROTATION_GRACE_SECONDS * 1000;\n  return Date.now() - refreshToken.rotatedAt.getTime() <= graceMs;\n}\n\nasync function createRefreshSession(\n  user: User,\n  refreshSessionId: string,\n): Promise<{refreshToken: string; refreshSessionId: string}> {\n  const refreshToken = generateOpaqueToken('refreshToken');\n  const session = await createRefreshToken({\n    sessionId: refreshSessionId,\n    userId: user.id,\n    hashedToken: hashOpaqueToken(refreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  return {refreshToken, refreshSessionId: session.sessionId};\n}\n\nasync function createSessionTokens(\n  user: User,\n  workspaces: WorkspacesInterModuleClient,\n): Promise<{token: string; refreshToken: string; adminRole: AdminRole | null}> {\n  const refreshSessionId = crypto.randomUUID();\n  const token = await signAccessToken(user, workspaces, refreshSessionId);\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n  const {refreshToken} = await createRefreshSession(user, refreshSessionId);\n  return {token, refreshToken, adminRole};\n}\n\nfunction passwordResetLink(rawToken: string): string {\n  return `${config.CLIENT_BASE_URL}/auth/reset?token=${rawToken}`;\n}\n\nfunction invitationErrorFromKnownError(\n  error: unknown,\n  method: 'preflightInvitationAcceptance' | 'acceptInvitation',\n): Error {\n  const contractMethod = workspacesInterModuleContract.methods[method];\n  if (!isInterModuleKnownError(contractMethod, error)) return error as Error;\n\n  if (error.code === 'invitation-token-invalid')\n    return new TokenInvalidError('Invitation token is invalid');\n  if (error.code === 'invitation-token-used') return new TokenAlreadyUsedError();\n  if (error.code === 'invitation-token-expired') return new TokenExpiredError();\n  return new InvitationEmailMismatchError();\n}\n\nfunction invitationErrorMessage(\n  code:\n    | 'invitation-token-invalid'\n    | 'invitation-token-used'\n    | 'invitation-token-expired'\n    | 'invitation-email-mismatch',\n): string {\n  if (code === 'invitation-token-invalid') return 'Invitation token is invalid';\n  if (code === 'invitation-token-used') return 'Invitation has already been accepted';\n  if (code === 'invitation-token-expired') return 'Invitation has expired';\n  return 'Signup email does not match the invitation';\n}\n\nexport interface SignupParams {\n  email: string;\n  password: string;\n  name?: string | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\nexport interface ProvisionUserParams {\n  email: string;\n  name?: string | null | undefined;\n  signupPolicy?: SignupPolicy | undefined;\n}\n\n/**\n * Creates a verified, password-less user for an external identity provider.\n * Existing users are returned unchanged, including their password and profile.\n */\nexport async function provisionUser(params: ProvisionUserParams): Promise<User> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) return existing;\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: true,\n    source: 'external-identity',\n  });\n\n  return await provisionDbUser({\n    email,\n    name: params.name ?? null,\n  });\n}\n\nexport type SignupResult = User & {\n  emailChallenge: {id: string; nextResendAvailableAt: Date};\n};\n\nexport async function signup(params: SignupParams & {sourceIp?: string}): Promise<SignupResult> {\n  const email = emailSchema.parse(params.email);\n  const existing = await findUserByEmail({email});\n  if (existing) {\n    const canResumeVerification =\n      existing.status === 'active' &&\n      existing.emailVerifiedAt === null &&\n      existing.hashedPassword !== null &&\n      (await verifyPassword({password: params.password, hash: existing.hashedPassword}));\n    if (canResumeVerification) {\n      const emailChallenge = await createEmailChallenge({\n        email: existing.email,\n        purpose: PASSWORD_VERIFICATION_PURPOSE,\n        continuation: existing.id,\n        idempotencyKey: existing.id,\n        sourceIp: params.sourceIp ?? '0.0.0.0',\n      });\n      return {...existing, emailChallenge};\n    }\n    throw new EmailTakenError(email);\n  }\n\n  await assertSignupAllowed({\n    signupPolicy: params.signupPolicy,\n    email,\n    emailVerified: false,\n    source: 'password',\n  });\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email,\n    hashedPassword,\n    name: params.name ?? null,\n    signedUp: {viaInvitation: false},\n  });\n\n  const emailChallenge = await createEmailChallenge({\n    email: user.email,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n    idempotencyKey: user.id,\n    sourceIp: params.sourceIp ?? '0.0.0.0',\n  });\n\n  return {...user, emailChallenge};\n}\n\nexport interface SignupWithInvitationParams extends SignupParams {\n  invitationToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface SignupWithInvitationResult extends LoginResult {\n  membership: {id: string; userId: string; workspaceId: string} | null;\n  acceptError?: {code: string; message: string};\n}\n\nexport async function signupWithInvitation(\n  params: SignupWithInvitationParams,\n): Promise<SignupWithInvitationResult> {\n  // Step 1: Pre-validate the invitation BEFORE any user write so an invalid\n  // token never produces an orphan user. Re-validation happens again inside\n  // acceptWorkspaceInvitation (race-safe) after the user is created.\n  try {\n    await params.workspaces.preflightInvitationAcceptance({\n      token: params.invitationToken,\n      email: params.email,\n    });\n  } catch (error) {\n    throw invitationErrorFromKnownError(error, 'preflightInvitationAcceptance');\n  }\n\n  // Step 2: Create the user as verified. The invitation email is the proof of\n  // ownership, and this avoids a second auth-table write just to mark verified.\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: new Date(),\n    signedUp: {viaInvitation: true},\n  });\n\n  // Step 3: Accept the invitation through the workspaces module boundary.\n  // This is intentionally not one database transaction with auth; treat it like\n  // calling another service. If it fails after user creation, return a verified\n  // signed-in user and an explicit retryable accept error.\n  let membership: SignupWithInvitationResult['membership'] = null;\n  let acceptError: SignupWithInvitationResult['acceptError'];\n  try {\n    const result = await params.workspaces.acceptInvitation({\n      token: params.invitationToken,\n      userId: user.id,\n      email: user.email,\n      name: user.name,\n    });\n    membership = {\n      id: result.membership.id,\n      userId: result.membership.userId,\n      workspaceId: result.membership.workspaceId,\n    };\n  } catch (error) {\n    if (isInterModuleKnownError(workspacesInterModuleContract.methods.acceptInvitation, error)) {\n      acceptError = {code: error.code, message: invitationErrorMessage(error.code)};\n    } else {\n      acceptError = {\n        code: 'AcceptFailed',\n        message: 'Could not accept the invitation; please retry from the invite link.',\n      };\n    }\n  }\n\n  // Step 4: Issue session. signAccessToken reads memberships through the\n  // workspaces module API, so a successful accept is reflected in the JWT.\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  if (acceptError) {\n    return {token, refreshToken, user, membership, acceptError, adminRole};\n  }\n  return {token, refreshToken, user, membership, adminRole};\n}\n\nexport interface CreateUserParams extends SignupParams {\n  verified: boolean;\n}\n\nexport async function createUser(params: CreateUserParams): Promise<User> {\n  const existing = await findUserByEmail({email: params.email});\n  if (existing) {\n    throw new EmailTakenError(params.email);\n  }\n\n  const hashedPassword = await hashPassword({password: params.password});\n  const user = await createDbUser({\n    email: params.email,\n    hashedPassword,\n    name: params.name ?? null,\n    emailVerifiedAt: params.verified ? new Date() : null,\n  });\n\n  return user;\n}\n\nexport interface LoginParams {\n  email: string;\n  password: string;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface LoginResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function login(params: LoginParams): Promise<LoginResult> {\n  const user = await findUserByEmail({email: params.email});\n\n  if (!user) {\n    await verifyPassword({password: params.password, hash: await getDummyHash()});\n    throw new InvalidCredentialsError();\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.password,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok || user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport interface CreateSessionForUserParams {\n  userId?: string | undefined;\n  email?: string | undefined;\n  workspaces: WorkspacesInterModuleClient;\n}\n\nexport interface CreateSessionForUserResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport type CreateSessionForUserError =\n  | AuthDependencyUnavailableError\n  | EmailNotVerifiedError\n  | InvalidCredentialsError\n  | UserNotFoundError;\n\nexport async function createSessionForUser(\n  params: CreateSessionForUserParams,\n): Promise<CreateSessionForUserResult> {\n  const user = params.userId\n    ? await findUserById({id: params.userId})\n    : params.email\n      ? await findUserByEmail({email: emailSchema.parse(params.email)})\n      : undefined;\n\n  if (!user) {\n    throw new UserNotFoundError(params.userId ?? params.email ?? 'unknown');\n  }\n  if (user.emailVerifiedAt === null) {\n    throw new EmailNotVerifiedError();\n  }\n  if (user.status !== 'active') {\n    throw new InvalidCredentialsError();\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport interface RefreshAccessTokenResult {\n  token: string;\n  /** Undefined on a grace-window hit: keep the existing cookie instead of rotating it. */\n  refreshToken: string | undefined;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function refreshAccessToken(params: {\n  refreshToken: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<RefreshAccessTokenResult> {\n  const currentHashedToken = hashOpaqueToken(params.refreshToken);\n  const current = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n  if (!current) {\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n\n  const user = await findUserById({id: current.userId});\n  if (user?.status !== 'active') {\n    await revokeRefreshSession({sessionId: current.sessionId, userId: current.userId});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token is invalid or expired');\n  }\n  const adminRole = await getCurrentAdminRole({userId: user.id});\n\n  // Within the grace window a rotated token means a concurrent refresh (e.g. a\n  // second tab); past it, reuse of a retired token means a compromised session.\n  if (current.rotatedAt) {\n    if (isWithinRotationGrace(current)) {\n      const token = await signAccessToken(user, params.workspaces, current.sessionId);\n      recordRefreshOutcome('grace');\n      return {token, refreshToken: undefined, user, adminRole};\n    }\n    await revokeRefreshTokensForUser({userId: user.id});\n    recordRefreshOutcome('rejected');\n    throw new TokenInvalidError('Refresh token reused after rotation');\n  }\n\n  // Losing the CAS requires a state check: another request may have rotated,\n  // revoked, or expired the token before this refresh could claim it.\n  const nextRefreshToken = generateOpaqueToken('refreshToken');\n  const rotated = await rotateRefreshToken({\n    id: current.id,\n    currentHashedToken,\n    nextHashedToken: hashOpaqueToken(nextRefreshToken),\n    expiresAt: daysFromNow(config.AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS),\n  });\n  if (!rotated) {\n    const latest = await findRefreshTokenByHash({hashedToken: currentHashedToken});\n    if (!latest || !isWithinRotationGrace(latest)) {\n      recordRefreshOutcome('rejected');\n      throw new TokenInvalidError('Refresh token is invalid or expired');\n    }\n    const token = await signAccessToken(user, params.workspaces, latest.sessionId);\n    recordRefreshOutcome('grace');\n    return {token, refreshToken: undefined, user, adminRole};\n  }\n\n  const token = await signAccessToken(user, params.workspaces, current.sessionId);\n  recordRefreshOutcome('rotated');\n  return {token, refreshToken: nextRefreshToken, user, adminRole};\n}\n\nexport interface ConfirmEmailVerificationResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport interface ResendEmailVerificationResult {\n  nextResendAvailableAt: Date;\n}\n\nexport async function confirmEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  code: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user) throw new TokenInvalidError('Verification code is invalid or expired');\n  await confirmEmailChallenge({id: params.challengeId, code: params.code, continuation: user.id});\n  await consumeEmailChallengeProof({\n    id: params.challengeId,\n    purpose: PASSWORD_VERIFICATION_PURPOSE,\n    continuation: user.id,\n  });\n\n  const verifiedUser = await markEmailVerified({userId: user.id});\n  if (verifiedUser?.status !== 'active') {\n    throw new TokenInvalidError('Verification code is invalid or expired');\n  }\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(\n    verifiedUser,\n    params.workspaces,\n  );\n\n  return {token, refreshToken, user: verifiedUser, adminRole};\n}\n\nexport async function resendEmailVerification(params: {\n  email: string;\n  challengeId: string;\n  sourceIp: string;\n}): Promise<ResendEmailVerificationResult> {\n  const user = await findUserByEmail({email: emailSchema.parse(params.email)});\n  if (!user || user.emailVerifiedAt || user.status !== 'active') {\n    return {nextResendAvailableAt: new Date()};\n  }\n  const result = await resendEmailChallenge({\n    id: params.challengeId,\n    continuation: user.id,\n    sourceIp: params.sourceIp,\n  });\n\n  return {nextResendAvailableAt: result.nextResendAvailableAt};\n}\n\nexport async function requestPasswordReset(params: {email: string}): Promise<void> {\n  const user = await findUserByEmail({email: params.email});\n  if (user?.status !== 'active' || user.hashedPassword === null) {\n    return;\n  }\n\n  const rawToken = generateOpaqueToken('passwordReset');\n  await createPasswordReset({\n    userId: user.id,\n    hashedToken: hashOpaqueToken(rawToken),\n    expiresAt: hoursFromNow(RESET_TTL_HOURS),\n    sendEmail: {\n      email: user.email,\n      resetLink: passwordResetLink(rawToken),\n      expiresInHours: RESET_TTL_HOURS,\n    },\n  });\n}\n\nexport interface ConfirmPasswordResetResult {\n  token: string;\n  refreshToken: string;\n  user: User;\n  adminRole: AdminRole | null;\n}\n\nexport async function confirmPasswordReset(params: {\n  token: string;\n  newPassword: string;\n  workspaces: WorkspacesInterModuleClient;\n}): Promise<ConfirmPasswordResetResult> {\n  const consumed = await consumePasswordReset({hashedToken: hashOpaqueToken(params.token)});\n  if (!consumed) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const existingUser = await findUserById({id: consumed.userId});\n  if (existingUser?.status !== 'active' || existingUser.hashedPassword === null) {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const user = await updateUserPassword({userId: consumed.userId, hashedPassword});\n  if (user?.status !== 'active') {\n    throw new TokenInvalidError('Reset token is invalid or expired');\n  }\n\n  await revokeRefreshTokensForUser({userId: consumed.userId});\n\n  const {token, refreshToken, adminRole} = await createSessionTokens(user, params.workspaces);\n\n  return {token, refreshToken, user, adminRole};\n}\n\nexport async function changePassword(params: {\n  userId: string;\n  currentPassword: string;\n  newPassword: string;\n  refreshToken?: string | undefined;\n}): Promise<void> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  const hasPassword = user.hashedPassword !== null;\n  const ok = await verifyPassword({\n    password: params.currentPassword,\n    hash: user.hashedPassword ?? (await getDummyHash()),\n  });\n  if (!hasPassword || !ok) {\n    throw new InvalidCredentialsError();\n  }\n\n  const hashedPassword = await hashPassword({password: params.newPassword});\n  const currentRefreshSession = params.refreshToken\n    ? await findActiveRefreshTokenByHash({hashedToken: hashOpaqueToken(params.refreshToken)})\n    : undefined;\n  const exceptRefreshTokenId =\n    currentRefreshSession?.userId === user.id ? currentRefreshSession.id : undefined;\n\n  await updateUserPassword({userId: user.id, hashedPassword});\n  await revokeRefreshTokensForUser({userId: user.id, exceptRefreshTokenId});\n}\n\nexport async function logout(params: {refreshToken?: string | undefined}): Promise<void> {\n  if (!params.refreshToken) return;\n  const refreshToken = await findRefreshTokenByHash({\n    hashedToken: hashOpaqueToken(params.refreshToken),\n  });\n  if (!refreshToken) return;\n  await revokeRefreshSession({sessionId: refreshToken.sessionId, userId: refreshToken.userId});\n}\n\nexport interface GetCurrentUserResult {\n  user: User;\n}\n\nexport async function getCurrentUser(params: {userId: string}): Promise<GetCurrentUserResult> {\n  const user = await findUserById({id: params.userId});\n  if (!user) {\n    throw new UserNotFoundError(params.userId);\n  }\n\n  return {user};\n}\n"],"names":["emailSchema","confirmEmailChallenge","consumeEmailChallengeProof","createEmailChallenge","resendEmailChallenge","workspacesInterModuleContract","isInterModuleKnownError","userAccessTokenKey","generateOpaqueToken","hashOpaqueToken","config","consumePasswordReset","createPasswordReset","createRefreshToken","findActiveRefreshTokenByHash","findRefreshTokenByHash","revokeRefreshSession","revokeRefreshTokensForUser","rotateRefreshToken","createUser","createDbUser","findUserByEmail","findUserById","markEmailVerified","provisionUser","provisionDbUser","updateUserPassword","recordTokenRefreshed","getCurrentAdminRole","AuthDependencyUnavailableError","EmailNotVerifiedError","EmailTakenError","InvalidCredentialsError","InvitationEmailMismatchError","SignupNotAllowedError","TokenAlreadyUsedError","TokenExpiredError","TokenInvalidError","UserNotFoundError","signUserToken","hashPassword","verifyPassword","RESET_TTL_HOURS","PASSWORD_VERIFICATION_PURPOSE","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","defaultSignupPolicy","isSignupAllowed","allowed","assertSignupAllowed","params","result","signupPolicy","email","emailVerified","source","message","dummyHashCache","getDummyHash","password","hoursFromNow","hours","Date","now","daysFromNow","days","recordRefreshOutcome","outcome","signAccessToken","user","workspaces","refreshSessionId","memberships","listMembershipsForTokenClaims","userId","id","catch","error","name","secret","expiresIn","AUTH_JWT_EXPIRES_IN","isWithinRotationGrace","refreshToken","rotatedAt","graceMs","AUTH_REFRESH_ROTATION_GRACE_SECONDS","getTime","createRefreshSession","session","sessionId","hashedToken","expiresAt","AUTH_REFRESH_TOKEN_EXPIRES_IN_DAYS","createSessionTokens","crypto","randomUUID","token","adminRole","passwordResetLink","rawToken","CLIENT_BASE_URL","invitationErrorFromKnownError","method","contractMethod","methods","code","invitationErrorMessage","parse","existing","signup","canResumeVerification","status","emailVerifiedAt","hashedPassword","hash","emailChallenge","purpose","continuation","idempotencyKey","sourceIp","signedUp","viaInvitation","signupWithInvitation","preflightInvitationAcceptance","invitationToken","membership","acceptError","acceptInvitation","workspaceId","verified","login","hasPassword","ok","createSessionForUser","undefined","refreshAccessToken","currentHashedToken","current","nextRefreshToken","rotated","nextHashedToken","latest","confirmEmailVerification","challengeId","verifiedUser","resendEmailVerification","nextResendAvailableAt","requestPasswordReset","sendEmail","resetLink","expiresInHours","confirmPasswordReset","consumed","existingUser","newPassword","changePassword","currentPassword","currentRefreshSession","exceptRefreshTokenId","logout","getCurrentUser"],"mappings":"AAAA,SAAwBA,WAAW,QAAO,wBAAwB;AAClE,SACEC,qBAAqB,EACrBC,0BAA0B,EAC1BC,oBAAoB,EACpBC,oBAAoB,QACf,gCAAgC;AACvC,SAEEC,6BAA6B,QACxB,2CAA2C;AAClD,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,kBAAkB,QAAO,8BAA8B;AAC/D,SAAQC,mBAAmB,EAAEC,eAAe,QAAO,uBAAuB;AAC1E,SAAQC,MAAM,QAAO,aAAa;AAClC,SAAQC,oBAAoB,EAAEC,mBAAmB,QAAO,yBAAyB;AACjF,SACEC,kBAAkB,EAClBC,4BAA4B,EAC5BC,sBAAsB,EACtBC,oBAAoB,EACpBC,0BAA0B,EAC1BC,kBAAkB,QACb,wBAAwB;AAC/B,SACEC,cAAcC,YAAY,EAC1BC,eAAe,EACfC,YAAY,EACZC,iBAAiB,EACjBC,iBAAiBC,eAAe,EAChCC,kBAAkB,QACb,eAAe;AACtB,SAAsCC,oBAAoB,QAAO,oBAAoB;AACrF,SAAQC,mBAAmB,QAAO,kBAAkB;AAGpD,SACEC,8BAA8B,EAC9BC,qBAAqB,EACrBC,eAAe,EACfC,uBAAuB,EACvBC,4BAA4B,EAC5BC,qBAAqB,EACrBC,qBAAqB,EACrBC,iBAAiB,EACjBC,iBAAiB,EACjBC,iBAAiB,QACZ,cAAc;AACrB,SAAQC,aAAa,QAAO,WAAW;AACvC,SAAQC,YAAY,EAAEC,cAAc,QAAO,gBAAgB;AAG3D,MAAMC,kBAAkB;AACxB,MAAMC,gCAAgC;AACtC,MAAMC,qCACJ;AAEF,MAAMC,sBAAoC;IACxCC,iBAAiB,UAAa,CAAA;YAACC,SAAS;QAAI,CAAA;AAC9C;AAEA,eAAeC,oBAAoBC,MAKlC;IACC,MAAMC,SAAS,MAAM,AAACD,CAAAA,OAAOE,YAAY,IAAIN,mBAAkB,EAAGC,eAAe,CAAC;QAChFM,OAAOH,OAAOG,KAAK;QACnBC,eAAeJ,OAAOI,aAAa;QACnCC,QAAQL,OAAOK,MAAM;IACvB;IAEA,IAAI,CAACJ,OAAOH,OAAO,EAAE;QACnB,MAAM,IAAIb,sBAAsBgB,OAAOK,OAAO,IAAIX;IACpD;AACF;AAEA,IAAIY;AACJ,eAAeC;IACb,IAAI,CAACD,gBAAgB;QACnBA,iBAAiB,MAAMhB,aAAa;YAACkB,UAAU;QAAyB;IAC1E;IACA,OAAOF;AACT;AAEA,SAASG,aAAaC,KAAa;IACjC,OAAO,IAAIC,KAAKA,KAAKC,GAAG,KAAKF,QAAQ,KAAK,KAAK;AACjD;AAEA,SAASG,YAAYC,IAAY;IAC/B,OAAO,IAAIH,KAAKA,KAAKC,GAAG,KAAKE,OAAO,KAAK,KAAK,KAAK;AACrD;AAEA,SAASC,qBAAqBC,OAAgC;IAC5DvC,qBAAqBuC;AACvB;AAEA,eAAeC,gBACbC,IAAU,EACVC,UAAuC,EACvCC,gBAAwB;IAExB,MAAMC,cAAc,MAAMF,WACvBG,6BAA6B,CAAC;QAACC,QAAQL,KAAKM,EAAE;IAAA,GAC9CC,KAAK,CAAC,CAACC;QACN,MAAM,IAAI/C,+BAA+B,cAAc+C;IACzD;IACF,OAAO,MAAMrC,cAAc;QACzBkC,QAAQL,KAAKM,EAAE;QACftB,OAAOgB,KAAKhB,KAAK;QACjByB,MAAMT,KAAKS,IAAI;QACfN,aAAaA,YAAYA,WAAW;QACpCD;QACAQ,QAAQvE;QACRwE,WAAWrE,OAAOsE,mBAAmB;IACvC;AACF;AAEA,SAASC,sBAAsBC,YAA0B;IACvD,IAAI,CAACA,aAAaC,SAAS,EAAE,OAAO;IACpC,MAAMC,UAAU1E,OAAO2E,mCAAmC,GAAG;IAC7D,OAAOxB,KAAKC,GAAG,KAAKoB,aAAaC,SAAS,CAACG,OAAO,MAAMF;AAC1D;AAEA,eAAeG,qBACbnB,IAAU,EACVE,gBAAwB;IAExB,MAAMY,eAAe1E,oBAAoB;IACzC,MAAMgF,UAAU,MAAM3E,mBAAmB;QACvC4E,WAAWnB;QACXG,QAAQL,KAAKM,EAAE;QACfgB,aAAajF,gBAAgByE;QAC7BS,WAAW5B,YAAYrD,OAAOkF,kCAAkC;IAClE;IACA,OAAO;QAACV;QAAcZ,kBAAkBkB,QAAQC,SAAS;IAAA;AAC3D;AAEA,eAAeI,oBACbzB,IAAU,EACVC,UAAuC;IAEvC,MAAMC,mBAAmBwB,OAAOC,UAAU;IAC1C,MAAMC,QAAQ,MAAM7B,gBAAgBC,MAAMC,YAAYC;IACtD,MAAM2B,YAAY,MAAMrE,oBAAoB;QAAC6C,QAAQL,KAAKM,EAAE;IAAA;IAC5D,MAAM,EAACQ,YAAY,EAAC,GAAG,MAAMK,qBAAqBnB,MAAME;IACxD,OAAO;QAAC0B;QAAOd;QAAce;IAAS;AACxC;AAEA,SAASC,kBAAkBC,QAAgB;IACzC,OAAO,GAAGzF,OAAO0F,eAAe,CAAC,kBAAkB,EAAED,UAAU;AACjE;AAEA,SAASE,8BACPzB,KAAc,EACd0B,MAA4D;IAE5D,MAAMC,iBAAiBlG,8BAA8BmG,OAAO,CAACF,OAAO;IACpE,IAAI,CAAChG,wBAAwBiG,gBAAgB3B,QAAQ,OAAOA;IAE5D,IAAIA,MAAM6B,IAAI,KAAK,4BACjB,OAAO,IAAIpE,kBAAkB;IAC/B,IAAIuC,MAAM6B,IAAI,KAAK,yBAAyB,OAAO,IAAItE;IACvD,IAAIyC,MAAM6B,IAAI,KAAK,4BAA4B,OAAO,IAAIrE;IAC1D,OAAO,IAAIH;AACb;AAEA,SAASyE,uBACPD,IAI+B;IAE/B,IAAIA,SAAS,4BAA4B,OAAO;IAChD,IAAIA,SAAS,yBAAyB,OAAO;IAC7C,IAAIA,SAAS,4BAA4B,OAAO;IAChD,OAAO;AACT;AAeA;;;CAGC,GACD,OAAO,eAAejF,cAAcyB,MAA2B;IAC7D,MAAMG,QAAQpD,YAAY2G,KAAK,CAAC1D,OAAOG,KAAK;IAC5C,MAAMwD,WAAW,MAAMvF,gBAAgB;QAAC+B;IAAK;IAC7C,IAAIwD,UAAU,OAAOA;IAErB,MAAM5D,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCC;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,OAAO,MAAM7B,gBAAgB;QAC3B2B;QACAyB,MAAM5B,OAAO4B,IAAI,IAAI;IACvB;AACF;AAMA,OAAO,eAAegC,OAAO5D,MAA0C;IACrE,MAAMG,QAAQpD,YAAY2G,KAAK,CAAC1D,OAAOG,KAAK;IAC5C,MAAMwD,WAAW,MAAMvF,gBAAgB;QAAC+B;IAAK;IAC7C,IAAIwD,UAAU;QACZ,MAAME,wBACJF,SAASG,MAAM,KAAK,YACpBH,SAASI,eAAe,KAAK,QAC7BJ,SAASK,cAAc,KAAK,QAC3B,MAAMxE,eAAe;YAACiB,UAAUT,OAAOS,QAAQ;YAAEwD,MAAMN,SAASK,cAAc;QAAA;QACjF,IAAIH,uBAAuB;YACzB,MAAMK,iBAAiB,MAAMhH,qBAAqB;gBAChDiD,OAAOwD,SAASxD,KAAK;gBACrBgE,SAASzE;gBACT0E,cAAcT,SAASlC,EAAE;gBACzB4C,gBAAgBV,SAASlC,EAAE;gBAC3B6C,UAAUtE,OAAOsE,QAAQ,IAAI;YAC/B;YACA,OAAO;gBAAC,GAAGX,QAAQ;gBAAEO;YAAc;QACrC;QACA,MAAM,IAAIpF,gBAAgBqB;IAC5B;IAEA,MAAMJ,oBAAoB;QACxBG,cAAcF,OAAOE,YAAY;QACjCC;QACAC,eAAe;QACfC,QAAQ;IACV;IAEA,MAAM2D,iBAAiB,MAAMzE,aAAa;QAACkB,UAAUT,OAAOS,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMhD,aAAa;QAC9BgC;QACA6D;QACApC,MAAM5B,OAAO4B,IAAI,IAAI;QACrB2C,UAAU;YAACC,eAAe;QAAK;IACjC;IAEA,MAAMN,iBAAiB,MAAMhH,qBAAqB;QAChDiD,OAAOgB,KAAKhB,KAAK;QACjBgE,SAASzE;QACT0E,cAAcjD,KAAKM,EAAE;QACrB4C,gBAAgBlD,KAAKM,EAAE;QACvB6C,UAAUtE,OAAOsE,QAAQ,IAAI;IAC/B;IAEA,OAAO;QAAC,GAAGnD,IAAI;QAAE+C;IAAc;AACjC;AAYA,OAAO,eAAeO,qBACpBzE,MAAkC;IAElC,0EAA0E;IAC1E,0EAA0E;IAC1E,mEAAmE;IACnE,IAAI;QACF,MAAMA,OAAOoB,UAAU,CAACsD,6BAA6B,CAAC;YACpD3B,OAAO/C,OAAO2E,eAAe;YAC7BxE,OAAOH,OAAOG,KAAK;QACrB;IACF,EAAE,OAAOwB,OAAO;QACd,MAAMyB,8BAA8BzB,OAAO;IAC7C;IAEA,4EAA4E;IAC5E,8EAA8E;IAC9E,MAAMgC,WAAW,MAAMvF,gBAAgB;QAAC+B,OAAOH,OAAOG,KAAK;IAAA;IAC3D,IAAIwD,UAAU;QACZ,MAAM,IAAI7E,gBAAgBkB,OAAOG,KAAK;IACxC;IACA,MAAM6D,iBAAiB,MAAMzE,aAAa;QAACkB,UAAUT,OAAOS,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMhD,aAAa;QAC9BgC,OAAOH,OAAOG,KAAK;QACnB6D;QACApC,MAAM5B,OAAO4B,IAAI,IAAI;QACrBmC,iBAAiB,IAAInD;QACrB2D,UAAU;YAACC,eAAe;QAAI;IAChC;IAEA,wEAAwE;IACxE,8EAA8E;IAC9E,8EAA8E;IAC9E,yDAAyD;IACzD,IAAII,aAAuD;IAC3D,IAAIC;IACJ,IAAI;QACF,MAAM5E,SAAS,MAAMD,OAAOoB,UAAU,CAAC0D,gBAAgB,CAAC;YACtD/B,OAAO/C,OAAO2E,eAAe;YAC7BnD,QAAQL,KAAKM,EAAE;YACftB,OAAOgB,KAAKhB,KAAK;YACjByB,MAAMT,KAAKS,IAAI;QACjB;QACAgD,aAAa;YACXnD,IAAIxB,OAAO2E,UAAU,CAACnD,EAAE;YACxBD,QAAQvB,OAAO2E,UAAU,CAACpD,MAAM;YAChCuD,aAAa9E,OAAO2E,UAAU,CAACG,WAAW;QAC5C;IACF,EAAE,OAAOpD,OAAO;QACd,IAAItE,wBAAwBD,8BAA8BmG,OAAO,CAACuB,gBAAgB,EAAEnD,QAAQ;YAC1FkD,cAAc;gBAACrB,MAAM7B,MAAM6B,IAAI;gBAAElD,SAASmD,uBAAuB9B,MAAM6B,IAAI;YAAC;QAC9E,OAAO;YACLqB,cAAc;gBACZrB,MAAM;gBACNlD,SAAS;YACX;QACF;IACF;IAEA,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,EAACyC,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBzB,MAAMnB,OAAOoB,UAAU;IAE1F,IAAIyD,aAAa;QACf,OAAO;YAAC9B;YAAOd;YAAcd;YAAMyD;YAAYC;YAAa7B;QAAS;IACvE;IACA,OAAO;QAACD;QAAOd;QAAcd;QAAMyD;QAAY5B;IAAS;AAC1D;AAMA,OAAO,eAAe9E,WAAW8B,MAAwB;IACvD,MAAM2D,WAAW,MAAMvF,gBAAgB;QAAC+B,OAAOH,OAAOG,KAAK;IAAA;IAC3D,IAAIwD,UAAU;QACZ,MAAM,IAAI7E,gBAAgBkB,OAAOG,KAAK;IACxC;IAEA,MAAM6D,iBAAiB,MAAMzE,aAAa;QAACkB,UAAUT,OAAOS,QAAQ;IAAA;IACpE,MAAMU,OAAO,MAAMhD,aAAa;QAC9BgC,OAAOH,OAAOG,KAAK;QACnB6D;QACApC,MAAM5B,OAAO4B,IAAI,IAAI;QACrBmC,iBAAiB/D,OAAOgF,QAAQ,GAAG,IAAIpE,SAAS;IAClD;IAEA,OAAOO;AACT;AAeA,OAAO,eAAe8D,MAAMjF,MAAmB;IAC7C,MAAMmB,OAAO,MAAM/C,gBAAgB;QAAC+B,OAAOH,OAAOG,KAAK;IAAA;IAEvD,IAAI,CAACgB,MAAM;QACT,MAAM3B,eAAe;YAACiB,UAAUT,OAAOS,QAAQ;YAAEwD,MAAM,MAAMzD;QAAc;QAC3E,MAAM,IAAIzB;IACZ;IAEA,MAAMmG,cAAc/D,KAAK6C,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM3F,eAAe;QAC9BiB,UAAUT,OAAOS,QAAQ;QACzBwD,MAAM9C,KAAK6C,cAAc,IAAK,MAAMxD;IACtC;IACA,IAAI,CAAC0E,eAAe,CAACC,MAAMhE,KAAK2C,MAAM,KAAK,UAAU;QACnD,MAAM,IAAI/E;IACZ;IAEA,IAAIoC,KAAK4C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIlF;IACZ;IAEA,MAAM,EAACkE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBzB,MAAMnB,OAAOoB,UAAU;IAE1F,OAAO;QAAC2B;QAAOd;QAAcd;QAAM6B;IAAS;AAC9C;AAqBA,OAAO,eAAeoC,qBACpBpF,MAAkC;IAElC,MAAMmB,OAAOnB,OAAOwB,MAAM,GACtB,MAAMnD,aAAa;QAACoD,IAAIzB,OAAOwB,MAAM;IAAA,KACrCxB,OAAOG,KAAK,GACV,MAAM/B,gBAAgB;QAAC+B,OAAOpD,YAAY2G,KAAK,CAAC1D,OAAOG,KAAK;IAAC,KAC7DkF;IAEN,IAAI,CAAClE,MAAM;QACT,MAAM,IAAI9B,kBAAkBW,OAAOwB,MAAM,IAAIxB,OAAOG,KAAK,IAAI;IAC/D;IACA,IAAIgB,KAAK4C,eAAe,KAAK,MAAM;QACjC,MAAM,IAAIlF;IACZ;IACA,IAAIsC,KAAK2C,MAAM,KAAK,UAAU;QAC5B,MAAM,IAAI/E;IACZ;IAEA,MAAM,EAACgE,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBzB,MAAMnB,OAAOoB,UAAU;IAE1F,OAAO;QAAC2B;QAAOd;QAAcd;QAAM6B;IAAS;AAC9C;AAUA,OAAO,eAAesC,mBAAmBtF,MAGxC;IACC,MAAMuF,qBAAqB/H,gBAAgBwC,OAAOiC,YAAY;IAC9D,MAAMuD,UAAU,MAAM1H,uBAAuB;QAAC2E,aAAa8C;IAAkB;IAC7E,IAAI,CAACC,SAAS;QACZxE,qBAAqB;QACrB,MAAM,IAAI5B,kBAAkB;IAC9B;IAEA,MAAM+B,OAAO,MAAM9C,aAAa;QAACoD,IAAI+D,QAAQhE,MAAM;IAAA;IACnD,IAAIL,MAAM2C,WAAW,UAAU;QAC7B,MAAM/F,qBAAqB;YAACyE,WAAWgD,QAAQhD,SAAS;YAAEhB,QAAQgE,QAAQhE,MAAM;QAAA;QAChFR,qBAAqB;QACrB,MAAM,IAAI5B,kBAAkB;IAC9B;IACA,MAAM4D,YAAY,MAAMrE,oBAAoB;QAAC6C,QAAQL,KAAKM,EAAE;IAAA;IAE5D,6EAA6E;IAC7E,8EAA8E;IAC9E,IAAI+D,QAAQtD,SAAS,EAAE;QACrB,IAAIF,sBAAsBwD,UAAU;YAClC,MAAMzC,QAAQ,MAAM7B,gBAAgBC,MAAMnB,OAAOoB,UAAU,EAAEoE,QAAQhD,SAAS;YAC9ExB,qBAAqB;YACrB,OAAO;gBAAC+B;gBAAOd,cAAcoD;gBAAWlE;gBAAM6B;YAAS;QACzD;QACA,MAAMhF,2BAA2B;YAACwD,QAAQL,KAAKM,EAAE;QAAA;QACjDT,qBAAqB;QACrB,MAAM,IAAI5B,kBAAkB;IAC9B;IAEA,2EAA2E;IAC3E,oEAAoE;IACpE,MAAMqG,mBAAmBlI,oBAAoB;IAC7C,MAAMmI,UAAU,MAAMzH,mBAAmB;QACvCwD,IAAI+D,QAAQ/D,EAAE;QACd8D;QACAI,iBAAiBnI,gBAAgBiI;QACjC/C,WAAW5B,YAAYrD,OAAOkF,kCAAkC;IAClE;IACA,IAAI,CAAC+C,SAAS;QACZ,MAAME,SAAS,MAAM9H,uBAAuB;YAAC2E,aAAa8C;QAAkB;QAC5E,IAAI,CAACK,UAAU,CAAC5D,sBAAsB4D,SAAS;YAC7C5E,qBAAqB;YACrB,MAAM,IAAI5B,kBAAkB;QAC9B;QACA,MAAM2D,QAAQ,MAAM7B,gBAAgBC,MAAMnB,OAAOoB,UAAU,EAAEwE,OAAOpD,SAAS;QAC7ExB,qBAAqB;QACrB,OAAO;YAAC+B;YAAOd,cAAcoD;YAAWlE;YAAM6B;QAAS;IACzD;IAEA,MAAMD,QAAQ,MAAM7B,gBAAgBC,MAAMnB,OAAOoB,UAAU,EAAEoE,QAAQhD,SAAS;IAC9ExB,qBAAqB;IACrB,OAAO;QAAC+B;QAAOd,cAAcwD;QAAkBtE;QAAM6B;IAAS;AAChE;AAaA,OAAO,eAAe6C,yBAAyB7F,MAK9C;IACC,MAAMmB,OAAO,MAAM/C,gBAAgB;QAAC+B,OAAOpD,YAAY2G,KAAK,CAAC1D,OAAOG,KAAK;IAAC;IAC1E,IAAI,CAACgB,MAAM,MAAM,IAAI/B,kBAAkB;IACvC,MAAMpC,sBAAsB;QAACyE,IAAIzB,OAAO8F,WAAW;QAAEtC,MAAMxD,OAAOwD,IAAI;QAAEY,cAAcjD,KAAKM,EAAE;IAAA;IAC7F,MAAMxE,2BAA2B;QAC/BwE,IAAIzB,OAAO8F,WAAW;QACtB3B,SAASzE;QACT0E,cAAcjD,KAAKM,EAAE;IACvB;IAEA,MAAMsE,eAAe,MAAMzH,kBAAkB;QAACkD,QAAQL,KAAKM,EAAE;IAAA;IAC7D,IAAIsE,cAAcjC,WAAW,UAAU;QACrC,MAAM,IAAI1E,kBAAkB;IAC9B;IAEA,MAAM,EAAC2D,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAC7CmD,cACA/F,OAAOoB,UAAU;IAGnB,OAAO;QAAC2B;QAAOd;QAAcd,MAAM4E;QAAc/C;IAAS;AAC5D;AAEA,OAAO,eAAegD,wBAAwBhG,MAI7C;IACC,MAAMmB,OAAO,MAAM/C,gBAAgB;QAAC+B,OAAOpD,YAAY2G,KAAK,CAAC1D,OAAOG,KAAK;IAAC;IAC1E,IAAI,CAACgB,QAAQA,KAAK4C,eAAe,IAAI5C,KAAK2C,MAAM,KAAK,UAAU;QAC7D,OAAO;YAACmC,uBAAuB,IAAIrF;QAAM;IAC3C;IACA,MAAMX,SAAS,MAAM9C,qBAAqB;QACxCsE,IAAIzB,OAAO8F,WAAW;QACtB1B,cAAcjD,KAAKM,EAAE;QACrB6C,UAAUtE,OAAOsE,QAAQ;IAC3B;IAEA,OAAO;QAAC2B,uBAAuBhG,OAAOgG,qBAAqB;IAAA;AAC7D;AAEA,OAAO,eAAeC,qBAAqBlG,MAAuB;IAChE,MAAMmB,OAAO,MAAM/C,gBAAgB;QAAC+B,OAAOH,OAAOG,KAAK;IAAA;IACvD,IAAIgB,MAAM2C,WAAW,YAAY3C,KAAK6C,cAAc,KAAK,MAAM;QAC7D;IACF;IAEA,MAAMd,WAAW3F,oBAAoB;IACrC,MAAMI,oBAAoB;QACxB6D,QAAQL,KAAKM,EAAE;QACfgB,aAAajF,gBAAgB0F;QAC7BR,WAAWhC,aAAajB;QACxB0G,WAAW;YACThG,OAAOgB,KAAKhB,KAAK;YACjBiG,WAAWnD,kBAAkBC;YAC7BmD,gBAAgB5G;QAClB;IACF;AACF;AASA,OAAO,eAAe6G,qBAAqBtG,MAI1C;IACC,MAAMuG,WAAW,MAAM7I,qBAAqB;QAAC+E,aAAajF,gBAAgBwC,OAAO+C,KAAK;IAAC;IACvF,IAAI,CAACwD,UAAU;QACb,MAAM,IAAInH,kBAAkB;IAC9B;IAEA,MAAMoH,eAAe,MAAMnI,aAAa;QAACoD,IAAI8E,SAAS/E,MAAM;IAAA;IAC5D,IAAIgF,cAAc1C,WAAW,YAAY0C,aAAaxC,cAAc,KAAK,MAAM;QAC7E,MAAM,IAAI5E,kBAAkB;IAC9B;IAEA,MAAM4E,iBAAiB,MAAMzE,aAAa;QAACkB,UAAUT,OAAOyG,WAAW;IAAA;IACvE,MAAMtF,OAAO,MAAM1C,mBAAmB;QAAC+C,QAAQ+E,SAAS/E,MAAM;QAAEwC;IAAc;IAC9E,IAAI7C,MAAM2C,WAAW,UAAU;QAC7B,MAAM,IAAI1E,kBAAkB;IAC9B;IAEA,MAAMpB,2BAA2B;QAACwD,QAAQ+E,SAAS/E,MAAM;IAAA;IAEzD,MAAM,EAACuB,KAAK,EAAEd,YAAY,EAAEe,SAAS,EAAC,GAAG,MAAMJ,oBAAoBzB,MAAMnB,OAAOoB,UAAU;IAE1F,OAAO;QAAC2B;QAAOd;QAAcd;QAAM6B;IAAS;AAC9C;AAEA,OAAO,eAAe0D,eAAe1G,MAKpC;IACC,MAAMmB,OAAO,MAAM9C,aAAa;QAACoD,IAAIzB,OAAOwB,MAAM;IAAA;IAClD,IAAI,CAACL,MAAM;QACT,MAAM,IAAI9B,kBAAkBW,OAAOwB,MAAM;IAC3C;IAEA,MAAM0D,cAAc/D,KAAK6C,cAAc,KAAK;IAC5C,MAAMmB,KAAK,MAAM3F,eAAe;QAC9BiB,UAAUT,OAAO2G,eAAe;QAChC1C,MAAM9C,KAAK6C,cAAc,IAAK,MAAMxD;IACtC;IACA,IAAI,CAAC0E,eAAe,CAACC,IAAI;QACvB,MAAM,IAAIpG;IACZ;IAEA,MAAMiF,iBAAiB,MAAMzE,aAAa;QAACkB,UAAUT,OAAOyG,WAAW;IAAA;IACvE,MAAMG,wBAAwB5G,OAAOiC,YAAY,GAC7C,MAAMpE,6BAA6B;QAAC4E,aAAajF,gBAAgBwC,OAAOiC,YAAY;IAAC,KACrFoD;IACJ,MAAMwB,uBACJD,uBAAuBpF,WAAWL,KAAKM,EAAE,GAAGmF,sBAAsBnF,EAAE,GAAG4D;IAEzE,MAAM5G,mBAAmB;QAAC+C,QAAQL,KAAKM,EAAE;QAAEuC;IAAc;IACzD,MAAMhG,2BAA2B;QAACwD,QAAQL,KAAKM,EAAE;QAAEoF;IAAoB;AACzE;AAEA,OAAO,eAAeC,OAAO9G,MAA2C;IACtE,IAAI,CAACA,OAAOiC,YAAY,EAAE;IAC1B,MAAMA,eAAe,MAAMnE,uBAAuB;QAChD2E,aAAajF,gBAAgBwC,OAAOiC,YAAY;IAClD;IACA,IAAI,CAACA,cAAc;IACnB,MAAMlE,qBAAqB;QAACyE,WAAWP,aAAaO,SAAS;QAAEhB,QAAQS,aAAaT,MAAM;IAAA;AAC5F;AAMA,OAAO,eAAeuF,eAAe/G,MAAwB;IAC3D,MAAMmB,OAAO,MAAM9C,aAAa;QAACoD,IAAIzB,OAAOwB,MAAM;IAAA;IAClD,IAAI,CAACL,MAAM;QACT,MAAM,IAAI9B,kBAAkBW,OAAOwB,MAAM;IAC3C;IAEA,OAAO;QAACL;IAAI;AACd"}

package/dist/core/entities/admin-grant.d.ts

@@ -0,0 +1,10 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+export interface AdminGrant {
+    id: string;
+    userId: string;
+    role: AdminRole;
+    revokedAt: Date | null;
+    createdAt: Date;
+    updatedAt: Date;
+}
+//# sourceMappingURL=admin-grant.d.ts.map

package/dist/core/entities/admin-grant.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-grant.d.ts","sourceRoot":"","sources":["../../../src/core/entities/admin-grant.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAErD,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,IAAI,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;CACjB"}

package/dist/core/entities/admin-grant.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=admin-grant.js.map

package/dist/core/entities/admin-grant.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/core/entities/admin-grant.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\n\nexport interface AdminGrant {\n  id: string;\n  userId: string;\n  role: AdminRole;\n  revokedAt: Date | null;\n  createdAt: Date;\n  updatedAt: Date;\n}\n"],"names":[],"mappings":"AAEA,WAOC"}

package/dist/core/errors.d.ts

@@ -19,6 +19,9 @@ export declare class UserNotFoundError extends Error {
 export declare class EmailTakenError extends Error {
     constructor(email: string);
 }
+export declare class SignupNotAllowedError extends Error {
+    constructor(message: string);
+}
 export declare class InvalidCredentialsError extends Error {
     constructor();
 }
@@ -30,6 +33,13 @@ export declare class AuthDependencyUnavailableError extends Error {
     readonly cause: unknown;
     constructor(dependency: string, cause: unknown);
 }
+export declare class AdminRoleRequiredError extends Error {
+    readonly minimumRole: import('@shipfox/api-auth-dto').AdminRole;
+    constructor(minimumRole: import('@shipfox/api-auth-dto').AdminRole);
+}
+export declare class LastAdminOwnerError extends Error {
+    constructor();
+}
 export declare class TokenInvalidError extends Error {
     constructor(reason?: string);
 }

package/dist/core/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAM/C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,EAAE,MAAM;CAI1B"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/core/errors.ts"],"names":[],"mappings":"AAAA,qBAAa,sBAAuB,SAAQ,KAAK;gBACnC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,EAAE,EAAE,MAAM;CAIvB;AAED,qBAAa,gCAAiC,SAAQ,KAAK;;CAK1D;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM;CAIhD;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,SAAS,EAAE,MAAM;CAI9B;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,KAAK,EAAE,MAAM;CAI1B;AAED,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,uBAAwB,SAAQ,KAAK;;CAKjD;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,8BAA+B,SAAQ,KAAK;IACvD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,SAAkB,KAAK,EAAE,OAAO,CAAC;gBAErB,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO;CAM/C;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS,CAAC;gBAEpD,WAAW,EAAE,OAAO,uBAAuB,EAAE,SAAS;CAKnE;AAED,qBAAa,mBAAoB,SAAQ,KAAK;;CAK7C;AAED,qBAAa,iBAAkB,SAAQ,KAAK;gBAC9B,MAAM,CAAC,EAAE,MAAM;CAI5B;AAED,qBAAa,iBAAkB,SAAQ,KAAK;;CAK3C;AAED,qBAAa,qBAAsB,SAAQ,KAAK;;CAK/C;AAED,qBAAa,uBAAwB,SAAQ,KAAK;gBACpC,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,eAAgB,SAAQ,KAAK;gBAC5B,WAAW,EAAE,MAAM;CAIhC;AAED,qBAAa,4BAA6B,SAAQ,KAAK;;CAKtD;AAED,qBAAa,yBAA0B,SAAQ,KAAK;gBACtC,KAAK,EAAE,MAAM;CAI1B"}

package/dist/core/errors.js

@@ -40,6 +40,12 @@ export class EmailTakenError extends Error {
         this.name = 'EmailTakenError';
     }
 }
+export class SignupNotAllowedError extends Error {
+    constructor(message){
+        super(message);
+        this.name = 'SignupNotAllowedError';
+    }
+}
 export class InvalidCredentialsError extends Error {
     constructor(){
         super('Invalid credentials');
@@ -60,6 +66,19 @@ export class AuthDependencyUnavailableError extends Error {
         this.cause = cause;
     }
 }
+export class AdminRoleRequiredError extends Error {
+    constructor(minimumRole){
+        super(`Administrator role required: ${minimumRole}`);
+        this.name = 'AdminRoleRequiredError';
+        this.minimumRole = minimumRole;
+    }
+}
+export class LastAdminOwnerError extends Error {
+    constructor(){
+        super('Cannot remove the final active administrator owner');
+        this.name = 'LastAdminOwnerError';
+    }
+}
 export class TokenInvalidError extends Error {
     constructor(reason){
         super(reason ? `Invalid token: ${reason}` : 'Invalid token');

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class ApiKeyNotFoundError extends Error {\n  constructor(id: string) {\n    super(`API key not found: ${id}`);\n    this.name = 'ApiKeyNotFoundError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class AuthDependencyUnavailableError extends Error {\n  readonly dependency: string;\n  override readonly cause: unknown;\n\n  constructor(dependency: string, cause: unknown) {\n    super(`Authentication dependency unavailable: ${dependency}`);\n    this.name = 'AuthDependencyUnavailableError';\n    this.dependency = dependency;\n    this.cause = cause;\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","ApiKeyNotFoundError","id","InvitationNotFoundError","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","InvalidCredentialsError","EmailNotVerifiedError","AuthDependencyUnavailableError","dependency","cause","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4BAA4BH;IACvC,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,mBAAmB,EAAEA,IAAI;QAChC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMG,gCAAgCL;IAC3C,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,gCAAgCb;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMY,8BAA8Bd;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,uCAAuCf;IAIlD,YAAYgB,UAAkB,EAAEC,KAAc,CAAE;QAC9C,KAAK,CAAC,CAAC,uCAAuC,EAAED,YAAY;QAC5D,IAAI,CAACd,IAAI,GAAG;QACZ,IAAI,CAACc,UAAU,GAAGA;QAClB,IAAI,CAACC,KAAK,GAAGA;IACf;AACF;AAEA,OAAO,MAAMC,0BAA0BlB;IACrC,YAAYmB,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAACjB,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMkB,0BAA0BpB;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMmB,8BAA8BrB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMoB,gCAAgCtB;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,wBAAwBvB;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMsB,qCAAqCxB;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMuB,kCAAkCzB;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class ApiKeyNotFoundError extends Error {\n  constructor(id: string) {\n    super(`API key not found: ${id}`);\n    this.name = 'ApiKeyNotFoundError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class SignupNotAllowedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignupNotAllowedError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class AuthDependencyUnavailableError extends Error {\n  readonly dependency: string;\n  override readonly cause: unknown;\n\n  constructor(dependency: string, cause: unknown) {\n    super(`Authentication dependency unavailable: ${dependency}`);\n    this.name = 'AuthDependencyUnavailableError';\n    this.dependency = dependency;\n    this.cause = cause;\n  }\n}\n\nexport class AdminRoleRequiredError extends Error {\n  readonly minimumRole: import('@shipfox/api-auth-dto').AdminRole;\n\n  constructor(minimumRole: import('@shipfox/api-auth-dto').AdminRole) {\n    super(`Administrator role required: ${minimumRole}`);\n    this.name = 'AdminRoleRequiredError';\n    this.minimumRole = minimumRole;\n  }\n}\n\nexport class LastAdminOwnerError extends Error {\n  constructor() {\n    super('Cannot remove the final active administrator owner');\n    this.name = 'LastAdminOwnerError';\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","ApiKeyNotFoundError","id","InvitationNotFoundError","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","SignupNotAllowedError","message","InvalidCredentialsError","EmailNotVerifiedError","AuthDependencyUnavailableError","dependency","cause","AdminRoleRequiredError","minimumRole","LastAdminOwnerError","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4BAA4BH;IACvC,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,mBAAmB,EAAEA,IAAI;QAChC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMG,gCAAgCL;IAC3C,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,8BAA8Bb;IACzC,YAAYc,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACZ,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,gCAAgCf;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMc,8BAA8BhB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMe,uCAAuCjB;IAIlD,YAAYkB,UAAkB,EAAEC,KAAc,CAAE;QAC9C,KAAK,CAAC,CAAC,uCAAuC,EAAED,YAAY;QAC5D,IAAI,CAAChB,IAAI,GAAG;QACZ,IAAI,CAACgB,UAAU,GAAGA;QAClB,IAAI,CAACC,KAAK,GAAGA;IACf;AACF;AAEA,OAAO,MAAMC,+BAA+BpB;IAG1C,YAAYqB,WAAsD,CAAE;QAClE,KAAK,CAAC,CAAC,6BAA6B,EAAEA,aAAa;QACnD,IAAI,CAACnB,IAAI,GAAG;QACZ,IAAI,CAACmB,WAAW,GAAGA;IACrB;AACF;AAEA,OAAO,MAAMC,4BAA4BtB;IACvC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,0BAA0BvB;IACrC,YAAYwB,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAACtB,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMuB,0BAA0BzB;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMwB,8BAA8B1B;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMyB,gCAAgC3B;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM0B,wBAAwB5B;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM2B,qCAAqC7B;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM4B,kCAAkC9B;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}

package/dist/core/ports.d.ts

@@ -0,0 +1,13 @@
+export interface SignupPolicy {
+    isSignupAllowed(params: {
+        email: string;
+        emailVerified: boolean;
+        source: string;
+    }): Promise<{
+        allowed: true;
+    } | {
+        allowed: false;
+        message?: string;
+    }>;
+}
+//# sourceMappingURL=ports.d.ts.map

package/dist/core/ports.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ports.d.ts","sourceRoot":"","sources":["../../src/core/ports.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,eAAe,CAAC,MAAM,EAAE;QACtB,KAAK,EAAE,MAAM,CAAC;QACd,aAAa,EAAE,OAAO,CAAC;QACvB,MAAM,EAAE,MAAM,CAAC;KAChB,GAAG,OAAO,CAAC;QAAC,OAAO,EAAE,IAAI,CAAA;KAAC,GAAG;QAAC,OAAO,EAAE,KAAK,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAC,CAAC,CAAC;CACnE"}

package/dist/core/ports.js

@@ -0,0 +1,3 @@
+export { };
+
+//# sourceMappingURL=ports.js.map

package/dist/core/ports.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/ports.ts"],"sourcesContent":["export interface SignupPolicy {\n  isSignupAllowed(params: {\n    email: string;\n    emailVerified: boolean;\n    source: string;\n  }): Promise<{allowed: true} | {allowed: false; message?: string}>;\n}\n"],"names":[],"mappings":"AAAA,WAMC"}

package/dist/core/signup-policy.d.ts

@@ -0,0 +1,10 @@
+import type { SignupPolicy } from './ports.js';
+export declare const DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE = "This Shipfox deployment does not accept new accounts right now.";
+/**
+ * Builds the default signup policy from the Auth module's environment settings.
+ *
+ * The allowlist is resolved once at startup. Environment values are normalized
+ * before matching, but the configured denial message is returned unchanged.
+ */
+export declare function createEnvironmentSignupPolicy(): SignupPolicy;
+//# sourceMappingURL=signup-policy.d.ts.map

package/dist/core/signup-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"signup-policy.d.ts","sourceRoot":"","sources":["../../src/core/signup-policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,YAAY,CAAC;AAE7C,eAAO,MAAM,kCAAkC,oEACoB,CAAC;AAEpE;;;;;GAKG;AACH,wBAAgB,6BAA6B,IAAI,YAAY,CAqB5D"}

package/dist/core/signup-policy.js

@@ -0,0 +1,39 @@
+import { config } from '#config.js';
+export const DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE = 'This Shipfox deployment does not accept new accounts right now.';
+/**
+ * Builds the default signup policy from the Auth module's environment settings.
+ *
+ * The allowlist is resolved once at startup. Environment values are normalized
+ * before matching, but the configured denial message is returned unchanged.
+ */ export function createEnvironmentSignupPolicy() {
+    const allowedEmails = parseAllowlist(config.AUTH_SIGNUP_ALLOWED_EMAILS);
+    const allowedDomains = parseAllowlist(config.AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS);
+    return {
+        isSignupAllowed ({ email }) {
+            if (!config.AUTH_SIGNUP_GATE_ENABLED) return Promise.resolve({
+                allowed: true
+            });
+            const normalizedEmail = normalize(email);
+            if (allowedEmails.has(normalizedEmail)) return Promise.resolve({
+                allowed: true
+            });
+            const atIndex = normalizedEmail.lastIndexOf('@');
+            const domain = atIndex === -1 ? '' : normalizedEmail.slice(atIndex + 1);
+            if (allowedDomains.has(domain)) return Promise.resolve({
+                allowed: true
+            });
+            return Promise.resolve({
+                allowed: false,
+                message: config.AUTH_SIGNUP_NOT_ALLOWED_MESSAGE ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE
+            });
+        }
+    };
+}
+function parseAllowlist(value) {
+    return new Set(value.split(',').map(normalize).filter(Boolean));
+}
+function normalize(value) {
+    return value.trim().toLowerCase();
+}
+
+//# sourceMappingURL=signup-policy.js.map

package/dist/core/signup-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/signup-policy.ts"],"sourcesContent":["import {config} from '#config.js';\nimport type {SignupPolicy} from './ports.js';\n\nexport const DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE =\n  'This Shipfox deployment does not accept new accounts right now.';\n\n/**\n * Builds the default signup policy from the Auth module's environment settings.\n *\n * The allowlist is resolved once at startup. Environment values are normalized\n * before matching, but the configured denial message is returned unchanged.\n */\nexport function createEnvironmentSignupPolicy(): SignupPolicy {\n  const allowedEmails = parseAllowlist(config.AUTH_SIGNUP_ALLOWED_EMAILS);\n  const allowedDomains = parseAllowlist(config.AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS);\n\n  return {\n    isSignupAllowed({email}) {\n      if (!config.AUTH_SIGNUP_GATE_ENABLED) return Promise.resolve({allowed: true});\n\n      const normalizedEmail = normalize(email);\n      if (allowedEmails.has(normalizedEmail)) return Promise.resolve({allowed: true});\n\n      const atIndex = normalizedEmail.lastIndexOf('@');\n      const domain = atIndex === -1 ? '' : normalizedEmail.slice(atIndex + 1);\n      if (allowedDomains.has(domain)) return Promise.resolve({allowed: true});\n\n      return Promise.resolve({\n        allowed: false,\n        message: config.AUTH_SIGNUP_NOT_ALLOWED_MESSAGE ?? DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE,\n      });\n    },\n  };\n}\n\nfunction parseAllowlist(value: string): ReadonlySet<string> {\n  return new Set(value.split(',').map(normalize).filter(Boolean));\n}\n\nfunction normalize(value: string): string {\n  return value.trim().toLowerCase();\n}\n"],"names":["config","DEFAULT_SIGNUP_NOT_ALLOWED_MESSAGE","createEnvironmentSignupPolicy","allowedEmails","parseAllowlist","AUTH_SIGNUP_ALLOWED_EMAILS","allowedDomains","AUTH_SIGNUP_ALLOWED_EMAIL_DOMAINS","isSignupAllowed","email","AUTH_SIGNUP_GATE_ENABLED","Promise","resolve","allowed","normalizedEmail","normalize","has","atIndex","lastIndexOf","domain","slice","message","AUTH_SIGNUP_NOT_ALLOWED_MESSAGE","value","Set","split","map","filter","Boolean","trim","toLowerCase"],"mappings":"AAAA,SAAQA,MAAM,QAAO,aAAa;AAGlC,OAAO,MAAMC,qCACX,kEAAkE;AAEpE;;;;;CAKC,GACD,OAAO,SAASC;IACd,MAAMC,gBAAgBC,eAAeJ,OAAOK,0BAA0B;IACtE,MAAMC,iBAAiBF,eAAeJ,OAAOO,iCAAiC;IAE9E,OAAO;QACLC,iBAAgB,EAACC,KAAK,EAAC;YACrB,IAAI,CAACT,OAAOU,wBAAwB,EAAE,OAAOC,QAAQC,OAAO,CAAC;gBAACC,SAAS;YAAI;YAE3E,MAAMC,kBAAkBC,UAAUN;YAClC,IAAIN,cAAca,GAAG,CAACF,kBAAkB,OAAOH,QAAQC,OAAO,CAAC;gBAACC,SAAS;YAAI;YAE7E,MAAMI,UAAUH,gBAAgBI,WAAW,CAAC;YAC5C,MAAMC,SAASF,YAAY,CAAC,IAAI,KAAKH,gBAAgBM,KAAK,CAACH,UAAU;YACrE,IAAIX,eAAeU,GAAG,CAACG,SAAS,OAAOR,QAAQC,OAAO,CAAC;gBAACC,SAAS;YAAI;YAErE,OAAOF,QAAQC,OAAO,CAAC;gBACrBC,SAAS;gBACTQ,SAASrB,OAAOsB,+BAA+B,IAAIrB;YACrD;QACF;IACF;AACF;AAEA,SAASG,eAAemB,KAAa;IACnC,OAAO,IAAIC,IAAID,MAAME,KAAK,CAAC,KAAKC,GAAG,CAACX,WAAWY,MAAM,CAACC;AACxD;AAEA,SAASb,UAAUQ,KAAa;IAC9B,OAAOA,MAAMM,IAAI,GAAGC,WAAW;AACjC"}

package/dist/db/admin-grants.d.ts

@@ -0,0 +1,15 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+import type { AdminGrant } from '#core/entities/admin-grant.js';
+export interface CreateAdminGrantParams {
+    userId: string;
+    role: AdminRole;
+}
+export declare function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant>;
+export declare function listAdminGrants(): Promise<AdminGrant[]>;
+export declare function findCurrentAdminRole(params: {
+    userId: string;
+}): Promise<AdminRole | null>;
+export declare function revokeAdminGrant(params: {
+    grantId: string;
+}): Promise<AdminGrant | undefined>;
+//# sourceMappingURL=admin-grants.d.ts.map

package/dist/db/admin-grants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-grants.d.ts","sourceRoot":"","sources":["../../src/db/admin-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAM9D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ1F;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAG7D;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAc9F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAqCjG"}

package/dist/db/admin-grants.js

@@ -0,0 +1,49 @@
+import { and, asc, eq, isNull, sql } from 'drizzle-orm';
+import { highestAdminRole } from '#core/admin-role-model.js';
+import { LastAdminOwnerError } from '#core/errors.js';
+import { db } from './db.js';
+import { adminGrants, toAdminGrant } from './schema/admin-grants.js';
+import { users } from './schema/users.js';
+export async function createAdminGrant(params) {
+    const rows = await db().insert(adminGrants).values({
+        userId: params.userId,
+        role: params.role
+    }).returning();
+    const row = rows[0];
+    if (!row) throw new Error('Insert returned no rows');
+    return toAdminGrant(row);
+}
+export async function listAdminGrants() {
+    const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));
+    return rows.map(toAdminGrant);
+}
+export async function findCurrentAdminRole(params) {
+    const rows = await db().select({
+        role: adminGrants.role
+    }).from(adminGrants).innerJoin(users, eq(adminGrants.userId, users.id)).where(and(eq(adminGrants.userId, params.userId), isNull(adminGrants.revokedAt), eq(users.status, 'active')));
+    return highestAdminRole(rows.map(({ role })=>role));
+}
+export async function revokeAdminGrant(params) {
+    return await db().transaction(async (tx)=>{
+        // All owner grant changes share one lock so concurrent revocations cannot
+        // both observe the same final owner and leave the instance ownerless.
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+        const rows = await tx.select().from(adminGrants).where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt))).limit(1);
+        const grant = rows[0];
+        if (!grant) return undefined;
+        if (grant.role === 'admin-owner') {
+            const activeOwners = await tx.select({
+                id: adminGrants.id
+            }).from(adminGrants).innerJoin(users, eq(adminGrants.userId, users.id)).where(and(eq(adminGrants.role, 'admin-owner'), isNull(adminGrants.revokedAt), eq(users.status, 'active')));
+            if (activeOwners.length <= 1) throw new LastAdminOwnerError();
+        }
+        const updated = await tx.update(adminGrants).set({
+            revokedAt: new Date(),
+            updatedAt: new Date()
+        }).where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt))).returning();
+        const row = updated[0];
+        return row ? toAdminGrant(row) : undefined;
+    });
+}
+
+//# sourceMappingURL=admin-grants.js.map

package/dist/db/admin-grants.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/admin-grants.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {and, asc, eq, isNull, sql} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {LastAdminOwnerError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {adminGrants, toAdminGrant} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\nexport interface CreateAdminGrantParams {\n  userId: string;\n  role: AdminRole;\n}\n\nexport async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {\n  const rows = await db()\n    .insert(adminGrants)\n    .values({userId: params.userId, role: params.role})\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAdminGrant(row);\n}\n\nexport async function listAdminGrants(): Promise<AdminGrant[]> {\n  const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));\n  return rows.map(toAdminGrant);\n}\n\nexport async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  const rows = await db()\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(\n      and(\n        eq(adminGrants.userId, params.userId),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    );\n\n  return highestAdminRole(rows.map(({role}) => role));\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {\n  return await db().transaction(async (tx) => {\n    // All owner grant changes share one lock so concurrent revocations cannot\n    // both observe the same final owner and leave the instance ownerless.\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) return undefined;\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const row = updated[0];\n    return row ? toAdminGrant(row) : undefined;\n  });\n}\n"],"names":["and","asc","eq","isNull","sql","highestAdminRole","LastAdminOwnerError","db","adminGrants","toAdminGrant","users","createAdminGrant","params","rows","insert","values","userId","role","returning","row","Error","listAdminGrants","select","from","orderBy","createdAt","map","findCurrentAdminRole","innerJoin","id","where","revokedAt","status","revokeAdminGrant","transaction","tx","execute","grantId","limit","grant","undefined","activeOwners","length","updated","update","set","Date","updatedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACtD,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SAAQC,mBAAmB,QAAO,kBAAkB;AACpD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,WAAW,EAAEC,YAAY,QAAO,2BAA2B;AACnE,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,OAAO,eAAeC,iBAAiBC,MAA8B;IACnE,MAAMC,OAAO,MAAMN,KAChBO,MAAM,CAACN,aACPO,MAAM,CAAC;QAACC,QAAQJ,OAAOI,MAAM;QAAEC,MAAML,OAAOK,IAAI;IAAA,GAChDC,SAAS;IACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOX,aAAaU;AACtB;AAEA,OAAO,eAAeE;IACpB,MAAMR,OAAO,MAAMN,KAAKe,MAAM,GAAGC,IAAI,CAACf,aAAagB,OAAO,CAACvB,IAAIO,YAAYiB,SAAS;IACpF,OAAOZ,KAAKa,GAAG,CAACjB;AAClB;AAEA,OAAO,eAAekB,qBAAqBf,MAAwB;IACjE,MAAMC,OAAO,MAAMN,KAChBe,MAAM,CAAC;QAACL,MAAMT,YAAYS,IAAI;IAAA,GAC9BM,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYQ,MAAM,EAAEJ,OAAOI,MAAM,GACpCb,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;IAIvB,OAAO3B,iBAAiBQ,KAAKa,GAAG,CAAC,CAAC,EAACT,IAAI,EAAC,GAAKA;AAC/C;AAEA,OAAO,eAAegB,iBAAiBrB,MAAyB;IAC9D,OAAO,MAAML,KAAK2B,WAAW,CAAC,OAAOC;QACnC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAMA,GAAGC,OAAO,CAAChC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMS,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAACf,aACLsB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEjB,OAAOyB,OAAO,GAAGlC,OAAOK,YAAYuB,SAAS,IAC1EO,KAAK,CAAC;QACT,MAAMC,QAAQ1B,IAAI,CAAC,EAAE;QACrB,IAAI,CAAC0B,OAAO,OAAOC;QAEnB,IAAID,MAAMtB,IAAI,KAAK,eAAe;YAChC,MAAMwB,eAAe,MAAMN,GACxBb,MAAM,CAAC;gBAACO,IAAIrB,YAAYqB,EAAE;YAAA,GAC1BN,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYS,IAAI,EAAE,gBACrBd,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;YAGvB,IAAIS,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAIpC;QAC1C;QAEA,MAAMqC,UAAU,MAAMR,GACnBS,MAAM,CAACpC,aACPqC,GAAG,CAAC;YAACd,WAAW,IAAIe;YAAQC,WAAW,IAAID;QAAM,GACjDhB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEU,MAAMV,EAAE,GAAG1B,OAAOK,YAAYuB,SAAS,IACpEb,SAAS;QACZ,MAAMC,MAAMwB,OAAO,CAAC,EAAE;QACtB,OAAOxB,MAAMV,aAAaU,OAAOqB;IACnC;AACF"}