@shipfox/api-auth 9.2.0 → 10.0.0

package/dist/db/admin-grants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/admin-grants.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {and, asc, eq, isNull, sql} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {LastAdminOwnerError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {adminGrants, toAdminGrant} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\nexport interface CreateAdminGrantParams {\n  userId: string;\n  role: AdminRole;\n}\n\nexport async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {\n  const rows = await db()\n    .insert(adminGrants)\n    .values({userId: params.userId, role: params.role})\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAdminGrant(row);\n}\n\nexport async function listAdminGrants(): Promise<AdminGrant[]> {\n  const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));\n  return rows.map(toAdminGrant);\n}\n\nexport async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  const rows = await db()\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(\n      and(\n        eq(adminGrants.userId, params.userId),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    );\n\n  return highestAdminRole(rows.map(({role}) => role));\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {\n  return await db().transaction(async (tx) => {\n    // All owner grant changes share one lock so concurrent revocations cannot\n    // both observe the same final owner and leave the instance ownerless.\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) return undefined;\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const row = updated[0];\n    return row ? toAdminGrant(row) : undefined;\n  });\n}\n"],"names":["and","asc","eq","isNull","sql","highestAdminRole","LastAdminOwnerError","db","adminGrants","toAdminGrant","users","createAdminGrant","params","rows","insert","values","userId","role","returning","row","Error","listAdminGrants","select","from","orderBy","createdAt","map","findCurrentAdminRole","innerJoin","id","where","revokedAt","status","revokeAdminGrant","transaction","tx","execute","grantId","limit","grant","undefined","activeOwners","length","updated","update","set","Date","updatedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACtD,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SAAQC,mBAAmB,QAAO,kBAAkB;AACpD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,WAAW,EAAEC,YAAY,QAAO,2BAA2B;AACnE,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,OAAO,eAAeC,iBAAiBC,MAA8B;IACnE,MAAMC,OAAO,MAAMN,KAChBO,MAAM,CAACN,aACPO,MAAM,CAAC;QAACC,QAAQJ,OAAOI,MAAM;QAAEC,MAAML,OAAOK,IAAI;IAAA,GAChDC,SAAS;IACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOX,aAAaU;AACtB;AAEA,OAAO,eAAeE;IACpB,MAAMR,OAAO,MAAMN,KAAKe,MAAM,GAAGC,IAAI,CAACf,aAAagB,OAAO,CAACvB,IAAIO,YAAYiB,SAAS;IACpF,OAAOZ,KAAKa,GAAG,CAACjB;AAClB;AAEA,OAAO,eAAekB,qBAAqBf,MAAwB;IACjE,MAAMC,OAAO,MAAMN,KAChBe,MAAM,CAAC;QAACL,MAAMT,YAAYS,IAAI;IAAA,GAC9BM,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYQ,MAAM,EAAEJ,OAAOI,MAAM,GACpCb,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;IAIvB,OAAO3B,iBAAiBQ,KAAKa,GAAG,CAAC,CAAC,EAACT,IAAI,EAAC,GAAKA;AAC/C;AAEA,OAAO,eAAegB,iBAAiBrB,MAAyB;IAC9D,OAAO,MAAML,KAAK2B,WAAW,CAAC,OAAOC;QACnC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAMA,GAAGC,OAAO,CAAChC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMS,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAACf,aACLsB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEjB,OAAOyB,OAAO,GAAGlC,OAAOK,YAAYuB,SAAS,IAC1EO,KAAK,CAAC;QACT,MAAMC,QAAQ1B,IAAI,CAAC,EAAE;QACrB,IAAI,CAAC0B,OAAO,OAAOC;QAEnB,IAAID,MAAMtB,IAAI,KAAK,eAAe;YAChC,MAAMwB,eAAe,MAAMN,GACxBb,MAAM,CAAC;gBAACO,IAAIrB,YAAYqB,EAAE;YAAA,GAC1BN,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYS,IAAI,EAAE,gBACrBd,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;YAGvB,IAAIS,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAIpC;QAC1C;QAEA,MAAMqC,UAAU,MAAMR,GACnBS,MAAM,CAACpC,aACPqC,GAAG,CAAC;YAACd,WAAW,IAAIe;YAAQC,WAAW,IAAID;QAAM,GACjDhB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEU,MAAMV,EAAE,GAAG1B,OAAOK,YAAYuB,SAAS,IACpEb,SAAS;QACZ,MAAMC,MAAMwB,OAAO,CAAC,EAAE;QACtB,OAAOxB,MAAMV,aAAaU,OAAOqB;IACnC;AACF"}
+{"version":3,"sources":["../../src/db/admin-grants.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport type {\n  AdministrationActionEvent,\n  AdministrationActionEventMap,\n} from '@shipfox/api-common-dto';\nimport {\n  paginateTimestampIdRows,\n  type TimestampIdCursor,\n  timestampIdCursorWhere,\n} from '@shipfox/node-drizzle';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {and, desc, eq, isNull, sql} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport type {AdministratorGrantSummary} from '#core/entities/administrator-read-model.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {db} from './db.js';\nimport {\n  type AdminCommandResultDb,\n  adminCommandResults,\n  type StoredAdminGrant,\n} from './schema/admin-command-results.js';\nimport {adminGrants, toAdminGrant} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nexport interface CreateAdminGrantParams {\n  userId: string;\n  role: AdminRole;\n}\n\nexport async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {\n  const rows = await db()\n    .insert(adminGrants)\n    .values({userId: params.userId, role: params.role})\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAdminGrant(row);\n}\n\nexport interface AdministratorGrantSummaryRecord {\n  id: string;\n  role: AdminRole;\n  createdAt: Date;\n  revokedAt: Date | null;\n  user: AdministratorGrantSummary['user'];\n}\n\nexport async function listAdminGrantSummaries(params: {\n  limit: number;\n  cursor?: TimestampIdCursor;\n}): Promise<{\n  rows: AdministratorGrantSummaryRecord[];\n  nextCursor: TimestampIdCursor | null;\n}> {\n  const cursorCondition = timestampIdCursorWhere({\n    timestampColumn: adminGrants.createdAt,\n    idColumn: adminGrants.id,\n    cursor: params.cursor,\n  });\n  const conditions = cursorCondition ? [cursorCondition] : [];\n  const rows = await db()\n    .select({\n      id: adminGrants.id,\n      role: adminGrants.role,\n      createdAt: adminGrants.createdAt,\n      revokedAt: adminGrants.revokedAt,\n      user: {\n        id: users.id,\n        email: users.email,\n        name: users.name,\n        status: users.status,\n      },\n    })\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(and(...conditions))\n    .orderBy(desc(adminGrants.createdAt), desc(adminGrants.id))\n    .limit(params.limit + 1);\n\n  const page = paginateTimestampIdRows({rows, limit: params.limit, timestampKey: 'createdAt'});\n  return {\n    rows: page.pageRows,\n    nextCursor: page.nextCursor,\n  };\n}\n\nexport async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  const rows = await db()\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(\n      and(\n        eq(adminGrants.userId, params.userId),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    );\n\n  return highestAdminRole(rows.map(({role}) => role));\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {\n  return await db().transaction(async (tx) => {\n    // All owner grant changes share one lock so concurrent revocations cannot\n    // both observe the same final owner and leave the instance ownerless.\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) return undefined;\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const row = updated[0];\n    return row ? toAdminGrant(row) : undefined;\n  });\n}\n\ninterface AuditedAdminCommandParams {\n  actorId: string;\n  idempotencyKeyFingerprint: string;\n  requestFingerprint: string;\n  event: AdministrationActionEvent;\n}\n\nfunction toStoredAdminGrant(grant: AdminGrant): StoredAdminGrant {\n  return {\n    id: grant.id,\n    userId: grant.userId,\n    role: grant.role,\n    revokedAt: grant.revokedAt?.toISOString() ?? null,\n    createdAt: grant.createdAt.toISOString(),\n    updatedAt: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction fromStoredAdminGrant(grant: StoredAdminGrant): AdminGrant {\n  return {\n    id: grant.id,\n    userId: grant.userId,\n    role: grant.role,\n    revokedAt: grant.revokedAt ? new Date(grant.revokedAt) : null,\n    createdAt: new Date(grant.createdAt),\n    updatedAt: new Date(grant.updatedAt),\n  };\n}\n\nasync function findCommandResult(\n  tx: Tx,\n  params: Pick<\n    AuditedAdminCommandParams,\n    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'\n  > & {\n    command: string;\n  },\n): Promise<AdminGrant | undefined> {\n  const rows = await tx\n    .select()\n    .from(adminCommandResults)\n    .where(\n      and(\n        eq(adminCommandResults.actorId, params.actorId),\n        eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),\n      ),\n    )\n    .limit(1);\n  const result: AdminCommandResultDb | undefined = rows[0];\n  if (!result) return undefined;\n  if (\n    result.command !== params.command ||\n    result.requestFingerprint !== params.requestFingerprint\n  ) {\n    throw new AdminIdempotencyKeyReuseError();\n  }\n  return fromStoredAdminGrant(result.result.grant);\n}\n\nasync function storeCommandResult(\n  tx: Tx,\n  params: AuditedAdminCommandParams,\n  grant: AdminGrant,\n): Promise<void> {\n  await tx.insert(adminCommandResults).values({\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    command: params.event.command,\n    requestFingerprint: params.requestFingerprint,\n    result: {grant: toStoredAdminGrant(grant)},\n  });\n}\n\nasync function writeAdminAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {\n  await writeOutboxEvent<AdministrationActionEventMap>(tx, authOutbox, {\n    type: 'administration.action.performed',\n    payload: event,\n  });\n}\n\nasync function lockAdminCommand(\n  tx: Tx,\n  params: {actorId: string; idempotencyKeyFingerprint: string},\n) {\n  await tx.execute(\n    sql`select pg_advisory_xact_lock(hashtext(${`auth_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`,\n  );\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AuditedAdminCommandParams & {userId: string},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const activeOwners = await tx\n      .select({id: adminGrants.id})\n      .from(adminGrants)\n      .innerJoin(users, eq(adminGrants.userId, users.id))\n      .where(\n        and(\n          eq(adminGrants.role, 'admin-owner'),\n          isNull(adminGrants.revokedAt),\n          eq(users.status, 'active'),\n        ),\n      )\n      .limit(1);\n    if (activeOwners.length > 0) throw new AdminBootstrapClosedError();\n\n    const userRows = await tx\n      .select({id: users.id, status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    const user = userRows[0];\n    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);\n\n    const rows = await tx\n      .insert(adminGrants)\n      .values({userId: params.userId, role: 'admin-owner'})\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Bootstrap grant insert returned no rows');\n\n    const grant = toAdminGrant(row);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, grant);\n    return grant;\n  });\n}\n\nexport async function grantAdminRoleWithAudit(\n  params: AuditedAdminCommandParams & {userId: string; role: AdminRole},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const userRows = await tx\n      .select({id: users.id, status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    const user = userRows[0];\n    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);\n\n    const activeRows = await tx\n      .select({id: adminGrants.id})\n      .from(adminGrants)\n      .where(\n        and(\n          eq(adminGrants.userId, params.userId),\n          eq(adminGrants.role, params.role),\n          isNull(adminGrants.revokedAt),\n        ),\n      )\n      .limit(1);\n    if (activeRows.length > 0) throw new AdminGrantAlreadyExistsError();\n\n    const rows = await tx\n      .insert(adminGrants)\n      .values({userId: params.userId, role: params.role})\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Administrator grant insert returned no rows');\n\n    const grant = toAdminGrant(row);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, grant);\n    return grant;\n  });\n}\n\nexport async function revokeAdminGrantWithAudit(\n  params: AuditedAdminCommandParams & {grantId: string},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) throw new AdminGrantNotFoundError();\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const updatedRow = updated[0];\n    if (!updatedRow) throw new AdminGrantNotFoundError();\n\n    const revoked = toAdminGrant(updatedRow);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, revoked);\n    return revoked;\n  });\n}\n"],"names":["paginateTimestampIdRows","timestampIdCursorWhere","writeOutboxEvent","and","desc","eq","isNull","sql","highestAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","LastAdminOwnerError","UserNotFoundError","db","adminCommandResults","adminGrants","toAdminGrant","authOutbox","users","createAdminGrant","params","rows","insert","values","userId","role","returning","row","Error","listAdminGrantSummaries","cursorCondition","timestampColumn","createdAt","idColumn","id","cursor","conditions","select","revokedAt","user","email","name","status","from","innerJoin","where","orderBy","limit","page","timestampKey","pageRows","nextCursor","findCurrentAdminRole","map","revokeAdminGrant","transaction","tx","execute","grantId","grant","undefined","activeOwners","length","updated","update","set","Date","updatedAt","toStoredAdminGrant","toISOString","fromStoredAdminGrant","findCommandResult","actorId","idempotencyKeyFingerprint","result","command","requestFingerprint","storeCommandResult","event","writeAdminAction","type","payload","lockAdminCommand","bootstrapFirstAdminOwner","existing","userRows","grantAdminRoleWithAudit","activeRows","revokeAdminGrantWithAudit","updatedRow","revoked"],"mappings":"AAKA,SACEA,uBAAuB,EAEvBC,sBAAsB,QACjB,wBAAwB;AAC/B,SAAQC,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,GAAG,EAAEC,IAAI,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACvD,SAAQC,gBAAgB,QAAO,4BAA4B;AAG3D,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAEEC,mBAAmB,QAEd,oCAAoC;AAC3C,SAAQC,WAAW,EAAEC,YAAY,QAAO,2BAA2B;AACnE,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,KAAK,QAAO,oBAAoB;AASxC,OAAO,eAAeC,iBAAiBC,MAA8B;IACnE,MAAMC,OAAO,MAAMR,KAChBS,MAAM,CAACP,aACPQ,MAAM,CAAC;QAACC,QAAQJ,OAAOI,MAAM;QAAEC,MAAML,OAAOK,IAAI;IAAA,GAChDC,SAAS;IACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOZ,aAAaW;AACtB;AAUA,OAAO,eAAeE,wBAAwBT,MAG7C;IAIC,MAAMU,kBAAkB/B,uBAAuB;QAC7CgC,iBAAiBhB,YAAYiB,SAAS;QACtCC,UAAUlB,YAAYmB,EAAE;QACxBC,QAAQf,OAAOe,MAAM;IACvB;IACA,MAAMC,aAAaN,kBAAkB;QAACA;KAAgB,GAAG,EAAE;IAC3D,MAAMT,OAAO,MAAMR,KAChBwB,MAAM,CAAC;QACNH,IAAInB,YAAYmB,EAAE;QAClBT,MAAMV,YAAYU,IAAI;QACtBO,WAAWjB,YAAYiB,SAAS;QAChCM,WAAWvB,YAAYuB,SAAS;QAChCC,MAAM;YACJL,IAAIhB,MAAMgB,EAAE;YACZM,OAAOtB,MAAMsB,KAAK;YAClBC,MAAMvB,MAAMuB,IAAI;YAChBC,QAAQxB,MAAMwB,MAAM;QACtB;IACF,GACCC,IAAI,CAAC5B,aACL6B,SAAS,CAAC1B,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMgB,EAAE,GAChDW,KAAK,CAAC5C,OAAOmC,aACbU,OAAO,CAAC5C,KAAKa,YAAYiB,SAAS,GAAG9B,KAAKa,YAAYmB,EAAE,GACxDa,KAAK,CAAC3B,OAAO2B,KAAK,GAAG;IAExB,MAAMC,OAAOlD,wBAAwB;QAACuB;QAAM0B,OAAO3B,OAAO2B,KAAK;QAAEE,cAAc;IAAW;IAC1F,OAAO;QACL5B,MAAM2B,KAAKE,QAAQ;QACnBC,YAAYH,KAAKG,UAAU;IAC7B;AACF;AAEA,OAAO,eAAeC,qBAAqBhC,MAAwB;IACjE,MAAMC,OAAO,MAAMR,KAChBwB,MAAM,CAAC;QAACZ,MAAMV,YAAYU,IAAI;IAAA,GAC9BkB,IAAI,CAAC5B,aACL6B,SAAS,CAAC1B,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMgB,EAAE,GAChDW,KAAK,CACJ5C,IACEE,GAAGY,YAAYS,MAAM,EAAEJ,OAAOI,MAAM,GACpCpB,OAAOW,YAAYuB,SAAS,GAC5BnC,GAAGe,MAAMwB,MAAM,EAAE;IAIvB,OAAOpC,iBAAiBe,KAAKgC,GAAG,CAAC,CAAC,EAAC5B,IAAI,EAAC,GAAKA;AAC/C;AAEA,OAAO,eAAe6B,iBAAiBlC,MAAyB;IAC9D,OAAO,MAAMP,KAAK0C,WAAW,CAAC,OAAOC;QACnC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAMA,GAAGC,OAAO,CAACpD,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMgB,OAAO,MAAMmC,GAChBnB,MAAM,GACNM,IAAI,CAAC5B,aACL8B,KAAK,CAAC5C,IAAIE,GAAGY,YAAYmB,EAAE,EAAEd,OAAOsC,OAAO,GAAGtD,OAAOW,YAAYuB,SAAS,IAC1ES,KAAK,CAAC;QACT,MAAMY,QAAQtC,IAAI,CAAC,EAAE;QACrB,IAAI,CAACsC,OAAO,OAAOC;QAEnB,IAAID,MAAMlC,IAAI,KAAK,eAAe;YAChC,MAAMoC,eAAe,MAAML,GACxBnB,MAAM,CAAC;gBAACH,IAAInB,YAAYmB,EAAE;YAAA,GAC1BS,IAAI,CAAC5B,aACL6B,SAAS,CAAC1B,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMgB,EAAE,GAChDW,KAAK,CACJ5C,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYuB,SAAS,GAC5BnC,GAAGe,MAAMwB,MAAM,EAAE;YAGvB,IAAImB,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAInD;QAC1C;QAEA,MAAMoD,UAAU,MAAMP,GACnBQ,MAAM,CAACjD,aACPkD,GAAG,CAAC;YAAC3B,WAAW,IAAI4B;YAAQC,WAAW,IAAID;QAAM,GACjDrB,KAAK,CAAC5C,IAAIE,GAAGY,YAAYmB,EAAE,EAAEyB,MAAMzB,EAAE,GAAG9B,OAAOW,YAAYuB,SAAS,IACpEZ,SAAS;QACZ,MAAMC,MAAMoC,OAAO,CAAC,EAAE;QACtB,OAAOpC,MAAMX,aAAaW,OAAOiC;IACnC;AACF;AASA,SAASQ,mBAAmBT,KAAiB;IAC3C,OAAO;QACLzB,IAAIyB,MAAMzB,EAAE;QACZV,QAAQmC,MAAMnC,MAAM;QACpBC,MAAMkC,MAAMlC,IAAI;QAChBa,WAAWqB,MAAMrB,SAAS,EAAE+B,iBAAiB;QAC7CrC,WAAW2B,MAAM3B,SAAS,CAACqC,WAAW;QACtCF,WAAWR,MAAMQ,SAAS,CAACE,WAAW;IACxC;AACF;AAEA,SAASC,qBAAqBX,KAAuB;IACnD,OAAO;QACLzB,IAAIyB,MAAMzB,EAAE;QACZV,QAAQmC,MAAMnC,MAAM;QACpBC,MAAMkC,MAAMlC,IAAI;QAChBa,WAAWqB,MAAMrB,SAAS,GAAG,IAAI4B,KAAKP,MAAMrB,SAAS,IAAI;QACzDN,WAAW,IAAIkC,KAAKP,MAAM3B,SAAS;QACnCmC,WAAW,IAAID,KAAKP,MAAMQ,SAAS;IACrC;AACF;AAEA,eAAeI,kBACbf,EAAM,EACNpC,MAKC;IAED,MAAMC,OAAO,MAAMmC,GAChBnB,MAAM,GACNM,IAAI,CAAC7B,qBACL+B,KAAK,CACJ5C,IACEE,GAAGW,oBAAoB0D,OAAO,EAAEpD,OAAOoD,OAAO,GAC9CrE,GAAGW,oBAAoB2D,yBAAyB,EAAErD,OAAOqD,yBAAyB,IAGrF1B,KAAK,CAAC;IACT,MAAM2B,SAA2CrD,IAAI,CAAC,EAAE;IACxD,IAAI,CAACqD,QAAQ,OAAOd;IACpB,IACEc,OAAOC,OAAO,KAAKvD,OAAOuD,OAAO,IACjCD,OAAOE,kBAAkB,KAAKxD,OAAOwD,kBAAkB,EACvD;QACA,MAAM,IAAIlE;IACZ;IACA,OAAO4D,qBAAqBI,OAAOA,MAAM,CAACf,KAAK;AACjD;AAEA,eAAekB,mBACbrB,EAAM,EACNpC,MAAiC,EACjCuC,KAAiB;IAEjB,MAAMH,GAAGlC,MAAM,CAACR,qBAAqBS,MAAM,CAAC;QAC1CiD,SAASpD,OAAOoD,OAAO;QACvBC,2BAA2BrD,OAAOqD,yBAAyB;QAC3DE,SAASvD,OAAO0D,KAAK,CAACH,OAAO;QAC7BC,oBAAoBxD,OAAOwD,kBAAkB;QAC7CF,QAAQ;YAACf,OAAOS,mBAAmBT;QAAM;IAC3C;AACF;AAEA,eAAeoB,iBAAiBvB,EAAM,EAAEsB,KAAgC;IACtE,MAAM9E,iBAA+CwD,IAAIvC,YAAY;QACnE+D,MAAM;QACNC,SAASH;IACX;AACF;AAEA,eAAeI,iBACb1B,EAAM,EACNpC,MAA4D;IAE5D,MAAMoC,GAAGC,OAAO,CACdpD,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEe,OAAOoD,OAAO,CAAC,CAAC,EAAEpD,OAAOqD,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAE9H;AAEA,OAAO,eAAeU,yBACpB/D,MAAoD;IAEpD,OAAO,MAAMP,KAAK0C,WAAW,CAAC,OAAOC;QACnC,MAAM0B,iBAAiB1B,IAAIpC;QAC3B,MAAMoC,GAAGC,OAAO,CAACpD,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAM+E,WAAW,MAAMb,kBAAkBf,IAAI;YAC3C,GAAGpC,MAAM;YACTuD,SAASvD,OAAO0D,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAMvB,eAAe,MAAML,GACxBnB,MAAM,CAAC;YAACH,IAAInB,YAAYmB,EAAE;QAAA,GAC1BS,IAAI,CAAC5B,aACL6B,SAAS,CAAC1B,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMgB,EAAE,GAChDW,KAAK,CACJ5C,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYuB,SAAS,GAC5BnC,GAAGe,MAAMwB,MAAM,EAAE,YAGpBK,KAAK,CAAC;QACT,IAAIc,aAAaC,MAAM,GAAG,GAAG,MAAM,IAAIvD;QAEvC,MAAM8E,WAAW,MAAM7B,GACpBnB,MAAM,CAAC;YAACH,IAAIhB,MAAMgB,EAAE;YAAEQ,QAAQxB,MAAMwB,MAAM;QAAA,GAC1CC,IAAI,CAACzB,OACL2B,KAAK,CAAC1C,GAAGe,MAAMgB,EAAE,EAAEd,OAAOI,MAAM,GAChCuB,KAAK,CAAC;QACT,MAAMR,OAAO8C,QAAQ,CAAC,EAAE;QACxB,IAAI9C,MAAMG,WAAW,UAAU,MAAM,IAAI9B,kBAAkBQ,OAAOI,MAAM;QAExE,MAAMH,OAAO,MAAMmC,GAChBlC,MAAM,CAACP,aACPQ,MAAM,CAAC;YAACC,QAAQJ,OAAOI,MAAM;YAAEC,MAAM;QAAa,GAClDC,SAAS;QACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAE1B,MAAM+B,QAAQ3C,aAAaW;QAC3B,MAAMoD,iBAAiBvB,IAAIpC,OAAO0D,KAAK;QACvC,MAAMD,mBAAmBrB,IAAIpC,QAAQuC;QACrC,OAAOA;IACT;AACF;AAEA,OAAO,eAAe2B,wBACpBlE,MAAqE;IAErE,OAAO,MAAMP,KAAK0C,WAAW,CAAC,OAAOC;QACnC,MAAM0B,iBAAiB1B,IAAIpC;QAC3B,MAAMoC,GAAGC,OAAO,CAACpD,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAM+E,WAAW,MAAMb,kBAAkBf,IAAI;YAC3C,GAAGpC,MAAM;YACTuD,SAASvD,OAAO0D,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAMC,WAAW,MAAM7B,GACpBnB,MAAM,CAAC;YAACH,IAAIhB,MAAMgB,EAAE;YAAEQ,QAAQxB,MAAMwB,MAAM;QAAA,GAC1CC,IAAI,CAACzB,OACL2B,KAAK,CAAC1C,GAAGe,MAAMgB,EAAE,EAAEd,OAAOI,MAAM,GAChCuB,KAAK,CAAC;QACT,MAAMR,OAAO8C,QAAQ,CAAC,EAAE;QACxB,IAAI9C,MAAMG,WAAW,UAAU,MAAM,IAAI9B,kBAAkBQ,OAAOI,MAAM;QAExE,MAAM+D,aAAa,MAAM/B,GACtBnB,MAAM,CAAC;YAACH,IAAInB,YAAYmB,EAAE;QAAA,GAC1BS,IAAI,CAAC5B,aACL8B,KAAK,CACJ5C,IACEE,GAAGY,YAAYS,MAAM,EAAEJ,OAAOI,MAAM,GACpCrB,GAAGY,YAAYU,IAAI,EAAEL,OAAOK,IAAI,GAChCrB,OAAOW,YAAYuB,SAAS,IAG/BS,KAAK,CAAC;QACT,IAAIwC,WAAWzB,MAAM,GAAG,GAAG,MAAM,IAAItD;QAErC,MAAMa,OAAO,MAAMmC,GAChBlC,MAAM,CAACP,aACPQ,MAAM,CAAC;YAACC,QAAQJ,OAAOI,MAAM;YAAEC,MAAML,OAAOK,IAAI;QAAA,GAChDC,SAAS;QACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAE1B,MAAM+B,QAAQ3C,aAAaW;QAC3B,MAAMoD,iBAAiBvB,IAAIpC,OAAO0D,KAAK;QACvC,MAAMD,mBAAmBrB,IAAIpC,QAAQuC;QACrC,OAAOA;IACT;AACF;AAEA,OAAO,eAAe6B,0BACpBpE,MAAqD;IAErD,OAAO,MAAMP,KAAK0C,WAAW,CAAC,OAAOC;QACnC,MAAM0B,iBAAiB1B,IAAIpC;QAC3B,MAAMoC,GAAGC,OAAO,CAACpD,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAM+E,WAAW,MAAMb,kBAAkBf,IAAI;YAC3C,GAAGpC,MAAM;YACTuD,SAASvD,OAAO0D,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAM/D,OAAO,MAAMmC,GAChBnB,MAAM,GACNM,IAAI,CAAC5B,aACL8B,KAAK,CAAC5C,IAAIE,GAAGY,YAAYmB,EAAE,EAAEd,OAAOsC,OAAO,GAAGtD,OAAOW,YAAYuB,SAAS,IAC1ES,KAAK,CAAC;QACT,MAAMY,QAAQtC,IAAI,CAAC,EAAE;QACrB,IAAI,CAACsC,OAAO,MAAM,IAAIlD;QAEtB,IAAIkD,MAAMlC,IAAI,KAAK,eAAe;YAChC,MAAMoC,eAAe,MAAML,GACxBnB,MAAM,CAAC;gBAACH,IAAInB,YAAYmB,EAAE;YAAA,GAC1BS,IAAI,CAAC5B,aACL6B,SAAS,CAAC1B,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMgB,EAAE,GAChDW,KAAK,CACJ5C,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYuB,SAAS,GAC5BnC,GAAGe,MAAMwB,MAAM,EAAE;YAGvB,IAAImB,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAInD;QAC1C;QAEA,MAAMoD,UAAU,MAAMP,GACnBQ,MAAM,CAACjD,aACPkD,GAAG,CAAC;YAAC3B,WAAW,IAAI4B;YAAQC,WAAW,IAAID;QAAM,GACjDrB,KAAK,CAAC5C,IAAIE,GAAGY,YAAYmB,EAAE,EAAEyB,MAAMzB,EAAE,GAAG9B,OAAOW,YAAYuB,SAAS,IACpEZ,SAAS;QACZ,MAAM+D,aAAa1B,OAAO,CAAC,EAAE;QAC7B,IAAI,CAAC0B,YAAY,MAAM,IAAIhF;QAE3B,MAAMiF,UAAU1E,aAAayE;QAC7B,MAAMV,iBAAiBvB,IAAIpC,OAAO0D,KAAK;QACvC,MAAMD,mBAAmBrB,IAAIpC,QAAQsE;QACrC,OAAOA;IACT;AACF"}

package/dist/db/admin-users.d.ts

@@ -0,0 +1,21 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+import type { UserStatus } from '#core/entities/user.js';
+export interface AdministratorUserRecord {
+    id: string;
+    email: string;
+    name: string | null;
+    emailVerifiedAt: Date | null;
+    status: UserStatus;
+    createdAt: Date;
+    adminRole: AdminRole | null;
+}
+type AdministratorUserLookup = {
+    id: string;
+    email?: never;
+} | {
+    email: string;
+    id?: never;
+};
+export declare function findAdministratorUser(params: AdministratorUserLookup): Promise<AdministratorUserRecord | undefined>;
+export {};
+//# sourceMappingURL=admin-users.d.ts.map

package/dist/db/admin-users.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-users.d.ts","sourceRoot":"","sources":["../../src/db/admin-users.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAKvD,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,eAAe,EAAE,IAAI,GAAG,IAAI,CAAC;IAC7B,MAAM,EAAE,UAAU,CAAC;IACnB,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,SAAS,GAAG,IAAI,CAAC;CAC7B;AAED,KAAK,uBAAuB,GAAG;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,KAAK,CAAA;CAAC,GAAG;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,EAAE,CAAC,EAAE,KAAK,CAAA;CAAC,CAAC;AAEzF,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,uBAAuB,GAC9B,OAAO,CAAC,uBAAuB,GAAG,SAAS,CAAC,CAmC9C"}

package/dist/db/admin-users.js

@@ -0,0 +1,32 @@
+import { and, eq, isNull } from 'drizzle-orm';
+import { highestAdminRole } from '#core/admin-role-model.js';
+import { db } from './db.js';
+import { adminGrants } from './schema/admin-grants.js';
+import { users } from './schema/users.js';
+export async function findAdministratorUser(params) {
+    const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);
+    const rows = await db().select({
+        id: users.id,
+        email: users.email,
+        name: users.name,
+        emailVerifiedAt: users.emailVerifiedAt,
+        status: users.status,
+        createdAt: users.createdAt,
+        adminRole: adminGrants.role
+    }).from(users).leftJoin(adminGrants, and(eq(adminGrants.userId, users.id), isNull(adminGrants.revokedAt), eq(users.status, 'active'))).where(identifier);
+    const first = rows[0];
+    if (!first) return undefined;
+    return {
+        id: first.id,
+        email: first.email,
+        name: first.name,
+        emailVerifiedAt: first.emailVerifiedAt,
+        status: first.status,
+        createdAt: first.createdAt,
+        adminRole: highestAdminRole(rows.flatMap(({ adminRole })=>adminRole ? [
+                adminRole
+            ] : []))
+    };
+}
+
+//# sourceMappingURL=admin-users.js.map

package/dist/db/admin-users.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/admin-users.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {and, eq, isNull} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {UserStatus} from '#core/entities/user.js';\nimport {db} from './db.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\nexport interface AdministratorUserRecord {\n  id: string;\n  email: string;\n  name: string | null;\n  emailVerifiedAt: Date | null;\n  status: UserStatus;\n  createdAt: Date;\n  adminRole: AdminRole | null;\n}\n\ntype AdministratorUserLookup = {id: string; email?: never} | {email: string; id?: never};\n\nexport async function findAdministratorUser(\n  params: AdministratorUserLookup,\n): Promise<AdministratorUserRecord | undefined> {\n  const identifier = 'id' in params ? eq(users.id, params.id) : eq(users.email, params.email);\n  const rows = await db()\n    .select({\n      id: users.id,\n      email: users.email,\n      name: users.name,\n      emailVerifiedAt: users.emailVerifiedAt,\n      status: users.status,\n      createdAt: users.createdAt,\n      adminRole: adminGrants.role,\n    })\n    .from(users)\n    .leftJoin(\n      adminGrants,\n      and(\n        eq(adminGrants.userId, users.id),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    )\n    .where(identifier);\n\n  const first = rows[0];\n  if (!first) return undefined;\n\n  return {\n    id: first.id,\n    email: first.email,\n    name: first.name,\n    emailVerifiedAt: first.emailVerifiedAt,\n    status: first.status,\n    createdAt: first.createdAt,\n    adminRole: highestAdminRole(rows.flatMap(({adminRole}) => (adminRole ? [adminRole] : []))),\n  };\n}\n"],"names":["and","eq","isNull","highestAdminRole","db","adminGrants","users","findAdministratorUser","params","identifier","id","email","rows","select","name","emailVerifiedAt","status","createdAt","adminRole","role","from","leftJoin","userId","revokedAt","where","first","undefined","flatMap"],"mappings":"AACA,SAAQA,GAAG,EAAEC,EAAE,EAAEC,MAAM,QAAO,cAAc;AAC5C,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,KAAK,QAAO,oBAAoB;AAcxC,OAAO,eAAeC,sBACpBC,MAA+B;IAE/B,MAAMC,aAAa,QAAQD,SAASP,GAAGK,MAAMI,EAAE,EAAEF,OAAOE,EAAE,IAAIT,GAAGK,MAAMK,KAAK,EAAEH,OAAOG,KAAK;IAC1F,MAAMC,OAAO,MAAMR,KAChBS,MAAM,CAAC;QACNH,IAAIJ,MAAMI,EAAE;QACZC,OAAOL,MAAMK,KAAK;QAClBG,MAAMR,MAAMQ,IAAI;QAChBC,iBAAiBT,MAAMS,eAAe;QACtCC,QAAQV,MAAMU,MAAM;QACpBC,WAAWX,MAAMW,SAAS;QAC1BC,WAAWb,YAAYc,IAAI;IAC7B,GACCC,IAAI,CAACd,OACLe,QAAQ,CACPhB,aACAL,IACEC,GAAGI,YAAYiB,MAAM,EAAEhB,MAAMI,EAAE,GAC/BR,OAAOG,YAAYkB,SAAS,GAC5BtB,GAAGK,MAAMU,MAAM,EAAE,YAGpBQ,KAAK,CAACf;IAET,MAAMgB,QAAQb,IAAI,CAAC,EAAE;IACrB,IAAI,CAACa,OAAO,OAAOC;IAEnB,OAAO;QACLhB,IAAIe,MAAMf,EAAE;QACZC,OAAOc,MAAMd,KAAK;QAClBG,MAAMW,MAAMX,IAAI;QAChBC,iBAAiBU,MAAMV,eAAe;QACtCC,QAAQS,MAAMT,MAAM;QACpBC,WAAWQ,MAAMR,SAAS;QAC1BC,WAAWf,iBAAiBS,KAAKe,OAAO,CAAC,CAAC,EAACT,SAAS,EAAC,GAAMA,YAAY;gBAACA;aAAU,GAAG,EAAE;IACzF;AACF"}

package/dist/db/db.d.ts

@@ -109,6 +109,134 @@ export declare const schema: {
         };
         dialect: "pg";
     }>;
+    adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_command_results";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            actorId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "actor_id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            idempotencyKeyFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "idempotency_key_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            command: import("drizzle-orm/pg-core").PgColumn<{
+                name: "command";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "request_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            result: import("drizzle-orm/pg-core").PgColumn<{
+                name: "result";
+                tableName: "admin_command_results";
+                dataType: "json";
+                columnType: "PgJsonb";
+                data: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+                driverParam: unknown;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                $type: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+            }>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_command_results";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;
@@ -986,6 +1114,134 @@ export declare function db(): NodePgDatabase<{
         };
         dialect: "pg";
     }>;
+    adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_command_results";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            actorId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "actor_id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            idempotencyKeyFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "idempotency_key_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            command: import("drizzle-orm/pg-core").PgColumn<{
+                name: "command";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "request_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            result: import("drizzle-orm/pg-core").PgColumn<{
+                name: "result";
+                tableName: "admin_command_results";
+                dataType: "json";
+                columnType: "PgJsonb";
+                data: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+                driverParam: unknown;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                $type: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+            }>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_command_results";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AASnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAUnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -1,5 +1,6 @@
 import { drizzle } from '@shipfox/node-drizzle';
 import { pgClient } from '@shipfox/node-postgres';
+import { adminCommandResults } from './schema/admin-command-results.js';
 import { adminGrants } from './schema/admin-grants.js';
 import { authOutbox } from './schema/outbox.js';
 import { passwordResets } from './schema/password-resets.js';
@@ -8,6 +9,7 @@ import { refreshTokens } from './schema/refresh-tokens.js';
 import { users } from './schema/users.js';
 export const schema = {
     adminGrants,
+    adminCommandResults,
     users,
     passwordResets,
     refreshTokens,

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  adminGrants,\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","adminGrants","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBN;IACAK;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMT,QAAQC,YAAY;QAACO;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {adminCommandResults} from './schema/admin-command-results.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  adminGrants,\n  adminCommandResults,\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","adminCommandResults","adminGrants","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,mBAAmB,QAAO,oCAAoC;AACtE,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBN;IACAD;IACAM;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMV,QAAQC,YAAY;QAACQ;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}

package/dist/db/schema/admin-command-results.d.ts

@@ -0,0 +1,142 @@
+import type { AdminRole } from '@shipfox/api-auth-dto';
+export interface StoredAdminGrant {
+    id: string;
+    userId: string;
+    role: AdminRole;
+    revokedAt: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface StoredAdminCommandResult {
+    grant: StoredAdminGrant;
+}
+export declare const adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "admin_command_results";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "admin_command_results";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        actorId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "actor_id";
+            tableName: "admin_command_results";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        idempotencyKeyFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "idempotency_key_fingerprint";
+            tableName: "admin_command_results";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        command: import("drizzle-orm/pg-core").PgColumn<{
+            name: "command";
+            tableName: "admin_command_results";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "request_fingerprint";
+            tableName: "admin_command_results";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        result: import("drizzle-orm/pg-core").PgColumn<{
+            name: "result";
+            tableName: "admin_command_results";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: StoredAdminCommandResult;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: StoredAdminCommandResult;
+        }>;
+        createdAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_at";
+            tableName: "admin_command_results";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+export type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;
+//# sourceMappingURL=admin-command-results.d.ts.map

package/dist/db/schema/admin-command-results.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin-command-results.d.ts","sourceRoot":"","sources":["../../../src/db/schema/admin-command-results.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAMrD,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,gBAAgB,CAAC;CACzB;AAED,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAmB/B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG,OAAO,mBAAmB,CAAC,YAAY,CAAC"}

package/dist/db/schema/admin-command-results.js

@@ -0,0 +1,21 @@
+import { uuidv7PrimaryKey } from '@shipfox/node-drizzle';
+import { jsonb, text, timestamp, uniqueIndex, uuid } from 'drizzle-orm/pg-core';
+import { pgTable } from './common.js';
+import { users } from './users.js';
+export const adminCommandResults = pgTable('admin_command_results', {
+    id: uuidv7PrimaryKey(),
+    actorId: uuid('actor_id').notNull().references(()=>users.id, {
+        onDelete: 'cascade'
+    }),
+    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),
+    command: text('command').notNull(),
+    requestFingerprint: text('request_fingerprint').notNull(),
+    result: jsonb('result').$type().notNull(),
+    createdAt: timestamp('created_at', {
+        withTimezone: true
+    }).notNull().defaultNow()
+}, (table)=>[
+        uniqueIndex('auth_admin_command_results_actor_key_unique').on(table.actorId, table.idempotencyKeyFingerprint)
+    ]);
+
+//# sourceMappingURL=admin-command-results.js.map

package/dist/db/schema/admin-command-results.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/db/schema/admin-command-results.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {uuidv7PrimaryKey} from '@shipfox/node-drizzle';\nimport {jsonb, text, timestamp, uniqueIndex, uuid} from 'drizzle-orm/pg-core';\nimport {pgTable} from './common.js';\nimport {users} from './users.js';\n\nexport interface StoredAdminGrant {\n  id: string;\n  userId: string;\n  role: AdminRole;\n  revokedAt: string | null;\n  createdAt: string;\n  updatedAt: string;\n}\n\nexport interface StoredAdminCommandResult {\n  grant: StoredAdminGrant;\n}\n\nexport const adminCommandResults = pgTable(\n  'admin_command_results',\n  {\n    id: uuidv7PrimaryKey(),\n    actorId: uuid('actor_id')\n      .notNull()\n      .references(() => users.id, {onDelete: 'cascade'}),\n    idempotencyKeyFingerprint: text('idempotency_key_fingerprint').notNull(),\n    command: text('command').notNull(),\n    requestFingerprint: text('request_fingerprint').notNull(),\n    result: jsonb('result').$type<StoredAdminCommandResult>().notNull(),\n    createdAt: timestamp('created_at', {withTimezone: true}).notNull().defaultNow(),\n  },\n  (table) => [\n    uniqueIndex('auth_admin_command_results_actor_key_unique').on(\n      table.actorId,\n      table.idempotencyKeyFingerprint,\n    ),\n  ],\n);\n\nexport type AdminCommandResultDb = typeof adminCommandResults.$inferSelect;\n"],"names":["uuidv7PrimaryKey","jsonb","text","timestamp","uniqueIndex","uuid","pgTable","users","adminCommandResults","id","actorId","notNull","references","onDelete","idempotencyKeyFingerprint","command","requestFingerprint","result","$type","createdAt","withTimezone","defaultNow","table","on"],"mappings":"AACA,SAAQA,gBAAgB,QAAO,wBAAwB;AACvD,SAAQC,KAAK,EAAEC,IAAI,EAAEC,SAAS,EAAEC,WAAW,EAAEC,IAAI,QAAO,sBAAsB;AAC9E,SAAQC,OAAO,QAAO,cAAc;AACpC,SAAQC,KAAK,QAAO,aAAa;AAejC,OAAO,MAAMC,sBAAsBF,QACjC,yBACA;IACEG,IAAIT;IACJU,SAASL,KAAK,YACXM,OAAO,GACPC,UAAU,CAAC,IAAML,MAAME,EAAE,EAAE;QAACI,UAAU;IAAS;IAClDC,2BAA2BZ,KAAK,+BAA+BS,OAAO;IACtEI,SAASb,KAAK,WAAWS,OAAO;IAChCK,oBAAoBd,KAAK,uBAAuBS,OAAO;IACvDM,QAAQhB,MAAM,UAAUiB,KAAK,GAA6BP,OAAO;IACjEQ,WAAWhB,UAAU,cAAc;QAACiB,cAAc;IAAI,GAAGT,OAAO,GAAGU,UAAU;AAC/E,GACA,CAACC,QAAU;QACTlB,YAAY,+CAA+CmB,EAAE,CAC3DD,MAAMZ,OAAO,EACbY,MAAMR,yBAAyB;KAElC,EACD"}

package/dist/index.d.ts

@@ -2,13 +2,14 @@ import type { ShipfoxModule } from '@shipfox/node-module';
 import type { SignupPolicy } from '#core/ports.js';
 export type { AdminRole, JobLeaseTokenClaims, RunnerSessionTokenClaims } from '@shipfox/api-auth-dto';
 export { ADMIN_ROLES, getCurrentAdminRole, hasMinimumAdminRole, highestAdminRole, requireAdminRole, revokeAdminGrant, } from '#core/admin-role.js';
+export { bootstrapFirstAdminOwner, grantAdministratorRole, revokeAdministratorGrant, } from '#core/administration.js';
 export type { CreateSessionForUserError, CreateSessionForUserParams, CreateSessionForUserResult, ProvisionUserParams, } from '#core/auth.js';
 export { createSessionForUser, provisionUser } from '#core/auth.js';
 export type { EmailOwner, FindUserByEmailParams } from '#core/email-owner.js';
 export { findUserByEmail } from '#core/email-owner.js';
 export type { AdminGrant } from '#core/entities/admin-grant.js';
 export type { User, UserStatus } from '#core/entities/user.js';
-export { AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
+export { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, AdminRoleRequiredError, AuthDependencyUnavailableError, EmailNotVerifiedError, InvalidAdminBootstrapTokenError, InvalidCredentialsError, LastAdminOwnerError, SignupNotAllowedError, UserNotFoundError, } from '#core/errors.js';
 export { issueJobLeaseToken, jobLeaseParamsFrom, verifyJobLeaseToken, } from '#core/job-lease-token.js';
 export type { SignupPolicy } from '#core/ports.js';
 export { issueRunnerSessionToken, verifyRunnerSessionToken, } from '#core/runner-session-token.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAcjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAYzC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAC,aAAa,EAAC,MAAM,sBAAsB,CAAC;AAGxD,OAAO,KAAK,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AAoBjD,YAAY,EAAC,SAAS,EAAE,mBAAmB,EAAE,wBAAwB,EAAC,MAAM,uBAAuB,CAAC;AACpG,OAAO,EACL,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,EAChB,gBAAgB,EAChB,gBAAgB,GACjB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EACV,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAC,oBAAoB,EAAE,aAAa,EAAC,MAAM,eAAe,CAAC;AAClE,YAAY,EAAC,UAAU,EAAE,qBAAqB,EAAC,MAAM,sBAAsB,CAAC;AAC5E,OAAO,EAAC,eAAe,EAAC,MAAM,sBAAsB,CAAC;AACrD,YAAY,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAC9D,YAAY,EAAC,IAAI,EAAE,UAAU,EAAC,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EACL,yBAAyB,EACzB,4BAA4B,EAC5B,uBAAuB,EACvB,6BAA6B,EAC7B,sBAAsB,EACtB,8BAA8B,EAC9B,qBAAqB,EACrB,+BAA+B,EAC/B,uBAAuB,EACvB,mBAAmB,EACnB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAC,YAAY,EAAC,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACL,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,6BAA6B,EAC7B,kCAAkC,GACnC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,KAAK,2BAA2B,EAChC,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,gBAAgB,EACrB,KAAK,MAAM,GACZ,MAAM,gCAAgC,CAAC;AACxC,OAAO,EAAC,0BAA0B,EAAC,MAAM,wCAAwC,CAAC;AAClF,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EAAC,6BAA6B,EAAC,MAAM,2CAA2C,CAAC;AAIxF,MAAM,WAAW,uBAAuB;IACtC,UAAU,EAAE,OAAO,0CAA0C,EAAE,2BAA2B,CAAC;IAC3F,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED,wBAAgB,gBAAgB,CAAC,EAC/B,UAAU,EACV,YAA8C,GAC/C,EAAE,uBAAuB,GAAG,aAAa,CAgBzC"}