@shipfox/api-auth 9.2.0 → 9.3.0

package/dist/core/errors.js

@@ -79,6 +79,36 @@ export class LastAdminOwnerError extends Error {
         this.name = 'LastAdminOwnerError';
     }
 }
+export class AdminGrantNotFoundError extends Error {
+    constructor(){
+        super('Administrator grant not found');
+        this.name = 'AdminGrantNotFoundError';
+    }
+}
+export class AdminGrantAlreadyExistsError extends Error {
+    constructor(){
+        super('Administrator grant already exists');
+        this.name = 'AdminGrantAlreadyExistsError';
+    }
+}
+export class AdminBootstrapClosedError extends Error {
+    constructor(){
+        super('First administrator owner has already been created');
+        this.name = 'AdminBootstrapClosedError';
+    }
+}
+export class InvalidAdminBootstrapTokenError extends Error {
+    constructor(){
+        super('Bootstrap token is invalid');
+        this.name = 'InvalidAdminBootstrapTokenError';
+    }
+}
+export class AdminIdempotencyKeyReuseError extends Error {
+    constructor(){
+        super('Idempotency key was already used for a different command');
+        this.name = 'AdminIdempotencyKeyReuseError';
+    }
+}
 export class TokenInvalidError extends Error {
     constructor(reason){
         super(reason ? `Invalid token: ${reason}` : 'Invalid token');

package/dist/core/errors.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class ApiKeyNotFoundError extends Error {\n  constructor(id: string) {\n    super(`API key not found: ${id}`);\n    this.name = 'ApiKeyNotFoundError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class SignupNotAllowedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignupNotAllowedError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class AuthDependencyUnavailableError extends Error {\n  readonly dependency: string;\n  override readonly cause: unknown;\n\n  constructor(dependency: string, cause: unknown) {\n    super(`Authentication dependency unavailable: ${dependency}`);\n    this.name = 'AuthDependencyUnavailableError';\n    this.dependency = dependency;\n    this.cause = cause;\n  }\n}\n\nexport class AdminRoleRequiredError extends Error {\n  readonly minimumRole: import('@shipfox/api-auth-dto').AdminRole;\n\n  constructor(minimumRole: import('@shipfox/api-auth-dto').AdminRole) {\n    super(`Administrator role required: ${minimumRole}`);\n    this.name = 'AdminRoleRequiredError';\n    this.minimumRole = minimumRole;\n  }\n}\n\nexport class LastAdminOwnerError extends Error {\n  constructor() {\n    super('Cannot remove the final active administrator owner');\n    this.name = 'LastAdminOwnerError';\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","ApiKeyNotFoundError","id","InvitationNotFoundError","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","SignupNotAllowedError","message","InvalidCredentialsError","EmailNotVerifiedError","AuthDependencyUnavailableError","dependency","cause","AdminRoleRequiredError","minimumRole","LastAdminOwnerError","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4BAA4BH;IACvC,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,mBAAmB,EAAEA,IAAI;QAChC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMG,gCAAgCL;IAC3C,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,8BAA8Bb;IACzC,YAAYc,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACZ,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,gCAAgCf;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMc,8BAA8BhB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMe,uCAAuCjB;IAIlD,YAAYkB,UAAkB,EAAEC,KAAc,CAAE;QAC9C,KAAK,CAAC,CAAC,uCAAuC,EAAED,YAAY;QAC5D,IAAI,CAAChB,IAAI,GAAG;QACZ,IAAI,CAACgB,UAAU,GAAGA;QAClB,IAAI,CAACC,KAAK,GAAGA;IACf;AACF;AAEA,OAAO,MAAMC,+BAA+BpB;IAG1C,YAAYqB,WAAsD,CAAE;QAClE,KAAK,CAAC,CAAC,6BAA6B,EAAEA,aAAa;QACnD,IAAI,CAACnB,IAAI,GAAG;QACZ,IAAI,CAACmB,WAAW,GAAGA;IACrB;AACF;AAEA,OAAO,MAAMC,4BAA4BtB;IACvC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,0BAA0BvB;IACrC,YAAYwB,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAACtB,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMuB,0BAA0BzB;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMwB,8BAA8B1B;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMyB,gCAAgC3B;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM0B,wBAAwB5B;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM2B,qCAAqC7B;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM4B,kCAAkC9B;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}
+{"version":3,"sources":["../../src/core/errors.ts"],"sourcesContent":["export class WorkspaceNotFoundError extends Error {\n  constructor(workspaceId: string) {\n    super(`Workspace not found: ${workspaceId}`);\n    this.name = 'WorkspaceNotFoundError';\n  }\n}\n\nexport class ApiKeyNotFoundError extends Error {\n  constructor(id: string) {\n    super(`API key not found: ${id}`);\n    this.name = 'ApiKeyNotFoundError';\n  }\n}\n\nexport class InvitationNotFoundError extends Error {\n  constructor(id: string) {\n    super(`Invitation not found: ${id}`);\n    this.name = 'InvitationNotFoundError';\n  }\n}\n\nexport class InvitationWorkspaceMismatchError extends Error {\n  constructor() {\n    super('Invitation does not belong to this workspace');\n    this.name = 'InvitationWorkspaceMismatchError';\n  }\n}\n\nexport class MembershipNotFoundError extends Error {\n  constructor(userId: string, workspaceId: string) {\n    super(`Membership not found for user ${userId} in workspace ${workspaceId}`);\n    this.name = 'MembershipNotFoundError';\n  }\n}\n\nexport class UserNotFoundError extends Error {\n  constructor(idOrEmail: string) {\n    super(`User not found: ${idOrEmail}`);\n    this.name = 'UserNotFoundError';\n  }\n}\n\nexport class EmailTakenError extends Error {\n  constructor(email: string) {\n    super(`Email already registered: ${email}`);\n    this.name = 'EmailTakenError';\n  }\n}\n\nexport class SignupNotAllowedError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = 'SignupNotAllowedError';\n  }\n}\n\nexport class InvalidCredentialsError extends Error {\n  constructor() {\n    super('Invalid credentials');\n    this.name = 'InvalidCredentialsError';\n  }\n}\n\nexport class EmailNotVerifiedError extends Error {\n  constructor() {\n    super('Email not verified');\n    this.name = 'EmailNotVerifiedError';\n  }\n}\n\nexport class AuthDependencyUnavailableError extends Error {\n  readonly dependency: string;\n  override readonly cause: unknown;\n\n  constructor(dependency: string, cause: unknown) {\n    super(`Authentication dependency unavailable: ${dependency}`);\n    this.name = 'AuthDependencyUnavailableError';\n    this.dependency = dependency;\n    this.cause = cause;\n  }\n}\n\nexport class AdminRoleRequiredError extends Error {\n  readonly minimumRole: import('@shipfox/api-auth-dto').AdminRole;\n\n  constructor(minimumRole: import('@shipfox/api-auth-dto').AdminRole) {\n    super(`Administrator role required: ${minimumRole}`);\n    this.name = 'AdminRoleRequiredError';\n    this.minimumRole = minimumRole;\n  }\n}\n\nexport class LastAdminOwnerError extends Error {\n  constructor() {\n    super('Cannot remove the final active administrator owner');\n    this.name = 'LastAdminOwnerError';\n  }\n}\n\nexport class AdminGrantNotFoundError extends Error {\n  constructor() {\n    super('Administrator grant not found');\n    this.name = 'AdminGrantNotFoundError';\n  }\n}\n\nexport class AdminGrantAlreadyExistsError extends Error {\n  constructor() {\n    super('Administrator grant already exists');\n    this.name = 'AdminGrantAlreadyExistsError';\n  }\n}\n\nexport class AdminBootstrapClosedError extends Error {\n  constructor() {\n    super('First administrator owner has already been created');\n    this.name = 'AdminBootstrapClosedError';\n  }\n}\n\nexport class InvalidAdminBootstrapTokenError extends Error {\n  constructor() {\n    super('Bootstrap token is invalid');\n    this.name = 'InvalidAdminBootstrapTokenError';\n  }\n}\n\nexport class AdminIdempotencyKeyReuseError extends Error {\n  constructor() {\n    super('Idempotency key was already used for a different command');\n    this.name = 'AdminIdempotencyKeyReuseError';\n  }\n}\n\nexport class TokenInvalidError extends Error {\n  constructor(reason?: string) {\n    super(reason ? `Invalid token: ${reason}` : 'Invalid token');\n    this.name = 'TokenInvalidError';\n  }\n}\n\nexport class TokenExpiredError extends Error {\n  constructor() {\n    super('Token has expired');\n    this.name = 'TokenExpiredError';\n  }\n}\n\nexport class TokenAlreadyUsedError extends Error {\n  constructor() {\n    super('Token has already been used');\n    this.name = 'TokenAlreadyUsedError';\n  }\n}\n\nexport class MembershipRequiredError extends Error {\n  constructor(workspaceId: string) {\n    super(`Membership required for workspace: ${workspaceId}`);\n    this.name = 'MembershipRequiredError';\n  }\n}\n\nexport class LastMemberError extends Error {\n  constructor(workspaceId: string) {\n    super(`Cannot remove the last member of workspace: ${workspaceId}`);\n    this.name = 'LastMemberError';\n  }\n}\n\nexport class InvitationEmailMismatchError extends Error {\n  constructor() {\n    super('Invitation email does not match authenticated user');\n    this.name = 'InvitationEmailMismatchError';\n  }\n}\n\nexport class OpenInvitationExistsError extends Error {\n  constructor(email: string) {\n    super(`An open invitation already exists for: ${email}`);\n    this.name = 'OpenInvitationExistsError';\n  }\n}\n"],"names":["WorkspaceNotFoundError","Error","workspaceId","name","ApiKeyNotFoundError","id","InvitationNotFoundError","InvitationWorkspaceMismatchError","MembershipNotFoundError","userId","UserNotFoundError","idOrEmail","EmailTakenError","email","SignupNotAllowedError","message","InvalidCredentialsError","EmailNotVerifiedError","AuthDependencyUnavailableError","dependency","cause","AdminRoleRequiredError","minimumRole","LastAdminOwnerError","AdminGrantNotFoundError","AdminGrantAlreadyExistsError","AdminBootstrapClosedError","InvalidAdminBootstrapTokenError","AdminIdempotencyKeyReuseError","TokenInvalidError","reason","TokenExpiredError","TokenAlreadyUsedError","MembershipRequiredError","LastMemberError","InvitationEmailMismatchError","OpenInvitationExistsError"],"mappings":"AAAA,OAAO,MAAMA,+BAA+BC;IAC1C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,qBAAqB,EAAEA,aAAa;QAC3C,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMC,4BAA4BH;IACvC,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,mBAAmB,EAAEA,IAAI;QAChC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMG,gCAAgCL;IAC3C,YAAYI,EAAU,CAAE;QACtB,KAAK,CAAC,CAAC,sBAAsB,EAAEA,IAAI;QACnC,IAAI,CAACF,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMI,yCAAyCN;IACpD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMK,gCAAgCP;IAC3C,YAAYQ,MAAc,EAAEP,WAAmB,CAAE;QAC/C,KAAK,CAAC,CAAC,8BAA8B,EAAEO,OAAO,cAAc,EAAEP,aAAa;QAC3E,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMO,0BAA0BT;IACrC,YAAYU,SAAiB,CAAE;QAC7B,KAAK,CAAC,CAAC,gBAAgB,EAAEA,WAAW;QACpC,IAAI,CAACR,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMS,wBAAwBX;IACnC,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,0BAA0B,EAAEA,OAAO;QAC1C,IAAI,CAACV,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMW,8BAA8Bb;IACzC,YAAYc,OAAe,CAAE;QAC3B,KAAK,CAACA;QACN,IAAI,CAACZ,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMa,gCAAgCf;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMc,8BAA8BhB;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMe,uCAAuCjB;IAIlD,YAAYkB,UAAkB,EAAEC,KAAc,CAAE;QAC9C,KAAK,CAAC,CAAC,uCAAuC,EAAED,YAAY;QAC5D,IAAI,CAAChB,IAAI,GAAG;QACZ,IAAI,CAACgB,UAAU,GAAGA;QAClB,IAAI,CAACC,KAAK,GAAGA;IACf;AACF;AAEA,OAAO,MAAMC,+BAA+BpB;IAG1C,YAAYqB,WAAsD,CAAE;QAClE,KAAK,CAAC,CAAC,6BAA6B,EAAEA,aAAa;QACnD,IAAI,CAACnB,IAAI,GAAG;QACZ,IAAI,CAACmB,WAAW,GAAGA;IACrB;AACF;AAEA,OAAO,MAAMC,4BAA4BtB;IACvC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMqB,gCAAgCvB;IAC3C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMsB,qCAAqCxB;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMuB,kCAAkCzB;IAC7C,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMwB,wCAAwC1B;IACnD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMyB,sCAAsC3B;IACjD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM0B,0BAA0B5B;IACrC,YAAY6B,MAAe,CAAE;QAC3B,KAAK,CAACA,SAAS,CAAC,eAAe,EAAEA,QAAQ,GAAG;QAC5C,IAAI,CAAC3B,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM4B,0BAA0B9B;IACrC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM6B,8BAA8B/B;IACzC,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM8B,gCAAgChC;IAC3C,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,mCAAmC,EAAEA,aAAa;QACzD,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAM+B,wBAAwBjC;IACnC,YAAYC,WAAmB,CAAE;QAC/B,KAAK,CAAC,CAAC,4CAA4C,EAAEA,aAAa;QAClE,IAAI,CAACC,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMgC,qCAAqClC;IAChD,aAAc;QACZ,KAAK,CAAC;QACN,IAAI,CAACE,IAAI,GAAG;IACd;AACF;AAEA,OAAO,MAAMiC,kCAAkCnC;IAC7C,YAAYY,KAAa,CAAE;QACzB,KAAK,CAAC,CAAC,uCAAuC,EAAEA,OAAO;QACvD,IAAI,CAACV,IAAI,GAAG;IACd;AACF"}

package/dist/db/admin-grants.d.ts

@@ -1,4 +1,5 @@
 import type { AdminRole } from '@shipfox/api-auth-dto';
+import type { AdministrationActionEvent } from '@shipfox/api-common-dto';
 import type { AdminGrant } from '#core/entities/admin-grant.js';
 export interface CreateAdminGrantParams {
     userId: string;
@@ -12,4 +13,21 @@ export declare function findCurrentAdminRole(params: {
 export declare function revokeAdminGrant(params: {
     grantId: string;
 }): Promise<AdminGrant | undefined>;
+interface AuditedAdminCommandParams {
+    actorId: string;
+    idempotencyKeyFingerprint: string;
+    requestFingerprint: string;
+    event: AdministrationActionEvent;
+}
+export declare function bootstrapFirstAdminOwner(params: AuditedAdminCommandParams & {
+    userId: string;
+}): Promise<AdminGrant>;
+export declare function grantAdminRoleWithAudit(params: AuditedAdminCommandParams & {
+    userId: string;
+    role: AdminRole;
+}): Promise<AdminGrant>;
+export declare function revokeAdminGrantWithAudit(params: AuditedAdminCommandParams & {
+    grantId: string;
+}): Promise<AdminGrant>;
+export {};
 //# sourceMappingURL=admin-grants.d.ts.map

package/dist/db/admin-grants.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"admin-grants.d.ts","sourceRoot":"","sources":["../../src/db/admin-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AAGrD,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAM9D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ1F;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAG7D;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAc9F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAqCjG"}
+{"version":3,"file":"admin-grants.d.ts","sourceRoot":"","sources":["../../src/db/admin-grants.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,SAAS,EAAC,MAAM,uBAAuB,CAAC;AACrD,OAAO,KAAK,EACV,yBAAyB,EAE1B,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAC,UAAU,EAAC,MAAM,+BAA+B,CAAC;AAqB9D,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;CACjB;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,UAAU,CAAC,CAQ1F;AAED,wBAAsB,eAAe,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC,CAG7D;AAED,wBAAsB,oBAAoB,CAAC,MAAM,EAAE;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAc9F;AAED,wBAAsB,gBAAgB,CAAC,MAAM,EAAE;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAqCjG;AAED,UAAU,yBAAyB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,yBAAyB,EAAE,MAAM,CAAC;IAClC,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,yBAAyB,CAAC;CAClC;AAoFD,wBAAsB,wBAAwB,CAC5C,MAAM,EAAE,yBAAyB,GAAG;IAAC,MAAM,EAAE,MAAM,CAAA;CAAC,GACnD,OAAO,CAAC,UAAU,CAAC,CA6CrB;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,yBAAyB,GAAG;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAC,GACpE,OAAO,CAAC,UAAU,CAAC,CA4CrB;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,yBAAyB,GAAG;IAAC,OAAO,EAAE,MAAM,CAAA;CAAC,GACpD,OAAO,CAAC,UAAU,CAAC,CA+CrB"}

package/dist/db/admin-grants.js

@@ -1,8 +1,11 @@
+import { writeOutboxEvent } from '@shipfox/node-outbox';
 import { and, asc, eq, isNull, sql } from 'drizzle-orm';
 import { highestAdminRole } from '#core/admin-role-model.js';
-import { LastAdminOwnerError } from '#core/errors.js';
+import { AdminBootstrapClosedError, AdminGrantAlreadyExistsError, AdminGrantNotFoundError, AdminIdempotencyKeyReuseError, LastAdminOwnerError, UserNotFoundError } from '#core/errors.js';
 import { db } from './db.js';
+import { adminCommandResults } from './schema/admin-command-results.js';
 import { adminGrants, toAdminGrant } from './schema/admin-grants.js';
+import { authOutbox } from './schema/outbox.js';
 import { users } from './schema/users.js';
 export async function createAdminGrant(params) {
     const rows = await db().insert(adminGrants).values({
@@ -45,5 +48,146 @@ export async function revokeAdminGrant(params) {
         return row ? toAdminGrant(row) : undefined;
     });
 }
+function toStoredAdminGrant(grant) {
+    return {
+        id: grant.id,
+        userId: grant.userId,
+        role: grant.role,
+        revokedAt: grant.revokedAt?.toISOString() ?? null,
+        createdAt: grant.createdAt.toISOString(),
+        updatedAt: grant.updatedAt.toISOString()
+    };
+}
+function fromStoredAdminGrant(grant) {
+    return {
+        id: grant.id,
+        userId: grant.userId,
+        role: grant.role,
+        revokedAt: grant.revokedAt ? new Date(grant.revokedAt) : null,
+        createdAt: new Date(grant.createdAt),
+        updatedAt: new Date(grant.updatedAt)
+    };
+}
+async function findCommandResult(tx, params) {
+    const rows = await tx.select().from(adminCommandResults).where(and(eq(adminCommandResults.actorId, params.actorId), eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint))).limit(1);
+    const result = rows[0];
+    if (!result) return undefined;
+    if (result.command !== params.command || result.requestFingerprint !== params.requestFingerprint) {
+        throw new AdminIdempotencyKeyReuseError();
+    }
+    return fromStoredAdminGrant(result.result.grant);
+}
+async function storeCommandResult(tx, params, grant) {
+    await tx.insert(adminCommandResults).values({
+        actorId: params.actorId,
+        idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,
+        command: params.event.command,
+        requestFingerprint: params.requestFingerprint,
+        result: {
+            grant: toStoredAdminGrant(grant)
+        }
+    });
+}
+async function writeAdminAction(tx, event) {
+    await writeOutboxEvent(tx, authOutbox, {
+        type: 'administration.action.performed',
+        payload: event
+    });
+}
+async function lockAdminCommand(tx, params) {
+    await tx.execute(sql`select pg_advisory_xact_lock(hashtext(${`auth_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`);
+}
+export async function bootstrapFirstAdminOwner(params) {
+    return await db().transaction(async (tx)=>{
+        await lockAdminCommand(tx, params);
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+        const existing = await findCommandResult(tx, {
+            ...params,
+            command: params.event.command
+        });
+        if (existing) return existing;
+        const activeOwners = await tx.select({
+            id: adminGrants.id
+        }).from(adminGrants).innerJoin(users, eq(adminGrants.userId, users.id)).where(and(eq(adminGrants.role, 'admin-owner'), isNull(adminGrants.revokedAt), eq(users.status, 'active'))).limit(1);
+        if (activeOwners.length > 0) throw new AdminBootstrapClosedError();
+        const userRows = await tx.select({
+            id: users.id,
+            status: users.status
+        }).from(users).where(eq(users.id, params.userId)).limit(1);
+        const user = userRows[0];
+        if (user?.status !== 'active') throw new UserNotFoundError(params.userId);
+        const rows = await tx.insert(adminGrants).values({
+            userId: params.userId,
+            role: 'admin-owner'
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Bootstrap grant insert returned no rows');
+        const grant = toAdminGrant(row);
+        await writeAdminAction(tx, params.event);
+        await storeCommandResult(tx, params, grant);
+        return grant;
+    });
+}
+export async function grantAdminRoleWithAudit(params) {
+    return await db().transaction(async (tx)=>{
+        await lockAdminCommand(tx, params);
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+        const existing = await findCommandResult(tx, {
+            ...params,
+            command: params.event.command
+        });
+        if (existing) return existing;
+        const userRows = await tx.select({
+            id: users.id,
+            status: users.status
+        }).from(users).where(eq(users.id, params.userId)).limit(1);
+        const user = userRows[0];
+        if (user?.status !== 'active') throw new UserNotFoundError(params.userId);
+        const activeRows = await tx.select({
+            id: adminGrants.id
+        }).from(adminGrants).where(and(eq(adminGrants.userId, params.userId), eq(adminGrants.role, params.role), isNull(adminGrants.revokedAt))).limit(1);
+        if (activeRows.length > 0) throw new AdminGrantAlreadyExistsError();
+        const rows = await tx.insert(adminGrants).values({
+            userId: params.userId,
+            role: params.role
+        }).returning();
+        const row = rows[0];
+        if (!row) throw new Error('Administrator grant insert returned no rows');
+        const grant = toAdminGrant(row);
+        await writeAdminAction(tx, params.event);
+        await storeCommandResult(tx, params, grant);
+        return grant;
+    });
+}
+export async function revokeAdminGrantWithAudit(params) {
+    return await db().transaction(async (tx)=>{
+        await lockAdminCommand(tx, params);
+        await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);
+        const existing = await findCommandResult(tx, {
+            ...params,
+            command: params.event.command
+        });
+        if (existing) return existing;
+        const rows = await tx.select().from(adminGrants).where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt))).limit(1);
+        const grant = rows[0];
+        if (!grant) throw new AdminGrantNotFoundError();
+        if (grant.role === 'admin-owner') {
+            const activeOwners = await tx.select({
+                id: adminGrants.id
+            }).from(adminGrants).innerJoin(users, eq(adminGrants.userId, users.id)).where(and(eq(adminGrants.role, 'admin-owner'), isNull(adminGrants.revokedAt), eq(users.status, 'active')));
+            if (activeOwners.length <= 1) throw new LastAdminOwnerError();
+        }
+        const updated = await tx.update(adminGrants).set({
+            revokedAt: new Date(),
+            updatedAt: new Date()
+        }).where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt))).returning();
+        const updatedRow = updated[0];
+        if (!updatedRow) throw new AdminGrantNotFoundError();
+        const revoked = toAdminGrant(updatedRow);
+        await writeAdminAction(tx, params.event);
+        await storeCommandResult(tx, params, revoked);
+        return revoked;
+    });
+}
 
 //# sourceMappingURL=admin-grants.js.map

package/dist/db/admin-grants.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/admin-grants.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport {and, asc, eq, isNull, sql} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {LastAdminOwnerError} from '#core/errors.js';\nimport {db} from './db.js';\nimport {adminGrants, toAdminGrant} from './schema/admin-grants.js';\nimport {users} from './schema/users.js';\n\nexport interface CreateAdminGrantParams {\n  userId: string;\n  role: AdminRole;\n}\n\nexport async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {\n  const rows = await db()\n    .insert(adminGrants)\n    .values({userId: params.userId, role: params.role})\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAdminGrant(row);\n}\n\nexport async function listAdminGrants(): Promise<AdminGrant[]> {\n  const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));\n  return rows.map(toAdminGrant);\n}\n\nexport async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  const rows = await db()\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(\n      and(\n        eq(adminGrants.userId, params.userId),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    );\n\n  return highestAdminRole(rows.map(({role}) => role));\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {\n  return await db().transaction(async (tx) => {\n    // All owner grant changes share one lock so concurrent revocations cannot\n    // both observe the same final owner and leave the instance ownerless.\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) return undefined;\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const row = updated[0];\n    return row ? toAdminGrant(row) : undefined;\n  });\n}\n"],"names":["and","asc","eq","isNull","sql","highestAdminRole","LastAdminOwnerError","db","adminGrants","toAdminGrant","users","createAdminGrant","params","rows","insert","values","userId","role","returning","row","Error","listAdminGrants","select","from","orderBy","createdAt","map","findCurrentAdminRole","innerJoin","id","where","revokedAt","status","revokeAdminGrant","transaction","tx","execute","grantId","limit","grant","undefined","activeOwners","length","updated","update","set","Date","updatedAt"],"mappings":"AACA,SAAQA,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACtD,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SAAQC,mBAAmB,QAAO,kBAAkB;AACpD,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAAQC,WAAW,EAAEC,YAAY,QAAO,2BAA2B;AACnE,SAAQC,KAAK,QAAO,oBAAoB;AAOxC,OAAO,eAAeC,iBAAiBC,MAA8B;IACnE,MAAMC,OAAO,MAAMN,KAChBO,MAAM,CAACN,aACPO,MAAM,CAAC;QAACC,QAAQJ,OAAOI,MAAM;QAAEC,MAAML,OAAOK,IAAI;IAAA,GAChDC,SAAS;IACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOX,aAAaU;AACtB;AAEA,OAAO,eAAeE;IACpB,MAAMR,OAAO,MAAMN,KAAKe,MAAM,GAAGC,IAAI,CAACf,aAAagB,OAAO,CAACvB,IAAIO,YAAYiB,SAAS;IACpF,OAAOZ,KAAKa,GAAG,CAACjB;AAClB;AAEA,OAAO,eAAekB,qBAAqBf,MAAwB;IACjE,MAAMC,OAAO,MAAMN,KAChBe,MAAM,CAAC;QAACL,MAAMT,YAAYS,IAAI;IAAA,GAC9BM,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYQ,MAAM,EAAEJ,OAAOI,MAAM,GACpCb,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;IAIvB,OAAO3B,iBAAiBQ,KAAKa,GAAG,CAAC,CAAC,EAACT,IAAI,EAAC,GAAKA;AAC/C;AAEA,OAAO,eAAegB,iBAAiBrB,MAAyB;IAC9D,OAAO,MAAML,KAAK2B,WAAW,CAAC,OAAOC;QACnC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAMA,GAAGC,OAAO,CAAChC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMS,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAACf,aACLsB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEjB,OAAOyB,OAAO,GAAGlC,OAAOK,YAAYuB,SAAS,IAC1EO,KAAK,CAAC;QACT,MAAMC,QAAQ1B,IAAI,CAAC,EAAE;QACrB,IAAI,CAAC0B,OAAO,OAAOC;QAEnB,IAAID,MAAMtB,IAAI,KAAK,eAAe;YAChC,MAAMwB,eAAe,MAAMN,GACxBb,MAAM,CAAC;gBAACO,IAAIrB,YAAYqB,EAAE;YAAA,GAC1BN,IAAI,CAACf,aACLoB,SAAS,CAAClB,OAAOR,GAAGM,YAAYQ,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJ9B,IACEE,GAAGM,YAAYS,IAAI,EAAE,gBACrBd,OAAOK,YAAYuB,SAAS,GAC5B7B,GAAGQ,MAAMsB,MAAM,EAAE;YAGvB,IAAIS,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAIpC;QAC1C;QAEA,MAAMqC,UAAU,MAAMR,GACnBS,MAAM,CAACpC,aACPqC,GAAG,CAAC;YAACd,WAAW,IAAIe;YAAQC,WAAW,IAAID;QAAM,GACjDhB,KAAK,CAAC9B,IAAIE,GAAGM,YAAYqB,EAAE,EAAEU,MAAMV,EAAE,GAAG1B,OAAOK,YAAYuB,SAAS,IACpEb,SAAS;QACZ,MAAMC,MAAMwB,OAAO,CAAC,EAAE;QACtB,OAAOxB,MAAMV,aAAaU,OAAOqB;IACnC;AACF"}
+{"version":3,"sources":["../../src/db/admin-grants.ts"],"sourcesContent":["import type {AdminRole} from '@shipfox/api-auth-dto';\nimport type {\n  AdministrationActionEvent,\n  AdministrationActionEventMap,\n} from '@shipfox/api-common-dto';\nimport {writeOutboxEvent} from '@shipfox/node-outbox';\nimport {and, asc, eq, isNull, sql} from 'drizzle-orm';\nimport {highestAdminRole} from '#core/admin-role-model.js';\nimport type {AdminGrant} from '#core/entities/admin-grant.js';\nimport {\n  AdminBootstrapClosedError,\n  AdminGrantAlreadyExistsError,\n  AdminGrantNotFoundError,\n  AdminIdempotencyKeyReuseError,\n  LastAdminOwnerError,\n  UserNotFoundError,\n} from '#core/errors.js';\nimport {db} from './db.js';\nimport {\n  type AdminCommandResultDb,\n  adminCommandResults,\n  type StoredAdminGrant,\n} from './schema/admin-command-results.js';\nimport {adminGrants, toAdminGrant} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {users} from './schema/users.js';\n\ntype Tx = Parameters<Parameters<ReturnType<typeof db>['transaction']>[0]>[0];\n\nexport interface CreateAdminGrantParams {\n  userId: string;\n  role: AdminRole;\n}\n\nexport async function createAdminGrant(params: CreateAdminGrantParams): Promise<AdminGrant> {\n  const rows = await db()\n    .insert(adminGrants)\n    .values({userId: params.userId, role: params.role})\n    .returning();\n  const row = rows[0];\n  if (!row) throw new Error('Insert returned no rows');\n  return toAdminGrant(row);\n}\n\nexport async function listAdminGrants(): Promise<AdminGrant[]> {\n  const rows = await db().select().from(adminGrants).orderBy(asc(adminGrants.createdAt));\n  return rows.map(toAdminGrant);\n}\n\nexport async function findCurrentAdminRole(params: {userId: string}): Promise<AdminRole | null> {\n  const rows = await db()\n    .select({role: adminGrants.role})\n    .from(adminGrants)\n    .innerJoin(users, eq(adminGrants.userId, users.id))\n    .where(\n      and(\n        eq(adminGrants.userId, params.userId),\n        isNull(adminGrants.revokedAt),\n        eq(users.status, 'active'),\n      ),\n    );\n\n  return highestAdminRole(rows.map(({role}) => role));\n}\n\nexport async function revokeAdminGrant(params: {grantId: string}): Promise<AdminGrant | undefined> {\n  return await db().transaction(async (tx) => {\n    // All owner grant changes share one lock so concurrent revocations cannot\n    // both observe the same final owner and leave the instance ownerless.\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) return undefined;\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const row = updated[0];\n    return row ? toAdminGrant(row) : undefined;\n  });\n}\n\ninterface AuditedAdminCommandParams {\n  actorId: string;\n  idempotencyKeyFingerprint: string;\n  requestFingerprint: string;\n  event: AdministrationActionEvent;\n}\n\nfunction toStoredAdminGrant(grant: AdminGrant): StoredAdminGrant {\n  return {\n    id: grant.id,\n    userId: grant.userId,\n    role: grant.role,\n    revokedAt: grant.revokedAt?.toISOString() ?? null,\n    createdAt: grant.createdAt.toISOString(),\n    updatedAt: grant.updatedAt.toISOString(),\n  };\n}\n\nfunction fromStoredAdminGrant(grant: StoredAdminGrant): AdminGrant {\n  return {\n    id: grant.id,\n    userId: grant.userId,\n    role: grant.role,\n    revokedAt: grant.revokedAt ? new Date(grant.revokedAt) : null,\n    createdAt: new Date(grant.createdAt),\n    updatedAt: new Date(grant.updatedAt),\n  };\n}\n\nasync function findCommandResult(\n  tx: Tx,\n  params: Pick<\n    AuditedAdminCommandParams,\n    'actorId' | 'idempotencyKeyFingerprint' | 'requestFingerprint'\n  > & {\n    command: string;\n  },\n): Promise<AdminGrant | undefined> {\n  const rows = await tx\n    .select()\n    .from(adminCommandResults)\n    .where(\n      and(\n        eq(adminCommandResults.actorId, params.actorId),\n        eq(adminCommandResults.idempotencyKeyFingerprint, params.idempotencyKeyFingerprint),\n      ),\n    )\n    .limit(1);\n  const result: AdminCommandResultDb | undefined = rows[0];\n  if (!result) return undefined;\n  if (\n    result.command !== params.command ||\n    result.requestFingerprint !== params.requestFingerprint\n  ) {\n    throw new AdminIdempotencyKeyReuseError();\n  }\n  return fromStoredAdminGrant(result.result.grant);\n}\n\nasync function storeCommandResult(\n  tx: Tx,\n  params: AuditedAdminCommandParams,\n  grant: AdminGrant,\n): Promise<void> {\n  await tx.insert(adminCommandResults).values({\n    actorId: params.actorId,\n    idempotencyKeyFingerprint: params.idempotencyKeyFingerprint,\n    command: params.event.command,\n    requestFingerprint: params.requestFingerprint,\n    result: {grant: toStoredAdminGrant(grant)},\n  });\n}\n\nasync function writeAdminAction(tx: Tx, event: AdministrationActionEvent): Promise<void> {\n  await writeOutboxEvent<AdministrationActionEventMap>(tx, authOutbox, {\n    type: 'administration.action.performed',\n    payload: event,\n  });\n}\n\nasync function lockAdminCommand(\n  tx: Tx,\n  params: {actorId: string; idempotencyKeyFingerprint: string},\n) {\n  await tx.execute(\n    sql`select pg_advisory_xact_lock(hashtext(${`auth_admin_command:${params.actorId}:${params.idempotencyKeyFingerprint}`}))`,\n  );\n}\n\nexport async function bootstrapFirstAdminOwner(\n  params: AuditedAdminCommandParams & {userId: string},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const activeOwners = await tx\n      .select({id: adminGrants.id})\n      .from(adminGrants)\n      .innerJoin(users, eq(adminGrants.userId, users.id))\n      .where(\n        and(\n          eq(adminGrants.role, 'admin-owner'),\n          isNull(adminGrants.revokedAt),\n          eq(users.status, 'active'),\n        ),\n      )\n      .limit(1);\n    if (activeOwners.length > 0) throw new AdminBootstrapClosedError();\n\n    const userRows = await tx\n      .select({id: users.id, status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    const user = userRows[0];\n    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);\n\n    const rows = await tx\n      .insert(adminGrants)\n      .values({userId: params.userId, role: 'admin-owner'})\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Bootstrap grant insert returned no rows');\n\n    const grant = toAdminGrant(row);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, grant);\n    return grant;\n  });\n}\n\nexport async function grantAdminRoleWithAudit(\n  params: AuditedAdminCommandParams & {userId: string; role: AdminRole},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const userRows = await tx\n      .select({id: users.id, status: users.status})\n      .from(users)\n      .where(eq(users.id, params.userId))\n      .limit(1);\n    const user = userRows[0];\n    if (user?.status !== 'active') throw new UserNotFoundError(params.userId);\n\n    const activeRows = await tx\n      .select({id: adminGrants.id})\n      .from(adminGrants)\n      .where(\n        and(\n          eq(adminGrants.userId, params.userId),\n          eq(adminGrants.role, params.role),\n          isNull(adminGrants.revokedAt),\n        ),\n      )\n      .limit(1);\n    if (activeRows.length > 0) throw new AdminGrantAlreadyExistsError();\n\n    const rows = await tx\n      .insert(adminGrants)\n      .values({userId: params.userId, role: params.role})\n      .returning();\n    const row = rows[0];\n    if (!row) throw new Error('Administrator grant insert returned no rows');\n\n    const grant = toAdminGrant(row);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, grant);\n    return grant;\n  });\n}\n\nexport async function revokeAdminGrantWithAudit(\n  params: AuditedAdminCommandParams & {grantId: string},\n): Promise<AdminGrant> {\n  return await db().transaction(async (tx) => {\n    await lockAdminCommand(tx, params);\n    await tx.execute(sql`select pg_advisory_xact_lock(hashtext('auth_admin_owner_grants'))`);\n\n    const existing = await findCommandResult(tx, {\n      ...params,\n      command: params.event.command,\n    });\n    if (existing) return existing;\n\n    const rows = await tx\n      .select()\n      .from(adminGrants)\n      .where(and(eq(adminGrants.id, params.grantId), isNull(adminGrants.revokedAt)))\n      .limit(1);\n    const grant = rows[0];\n    if (!grant) throw new AdminGrantNotFoundError();\n\n    if (grant.role === 'admin-owner') {\n      const activeOwners = await tx\n        .select({id: adminGrants.id})\n        .from(adminGrants)\n        .innerJoin(users, eq(adminGrants.userId, users.id))\n        .where(\n          and(\n            eq(adminGrants.role, 'admin-owner'),\n            isNull(adminGrants.revokedAt),\n            eq(users.status, 'active'),\n          ),\n        );\n      if (activeOwners.length <= 1) throw new LastAdminOwnerError();\n    }\n\n    const updated = await tx\n      .update(adminGrants)\n      .set({revokedAt: new Date(), updatedAt: new Date()})\n      .where(and(eq(adminGrants.id, grant.id), isNull(adminGrants.revokedAt)))\n      .returning();\n    const updatedRow = updated[0];\n    if (!updatedRow) throw new AdminGrantNotFoundError();\n\n    const revoked = toAdminGrant(updatedRow);\n    await writeAdminAction(tx, params.event);\n    await storeCommandResult(tx, params, revoked);\n    return revoked;\n  });\n}\n"],"names":["writeOutboxEvent","and","asc","eq","isNull","sql","highestAdminRole","AdminBootstrapClosedError","AdminGrantAlreadyExistsError","AdminGrantNotFoundError","AdminIdempotencyKeyReuseError","LastAdminOwnerError","UserNotFoundError","db","adminCommandResults","adminGrants","toAdminGrant","authOutbox","users","createAdminGrant","params","rows","insert","values","userId","role","returning","row","Error","listAdminGrants","select","from","orderBy","createdAt","map","findCurrentAdminRole","innerJoin","id","where","revokedAt","status","revokeAdminGrant","transaction","tx","execute","grantId","limit","grant","undefined","activeOwners","length","updated","update","set","Date","updatedAt","toStoredAdminGrant","toISOString","fromStoredAdminGrant","findCommandResult","actorId","idempotencyKeyFingerprint","result","command","requestFingerprint","storeCommandResult","event","writeAdminAction","type","payload","lockAdminCommand","bootstrapFirstAdminOwner","existing","userRows","user","grantAdminRoleWithAudit","activeRows","revokeAdminGrantWithAudit","updatedRow","revoked"],"mappings":"AAKA,SAAQA,gBAAgB,QAAO,uBAAuB;AACtD,SAAQC,GAAG,EAAEC,GAAG,EAAEC,EAAE,EAAEC,MAAM,EAAEC,GAAG,QAAO,cAAc;AACtD,SAAQC,gBAAgB,QAAO,4BAA4B;AAE3D,SACEC,yBAAyB,EACzBC,4BAA4B,EAC5BC,uBAAuB,EACvBC,6BAA6B,EAC7BC,mBAAmB,EACnBC,iBAAiB,QACZ,kBAAkB;AACzB,SAAQC,EAAE,QAAO,UAAU;AAC3B,SAEEC,mBAAmB,QAEd,oCAAoC;AAC3C,SAAQC,WAAW,EAAEC,YAAY,QAAO,2BAA2B;AACnE,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,KAAK,QAAO,oBAAoB;AASxC,OAAO,eAAeC,iBAAiBC,MAA8B;IACnE,MAAMC,OAAO,MAAMR,KAChBS,MAAM,CAACP,aACPQ,MAAM,CAAC;QAACC,QAAQJ,OAAOI,MAAM;QAAEC,MAAML,OAAOK,IAAI;IAAA,GAChDC,SAAS;IACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;IACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;IAC1B,OAAOZ,aAAaW;AACtB;AAEA,OAAO,eAAeE;IACpB,MAAMR,OAAO,MAAMR,KAAKiB,MAAM,GAAGC,IAAI,CAAChB,aAAaiB,OAAO,CAAC9B,IAAIa,YAAYkB,SAAS;IACpF,OAAOZ,KAAKa,GAAG,CAAClB;AAClB;AAEA,OAAO,eAAemB,qBAAqBf,MAAwB;IACjE,MAAMC,OAAO,MAAMR,KAChBiB,MAAM,CAAC;QAACL,MAAMV,YAAYU,IAAI;IAAA,GAC9BM,IAAI,CAAChB,aACLqB,SAAS,CAAClB,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJrC,IACEE,GAAGY,YAAYS,MAAM,EAAEJ,OAAOI,MAAM,GACpCpB,OAAOW,YAAYwB,SAAS,GAC5BpC,GAAGe,MAAMsB,MAAM,EAAE;IAIvB,OAAOlC,iBAAiBe,KAAKa,GAAG,CAAC,CAAC,EAACT,IAAI,EAAC,GAAKA;AAC/C;AAEA,OAAO,eAAegB,iBAAiBrB,MAAyB;IAC9D,OAAO,MAAMP,KAAK6B,WAAW,CAAC,OAAOC;QACnC,0EAA0E;QAC1E,sEAAsE;QACtE,MAAMA,GAAGC,OAAO,CAACvC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMgB,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAAChB,aACLuB,KAAK,CAACrC,IAAIE,GAAGY,YAAYsB,EAAE,EAAEjB,OAAOyB,OAAO,GAAGzC,OAAOW,YAAYwB,SAAS,IAC1EO,KAAK,CAAC;QACT,MAAMC,QAAQ1B,IAAI,CAAC,EAAE;QACrB,IAAI,CAAC0B,OAAO,OAAOC;QAEnB,IAAID,MAAMtB,IAAI,KAAK,eAAe;YAChC,MAAMwB,eAAe,MAAMN,GACxBb,MAAM,CAAC;gBAACO,IAAItB,YAAYsB,EAAE;YAAA,GAC1BN,IAAI,CAAChB,aACLqB,SAAS,CAAClB,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJrC,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYwB,SAAS,GAC5BpC,GAAGe,MAAMsB,MAAM,EAAE;YAGvB,IAAIS,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAIvC;QAC1C;QAEA,MAAMwC,UAAU,MAAMR,GACnBS,MAAM,CAACrC,aACPsC,GAAG,CAAC;YAACd,WAAW,IAAIe;YAAQC,WAAW,IAAID;QAAM,GACjDhB,KAAK,CAACrC,IAAIE,GAAGY,YAAYsB,EAAE,EAAEU,MAAMV,EAAE,GAAGjC,OAAOW,YAAYwB,SAAS,IACpEb,SAAS;QACZ,MAAMC,MAAMwB,OAAO,CAAC,EAAE;QACtB,OAAOxB,MAAMX,aAAaW,OAAOqB;IACnC;AACF;AASA,SAASQ,mBAAmBT,KAAiB;IAC3C,OAAO;QACLV,IAAIU,MAAMV,EAAE;QACZb,QAAQuB,MAAMvB,MAAM;QACpBC,MAAMsB,MAAMtB,IAAI;QAChBc,WAAWQ,MAAMR,SAAS,EAAEkB,iBAAiB;QAC7CxB,WAAWc,MAAMd,SAAS,CAACwB,WAAW;QACtCF,WAAWR,MAAMQ,SAAS,CAACE,WAAW;IACxC;AACF;AAEA,SAASC,qBAAqBX,KAAuB;IACnD,OAAO;QACLV,IAAIU,MAAMV,EAAE;QACZb,QAAQuB,MAAMvB,MAAM;QACpBC,MAAMsB,MAAMtB,IAAI;QAChBc,WAAWQ,MAAMR,SAAS,GAAG,IAAIe,KAAKP,MAAMR,SAAS,IAAI;QACzDN,WAAW,IAAIqB,KAAKP,MAAMd,SAAS;QACnCsB,WAAW,IAAID,KAAKP,MAAMQ,SAAS;IACrC;AACF;AAEA,eAAeI,kBACbhB,EAAM,EACNvB,MAKC;IAED,MAAMC,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAACjB,qBACLwB,KAAK,CACJrC,IACEE,GAAGW,oBAAoB8C,OAAO,EAAExC,OAAOwC,OAAO,GAC9CzD,GAAGW,oBAAoB+C,yBAAyB,EAAEzC,OAAOyC,yBAAyB,IAGrFf,KAAK,CAAC;IACT,MAAMgB,SAA2CzC,IAAI,CAAC,EAAE;IACxD,IAAI,CAACyC,QAAQ,OAAOd;IACpB,IACEc,OAAOC,OAAO,KAAK3C,OAAO2C,OAAO,IACjCD,OAAOE,kBAAkB,KAAK5C,OAAO4C,kBAAkB,EACvD;QACA,MAAM,IAAItD;IACZ;IACA,OAAOgD,qBAAqBI,OAAOA,MAAM,CAACf,KAAK;AACjD;AAEA,eAAekB,mBACbtB,EAAM,EACNvB,MAAiC,EACjC2B,KAAiB;IAEjB,MAAMJ,GAAGrB,MAAM,CAACR,qBAAqBS,MAAM,CAAC;QAC1CqC,SAASxC,OAAOwC,OAAO;QACvBC,2BAA2BzC,OAAOyC,yBAAyB;QAC3DE,SAAS3C,OAAO8C,KAAK,CAACH,OAAO;QAC7BC,oBAAoB5C,OAAO4C,kBAAkB;QAC7CF,QAAQ;YAACf,OAAOS,mBAAmBT;QAAM;IAC3C;AACF;AAEA,eAAeoB,iBAAiBxB,EAAM,EAAEuB,KAAgC;IACtE,MAAMlE,iBAA+C2C,IAAI1B,YAAY;QACnEmD,MAAM;QACNC,SAASH;IACX;AACF;AAEA,eAAeI,iBACb3B,EAAM,EACNvB,MAA4D;IAE5D,MAAMuB,GAAGC,OAAO,CACdvC,GAAG,CAAC,sCAAsC,EAAE,CAAC,mBAAmB,EAAEe,OAAOwC,OAAO,CAAC,CAAC,EAAExC,OAAOyC,yBAAyB,EAAE,CAAC,EAAE,CAAC;AAE9H;AAEA,OAAO,eAAeU,yBACpBnD,MAAoD;IAEpD,OAAO,MAAMP,KAAK6B,WAAW,CAAC,OAAOC;QACnC,MAAM2B,iBAAiB3B,IAAIvB;QAC3B,MAAMuB,GAAGC,OAAO,CAACvC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMmE,WAAW,MAAMb,kBAAkBhB,IAAI;YAC3C,GAAGvB,MAAM;YACT2C,SAAS3C,OAAO8C,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAMvB,eAAe,MAAMN,GACxBb,MAAM,CAAC;YAACO,IAAItB,YAAYsB,EAAE;QAAA,GAC1BN,IAAI,CAAChB,aACLqB,SAAS,CAAClB,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJrC,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYwB,SAAS,GAC5BpC,GAAGe,MAAMsB,MAAM,EAAE,YAGpBM,KAAK,CAAC;QACT,IAAIG,aAAaC,MAAM,GAAG,GAAG,MAAM,IAAI3C;QAEvC,MAAMkE,WAAW,MAAM9B,GACpBb,MAAM,CAAC;YAACO,IAAInB,MAAMmB,EAAE;YAAEG,QAAQtB,MAAMsB,MAAM;QAAA,GAC1CT,IAAI,CAACb,OACLoB,KAAK,CAACnC,GAAGe,MAAMmB,EAAE,EAAEjB,OAAOI,MAAM,GAChCsB,KAAK,CAAC;QACT,MAAM4B,OAAOD,QAAQ,CAAC,EAAE;QACxB,IAAIC,MAAMlC,WAAW,UAAU,MAAM,IAAI5B,kBAAkBQ,OAAOI,MAAM;QAExE,MAAMH,OAAO,MAAMsB,GAChBrB,MAAM,CAACP,aACPQ,MAAM,CAAC;YAACC,QAAQJ,OAAOI,MAAM;YAAEC,MAAM;QAAa,GAClDC,SAAS;QACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAE1B,MAAMmB,QAAQ/B,aAAaW;QAC3B,MAAMwC,iBAAiBxB,IAAIvB,OAAO8C,KAAK;QACvC,MAAMD,mBAAmBtB,IAAIvB,QAAQ2B;QACrC,OAAOA;IACT;AACF;AAEA,OAAO,eAAe4B,wBACpBvD,MAAqE;IAErE,OAAO,MAAMP,KAAK6B,WAAW,CAAC,OAAOC;QACnC,MAAM2B,iBAAiB3B,IAAIvB;QAC3B,MAAMuB,GAAGC,OAAO,CAACvC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMmE,WAAW,MAAMb,kBAAkBhB,IAAI;YAC3C,GAAGvB,MAAM;YACT2C,SAAS3C,OAAO8C,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAMC,WAAW,MAAM9B,GACpBb,MAAM,CAAC;YAACO,IAAInB,MAAMmB,EAAE;YAAEG,QAAQtB,MAAMsB,MAAM;QAAA,GAC1CT,IAAI,CAACb,OACLoB,KAAK,CAACnC,GAAGe,MAAMmB,EAAE,EAAEjB,OAAOI,MAAM,GAChCsB,KAAK,CAAC;QACT,MAAM4B,OAAOD,QAAQ,CAAC,EAAE;QACxB,IAAIC,MAAMlC,WAAW,UAAU,MAAM,IAAI5B,kBAAkBQ,OAAOI,MAAM;QAExE,MAAMoD,aAAa,MAAMjC,GACtBb,MAAM,CAAC;YAACO,IAAItB,YAAYsB,EAAE;QAAA,GAC1BN,IAAI,CAAChB,aACLuB,KAAK,CACJrC,IACEE,GAAGY,YAAYS,MAAM,EAAEJ,OAAOI,MAAM,GACpCrB,GAAGY,YAAYU,IAAI,EAAEL,OAAOK,IAAI,GAChCrB,OAAOW,YAAYwB,SAAS,IAG/BO,KAAK,CAAC;QACT,IAAI8B,WAAW1B,MAAM,GAAG,GAAG,MAAM,IAAI1C;QAErC,MAAMa,OAAO,MAAMsB,GAChBrB,MAAM,CAACP,aACPQ,MAAM,CAAC;YAACC,QAAQJ,OAAOI,MAAM;YAAEC,MAAML,OAAOK,IAAI;QAAA,GAChDC,SAAS;QACZ,MAAMC,MAAMN,IAAI,CAAC,EAAE;QACnB,IAAI,CAACM,KAAK,MAAM,IAAIC,MAAM;QAE1B,MAAMmB,QAAQ/B,aAAaW;QAC3B,MAAMwC,iBAAiBxB,IAAIvB,OAAO8C,KAAK;QACvC,MAAMD,mBAAmBtB,IAAIvB,QAAQ2B;QACrC,OAAOA;IACT;AACF;AAEA,OAAO,eAAe8B,0BACpBzD,MAAqD;IAErD,OAAO,MAAMP,KAAK6B,WAAW,CAAC,OAAOC;QACnC,MAAM2B,iBAAiB3B,IAAIvB;QAC3B,MAAMuB,GAAGC,OAAO,CAACvC,GAAG,CAAC,iEAAiE,CAAC;QAEvF,MAAMmE,WAAW,MAAMb,kBAAkBhB,IAAI;YAC3C,GAAGvB,MAAM;YACT2C,SAAS3C,OAAO8C,KAAK,CAACH,OAAO;QAC/B;QACA,IAAIS,UAAU,OAAOA;QAErB,MAAMnD,OAAO,MAAMsB,GAChBb,MAAM,GACNC,IAAI,CAAChB,aACLuB,KAAK,CAACrC,IAAIE,GAAGY,YAAYsB,EAAE,EAAEjB,OAAOyB,OAAO,GAAGzC,OAAOW,YAAYwB,SAAS,IAC1EO,KAAK,CAAC;QACT,MAAMC,QAAQ1B,IAAI,CAAC,EAAE;QACrB,IAAI,CAAC0B,OAAO,MAAM,IAAItC;QAEtB,IAAIsC,MAAMtB,IAAI,KAAK,eAAe;YAChC,MAAMwB,eAAe,MAAMN,GACxBb,MAAM,CAAC;gBAACO,IAAItB,YAAYsB,EAAE;YAAA,GAC1BN,IAAI,CAAChB,aACLqB,SAAS,CAAClB,OAAOf,GAAGY,YAAYS,MAAM,EAAEN,MAAMmB,EAAE,GAChDC,KAAK,CACJrC,IACEE,GAAGY,YAAYU,IAAI,EAAE,gBACrBrB,OAAOW,YAAYwB,SAAS,GAC5BpC,GAAGe,MAAMsB,MAAM,EAAE;YAGvB,IAAIS,aAAaC,MAAM,IAAI,GAAG,MAAM,IAAIvC;QAC1C;QAEA,MAAMwC,UAAU,MAAMR,GACnBS,MAAM,CAACrC,aACPsC,GAAG,CAAC;YAACd,WAAW,IAAIe;YAAQC,WAAW,IAAID;QAAM,GACjDhB,KAAK,CAACrC,IAAIE,GAAGY,YAAYsB,EAAE,EAAEU,MAAMV,EAAE,GAAGjC,OAAOW,YAAYwB,SAAS,IACpEb,SAAS;QACZ,MAAMoD,aAAa3B,OAAO,CAAC,EAAE;QAC7B,IAAI,CAAC2B,YAAY,MAAM,IAAIrE;QAE3B,MAAMsE,UAAU/D,aAAa8D;QAC7B,MAAMX,iBAAiBxB,IAAIvB,OAAO8C,KAAK;QACvC,MAAMD,mBAAmBtB,IAAIvB,QAAQ2D;QACrC,OAAOA;IACT;AACF"}

package/dist/db/db.d.ts

@@ -109,6 +109,134 @@ export declare const schema: {
         };
         dialect: "pg";
     }>;
+    adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_command_results";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            actorId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "actor_id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            idempotencyKeyFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "idempotency_key_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            command: import("drizzle-orm/pg-core").PgColumn<{
+                name: "command";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "request_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            result: import("drizzle-orm/pg-core").PgColumn<{
+                name: "result";
+                tableName: "admin_command_results";
+                dataType: "json";
+                columnType: "PgJsonb";
+                data: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+                driverParam: unknown;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                $type: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+            }>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_command_results";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;
@@ -986,6 +1114,134 @@ export declare function db(): NodePgDatabase<{
         };
         dialect: "pg";
     }>;
+    adminCommandResults: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "admin_command_results";
+        schema: undefined;
+        columns: {
+            id: import("drizzle-orm/pg-core").PgColumn<{
+                name: "id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: true;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            actorId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "actor_id";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            idempotencyKeyFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "idempotency_key_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            command: import("drizzle-orm/pg-core").PgColumn<{
+                name: "command";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            requestFingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "request_fingerprint";
+                tableName: "admin_command_results";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            result: import("drizzle-orm/pg-core").PgColumn<{
+                name: "result";
+                tableName: "admin_command_results";
+                dataType: "json";
+                columnType: "PgJsonb";
+                data: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+                driverParam: unknown;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {
+                $type: import("./schema/admin-command-results.js").StoredAdminCommandResult;
+            }>;
+            createdAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "created_at";
+                tableName: "admin_command_results";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
     users: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "users";
         schema: undefined;

package/dist/db/db.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AASnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAOlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}
+{"version":3,"file":"db.d.ts","sourceRoot":"","sources":["../../src/db/db.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,cAAc,EAAC,MAAM,uBAAuB,CAAC;AAUnE,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAQlB,CAAC;AAIF,wBAAgB,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAGjB;AAED,wBAAgB,OAAO,IAAI,IAAI,CAE9B"}

package/dist/db/db.js

@@ -1,5 +1,6 @@
 import { drizzle } from '@shipfox/node-drizzle';
 import { pgClient } from '@shipfox/node-postgres';
+import { adminCommandResults } from './schema/admin-command-results.js';
 import { adminGrants } from './schema/admin-grants.js';
 import { authOutbox } from './schema/outbox.js';
 import { passwordResets } from './schema/password-resets.js';
@@ -8,6 +9,7 @@ import { refreshTokens } from './schema/refresh-tokens.js';
 import { users } from './schema/users.js';
 export const schema = {
     adminGrants,
+    adminCommandResults,
     users,
     passwordResets,
     refreshTokens,

package/dist/db/db.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  adminGrants,\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","adminGrants","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBN;IACAK;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMT,QAAQC,YAAY;QAACO;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}
+{"version":3,"sources":["../../src/db/db.ts"],"sourcesContent":["import {drizzle, type NodePgDatabase} from '@shipfox/node-drizzle';\nimport {pgClient} from '@shipfox/node-postgres';\nimport {adminCommandResults} from './schema/admin-command-results.js';\nimport {adminGrants} from './schema/admin-grants.js';\nimport {authOutbox} from './schema/outbox.js';\nimport {passwordResets} from './schema/password-resets.js';\nimport {authRateLimits} from './schema/rate-limits.js';\nimport {refreshTokens} from './schema/refresh-tokens.js';\nimport {users} from './schema/users.js';\n\nexport const schema = {\n  adminGrants,\n  adminCommandResults,\n  users,\n  passwordResets,\n  refreshTokens,\n  authOutbox,\n  authRateLimits,\n};\n\nlet _db: NodePgDatabase<typeof schema> | undefined;\n\nexport function db() {\n  if (!_db) _db = drizzle(pgClient(), {schema});\n  return _db;\n}\n\nexport function closeDb(): void {\n  _db = undefined;\n}\n"],"names":["drizzle","pgClient","adminCommandResults","adminGrants","authOutbox","passwordResets","authRateLimits","refreshTokens","users","schema","_db","db","closeDb","undefined"],"mappings":"AAAA,SAAQA,OAAO,QAA4B,wBAAwB;AACnE,SAAQC,QAAQ,QAAO,yBAAyB;AAChD,SAAQC,mBAAmB,QAAO,oCAAoC;AACtE,SAAQC,WAAW,QAAO,2BAA2B;AACrD,SAAQC,UAAU,QAAO,qBAAqB;AAC9C,SAAQC,cAAc,QAAO,8BAA8B;AAC3D,SAAQC,cAAc,QAAO,0BAA0B;AACvD,SAAQC,aAAa,QAAO,6BAA6B;AACzD,SAAQC,KAAK,QAAO,oBAAoB;AAExC,OAAO,MAAMC,SAAS;IACpBN;IACAD;IACAM;IACAH;IACAE;IACAH;IACAE;AACF,EAAE;AAEF,IAAII;AAEJ,OAAO,SAASC;IACd,IAAI,CAACD,KAAKA,MAAMV,QAAQC,YAAY;QAACQ;IAAM;IAC3C,OAAOC;AACT;AAEA,OAAO,SAASE;IACdF,MAAMG;AACR"}