@spinajs/authn-orm 0.0.0-stage → 3.0.0

package/lib/cjs/models/AuthnMfa.js

@@ -0,0 +1,39 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnMfa = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+/** One MFA step of an identity; the primary key is (identity, step). */
+let AuthnMfa = class AuthnMfa extends orm_1.ModelBase {
+};
+exports.AuthnMfa = AuthnMfa;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnMfa.prototype, "identity", void 0);
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnMfa.prototype, "step", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnMfa.prototype, "confirmed_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnMfa.prototype, "created_at", void 0);
+exports.AuthnMfa = AuthnMfa = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_mfa')
+], AuthnMfa);
+//# sourceMappingURL=AuthnMfa.js.map

package/lib/cjs/models/AuthnMfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnMfa.js","sourceRoot":"","sources":["../../../src/models/AuthnMfa.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAEjC,wEAAwE;AAGjE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,eAAmB;CAuBhD,CAAA;;AArBQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;0CACX;AAGjB;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;sCACf;AAWb;IADN,IAAA,cAAE,GAAE;8BACiB,gBAAQ;8CAAC;AAMxB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;4CAAC;mBAtBjB,QAAQ;IAFpB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,WAAW,CAAC;GACN,QAAQ,CAuBpB"}

package/lib/cjs/models/AuthnNonce.d.ts

@@ -0,0 +1,7 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnNonce extends ModelBase<AuthnNonce> {
+    k: string;
+    expires_at: DateTime;
+}
+//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/cjs/models/AuthnNonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnNonce.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnNonce = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+let AuthnNonce = class AuthnNonce extends orm_1.ModelBase {
+};
+exports.AuthnNonce = AuthnNonce;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnNonce.prototype, "k", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnNonce.prototype, "expires_at", void 0);
+exports.AuthnNonce = AuthnNonce = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_nonce')
+], AuthnNonce);
+//# sourceMappingURL=AuthnNonce.js.map

package/lib/cjs/models/AuthnNonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAI1B,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,eAAqB;CAMpD,CAAA;;AAJQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;qCAClB;AAGV;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;8CAAC;qBALjB,UAAU;IAFtB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/cjs/models/AuthnRecoveryCode.d.ts

@@ -0,0 +1,10 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnRecoveryCode extends ModelBase<AuthnRecoveryCode> {
+    id: string;
+    identity: string;
+    /** Hex SHA-256 of the raw code. */
+    code_hash: string;
+    used_at?: DateTime;
+}
+//# sourceMappingURL=AuthnRecoveryCode.d.ts.map

package/lib/cjs/models/AuthnRecoveryCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnRecoveryCode.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnRecoveryCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,iBAAkB,SAAQ,SAAS,CAAC,iBAAiB,CAAC;IAE1D,EAAE,EAAE,MAAM,CAAC;IAEX,QAAQ,EAAE,MAAM,CAAC;IAExB,mCAAmC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAIlB,OAAO,CAAC,EAAE,QAAQ,CAAC;CAC3B"}

package/lib/cjs/models/AuthnRecoveryCode.js

@@ -0,0 +1,30 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnRecoveryCode = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+let AuthnRecoveryCode = class AuthnRecoveryCode extends orm_1.ModelBase {
+};
+exports.AuthnRecoveryCode = AuthnRecoveryCode;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnRecoveryCode.prototype, "id", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnRecoveryCode.prototype, "used_at", void 0);
+exports.AuthnRecoveryCode = AuthnRecoveryCode = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_recovery_code')
+], AuthnRecoveryCode);
+//# sourceMappingURL=AuthnRecoveryCode.js.map

package/lib/cjs/models/AuthnRecoveryCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnRecoveryCode.js","sourceRoot":"","sources":["../../../src/models/AuthnRecoveryCode.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAI1B,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,eAA4B;CAYlE,CAAA;;AAVQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;6CACjB;AASX;IADN,IAAA,cAAE,GAAE;8BACY,gBAAQ;kDAAC;4BAXf,iBAAiB;IAF7B,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,qBAAqB,CAAC;GAChB,iBAAiB,CAY7B"}

package/lib/cjs/models/AuthnSecret.d.ts

@@ -0,0 +1,13 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnSecret extends ModelBase<AuthnSecret> {
+    id: string;
+    identity: string;
+    purpose: string;
+    /** Hex SHA-256 of the raw secret. */
+    secret_hash: string;
+    expires_at: DateTime;
+    used_at?: DateTime;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnSecret.d.ts.map

package/lib/cjs/models/AuthnSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnSecret.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IAE9C,EAAE,EAAE,MAAM,CAAC;IAEX,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEvB,qCAAqC;IAC9B,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,EAAE,QAAQ,CAAC;IAIrB,OAAO,CAAC,EAAE,QAAQ,CAAC;IAGnB,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnSecret.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnSecret = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+let AuthnSecret = class AuthnSecret extends orm_1.ModelBase {
+};
+exports.AuthnSecret = AuthnSecret;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnSecret.prototype, "id", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnSecret.prototype, "expires_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnSecret.prototype, "used_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnSecret.prototype, "created_at", void 0);
+exports.AuthnSecret = AuthnSecret = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_secret')
+], AuthnSecret);
+//# sourceMappingURL=AuthnSecret.js.map

package/lib/cjs/models/AuthnSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnSecret.js","sourceRoot":"","sources":["../../../src/models/AuthnSecret.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAI1B,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,eAAsB;CAoBtD,CAAA;;AAlBQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;uCACjB;AAUX;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;+CAAC;AAIrB;IADN,IAAA,cAAE,GAAE;8BACY,gBAAQ;4CAAC;AAGnB;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;+CAAC;sBAnBjB,WAAW;IAFvB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,cAAc,CAAC;GACT,WAAW,CAoBvB"}

package/lib/cjs/models/AuthnThrottle.d.ts

@@ -0,0 +1,10 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnThrottle extends ModelBase<AuthnThrottle> {
+    k: string;
+    attempts: number;
+    last_attempt_at: DateTime;
+    next_allowed_at: DateTime;
+    updated_at: DateTime;
+}
+//# sourceMappingURL=AuthnThrottle.d.ts.map

package/lib/cjs/models/AuthnThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnThrottle.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnThrottle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,aAAc,SAAQ,SAAS,CAAC,aAAa,CAAC;IAElD,CAAC,EAAE,MAAM,CAAC;IAEV,QAAQ,EAAE,MAAM,CAAC;IAGjB,eAAe,EAAE,QAAQ,CAAC;IAG1B,eAAe,EAAE,QAAQ,CAAC;IAG1B,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/cjs/models/AuthnThrottle.js

@@ -0,0 +1,38 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnThrottle = void 0;
+const orm_1 = require("@spinajs/orm");
+const luxon_1 = require("luxon");
+let AuthnThrottle = class AuthnThrottle extends orm_1.ModelBase {
+};
+exports.AuthnThrottle = AuthnThrottle;
+__decorate([
+    (0, orm_1.Primary)({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnThrottle.prototype, "k", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnThrottle.prototype, "last_attempt_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnThrottle.prototype, "next_allowed_at", void 0);
+__decorate([
+    (0, orm_1.DateTime)(),
+    __metadata("design:type", luxon_1.DateTime)
+], AuthnThrottle.prototype, "updated_at", void 0);
+exports.AuthnThrottle = AuthnThrottle = __decorate([
+    (0, orm_1.Connection)('default'),
+    (0, orm_1.Model)('authn_throttle')
+], AuthnThrottle);
+//# sourceMappingURL=AuthnThrottle.js.map

package/lib/cjs/models/AuthnThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnThrottle.js","sourceRoot":"","sources":["../../../src/models/AuthnThrottle.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,sCAAqF;AACrF,iCAAiC;AAI1B,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,eAAwB;CAc1D,CAAA;;AAZQ;IADN,IAAA,aAAO,EAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;wCAClB;AAKV;IADN,IAAA,cAAE,GAAE;8BACmB,gBAAQ;sDAAC;AAG1B;IADN,IAAA,cAAE,GAAE;8BACmB,gBAAQ;sDAAC;AAG1B;IADN,IAAA,cAAE,GAAE;8BACc,gBAAQ;iDAAC;wBAbjB,aAAa;IAFzB,IAAA,gBAAU,EAAC,SAAS,CAAC;IACrB,IAAA,WAAK,EAAC,gBAAgB,CAAC;GACX,aAAa,CAczB"}

package/lib/cjs/models/index.d.ts

@@ -0,0 +1,9 @@
+export * from './AuthnAudit.js';
+export * from './AuthnIdentity.js';
+export * from './AuthnMfa.js';
+export * from './AuthnNonce.js';
+export * from './AuthnRecoveryCode.js';
+export * from './AuthnSecret.js';
+export * from './AuthnThrottle.js';
+export * from './time.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC"}

package/lib/cjs/models/index.js

@@ -0,0 +1,25 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./AuthnAudit.js"), exports);
+__exportStar(require("./AuthnIdentity.js"), exports);
+__exportStar(require("./AuthnMfa.js"), exports);
+__exportStar(require("./AuthnNonce.js"), exports);
+__exportStar(require("./AuthnRecoveryCode.js"), exports);
+__exportStar(require("./AuthnSecret.js"), exports);
+__exportStar(require("./AuthnThrottle.js"), exports);
+__exportStar(require("./time.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,kDAAgC;AAChC,qDAAmC;AACnC,gDAA8B;AAC9B,kDAAgC;AAChC,yDAAuC;AACvC,mDAAiC;AACjC,qDAAmC;AACnC,4CAA0B"}

package/lib/cjs/models/time.d.ts

@@ -0,0 +1,4 @@
+import { DateTime } from 'luxon';
+/** The instant of a datetime as a driver returns it or as text read with a cast; text without an offset is UTC. */
+export declare function readInstant(v: DateTime | Date | string | null | undefined): Date | undefined;
+//# sourceMappingURL=time.d.ts.map

package/lib/cjs/models/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../src/models/time.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAY5F"}

package/lib/cjs/models/time.js

@@ -0,0 +1,19 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.readInstant = readInstant;
+const luxon_1 = require("luxon");
+/** The instant of a datetime as a driver returns it or as text read with a cast; text without an offset is UTC. */
+function readInstant(v) {
+    if (v === null || v === undefined) {
+        return undefined;
+    }
+    if (v instanceof Date) {
+        return new Date(v.getTime());
+    }
+    if (typeof v === 'string') {
+        const sql = luxon_1.DateTime.fromSQL(v, { zone: 'utc' });
+        return (sql.isValid ? sql : luxon_1.DateTime.fromISO(v, { zone: 'utc' })).toJSDate();
+    }
+    return v.toJSDate();
+}
+//# sourceMappingURL=time.js.map

package/lib/cjs/models/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../../src/models/time.ts"],"names":[],"mappings":";;;AAAA,iCAAiC;AAEjC,mHAAmH;AACnH,qBAA4B,CAA8C;IACxE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,gBAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/lib/cjs/nonces/index.d.ts

@@ -0,0 +1,2 @@
+export * from './nonce-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/cjs/nonces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonces/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/lib/cjs/nonces/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./nonce-store.js"), exports);
+//# sourceMappingURL=index.js.map

package/lib/cjs/nonces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonces/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,mDAAiC"}

package/lib/cjs/nonces/nonce-store.d.ts

@@ -0,0 +1,11 @@
+import { NonceStore } from '@spinajs/authn/contracts';
+export { NonceStore } from '@spinajs/authn/contracts';
+export { MemoryNonceStore } from '@spinajs/authn/nonces';
+/** `authn_nonce`: the primary key makes a claim atomic across processes; an expired row is taken over with a conditional update. */
+export declare class DbNonceStore extends NonceStore {
+    private readonly purgeDue;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+    /** Deletes up to one batch of expired keys; returns how many went. */
+    purge(now?: Date): Promise<number>;
+}
+//# sourceMappingURL=nonce-store.d.ts.map

package/lib/cjs/nonces/nonce-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-store.d.ts","sourceRoot":"","sources":["../../../src/nonces/nonce-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAOtD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAazD,oIAAoI;AACpI,qBAEa,YAAa,SAAQ,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB5E;IAED,sEAAsE;IACzD,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D;CACF"}

package/lib/cjs/nonces/nonce-store.js

@@ -0,0 +1,77 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbNonceStore = exports.MemoryNonceStore = exports.NonceStore = void 0;
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const AuthnNonce_js_1 = require("../models/AuthnNonce.js");
+const sql_js_1 = require("../support/sql.js");
+var contracts_2 = require("@spinajs/authn/contracts");
+Object.defineProperty(exports, "NonceStore", { enumerable: true, get: function () { return contracts_2.NonceStore; } });
+var nonces_1 = require("@spinajs/authn/nonces");
+Object.defineProperty(exports, "MemoryNonceStore", { enumerable: true, get: function () { return nonces_1.MemoryNonceStore; } });
+const KEY_MAX = 160;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** A miss after a duplicate means a purge removed the row in between; a few retries cover that. */
+const MAX_TRIES = 8;
+function checkClaim(key, expiresAt, now, owner) {
+    (0, sql_js_1.checkedText)(key, KEY_MAX, `${owner}.claim: key`);
+    return { expiresMs: (0, sql_js_1.checkedMs)(expiresAt, `${owner}.claim: expiresAt`), nowMs: (0, sql_js_1.checkedMs)(now, `${owner}.claim: now`) };
+}
+/** `authn_nonce`: the primary key makes a claim atomic across processes; an expired row is taken over with a conditional update. */
+let DbNonceStore = class DbNonceStore extends contracts_1.NonceStore {
+    constructor() {
+        super(...arguments);
+        this.purgeDue = (0, orm_1.everyNthCall)(PURGE_EVERY);
+    }
+    async claim(key, expiresAt, now) {
+        const { expiresMs, nowMs } = checkClaim(key, expiresAt, now, 'DbNonceStore');
+        await (0, orm_1.ormReady)();
+        if (this.purgeDue()) {
+            await this.purge(now);
+        }
+        const t = (0, sql_js_1.instant)(nowMs);
+        const expires = (0, sql_js_1.instant)(expiresMs);
+        for (let i = 0; i < MAX_TRIES; i++) {
+            try {
+                await AuthnNonce_js_1.AuthnNonce.insert({ k: key, expires_at: expires });
+                return true;
+            }
+            catch (err) {
+                if (!(err instanceof orm_1.UniqueViolation))
+                    throw err;
+            }
+            if ((await AuthnNonce_js_1.AuthnNonce.update({ expires_at: expires }).where('k', key).where('expires_at', '<=', t)).RowsAffected === 1) {
+                return true;
+            }
+            const live = await AuthnNonce_js_1.AuthnNonce.query().columns(['k']).where('k', key).where('expires_at', '>', t);
+            if (live.length > 0)
+                return false;
+        }
+        return false;
+    }
+    /** Deletes up to one batch of expired keys; returns how many went. */
+    async purge(now = new Date()) {
+        const ms = (0, sql_js_1.checkedMs)(now, 'DbNonceStore.purge: now');
+        await (0, orm_1.ormReady)();
+        const t = (0, sql_js_1.instant)(ms);
+        // MSSQL pages with OFFSET … FETCH, which needs an ORDER BY.
+        const keys = (await AuthnNonce_js_1.AuthnNonce.query().columns(['k']).where('expires_at', '<=', t).orderBy('k').take(PURGE_BATCH)).map((r) => r.k);
+        if (keys.length === 0)
+            return 0;
+        return (await AuthnNonce_js_1.AuthnNonce.destroy().whereIn('k', keys).where('expires_at', '<=', t)).RowsAffected;
+    }
+};
+exports.DbNonceStore = DbNonceStore;
+exports.DbNonceStore = DbNonceStore = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.NonceStore)
+], DbNonceStore);
+//# sourceMappingURL=nonce-store.js.map

package/lib/cjs/nonces/nonce-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-store.js","sourceRoot":"","sources":["../../../src/nonces/nonce-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,wDAAsD;AACtD,oCAA2D;AAC3D,sCAAuE;AAEvE,2DAAqD;AACrD,8CAAoE;AAEpE,sDAAsD;AAA7C,uGAAA,UAAU,OAAA;AACnB,gDAAyD;AAAhD,0GAAA,gBAAgB,OAAA;AAEzB,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,mGAAmG;AACnG,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,UAAU,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS,EAAE,KAAa;IACxE,IAAA,oBAAW,EAAC,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACjD,OAAO,EAAE,SAAS,EAAE,IAAA,kBAAS,EAAC,SAAS,EAAE,GAAG,KAAK,mBAAmB,CAAC,EAAE,KAAK,EAAE,IAAA,kBAAS,EAAC,GAAG,EAAE,GAAG,KAAK,aAAa,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,oIAAoI;AAG7H,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,sBAAU;IAArC;;QACY,aAAQ,GAAG,IAAA,kBAAY,EAAC,WAAW,CAAC,CAAC;IAqCxD,CAAC;IAnCQ,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACxD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7E,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,IAAA,gBAAO,EAAC,SAAS,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,0BAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,qBAAe,CAAC;oBAAE,MAAM,GAAG,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,MAAM,0BAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,0BAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IAC/D,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACrD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,EAAE,CAAC,CAAC;QACtB,4DAA4D;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,0BAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,0BAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACnG,CAAC;CACF,CAAA;;uBAtCY,YAAY;IAFxB,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,sBAAU,CAAC;GACV,YAAY,CAsCxB"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/secrets/db-secret-store.d.ts

@@ -0,0 +1,25 @@
+import { SecretStore } from '@spinajs/authn/contracts';
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import type { DateTime } from 'luxon';
+/**
+ * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
+ * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * decides expiry and single use in SQL against that time (D10).
+ *
+ * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
+ */
+export declare class DbSecretStore extends SecretStore {
+    private readonly purgeDue;
+    issue(identity: IdentityRef, purpose: string, ttlSeconds: number): Promise<string>;
+    /**
+     * Looks the row up by the hash of `raw`, so no stored value is compared with the input in Node. The lookup
+     * also matches identity and purpose; the claim succeeds for exactly one caller.
+     */
+    redeem(identity: IdentityRef, purpose: string, raw: string): Promise<boolean>;
+    /** Deletes up to one batch of spent and expired rows; returns how many went. */
+    purge(now?: Date): Promise<number>;
+    /** @internal An early exit only: the claim's SQL guard decides. */
+    protected liveInNode(expiresAt: DateTime | null | undefined, nowMs: number): boolean;
+    private purgeNowAndThen;
+}
+//# sourceMappingURL=db-secret-store.d.ts.map

package/lib/cjs/secrets/db-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-secret-store.d.ts","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAK5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAatC;;;;;;GAMG;AACH,qBAEa,aAAc,SAAQ,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9F;IAED;;;OAGG;IACU,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBzF;IAED,gFAAgF;IACnE,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1D;IAED,mEAAmE;IACnE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnF;YAEa,eAAe;CAK9B"}

package/lib/cjs/secrets/db-secret-store.js

@@ -0,0 +1,99 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbSecretStore = void 0;
+const node_crypto_1 = require("node:crypto");
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const orm_1 = require("@spinajs/orm");
+const util_1 = require("@spinajs/util");
+const identity_js_1 = require("../identity.js");
+const AuthnSecret_js_1 = require("../models/AuthnSecret.js");
+const sql_js_1 = require("../support/sql.js");
+const values_js_1 = require("../support/values.js");
+const PURPOSE_MAX = 32;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** Far above any secret this store issues; longer input is refused before hashing. */
+const RAW_MAX = 1024;
+/**
+ * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
+ * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * decides expiry and single use in SQL against that time (D10).
+ *
+ * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
+ */
+let DbSecretStore = class DbSecretStore extends contracts_1.SecretStore {
+    constructor() {
+        super(...arguments);
+        this.purgeDue = (0, orm_1.everyNthCall)(PURGE_EVERY);
+    }
+    async issue(identity, purpose, ttlSeconds) {
+        const key = (0, identity_js_1.identityKey)(identity);
+        (0, sql_js_1.checkedText)(purpose, PURPOSE_MAX, 'DbSecretStore: purpose');
+        (0, util_1._check_arg)((0, util_1._is_number)((0, util_1._finite)(), (0, util_1._gt)(0)))(ttlSeconds, 'ttlSeconds');
+        const nowMs = (0, sql_js_1.checkedMs)(new Date(), 'DbSecretStore.issue: the clock');
+        await (0, orm_1.ormReady)();
+        await this.purgeNowAndThen(nowMs);
+        const raw = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        await AuthnSecret_js_1.AuthnSecret.destroy().where('identity', key).where('purpose', purpose);
+        await AuthnSecret_js_1.AuthnSecret.insert((0, values_js_1.columnValues)({ id: (0, node_crypto_1.randomUUID)(), identity: key, purpose, secret_hash: (0, sql_js_1.sha256hex)(raw), expires_at: (0, sql_js_1.instant)(nowMs + ttlSeconds * 1000), used_at: null, created_at: (0, sql_js_1.instant)(nowMs) }));
+        return raw;
+    }
+    /**
+     * Looks the row up by the hash of `raw`, so no stored value is compared with the input in Node. The lookup
+     * also matches identity and purpose; the claim succeeds for exactly one caller.
+     */
+    async redeem(identity, purpose, raw) {
+        const key = (0, identity_js_1.identityKey)(identity);
+        (0, sql_js_1.checkedText)(purpose, PURPOSE_MAX, 'DbSecretStore: purpose');
+        if (!(0, util_1._try_check_arg)((0, util_1._is_string)((0, util_1._non_empty)(), (0, util_1._max_length)(RAW_MAX)))(raw, 'raw')[0])
+            return false;
+        const nowMs = (0, sql_js_1.checkedMs)(new Date(), 'DbSecretStore.redeem: the clock');
+        await (0, orm_1.ormReady)();
+        await this.purgeNowAndThen(nowMs);
+        const rows = await AuthnSecret_js_1.AuthnSecret.query().columns(['id', 'identity', 'purpose', 'expires_at']).where('secret_hash', (0, sql_js_1.sha256hex)(raw)).where('identity', key).where('purpose', purpose).whereNull('used_at');
+        // MySQL and MSSQL default collations ignore case: the binding to identity and purpose is checked exactly here.
+        const row = rows.find((r) => r.identity === key && r.purpose === purpose);
+        if (!row || !this.liveInNode(row.expires_at, nowMs))
+            return false;
+        const now = (0, sql_js_1.instant)(nowMs);
+        const { RowsAffected } = await AuthnSecret_js_1.AuthnSecret.update({ used_at: now }).where('id', row.id).whereNull('used_at').where('expires_at', '>', now);
+        return RowsAffected === 1;
+    }
+    /** Deletes up to one batch of spent and expired rows; returns how many went. */
+    async purge(now = new Date()) {
+        const ms = (0, sql_js_1.checkedMs)(now, 'DbSecretStore.purge: now');
+        await (0, orm_1.ormReady)();
+        const t = (0, sql_js_1.instant)(ms);
+        const done = function () {
+            this.whereNotNull('used_at');
+            this.orWhere('expires_at', '<=', t);
+        };
+        const ids = (await AuthnSecret_js_1.AuthnSecret.query().columns(['id']).where(done).orderBy('id').take(PURGE_BATCH)).map((r) => r.id);
+        if (ids.length === 0)
+            return 0;
+        return (await AuthnSecret_js_1.AuthnSecret.destroy().whereIn('id', ids).where(done)).RowsAffected;
+    }
+    /** @internal An early exit only: the claim's SQL guard decides. */
+    liveInNode(expiresAt, nowMs) {
+        const ms = expiresAt ? expiresAt.toMillis() : NaN;
+        return !Number.isFinite(ms) || ms > nowMs;
+    }
+    async purgeNowAndThen(nowMs) {
+        if (this.purgeDue()) {
+            await this.purge(new Date(nowMs));
+        }
+    }
+};
+exports.DbSecretStore = DbSecretStore;
+exports.DbSecretStore = DbSecretStore = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.SecretStore)
+], DbSecretStore);
+//# sourceMappingURL=db-secret-store.js.map

package/lib/cjs/secrets/db-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-secret-store.js","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAsD;AAEtD,wDAAuD;AAEvD,oCAA2D;AAC3D,sCAAsD;AAEtD,wCAA0H;AAG1H,gDAA6C;AAC7C,6DAAuD;AACvD,8CAA+E;AAC/E,oDAAoD;AAEpD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;;GAMG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,uBAAW;IAAvC;;QACY,aAAQ,GAAG,IAAA,kBAAY,EAAC,WAAW,CAAC,CAAC;IA+DxD,CAAC;IA7DQ,KAAK,CAAC,KAAK,CAAC,QAAqB,EAAE,OAAe,EAAE,UAAkB;QAC3E,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,cAAO,GAAE,EAAE,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACtE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,4BAAW,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAc,EAAE,EAAE,EAAE,IAAA,wBAAU,GAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1N,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,OAAe,EAAE,GAAW;QACrE,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACvE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvM,+GAA+G;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElE,MAAM,GAAG,GAAG,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,4BAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3I,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,gFAAgF;IACzE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACtD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,EAAE,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG;YACX,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnF,CAAC;IAED,mEAAmE;IACzD,UAAU,CAAC,SAAsC,EAAE,KAAa;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF,CAAA;;wBAhEY,aAAa;IAFzB,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,uBAAW,CAAC;GACX,aAAa,CAgEzB"}

package/lib/cjs/secrets/index.d.ts

@@ -0,0 +1,2 @@
+export { DbSecretStore } from './db-secret-store.js';
+//# sourceMappingURL=index.d.ts.map