@spinajs/authn-orm 0.0.0-stage → 3.0.0

package/lib/mjs/models/AuthnAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnAudit.js","sourceRoot":"","sources":["../../../src/models/AuthnAudit.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI1B,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,SAAqB;CA2BpD,CAAA;AAzBQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;sCACjB;AAGX;IADN,EAAE,EAAE;8BACM,QAAQ;sCAAC;AALT,UAAU;IAFtB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,aAAa,CAAC;GACR,UAAU,CA2BtB"}

package/lib/mjs/models/AuthnIdentity.d.ts

@@ -0,0 +1,16 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A link from an external subject to an identity (design §22.16). */
+export declare class AuthnIdentity extends ModelBase<AuthnIdentity> {
+    id: string;
+    identity_type: string;
+    identity_id: string;
+    provider: string;
+    subject: string;
+    email?: string | null;
+    email_verified: boolean;
+    attributes?: string | null;
+    linked_at: DateTime;
+    last_used_at?: DateTime;
+}
+//# sourceMappingURL=AuthnIdentity.d.ts.map

package/lib/mjs/models/AuthnIdentity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnIdentity.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnIdentity.ts"],"names":[],"mappings":"AAAA,OAAO,EAA2C,SAAS,EAAW,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,sEAAsE;AACtE,qBAEa,aAAc,SAAQ,SAAS,CAAC,aAAa,CAAC;IAElD,EAAE,EAAE,MAAM,CAAC;IAEX,aAAa,EAAE,MAAM,CAAC;IAEtB,WAAW,EAAE,MAAM,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEhB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAGtB,cAAc,EAAE,OAAO,CAAC;IAExB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3B,SAAS,EAAE,QAAQ,CAAC;IAIpB,YAAY,CAAC,EAAE,QAAQ,CAAC;CAChC"}

package/lib/mjs/models/AuthnIdentity.js

@@ -0,0 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Bool, Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** A link from an external subject to an identity (design §22.16). */
+let AuthnIdentity = class AuthnIdentity extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnIdentity.prototype, "id", void 0);
+__decorate([
+    Bool(),
+    __metadata("design:type", Boolean)
+], AuthnIdentity.prototype, "email_verified", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnIdentity.prototype, "linked_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnIdentity.prototype, "last_used_at", void 0);
+AuthnIdentity = __decorate([
+    Connection('default'),
+    Model('authn_identity')
+], AuthnIdentity);
+export { AuthnIdentity };
+//# sourceMappingURL=AuthnIdentity.js.map

package/lib/mjs/models/AuthnIdentity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnIdentity.js","sourceRoot":"","sources":["../../../src/models/AuthnIdentity.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAC3F,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,sEAAsE;AAG/D,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,SAAwB;CAyB1D,CAAA;AAvBQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;yCACjB;AAaX;IADN,IAAI,EAAE;;qDACwB;AAKxB;IADN,EAAE,EAAE;8BACa,QAAQ;gDAAC;AAIpB;IADN,EAAE,EAAE;8BACiB,QAAQ;mDAAC;AAxBpB,aAAa;IAFzB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,gBAAgB,CAAC;GACX,aAAa,CAyBzB"}

package/lib/mjs/models/AuthnMfa.d.ts

@@ -0,0 +1,16 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** One MFA step of an identity; the primary key is (identity, step). */
+export declare class AuthnMfa extends ModelBase<AuthnMfa> {
+    identity: string;
+    step: string;
+    secret_enc: string;
+    /** Hex SHA-256 of `secret_enc`: `confirm` compares this, since TEXT is not comparable on MSSQL and case-blind on MySQL. */
+    secret_hash: string;
+    key_id: string;
+    confirmed_at?: DateTime;
+    /** Postgres returns bigint as a string. */
+    last_step?: number | string | null;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnMfa.d.ts.map

package/lib/mjs/models/AuthnMfa.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnMfa.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnMfa.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,wEAAwE;AACxE,qBAEa,QAAS,SAAQ,SAAS,CAAC,QAAQ,CAAC;IAExC,QAAQ,EAAE,MAAM,CAAC;IAGjB,IAAI,EAAE,MAAM,CAAC;IAEb,UAAU,EAAE,MAAM,CAAC;IAE1B,2HAA2H;IACpH,WAAW,EAAE,MAAM,CAAC;IAEpB,MAAM,EAAE,MAAM,CAAC;IAIf,YAAY,CAAC,EAAE,QAAQ,CAAC;IAE/B,2CAA2C;IACpC,SAAS,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAGnC,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnMfa.js

@@ -0,0 +1,36 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+/** One MFA step of an identity; the primary key is (identity, step). */
+let AuthnMfa = class AuthnMfa extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnMfa.prototype, "identity", void 0);
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnMfa.prototype, "step", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnMfa.prototype, "confirmed_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnMfa.prototype, "created_at", void 0);
+AuthnMfa = __decorate([
+    Connection('default'),
+    Model('authn_mfa')
+], AuthnMfa);
+export { AuthnMfa };
+//# sourceMappingURL=AuthnMfa.js.map

package/lib/mjs/models/AuthnMfa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnMfa.js","sourceRoot":"","sources":["../../../src/models/AuthnMfa.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,wEAAwE;AAGjE,IAAM,QAAQ,GAAd,MAAM,QAAS,SAAQ,SAAmB;CAuBhD,CAAA;AArBQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;0CACX;AAGjB;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;sCACf;AAWb;IADN,EAAE,EAAE;8BACiB,QAAQ;8CAAC;AAMxB;IADN,EAAE,EAAE;8BACc,QAAQ;4CAAC;AAtBjB,QAAQ;IAFpB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,WAAW,CAAC;GACN,QAAQ,CAuBpB"}

package/lib/mjs/models/AuthnNonce.d.ts

@@ -0,0 +1,7 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnNonce extends ModelBase<AuthnNonce> {
+    k: string;
+    expires_at: DateTime;
+}
+//# sourceMappingURL=AuthnNonce.d.ts.map

package/lib/mjs/models/AuthnNonce.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,UAAW,SAAQ,SAAS,CAAC,UAAU,CAAC;IAE5C,CAAC,EAAE,MAAM,CAAC;IAGV,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnNonce.js

@@ -0,0 +1,27 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+let AuthnNonce = class AuthnNonce extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnNonce.prototype, "k", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnNonce.prototype, "expires_at", void 0);
+AuthnNonce = __decorate([
+    Connection('default'),
+    Model('authn_nonce')
+], AuthnNonce);
+export { AuthnNonce };
+//# sourceMappingURL=AuthnNonce.js.map

package/lib/mjs/models/AuthnNonce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnNonce.js","sourceRoot":"","sources":["../../../src/models/AuthnNonce.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI1B,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,SAAqB;CAMpD,CAAA;AAJQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;qCAClB;AAGV;IADN,EAAE,EAAE;8BACc,QAAQ;8CAAC;AALjB,UAAU;IAFtB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,aAAa,CAAC;GACR,UAAU,CAMtB"}

package/lib/mjs/models/AuthnRecoveryCode.d.ts

@@ -0,0 +1,10 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnRecoveryCode extends ModelBase<AuthnRecoveryCode> {
+    id: string;
+    identity: string;
+    /** Hex SHA-256 of the raw code. */
+    code_hash: string;
+    used_at?: DateTime;
+}
+//# sourceMappingURL=AuthnRecoveryCode.d.ts.map

package/lib/mjs/models/AuthnRecoveryCode.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnRecoveryCode.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnRecoveryCode.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,iBAAkB,SAAQ,SAAS,CAAC,iBAAiB,CAAC;IAE1D,EAAE,EAAE,MAAM,CAAC;IAEX,QAAQ,EAAE,MAAM,CAAC;IAExB,mCAAmC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAIlB,OAAO,CAAC,EAAE,QAAQ,CAAC;CAC3B"}

package/lib/mjs/models/AuthnRecoveryCode.js

@@ -0,0 +1,27 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+let AuthnRecoveryCode = class AuthnRecoveryCode extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnRecoveryCode.prototype, "id", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnRecoveryCode.prototype, "used_at", void 0);
+AuthnRecoveryCode = __decorate([
+    Connection('default'),
+    Model('authn_recovery_code')
+], AuthnRecoveryCode);
+export { AuthnRecoveryCode };
+//# sourceMappingURL=AuthnRecoveryCode.js.map

package/lib/mjs/models/AuthnRecoveryCode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnRecoveryCode.js","sourceRoot":"","sources":["../../../src/models/AuthnRecoveryCode.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI1B,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,SAA4B;CAYlE,CAAA;AAVQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;6CACjB;AASX;IADN,EAAE,EAAE;8BACY,QAAQ;kDAAC;AAXf,iBAAiB;IAF7B,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,qBAAqB,CAAC;GAChB,iBAAiB,CAY7B"}

package/lib/mjs/models/AuthnSecret.d.ts

@@ -0,0 +1,13 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnSecret extends ModelBase<AuthnSecret> {
+    id: string;
+    identity: string;
+    purpose: string;
+    /** Hex SHA-256 of the raw secret. */
+    secret_hash: string;
+    expires_at: DateTime;
+    used_at?: DateTime;
+    created_at: DateTime;
+}
+//# sourceMappingURL=AuthnSecret.d.ts.map

package/lib/mjs/models/AuthnSecret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnSecret.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnSecret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,WAAY,SAAQ,SAAS,CAAC,WAAW,CAAC;IAE9C,EAAE,EAAE,MAAM,CAAC;IAEX,QAAQ,EAAE,MAAM,CAAC;IAEjB,OAAO,EAAE,MAAM,CAAC;IAEvB,qCAAqC;IAC9B,WAAW,EAAE,MAAM,CAAC;IAGpB,UAAU,EAAE,QAAQ,CAAC;IAIrB,OAAO,CAAC,EAAE,QAAQ,CAAC;IAGnB,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnSecret.js

@@ -0,0 +1,35 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+let AuthnSecret = class AuthnSecret extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnSecret.prototype, "id", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnSecret.prototype, "expires_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnSecret.prototype, "used_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnSecret.prototype, "created_at", void 0);
+AuthnSecret = __decorate([
+    Connection('default'),
+    Model('authn_secret')
+], AuthnSecret);
+export { AuthnSecret };
+//# sourceMappingURL=AuthnSecret.js.map

package/lib/mjs/models/AuthnSecret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnSecret.js","sourceRoot":"","sources":["../../../src/models/AuthnSecret.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI1B,IAAM,WAAW,GAAjB,MAAM,WAAY,SAAQ,SAAsB;CAoBtD,CAAA;AAlBQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;uCACjB;AAUX;IADN,EAAE,EAAE;8BACc,QAAQ;+CAAC;AAIrB;IADN,EAAE,EAAE;8BACY,QAAQ;4CAAC;AAGnB;IADN,EAAE,EAAE;8BACc,QAAQ;+CAAC;AAnBjB,WAAW;IAFvB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,cAAc,CAAC;GACT,WAAW,CAoBvB"}

package/lib/mjs/models/AuthnThrottle.d.ts

@@ -0,0 +1,10 @@
+import { ModelBase } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+export declare class AuthnThrottle extends ModelBase<AuthnThrottle> {
+    k: string;
+    attempts: number;
+    last_attempt_at: DateTime;
+    next_allowed_at: DateTime;
+    updated_at: DateTime;
+}
+//# sourceMappingURL=AuthnThrottle.d.ts.map

package/lib/mjs/models/AuthnThrottle.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnThrottle.d.ts","sourceRoot":"","sources":["../../../src/models/AuthnThrottle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAqC,SAAS,EAAW,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,qBAEa,aAAc,SAAQ,SAAS,CAAC,aAAa,CAAC;IAElD,CAAC,EAAE,MAAM,CAAC;IAEV,QAAQ,EAAE,MAAM,CAAC;IAGjB,eAAe,EAAE,QAAQ,CAAC;IAG1B,eAAe,EAAE,QAAQ,CAAC;IAG1B,UAAU,EAAE,QAAQ,CAAC;CAC7B"}

package/lib/mjs/models/AuthnThrottle.js

@@ -0,0 +1,35 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Connection, DateTime as DT, Model, ModelBase, Primary } from '@spinajs/orm';
+import { DateTime } from 'luxon';
+let AuthnThrottle = class AuthnThrottle extends ModelBase {
+};
+__decorate([
+    Primary({ generated: 'assigned' }),
+    __metadata("design:type", String)
+], AuthnThrottle.prototype, "k", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnThrottle.prototype, "last_attempt_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnThrottle.prototype, "next_allowed_at", void 0);
+__decorate([
+    DT(),
+    __metadata("design:type", DateTime)
+], AuthnThrottle.prototype, "updated_at", void 0);
+AuthnThrottle = __decorate([
+    Connection('default'),
+    Model('authn_throttle')
+], AuthnThrottle);
+export { AuthnThrottle };
+//# sourceMappingURL=AuthnThrottle.js.map

package/lib/mjs/models/AuthnThrottle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AuthnThrottle.js","sourceRoot":"","sources":["../../../src/models/AuthnThrottle.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAI1B,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,SAAwB;CAc1D,CAAA;AAZQ;IADN,OAAO,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;;wCAClB;AAKV;IADN,EAAE,EAAE;8BACmB,QAAQ;sDAAC;AAG1B;IADN,EAAE,EAAE;8BACmB,QAAQ;sDAAC;AAG1B;IADN,EAAE,EAAE;8BACc,QAAQ;iDAAC;AAbjB,aAAa;IAFzB,UAAU,CAAC,SAAS,CAAC;IACrB,KAAK,CAAC,gBAAgB,CAAC;GACX,aAAa,CAczB"}

package/lib/mjs/models/index.d.ts

@@ -0,0 +1,9 @@
+export * from './AuthnAudit.js';
+export * from './AuthnIdentity.js';
+export * from './AuthnMfa.js';
+export * from './AuthnNonce.js';
+export * from './AuthnRecoveryCode.js';
+export * from './AuthnSecret.js';
+export * from './AuthnThrottle.js';
+export * from './time.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/models/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC"}

package/lib/mjs/models/index.js

@@ -0,0 +1,9 @@
+export * from './AuthnAudit.js';
+export * from './AuthnIdentity.js';
+export * from './AuthnMfa.js';
+export * from './AuthnNonce.js';
+export * from './AuthnRecoveryCode.js';
+export * from './AuthnSecret.js';
+export * from './AuthnThrottle.js';
+export * from './time.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/models/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/models/index.ts"],"names":[],"mappings":"AAAA,cAAc,iBAAiB,CAAC;AAChC,cAAc,oBAAoB,CAAC;AACnC,cAAc,eAAe,CAAC;AAC9B,cAAc,iBAAiB,CAAC;AAChC,cAAc,wBAAwB,CAAC;AACvC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,WAAW,CAAC"}

package/lib/mjs/models/time.d.ts

@@ -0,0 +1,4 @@
+import { DateTime } from 'luxon';
+/** The instant of a datetime as a driver returns it or as text read with a cast; text without an offset is UTC. */
+export declare function readInstant(v: DateTime | Date | string | null | undefined): Date | undefined;
+//# sourceMappingURL=time.d.ts.map

package/lib/mjs/models/time.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.d.ts","sourceRoot":"","sources":["../../../src/models/time.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,mHAAmH;AACnH,wBAAgB,WAAW,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,GAAG,SAAS,CAY5F"}

package/lib/mjs/models/time.js

@@ -0,0 +1,16 @@
+import { DateTime } from 'luxon';
+/** The instant of a datetime as a driver returns it or as text read with a cast; text without an offset is UTC. */
+export function readInstant(v) {
+    if (v === null || v === undefined) {
+        return undefined;
+    }
+    if (v instanceof Date) {
+        return new Date(v.getTime());
+    }
+    if (typeof v === 'string') {
+        const sql = DateTime.fromSQL(v, { zone: 'utc' });
+        return (sql.isValid ? sql : DateTime.fromISO(v, { zone: 'utc' })).toJSDate();
+    }
+    return v.toJSDate();
+}
+//# sourceMappingURL=time.js.map

package/lib/mjs/models/time.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"time.js","sourceRoot":"","sources":["../../../src/models/time.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,mHAAmH;AACnH,MAAM,UAAU,WAAW,CAAC,CAA8C;IACxE,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC;QACtB,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC/E,CAAC;IACD,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;AACtB,CAAC"}

package/lib/mjs/nonces/index.d.ts

@@ -0,0 +1,2 @@
+export * from './nonce-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/nonces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/nonces/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/lib/mjs/nonces/index.js

@@ -0,0 +1,2 @@
+export * from './nonce-store.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/nonces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/nonces/index.ts"],"names":[],"mappings":"AAAA,cAAc,kBAAkB,CAAC"}

package/lib/mjs/nonces/nonce-store.d.ts

@@ -0,0 +1,11 @@
+import { NonceStore } from '@spinajs/authn/contracts';
+export { NonceStore } from '@spinajs/authn/contracts';
+export { MemoryNonceStore } from '@spinajs/authn/nonces';
+/** `authn_nonce`: the primary key makes a claim atomic across processes; an expired row is taken over with a conditional update. */
+export declare class DbNonceStore extends NonceStore {
+    private readonly purgeDue;
+    claim(key: string, expiresAt: Date, now: Date): Promise<boolean>;
+    /** Deletes up to one batch of expired keys; returns how many went. */
+    purge(now?: Date): Promise<number>;
+}
+//# sourceMappingURL=nonce-store.d.ts.map

package/lib/mjs/nonces/nonce-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-store.d.ts","sourceRoot":"","sources":["../../../src/nonces/nonce-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAOtD,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAazD,oIAAoI;AACpI,qBAEa,YAAa,SAAQ,UAAU;IAC1C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAuB5E;IAED,sEAAsE;IACzD,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAQ1D;CACF"}

package/lib/mjs/nonces/nonce-store.js

@@ -0,0 +1,72 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { NonceStore } from '@spinajs/authn/contracts';
+import { Injectable, PerChildInstance } from '@spinajs/di';
+import { UniqueViolation, everyNthCall, ormReady } from '@spinajs/orm';
+import { AuthnNonce } from '../models/AuthnNonce.js';
+import { checkedMs, checkedText, instant } from '../support/sql.js';
+export { NonceStore } from '@spinajs/authn/contracts';
+export { MemoryNonceStore } from '@spinajs/authn/nonces';
+const KEY_MAX = 160;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** A miss after a duplicate means a purge removed the row in between; a few retries cover that. */
+const MAX_TRIES = 8;
+function checkClaim(key, expiresAt, now, owner) {
+    checkedText(key, KEY_MAX, `${owner}.claim: key`);
+    return { expiresMs: checkedMs(expiresAt, `${owner}.claim: expiresAt`), nowMs: checkedMs(now, `${owner}.claim: now`) };
+}
+/** `authn_nonce`: the primary key makes a claim atomic across processes; an expired row is taken over with a conditional update. */
+let DbNonceStore = class DbNonceStore extends NonceStore {
+    constructor() {
+        super(...arguments);
+        this.purgeDue = everyNthCall(PURGE_EVERY);
+    }
+    async claim(key, expiresAt, now) {
+        const { expiresMs, nowMs } = checkClaim(key, expiresAt, now, 'DbNonceStore');
+        await ormReady();
+        if (this.purgeDue()) {
+            await this.purge(now);
+        }
+        const t = instant(nowMs);
+        const expires = instant(expiresMs);
+        for (let i = 0; i < MAX_TRIES; i++) {
+            try {
+                await AuthnNonce.insert({ k: key, expires_at: expires });
+                return true;
+            }
+            catch (err) {
+                if (!(err instanceof UniqueViolation))
+                    throw err;
+            }
+            if ((await AuthnNonce.update({ expires_at: expires }).where('k', key).where('expires_at', '<=', t)).RowsAffected === 1) {
+                return true;
+            }
+            const live = await AuthnNonce.query().columns(['k']).where('k', key).where('expires_at', '>', t);
+            if (live.length > 0)
+                return false;
+        }
+        return false;
+    }
+    /** Deletes up to one batch of expired keys; returns how many went. */
+    async purge(now = new Date()) {
+        const ms = checkedMs(now, 'DbNonceStore.purge: now');
+        await ormReady();
+        const t = instant(ms);
+        // MSSQL pages with OFFSET … FETCH, which needs an ORDER BY.
+        const keys = (await AuthnNonce.query().columns(['k']).where('expires_at', '<=', t).orderBy('k').take(PURGE_BATCH)).map((r) => r.k);
+        if (keys.length === 0)
+            return 0;
+        return (await AuthnNonce.destroy().whereIn('k', keys).where('expires_at', '<=', t)).RowsAffected;
+    }
+};
+DbNonceStore = __decorate([
+    PerChildInstance(),
+    Injectable(NonceStore)
+], DbNonceStore);
+export { DbNonceStore };
+//# sourceMappingURL=nonce-store.js.map

package/lib/mjs/nonces/nonce-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nonce-store.js","sourceRoot":"","sources":["../../../src/nonces/nonce-store.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEvE,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACrD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAEpE,OAAO,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,MAAM,OAAO,GAAG,GAAG,CAAC;AACpB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,mGAAmG;AACnG,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB,SAAS,UAAU,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS,EAAE,KAAa;IACxE,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,aAAa,CAAC,CAAC;IACjD,OAAO,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,EAAE,GAAG,KAAK,mBAAmB,CAAC,EAAE,KAAK,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,aAAa,CAAC,EAAE,CAAC;AACxH,CAAC;AAED,oIAAoI;AAG7H,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,UAAU;IAArC;;QACY,aAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IAqCxD,CAAC;IAnCQ,KAAK,CAAC,KAAK,CAAC,GAAW,EAAE,SAAe,EAAE,GAAS;QACxD,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,cAAc,CAAC,CAAC;QAC7E,MAAM,QAAQ,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxB,CAAC;QAED,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QACzB,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,IAAI,CAAC;gBACH,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC;gBACzD,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;oBAAE,MAAM,GAAG,CAAC;YACnD,CAAC;YACD,IAAI,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,KAAK,CAAC,EAAE,CAAC;gBACvH,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;YACjG,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,sEAAsE;IAC/D,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;QACrD,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtB,4DAA4D;QAC5D,MAAM,IAAI,GAAG,CAAC,MAAM,UAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACnI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAChC,OAAO,CAAC,MAAM,UAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC;IACnG,CAAC;CACF,CAAA;AAtCY,YAAY;IAFxB,gBAAgB,EAAE;IAClB,UAAU,CAAC,UAAU,CAAC;GACV,YAAY,CAsCxB"}

package/lib/mjs/package.json

@@ -0,0 +1 @@
+{"type":"module"}

package/lib/mjs/secrets/db-secret-store.d.ts

@@ -0,0 +1,25 @@
+import { SecretStore } from '@spinajs/authn/contracts';
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import type { DateTime } from 'luxon';
+/**
+ * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
+ * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * decides expiry and single use in SQL against that time (D10).
+ *
+ * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
+ */
+export declare class DbSecretStore extends SecretStore {
+    private readonly purgeDue;
+    issue(identity: IdentityRef, purpose: string, ttlSeconds: number): Promise<string>;
+    /**
+     * Looks the row up by the hash of `raw`, so no stored value is compared with the input in Node. The lookup
+     * also matches identity and purpose; the claim succeeds for exactly one caller.
+     */
+    redeem(identity: IdentityRef, purpose: string, raw: string): Promise<boolean>;
+    /** Deletes up to one batch of spent and expired rows; returns how many went. */
+    purge(now?: Date): Promise<number>;
+    /** @internal An early exit only: the claim's SQL guard decides. */
+    protected liveInNode(expiresAt: DateTime | null | undefined, nowMs: number): boolean;
+    private purgeNowAndThen;
+}
+//# sourceMappingURL=db-secret-store.d.ts.map

package/lib/mjs/secrets/db-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-secret-store.d.ts","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAK5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAatC;;;;;;GAMG;AACH,qBAEa,aAAc,SAAQ,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9F;IAED;;;OAGG;IACU,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBzF;IAED,gFAAgF;IACnE,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1D;IAED,mEAAmE;IACnE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnF;YAEa,eAAe;CAK9B"}