@spinajs/authn-orm 0.0.0-stage → 3.0.1

package/lib/mjs/secrets/db-secret-store.js

@@ -0,0 +1,96 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { randomBytes, randomUUID } from 'node:crypto';
+import { SecretStore } from '@spinajs/authn/contracts';
+import { Injectable, PerChildInstance } from '@spinajs/di';
+import { everyNthCall, ormReady } from '@spinajs/orm';
+import { _check_arg, _finite, _gt, _is_number, _is_string, _max_length, _non_empty, _try_check_arg } from '@spinajs/util';
+import { identityKey } from '../identity.js';
+import { AuthnSecret } from '../models/AuthnSecret.js';
+import { checkedMs, checkedText, instant, sha256hex } from '../support/sql.js';
+import { columnValues } from '../support/values.js';
+const PURPOSE_MAX = 32;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+/** Far above any secret this store issues; longer input is refused before hashing. */
+const RAW_MAX = 1024;
+/**
+ * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
+ * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * decides expiry and single use in SQL against that time (D10).
+ *
+ * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
+ */
+let DbSecretStore = class DbSecretStore extends SecretStore {
+    constructor() {
+        super(...arguments);
+        this.purgeDue = everyNthCall(PURGE_EVERY);
+    }
+    async issue(identity, purpose, ttlSeconds) {
+        const key = identityKey(identity);
+        checkedText(purpose, PURPOSE_MAX, 'DbSecretStore: purpose');
+        _check_arg(_is_number(_finite(), _gt(0)))(ttlSeconds, 'ttlSeconds');
+        const nowMs = checkedMs(new Date(), 'DbSecretStore.issue: the clock');
+        await ormReady();
+        await this.purgeNowAndThen(nowMs);
+        const raw = randomBytes(32).toString('base64url');
+        await AuthnSecret.destroy().where('identity', key).where('purpose', purpose);
+        await AuthnSecret.insert(columnValues({ id: randomUUID(), identity: key, purpose, secret_hash: sha256hex(raw), expires_at: instant(nowMs + ttlSeconds * 1000), used_at: null, created_at: instant(nowMs) }));
+        return raw;
+    }
+    /**
+     * Looks the row up by the hash of `raw`, so no stored value is compared with the input in Node. The lookup
+     * also matches identity and purpose; the claim succeeds for exactly one caller.
+     */
+    async redeem(identity, purpose, raw) {
+        const key = identityKey(identity);
+        checkedText(purpose, PURPOSE_MAX, 'DbSecretStore: purpose');
+        if (!_try_check_arg(_is_string(_non_empty(), _max_length(RAW_MAX)))(raw, 'raw')[0])
+            return false;
+        const nowMs = checkedMs(new Date(), 'DbSecretStore.redeem: the clock');
+        await ormReady();
+        await this.purgeNowAndThen(nowMs);
+        const rows = await AuthnSecret.query().columns(['id', 'identity', 'purpose', 'expires_at']).where('secret_hash', sha256hex(raw)).where('identity', key).where('purpose', purpose).whereNull('used_at');
+        // MySQL and MSSQL default collations ignore case: the binding to identity and purpose is checked exactly here.
+        const row = rows.find((r) => r.identity === key && r.purpose === purpose);
+        if (!row || !this.liveInNode(row.expires_at, nowMs))
+            return false;
+        const now = instant(nowMs);
+        const { RowsAffected } = await AuthnSecret.update({ used_at: now }).where('id', row.id).whereNull('used_at').where('expires_at', '>', now);
+        return RowsAffected === 1;
+    }
+    /** Deletes up to one batch of spent and expired rows; returns how many went. */
+    async purge(now = new Date()) {
+        const ms = checkedMs(now, 'DbSecretStore.purge: now');
+        await ormReady();
+        const t = instant(ms);
+        const done = function () {
+            this.whereNotNull('used_at');
+            this.orWhere('expires_at', '<=', t);
+        };
+        const ids = (await AuthnSecret.query().columns(['id']).where(done).orderBy('id').take(PURGE_BATCH)).map((r) => r.id);
+        if (ids.length === 0)
+            return 0;
+        return (await AuthnSecret.destroy().whereIn('id', ids).where(done)).RowsAffected;
+    }
+    /** @internal An early exit only: the claim's SQL guard decides. */
+    liveInNode(expiresAt, nowMs) {
+        const ms = expiresAt ? expiresAt.toMillis() : NaN;
+        return !Number.isFinite(ms) || ms > nowMs;
+    }
+    async purgeNowAndThen(nowMs) {
+        if (this.purgeDue()) {
+            await this.purge(new Date(nowMs));
+        }
+    }
+};
+DbSecretStore = __decorate([
+    PerChildInstance(),
+    Injectable(SecretStore)
+], DbSecretStore);
+export { DbSecretStore };
+//# sourceMappingURL=db-secret-store.js.map

package/lib/mjs/secrets/db-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-secret-store.js","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,OAAO,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAG1H,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC/E,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAEpD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;;GAMG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,WAAW;IAAvC;;QACY,aAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;IA+DxD,CAAC;IA7DQ,KAAK,CAAC,KAAK,CAAC,QAAqB,EAAE,OAAe,EAAE,UAAkB;QAC3E,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,UAAU,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACtE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,WAAW,CAAC,MAAM,CAAC,YAAY,CAAc,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1N,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,OAAe,EAAE,GAAW;QACrE,MAAM,GAAG,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAC;QAClC,WAAW,CAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACvE,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvM,+GAA+G;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElE,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3I,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,gFAAgF;IACzE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACtD,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG;YACX,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,WAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,WAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnF,CAAC;IAED,mEAAmE;IACzD,UAAU,CAAC,SAAsC,EAAE,KAAa;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF,CAAA;AAhEY,aAAa;IAFzB,gBAAgB,EAAE;IAClB,UAAU,CAAC,WAAW,CAAC;GACX,aAAa,CAgEzB"}

package/lib/mjs/secrets/index.d.ts

@@ -0,0 +1,2 @@
+export { DbSecretStore } from './db-secret-store.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/mjs/secrets/index.js

@@ -0,0 +1,2 @@
+export { DbSecretStore } from './db-secret-store.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/secrets/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/secrets/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/lib/mjs/support/sql.d.ts

@@ -0,0 +1,16 @@
+import { DateTime } from 'luxon';
+export declare const MIN_MS: number;
+export declare const MAX_MS: number;
+/** @internal The instant as a datetime column value, clamped to four-digit years. */
+export declare function instant(ms: number): DateTime;
+/** @internal A hydrated datetime column as a Date; an invalid or missing value is an invalid Date. */
+export declare function dateOf(value: DateTime | null | undefined): Date;
+/** @internal The time of a valid Date within four-digit years; anything else throws `InvalidArgument` naming `label`. */
+export declare function checkedMs(value: unknown, label: string): number;
+/** @internal Hex SHA-256 of the UTF-8 bytes. */
+export declare const sha256hex: (value: string) => string;
+/** @internal A string of at most `max` characters (code points), or `InvalidArgument`; never truncated. */
+export declare function checkedText(value: unknown, max: number, label: string, allowEmpty?: boolean): string;
+/** @internal Cuts to `max` code points, so no surrogate pair is split. */
+export declare function cutText(value: string | undefined | null, max: number): string | null;
+//# sourceMappingURL=sql.d.ts.map

package/lib/mjs/support/sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.d.ts","sourceRoot":"","sources":["../../../src/support/sql.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAGjC,eAAO,MAAM,MAAM,QAAuB,CAAC;AAC3C,eAAO,MAAM,MAAM,QAA0C,CAAC;AAE9D,qFAAqF;AACrF,wBAAgB,OAAO,CAAC,EAAE,EAAE,MAAM,GAAG,QAAQ,CAE5C;AAED,sGAAsG;AACtG,wBAAgB,MAAM,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,GAAG,IAAI,CAE/D;AAED,yHAAyH;AACzH,wBAAgB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAM/D;AAED,gDAAgD;AAChD,eAAO,MAAM,SAAS,UAAW,MAAM,KAAG,MAAkE,CAAC;AAE7G,2GAA2G;AAC3G,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,UAAQ,GAAG,MAAM,CAOlG;AAED,0EAA0E;AAC1E,wBAAgB,OAAO,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAGpF"}

package/lib/mjs/support/sql.js

@@ -0,0 +1,41 @@
+import { createHash } from 'node:crypto';
+import { InvalidArgument } from '@spinajs/exceptions';
+import { _check_arg, _is_string, _non_empty, truncate } from '@spinajs/util';
+import { DateTime } from 'luxon';
+// Four-digit years keep the text form of a datetime ordered on sqlite, where the column holds text.
+export const MIN_MS = Date.UTC(1000, 0, 1);
+export const MAX_MS = Date.UTC(9999, 11, 31, 23, 59, 59, 999);
+/** @internal The instant as a datetime column value, clamped to four-digit years. */
+export function instant(ms) {
+    return DateTime.fromMillis(Math.min(Math.max(ms, MIN_MS), MAX_MS), { zone: 'utc' });
+}
+/** @internal A hydrated datetime column as a Date; an invalid or missing value is an invalid Date. */
+export function dateOf(value) {
+    return value ? value.toJSDate() : new Date(NaN);
+}
+/** @internal The time of a valid Date within four-digit years; anything else throws `InvalidArgument` naming `label`. */
+export function checkedMs(value, label) {
+    const ms = value instanceof Date ? value.getTime() : NaN;
+    if (!Number.isFinite(ms) || ms < MIN_MS || ms > MAX_MS) {
+        throw new InvalidArgument(`${label} must be a valid Date`);
+    }
+    return ms;
+}
+/** @internal Hex SHA-256 of the UTF-8 bytes. */
+export const sha256hex = (value) => createHash('sha256').update(value, 'utf8').digest('hex');
+/** @internal A string of at most `max` characters (code points), or `InvalidArgument`; never truncated. */
+export function checkedText(value, max, label, allowEmpty = false) {
+    const text = _check_arg(_is_string(...(allowEmpty ? [] : [_non_empty()])))(value, label);
+    const length = [...text].length;
+    if (length > max) {
+        throw new InvalidArgument(`${label} is ${length} characters long, the column holds ${max}`);
+    }
+    return text;
+}
+/** @internal Cuts to `max` code points, so no surrogate pair is split. */
+export function cutText(value, max) {
+    if (value === undefined || value === null)
+        return null;
+    return truncate(String(value), max, '', { codePoints: true });
+}
+//# sourceMappingURL=sql.js.map

package/lib/mjs/support/sql.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sql.js","sourceRoot":"","sources":["../../../src/support/sql.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC7E,OAAO,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAEjC,oGAAoG;AACpG,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;AAC3C,MAAM,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;AAE9D,qFAAqF;AACrF,MAAM,UAAU,OAAO,CAAC,EAAU;IAChC,OAAO,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,MAAM,CAAC,KAAkC;IACvD,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,yHAAyH;AACzH,MAAM,UAAU,SAAS,CAAC,KAAc,EAAE,KAAa;IACrD,MAAM,EAAE,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;IACzD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,MAAM,IAAI,EAAE,GAAG,MAAM,EAAE,CAAC;QACvD,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,uBAAuB,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,KAAa,EAAU,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE7G,2GAA2G;AAC3G,MAAM,UAAU,WAAW,CAAC,KAAc,EAAE,GAAW,EAAE,KAAa,EAAE,UAAU,GAAG,KAAK;IACxF,MAAM,IAAI,GAAW,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACjG,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC;IAChC,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,eAAe,CAAC,GAAG,KAAK,OAAO,MAAM,sCAAsC,GAAG,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,OAAO,CAAC,KAAgC,EAAE,GAAW;IACnE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;AAChE,CAAC"}

package/lib/mjs/support/values.d.ts

@@ -0,0 +1,7 @@
+/** @internal What a write passes for a model's columns: a nullable column takes `null`, which its property type leaves out. */
+export type ColumnValues<M> = {
+    [K in keyof M]?: M[K] | null;
+};
+/** @internal `values` typed as the ORM's write methods take them. */
+export declare function columnValues<M>(values: ColumnValues<M>): Partial<M>;
+//# sourceMappingURL=values.d.ts.map

package/lib/mjs/support/values.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.d.ts","sourceRoot":"","sources":["../../../src/support/values.ts"],"names":[],"mappings":"AAAA,+HAA+H;AAC/H,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;KAAG,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI;CAAE,CAAC;AAE/D,qEAAqE;AACrE,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAEnE"}

package/lib/mjs/support/values.js

@@ -0,0 +1,5 @@
+/** @internal `values` typed as the ORM's write methods take them. */
+export function columnValues(values) {
+    return values;
+}
+//# sourceMappingURL=values.js.map

package/lib/mjs/support/values.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"values.js","sourceRoot":"","sources":["../../../src/support/values.ts"],"names":[],"mappings":"AAGA,qEAAqE;AACrE,MAAM,UAAU,YAAY,CAAI,MAAuB;IACrD,OAAO,MAAoB,CAAC;AAC9B,CAAC"}

package/lib/mjs/throttle/db-throttle-store.d.ts

@@ -0,0 +1,79 @@
+import type { KeyedBackoffVerdict, ThrottleGate, ThrottleLower, ThrottleStore } from '@spinajs/util';
+import type { DateTime } from 'luxon';
+/** @internal "now" and the staleness cutoff of one call. */
+export interface StoreTimes {
+    readonly nowMs: number;
+    readonly now: DateTime;
+    readonly cutoff: DateTime;
+}
+/** @internal A live row as stored: its datetimes as read back, so a write can compare against them. */
+export interface ClaimState {
+    readonly attempts: number;
+    readonly last: DateTime;
+    readonly next: DateTime;
+}
+/** @internal What a claim wrote. `prev` is the live row it replaced; without one (insert or stale row) undo deletes the row. */
+export interface ClaimWrite {
+    readonly k: string;
+    readonly attempts: number;
+    readonly last: DateTime;
+    readonly next: DateTime;
+    readonly prev?: ClaimState;
+}
+/** @internal */
+export type Claimed = {
+    readonly ok: true;
+    readonly write: ClaimWrite;
+} | {
+    readonly ok: false;
+    readonly waitMs: number;
+};
+export interface DbThrottleStoreOptions {
+    /** A row idle this long that delays nobody counts as zero and may be purged. */
+    readonly resetAfterMs: number;
+}
+/**
+ * The rows of `DbAuthnThrottle` in `authn_throttle`, shared by every app instance. Each attempt claims its slot on
+ * every gating key with a compare-and-set; a later key that refuses undoes the earlier claims in reverse. No
+ * transactions: the sqlite driver shares one handle, so a transaction would take in the statements of concurrent
+ * attempts. `succeed` is several compare-and-set statements too, where a lost race only throttles more.
+ *
+ * Every time decision compares in SQL against the `nowMs` passed in, never SQL `now()`, and never against a datetime
+ * read back (lane note D10). Flows need no column: the ids already differ per flow.
+ */
+export declare class DbThrottleStore implements ThrottleStore {
+    private readonly resetAfterMs;
+    private readonly purgeDue;
+    constructor(options: DbThrottleStoreOptions);
+    attempt(_flow: string, gates: readonly ThrottleGate[], counted: readonly string[], nowMs: number): Promise<KeyedBackoffVerdict>;
+    peek(_flow: string, gates: readonly ThrottleGate[], nowMs: number): Promise<KeyedBackoffVerdict>;
+    /** Lowers by the largest count it consumed: rows carry no run, so a `by` row older than its target is taken off too. */
+    succeed(_flow: string, lower: readonly ThrottleLower[], clear: readonly string[], nowMs: number): Promise<void>;
+    /** Deletes up to one batch of stale rows (idle for resetAfterMs and delaying nobody); returns how many went. */
+    purge(nowMs: number): Promise<number>;
+    /**
+     * @internal Claims one gating key: counts attempt n + 1 and sets its next allowed time, or reports the wait. A miss
+     * re-reads this key and the keys still to claim (`rest`): an attempt that will be refused further on stops here,
+     * before it adds counts that its undo may no longer take back.
+     */
+    protected claimKey(k: string, delay: (n: number) => number, state: ClaimState | undefined, t: StoreTimes, rest?: readonly string[]): Promise<Claimed>;
+    /** @internal CAS on a live row that delays nobody now. */
+    protected writeLive(w: ClaimWrite, n: number, t: StoreTimes): Promise<boolean>;
+    /** @internal Inserts the first count; a row already there may be taken over only when stale (it counts as zero). */
+    protected insertOrTakeStale(w: ClaimWrite, t: StoreTimes): Promise<boolean>;
+    /** @internal Puts back what each claim replaced, only where the row still holds exactly what it wrote; a miss keeps the count. */
+    protected undo(claims: readonly ClaimWrite[], t: StoreTimes): Promise<void>;
+    /** A counted row gates nothing, so a lost race here only leaves less to subtract on success (more throttling). */
+    private countBook;
+    /** Deletes a live counted row; the caller that deleted it gets its count. */
+    private takeBook;
+    private subtract;
+    /** The longest wait any of `ks` imposes now, 0 when none delays. */
+    private blockedWait;
+    /** Rows of `ks` that are not stale; stale and missing rows both count as zero. */
+    private readLive;
+    private isLive;
+    private refuse;
+    private times;
+}
+//# sourceMappingURL=db-throttle-store.d.ts.map

package/lib/mjs/throttle/db-throttle-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-throttle-store.d.ts","sourceRoot":"","sources":["../../../src/throttle/db-throttle-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAWtC,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,gIAAgI;AAChI,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,gBAAgB;AAChB,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,OAAO,EAAE,sBAAsB,EAE1C;IAEY,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6B3I;IAEY,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAK5G;IAED,wHAAwH;IAC3G,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB3H;IAED,gHAAgH;IACnG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAajD;IAED;;;;OAIG;IACH,UAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9J;IAED,0DAA0D;IAC1D,UAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAGnF;IAED,oHAAoH;IACpH,UAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAShF;IAED,kIAAkI;IAClI,UAAgB,IAAI,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;IAED,kHAAkH;YACpG,SAAS;IAQvB,6EAA6E;YAC/D,QAAQ;YAUR,QAAQ;IAkBtB,oEAAoE;YACtD,WAAW;IAczB,kFAAkF;YACpE,QAAQ;IActB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,KAAK;CAGd"}

package/lib/mjs/throttle/db-throttle-store.js

@@ -0,0 +1,227 @@
+import { backoffDelayMs } from '@spinajs/authn/contracts';
+import { UniqueViolation, everyNthCall, ormReady } from '@spinajs/orm';
+import { AuthnThrottle } from '../models/AuthnThrottle.js';
+import { instant } from '../support/sql.js';
+/** Each miss means another attempt won that key, so this bounds the parallel attempts one call waits behind. */
+const MAX_TRIES = 64;
+const PURGE_EVERY = 64;
+const PURGE_BATCH = 500;
+const FAIL_CLOSED_MS = 1000;
+/**
+ * The rows of `DbAuthnThrottle` in `authn_throttle`, shared by every app instance. Each attempt claims its slot on
+ * every gating key with a compare-and-set; a later key that refuses undoes the earlier claims in reverse. No
+ * transactions: the sqlite driver shares one handle, so a transaction would take in the statements of concurrent
+ * attempts. `succeed` is several compare-and-set statements too, where a lost race only throttles more.
+ *
+ * Every time decision compares in SQL against the `nowMs` passed in, never SQL `now()`, and never against a datetime
+ * read back (lane note D10). Flows need no column: the ids already differ per flow.
+ */
+export class DbThrottleStore {
+    constructor(options) {
+        this.purgeDue = everyNthCall(PURGE_EVERY);
+        this.resetAfterMs = options.resetAfterMs;
+    }
+    async attempt(_flow, gates, counted, nowMs) {
+        await ormReady();
+        if (this.purgeDue()) {
+            await this.purge(nowMs);
+        }
+        const t = this.times(nowMs);
+        const backoff = new Map(gates.map((g) => [g.id, g.backoff]));
+        const order = [...backoff.keys()].sort();
+        if (order.length > 0) {
+            const waitMs = await this.blockedWait(order, t);
+            if (waitMs > 0)
+                return this.refuse(waitMs);
+        }
+        const live = await this.readLive([...order, ...counted], t);
+        const claims = [];
+        for (const [i, k] of order.entries()) {
+            const p = backoff.get(k);
+            const r = await this.claimKey(k, (n) => backoffDelayMs(p, n), live.get(k), t, order.slice(i + 1));
+            if (!r.ok) {
+                await this.undo(claims, t);
+                return this.refuse(r.waitMs);
+            }
+            claims.push(r.write);
+        }
+        for (const k of counted) {
+            await this.countBook(k, live.get(k), t);
+        }
+        return { allowed: true };
+    }
+    async peek(_flow, gates, nowMs) {
+        if (gates.length === 0)
+            return { allowed: true };
+        await ormReady();
+        const waitMs = await this.blockedWait(gates.map((g) => g.id).sort(), this.times(nowMs));
+        return waitMs > 0 ? this.refuse(waitMs) : { allowed: true };
+    }
+    /** Lowers by the largest count it consumed: rows carry no run, so a `by` row older than its target is taken off too. */
+    async succeed(_flow, lower, clear, nowMs) {
+        await ormReady();
+        const t = this.times(nowMs);
+        const consumed = new Set();
+        for (const { targets, by } of lower) {
+            let spent = 0;
+            for (const k of by) {
+                consumed.add(k);
+                spent = Math.max(spent, await this.takeBook(k, t));
+            }
+            if (spent === 0)
+                continue;
+            for (const { id, backoff } of targets) {
+                await this.subtract(id, backoff, spent, t);
+            }
+        }
+        // A consumed row is not deleted again: a count an attempt added to it since stays for the next success.
+        for (const k of clear) {
+            if (!consumed.has(k))
+                await AuthnThrottle.destroy().where('k', k);
+        }
+    }
+    /** Deletes up to one batch of stale rows (idle for resetAfterMs and delaying nobody); returns how many went. */
+    async purge(nowMs) {
+        await ormReady();
+        const t = this.times(nowMs);
+        const stale = await AuthnThrottle.query().columns(['k']).where('last_attempt_at', '<=', t.cutoff).where('next_allowed_at', '<=', t.now).orderBy('k').take(PURGE_BATCH);
+        if (stale.length === 0)
+            return 0;
+        const { RowsAffected } = await AuthnThrottle.destroy()
+            .whereIn('k', stale.map((r) => r.k))
+            .where('last_attempt_at', '<=', t.cutoff)
+            .where('next_allowed_at', '<=', t.now);
+        return RowsAffected;
+    }
+    /**
+     * @internal Claims one gating key: counts attempt n + 1 and sets its next allowed time, or reports the wait. A miss
+     * re-reads this key and the keys still to claim (`rest`): an attempt that will be refused further on stops here,
+     * before it adds counts that its undo may no longer take back.
+     */
+    async claimKey(k, delay, state, t, rest = []) {
+        for (let i = 0; i < MAX_TRIES; i++) {
+            const attempts = (state?.attempts ?? 0) + 1;
+            const write = { k, attempts, last: t.now, next: instant(t.nowMs + delay(attempts)), prev: state };
+            if (state ? await this.writeLive(write, state.attempts, t) : await this.insertOrTakeStale(write, t)) {
+                return { ok: true, write };
+            }
+            const waitMs = await this.blockedWait([k, ...rest], t);
+            if (waitMs > 0)
+                return { ok: false, waitMs };
+            state = (await this.readLive([k], t)).get(k);
+        }
+        return { ok: false, waitMs: FAIL_CLOSED_MS };
+    }
+    /** @internal CAS on a live row that delays nobody now. */
+    async writeLive(w, n, t) {
+        const r = await AuthnThrottle.update({ attempts: w.attempts, last_attempt_at: w.last, next_allowed_at: w.next, updated_at: t.now }).where('k', w.k).where('attempts', n).where('next_allowed_at', '<=', t.now).where('last_attempt_at', '>', t.cutoff);
+        return r.RowsAffected === 1;
+    }
+    /** @internal Inserts the first count; a row already there may be taken over only when stale (it counts as zero). */
+    async insertOrTakeStale(w, t) {
+        try {
+            await AuthnThrottle.insert({ k: w.k, attempts: w.attempts, last_attempt_at: w.last, next_allowed_at: w.next, updated_at: t.now });
+            return true;
+        }
+        catch (err) {
+            if (!(err instanceof UniqueViolation))
+                throw err;
+        }
+        const r = await AuthnThrottle.update({ attempts: w.attempts, last_attempt_at: w.last, next_allowed_at: w.next, updated_at: t.now }).where('k', w.k).where('next_allowed_at', '<=', t.now).where('last_attempt_at', '<=', t.cutoff);
+        return r.RowsAffected === 1;
+    }
+    /** @internal Puts back what each claim replaced, only where the row still holds exactly what it wrote; a miss keeps the count. */
+    async undo(claims, t) {
+        for (const w of [...claims].reverse()) {
+            if (w.prev) {
+                await AuthnThrottle.update({ attempts: w.prev.attempts, last_attempt_at: w.prev.last, next_allowed_at: w.prev.next, updated_at: t.now }).where('k', w.k).where('attempts', w.attempts).where('last_attempt_at', w.last).where('next_allowed_at', w.next);
+            }
+            else {
+                await AuthnThrottle.destroy().where('k', w.k).where('attempts', w.attempts).where('last_attempt_at', w.last).where('next_allowed_at', w.next);
+            }
+        }
+    }
+    /** A counted row gates nothing, so a lost race here only leaves less to subtract on success (more throttling). */
+    async countBook(k, state, t) {
+        for (let i = 0; i < MAX_TRIES; i++) {
+            const write = { k, attempts: (state?.attempts ?? 0) + 1, last: t.now, next: t.now };
+            if (state ? await this.writeLive(write, state.attempts, t) : await this.insertOrTakeStale(write, t))
+                return;
+            state = (await this.readLive([k], t)).get(k);
+        }
+    }
+    /** Deletes a live counted row; the caller that deleted it gets its count. */
+    async takeBook(k, t) {
+        for (let i = 0; i < MAX_TRIES; i++) {
+            const state = (await this.readLive([k], t)).get(k);
+            if (!state)
+                return 0;
+            const r = await AuthnThrottle.destroy().where('k', k).where('attempts', state.attempts).where(this.isLive(t));
+            if (r.RowsAffected === 1)
+                return state.attempts;
+        }
+        return 0;
+    }
+    async subtract(k, p, spent, t) {
+        for (let i = 0; i < MAX_TRIES; i++) {
+            const state = (await this.readLive([k], t)).get(k);
+            if (!state)
+                return;
+            const attempts = Math.max(0, state.attempts - spent);
+            let r;
+            if (attempts === 0) {
+                r = await AuthnThrottle.destroy().where('k', k).where('attempts', state.attempts).where(this.isLive(t));
+            }
+            else {
+                // The schedule runs from the row's last counted attempt.
+                const lastMs = state.last?.toMillis() ?? NaN;
+                const next = Number.isFinite(lastMs) ? instant(lastMs + backoffDelayMs(p, attempts)) : state.next;
+                r = await AuthnThrottle.update({ attempts, next_allowed_at: next, updated_at: t.now }).where('k', k).where('attempts', state.attempts).where(this.isLive(t));
+            }
+            if (r.RowsAffected === 1)
+                return;
+        }
+    }
+    /** The longest wait any of `ks` imposes now, 0 when none delays. */
+    async blockedWait(ks, t) {
+        const rows = await AuthnThrottle.query()
+            .columns(['k', 'next_allowed_at'])
+            .whereIn('k', [...ks])
+            .where('next_allowed_at', '>', t.now);
+        let waitMs = 0;
+        for (const r of rows) {
+            const ms = (r.next_allowed_at?.toMillis() ?? NaN) - t.nowMs;
+            // A delaying row whose datetime does not read still delays.
+            waitMs = Math.max(waitMs, Number.isFinite(ms) && ms > 0 ? ms : FAIL_CLOSED_MS);
+        }
+        return waitMs;
+    }
+    /** Rows of `ks` that are not stale; stale and missing rows both count as zero. */
+    async readLive(ks, t) {
+        const out = new Map();
+        if (ks.length === 0)
+            return out;
+        const rows = await AuthnThrottle.query()
+            .columns(['k', 'attempts', 'last_attempt_at', 'next_allowed_at'])
+            .whereIn('k', [...ks])
+            .where(this.isLive(t));
+        for (const r of rows) {
+            out.set(r.k, { attempts: Number(r.attempts), last: r.last_attempt_at, next: r.next_allowed_at });
+        }
+        return out;
+    }
+    // Stale: idle for resetAfterMs and delaying nobody; a delay longer than that still runs to its end.
+    isLive(t) {
+        return function () {
+            this.where('last_attempt_at', '>', t.cutoff);
+            this.orWhere('next_allowed_at', '>', t.now);
+        };
+    }
+    refuse(waitMs) {
+        return { allowed: false, retryAfterSeconds: Math.max(1, Math.ceil(waitMs / 1000)) };
+    }
+    times(nowMs) {
+        return { nowMs, now: instant(nowMs), cutoff: instant(nowMs - this.resetAfterMs) };
+    }
+}
+//# sourceMappingURL=db-throttle-store.js.map

package/lib/mjs/throttle/db-throttle-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-throttle-store.js","sourceRoot":"","sources":["../../../src/throttle/db-throttle-store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAE1D,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAKvE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAE5C,gHAAgH;AAChH,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,MAAM,cAAc,GAAG,IAAI,CAAC;AAiC5B;;;;;;;;GAQG;AACH,MAAM,OAAO,eAAe;IAI1B,YAAY,OAA+B;QAF1B,aAAQ,GAAG,YAAY,CAAC,WAAW,CAAC,CAAC;QAGpD,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC;IAC3C,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAA8B,EAAE,OAA0B,EAAE,KAAa;QAC3G,MAAM,QAAQ,EAAE,CAAC;QACjB,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QAED,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC7D,MAAM,KAAK,GAAG,CAAC,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;YAChD,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAiB,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;YACrC,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAClG,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;gBACV,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;YAC/B,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvB,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,KAAa,EAAE,KAA8B,EAAE,KAAa;QAC5E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QACjD,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,OAAO,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC9D,CAAC;IAED,wHAAwH;IACjH,KAAK,CAAC,OAAO,CAAC,KAAa,EAAE,KAA+B,EAAE,KAAwB,EAAE,KAAa;QAC1G,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;QACnC,KAAK,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE,IAAI,KAAK,EAAE,CAAC;YACpC,IAAI,KAAK,GAAG,CAAC,CAAC;YACd,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBACnB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBAChB,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACrD,CAAC;YACD,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS;YAC1B,KAAK,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,OAAO,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YAC7C,CAAC;QACH,CAAC;QACD,wGAAwG;QACxG,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAE,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IAED,gHAAgH;IACzG,KAAK,CAAC,KAAK,CAAC,KAAa;QAC9B,MAAM,QAAQ,EAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACvK,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACjC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;aACnD,OAAO,CACN,GAAG,EACH,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CACtB;aACA,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;aACxC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACzC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED;;;;OAIG;IACO,KAAK,CAAC,QAAQ,CAAC,CAAS,EAAE,KAA4B,EAAE,KAA6B,EAAE,CAAa,EAAE,IAAI,GAAsB,EAAE;QAC1I,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,QAAQ,GAAG,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC9G,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;gBACpG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAC7B,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;YACvD,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;YAC7C,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC/C,CAAC;IAED,0DAA0D;IAChD,KAAK,CAAC,SAAS,CAAC,CAAa,EAAE,CAAS,EAAE,CAAa;QAC/D,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACvP,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,oHAAoH;IAC1G,KAAK,CAAC,iBAAiB,CAAC,CAAa,EAAE,CAAa;QAC5D,IAAI,CAAC;YACH,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;YAClI,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,CAAC,GAAG,YAAY,eAAe,CAAC;gBAAE,MAAM,GAAG,CAAC;QACnD,CAAC;QACD,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;QACnO,OAAO,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,kIAAkI;IACxH,KAAK,CAAC,IAAI,CAAC,MAA6B,EAAE,CAAa;QAC/D,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;gBACX,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAC3P,CAAC;iBAAM,CAAC;gBACN,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;YAChJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,kHAAkH;IAC1G,KAAK,CAAC,SAAS,CAAC,CAAS,EAAE,KAA6B,EAAE,CAAa;QAC7E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAe,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,KAAK,EAAE,QAAQ,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;YAChG,IAAI,KAAK,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,CAAC;gBAAE,OAAO;YAC5G,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IAED,6EAA6E;IACrE,KAAK,CAAC,QAAQ,CAAC,CAAS,EAAE,CAAa;QAC7C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,OAAO,CAAC,CAAC;YACrB,MAAM,CAAC,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9G,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC,QAAQ,CAAC;QAClD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IAEO,KAAK,CAAC,QAAQ,CAAC,CAAS,EAAE,CAAgB,EAAE,KAAa,EAAE,CAAa;QAC9E,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnD,IAAI,CAAC,KAAK;gBAAE,OAAO;YACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,KAAK,CAAC,CAAC;YACrD,IAAI,CAA2B,CAAC;YAChC,IAAI,QAAQ,KAAK,CAAC,EAAE,CAAC;gBACnB,CAAC,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1G,CAAC;iBAAM,CAAC;gBACN,yDAAyD;gBACzD,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC;gBAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,cAAc,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;gBAClG,CAAC,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAC/J,CAAC;YACD,IAAI,CAAC,CAAC,YAAY,KAAK,CAAC;gBAAE,OAAO;QACnC,CAAC;IACH,CAAC;IAED,oEAAoE;IAC5D,KAAK,CAAC,WAAW,CAAC,EAAqB,EAAE,CAAa;QAC5D,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;aACrC,OAAO,CAAC,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;aACjC,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;aACrB,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,EAAE,QAAQ,EAAE,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;YAC5D,4DAA4D;YAC5D,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,kFAAkF;IAC1E,KAAK,CAAC,QAAQ,CAAC,EAAqB,EAAE,CAAa;QACzD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;QAC1C,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE;aACrC,OAAO,CAAC,CAAC,GAAG,EAAE,UAAU,EAAE,iBAAiB,EAAE,iBAAiB,CAAC,CAAC;aAChE,OAAO,CAAC,GAAG,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;aACrB,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACzB,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,oGAAoG;IAC5F,MAAM,CAAC,CAAa;QAC1B,OAAO;YACL,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;YAC7C,IAAI,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,CAAC;IACJ,CAAC;IAEO,MAAM,CAAC,MAAc;QAC3B,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAEO,KAAK,CAAC,KAAa;QACzB,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;IACpF,CAAC;CACF"}

package/lib/mjs/throttle/db-throttle.d.ts

@@ -0,0 +1,77 @@
+import type { AuthnConfigSource } from '@spinajs/authn/env';
+import { StoreAuthnThrottle } from '@spinajs/authn/store-throttle';
+import type { AuthnContext, ThrottleFlow, ThrottleKey, ThrottleParams } from '@spinajs/authn/contracts';
+import '@spinajs/authn/register-schema';
+import { IContainer } from '@spinajs/di';
+import { Log } from '@spinajs/log';
+import type { ThrottleStore } from '@spinajs/util';
+import { DbThrottleStore } from './db-throttle-store.js';
+import type { DbThrottleStoreOptions } from './db-throttle-store.js';
+export interface DbThrottleOptions {
+    /** Overrides `authn.audit.hashKey.secret`; null: a random key of this process. */
+    readonly hashKey?: string | null;
+}
+/**
+ * Backoff per key, never a lock (A05, A06, H31), in `authn_throttle`, shared by every app instance. The rows, their
+ * compare-and-set claims and the purge are a `DbThrottleStore`.
+ *
+ * Every time decision compares in SQL against values computed in Node (`ctx.now`, or the clock in `succeed`),
+ * never SQL `now()`, and never against a datetime read back (lane note D10).
+ *
+ * Tested on sqlite and postgres. On MySQL and MSSQL the migration's `datetime` keeps whole seconds (MySQL) or
+ * about 3 ms (MSSQL): undo may then miss, which keeps the extra count (more throttling), and a `baseDelayMs`
+ * below one second is not supported there.
+ *
+ * `last_attempt_at` takes the caller's now, not the later of the two: with clocks skewed across instances, an
+ * account-ip row can outlive the ip run it counted in by that skew, and a later success subtracts it from the new run.
+ *
+ * The hash key check (`checkConfiguration`) runs when AuthnService resolves. A process that resolves this throttle
+ * without it (a worker, a CLI command) keys rows with a random key of the process when the key is unset.
+ */
+export declare class DbAuthnThrottle extends StoreAuthnThrottle {
+    private readonly options;
+    protected ConfiguredParams: ThrottleParams;
+    protected ConfiguredHashSecret: string | null | undefined;
+    protected Log: Log;
+    protected Container: IContainer;
+    /** Complete params given to the constructor. */
+    private readonly fixedParams;
+    private loadedParams;
+    private readonly fromConfiguration;
+    private hmacKey;
+    private loading;
+    private rows;
+    /**
+     * DI passes nothing: `authn.throttle` and `authn.audit.hashKey.secret` come from the configuration of the resolving
+     * container on first use (`init`). With `params` nothing is read from the configuration: the hash key is
+     * `options.hashKey`. The rows live on the connection of the `AuthnThrottle` model.
+     */
+    constructor(params?: ThrottleParams, options?: DbThrottleOptions);
+    get params(): ThrottleParams;
+    protected get throttleName(): string;
+    /**
+     * The authn service calls it at boot with its Configuration. Without the hash key this throttle uses (`options.hashKey`
+     * or the `authn.audit.hashKey.secret` it reads) the rows are keyed with a random key of this process, which only a
+     * development or test env of the booting configuration accepts.
+     */
+    checkConfiguration(booting: AuthnConfigSource): Promise<void>;
+    /** Resolves the configuration; the first `attempt`, `peek` or `succeed` and every `purge` call it. */
+    init(): Promise<void>;
+    /** The row key: base64url(HMAC-SHA256(hash key, `flow|kind|value`)); logins and addresses are personal data (SR-19). */
+    rowKey(flow: ThrottleFlow, key: ThrottleKey): string;
+    /** Deletes up to one batch of stale rows (idle for resetAfterSeconds and delaying nobody); returns how many went. */
+    purge(now?: Date): Promise<number>;
+    protected store(): Promise<ThrottleStore>;
+    protected keyId(flow: ThrottleFlow, key: ThrottleKey): string;
+    protected checkKeys(keys: readonly ThrottleKey[]): void;
+    protected nowMs(ctx: AuthnContext, method: string): number;
+    /** Protected seam: override to wrap or replace the store (tests use it to interleave or fail statements). */
+    protected createStore(options: DbThrottleStoreOptions): DbThrottleStore;
+    private dbStore;
+    private snapshotConfigured;
+    /** The key `init` uses: `options.hashKey` when given, else the configured one when there is a configuration. */
+    private hashSecret;
+    private configurationContainer;
+    private load;
+}
+//# sourceMappingURL=db-throttle.d.ts.map