@spinajs/authn-orm 3.0.3 → 3.0.4

package/lib/cjs/audit/index.d.ts

@@ -1,2 +1,3 @@
 export { DbAuthnAuditSink } from './db-audit-sink.js';
+export { AuthnAuditRetention } from './retention.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/cjs/audit/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbAuthnAuditSink = void 0;
+exports.AuthnAuditRetention = exports.DbAuthnAuditSink = void 0;
 var db_audit_sink_js_1 = require("./db-audit-sink.js");
 Object.defineProperty(exports, "DbAuthnAuditSink", { enumerable: true, get: function () { return db_audit_sink_js_1.DbAuthnAuditSink; } });
+var retention_js_1 = require("./retention.js");
+Object.defineProperty(exports, "AuthnAuditRetention", { enumerable: true, get: function () { return retention_js_1.AuthnAuditRetention; } });
 //# sourceMappingURL=index.js.map

package/lib/cjs/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,+CAAqD;AAA5C,mHAAA,mBAAmB,OAAA"}

package/lib/cjs/audit/retention.d.ts

@@ -0,0 +1,21 @@
+import '@spinajs/authn/register-schema';
+import { AsyncService } from '@spinajs/di';
+import { Log } from '@spinajs/log';
+/**
+ * Deletes `authn_audit` rows older than `authn.audit.retentionDays`, in batches, on `purge` and, when
+ * `authn.audit.purgeInterval` (ms) is set, on a timer. Both keys are unset by default: audit rows are kept forever.
+ */
+export declare class AuthnAuditRetention extends AsyncService {
+    protected RetentionDays: number | null | undefined;
+    protected PurgeInterval: number | null | undefined;
+    protected Log: Log;
+    private timer;
+    private running;
+    get Enabled(): boolean;
+    resolve(): Promise<void>;
+    dispose(): Promise<void>;
+    /** Deletes the rows older than the retention; returns how many went. 0 while `retentionDays` is unset. */
+    purge(now?: Date): Promise<number>;
+    private tick;
+}
+//# sourceMappingURL=retention.d.ts.map

package/lib/cjs/audit/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../../src/audit/retention.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAAgC,MAAM,aAAa,CAAC;AAEzE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAS3C;;;GAGG;AACH,qBAEa,mBAAoB,SAAQ,YAAY;IAEnD,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAGnD,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAGnD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,KAAK,CAA6C;IAC1D,OAAO,CAAC,OAAO,CAAS;IAExB,IAAW,OAAO,IAAI,OAAO,CAE5B;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAOpC;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED,0GAA0G;IAC7F,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyB1D;YAEa,IAAI;CAkBnB"}

package/lib/cjs/audit/retention.js

@@ -0,0 +1,105 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnAuditRetention = void 0;
+require("@spinajs/authn/register-schema");
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+const orm_1 = require("@spinajs/orm");
+const AuthnAudit_js_1 = require("../models/AuthnAudit.js");
+const sql_js_1 = require("../support/sql.js");
+const DAY_MS = 86_400_000;
+const PURGE_BATCH = 500;
+/**
+ * Deletes `authn_audit` rows older than `authn.audit.retentionDays`, in batches, on `purge` and, when
+ * `authn.audit.purgeInterval` (ms) is set, on a timer. Both keys are unset by default: audit rows are kept forever.
+ */
+let AuthnAuditRetention = class AuthnAuditRetention extends di_1.AsyncService {
+    constructor() {
+        super(...arguments);
+        this.running = false;
+    }
+    get Enabled() {
+        return typeof this.RetentionDays === 'number' && this.RetentionDays > 0;
+    }
+    async resolve() {
+        if (!this.Enabled || !this.PurgeInterval || this.PurgeInterval < 1) {
+            return;
+        }
+        this.timer = setInterval(() => void this.tick(), this.PurgeInterval);
+        this.timer.unref?.();
+    }
+    async dispose() {
+        clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Deletes the rows older than the retention; returns how many went. 0 while `retentionDays` is unset. */
+    async purge(now = new Date()) {
+        const days = this.RetentionDays;
+        if (typeof days !== 'number' || !(days > 0)) {
+            return 0;
+        }
+        const cutoff = (0, sql_js_1.instant)((0, sql_js_1.checkedMs)(now, 'AuthnAuditRetention.purge: now') - days * DAY_MS);
+        await (0, orm_1.ormReady)();
+        let removed = 0;
+        for (;;) {
+            // MSSQL pages with OFFSET ... FETCH, which needs an ORDER BY.
+            const ids = (await AuthnAudit_js_1.AuthnAudit.query().columns(['id']).where('at', '<', cutoff).orderBy('at').take(PURGE_BATCH)).map((r) => r.id);
+            if (ids.length === 0) {
+                break;
+            }
+            const deleted = (await AuthnAudit_js_1.AuthnAudit.destroy().whereIn('id', ids).where('at', '<', cutoff)).RowsAffected;
+            removed += deleted;
+            if (ids.length < PURGE_BATCH || deleted === 0) {
+                break;
+            }
+        }
+        return removed;
+    }
+    async tick() {
+        if (this.running) {
+            return;
+        }
+        this.running = true;
+        try {
+            const count = await this.purge();
+            if (count > 0) {
+                this.Log.info({ count }, 'Purged audit rows past retention, count: ${count}');
+            }
+        }
+        catch (err) {
+            // An unhandled rejection here would end the process; the next tick retries.
+            this.Log.error(err, 'Audit retention purge failed');
+        }
+        finally {
+            this.running = false;
+        }
+    }
+};
+exports.AuthnAuditRetention = AuthnAuditRetention;
+__decorate([
+    (0, configuration_1.Config)('authn.audit.retentionDays'),
+    __metadata("design:type", Object)
+], AuthnAuditRetention.prototype, "RetentionDays", void 0);
+__decorate([
+    (0, configuration_1.Config)('authn.audit.purgeInterval'),
+    __metadata("design:type", Object)
+], AuthnAuditRetention.prototype, "PurgeInterval", void 0);
+__decorate([
+    (0, log_1.Logger)('authn-orm'),
+    __metadata("design:type", log_1.Log)
+], AuthnAuditRetention.prototype, "Log", void 0);
+exports.AuthnAuditRetention = AuthnAuditRetention = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)()
+], AuthnAuditRetention);
+//# sourceMappingURL=retention.js.map

package/lib/cjs/audit/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../src/audit/retention.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAwC;AACxC,oCAAyE;AACzE,0DAAgD;AAChD,sCAA2C;AAC3C,sCAAwC;AAExC,2DAAqD;AACrD,8CAAuD;AAEvD,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,iBAAY;IAA9C;;QAWG,YAAO,GAAG,KAAK,CAAC;IAkE1B,CAAC;IAhEC,IAAW,OAAO;QAChB,OAAO,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,0GAA0G;IACnG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAC,IAAA,kBAAS,EAAC,GAAG,EAAE,gCAAgC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;QACzF,MAAM,IAAA,cAAQ,GAAE,CAAC;QAEjB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,SAAS,CAAC;YACR,8DAA8D;YAC9D,MAAM,GAAG,GAAG,CAAC,MAAM,0BAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,0BAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACtG,OAAO,IAAI,OAAO,CAAC;YACnB,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,mDAAmD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAY,EAAE,8BAA8B,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF,CAAA;;AA3EW;IADT,IAAA,sBAAM,EAAC,2BAA2B,CAAC;;0DACe;AAGzC;IADT,IAAA,sBAAM,EAAC,2BAA2B,CAAC;;0DACe;AAGzC;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACL,SAAG;gDAAC;8BARR,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,GAAE;GACA,mBAAmB,CA6E/B"}

package/lib/cjs/cli/PurgeAudit.d.ts

@@ -0,0 +1,10 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { AuthnAuditRetention } from '../audit/retention.js';
+/** Housekeeping for a scheduler (cron, worker); a no-op while `authn.audit.retentionDays` is unset. */
+export declare class PurgeAudit extends CliCommand {
+    protected Log: Log;
+    protected Retention: AuthnAuditRetention;
+    execute(): Promise<void>;
+}
+//# sourceMappingURL=PurgeAudit.d.ts.map

package/lib/cjs/cli/PurgeAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgeAudit.d.ts","sourceRoot":"","sources":["../../../src/cli/PurgeAudit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAW,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,uGAAuG;AACvG,qBACa,UAAW,SAAQ,UAAU;IAExC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAapC;CACF"}

package/lib/cjs/cli/PurgeAudit.js

@@ -0,0 +1,46 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PurgeAudit = void 0;
+const di_1 = require("@spinajs/di");
+const cli_1 = require("@spinajs/cli");
+const log_1 = require("@spinajs/log");
+const retention_js_1 = require("../audit/retention.js");
+/** Housekeeping for a scheduler (cron, worker); a no-op while `authn.audit.retentionDays` is unset. */
+let PurgeAudit = class PurgeAudit extends cli_1.CliCommand {
+    async execute() {
+        try {
+            if (!this.Retention.Enabled) {
+                this.Log.warn('authn.audit.retentionDays is not set, no audit rows were purged');
+                return;
+            }
+            const count = await this.Retention.purge();
+            this.Log.success({ count }, 'Deleted ${count} audit row(s) past retention');
+        }
+        catch (e) {
+            this.Log.error({ error: e }, 'Error while purging audit rows');
+            process.exitCode = 1;
+        }
+    }
+};
+exports.PurgeAudit = PurgeAudit;
+__decorate([
+    (0, log_1.Logger)('authn-orm'),
+    __metadata("design:type", log_1.Log)
+], PurgeAudit.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(retention_js_1.AuthnAuditRetention),
+    __metadata("design:type", retention_js_1.AuthnAuditRetention)
+], PurgeAudit.prototype, "Retention", void 0);
+exports.PurgeAudit = PurgeAudit = __decorate([
+    (0, cli_1.Command)('authn:audit-purge', 'Deletes audit rows older than authn.audit.retentionDays')
+], PurgeAudit);
+//# sourceMappingURL=PurgeAudit.js.map

package/lib/cjs/cli/PurgeAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgeAudit.js","sourceRoot":"","sources":["../../../src/cli/PurgeAudit.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAmD;AACnD,sCAA2C;AAE3C,wDAA4D;AAE5D,uGAAuG;AAEhG,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,gBAAU;IAOjC,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF,CAAA;;AAnBW;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACL,SAAG;uCAAC;AAGT;IADT,IAAA,eAAU,EAAC,kCAAmB,CAAC;8BACX,kCAAmB;6CAAC;qBAL9B,UAAU;IADtB,IAAA,aAAO,EAAC,mBAAmB,EAAE,yDAAyD,CAAC;GAC3E,UAAU,CAqBtB"}

package/lib/cjs/config/authn-orm.d.ts

@@ -0,0 +1,9 @@
+declare const authnOrm: {
+    system: {
+        dirs: {
+            cli: string[];
+        };
+    };
+};
+export default authnOrm;
+//# sourceMappingURL=authn-orm.d.ts.map

package/lib/cjs/config/authn-orm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-orm.d.ts","sourceRoot":"","sources":["../../../src/config/authn-orm.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,QAAQ;IACZ,MAAM;QACJ,IAAI;YAEF,GAAG;;;CAGR,CAAC;eAEa,QAAQ"}

package/lib/cjs/config/authn-orm.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'authn-orm', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'authn-orm', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+const authnOrm = {
+    system: {
+        dirs: {
+            // CLI commands are found by a filesystem scan, so without this entry `authn:audit-purge` is unreachable in a consuming app.
+            cli: [...dir('cli')],
+        },
+    },
+};
+exports.default = authnOrm;
+//# sourceMappingURL=authn-orm.js.map

package/lib/cjs/config/authn-orm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-orm.js","sourceRoot":"","sources":["../../../src/config/authn-orm.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAE5J,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KACpK,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,4HAA4H;YAC5H,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;CACF,CAAC;kBAEa,QAAQ"}

package/lib/cjs/index.d.ts

@@ -7,4 +7,5 @@ export * from './links/index.js';
 export * from './nonces/index.js';
 export * from './mfa/index.js';
 export * from './audit/index.js';
+export * from './cli/PurgeAudit.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/lib/cjs/index.js

@@ -23,4 +23,5 @@ __exportStar(require("./links/index.js"), exports);
 __exportStar(require("./nonces/index.js"), exports);
 __exportStar(require("./mfa/index.js"), exports);
 __exportStar(require("./audit/index.js"), exports);
+__exportStar(require("./cli/PurgeAudit.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,oDAAkC;AAClC,gDAA8B;AAC9B,sDAAoC;AACpC,qDAAmC;AACnC,mDAAiC;AACjC,oDAAkC;AAClC,iDAA+B;AAC/B,mDAAiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,oDAAkC;AAClC,gDAA8B;AAC9B,sDAAoC;AACpC,qDAAmC;AACnC,mDAAiC;AACjC,oDAAkC;AAClC,iDAA+B;AAC/B,mDAAiC;AACjC,sDAAoC"}

package/lib/cjs/mfa/db-mfa-enrolment-marks.d.ts

@@ -0,0 +1,16 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import { MfaEnrolmentMarks } from '@spinajs/authn/contracts';
+import { DbMfaStore } from './db-mfa-store.js';
+/** Enrolment marks of steps without a secret of their own, as confirmed `authn_mfa` rows. */
+export declare class DbMfaEnrolmentMarks extends MfaEnrolmentMarks {
+    protected readonly db?: DbMfaStore | undefined;
+    protected DbMfaStore: DbMfaStore;
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db?: DbMfaStore | undefined);
+    has(id: IdentityRef, step: string): Promise<boolean>;
+    /** True for exactly the call that confirmed the row; false when the identity is marked already. */
+    mark(id: IdentityRef, step: string): Promise<boolean>;
+    unmark(id: IdentityRef, step: string): Promise<void>;
+    private store;
+}
+//# sourceMappingURL=db-mfa-enrolment-marks.d.ts.map

package/lib/cjs/mfa/db-mfa-enrolment-marks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolment-marks.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolment-marks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM/C,6FAA6F;AAC7F,qBAEa,mBAAoB,SAAQ,iBAAiB;IAK5C,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU;IAH9C,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,kDAAkD;IAClD,YAA+B,EAAE,CAAC,EAAE,UAAU,YAAA,EAE7C;IAEY,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhE;IAED,mGAAmG;IACtF,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIjE;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;IAED,OAAO,CAAC,KAAK;CAGd"}

package/lib/cjs/mfa/db-mfa-enrolment-marks.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbMfaEnrolmentMarks = void 0;
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const db_mfa_store_js_1 = require("./db-mfa-store.js");
+/** What the row holds in place of a secret: the store keeps cipher text, and a mark has nothing to hide. */
+const MARK_SECRET = 'mark';
+const MARK_KEY = 'none';
+/** Enrolment marks of steps without a secret of their own, as confirmed `authn_mfa` rows. */
+let DbMfaEnrolmentMarks = class DbMfaEnrolmentMarks extends contracts_1.MfaEnrolmentMarks {
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db) {
+        super();
+        this.db = db;
+    }
+    async has(id, step) {
+        const row = await this.store().get(id, step);
+        return row !== null && row.confirmedAt !== null;
+    }
+    /** True for exactly the call that confirmed the row; false when the identity is marked already. */
+    async mark(id, step) {
+        const store = this.store();
+        if (!(await store.putPending(id, step, MARK_SECRET, MARK_KEY)))
+            return false;
+        return store.confirm(id, step, new Date(), MARK_SECRET);
+    }
+    async unmark(id, step) {
+        await this.store().remove(id, step);
+    }
+    store() {
+        return this.db ?? this.DbMfaStore;
+    }
+};
+exports.DbMfaEnrolmentMarks = DbMfaEnrolmentMarks;
+__decorate([
+    (0, di_1.Autoinject)(db_mfa_store_js_1.DbMfaStore),
+    __metadata("design:type", db_mfa_store_js_1.DbMfaStore)
+], DbMfaEnrolmentMarks.prototype, "DbMfaStore", void 0);
+exports.DbMfaEnrolmentMarks = DbMfaEnrolmentMarks = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.MfaEnrolmentMarks),
+    __metadata("design:paramtypes", [db_mfa_store_js_1.DbMfaStore])
+], DbMfaEnrolmentMarks);
+//# sourceMappingURL=db-mfa-enrolment-marks.js.map

package/lib/cjs/mfa/db-mfa-enrolment-marks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolment-marks.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolment-marks.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAA6D;AAC7D,oCAAuE;AAEvE,uDAA+C;AAE/C,4GAA4G;AAC5G,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,6FAA6F;AAGtF,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,6BAAiB;IAIxD,kDAAkD;IAClD,YAA+B,EAAe;QAC5C,KAAK,EAAE,CAAC;kBADqB,EAAE;IAEjC,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAe,EAAE,IAAY;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC;IAClD,CAAC;IAED,mGAAmG;IAC5F,KAAK,CAAC,IAAI,CAAC,EAAe,EAAE,IAAY;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAe,EAAE,IAAY;QAC/C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF,CAAA;;AA1BW;IADT,IAAA,eAAU,EAAC,4BAAU,CAAC;8BACD,4BAAU;uDAAC;8BAFtB,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,6BAAiB,CAAC;qCAMQ,4BAAU;GALnC,mBAAmB,CA4B/B"}

package/lib/cjs/mfa/index.d.ts

@@ -1,4 +1,5 @@
 export * from './db-mfa-store.js';
 export * from './db-mfa-enrolments.js';
+export * from './db-mfa-enrolment-marks.js';
 export * from './cipher.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/mfa/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":"AAAA,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,aAAa,CAAC"}

package/lib/cjs/mfa/index.js

@@ -16,5 +16,6 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
 Object.defineProperty(exports, "__esModule", { value: true });
 __exportStar(require("./db-mfa-store.js"), exports);
 __exportStar(require("./db-mfa-enrolments.js"), exports);
+__exportStar(require("./db-mfa-enrolment-marks.js"), exports);
 __exportStar(require("./cipher.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/mfa/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,yDAAuC;AACvC,8CAA4B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/mfa/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,oDAAkC;AAClC,yDAAuC;AACvC,8DAA4C;AAC5C,8CAA4B"}

package/lib/cjs/secrets/db-secret-store.d.ts

@@ -3,14 +3,14 @@ import type { IdentityRef } from '@spinajs/authn/contracts';
 import type { DateTime } from 'luxon';
 /**
  * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
- * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * 32 random bytes as base64url (43 chars), or the `value` the caller gives (a short code). Times are taken in Node at call time (F7); the claim of `redeem`
  * decides expiry and single use in SQL against that time (D10).
  *
  * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
  */
 export declare class DbSecretStore extends SecretStore {
     private readonly purgeDue;
-    issue(identity: IdentityRef, purpose: string, ttlSeconds: number): Promise<string>;
+    issue(identity: IdentityRef, purpose: string, ttlSeconds: number, value?: string): Promise<string>;
     /**
      * Looks the row up by the hash of `raw`, so no stored value is compared with the input in Node. The lookup
      * also matches identity and purpose; the claim succeeds for exactly one caller.

package/lib/cjs/secrets/db-secret-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-secret-store.d.ts","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAK5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAatC;;;;;;GAMG;AACH,qBAEa,aAAc,SAAQ,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAY9F;IAED;;;OAGG;IACU,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBzF;IAED,gFAAgF;IACnE,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1D;IAED,mEAAmE;IACnE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnF;YAEa,eAAe;CAK9B"}
+{"version":3,"file":"db-secret-store.d.ts","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAK5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAatC;;;;;;GAMG;AACH,qBAEa,aAAc,SAAQ,WAAW;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEzC,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAa9G;IAED;;;OAGG;IACU,MAAM,CAAC,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAgBzF;IAED,gFAAgF;IACnE,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAW1D;IAED,mEAAmE;IACnE,SAAS,CAAC,UAAU,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAGnF;YAEa,eAAe;CAK9B"}

package/lib/cjs/secrets/db-secret-store.js

@@ -23,7 +23,7 @@ const PURGE_BATCH = 500;
 const RAW_MAX = 1024;
 /**
  * `authn_secret`: single-use secrets stored as the hex SHA-256 of the raw value only (SR-09). The raw secret is
- * 32 random bytes as base64url (43 chars). Times are taken in Node at call time (F7); the claim of `redeem`
+ * 32 random bytes as base64url (43 chars), or the `value` the caller gives (a short code). Times are taken in Node at call time (F7); the claim of `redeem`
  * decides expiry and single use in SQL against that time (D10).
  *
  * Two parallel `issue` calls for one identity and purpose may both leave a live row: each deletes, then inserts.
@@ -33,14 +33,16 @@ let DbSecretStore = class DbSecretStore extends contracts_1.SecretStore {
         super(...arguments);
         this.purgeDue = (0, orm_1.everyNthCall)(PURGE_EVERY);
     }
-    async issue(identity, purpose, ttlSeconds) {
+    async issue(identity, purpose, ttlSeconds, value) {
         const key = (0, identity_js_1.identityKey)(identity);
         (0, sql_js_1.checkedText)(purpose, PURPOSE_MAX, 'DbSecretStore: purpose');
         (0, util_1._check_arg)((0, util_1._is_number)((0, util_1._finite)(), (0, util_1._gt)(0)))(ttlSeconds, 'ttlSeconds');
+        if (value !== undefined)
+            (0, util_1._check_arg)((0, util_1._is_string)((0, util_1._non_empty)(), (0, util_1._max_length)(RAW_MAX)))(value, 'value');
         const nowMs = (0, sql_js_1.checkedMs)(new Date(), 'DbSecretStore.issue: the clock');
         await (0, orm_1.ormReady)();
         await this.purgeNowAndThen(nowMs);
-        const raw = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+        const raw = value ?? (0, node_crypto_1.randomBytes)(32).toString('base64url');
         await AuthnSecret_js_1.AuthnSecret.destroy().where('identity', key).where('purpose', purpose);
         await AuthnSecret_js_1.AuthnSecret.insert((0, values_js_1.columnValues)({ id: (0, node_crypto_1.randomUUID)(), identity: key, purpose, secret_hash: (0, sql_js_1.sha256hex)(raw), expires_at: (0, sql_js_1.instant)(nowMs + ttlSeconds * 1000), used_at: null, created_at: (0, sql_js_1.instant)(nowMs) }));
         return raw;

package/lib/cjs/secrets/db-secret-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"db-secret-store.js","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAsD;AAEtD,wDAAuD;AAEvD,oCAA2D;AAC3D,sCAAsD;AAEtD,wCAA0H;AAG1H,gDAA6C;AAC7C,6DAAuD;AACvD,8CAA+E;AAC/E,oDAAoD;AAEpD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;;GAMG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,uBAAW;IAAvC;;QACY,aAAQ,GAAG,IAAA,kBAAY,EAAC,WAAW,CAAC,CAAC;IA+DxD,CAAC;IA7DQ,KAAK,CAAC,KAAK,CAAC,QAAqB,EAAE,OAAe,EAAE,UAAkB;QAC3E,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,cAAO,GAAE,EAAE,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACtE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,4BAAW,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAc,EAAE,EAAE,EAAE,IAAA,wBAAU,GAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1N,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,OAAe,EAAE,GAAW;QACrE,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACvE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvM,+GAA+G;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElE,MAAM,GAAG,GAAG,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,4BAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3I,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,gFAAgF;IACzE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACtD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,EAAE,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG;YACX,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnF,CAAC;IAED,mEAAmE;IACzD,UAAU,CAAC,SAAsC,EAAE,KAAa;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF,CAAA;;wBAhEY,aAAa;IAFzB,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,uBAAW,CAAC;GACX,aAAa,CAgEzB"}
+{"version":3,"file":"db-secret-store.js","sourceRoot":"","sources":["../../../src/secrets/db-secret-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAsD;AAEtD,wDAAuD;AAEvD,oCAA2D;AAC3D,sCAAsD;AAEtD,wCAA0H;AAG1H,gDAA6C;AAC7C,6DAAuD;AACvD,8CAA+E;AAC/E,oDAAoD;AAEpD,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,EAAE,CAAC;AACvB,MAAM,WAAW,GAAG,GAAG,CAAC;AACxB,sFAAsF;AACtF,MAAM,OAAO,GAAG,IAAI,CAAC;AAErB;;;;;;GAMG;AAGI,IAAM,aAAa,GAAnB,MAAM,aAAc,SAAQ,uBAAW;IAAvC;;QACY,aAAQ,GAAG,IAAA,kBAAY,EAAC,WAAW,CAAC,CAAC;IAgExD,CAAC;IA9DQ,KAAK,CAAC,KAAK,CAAC,QAAqB,EAAE,OAAe,EAAE,UAAkB,EAAE,KAAc;QAC3F,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,cAAO,GAAE,EAAE,IAAA,UAAG,EAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;QACpE,IAAI,KAAK,KAAK,SAAS;YAAE,IAAA,iBAAU,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACpG,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,gCAAgC,CAAC,CAAC;QACtE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,GAAG,GAAG,KAAK,IAAI,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC3D,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7E,MAAM,4BAAW,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAc,EAAE,EAAE,EAAE,IAAA,wBAAU,GAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,GAAG,UAAU,GAAG,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;QAC1N,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;OAGG;IACI,KAAK,CAAC,MAAM,CAAC,QAAqB,EAAE,OAAe,EAAE,GAAW;QACrE,MAAM,GAAG,GAAG,IAAA,yBAAW,EAAC,QAAQ,CAAC,CAAC;QAClC,IAAA,oBAAW,EAAC,OAAO,EAAE,WAAW,EAAE,wBAAwB,CAAC,CAAC;QAC5D,IAAI,CAAC,IAAA,qBAAc,EAAC,IAAA,iBAAU,EAAC,IAAA,iBAAU,GAAE,EAAE,IAAA,kBAAW,EAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACjG,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,iCAAiC,CAAC,CAAC;QACvE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;QAElC,MAAM,IAAI,GAAG,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,IAAA,kBAAS,EAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACvM,+GAA+G;QAC/G,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,GAAG,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QAC1E,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAElE,MAAM,GAAG,GAAG,IAAA,gBAAO,EAAC,KAAK,CAAC,CAAC;QAC3B,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,4BAAW,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;QAC3I,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED,gFAAgF;IACzE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,GAAG,EAAE,0BAA0B,CAAC,CAAC;QACtD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,CAAC,GAAG,IAAA,gBAAO,EAAC,EAAE,CAAC,CAAC;QACtB,MAAM,IAAI,GAAG;YACX,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;YAC7B,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QACtC,CAAC,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,MAAM,4BAAW,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,CAAC,MAAM,4BAAW,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC;IACnF,CAAC;IAED,mEAAmE;IACzD,UAAU,CAAC,SAAsC,EAAE,KAAa;QACxE,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC;IAC5C,CAAC;IAEO,KAAK,CAAC,eAAe,CAAC,KAAa;QACzC,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;CACF,CAAA;;wBAjEY,aAAa;IAFzB,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,uBAAW,CAAC;GACX,aAAa,CAiEzB"}

package/lib/cjs/throttle/db-throttle-store.d.ts

@@ -1,3 +1,4 @@
+import type { PeekVerdict } from '@spinajs/authn/contracts';
 import type { KeyedBackoffVerdict, ThrottleGate, ThrottleLower, ThrottleStore } from '@spinajs/util';
 import type { DateTime } from 'luxon';
 /** @internal "now" and the staleness cutoff of one call. */
@@ -46,7 +47,12 @@ export declare class DbThrottleStore implements ThrottleStore {
     private readonly purgeDue;
     constructor(options: DbThrottleStoreOptions);
     attempt(_flow: string, gates: readonly ThrottleGate[], counted: readonly string[], nowMs: number): Promise<KeyedBackoffVerdict>;
-    peek(_flow: string, gates: readonly ThrottleGate[], nowMs: number): Promise<KeyedBackoffVerdict>;
+    /**
+     * One SELECT of the live rows of the gates: refuses as `attempt` would for a delay, else `clean` when there are
+     * none. A success lowers or clears only rows an attempt writes next to its account gate, so a clean peek needs no
+     * `succeed`.
+     */
+    peek(_flow: string, gates: readonly ThrottleGate[], nowMs: number): Promise<PeekVerdict>;
     /** Lowers by the largest count it consumed: rows carry no run, so a `by` row older than its target is taken off too. */
     succeed(_flow: string, lower: readonly ThrottleLower[], clear: readonly string[], nowMs: number): Promise<void>;
     /** Deletes up to one batch of stale rows (idle for resetAfterMs and delaying nobody); returns how many went. */
@@ -70,6 +76,7 @@ export declare class DbThrottleStore implements ThrottleStore {
     private subtract;
     /** The longest wait any of `ks` imposes now, 0 when none delays. */
     private blockedWait;
+    private waitOf;
     /** Rows of `ks` that are not stale; stale and missing rows both count as zero. */
     private readLive;
     private isLive;

package/lib/cjs/throttle/db-throttle-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-throttle-store.d.ts","sourceRoot":"","sources":["../../../src/throttle/db-throttle-store.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAWtC,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,gIAAgI;AAChI,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,gBAAgB;AAChB,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,OAAO,EAAE,sBAAsB,EAE1C;IAEY,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6B3I;IAEY,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAK5G;IAED,wHAAwH;IAC3G,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB3H;IAED,gHAAgH;IACnG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAajD;IAED;;;;OAIG;IACH,UAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9J;IAED,0DAA0D;IAC1D,UAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAGnF;IAED,oHAAoH;IACpH,UAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAShF;IAED,kIAAkI;IAClI,UAAgB,IAAI,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;IAED,kHAAkH;YACpG,SAAS;IAQvB,6EAA6E;YAC/D,QAAQ;YAUR,QAAQ;IAkBtB,oEAAoE;YACtD,WAAW;IAczB,kFAAkF;YACpE,QAAQ;IActB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,KAAK;CAGd"}
+{"version":3,"file":"db-throttle-store.d.ts","sourceRoot":"","sources":["../../../src/throttle/db-throttle-store.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAiB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3E,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AACrG,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,OAAO,CAAC;AAWtC,4DAA4D;AAC5D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;CAC3B;AAED,uGAAuG;AACvG,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;CACzB;AAED,gIAAgI;AAChI,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC;CAC5B;AAED,gBAAgB;AAChB,MAAM,MAAM,OAAO,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,UAAU,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAE1H,MAAM,WAAW,sBAAsB;IACrC,gFAAgF;IAChF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;GAQG;AACH,qBAAa,eAAgB,YAAW,aAAa;IACnD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;IACtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA6B;IAEtD,YAAY,OAAO,EAAE,sBAAsB,EAE1C;IAEY,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA6B3I;IAED;;;;OAIG;IACU,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,YAAY,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAapG;IAED,wHAAwH;IAC3G,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,aAAa,EAAE,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmB3H;IAED,gHAAgH;IACnG,KAAK,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAajD;IAED;;;;OAIG;IACH,UAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,IAAI,GAAE,SAAS,MAAM,EAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAY9J;IAED,0DAA0D;IAC1D,UAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAGnF;IAED,oHAAoH;IACpH,UAAgB,iBAAiB,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,CAShF;IAED,kIAAkI;IAClI,UAAgB,IAAI,CAAC,MAAM,EAAE,SAAS,UAAU,EAAE,EAAE,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAQhF;IAED,kHAAkH;YACpG,SAAS;IAQvB,6EAA6E;YAC/D,QAAQ;YAUR,QAAQ;IAkBtB,oEAAoE;YACtD,WAAW;IAUzB,OAAO,CAAC,MAAM;IAKd,kFAAkF;YACpE,QAAQ;IActB,OAAO,CAAC,MAAM;IAOd,OAAO,CAAC,MAAM;IAId,OAAO,CAAC,KAAK;CAGd"}

package/lib/cjs/throttle/db-throttle-store.js

@@ -53,12 +53,22 @@ class DbThrottleStore {
         }
         return { allowed: true };
     }
+    /**
+     * One SELECT of the live rows of the gates: refuses as `attempt` would for a delay, else `clean` when there are
+     * none. A success lowers or clears only rows an attempt writes next to its account gate, so a clean peek needs no
+     * `succeed`.
+     */
     async peek(_flow, gates, nowMs) {
         if (gates.length === 0)
-            return { allowed: true };
+            return { allowed: true, clean: true };
         await (0, orm_1.ormReady)();
-        const waitMs = await this.blockedWait(gates.map((g) => g.id).sort(), this.times(nowMs));
-        return waitMs > 0 ? this.refuse(waitMs) : { allowed: true };
+        const t = this.times(nowMs);
+        const live = await AuthnThrottle_js_1.AuthnThrottle.query()
+            .columns(['k', 'next_allowed_at'])
+            .whereIn('k', gates.map((g) => g.id))
+            .where(this.isLive(t));
+        const waitMs = Math.max(0, ...live.map((r) => this.waitOf(r, t)));
+        return waitMs > 0 ? this.refuse(waitMs) : { allowed: true, clean: live.length === 0 };
     }
     /** Lowers by the largest count it consumed: rows carry no run, so a `by` row older than its target is taken off too. */
     async succeed(_flow, lower, clear, nowMs) {
@@ -191,13 +201,13 @@ class DbThrottleStore {
             .columns(['k', 'next_allowed_at'])
             .whereIn('k', [...ks])
             .where('next_allowed_at', '>', t.now);
-        let waitMs = 0;
-        for (const r of rows) {
-            const ms = (r.next_allowed_at?.toMillis() ?? NaN) - t.nowMs;
-            // A delaying row whose datetime does not read still delays.
-            waitMs = Math.max(waitMs, Number.isFinite(ms) && ms > 0 ? ms : FAIL_CLOSED_MS);
-        }
-        return waitMs;
+        // SQL found each row delaying, so one that reads as not delaying still delays.
+        return Math.max(0, ...rows.map((r) => this.waitOf(r, t) || FAIL_CLOSED_MS));
+    }
+    // A row whose datetime does not read is taken to delay.
+    waitOf(r, t) {
+        const ms = (r.next_allowed_at?.toMillis() ?? NaN) - t.nowMs;
+        return Number.isFinite(ms) ? Math.max(0, ms) : FAIL_CLOSED_MS;
     }
     /** Rows of `ks` that are not stale; stale and missing rows both count as zero. */
     async readLive(ks, t) {