@spinajs/authn-orm 3.0.3 → 3.0.5

package/README.md

@@ -39,8 +39,8 @@ The cipher and `identityKey` are also exported from the side-effect-free subpath
 
 Every store reads and writes through the package's models (`AuthnIdentity`, `AuthnSecret`,
 `AuthnNonce`, `AuthnMfa`, `AuthnRecoveryCode`, `AuthnThrottle`, `AuthnAudit`), which name the
-table and the `default` connection. The stores take no driver: a store awaits `ormReady()` before
-its first statement, and a test boots an Orm whose `default` connection is the database under test.
+table and the `default` connection. The stores take no driver: each injects the Orm, so resolving a store
+resolves the Orm and binds the models, and a test boots an Orm whose `default` connection is the database under test.
 The stores, `DbAuthnThrottle` and `DbMfaEnrolments` are `@PerChildInstance`: each container that
 resolves one gets its own instance, and the throttle reads that container's configuration.
 

package/lib/cjs/audit/db-audit-sink.d.ts

@@ -1,11 +1,14 @@
 import { AuthnEventSink } from '@spinajs/authn/contracts';
 import type { AuthnEvent } from '@spinajs/authn/contracts';
+import { Orm } from '@spinajs/orm';
 /**
  * One `authn_audit` row per event (SR-11). Nothing in an event makes the write fail, so a sink never fails a call
  * whose work is already done (D4 over D1): free text longer than its column is cut, and an identity or actor that
  * does not fit its column leaves the column null and goes whole into `data` (`identityRef`, `actorRef`).
  */
 export declare class DbAuthnAuditSink extends AuthnEventSink {
+    /** Never read: injecting it resolves the Orm, which binds the models, before the first query. */
+    protected Orm: Orm;
     publish(e: AuthnEvent): Promise<void>;
 }
 //# sourceMappingURL=db-audit-sink.d.ts.map

package/lib/cjs/audit/db-audit-sink.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-audit-sink.d.ts","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,0BAA0B,CAAC;AA0BtF;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IACrC,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BjD;CACF"}
+{"version":3,"file":"db-audit-sink.d.ts","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAA6B,MAAM,0BAA0B,CAAC;AAEtF,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAwBnC;;;;GAIG;AACH,qBAEa,gBAAiB,SAAQ,cAAc;IAClD,iGAAiG;IAEjG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,OAAO,CAAC,CAAC,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAyBjD;CACF"}

package/lib/cjs/audit/db-audit-sink.js

@@ -5,6 +5,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbAuthnAuditSink = void 0;
 const node_crypto_1 = require("node:crypto");
@@ -48,7 +51,6 @@ let DbAuthnAuditSink = class DbAuthnAuditSink extends contracts_1.AuthnEventSink
         };
         const data = e.data === undefined && Object.keys(extra).length === 0 ? undefined : { ...(e.data ?? {}), ...extra };
         const at = (0, sql_js_1.instant)((0, sql_js_1.checkedMs)(e.at, 'DbAuthnAuditSink.publish: e.at'));
-        await (0, orm_1.ormReady)();
         await AuthnAudit_js_1.AuthnAudit.insert((0, values_js_1.columnValues)({
             id: (0, node_crypto_1.randomUUID)(),
             at,
@@ -66,6 +68,10 @@ let DbAuthnAuditSink = class DbAuthnAuditSink extends contracts_1.AuthnEventSink
     }
 };
 exports.DbAuthnAuditSink = DbAuthnAuditSink;
+__decorate([
+    (0, di_1.Autoinject)(orm_1.Orm),
+    __metadata("design:type", orm_1.Orm)
+], DbAuthnAuditSink.prototype, "Orm", void 0);
 exports.DbAuthnAuditSink = DbAuthnAuditSink = __decorate([
     (0, di_1.PerChildInstance)(),
     (0, di_1.Injectable)(contracts_1.AuthnEventSink)

package/lib/cjs/audit/db-audit-sink.js.map

@@ -1 +1 @@
-{"version":3,"file":"db-audit-sink.js","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA0D;AAE1D,oCAA2D;AAC3D,sCAAwC;AAExC,gDAA6C;AAC7C,2DAAqD;AACrD,8CAAgE;AAChE,oDAAoD;AAEpD,SAAS,SAAS,CAAC,GAA2C;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,0BAAc;IAC3C,KAAK,CAAC,OAAO,CAAC,CAAa;QAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QACnH,MAAM,EAAE,GAAG,IAAA,gBAAO,EAAC,IAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACtE,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,0BAAU,CAAC,MAAM,CACrB,IAAA,wBAAY,EAAa;YACvB,EAAE,EAAE,IAAA,wBAAU,GAAE;YAChB,EAAE;YACF,IAAI,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7B,EAAE,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACrB,UAAU,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACrC,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;;2BA5BY,gBAAgB;IAF5B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,0BAAc,CAAC;GACd,gBAAgB,CA4B5B"}
+{"version":3,"file":"db-audit-sink.js","sourceRoot":"","sources":["../../../src/audit/db-audit-sink.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA0D;AAE1D,oCAAuE;AACvE,sCAAmC;AAEnC,gDAA6C;AAC7C,2DAAqD;AACrD,8CAAgE;AAChE,oDAAoD;AAEpD,SAAS,SAAS,CAAC,GAA2C;IAC5D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,OAAO,IAAA,yBAAW,EAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;AACH,CAAC;AAED;;;;GAIG;AAGI,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,0BAAc;IAK3C,KAAK,CAAC,OAAO,CAAC,CAAa;QAChC,MAAM,QAAQ,GAAG,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACjC,MAAM,KAAK,GAAG;YACZ,GAAG,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACzG,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3F,CAAC;QACF,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;QACnH,MAAM,EAAE,GAAG,IAAA,gBAAO,EAAC,IAAA,kBAAS,EAAC,CAAC,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC,CAAC;QACtE,MAAM,0BAAU,CAAC,MAAM,CACrB,IAAA,wBAAY,EAAa;YACvB,EAAE,EAAE,IAAA,wBAAU,GAAE;YAChB,EAAE;YACF,IAAI,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YACzB,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9B,QAAQ;YACR,KAAK;YACL,QAAQ,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;YACjC,MAAM,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7B,EAAE,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC;YACrB,UAAU,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,SAAS,EAAE,GAAG,CAAC;YACrC,OAAO,EAAE,IAAA,gBAAO,EAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC;YAC/B,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;SAC7C,CAAC,CACH,CAAC;IACJ,CAAC;CACF,CAAA;;AA5BW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;6CAAC;2BAHR,gBAAgB;IAF5B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,0BAAc,CAAC;GACd,gBAAgB,CA+B5B"}

package/lib/cjs/audit/index.d.ts

@@ -1,2 +1,3 @@
 export { DbAuthnAuditSink } from './db-audit-sink.js';
+export { AuthnAuditRetention } from './retention.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/audit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC"}

package/lib/cjs/audit/index.js

@@ -1,6 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DbAuthnAuditSink = void 0;
+exports.AuthnAuditRetention = exports.DbAuthnAuditSink = void 0;
 var db_audit_sink_js_1 = require("./db-audit-sink.js");
 Object.defineProperty(exports, "DbAuthnAuditSink", { enumerable: true, get: function () { return db_audit_sink_js_1.DbAuthnAuditSink; } });
+var retention_js_1 = require("./retention.js");
+Object.defineProperty(exports, "AuthnAuditRetention", { enumerable: true, get: function () { return retention_js_1.AuthnAuditRetention; } });
 //# sourceMappingURL=index.js.map

package/lib/cjs/audit/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/audit/index.ts"],"names":[],"mappings":";;;AAAA,uDAAsD;AAA7C,oHAAA,gBAAgB,OAAA;AACzB,+CAAqD;AAA5C,mHAAA,mBAAmB,OAAA"}

package/lib/cjs/audit/retention.d.ts

@@ -0,0 +1,24 @@
+import '@spinajs/authn/register-schema';
+import { AsyncService } from '@spinajs/di';
+import { Log } from '@spinajs/log';
+import { Orm } from '@spinajs/orm';
+/**
+ * Deletes `authn_audit` rows older than `authn.audit.retentionDays`, in batches, on `purge` and, when
+ * `authn.audit.purgeInterval` (ms) is set, on a timer. Both keys are unset by default: audit rows are kept forever.
+ */
+export declare class AuthnAuditRetention extends AsyncService {
+    /** Never read: injecting it resolves the Orm, which binds `AuthnAudit`, before the first purge. */
+    protected Orm: Orm;
+    protected RetentionDays: number | null | undefined;
+    protected PurgeInterval: number | null | undefined;
+    protected Log: Log;
+    private timer;
+    private running;
+    get Enabled(): boolean;
+    resolve(): Promise<void>;
+    dispose(): Promise<void>;
+    /** Deletes the rows older than the retention; returns how many went. 0 while `retentionDays` is unset. */
+    purge(now?: Date): Promise<number>;
+    private tick;
+}
+//# sourceMappingURL=retention.d.ts.map

package/lib/cjs/audit/retention.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.d.ts","sourceRoot":"","sources":["../../../src/audit/retention.ts"],"names":[],"mappings":"AAAA,OAAO,gCAAgC,CAAC;AACxC,OAAO,EAAE,YAAY,EAA4C,MAAM,aAAa,CAAC;AAErF,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAC;AAQnC;;;GAGG;AACH,qBAEa,mBAAoB,SAAQ,YAAY;IACnD,mGAAmG;IAEnG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAGnD,SAAS,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAGnD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,OAAO,CAAC,KAAK,CAA6C;IAC1D,OAAO,CAAC,OAAO,CAAS;IAExB,IAAW,OAAO,IAAI,OAAO,CAE5B;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAOpC;IAEY,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAGpC;IAED,0GAA0G;IAC7F,KAAK,CAAC,GAAG,GAAE,IAAiB,GAAG,OAAO,CAAC,MAAM,CAAC,CAwB1D;YAEa,IAAI;CAkBnB"}

package/lib/cjs/audit/retention.js

@@ -0,0 +1,108 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuthnAuditRetention = void 0;
+require("@spinajs/authn/register-schema");
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+const orm_1 = require("@spinajs/orm");
+const AuthnAudit_js_1 = require("../models/AuthnAudit.js");
+const sql_js_1 = require("../support/sql.js");
+const DAY_MS = 86_400_000;
+const PURGE_BATCH = 500;
+/**
+ * Deletes `authn_audit` rows older than `authn.audit.retentionDays`, in batches, on `purge` and, when
+ * `authn.audit.purgeInterval` (ms) is set, on a timer. Both keys are unset by default: audit rows are kept forever.
+ */
+let AuthnAuditRetention = class AuthnAuditRetention extends di_1.AsyncService {
+    constructor() {
+        super(...arguments);
+        this.running = false;
+    }
+    get Enabled() {
+        return typeof this.RetentionDays === 'number' && this.RetentionDays > 0;
+    }
+    async resolve() {
+        if (!this.Enabled || !this.PurgeInterval || this.PurgeInterval < 1) {
+            return;
+        }
+        this.timer = setInterval(() => void this.tick(), this.PurgeInterval);
+        this.timer.unref?.();
+    }
+    async dispose() {
+        clearInterval(this.timer);
+        this.timer = undefined;
+    }
+    /** Deletes the rows older than the retention; returns how many went. 0 while `retentionDays` is unset. */
+    async purge(now = new Date()) {
+        const days = this.RetentionDays;
+        if (typeof days !== 'number' || !(days > 0)) {
+            return 0;
+        }
+        const cutoff = (0, sql_js_1.instant)((0, sql_js_1.checkedMs)(now, 'AuthnAuditRetention.purge: now') - days * DAY_MS);
+        let removed = 0;
+        for (;;) {
+            // MSSQL pages with OFFSET ... FETCH, which needs an ORDER BY.
+            const ids = (await AuthnAudit_js_1.AuthnAudit.query().columns(['id']).where('at', '<', cutoff).orderBy('at').take(PURGE_BATCH)).map((r) => r.id);
+            if (ids.length === 0) {
+                break;
+            }
+            const deleted = (await AuthnAudit_js_1.AuthnAudit.destroy().whereIn('id', ids).where('at', '<', cutoff)).RowsAffected;
+            removed += deleted;
+            if (ids.length < PURGE_BATCH || deleted === 0) {
+                break;
+            }
+        }
+        return removed;
+    }
+    async tick() {
+        if (this.running) {
+            return;
+        }
+        this.running = true;
+        try {
+            const count = await this.purge();
+            if (count > 0) {
+                this.Log.info({ count }, 'Purged audit rows past retention, count: ${count}');
+            }
+        }
+        catch (err) {
+            // An unhandled rejection here would end the process; the next tick retries.
+            this.Log.error(err, 'Audit retention purge failed');
+        }
+        finally {
+            this.running = false;
+        }
+    }
+};
+exports.AuthnAuditRetention = AuthnAuditRetention;
+__decorate([
+    (0, di_1.Autoinject)(orm_1.Orm),
+    __metadata("design:type", orm_1.Orm)
+], AuthnAuditRetention.prototype, "Orm", void 0);
+__decorate([
+    (0, configuration_1.Config)('authn.audit.retentionDays'),
+    __metadata("design:type", Object)
+], AuthnAuditRetention.prototype, "RetentionDays", void 0);
+__decorate([
+    (0, configuration_1.Config)('authn.audit.purgeInterval'),
+    __metadata("design:type", Object)
+], AuthnAuditRetention.prototype, "PurgeInterval", void 0);
+__decorate([
+    (0, log_1.Logger)('authn-orm'),
+    __metadata("design:type", log_1.Log)
+], AuthnAuditRetention.prototype, "Log", void 0);
+exports.AuthnAuditRetention = AuthnAuditRetention = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)()
+], AuthnAuditRetention);
+//# sourceMappingURL=retention.js.map

package/lib/cjs/audit/retention.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retention.js","sourceRoot":"","sources":["../../../src/audit/retention.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0CAAwC;AACxC,oCAAqF;AACrF,0DAAgD;AAChD,sCAA2C;AAC3C,sCAAmC;AAEnC,2DAAqD;AACrD,8CAAuD;AAEvD,MAAM,MAAM,GAAG,UAAU,CAAC;AAC1B,MAAM,WAAW,GAAG,GAAG,CAAC;AAExB;;;GAGG;AAGI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,iBAAY;IAA9C;;QAeG,YAAO,GAAG,KAAK,CAAC;IAiE1B,CAAC;IA/DC,IAAW,OAAO;QAChB,OAAO,OAAO,IAAI,CAAC,aAAa,KAAK,QAAQ,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC;IAC1E,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;YACnE,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAEM,KAAK,CAAC,OAAO;QAClB,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;IACzB,CAAC;IAED,0GAA0G;IACnG,KAAK,CAAC,KAAK,CAAC,GAAG,GAAS,IAAI,IAAI,EAAE;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC;QAChC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,EAAE,CAAC;YAC5C,OAAO,CAAC,CAAC;QACX,CAAC;QAED,MAAM,MAAM,GAAG,IAAA,gBAAO,EAAC,IAAA,kBAAS,EAAC,GAAG,EAAE,gCAAgC,CAAC,GAAG,IAAI,GAAG,MAAM,CAAC,CAAC;QAEzF,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,SAAS,CAAC;YACR,8DAA8D;YAC9D,MAAM,GAAG,GAAG,CAAC,MAAM,0BAAU,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjI,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACrB,MAAM;YACR,CAAC;YAED,MAAM,OAAO,GAAG,CAAC,MAAM,0BAAU,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,YAAY,CAAC;YACtG,OAAO,IAAI,OAAO,CAAC;YACnB,IAAI,GAAG,CAAC,MAAM,GAAG,WAAW,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;gBAC9C,MAAM;YACR,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEO,KAAK,CAAC,IAAI;QAChB,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,OAAO;QACT,CAAC;QAED,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;YACjC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;gBACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,mDAAmD,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,4EAA4E;YAC5E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAY,EAAE,8BAA8B,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,OAAO,GAAG,KAAK,CAAC;QACvB,CAAC;IACH,CAAC;CACF,CAAA;;AA7EW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;gDAAC;AAGT;IADT,IAAA,sBAAM,EAAC,2BAA2B,CAAC;;0DACe;AAGzC;IADT,IAAA,sBAAM,EAAC,2BAA2B,CAAC;;0DACe;AAGzC;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACL,SAAG;gDAAC;8BAZR,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,GAAE;GACA,mBAAmB,CAgF/B"}

package/lib/cjs/cli/PurgeAudit.d.ts

@@ -0,0 +1,13 @@
+import { CliCommand } from '@spinajs/cli';
+import { Log } from '@spinajs/log';
+import { OrmMigrator } from '@spinajs/orm';
+import { AuthnAuditRetention } from '../audit/retention.js';
+/** Housekeeping for a scheduler (cron, worker); a no-op while `authn.audit.retentionDays` is unset. */
+export declare class PurgeAudit extends CliCommand {
+    protected Log: Log;
+    /** The cli resolves only the command, so the command runs the `Migration.OnStartup` pass an app process runs before serving. */
+    protected Migrator: OrmMigrator;
+    protected Retention: AuthnAuditRetention;
+    execute(): Promise<void>;
+}
+//# sourceMappingURL=PurgeAudit.d.ts.map

package/lib/cjs/cli/PurgeAudit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgeAudit.d.ts","sourceRoot":"","sources":["../../../src/cli/PurgeAudit.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAW,MAAM,cAAc,CAAC;AACnD,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,uGAAuG;AACvG,qBACa,UAAW,SAAQ,UAAU;IAExC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEnB,gIAAgI;IAEhI,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC;IAGhC,SAAS,CAAC,SAAS,EAAE,mBAAmB,CAAC;IAE5B,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAapC;CACF"}

package/lib/cjs/cli/PurgeAudit.js

@@ -0,0 +1,51 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PurgeAudit = void 0;
+const di_1 = require("@spinajs/di");
+const cli_1 = require("@spinajs/cli");
+const log_1 = require("@spinajs/log");
+const orm_1 = require("@spinajs/orm");
+const retention_js_1 = require("../audit/retention.js");
+/** Housekeeping for a scheduler (cron, worker); a no-op while `authn.audit.retentionDays` is unset. */
+let PurgeAudit = class PurgeAudit extends cli_1.CliCommand {
+    async execute() {
+        try {
+            if (!this.Retention.Enabled) {
+                this.Log.warn('authn.audit.retentionDays is not set, no audit rows were purged');
+                return;
+            }
+            const count = await this.Retention.purge();
+            this.Log.success({ count }, 'Deleted ${count} audit row(s) past retention');
+        }
+        catch (e) {
+            this.Log.error({ error: e }, 'Error while purging audit rows');
+            process.exitCode = 1;
+        }
+    }
+};
+exports.PurgeAudit = PurgeAudit;
+__decorate([
+    (0, log_1.Logger)('authn-orm'),
+    __metadata("design:type", log_1.Log)
+], PurgeAudit.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(orm_1.OrmMigrator),
+    __metadata("design:type", orm_1.OrmMigrator)
+], PurgeAudit.prototype, "Migrator", void 0);
+__decorate([
+    (0, di_1.Autoinject)(retention_js_1.AuthnAuditRetention),
+    __metadata("design:type", retention_js_1.AuthnAuditRetention)
+], PurgeAudit.prototype, "Retention", void 0);
+exports.PurgeAudit = PurgeAudit = __decorate([
+    (0, cli_1.Command)('authn:audit-purge', 'Deletes audit rows older than authn.audit.retentionDays')
+], PurgeAudit);
+//# sourceMappingURL=PurgeAudit.js.map

package/lib/cjs/cli/PurgeAudit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PurgeAudit.js","sourceRoot":"","sources":["../../../src/cli/PurgeAudit.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,oCAAyC;AACzC,sCAAmD;AACnD,sCAA2C;AAC3C,sCAA2C;AAE3C,wDAA4D;AAE5D,uGAAuG;AAEhG,IAAM,UAAU,GAAhB,MAAM,UAAW,SAAQ,gBAAU;IAWjC,KAAK,CAAC,OAAO;QAClB,IAAI,CAAC;YACH,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;gBAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;gBACjF,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,EAAE,8CAA8C,CAAC,CAAC;QAC9E,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,gCAAgC,CAAC,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;CACF,CAAA;;AAvBW;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACL,SAAG;uCAAC;AAIT;IADT,IAAA,eAAU,EAAC,iBAAW,CAAC;8BACJ,iBAAW;4CAAC;AAGtB;IADT,IAAA,eAAU,EAAC,kCAAmB,CAAC;8BACX,kCAAmB;6CAAC;qBAT9B,UAAU;IADtB,IAAA,aAAO,EAAC,mBAAmB,EAAE,yDAAyD,CAAC;GAC3E,UAAU,CAyBtB"}

package/lib/cjs/config/authn-orm.d.ts

@@ -0,0 +1,9 @@
+declare const authnOrm: {
+    system: {
+        dirs: {
+            cli: string[];
+        };
+    };
+};
+export default authnOrm;
+//# sourceMappingURL=authn-orm.d.ts.map

package/lib/cjs/config/authn-orm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-orm.d.ts","sourceRoot":"","sources":["../../../src/config/authn-orm.ts"],"names":[],"mappings":"AAYA,QAAA,MAAM,QAAQ;IACZ,MAAM;QACJ,IAAI;YAEF,GAAG;;;CAGR,CAAC;eAEa,QAAQ"}

package/lib/cjs/config/authn-orm.js

@@ -0,0 +1,21 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const path_1 = require("path");
+function dir(path) {
+    const inCommonJs = typeof module !== 'undefined';
+    return [
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), 'node_modules', '@spinajs', 'authn-orm', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+        // one up if we run from app or build folder
+        (0, path_1.resolve)((0, path_1.normalize)((0, path_1.join)(process.env.WORKSPACE_ROOT_PATH ?? process.cwd(), '../', 'node_modules', '@spinajs', 'authn-orm', 'lib', inCommonJs ? 'cjs' : 'mjs', path))),
+    ];
+}
+const authnOrm = {
+    system: {
+        dirs: {
+            // CLI commands are found by a filesystem scan, so without this entry `authn:audit-purge` is unreachable in a consuming app.
+            cli: [...dir('cli')],
+        },
+    },
+};
+exports.default = authnOrm;
+//# sourceMappingURL=authn-orm.js.map

package/lib/cjs/config/authn-orm.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authn-orm.js","sourceRoot":"","sources":["../../../src/config/authn-orm.ts"],"names":[],"mappings":";;AAAA,+BAAgD;AAEhD,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,UAAU,GAAG,OAAO,MAAM,KAAK,WAAW,CAAC;IACjD,OAAO;QACL,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;QAE5J,4CAA4C;QAC5C,IAAA,cAAO,EAAC,IAAA,gBAAS,EAAC,IAAA,WAAI,EAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;KACpK,CAAC;AACJ,CAAC;AAED,MAAM,QAAQ,GAAG;IACf,MAAM,EAAE;QACN,IAAI,EAAE;YACJ,4HAA4H;YAC5H,GAAG,EAAE,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC;SACrB;KACF;CACF,CAAC;kBAEa,QAAQ"}

package/lib/cjs/index.d.ts

@@ -7,4 +7,5 @@ export * from './links/index.js';
 export * from './nonces/index.js';
 export * from './mfa/index.js';
 export * from './audit/index.js';
+export * from './cli/PurgeAudit.js';
 //# sourceMappingURL=index.d.ts.map

package/lib/cjs/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,mBAAmB,CAAC;AAClC,cAAc,eAAe,CAAC;AAC9B,cAAc,qBAAqB,CAAC;AACpC,cAAc,oBAAoB,CAAC;AACnC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,qBAAqB,CAAC"}

package/lib/cjs/index.js

@@ -23,4 +23,5 @@ __exportStar(require("./links/index.js"), exports);
 __exportStar(require("./nonces/index.js"), exports);
 __exportStar(require("./mfa/index.js"), exports);
 __exportStar(require("./audit/index.js"), exports);
+__exportStar(require("./cli/PurgeAudit.js"), exports);
 //# sourceMappingURL=index.js.map

package/lib/cjs/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,oDAAkC;AAClC,gDAA8B;AAC9B,sDAAoC;AACpC,qDAAmC;AACnC,mDAAiC;AACjC,oDAAkC;AAClC,iDAA+B;AAC/B,mDAAiC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wDAAsC;AACtC,oDAAkC;AAClC,gDAA8B;AAC9B,sDAAoC;AACpC,qDAAmC;AACnC,mDAAiC;AACjC,oDAAkC;AAClC,iDAA+B;AAC/B,mDAAiC;AACjC,sDAAoC"}

package/lib/cjs/links/db-link-store.d.ts

@@ -1,7 +1,10 @@
 import { IdentityLinkStore } from '@spinajs/authn/contracts';
 import type { ExternalSubject, IdentityLink, IdentityRef } from '@spinajs/authn/contracts';
+import { Orm } from '@spinajs/orm';
 /** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
 export declare class DbIdentityLinkStore extends IdentityLinkStore {
+    /** Never read: injecting it resolves the Orm, which binds the models, before the first query. */
+    protected Orm: Orm;
     find(provider: string, subject: string): Promise<IdentityLink | null>;
     list(identity: IdentityRef): Promise<readonly IdentityLink[]>;
     /** A duplicate (provider, subject) rejects with `ResourceDuplicated` (the unique index decides). */

package/lib/cjs/links/db-link-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-link-store.d.ts","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAiB3F,mHAAmH;AACnH,qBAEa,mBAAoB,SAAQ,iBAAiB;IAC3C,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAOjF;IAEY,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAKzE;IAED,oGAAoG;IACvF,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAgBzF;IAEY,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAG7C;IAED,oEAAoE;IACvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAKtE;CACF"}
+{"version":3,"file":"db-link-store.d.ts","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAC7D,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG3F,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAC;AAcpD,mHAAmH;AACnH,qBAEa,mBAAoB,SAAQ,iBAAiB;IACxD,iGAAiG;IAEjG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAMjF;IAEY,IAAI,CAAC,QAAQ,EAAE,WAAW,GAAG,OAAO,CAAC,SAAS,YAAY,EAAE,CAAC,CAIzE;IAED,oGAAoG;IACvF,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,GAAG,OAAO,CAAC,YAAY,CAAC,CAezF;IAEY,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7C;IAED,oEAAoE;IACvD,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,GAAG,OAAO,CAAC,OAAO,CAAC,CAItE;CACF"}

package/lib/cjs/links/db-link-store.js

@@ -5,6 +5,9 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DbIdentityLinkStore = void 0;
 const node_crypto_1 = require("node:crypto");
@@ -25,7 +28,6 @@ function identityParts(ref) {
 /** `authn_identity`: external subjects linked to identities (A19). Values longer than their columns throw (D1). */
 let DbIdentityLinkStore = class DbIdentityLinkStore extends contracts_1.IdentityLinkStore {
     async find(provider, subject) {
-        await (0, orm_1.ormReady)();
         const rows = await AuthnIdentity_js_1.AuthnIdentity.query().columns(LINK_COLUMNS).where('provider', provider).where('subject', subject);
         // MySQL and MSSQL default collations ignore case (and accents or trailing spaces): a subject differing only that
         // way must not sign in as another account.
@@ -34,7 +36,6 @@ let DbIdentityLinkStore = class DbIdentityLinkStore extends contracts_1.Identity
     }
     async list(identity) {
         const { type, id } = identityParts(identity);
-        await (0, orm_1.ormReady)();
         const rows = await AuthnIdentity_js_1.AuthnIdentity.query().columns(LINK_COLUMNS).where('identity_type', type).where('identity_id', id).orderBy('linked_at');
         return rows.filter((r) => r.identity_type === type && r.identity_id === id).map(toLink);
     }
@@ -45,7 +46,6 @@ let DbIdentityLinkStore = class DbIdentityLinkStore extends contracts_1.Identity
         const subject = (0, sql_js_1.checkedText)(external.subject, 255, 'DbIdentityLinkStore: subject');
         const email = external.email === undefined || external.email === null ? undefined : (0, sql_js_1.checkedText)(external.email, 255, 'DbIdentityLinkStore: email', true);
         const nowMs = (0, sql_js_1.checkedMs)(new Date(), 'DbIdentityLinkStore.link: the clock');
-        await (0, orm_1.ormReady)();
         const linkId = (0, node_crypto_1.randomUUID)();
         try {
             await AuthnIdentity_js_1.AuthnIdentity.insert((0, values_js_1.columnValues)({ id: linkId, identity_type: type, identity_id: id, provider, subject, email: email ?? null, email_verified: external.emailVerified === true, attributes: null, linked_at: (0, sql_js_1.instant)(nowMs), last_used_at: null }));
@@ -58,18 +58,20 @@ let DbIdentityLinkStore = class DbIdentityLinkStore extends contracts_1.Identity
         return { id: linkId, identity: { type, id }, provider, subject, ...(email !== undefined ? { email } : {}), linkedAt: new Date(nowMs) };
     }
     async unlink(id) {
-        await (0, orm_1.ormReady)();
         await AuthnIdentity_js_1.AuthnIdentity.destroy().where('id', id);
     }
     /** Sets `last_used_at` (default now); true when the link exists. */
     async touch(id, at = new Date()) {
         const ms = (0, sql_js_1.checkedMs)(at, 'DbIdentityLinkStore.touch: at');
-        await (0, orm_1.ormReady)();
         const { RowsAffected } = await AuthnIdentity_js_1.AuthnIdentity.update({ last_used_at: (0, sql_js_1.instant)(ms) }).where('id', id);
         return RowsAffected === 1;
     }
 };
 exports.DbIdentityLinkStore = DbIdentityLinkStore;
+__decorate([
+    (0, di_1.Autoinject)(orm_1.Orm),
+    __metadata("design:type", orm_1.Orm)
+], DbIdentityLinkStore.prototype, "Orm", void 0);
 exports.DbIdentityLinkStore = DbIdentityLinkStore = __decorate([
     (0, di_1.PerChildInstance)(),
     (0, di_1.Injectable)(contracts_1.IdentityLinkStore)

package/lib/cjs/links/db-link-store.js.map

@@ -1 +1 @@
-{"version":3,"file":"db-link-store.js","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":";;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA6D;AAE7D,oCAA2D;AAC3D,oDAA0E;AAC1E,sCAAyD;AAEzD,iEAA2D;AAC3D,8CAA4E;AAC5E,oDAAoD;AAEpD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAEzH,SAAS,aAAa,CAAC,GAAgB;IACrC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,4BAAe,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC/G,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,kCAAkC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,mHAAmH;AAG5G,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,6BAAiB;IACjD,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACjD,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrH,iHAAiH;QACjH,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAqB;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,oGAAoG;IAC7F,KAAK,CAAC,IAAI,CAAC,QAAqB,EAAE,QAAyB;QAChE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAC3E,MAAM,IAAA,cAAQ,GAAE,CAAC;QAEjB,MAAM,MAAM,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,gCAAa,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3Q,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAe;gBAAE,MAAM,IAAI,+BAAkB,CAAC,yBAAyB,QAAQ,8BAA8B,EAAE,GAAG,CAAC,CAAC;YACvI,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACzI,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,gCAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IAC7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC1D,MAAM,IAAA,cAAQ,GAAE,CAAC;QACjB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,gCAAa,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;8BAhDY,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,6BAAiB,CAAC;GACjB,mBAAmB,CAgD/B;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"db-link-store.js","sourceRoot":"","sources":["../../../src/links/db-link-store.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,6CAAyC;AAEzC,wDAA6D;AAE7D,oCAAuE;AACvE,oDAA0E;AAC1E,sCAAoD;AAEpD,iEAA2D;AAC3D,8CAA4E;AAC5E,oDAAoD;AAEpD,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,eAAe,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC;AAEzH,SAAS,aAAa,CAAC,GAAgB;IACrC,MAAM,IAAI,GAAG,IAAA,oBAAW,EAAC,GAAG,EAAE,IAAI,EAAE,EAAE,EAAE,oCAAoC,CAAC,CAAC;IAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,IAAI,4BAAe,CAAC,uCAAuC,IAAI,gBAAgB,CAAC,CAAC;IAC/G,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAA,oBAAW,EAAC,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,kCAAkC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,mHAAmH;AAG5G,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,6BAAiB;IAKjD,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,OAAe;QACjD,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrH,iHAAiH;QACjH,2CAA2C;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;QACjF,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,QAAqB;QACrC,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,gCAAa,CAAC,KAAK,EAAE,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;QAC1I,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1F,CAAC;IAED,oGAAoG;IAC7F,KAAK,CAAC,IAAI,CAAC,QAAqB,EAAE,QAAyB;QAChE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,QAAQ,EAAE,QAAQ,EAAE,GAAG,EAAE,+BAA+B,CAAC,CAAC;QACvF,MAAM,OAAO,GAAG,IAAA,oBAAW,EAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,EAAE,8BAA8B,CAAC,CAAC;QACnF,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,KAAK,SAAS,IAAI,QAAQ,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAA,oBAAW,EAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,EAAE,4BAA4B,EAAE,IAAI,CAAC,CAAC;QACzJ,MAAM,KAAK,GAAG,IAAA,kBAAS,EAAC,IAAI,IAAI,EAAE,EAAE,qCAAqC,CAAC,CAAC;QAE3E,MAAM,MAAM,GAAG,IAAA,wBAAU,GAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,gCAAa,CAAC,MAAM,CAAC,IAAA,wBAAY,EAAgB,EAAE,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,IAAI,IAAI,EAAE,cAAc,EAAE,QAAQ,CAAC,aAAa,KAAK,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,IAAA,gBAAO,EAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;QAC3Q,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,qBAAe;gBAAE,MAAM,IAAI,+BAAkB,CAAC,yBAAyB,QAAQ,8BAA8B,EAAE,GAAG,CAAC,CAAC;YACvI,MAAM,GAAG,CAAC;QACZ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;IACzI,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAU;QAC5B,MAAM,gCAAa,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChD,CAAC;IAED,oEAAoE;IAC7D,KAAK,CAAC,KAAK,CAAC,EAAU,EAAE,EAAE,GAAS,IAAI,IAAI,EAAE;QAClD,MAAM,EAAE,GAAG,IAAA,kBAAS,EAAC,EAAE,EAAE,+BAA+B,CAAC,CAAC;QAC1D,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,gCAAa,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,IAAA,gBAAO,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnG,OAAO,YAAY,KAAK,CAAC,CAAC;IAC5B,CAAC;CACF,CAAA;;AA5CW;IADT,IAAA,eAAU,EAAC,SAAG,CAAC;8BACD,SAAG;gDAAC;8BAHR,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,6BAAiB,CAAC;GACjB,mBAAmB,CA+C/B;AAED,SAAS,MAAM,CAAC,CAAgB;IAC9B,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAE;QACR,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,aAAa,EAAE,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE;QACtD,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,OAAO,EAAE,CAAC,CAAC,OAAO;QAClB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxE,QAAQ,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,SAAS,CAAC;QAC7B,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAA,eAAM,EAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAClE,CAAC;AACJ,CAAC"}

package/lib/cjs/mfa/db-mfa-enrolment-marks.d.ts

@@ -0,0 +1,16 @@
+import type { IdentityRef } from '@spinajs/authn/contracts';
+import { MfaEnrolmentMarks } from '@spinajs/authn/contracts';
+import { DbMfaStore } from './db-mfa-store.js';
+/** Enrolment marks of steps without a secret of their own, as confirmed `authn_mfa` rows. */
+export declare class DbMfaEnrolmentMarks extends MfaEnrolmentMarks {
+    protected readonly db?: DbMfaStore | undefined;
+    protected DbMfaStore: DbMfaStore;
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db?: DbMfaStore | undefined);
+    has(id: IdentityRef, step: string): Promise<boolean>;
+    /** True for exactly the call that confirmed the row; false when the identity is marked already. */
+    mark(id: IdentityRef, step: string): Promise<boolean>;
+    unmark(id: IdentityRef, step: string): Promise<void>;
+    private store;
+}
+//# sourceMappingURL=db-mfa-enrolment-marks.d.ts.map

package/lib/cjs/mfa/db-mfa-enrolment-marks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolment-marks.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolment-marks.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG7D,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM/C,6FAA6F;AAC7F,qBAEa,mBAAoB,SAAQ,iBAAiB;IAK5C,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,UAAU;IAH9C,SAAS,CAAC,UAAU,EAAE,UAAU,CAAC;IAEjC,kDAAkD;IAClD,YAA+B,EAAE,CAAC,EAAE,UAAU,YAAA,EAE7C;IAEY,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGhE;IAED,mGAAmG;IACtF,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIjE;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAEhE;IAED,OAAO,CAAC,KAAK;CAGd"}

package/lib/cjs/mfa/db-mfa-enrolment-marks.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DbMfaEnrolmentMarks = void 0;
+const contracts_1 = require("@spinajs/authn/contracts");
+const di_1 = require("@spinajs/di");
+const db_mfa_store_js_1 = require("./db-mfa-store.js");
+/** What the row holds in place of a secret: the store keeps cipher text, and a mark has nothing to hide. */
+const MARK_SECRET = 'mark';
+const MARK_KEY = 'none';
+/** Enrolment marks of steps without a secret of their own, as confirmed `authn_mfa` rows. */
+let DbMfaEnrolmentMarks = class DbMfaEnrolmentMarks extends contracts_1.MfaEnrolmentMarks {
+    /** DI passes nothing and injects `DbMfaStore`. */
+    constructor(db) {
+        super();
+        this.db = db;
+    }
+    async has(id, step) {
+        const row = await this.store().get(id, step);
+        return row !== null && row.confirmedAt !== null;
+    }
+    /** True for exactly the call that confirmed the row; false when the identity is marked already. */
+    async mark(id, step) {
+        const store = this.store();
+        if (!(await store.putPending(id, step, MARK_SECRET, MARK_KEY)))
+            return false;
+        return store.confirm(id, step, new Date(), MARK_SECRET);
+    }
+    async unmark(id, step) {
+        await this.store().remove(id, step);
+    }
+    store() {
+        return this.db ?? this.DbMfaStore;
+    }
+};
+exports.DbMfaEnrolmentMarks = DbMfaEnrolmentMarks;
+__decorate([
+    (0, di_1.Autoinject)(db_mfa_store_js_1.DbMfaStore),
+    __metadata("design:type", db_mfa_store_js_1.DbMfaStore)
+], DbMfaEnrolmentMarks.prototype, "DbMfaStore", void 0);
+exports.DbMfaEnrolmentMarks = DbMfaEnrolmentMarks = __decorate([
+    (0, di_1.PerChildInstance)(),
+    (0, di_1.Injectable)(contracts_1.MfaEnrolmentMarks),
+    __metadata("design:paramtypes", [db_mfa_store_js_1.DbMfaStore])
+], DbMfaEnrolmentMarks);
+//# sourceMappingURL=db-mfa-enrolment-marks.js.map

package/lib/cjs/mfa/db-mfa-enrolment-marks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db-mfa-enrolment-marks.js","sourceRoot":"","sources":["../../../src/mfa/db-mfa-enrolment-marks.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,wDAA6D;AAC7D,oCAAuE;AAEvE,uDAA+C;AAE/C,4GAA4G;AAC5G,MAAM,WAAW,GAAG,MAAM,CAAC;AAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC;AAExB,6FAA6F;AAGtF,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,6BAAiB;IAIxD,kDAAkD;IAClD,YAA+B,EAAe;QAC5C,KAAK,EAAE,CAAC;kBADqB,EAAE;IAEjC,CAAC;IAEM,KAAK,CAAC,GAAG,CAAC,EAAe,EAAE,IAAY;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC7C,OAAO,GAAG,KAAK,IAAI,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,CAAC;IAClD,CAAC;IAED,mGAAmG;IAC5F,KAAK,CAAC,IAAI,CAAC,EAAe,EAAE,IAAY;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7E,OAAO,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC1D,CAAC;IAEM,KAAK,CAAC,MAAM,CAAC,EAAe,EAAE,IAAY;QAC/C,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;IACtC,CAAC;IAEO,KAAK;QACX,OAAO,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC;IACpC,CAAC;CACF,CAAA;;AA1BW;IADT,IAAA,eAAU,EAAC,4BAAU,CAAC;8BACD,4BAAU;uDAAC;8BAFtB,mBAAmB;IAF/B,IAAA,qBAAgB,GAAE;IAClB,IAAA,eAAU,EAAC,6BAAiB,CAAC;qCAMQ,4BAAU;GALnC,mBAAmB,CA4B/B"}

package/lib/cjs/mfa/db-mfa-store.d.ts

@@ -1,4 +1,5 @@
 import type { IdentityRef } from '@spinajs/authn/contracts';
+import { Orm } from '@spinajs/orm';
 /** One MFA step of an identity as stored. */
 export interface MfaRecord {
     /** Cipher text exactly as `putPending` was given it; this store never encrypts or decrypts. */
@@ -18,6 +19,8 @@ export interface MfaRecord {
  * parallel calls for one identity may leave both sets.
  */
 export declare class DbMfaStore {
+    /** Never read: injecting it resolves the Orm, which binds the models, before the first query. */
+    protected Orm: Orm;
     get(id: IdentityRef, step: string): Promise<MfaRecord | null>;
     /**
      * Stores the step unconfirmed, with no accepted time step and created now, replacing a pending one. A confirmed

package/lib/cjs/mfa/db-mfa-store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"db-mfa-store.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAmB5D,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAkBD;;;;;;;GAOG;AACH,qBAEa,UAAU;IACR,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAczE;IAED;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAqBzG;IAED;;;OAGG;IACU,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAavH;IAED,mIAAmI;IACtH,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAUzF;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAKhE;IAED,mDAAmD;IACtC,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAK9D;IAED;;;OAGG;IACU,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAInD;IAED,4GAA4G;IAC/F,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAU7F;IAED,8EAA8E;IACjE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU9E;IAED,oBAAoB;IACP,kBAAkB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAKhE;IAEY,mBAAmB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAI/D;CACF"}
+{"version":3,"file":"db-mfa-store.d.ts","sourceRoot":"","sources":["../../../src/mfa/db-mfa-store.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAG5D,OAAO,EAAE,GAAG,EAAmB,MAAM,cAAc,CAAC;AAgBpD,6CAA6C;AAC7C,MAAM,WAAW,SAAS;IACxB,+FAA+F;IAC/F,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,IAAI,GAAG,IAAI,CAAC;IAClC,mCAAmC;IACnC,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC;CAC1B;AAkBD;;;;;;;GAOG;AACH,qBAEa,UAAU;IACrB,iGAAiG;IAEjG,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAEN,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAazE;IAED;;;;OAIG;IACU,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAoBzG;IAED;;;OAGG;IACU,OAAO,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,GAAE,IAAiB,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAYvH;IAED,mIAAmI;IACtH,UAAU,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CASzF;IAEY,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAIhE;IAED,mDAAmD;IACtC,cAAc,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAI9D;IAED;;;OAGG;IACU,kBAAkB,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAGnD;IAED,4GAA4G;IAC/F,oBAAoB,CAAC,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAS7F;IAED,8EAA8E;IACjE,kBAAkB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAS9E;IAED,oBAAoB;IACP,kBAAkB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAIhE;IAEY,mBAAmB,CAAC,EAAE,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAG/D;CACF"}