@techelusive/nest-auth 0.0.0-stage → 0.2.1

package/dist/database/entities/organization.entity.js

@@ -0,0 +1,58 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OrganizationEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** A company or team. Users join organizations with a role (owner, admin, member). */
+let OrganizationEntity = class OrganizationEntity {
+    id;
+    name;
+    /** Unique handle, e.g. "acme-india". */
+    slug;
+    metadata;
+    createdByUserId;
+    createdAt;
+    updatedAt;
+};
+exports.OrganizationEntity = OrganizationEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], OrganizationEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], OrganizationEntity.prototype, "name", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], OrganizationEntity.prototype, "slug", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'jsonb', default: {} }),
+    __metadata("design:type", Object)
+], OrganizationEntity.prototype, "metadata", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'created_by_user_id', type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], OrganizationEntity.prototype, "createdByUserId", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], OrganizationEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], OrganizationEntity.prototype, "updatedAt", void 0);
+exports.OrganizationEntity = OrganizationEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_organizations')
+], OrganizationEntity);
+//# sourceMappingURL=organization.entity.js.map

package/dist/database/entities/organization.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"organization.entity.js","sourceRoot":"","sources":["../../../src/database/entities/organization.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA4G;AAG5G,sFAAsF;AAE/E,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAE7B,EAAE,CAAS;IAGX,IAAI,CAAS;IAEb,wCAAwC;IAGxC,IAAI,CAAS;IAGb,QAAQ,CAAa;IAGrB,eAAe,CAAgB;IAG/B,SAAS,CAAO;IAGhB,SAAS,CAAO;CACjB,CAAA;AAvBY,gDAAkB;AAE7B;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;8CACpB;AAGX;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;gDACZ;AAKb;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;gDACZ;AAGb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;;oDAClB;AAGrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2DACtC;AAG/B;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;qDAAC;AAGhB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;qDAAC;6BAtBL,kBAAkB;IAD9B,IAAA,gBAAM,EAAC,oBAAoB,CAAC;GAChB,kBAAkB,CAuB9B"}

package/dist/database/entities/passkey.entity.d.ts

@@ -0,0 +1,19 @@
+/** A passkey (Face ID, Touch ID, Windows Hello, security key) registered by a user. */
+export declare class PasskeyEntity {
+    id: string;
+    userId: string;
+    /** The id the device gave this passkey (base64url). */
+    credentialId: string;
+    /** The passkey's public key (base64url). The private key never leaves the user's device. */
+    publicKey: string;
+    /** Signature counter; if it goes backwards the passkey may have been cloned. */
+    signCount: number;
+    /** How the device talks to the browser, e.g. ["internal", "hybrid"]. */
+    transports: string[];
+    /** Name the user gave it, e.g. "My iPhone". */
+    name: string;
+    /** True when the passkey is synced (iCloud Keychain, Google Password Manager). */
+    isBackedUp: boolean;
+    createdAt: Date;
+    lastUsedAt: Date | null;
+}

package/dist/database/entities/passkey.entity.js

@@ -0,0 +1,78 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasskeyEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** A passkey (Face ID, Touch ID, Windows Hello, security key) registered by a user. */
+let PasskeyEntity = class PasskeyEntity {
+    id;
+    userId;
+    /** The id the device gave this passkey (base64url). */
+    credentialId;
+    /** The passkey's public key (base64url). The private key never leaves the user's device. */
+    publicKey;
+    /** Signature counter; if it goes backwards the passkey may have been cloned. */
+    signCount;
+    /** How the device talks to the browser, e.g. ["internal", "hybrid"]. */
+    transports;
+    /** Name the user gave it, e.g. "My iPhone". */
+    name;
+    /** True when the passkey is synced (iCloud Keychain, Google Password Manager). */
+    isBackedUp;
+    createdAt;
+    lastUsedAt;
+};
+exports.PasskeyEntity = PasskeyEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], PasskeyEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'user_id', type: 'uuid' }),
+    __metadata("design:type", String)
+], PasskeyEntity.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)({ name: 'credential_id', type: 'text' }),
+    __metadata("design:type", String)
+], PasskeyEntity.prototype, "credentialId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'public_key', type: 'text' }),
+    __metadata("design:type", String)
+], PasskeyEntity.prototype, "publicKey", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'sign_count', type: 'bigint', default: 0, transformer: { to: (v) => v, from: (v) => Number(v) } }),
+    __metadata("design:type", Number)
+], PasskeyEntity.prototype, "signCount", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text', array: true, default: '{}' }),
+    __metadata("design:type", Array)
+], PasskeyEntity.prototype, "transports", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], PasskeyEntity.prototype, "name", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'is_backed_up', type: 'boolean', default: false }),
+    __metadata("design:type", Boolean)
+], PasskeyEntity.prototype, "isBackedUp", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], PasskeyEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'last_used_at', type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Object)
+], PasskeyEntity.prototype, "lastUsedAt", void 0);
+exports.PasskeyEntity = PasskeyEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_passkeys')
+], PasskeyEntity);
+//# sourceMappingURL=passkey.entity.js.map

package/dist/database/entities/passkey.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"passkey.entity.js","sourceRoot":"","sources":["../../../src/database/entities/passkey.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0F;AAE1F,uFAAuF;AAEhF,IAAM,aAAa,GAAnB,MAAM,aAAa;IAExB,EAAE,CAAS;IAGX,MAAM,CAAS;IAEf,uDAAuD;IAGvD,YAAY,CAAS;IAErB,4FAA4F;IAE5F,SAAS,CAAS;IAElB,gFAAgF;IAEhF,SAAS,CAAS;IAElB,wEAAwE;IAExE,UAAU,CAAW;IAErB,+CAA+C;IAE/C,IAAI,CAAS;IAEb,kFAAkF;IAElF,UAAU,CAAU;IAGpB,SAAS,CAAO;IAGhB,UAAU,CAAc;CACzB,CAAA;AArCY,sCAAa;AAExB;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;yCACpB;AAGX;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6CAC3B;AAKf;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDAC3B;AAIrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;gDAC3B;AAIlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;;gDAChH;AAIlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;;iDAChC;AAIrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;2CACZ;AAIb;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;iDAC9C;AAGpB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;gDAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iDAC9C;wBApCb,aAAa;IADzB,IAAA,gBAAM,EAAC,eAAe,CAAC;GACX,aAAa,CAqCzB"}

package/dist/database/entities/password.entity.d.ts

@@ -0,0 +1,6 @@
+/** A user's password, stored only as an Argon2id hash. */
+export declare class PasswordEntity {
+    userId: string;
+    passwordHash: string;
+    updatedAt: Date;
+}

package/dist/database/entities/password.entity.js

@@ -0,0 +1,36 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PasswordEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** A user's password, stored only as an Argon2id hash. */
+let PasswordEntity = class PasswordEntity {
+    userId;
+    passwordHash;
+    updatedAt;
+};
+exports.PasswordEntity = PasswordEntity;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ name: 'user_id', type: 'uuid' }),
+    __metadata("design:type", String)
+], PasswordEntity.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'password_hash', type: 'text' }),
+    __metadata("design:type", String)
+], PasswordEntity.prototype, "passwordHash", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], PasswordEntity.prototype, "updatedAt", void 0);
+exports.PasswordEntity = PasswordEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_passwords')
+], PasswordEntity);
+//# sourceMappingURL=password.entity.js.map

package/dist/database/entities/password.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.entity.js","sourceRoot":"","sources":["../../../src/database/entities/password.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0E;AAE1E,0DAA0D;AAEnD,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,MAAM,CAAS;IAGf,YAAY,CAAS;IAGrB,SAAS,CAAO;CACjB,CAAA;AATY,wCAAc;AAEzB;IADC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;8CAClC;AAGf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;oDAC3B;AAGrB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;iDAAC;yBARL,cAAc;IAD1B,IAAA,gBAAM,EAAC,gBAAgB,CAAC;GACZ,cAAc,CAS1B"}

package/dist/database/entities/refresh-token.entity.d.ts

@@ -0,0 +1,9 @@
+/** Single-use refresh tokens. Each refresh marks the old one used and creates a new one. */
+export declare class RefreshTokenEntity {
+    id: string;
+    sessionId: string;
+    tokenHash: string;
+    expiresAt: Date;
+    usedAt: Date | null;
+    createdAt: Date;
+}

package/dist/database/entities/refresh-token.entity.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RefreshTokenEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** Single-use refresh tokens. Each refresh marks the old one used and creates a new one. */
+let RefreshTokenEntity = class RefreshTokenEntity {
+    id;
+    sessionId;
+    tokenHash;
+    expiresAt;
+    usedAt;
+    createdAt;
+};
+exports.RefreshTokenEntity = RefreshTokenEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], RefreshTokenEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ name: 'session_id', type: 'uuid' }),
+    __metadata("design:type", String)
+], RefreshTokenEntity.prototype, "sessionId", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)({ name: 'token_hash', type: 'text' }),
+    __metadata("design:type", String)
+], RefreshTokenEntity.prototype, "tokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'expires_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], RefreshTokenEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'used_at', type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Object)
+], RefreshTokenEntity.prototype, "usedAt", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], RefreshTokenEntity.prototype, "createdAt", void 0);
+exports.RefreshTokenEntity = RefreshTokenEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_refresh_tokens')
+], RefreshTokenEntity);
+//# sourceMappingURL=refresh-token.entity.js.map

package/dist/database/entities/refresh-token.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh-token.entity.js","sourceRoot":"","sources":["../../../src/database/entities/refresh-token.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0F;AAE1F,4FAA4F;AAErF,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IAE7B,EAAE,CAAS;IAIX,SAAS,CAAS;IAIlB,SAAS,CAAS;IAGlB,SAAS,CAAO;IAGhB,MAAM,CAAc;IAGpB,SAAS,CAAO;CACjB,CAAA;AApBY,gDAAkB;AAE7B;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;8CACpB;AAIX;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDAC3B;AAIlB;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;qDAC3B;AAGlB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACzC,IAAI;qDAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;kDAC7C;AAGpB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;qDAAC;6BAnBL,kBAAkB;IAD9B,IAAA,gBAAM,EAAC,qBAAqB,CAAC;GACjB,kBAAkB,CAoB9B"}

package/dist/database/entities/session.entity.d.ts

@@ -0,0 +1,20 @@
+/** One signed-in device. Signing out ends the session and every refresh token in it. */
+export declare class SessionEntity {
+    id: string;
+    userId: string;
+    /** How the user signed in: password, email_code, magic_link, phone_code, google, apple, facebook, passkey. */
+    signInMethod: string;
+    /** True when a 2FA code was also checked. */
+    usedTwoFactor: boolean;
+    /** The organization this device is currently working in (copied into the access token). */
+    activeOrganizationId: string | null;
+    ipAddress: string | null;
+    userAgent: string | null;
+    createdAt: Date;
+    lastUsedAt: Date;
+    /** Hard limit: after this the user must sign in again, however often they refresh. */
+    expiresAt: Date;
+    revokedAt: Date | null;
+    /** Why it ended: signed_out, password_changed, refresh_token_reused, admin... */
+    revokedReason: string | null;
+}

package/dist/database/entities/session.entity.js

@@ -0,0 +1,87 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** One signed-in device. Signing out ends the session and every refresh token in it. */
+let SessionEntity = class SessionEntity {
+    id;
+    userId;
+    /** How the user signed in: password, email_code, magic_link, phone_code, google, apple, facebook, passkey. */
+    signInMethod;
+    /** True when a 2FA code was also checked. */
+    usedTwoFactor;
+    /** The organization this device is currently working in (copied into the access token). */
+    activeOrganizationId;
+    ipAddress;
+    userAgent;
+    createdAt;
+    lastUsedAt;
+    /** Hard limit: after this the user must sign in again, however often they refresh. */
+    expiresAt;
+    revokedAt;
+    /** Why it ended: signed_out, password_changed, refresh_token_reused, admin... */
+    revokedReason;
+};
+exports.SessionEntity = SessionEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], SessionEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Index)(),
+    (0, typeorm_1.Column)({ name: 'user_id', type: 'uuid' }),
+    __metadata("design:type", String)
+], SessionEntity.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'sign_in_method', type: 'text' }),
+    __metadata("design:type", String)
+], SessionEntity.prototype, "signInMethod", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'used_two_factor', type: 'boolean', default: false }),
+    __metadata("design:type", Boolean)
+], SessionEntity.prototype, "usedTwoFactor", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'active_organization_id', type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], SessionEntity.prototype, "activeOrganizationId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'ip_address', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SessionEntity.prototype, "ipAddress", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'user_agent', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SessionEntity.prototype, "userAgent", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SessionEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'last_used_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SessionEntity.prototype, "lastUsedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'expires_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SessionEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'revoked_at', type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Object)
+], SessionEntity.prototype, "revokedAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'revoked_reason', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SessionEntity.prototype, "revokedReason", void 0);
+exports.SessionEntity = SessionEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_sessions')
+], SessionEntity);
+//# sourceMappingURL=session.entity.js.map

package/dist/database/entities/session.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.entity.js","sourceRoot":"","sources":["../../../src/database/entities/session.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0F;AAE1F,wFAAwF;AAEjF,IAAM,aAAa,GAAnB,MAAM,aAAa;IAExB,EAAE,CAAS;IAIX,MAAM,CAAS;IAEf,8GAA8G;IAE9G,YAAY,CAAS;IAErB,6CAA6C;IAE7C,aAAa,CAAU;IAEvB,2FAA2F;IAE3F,oBAAoB,CAAgB;IAGpC,SAAS,CAAgB;IAGzB,SAAS,CAAgB;IAGzB,SAAS,CAAO;IAGhB,UAAU,CAAO;IAEjB,sFAAsF;IAEtF,SAAS,CAAO;IAGhB,SAAS,CAAc;IAEvB,iFAAiF;IAEjF,aAAa,CAAgB;CAC9B,CAAA;AA1CY,sCAAa;AAExB;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;yCACpB;AAIX;IAFC,IAAA,eAAK,GAAE;IACP,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6CAC3B;AAIf;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;mDAC5B;AAIrB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;;oDAC9C;AAIvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2DACrC;AAGpC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACpC;AAGzB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDACpC;AAGzB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;gDAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BAC1C,IAAI;iDAAC;AAIjB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACzC,IAAI;gDAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gDAC7C;AAIvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;oDACpC;wBAzClB,aAAa;IADzB,IAAA,gBAAM,EAAC,eAAe,CAAC;GACX,aAAa,CA0CzB"}

package/dist/database/entities/settings.entity.d.ts

@@ -0,0 +1,7 @@
+/** Settings changed at runtime by admins. One row (id = 1). No row = use the settings in code. */
+export declare class SettingsEntity {
+    id: number;
+    changedValues: Record<string, any>;
+    changedBy: string;
+    updatedAt: Date;
+}

package/dist/database/entities/settings.entity.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SettingsEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** Settings changed at runtime by admins. One row (id = 1). No row = use the settings in code. */
+let SettingsEntity = class SettingsEntity {
+    id;
+    changedValues;
+    changedBy;
+    updatedAt;
+};
+exports.SettingsEntity = SettingsEntity;
+__decorate([
+    (0, typeorm_1.PrimaryColumn)({ type: 'int', default: 1 }),
+    __metadata("design:type", Number)
+], SettingsEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'changed_values', type: 'jsonb' }),
+    __metadata("design:type", Object)
+], SettingsEntity.prototype, "changedValues", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'changed_by', type: 'text' }),
+    __metadata("design:type", String)
+], SettingsEntity.prototype, "changedBy", void 0);
+__decorate([
+    (0, typeorm_1.UpdateDateColumn)({ name: 'updated_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SettingsEntity.prototype, "updatedAt", void 0);
+exports.SettingsEntity = SettingsEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_settings')
+], SettingsEntity);
+//# sourceMappingURL=settings.entity.js.map

package/dist/database/entities/settings.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.entity.js","sourceRoot":"","sources":["../../../src/database/entities/settings.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0E;AAE1E,kGAAkG;AAE3F,IAAM,cAAc,GAApB,MAAM,cAAc;IAEzB,EAAE,CAAS;IAGX,aAAa,CAAsB;IAGnC,SAAS,CAAS;IAGlB,SAAS,CAAO;CACjB,CAAA;AAZY,wCAAc;AAEzB;IADC,IAAA,uBAAa,EAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;0CAChC;AAGX;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;qDACf;AAGnC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;iDAC3B;AAGlB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;iDAAC;yBAXL,cAAc;IAD1B,IAAA,gBAAM,EAAC,eAAe,CAAC;GACX,cAAc,CAY1B"}

package/dist/database/entities/sign-in-challenge.entity.d.ts

@@ -0,0 +1,23 @@
+import type { ChallengePurpose } from '../../constants.js';
+export type { ChallengePurpose };
+/**
+ * A sign-in that is half done:
+ * - two_factor: the password (or code) was right, now we wait for the 2FA code.
+ * - reactivate_account: a DEACTIVATED user proved who they are; the token lets them reactivate.
+ * - passkey_*: we sent the device a random challenge and wait for it to sign it.
+ */
+export declare class SignInChallengeEntity {
+    id: string;
+    purpose: ChallengePurpose;
+    userId: string | null;
+    /** Hash of the token the client sends back to continue (for 2FA). */
+    challengeTokenHash: string | null;
+    /** The random WebAuthn challenge the device must sign (for passkeys). */
+    webauthnChallenge: string | null;
+    /** For 2FA: how the first step was done, kept for the session record. */
+    signInMethod: string | null;
+    failedAttempts: number;
+    expiresAt: Date;
+    usedAt: Date | null;
+    createdAt: Date;
+}

package/dist/database/entities/sign-in-challenge.entity.js

@@ -0,0 +1,80 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SignInChallengeEntity = void 0;
+const typeorm_1 = require("typeorm");
+/**
+ * A sign-in that is half done:
+ * - two_factor: the password (or code) was right, now we wait for the 2FA code.
+ * - reactivate_account: a DEACTIVATED user proved who they are; the token lets them reactivate.
+ * - passkey_*: we sent the device a random challenge and wait for it to sign it.
+ */
+let SignInChallengeEntity = class SignInChallengeEntity {
+    id;
+    purpose;
+    userId;
+    /** Hash of the token the client sends back to continue (for 2FA). */
+    challengeTokenHash;
+    /** The random WebAuthn challenge the device must sign (for passkeys). */
+    webauthnChallenge;
+    /** For 2FA: how the first step was done, kept for the session record. */
+    signInMethod;
+    failedAttempts;
+    expiresAt;
+    usedAt;
+    createdAt;
+};
+exports.SignInChallengeEntity = SignInChallengeEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], SignInChallengeEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ type: 'text' }),
+    __metadata("design:type", String)
+], SignInChallengeEntity.prototype, "purpose", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'user_id', type: 'uuid', nullable: true }),
+    __metadata("design:type", Object)
+], SignInChallengeEntity.prototype, "userId", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true, where: 'challenge_token_hash IS NOT NULL' }),
+    (0, typeorm_1.Column)({ name: 'challenge_token_hash', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SignInChallengeEntity.prototype, "challengeTokenHash", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'webauthn_challenge', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SignInChallengeEntity.prototype, "webauthnChallenge", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'sign_in_method', type: 'text', nullable: true }),
+    __metadata("design:type", Object)
+], SignInChallengeEntity.prototype, "signInMethod", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'failed_attempts', type: 'int', default: 0 }),
+    __metadata("design:type", Number)
+], SignInChallengeEntity.prototype, "failedAttempts", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'expires_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SignInChallengeEntity.prototype, "expiresAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'used_at', type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Object)
+], SignInChallengeEntity.prototype, "usedAt", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SignInChallengeEntity.prototype, "createdAt", void 0);
+exports.SignInChallengeEntity = SignInChallengeEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_sign_in_challenges')
+], SignInChallengeEntity);
+//# sourceMappingURL=sign-in-challenge.entity.js.map

package/dist/database/entities/sign-in-challenge.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sign-in-challenge.entity.js","sourceRoot":"","sources":["../../../src/database/entities/sign-in-challenge.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0F;AAK1F;;;;;GAKG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAEhC,EAAE,CAAS;IAGX,OAAO,CAAmB;IAG1B,MAAM,CAAgB;IAEtB,qEAAqE;IAGrE,kBAAkB,CAAgB;IAElC,yEAAyE;IAEzE,iBAAiB,CAAgB;IAEjC,yEAAyE;IAEzE,YAAY,CAAgB;IAG5B,cAAc,CAAS;IAGvB,SAAS,CAAO;IAGhB,MAAM,CAAc;IAGpB,SAAS,CAAO;CACjB,CAAA;AAlCY,sDAAqB;AAEhC;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;iDACpB;AAGX;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;sDACC;AAG1B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDACpC;AAKtB;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,kCAAkC,EAAE,CAAC;IAClE,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;iEACrC;AAIlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;gEACpC;AAIjC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;2DACrC;AAG5B;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;;6DACtC;AAGvB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACzC,IAAI;wDAAC;AAGhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;qDAC7C;AAGpB;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;wDAAC;gCAjCL,qBAAqB;IADjC,IAAA,gBAAM,EAAC,yBAAyB,CAAC;GACrB,qBAAqB,CAkCjC"}

package/dist/database/entities/signing-key.entity.d.ts

@@ -0,0 +1,11 @@
+/** Keys that sign tokens. The private half is stored encrypted (AWS KMS in production). */
+export declare class SigningKeyEntity {
+    id: string;
+    /** Key id, put in every token header so verifiers know which public key to use. */
+    keyId: string;
+    publicKey: Record<string, string>;
+    encryptedPrivateKey: string;
+    createdAt: Date;
+    /** Null for the key in use. Retired keys stay published for a while so older tokens still verify. */
+    retiredAt: Date | null;
+}

package/dist/database/entities/signing-key.entity.js

@@ -0,0 +1,54 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SigningKeyEntity = void 0;
+const typeorm_1 = require("typeorm");
+/** Keys that sign tokens. The private half is stored encrypted (AWS KMS in production). */
+let SigningKeyEntity = class SigningKeyEntity {
+    id;
+    /** Key id, put in every token header so verifiers know which public key to use. */
+    keyId;
+    publicKey;
+    encryptedPrivateKey;
+    createdAt;
+    /** Null for the key in use. Retired keys stay published for a while so older tokens still verify. */
+    retiredAt;
+};
+exports.SigningKeyEntity = SigningKeyEntity;
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)('uuid'),
+    __metadata("design:type", String)
+], SigningKeyEntity.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Index)({ unique: true }),
+    (0, typeorm_1.Column)({ name: 'key_id', type: 'text' }),
+    __metadata("design:type", String)
+], SigningKeyEntity.prototype, "keyId", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'public_key', type: 'jsonb' }),
+    __metadata("design:type", Object)
+], SigningKeyEntity.prototype, "publicKey", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'encrypted_private_key', type: 'text' }),
+    __metadata("design:type", String)
+], SigningKeyEntity.prototype, "encryptedPrivateKey", void 0);
+__decorate([
+    (0, typeorm_1.CreateDateColumn)({ name: 'created_at', type: 'timestamptz' }),
+    __metadata("design:type", Date)
+], SigningKeyEntity.prototype, "createdAt", void 0);
+__decorate([
+    (0, typeorm_1.Column)({ name: 'retired_at', type: 'timestamptz', nullable: true }),
+    __metadata("design:type", Object)
+], SigningKeyEntity.prototype, "retiredAt", void 0);
+exports.SigningKeyEntity = SigningKeyEntity = __decorate([
+    (0, typeorm_1.Entity)('auth_signing_keys')
+], SigningKeyEntity);
+//# sourceMappingURL=signing-key.entity.js.map

package/dist/database/entities/signing-key.entity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"signing-key.entity.js","sourceRoot":"","sources":["../../../src/database/entities/signing-key.entity.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,qCAA0F;AAE1F,2FAA2F;AAEpF,IAAM,gBAAgB,GAAtB,MAAM,gBAAgB;IAE3B,EAAE,CAAS;IAEX,mFAAmF;IAGnF,KAAK,CAAS;IAGd,SAAS,CAAyB;IAGlC,mBAAmB,CAAS;IAG5B,SAAS,CAAO;IAEhB,qGAAqG;IAErG,SAAS,CAAc;CACxB,CAAA;AArBY,4CAAgB;AAE3B;IADC,IAAA,gCAAsB,EAAC,MAAM,CAAC;;4CACpB;AAKX;IAFC,IAAA,eAAK,EAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACvB,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;+CAC3B;AAGd;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;;mDACZ;AAGlC;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;;6DAC5B;AAG5B;IADC,IAAA,0BAAgB,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,CAAC;8BACnD,IAAI;mDAAC;AAIhB;IADC,IAAA,gBAAM,EAAC,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;;mDAC7C;2BApBZ,gBAAgB;IAD5B,IAAA,gBAAM,EAAC,mBAAmB,CAAC;GACf,gBAAgB,CAqB5B"}