handoff-app 2.0.0-1 → 2.0.0-3

package/dist/index.d.ts

@@ -45,17 +45,21 @@ declare class Handoff {
      */
     dbMigrate(): Promise<Handoff>;
     /**
-     * Publish a single component, pattern, or page from this connected workspace to the configured
-     * remote registry. Components and patterns receive a fresh targeted build before upload. Pages
-     * upload their record and markdown source because they render at runtime. The publish module is
-     * loaded lazily so the registry client and build code never enter the docs app bundle.
+     * Publish components, patterns, or pages from this connected workspace to the configured remote
+     * registry. With `id` it publishes that one entity after a targeted build; without `id` it builds
+     * the kind once and publishes every declared entity, skipping ones whose content is unchanged on
+     * the registry (`--force` re-uploads all). Pages upload their record and markdown source because
+     * they render at runtime. The publish module is loaded lazily so the registry client and build code
+     * never enter the docs app bundle.
      */
-    publish(kind: 'component' | 'pattern' | 'page', id: string): Promise<Handoff>;
+    publish(kind: 'component' | 'pattern' | 'page', id?: string): Promise<Handoff>;
     /**
-     * Checkout a single component, pattern, or page from the connected remote registry. The checkout
-     * module is loaded lazily so the registry client never enters the docs app bundle.
+     * Checkout components, patterns, or pages from the connected remote registry into this workspace.
+     * With `id` it checks out that one entity; without `id` it checks out every published entity of the
+     * kind. Overwriting existing local files requires `--force` or an interactive confirmation. The
+     * checkout module is loaded lazily so the registry client never enters the docs app bundle.
      */
-    checkout(kind: 'component' | 'pattern' | 'page', id: string): Promise<Handoff>;
+    checkout(kind: 'component' | 'pattern' | 'page', id?: string): Promise<Handoff>;
     /**
      * Publish design token sets from this connected workspace to the configured remote registry. Runs a
      * fresh token build (Figma extract + style transformers), discovers the logical sets, and uploads

package/dist/index.js

@@ -159,28 +159,44 @@ class Handoff {
         });
     }
     /**
-     * Publish a single component, pattern, or page from this connected workspace to the configured
-     * remote registry. Components and patterns receive a fresh targeted build before upload. Pages
-     * upload their record and markdown source because they render at runtime. The publish module is
-     * loaded lazily so the registry client and build code never enter the docs app bundle.
+     * Publish components, patterns, or pages from this connected workspace to the configured remote
+     * registry. With `id` it publishes that one entity after a targeted build; without `id` it builds
+     * the kind once and publishes every declared entity, skipping ones whose content is unchanged on
+     * the registry (`--force` re-uploads all). Pages upload their record and markdown source because
+     * they render at runtime. The publish module is loaded lazily so the registry client and build code
+     * never enter the docs app bundle.
      */
     publish(kind, id) {
         return __awaiter(this, void 0, void 0, function* () {
             this.preRunner();
-            const { publishEntity } = yield Promise.resolve().then(() => __importStar(require('./registry/publish')));
-            yield publishEntity(this, kind, id);
+            if (id) {
+                const { publishEntity } = yield Promise.resolve().then(() => __importStar(require('./registry/publish')));
+                yield publishEntity(this, kind, id);
+            }
+            else {
+                const { publishEntities } = yield Promise.resolve().then(() => __importStar(require('./registry/publish')));
+                yield publishEntities(this, kind);
+            }
             return this;
         });
     }
     /**
-     * Checkout a single component, pattern, or page from the connected remote registry. The checkout
-     * module is loaded lazily so the registry client never enters the docs app bundle.
+     * Checkout components, patterns, or pages from the connected remote registry into this workspace.
+     * With `id` it checks out that one entity; without `id` it checks out every published entity of the
+     * kind. Overwriting existing local files requires `--force` or an interactive confirmation. The
+     * checkout module is loaded lazily so the registry client never enters the docs app bundle.
      */
     checkout(kind, id) {
         return __awaiter(this, void 0, void 0, function* () {
             this.preRunner();
-            const { checkoutEntity } = yield Promise.resolve().then(() => __importStar(require('./registry/checkout')));
-            yield checkoutEntity(this, kind, id);
+            if (id) {
+                const { checkoutEntity } = yield Promise.resolve().then(() => __importStar(require('./registry/checkout')));
+                yield checkoutEntity(this, kind, id);
+            }
+            else {
+                const { checkoutEntities } = yield Promise.resolve().then(() => __importStar(require('./registry/checkout')));
+                yield checkoutEntities(this, kind);
+            }
             return this;
         });
     }

package/dist/registry/asset-storage/resolve.d.ts

@@ -3,7 +3,7 @@
  *
  * `runtime.registry.assetStorage` selects the active provider for **new** uploads: the built-in
  * `database` inline default, the pre-packaged `vercel-blob` adapter, or a `custom` module. Mirrors
- * {@link import('../db/adapter')}: only provider selection, module location, non-secret options, and
+ * {@link import('../db/driver')}: only provider selection, module location, non-secret options, and
  * env-var *names* are ever persisted; secret *values* are read from `process.env` at request time.
  */
 import type { Config } from '../../types/config';

package/dist/registry/asset-storage/resolve.js

@@ -4,7 +4,7 @@
  *
  * `runtime.registry.assetStorage` selects the active provider for **new** uploads: the built-in
  * `database` inline default, the pre-packaged `vercel-blob` adapter, or a `custom` module. Mirrors
- * {@link import('../db/adapter')}: only provider selection, module location, non-secret options, and
+ * {@link import('../db/driver')}: only provider selection, module location, non-secret options, and
  * env-var *names* are ever persisted; secret *values* are read from `process.env` at request time.
  */
 Object.defineProperty(exports, "__esModule", { value: true });

package/dist/registry/auth/access-tokens.d.ts

@@ -0,0 +1,46 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryAccessScope } from '../db/schema';
+import { type RegistryPrincipal, type RegistryUserRole } from './types';
+export interface RegistryAccessTokenSummary {
+    id: string;
+    name: string;
+    scopes: RegistryAccessScope[];
+    expiresAt: Date;
+    lastUsedAt: Date | null;
+    revokedAt: Date | null;
+    createdAt: Date;
+}
+export type CreateRegistryAccessTokenResult = {
+    ok: true;
+    token: string;
+    record: RegistryAccessTokenSummary;
+} | {
+    ok: false;
+    reason: 'user_not_found' | 'user_inactive' | 'scope_forbidden' | 'invalid_name' | 'invalid_expiry';
+};
+export declare const normalizeRegistryScopes: (scopes: readonly RegistryAccessScope[]) => RegistryAccessScope[];
+export declare const registryRoleAllowsScopes: (role: RegistryUserRole, scopes: readonly RegistryAccessScope[]) => boolean;
+export declare const formatRegistryAccessToken: (id: string, secret: string) => string;
+export declare const parseRegistryAccessToken: (token: string) => {
+    id: string;
+    secret: string;
+} | null;
+export declare const createRegistryAccessToken: (db: RegistryDatabase, input: {
+    userId: string;
+    name: string;
+    scopes: RegistryAccessScope[];
+    expiresAt?: Date;
+    now?: Date;
+}) => Promise<CreateRegistryAccessTokenResult>;
+export declare const listRegistryAccessTokens: (db: RegistryDatabase, userId: string) => Promise<RegistryAccessTokenSummary[]>;
+export declare const revokeRegistryAccessToken: (db: RegistryDatabase, input: {
+    tokenId: string;
+    userId: string;
+    now?: Date;
+}) => Promise<boolean>;
+export declare const revokeAllRegistryAccessTokens: (db: RegistryDatabase, userId: string, now?: Date) => Promise<number>;
+/**
+ * Resolve an opaque bearer credential into a live principal. User state is joined on every call,
+ * making deactivation effective even if a defensive token-revocation write was interrupted.
+ */
+export declare const authenticateRegistryAccessToken: (db: RegistryDatabase, token: string, now?: Date) => Promise<RegistryPrincipal | null>;

package/dist/registry/auth/access-tokens.js

@@ -0,0 +1,165 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.authenticateRegistryAccessToken = exports.revokeAllRegistryAccessTokens = exports.revokeRegistryAccessToken = exports.listRegistryAccessTokens = exports.createRegistryAccessToken = exports.parseRegistryAccessToken = exports.formatRegistryAccessToken = exports.registryRoleAllowsScopes = exports.normalizeRegistryScopes = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const schema_1 = require("../db/schema");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const types_1 = require("./types");
+const ACCESS_TOKEN_PREFIX = 'hnd';
+const DEFAULT_ACCESS_TOKEN_LIFETIME_MS = 365 * 24 * 60 * 60 * 1000;
+const isRegistryScope = (value) => value === types_1.REGISTRY_READ_SCOPE || value === types_1.REGISTRY_WRITE_SCOPE;
+const normalizeRegistryScopes = (scopes) => {
+    const unique = new Set(scopes.filter(isRegistryScope));
+    return [types_1.REGISTRY_READ_SCOPE, types_1.REGISTRY_WRITE_SCOPE].filter((scope) => unique.has(scope));
+};
+exports.normalizeRegistryScopes = normalizeRegistryScopes;
+const registryRoleAllowsScopes = (role, scopes) => role === 'admin' || !scopes.includes(types_1.REGISTRY_WRITE_SCOPE);
+exports.registryRoleAllowsScopes = registryRoleAllowsScopes;
+const formatRegistryAccessToken = (id, secret) => `${ACCESS_TOKEN_PREFIX}_${id}_${secret}`;
+exports.formatRegistryAccessToken = formatRegistryAccessToken;
+const parseRegistryAccessToken = (token) => {
+    const match = /^hnd_([A-Za-z0-9_-]{16})_([A-Za-z0-9_-]{43})$/.exec(token.trim());
+    return match ? { id: match[1], secret: match[2] } : null;
+};
+exports.parseRegistryAccessToken = parseRegistryAccessToken;
+const createRegistryAccessTokenInTransaction = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const name = input.name.trim();
+    if (!name || name.length > 120)
+        return { ok: false, reason: 'invalid_name' };
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + DEFAULT_ACCESS_TOKEN_LIFETIME_MS);
+    if (!(expiresAt instanceof Date) || !Number.isFinite(expiresAt.getTime()) || expiresAt <= now) {
+        return { ok: false, reason: 'invalid_expiry' };
+    }
+    const [user] = yield db
+        .select({ id: schema_1.registryUsers.id, role: schema_1.registryUsers.role, status: schema_1.registryUsers.status })
+        .from(schema_1.registryUsers)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId))
+        .limit(1)
+        .for('update');
+    if (!user)
+        return { ok: false, reason: 'user_not_found' };
+    if (user.status !== 'active')
+        return { ok: false, reason: 'user_inactive' };
+    const scopes = (0, exports.normalizeRegistryScopes)(input.scopes);
+    if (!scopes.length)
+        scopes.push(types_1.REGISTRY_READ_SCOPE);
+    if (!(0, exports.registryRoleAllowsScopes)(user.role, scopes))
+        return { ok: false, reason: 'scope_forbidden' };
+    const id = (0, crypto_1.createOpaqueSecret)(12);
+    const secret = (0, crypto_1.createOpaqueSecret)(32);
+    const [record] = yield db
+        .insert(schema_1.registryAccessTokens)
+        .values({
+        id,
+        userId: user.id,
+        name,
+        secretHash: (0, crypto_1.hashSecret)(secret),
+        scopes,
+        expiresAt,
+    })
+        .returning({
+        id: schema_1.registryAccessTokens.id,
+        name: schema_1.registryAccessTokens.name,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        lastUsedAt: schema_1.registryAccessTokens.lastUsedAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        createdAt: schema_1.registryAccessTokens.createdAt,
+    });
+    return { ok: true, token: (0, exports.formatRegistryAccessToken)(id, secret), record };
+});
+const createRegistryAccessToken = (db, input) => __awaiter(void 0, void 0, void 0, function* () { return (0, database_1.withRegistryTransaction)(db, (tx) => createRegistryAccessTokenInTransaction(tx, input)); });
+exports.createRegistryAccessToken = createRegistryAccessToken;
+const listRegistryAccessTokens = (db, userId) => __awaiter(void 0, void 0, void 0, function* () {
+    return db
+        .select({
+        id: schema_1.registryAccessTokens.id,
+        name: schema_1.registryAccessTokens.name,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        lastUsedAt: schema_1.registryAccessTokens.lastUsedAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        createdAt: schema_1.registryAccessTokens.createdAt,
+    })
+        .from(schema_1.registryAccessTokens)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, userId))
+        .orderBy(schema_1.registryAccessTokens.createdAt);
+});
+exports.listRegistryAccessTokens = listRegistryAccessTokens;
+const revokeRegistryAccessToken = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const rows = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ revokedAt: (_a = input.now) !== null && _a !== void 0 ? _a : new Date() })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, input.tokenId), (0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, input.userId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    return rows.length > 0;
+});
+exports.revokeRegistryAccessToken = revokeRegistryAccessToken;
+const revokeAllRegistryAccessTokens = (db_1, userId_1, ...args_1) => __awaiter(void 0, [db_1, userId_1, ...args_1], void 0, function* (db, userId, now = new Date()) {
+    const rows = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ revokedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.userId, userId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    return rows.length;
+});
+exports.revokeAllRegistryAccessTokens = revokeAllRegistryAccessTokens;
+/**
+ * Resolve an opaque bearer credential into a live principal. User state is joined on every call,
+ * making deactivation effective even if a defensive token-revocation write was interrupted.
+ */
+const authenticateRegistryAccessToken = (db_1, token_1, ...args_1) => __awaiter(void 0, [db_1, token_1, ...args_1], void 0, function* (db, token, now = new Date()) {
+    const parsed = (0, exports.parseRegistryAccessToken)(token);
+    if (!parsed)
+        return null;
+    const [row] = yield db
+        .select({
+        tokenId: schema_1.registryAccessTokens.id,
+        secretHash: schema_1.registryAccessTokens.secretHash,
+        scopes: schema_1.registryAccessTokens.scopes,
+        expiresAt: schema_1.registryAccessTokens.expiresAt,
+        revokedAt: schema_1.registryAccessTokens.revokedAt,
+        userId: schema_1.registryUsers.id,
+        email: schema_1.registryUsers.email,
+        name: schema_1.registryUsers.name,
+        role: schema_1.registryUsers.role,
+        status: schema_1.registryUsers.status,
+    })
+        .from(schema_1.registryAccessTokens)
+        .innerJoin(schema_1.registryUsers, (0, drizzle_orm_1.eq)(schema_1.registryUsers.id, schema_1.registryAccessTokens.userId))
+        .where((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, parsed.id))
+        .limit(1);
+    if (!row || row.status !== 'active' || row.revokedAt || row.expiresAt <= now || !(0, crypto_1.secretHashMatches)(parsed.secret, row.secretHash)) {
+        return null;
+    }
+    const scopes = (0, exports.normalizeRegistryScopes)(Array.isArray(row.scopes) ? row.scopes : []);
+    const updated = yield db
+        .update(schema_1.registryAccessTokens)
+        .set({ lastUsedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAccessTokens.id, row.tokenId), (0, drizzle_orm_1.isNull)(schema_1.registryAccessTokens.revokedAt), (0, drizzle_orm_1.gt)(schema_1.registryAccessTokens.expiresAt, now)))
+        .returning({ id: schema_1.registryAccessTokens.id });
+    if (!updated.length)
+        return null;
+    return {
+        tokenId: row.tokenId,
+        userId: row.userId,
+        email: row.email,
+        name: row.name,
+        role: row.role,
+        scopes,
+    };
+});
+exports.authenticateRegistryAccessToken = authenticateRegistryAccessToken;

package/dist/registry/auth/action-tokens.d.ts

@@ -0,0 +1,66 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryUserRole } from '../db/schema';
+import type { RegistryUser } from './types';
+export declare const INVITATION_LIFETIME_MS: number;
+export declare const PASSWORD_RESET_LIFETIME_MS: number;
+export type CreateUserInvitationResult = {
+    ok: true;
+    user: RegistryUser;
+    token: string;
+    expiresAt: Date;
+} | {
+    ok: false;
+    reason: 'invalid_email' | 'invalid_name' | 'invalid_role' | 'email_exists';
+};
+export type ResendUserInvitationResult = {
+    ok: true;
+    user: RegistryUser;
+    token: string;
+    expiresAt: Date;
+} | {
+    ok: false;
+    reason: 'not_found' | 'already_accepted' | 'deactivated';
+};
+export type ConsumeAuthActionResult = {
+    ok: true;
+    user: RegistryUser;
+} | {
+    ok: false;
+    reason: 'invalid_or_expired_token' | 'invalid_password';
+    error?: string;
+};
+export declare const createUserInvitation: (db: RegistryDatabase, input: {
+    email: string;
+    name: string;
+    role: RegistryUserRole;
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<CreateUserInvitationResult>;
+export declare const resendUserInvitation: (db: RegistryDatabase, input: {
+    userId: string;
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<ResendUserInvitationResult>;
+export declare const acceptUserInvitation: (db: RegistryDatabase, input: {
+    token: string;
+    password: string;
+    now?: Date;
+}) => Promise<ConsumeAuthActionResult>;
+/**
+ * Enumeration-safe reset request. The token is returned only to the trusted mail-delivery caller;
+ * unknown/inactive emails return the same successful shape with a null token.
+ */
+export declare const createPasswordReset: (db: RegistryDatabase, email: string, options?: {
+    now?: Date;
+    expiresAt?: Date;
+}) => Promise<{
+    ok: true;
+    user: RegistryUser | null;
+    token: string | null;
+    expiresAt: Date | null;
+}>;
+export declare const resetPassword: (db: RegistryDatabase, input: {
+    token: string;
+    password: string;
+    now?: Date;
+}) => Promise<ConsumeAuthActionResult>;

package/dist/registry/auth/action-tokens.js

@@ -0,0 +1,178 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetPassword = exports.createPasswordReset = exports.acceptUserInvitation = exports.resendUserInvitation = exports.createUserInvitation = exports.PASSWORD_RESET_LIFETIME_MS = exports.INVITATION_LIFETIME_MS = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+exports.INVITATION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+exports.PASSWORD_RESET_LIFETIME_MS = 60 * 60 * 1000;
+const invalidateUnusedActionTokens = (db, userId, purpose, now) => __awaiter(void 0, void 0, void 0, function* () {
+    yield db
+        .update(schema_1.registryAuthActionTokens)
+        .set({ usedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.userId, userId), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, purpose), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt)));
+});
+const insertActionToken = (db, userId, purpose, expiresAt, now) => __awaiter(void 0, void 0, void 0, function* () {
+    const token = (0, crypto_1.createOpaqueSecret)(32);
+    yield db.insert(schema_1.registryAuthActionTokens).values({
+        id: (0, node_crypto_1.randomUUID)(),
+        userId,
+        purpose,
+        tokenHash: (0, crypto_1.hashSecret)(token),
+        expiresAt,
+        createdAt: now,
+    });
+    return token;
+});
+const createUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const email = (0, validation_1.validateRegistryEmail)(input.email);
+    if (!email)
+        return { ok: false, reason: 'invalid_email' };
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    if (input.role !== 'admin' && input.role !== 'member')
+        return { ok: false, reason: 'invalid_role' };
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.INVITATION_LIFETIME_MS);
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const userId = (0, node_crypto_1.randomUUID)();
+        const rows = yield tx
+            .insert(schema_1.registryUsers)
+            .values({
+            id: userId,
+            email,
+            name,
+            role: input.role,
+            status: 'invited',
+            createdAt: now,
+            updatedAt: now,
+        })
+            .onConflictDoNothing()
+            .returning();
+        const user = rows[0];
+        if (!user)
+            return { ok: false, reason: 'email_exists' };
+        const token = yield insertActionToken(tx, userId, 'invite', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.createUserInvitation = createUserInvitation;
+const resendUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        const [user] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1).for('update');
+        if (!user)
+            return { ok: false, reason: 'not_found' };
+        if (user.status === 'active')
+            return { ok: false, reason: 'already_accepted' };
+        if (user.status === 'deactivated')
+            return { ok: false, reason: 'deactivated' };
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.INVITATION_LIFETIME_MS);
+        yield invalidateUnusedActionTokens(tx, user.id, 'invite', now);
+        const token = yield insertActionToken(tx, user.id, 'invite', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.resendUserInvitation = resendUserInvitation;
+const acceptUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const validation = (0, password_1.validatePassword)(input.password);
+    if ('error' in validation)
+        return { ok: false, reason: 'invalid_password', error: validation.error };
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [consumed] = yield tx
+            .update(schema_1.registryAuthActionTokens)
+            .set({ usedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.tokenHash, (0, crypto_1.hashSecret)(input.token)), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, 'invite'), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt), (0, drizzle_orm_1.gt)(schema_1.registryAuthActionTokens.expiresAt, now)))
+            .returning({ userId: schema_1.registryAuthActionTokens.userId });
+        if (!consumed)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        const [user] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            passwordHash,
+            status: 'active',
+            emailVerifiedAt: now,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, consumed.userId), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'invited')))
+            .returning();
+        return user ? { ok: true, user: (0, user_record_1.toRegistryUser)(user) } : { ok: false, reason: 'invalid_or_expired_token' };
+    }));
+});
+exports.acceptUserInvitation = acceptUserInvitation;
+/**
+ * Enumeration-safe reset request. The token is returned only to the trusted mail-delivery caller;
+ * unknown/inactive emails return the same successful shape with a null token.
+ */
+const createPasswordReset = (db_1, email_1, ...args_1) => __awaiter(void 0, [db_1, email_1, ...args_1], void 0, function* (db, email, options = {}) {
+    var _a, _b;
+    const normalizedEmail = (0, crypto_1.normalizeEmail)(email);
+    const now = (_a = options.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = options.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.PASSWORD_RESET_LIFETIME_MS);
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [user] = yield tx
+            .select()
+            .from(schema_1.registryUsers)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.email, normalizedEmail), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')))
+            .limit(1)
+            .for('update');
+        if (!user)
+            return { ok: true, user: null, token: null, expiresAt: null };
+        yield invalidateUnusedActionTokens(tx, user.id, 'password_reset', now);
+        const token = yield insertActionToken(tx, user.id, 'password_reset', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.createPasswordReset = createPasswordReset;
+const resetPassword = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const validation = (0, password_1.validatePassword)(input.password);
+    if ('error' in validation)
+        return { ok: false, reason: 'invalid_password', error: validation.error };
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [consumed] = yield tx
+            .update(schema_1.registryAuthActionTokens)
+            .set({ usedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.tokenHash, (0, crypto_1.hashSecret)(input.token)), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, 'password_reset'), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt), (0, drizzle_orm_1.gt)(schema_1.registryAuthActionTokens.expiresAt, now)))
+            .returning({ userId: schema_1.registryAuthActionTokens.userId });
+        if (!consumed)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        const [user] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            passwordHash,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, consumed.userId), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')))
+            .returning();
+        if (!user)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, user.id, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user) };
+    }));
+});
+exports.resetPassword = resetPassword;

package/dist/registry/auth/crypto.d.ts

@@ -0,0 +1,4 @@
+export declare const hashSecret: (secret: string) => string;
+export declare const createOpaqueSecret: (byteLength?: number) => string;
+export declare const secretHashMatches: (secret: string, expectedHash: string) => boolean;
+export declare const normalizeEmail: (email: string) => string;

package/dist/registry/auth/crypto.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEmail = exports.secretHashMatches = exports.createOpaqueSecret = exports.hashSecret = void 0;
+const node_crypto_1 = require("node:crypto");
+const hashSecret = (secret) => (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+exports.hashSecret = hashSecret;
+const createOpaqueSecret = (byteLength = 32) => (0, node_crypto_1.randomBytes)(byteLength).toString('base64url');
+exports.createOpaqueSecret = createOpaqueSecret;
+const secretHashMatches = (secret, expectedHash) => {
+    const actual = Buffer.from((0, exports.hashSecret)(secret), 'hex');
+    const expected = Buffer.from(expectedHash, 'hex');
+    return actual.length === expected.length && (0, node_crypto_1.timingSafeEqual)(actual, expected);
+};
+exports.secretHashMatches = secretHashMatches;
+const normalizeEmail = (email) => email.trim().toLowerCase();
+exports.normalizeEmail = normalizeEmail;

package/dist/registry/auth/database.d.ts

@@ -0,0 +1,7 @@
+import type { RegistryDatabase } from '../db/client';
+export type RegistryTransaction = RegistryDatabase;
+export declare const withRegistryTransaction: <T>(db: RegistryDatabase, callback: (tx: RegistryTransaction) => Promise<T>) => Promise<T>;
+export declare const acquireRegistryAdvisoryLock: (tx: RegistryTransaction, lockId: number) => Promise<void>;
+/** Stable, package-owned Postgres advisory-lock ids. */
+export declare const REGISTRY_INSTALL_LOCK_ID = 1841111001;
+export declare const REGISTRY_ADMIN_LOCK_ID = 1841111002;

package/dist/registry/auth/database.js

@@ -0,0 +1,22 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY_ADMIN_LOCK_ID = exports.REGISTRY_INSTALL_LOCK_ID = exports.acquireRegistryAdvisoryLock = exports.withRegistryTransaction = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const withRegistryTransaction = (db, callback) => __awaiter(void 0, void 0, void 0, function* () { return db.transaction((tx) => callback(tx)); });
+exports.withRegistryTransaction = withRegistryTransaction;
+const acquireRegistryAdvisoryLock = (tx, lockId) => __awaiter(void 0, void 0, void 0, function* () {
+    yield tx.execute((0, drizzle_orm_1.sql) `select pg_advisory_xact_lock(${lockId})`);
+});
+exports.acquireRegistryAdvisoryLock = acquireRegistryAdvisoryLock;
+/** Stable, package-owned Postgres advisory-lock ids. */
+exports.REGISTRY_INSTALL_LOCK_ID = 1841111001;
+exports.REGISTRY_ADMIN_LOCK_ID = 1841111002;