handoff-app 2.0.0-1 → 2.0.0-3

package/dist/registry/auth/device-authorizations.d.ts

@@ -0,0 +1,51 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryAccessTokenSummary } from './access-tokens';
+import { type RegistryAccessScope, type RegistryUser } from './types';
+export declare const DEVICE_AUTHORIZATION_LIFETIME_SECONDS: number;
+export declare const DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = 5;
+export declare const generateRegistryUserCode: () => string;
+export declare const normalizeRegistryUserCode: (value: string) => string;
+export interface CreateRegistryDeviceAuthorizationResult {
+    deviceCode: string;
+    userCode: string;
+    expiresIn: number;
+    interval: number;
+    expiresAt: Date;
+}
+export declare const createRegistryDeviceAuthorization: (db: RegistryDatabase, options?: {
+    now?: Date;
+    expiresInSeconds?: number;
+}) => Promise<CreateRegistryDeviceAuthorizationResult>;
+export type RegistryDeviceApprovalResult = {
+    ok: true;
+    user: RegistryUser;
+    scopes: RegistryAccessScope[];
+} | {
+    ok: false;
+    reason: 'invalid_or_expired_code' | 'user_inactive';
+};
+export declare const approveRegistryDeviceAuthorization: (db: RegistryDatabase, input: {
+    userCode: string;
+    userId: string;
+    now?: Date;
+}) => Promise<RegistryDeviceApprovalResult>;
+export declare const denyRegistryDeviceAuthorization: (db: RegistryDatabase, userCode: string, now?: Date) => Promise<boolean>;
+export type ExchangeRegistryDeviceAuthorizationResult = {
+    ok: true;
+    accessToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    scopes: RegistryAccessScope[];
+    user: RegistryUser;
+    record: RegistryAccessTokenSummary;
+} | {
+    ok: false;
+    error: 'invalid_grant' | 'expired_token' | 'authorization_pending' | 'access_denied';
+    errorDescription: string;
+};
+export declare const exchangeRegistryDeviceAuthorization: (db: RegistryDatabase, input: {
+    deviceCode: string;
+    tokenName?: string;
+    now?: Date;
+}) => Promise<ExchangeRegistryDeviceAuthorizationResult>;
+export declare const purgeExpiredRegistryDeviceAuthorizations: (db: RegistryDatabase, now?: Date) => Promise<number>;

package/dist/registry/auth/device-authorizations.js

@@ -0,0 +1,170 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeExpiredRegistryDeviceAuthorizations = exports.exchangeRegistryDeviceAuthorization = exports.denyRegistryDeviceAuthorization = exports.approveRegistryDeviceAuthorization = exports.createRegistryDeviceAuthorization = exports.normalizeRegistryUserCode = exports.generateRegistryUserCode = exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const types_1 = require("./types");
+const user_record_1 = require("./user-record");
+const USER_CODE_ALPHABET = 'BCDFGHJKLMNPQRSTVWXYZ23456789';
+exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = 15 * 60;
+exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = 5;
+const randomUserCodeSegment = (length) => {
+    const bytes = (0, node_crypto_1.randomBytes)(length);
+    let result = '';
+    for (let index = 0; index < length; index += 1) {
+        result += USER_CODE_ALPHABET[bytes[index] % USER_CODE_ALPHABET.length];
+    }
+    return result;
+};
+const generateRegistryUserCode = () => `${randomUserCodeSegment(4)}-${randomUserCodeSegment(4)}`;
+exports.generateRegistryUserCode = generateRegistryUserCode;
+const normalizeRegistryUserCode = (value) => {
+    const compact = value.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return compact.length === 8 ? `${compact.slice(0, 4)}-${compact.slice(4)}` : value.trim().toUpperCase();
+};
+exports.normalizeRegistryUserCode = normalizeRegistryUserCode;
+const createRegistryDeviceAuthorization = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, options = {}) {
+    var _a, _b;
+    const now = (_a = options.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresIn = (_b = options.expiresInSeconds) !== null && _b !== void 0 ? _b : exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS;
+    const deviceCode = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    const userCode = (0, exports.generateRegistryUserCode)();
+    const expiresAt = new Date(now.getTime() + expiresIn * 1000);
+    yield db.insert(schema_1.registryDeviceAuthorizations).values({
+        id: (0, node_crypto_1.randomUUID)(),
+        deviceCodeHash: (0, crypto_1.hashSecret)(deviceCode),
+        userCode,
+        status: 'pending',
+        scopes: [],
+        expiresAt,
+        createdAt: now,
+    });
+    return {
+        deviceCode,
+        userCode,
+        expiresIn,
+        interval: exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS,
+        expiresAt,
+    };
+});
+exports.createRegistryDeviceAuthorization = createRegistryDeviceAuthorization;
+const approveRegistryDeviceAuthorization = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const [user] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+    if (!user || user.status !== 'active')
+        return { ok: false, reason: 'user_inactive' };
+    const scopes = (0, types_1.scopesForRegistryRole)(user.role);
+    const [authorization] = yield db
+        .update(schema_1.registryDeviceAuthorizations)
+        .set({
+        status: 'approved',
+        userId: user.id,
+        scopes,
+        approvedAt: now,
+    })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.userCode, (0, exports.normalizeRegistryUserCode)(input.userCode)), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'pending'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return authorization ? { ok: true, user: (0, user_record_1.toRegistryUser)(user), scopes } : { ok: false, reason: 'invalid_or_expired_code' };
+});
+exports.approveRegistryDeviceAuthorization = approveRegistryDeviceAuthorization;
+const denyRegistryDeviceAuthorization = (db_1, userCode_1, ...args_1) => __awaiter(void 0, [db_1, userCode_1, ...args_1], void 0, function* (db, userCode, now = new Date()) {
+    const rows = yield db
+        .update(schema_1.registryDeviceAuthorizations)
+        .set({ status: 'denied' })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.userCode, (0, exports.normalizeRegistryUserCode)(userCode)), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'pending'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return rows.length > 0;
+});
+exports.denyRegistryDeviceAuthorization = denyRegistryDeviceAuthorization;
+const exchangeRegistryDeviceAuthorization = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const tokenName = ((_b = input.tokenName) === null || _b === void 0 ? void 0 : _b.trim()) || 'Handoff CLI';
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [authorization] = yield tx
+            .select()
+            .from(schema_1.registryDeviceAuthorizations)
+            .where((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.deviceCodeHash, (0, crypto_1.hashSecret)(input.deviceCode)))
+            .limit(1);
+        if (!authorization) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Unknown device code.' };
+        }
+        if (authorization.expiresAt <= now) {
+            return { ok: false, error: 'expired_token', errorDescription: 'Device authorization expired.' };
+        }
+        if (authorization.status === 'pending') {
+            return {
+                ok: false,
+                error: 'authorization_pending',
+                errorDescription: 'The authorization request is still pending.',
+            };
+        }
+        if (authorization.status === 'denied') {
+            return { ok: false, error: 'access_denied', errorDescription: 'The authorization request was denied.' };
+        }
+        if (authorization.status === 'consumed') {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device code has already been used.' };
+        }
+        if (!authorization.userId) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device authorization has no user.' };
+        }
+        const [consumed] = yield tx
+            .update(schema_1.registryDeviceAuthorizations)
+            .set({ status: 'consumed', consumedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.id, authorization.id), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'approved'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+            .returning({ id: schema_1.registryDeviceAuthorizations.id });
+        if (!consumed) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device code has already been used.' };
+        }
+        const [user] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, authorization.userId)).limit(1);
+        if (!user || user.status !== 'active') {
+            return { ok: false, error: 'access_denied', errorDescription: 'The approving account is inactive.' };
+        }
+        let scopes = (0, access_tokens_1.normalizeRegistryScopes)(authorization.scopes);
+        if (!(0, access_tokens_1.registryRoleAllowsScopes)(user.role, scopes))
+            scopes = (0, types_1.scopesForRegistryRole)(user.role);
+        const expiresAt = new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000);
+        const token = yield (0, access_tokens_1.createRegistryAccessToken)(tx, {
+            userId: user.id,
+            name: tokenName,
+            scopes,
+            expiresAt,
+            now,
+        });
+        if (!token.ok) {
+            return { ok: false, error: 'access_denied', errorDescription: 'The account cannot issue this token.' };
+        }
+        return {
+            ok: true,
+            accessToken: token.token,
+            tokenType: 'Bearer',
+            expiresIn: Math.floor((expiresAt.getTime() - now.getTime()) / 1000),
+            scopes: token.record.scopes,
+            user: (0, user_record_1.toRegistryUser)(user),
+            record: token.record,
+        };
+    }));
+});
+exports.exchangeRegistryDeviceAuthorization = exchangeRegistryDeviceAuthorization;
+const purgeExpiredRegistryDeviceAuthorizations = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, now = new Date()) {
+    const rows = yield db
+        .delete(schema_1.registryDeviceAuthorizations)
+        .where((0, drizzle_orm_1.lt)(schema_1.registryDeviceAuthorizations.expiresAt, now))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return rows.length;
+});
+exports.purgeExpiredRegistryDeviceAuthorizations = purgeExpiredRegistryDeviceAuthorizations;

package/dist/registry/auth/gravatar.d.ts

@@ -0,0 +1 @@
+export declare const buildGravatarUrl: (email: string) => string;

package/dist/registry/auth/gravatar.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGravatarUrl = void 0;
+const crypto_1 = require("./crypto");
+// Gravatar resolves an avatar from the SHA-256 hash of the trimmed, lowercased email.
+// `d=identicon` guarantees a generated image renders even when the user has no Gravatar.
+const buildGravatarUrl = (email) => `https://www.gravatar.com/avatar/${(0, crypto_1.hashSecret)((0, crypto_1.normalizeEmail)(email))}?d=identicon`;
+exports.buildGravatarUrl = buildGravatarUrl;

package/dist/registry/auth/index.d.ts

@@ -0,0 +1,11 @@
+export { createRegistryAccessToken, listRegistryAccessTokens, revokeRegistryAccessToken, revokeAllRegistryAccessTokens, authenticateRegistryAccessToken, formatRegistryAccessToken, parseRegistryAccessToken, normalizeRegistryScopes, registryRoleAllowsScopes, type RegistryAccessTokenSummary, type CreateRegistryAccessTokenResult, } from './access-tokens';
+export { createUserInvitation, resendUserInvitation, acceptUserInvitation, createPasswordReset, resetPassword, INVITATION_LIFETIME_MS, PASSWORD_RESET_LIFETIME_MS, type CreateUserInvitationResult, type ResendUserInvitationResult, type ConsumeAuthActionResult, } from './action-tokens';
+export { createOpaqueSecret, hashSecret, normalizeEmail, secretHashMatches } from './crypto';
+export { buildGravatarUrl } from './gravatar';
+export { createRegistryDeviceAuthorization, approveRegistryDeviceAuthorization, denyRegistryDeviceAuthorization, exchangeRegistryDeviceAuthorization, purgeExpiredRegistryDeviceAuthorizations, generateRegistryUserCode, normalizeRegistryUserCode, DEVICE_AUTHORIZATION_LIFETIME_SECONDS, DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS, type CreateRegistryDeviceAuthorizationResult, type RegistryDeviceApprovalResult, type ExchangeRegistryDeviceAuthorizationResult, } from './device-authorizations';
+export { getRegistryInstallation, getRegistryInstallationState, installRegistry, REGISTRY_AUTH_SCHEMA_VERSION, REGISTRY_INSTALLATION_ID, type RegistryInstallation, type RegistryInstallationState, type RegistryInstallInput, type RegistryInstallResult, } from './installation';
+export { hashPassword, verifyPassword, validatePassword, MINIMUM_PASSWORD_LENGTH, MAXIMUM_PASSWORD_LENGTH, type PasswordValidationResult, } from './password';
+export { consumeAuthRateLimit, clearAuthRateLimit, purgeExpiredAuthRateLimits, hashRateLimitIdentifier, type ConsumeAuthRateLimitInput, type AuthRateLimitResult, } from './rate-limits';
+export { getRegistryUserById, listRegistryUsers, authenticateRegistryCredentials, updateRegistryUserProfile, updateRegistryUserRole, setRegistryUserStatus, type RegistryUserMutationResult, } from './users';
+export { REGISTRY_READ_SCOPE, REGISTRY_WRITE_SCOPE, scopesForRegistryRole, registryPrincipalHasScope, type RegistryAccessScope, type RegistryPrincipal, type RegistryUser, type RegistryUserRole, type RegistryUserStatus, } from './types';
+export { validateRegistryDisplayName, validateRegistryEmail, validateRegistryImageUrl } from './validation';

package/dist/registry/auth/index.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRegistryUserStatus = exports.updateRegistryUserRole = exports.updateRegistryUserProfile = exports.authenticateRegistryCredentials = exports.listRegistryUsers = exports.getRegistryUserById = exports.hashRateLimitIdentifier = exports.purgeExpiredAuthRateLimits = exports.clearAuthRateLimit = exports.consumeAuthRateLimit = exports.MAXIMUM_PASSWORD_LENGTH = exports.MINIMUM_PASSWORD_LENGTH = exports.validatePassword = exports.verifyPassword = exports.hashPassword = exports.REGISTRY_INSTALLATION_ID = exports.REGISTRY_AUTH_SCHEMA_VERSION = exports.installRegistry = exports.getRegistryInstallationState = exports.getRegistryInstallation = exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = exports.normalizeRegistryUserCode = exports.generateRegistryUserCode = exports.purgeExpiredRegistryDeviceAuthorizations = exports.exchangeRegistryDeviceAuthorization = exports.denyRegistryDeviceAuthorization = exports.approveRegistryDeviceAuthorization = exports.createRegistryDeviceAuthorization = exports.buildGravatarUrl = exports.secretHashMatches = exports.normalizeEmail = exports.hashSecret = exports.createOpaqueSecret = exports.PASSWORD_RESET_LIFETIME_MS = exports.INVITATION_LIFETIME_MS = exports.resetPassword = exports.createPasswordReset = exports.acceptUserInvitation = exports.resendUserInvitation = exports.createUserInvitation = exports.registryRoleAllowsScopes = exports.normalizeRegistryScopes = exports.parseRegistryAccessToken = exports.formatRegistryAccessToken = exports.authenticateRegistryAccessToken = exports.revokeAllRegistryAccessTokens = exports.revokeRegistryAccessToken = exports.listRegistryAccessTokens = exports.createRegistryAccessToken = void 0;
+exports.validateRegistryImageUrl = exports.validateRegistryEmail = exports.validateRegistryDisplayName = exports.registryPrincipalHasScope = exports.scopesForRegistryRole = exports.REGISTRY_WRITE_SCOPE = exports.REGISTRY_READ_SCOPE = void 0;
+var access_tokens_1 = require("./access-tokens");
+Object.defineProperty(exports, "createRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.createRegistryAccessToken; } });
+Object.defineProperty(exports, "listRegistryAccessTokens", { enumerable: true, get: function () { return access_tokens_1.listRegistryAccessTokens; } });
+Object.defineProperty(exports, "revokeRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.revokeRegistryAccessToken; } });
+Object.defineProperty(exports, "revokeAllRegistryAccessTokens", { enumerable: true, get: function () { return access_tokens_1.revokeAllRegistryAccessTokens; } });
+Object.defineProperty(exports, "authenticateRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.authenticateRegistryAccessToken; } });
+Object.defineProperty(exports, "formatRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.formatRegistryAccessToken; } });
+Object.defineProperty(exports, "parseRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.parseRegistryAccessToken; } });
+Object.defineProperty(exports, "normalizeRegistryScopes", { enumerable: true, get: function () { return access_tokens_1.normalizeRegistryScopes; } });
+Object.defineProperty(exports, "registryRoleAllowsScopes", { enumerable: true, get: function () { return access_tokens_1.registryRoleAllowsScopes; } });
+var action_tokens_1 = require("./action-tokens");
+Object.defineProperty(exports, "createUserInvitation", { enumerable: true, get: function () { return action_tokens_1.createUserInvitation; } });
+Object.defineProperty(exports, "resendUserInvitation", { enumerable: true, get: function () { return action_tokens_1.resendUserInvitation; } });
+Object.defineProperty(exports, "acceptUserInvitation", { enumerable: true, get: function () { return action_tokens_1.acceptUserInvitation; } });
+Object.defineProperty(exports, "createPasswordReset", { enumerable: true, get: function () { return action_tokens_1.createPasswordReset; } });
+Object.defineProperty(exports, "resetPassword", { enumerable: true, get: function () { return action_tokens_1.resetPassword; } });
+Object.defineProperty(exports, "INVITATION_LIFETIME_MS", { enumerable: true, get: function () { return action_tokens_1.INVITATION_LIFETIME_MS; } });
+Object.defineProperty(exports, "PASSWORD_RESET_LIFETIME_MS", { enumerable: true, get: function () { return action_tokens_1.PASSWORD_RESET_LIFETIME_MS; } });
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "createOpaqueSecret", { enumerable: true, get: function () { return crypto_1.createOpaqueSecret; } });
+Object.defineProperty(exports, "hashSecret", { enumerable: true, get: function () { return crypto_1.hashSecret; } });
+Object.defineProperty(exports, "normalizeEmail", { enumerable: true, get: function () { return crypto_1.normalizeEmail; } });
+Object.defineProperty(exports, "secretHashMatches", { enumerable: true, get: function () { return crypto_1.secretHashMatches; } });
+var gravatar_1 = require("./gravatar");
+Object.defineProperty(exports, "buildGravatarUrl", { enumerable: true, get: function () { return gravatar_1.buildGravatarUrl; } });
+var device_authorizations_1 = require("./device-authorizations");
+Object.defineProperty(exports, "createRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.createRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "approveRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.approveRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "denyRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.denyRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "exchangeRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.exchangeRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "purgeExpiredRegistryDeviceAuthorizations", { enumerable: true, get: function () { return device_authorizations_1.purgeExpiredRegistryDeviceAuthorizations; } });
+Object.defineProperty(exports, "generateRegistryUserCode", { enumerable: true, get: function () { return device_authorizations_1.generateRegistryUserCode; } });
+Object.defineProperty(exports, "normalizeRegistryUserCode", { enumerable: true, get: function () { return device_authorizations_1.normalizeRegistryUserCode; } });
+Object.defineProperty(exports, "DEVICE_AUTHORIZATION_LIFETIME_SECONDS", { enumerable: true, get: function () { return device_authorizations_1.DEVICE_AUTHORIZATION_LIFETIME_SECONDS; } });
+Object.defineProperty(exports, "DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS", { enumerable: true, get: function () { return device_authorizations_1.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS; } });
+var installation_1 = require("./installation");
+Object.defineProperty(exports, "getRegistryInstallation", { enumerable: true, get: function () { return installation_1.getRegistryInstallation; } });
+Object.defineProperty(exports, "getRegistryInstallationState", { enumerable: true, get: function () { return installation_1.getRegistryInstallationState; } });
+Object.defineProperty(exports, "installRegistry", { enumerable: true, get: function () { return installation_1.installRegistry; } });
+Object.defineProperty(exports, "REGISTRY_AUTH_SCHEMA_VERSION", { enumerable: true, get: function () { return installation_1.REGISTRY_AUTH_SCHEMA_VERSION; } });
+Object.defineProperty(exports, "REGISTRY_INSTALLATION_ID", { enumerable: true, get: function () { return installation_1.REGISTRY_INSTALLATION_ID; } });
+var password_1 = require("./password");
+Object.defineProperty(exports, "hashPassword", { enumerable: true, get: function () { return password_1.hashPassword; } });
+Object.defineProperty(exports, "verifyPassword", { enumerable: true, get: function () { return password_1.verifyPassword; } });
+Object.defineProperty(exports, "validatePassword", { enumerable: true, get: function () { return password_1.validatePassword; } });
+Object.defineProperty(exports, "MINIMUM_PASSWORD_LENGTH", { enumerable: true, get: function () { return password_1.MINIMUM_PASSWORD_LENGTH; } });
+Object.defineProperty(exports, "MAXIMUM_PASSWORD_LENGTH", { enumerable: true, get: function () { return password_1.MAXIMUM_PASSWORD_LENGTH; } });
+var rate_limits_1 = require("./rate-limits");
+Object.defineProperty(exports, "consumeAuthRateLimit", { enumerable: true, get: function () { return rate_limits_1.consumeAuthRateLimit; } });
+Object.defineProperty(exports, "clearAuthRateLimit", { enumerable: true, get: function () { return rate_limits_1.clearAuthRateLimit; } });
+Object.defineProperty(exports, "purgeExpiredAuthRateLimits", { enumerable: true, get: function () { return rate_limits_1.purgeExpiredAuthRateLimits; } });
+Object.defineProperty(exports, "hashRateLimitIdentifier", { enumerable: true, get: function () { return rate_limits_1.hashRateLimitIdentifier; } });
+var users_1 = require("./users");
+Object.defineProperty(exports, "getRegistryUserById", { enumerable: true, get: function () { return users_1.getRegistryUserById; } });
+Object.defineProperty(exports, "listRegistryUsers", { enumerable: true, get: function () { return users_1.listRegistryUsers; } });
+Object.defineProperty(exports, "authenticateRegistryCredentials", { enumerable: true, get: function () { return users_1.authenticateRegistryCredentials; } });
+Object.defineProperty(exports, "updateRegistryUserProfile", { enumerable: true, get: function () { return users_1.updateRegistryUserProfile; } });
+Object.defineProperty(exports, "updateRegistryUserRole", { enumerable: true, get: function () { return users_1.updateRegistryUserRole; } });
+Object.defineProperty(exports, "setRegistryUserStatus", { enumerable: true, get: function () { return users_1.setRegistryUserStatus; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "REGISTRY_READ_SCOPE", { enumerable: true, get: function () { return types_1.REGISTRY_READ_SCOPE; } });
+Object.defineProperty(exports, "REGISTRY_WRITE_SCOPE", { enumerable: true, get: function () { return types_1.REGISTRY_WRITE_SCOPE; } });
+Object.defineProperty(exports, "scopesForRegistryRole", { enumerable: true, get: function () { return types_1.scopesForRegistryRole; } });
+Object.defineProperty(exports, "registryPrincipalHasScope", { enumerable: true, get: function () { return types_1.registryPrincipalHasScope; } });
+var validation_1 = require("./validation");
+Object.defineProperty(exports, "validateRegistryDisplayName", { enumerable: true, get: function () { return validation_1.validateRegistryDisplayName; } });
+Object.defineProperty(exports, "validateRegistryEmail", { enumerable: true, get: function () { return validation_1.validateRegistryEmail; } });
+Object.defineProperty(exports, "validateRegistryImageUrl", { enumerable: true, get: function () { return validation_1.validateRegistryImageUrl; } });

package/dist/registry/auth/installation.d.ts

@@ -0,0 +1,42 @@
+import type { RegistryDatabase } from '../db/client';
+import { registryInstallations } from '../db/schema';
+import type { RegistryUser } from './types';
+/** Migration number that introduced the registry authentication schema. */
+export declare const REGISTRY_AUTH_SCHEMA_VERSION = 5;
+export declare const REGISTRY_INSTALLATION_ID = "default";
+export type RegistryInstallation = typeof registryInstallations.$inferSelect;
+export type RegistryInstallationState = {
+    status: 'ready';
+    installation: null;
+    userCount: 0;
+} | {
+    status: 'installed';
+    installation: RegistryInstallation;
+    userCount: number;
+} | {
+    status: 'inconsistent';
+    installation: null;
+    userCount: number;
+};
+export interface RegistryInstallInput {
+    email: string;
+    name: string;
+    password: string;
+    now?: Date;
+}
+export type RegistryInstallResult = {
+    ok: true;
+    user: RegistryUser;
+    installation: RegistryInstallation;
+} | {
+    ok: false;
+    reason: 'invalid_email' | 'invalid_name' | 'invalid_password' | 'already_installed' | 'users_exist';
+    error?: string;
+};
+export declare const getRegistryInstallation: (db: RegistryDatabase) => Promise<RegistryInstallation | null>;
+export declare const getRegistryInstallationState: (db: RegistryDatabase) => Promise<RegistryInstallationState>;
+/**
+ * Complete first-visitor installation under a transaction-scoped advisory lock. Password hashing is
+ * intentionally performed before taking the lock; all state checks are repeated inside it.
+ */
+export declare const installRegistry: (db: RegistryDatabase, input: RegistryInstallInput) => Promise<RegistryInstallResult>;

package/dist/registry/auth/installation.js

@@ -0,0 +1,105 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installRegistry = exports.getRegistryInstallationState = exports.getRegistryInstallation = exports.REGISTRY_INSTALLATION_ID = exports.REGISTRY_AUTH_SCHEMA_VERSION = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const database_1 = require("./database");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+/** Migration number that introduced the registry authentication schema. */
+exports.REGISTRY_AUTH_SCHEMA_VERSION = 5;
+exports.REGISTRY_INSTALLATION_ID = 'default';
+const getRegistryInstallation = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const [installation] = yield db
+        .select()
+        .from(schema_1.registryInstallations)
+        .where((0, drizzle_orm_1.eq)(schema_1.registryInstallations.id, exports.REGISTRY_INSTALLATION_ID))
+        .limit(1);
+    return installation !== null && installation !== void 0 ? installation : null;
+});
+exports.getRegistryInstallation = getRegistryInstallation;
+const getRegistryInstallationState = (db) => __awaiter(void 0, void 0, void 0, function* () {
+    const installation = yield (0, exports.getRegistryInstallation)(db);
+    const [{ value }] = yield db.select({ value: (0, drizzle_orm_1.count)() }).from(schema_1.registryUsers);
+    const userCount = Number(value);
+    if (installation)
+        return { status: 'installed', installation, userCount };
+    return userCount === 0
+        ? { status: 'ready', installation: null, userCount: 0 }
+        : { status: 'inconsistent', installation: null, userCount };
+});
+exports.getRegistryInstallationState = getRegistryInstallationState;
+/**
+ * Complete first-visitor installation under a transaction-scoped advisory lock. Password hashing is
+ * intentionally performed before taking the lock; all state checks are repeated inside it.
+ */
+const installRegistry = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const email = (0, validation_1.validateRegistryEmail)(input.email);
+    if (!email)
+        return { ok: false, reason: 'invalid_email' };
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    const passwordValidation = (0, password_1.validatePassword)(input.password);
+    if ('error' in passwordValidation) {
+        return { ok: false, reason: 'invalid_password', error: passwordValidation.error };
+    }
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        yield (0, database_1.acquireRegistryAdvisoryLock)(tx, database_1.REGISTRY_INSTALL_LOCK_ID);
+        const [installation] = yield tx
+            .select()
+            .from(schema_1.registryInstallations)
+            .where((0, drizzle_orm_1.eq)(schema_1.registryInstallations.id, exports.REGISTRY_INSTALLATION_ID))
+            .limit(1);
+        if (installation)
+            return { ok: false, reason: 'already_installed' };
+        const [{ value }] = yield tx.select({ value: (0, drizzle_orm_1.count)() }).from(schema_1.registryUsers);
+        if (Number(value) > 0)
+            return { ok: false, reason: 'users_exist' };
+        const userId = (0, node_crypto_1.randomUUID)();
+        const [userRow] = yield tx
+            .insert(schema_1.registryUsers)
+            .values({
+            id: userId,
+            email,
+            name,
+            role: 'admin',
+            status: 'active',
+            passwordHash,
+            emailVerifiedAt: now,
+            createdAt: now,
+            updatedAt: now,
+        })
+            .returning();
+        const [createdInstallation] = yield tx
+            .insert(schema_1.registryInstallations)
+            .values({
+            id: exports.REGISTRY_INSTALLATION_ID,
+            status: 'installed',
+            schemaVersion: exports.REGISTRY_AUTH_SCHEMA_VERSION,
+            initialAdminUserId: userId,
+            installedAt: now,
+        })
+            .returning();
+        return {
+            ok: true,
+            user: (0, user_record_1.toRegistryUser)(userRow),
+            installation: createdInstallation,
+        };
+    }));
+});
+exports.installRegistry = installRegistry;

package/dist/registry/auth/password.d.ts

@@ -0,0 +1,12 @@
+export declare const MINIMUM_PASSWORD_LENGTH = 12;
+export declare const MAXIMUM_PASSWORD_LENGTH = 1024;
+export type PasswordValidationResult = {
+    valid: true;
+} | {
+    valid: false;
+    error: string;
+};
+export declare const validatePassword: (password: string) => PasswordValidationResult;
+/** Versioned scrypt encoding: `scrypt-v1:<base64url salt>:<base64url derived key>`. */
+export declare const hashPassword: (password: string) => Promise<string>;
+export declare const verifyPassword: (password: string, encoded: string | null | undefined) => Promise<boolean>;

package/dist/registry/auth/password.js

@@ -0,0 +1,58 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyPassword = exports.hashPassword = exports.validatePassword = exports.MAXIMUM_PASSWORD_LENGTH = exports.MINIMUM_PASSWORD_LENGTH = void 0;
+const node_crypto_1 = require("node:crypto");
+const node_util_1 = require("node:util");
+const scryptAsync = (0, node_util_1.promisify)(node_crypto_1.scrypt);
+const PASSWORD_HASH_VERSION = 'scrypt-v1';
+const PASSWORD_KEY_LENGTH = 64;
+exports.MINIMUM_PASSWORD_LENGTH = 12;
+exports.MAXIMUM_PASSWORD_LENGTH = 1024;
+const validatePassword = (password) => {
+    if (password.length < exports.MINIMUM_PASSWORD_LENGTH) {
+        return { valid: false, error: `Password must be at least ${exports.MINIMUM_PASSWORD_LENGTH} characters.` };
+    }
+    if (password.length > exports.MAXIMUM_PASSWORD_LENGTH) {
+        return { valid: false, error: `Password must be at most ${exports.MAXIMUM_PASSWORD_LENGTH} characters.` };
+    }
+    return { valid: true };
+};
+exports.validatePassword = validatePassword;
+/** Versioned scrypt encoding: `scrypt-v1:<base64url salt>:<base64url derived key>`. */
+const hashPassword = (password) => __awaiter(void 0, void 0, void 0, function* () {
+    const validation = (0, exports.validatePassword)(password);
+    if ('error' in validation)
+        throw new Error(validation.error);
+    const salt = (0, node_crypto_1.randomBytes)(16);
+    const derived = (yield scryptAsync(password, salt, PASSWORD_KEY_LENGTH));
+    return `${PASSWORD_HASH_VERSION}:${salt.toString('base64url')}:${derived.toString('base64url')}`;
+});
+exports.hashPassword = hashPassword;
+const verifyPassword = (password, encoded) => __awaiter(void 0, void 0, void 0, function* () {
+    if (!encoded || password.length > exports.MAXIMUM_PASSWORD_LENGTH)
+        return false;
+    const [version, saltText, hashText, ...rest] = encoded.split(':');
+    if (version !== PASSWORD_HASH_VERSION || !saltText || !hashText || rest.length)
+        return false;
+    try {
+        const salt = Buffer.from(saltText, 'base64url');
+        const expected = Buffer.from(hashText, 'base64url');
+        if (salt.length !== 16 || expected.length !== PASSWORD_KEY_LENGTH)
+            return false;
+        const actual = (yield scryptAsync(password, salt, PASSWORD_KEY_LENGTH));
+        return actual.length === expected.length && (0, node_crypto_1.timingSafeEqual)(actual, expected);
+    }
+    catch (_a) {
+        return false;
+    }
+});
+exports.verifyPassword = verifyPassword;

package/dist/registry/auth/rate-limits.d.ts

@@ -0,0 +1,22 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryRateLimitBucket } from '../db/schema';
+export interface ConsumeAuthRateLimitInput {
+    bucket: RegistryRateLimitBucket;
+    identifier: string;
+    limit: number;
+    windowMs: number;
+    now?: Date;
+}
+export interface AuthRateLimitResult {
+    allowed: boolean;
+    attempts: number;
+    limit: number;
+    remaining: number;
+    resetsAt: Date;
+    retryAfterSeconds: number;
+}
+export declare const hashRateLimitIdentifier: (bucket: RegistryRateLimitBucket, identifier: string) => string;
+/** Atomic fixed-window counter shared by all registry instances. */
+export declare const consumeAuthRateLimit: (db: RegistryDatabase, input: ConsumeAuthRateLimitInput) => Promise<AuthRateLimitResult>;
+export declare const clearAuthRateLimit: (db: RegistryDatabase, bucket: RegistryRateLimitBucket, identifier: string) => Promise<number>;
+export declare const purgeExpiredAuthRateLimits: (db: RegistryDatabase, now?: Date) => Promise<number>;