handoff-app 2.0.0-2 → 2.0.0-3

package/dist/registry/auth/action-tokens.js

@@ -0,0 +1,178 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resetPassword = exports.createPasswordReset = exports.acceptUserInvitation = exports.resendUserInvitation = exports.createUserInvitation = exports.PASSWORD_RESET_LIFETIME_MS = exports.INVITATION_LIFETIME_MS = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const password_1 = require("./password");
+const user_record_1 = require("./user-record");
+const validation_1 = require("./validation");
+exports.INVITATION_LIFETIME_MS = 7 * 24 * 60 * 60 * 1000;
+exports.PASSWORD_RESET_LIFETIME_MS = 60 * 60 * 1000;
+const invalidateUnusedActionTokens = (db, userId, purpose, now) => __awaiter(void 0, void 0, void 0, function* () {
+    yield db
+        .update(schema_1.registryAuthActionTokens)
+        .set({ usedAt: now })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.userId, userId), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, purpose), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt)));
+});
+const insertActionToken = (db, userId, purpose, expiresAt, now) => __awaiter(void 0, void 0, void 0, function* () {
+    const token = (0, crypto_1.createOpaqueSecret)(32);
+    yield db.insert(schema_1.registryAuthActionTokens).values({
+        id: (0, node_crypto_1.randomUUID)(),
+        userId,
+        purpose,
+        tokenHash: (0, crypto_1.hashSecret)(token),
+        expiresAt,
+        createdAt: now,
+    });
+    return token;
+});
+const createUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const email = (0, validation_1.validateRegistryEmail)(input.email);
+    if (!email)
+        return { ok: false, reason: 'invalid_email' };
+    const name = (0, validation_1.validateRegistryDisplayName)(input.name);
+    if (!name)
+        return { ok: false, reason: 'invalid_name' };
+    if (input.role !== 'admin' && input.role !== 'member')
+        return { ok: false, reason: 'invalid_role' };
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.INVITATION_LIFETIME_MS);
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const userId = (0, node_crypto_1.randomUUID)();
+        const rows = yield tx
+            .insert(schema_1.registryUsers)
+            .values({
+            id: userId,
+            email,
+            name,
+            role: input.role,
+            status: 'invited',
+            createdAt: now,
+            updatedAt: now,
+        })
+            .onConflictDoNothing()
+            .returning();
+        const user = rows[0];
+        if (!user)
+            return { ok: false, reason: 'email_exists' };
+        const token = yield insertActionToken(tx, userId, 'invite', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.createUserInvitation = createUserInvitation;
+const resendUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        var _a, _b;
+        const [user] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1).for('update');
+        if (!user)
+            return { ok: false, reason: 'not_found' };
+        if (user.status === 'active')
+            return { ok: false, reason: 'already_accepted' };
+        if (user.status === 'deactivated')
+            return { ok: false, reason: 'deactivated' };
+        const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+        const expiresAt = (_b = input.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.INVITATION_LIFETIME_MS);
+        yield invalidateUnusedActionTokens(tx, user.id, 'invite', now);
+        const token = yield insertActionToken(tx, user.id, 'invite', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.resendUserInvitation = resendUserInvitation;
+const acceptUserInvitation = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const validation = (0, password_1.validatePassword)(input.password);
+    if ('error' in validation)
+        return { ok: false, reason: 'invalid_password', error: validation.error };
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [consumed] = yield tx
+            .update(schema_1.registryAuthActionTokens)
+            .set({ usedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.tokenHash, (0, crypto_1.hashSecret)(input.token)), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, 'invite'), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt), (0, drizzle_orm_1.gt)(schema_1.registryAuthActionTokens.expiresAt, now)))
+            .returning({ userId: schema_1.registryAuthActionTokens.userId });
+        if (!consumed)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        const [user] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            passwordHash,
+            status: 'active',
+            emailVerifiedAt: now,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, consumed.userId), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'invited')))
+            .returning();
+        return user ? { ok: true, user: (0, user_record_1.toRegistryUser)(user) } : { ok: false, reason: 'invalid_or_expired_token' };
+    }));
+});
+exports.acceptUserInvitation = acceptUserInvitation;
+/**
+ * Enumeration-safe reset request. The token is returned only to the trusted mail-delivery caller;
+ * unknown/inactive emails return the same successful shape with a null token.
+ */
+const createPasswordReset = (db_1, email_1, ...args_1) => __awaiter(void 0, [db_1, email_1, ...args_1], void 0, function* (db, email, options = {}) {
+    var _a, _b;
+    const normalizedEmail = (0, crypto_1.normalizeEmail)(email);
+    const now = (_a = options.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresAt = (_b = options.expiresAt) !== null && _b !== void 0 ? _b : new Date(now.getTime() + exports.PASSWORD_RESET_LIFETIME_MS);
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [user] = yield tx
+            .select()
+            .from(schema_1.registryUsers)
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.email, normalizedEmail), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')))
+            .limit(1)
+            .for('update');
+        if (!user)
+            return { ok: true, user: null, token: null, expiresAt: null };
+        yield invalidateUnusedActionTokens(tx, user.id, 'password_reset', now);
+        const token = yield insertActionToken(tx, user.id, 'password_reset', expiresAt, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user), token, expiresAt };
+    }));
+});
+exports.createPasswordReset = createPasswordReset;
+const resetPassword = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const validation = (0, password_1.validatePassword)(input.password);
+    if ('error' in validation)
+        return { ok: false, reason: 'invalid_password', error: validation.error };
+    const passwordHash = yield (0, password_1.hashPassword)(input.password);
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [consumed] = yield tx
+            .update(schema_1.registryAuthActionTokens)
+            .set({ usedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.tokenHash, (0, crypto_1.hashSecret)(input.token)), (0, drizzle_orm_1.eq)(schema_1.registryAuthActionTokens.purpose, 'password_reset'), (0, drizzle_orm_1.isNull)(schema_1.registryAuthActionTokens.usedAt), (0, drizzle_orm_1.gt)(schema_1.registryAuthActionTokens.expiresAt, now)))
+            .returning({ userId: schema_1.registryAuthActionTokens.userId });
+        if (!consumed)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        const [user] = yield tx
+            .update(schema_1.registryUsers)
+            .set({
+            passwordHash,
+            authVersion: (0, drizzle_orm_1.sql) `${schema_1.registryUsers.authVersion} + 1`,
+            updatedAt: now,
+        })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, consumed.userId), (0, drizzle_orm_1.eq)(schema_1.registryUsers.status, 'active')))
+            .returning();
+        if (!user)
+            return { ok: false, reason: 'invalid_or_expired_token' };
+        yield (0, access_tokens_1.revokeAllRegistryAccessTokens)(tx, user.id, now);
+        return { ok: true, user: (0, user_record_1.toRegistryUser)(user) };
+    }));
+});
+exports.resetPassword = resetPassword;

package/dist/registry/auth/crypto.d.ts

@@ -0,0 +1,4 @@
+export declare const hashSecret: (secret: string) => string;
+export declare const createOpaqueSecret: (byteLength?: number) => string;
+export declare const secretHashMatches: (secret: string, expectedHash: string) => boolean;
+export declare const normalizeEmail: (email: string) => string;

package/dist/registry/auth/crypto.js

@@ -0,0 +1,16 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeEmail = exports.secretHashMatches = exports.createOpaqueSecret = exports.hashSecret = void 0;
+const node_crypto_1 = require("node:crypto");
+const hashSecret = (secret) => (0, node_crypto_1.createHash)('sha256').update(secret, 'utf8').digest('hex');
+exports.hashSecret = hashSecret;
+const createOpaqueSecret = (byteLength = 32) => (0, node_crypto_1.randomBytes)(byteLength).toString('base64url');
+exports.createOpaqueSecret = createOpaqueSecret;
+const secretHashMatches = (secret, expectedHash) => {
+    const actual = Buffer.from((0, exports.hashSecret)(secret), 'hex');
+    const expected = Buffer.from(expectedHash, 'hex');
+    return actual.length === expected.length && (0, node_crypto_1.timingSafeEqual)(actual, expected);
+};
+exports.secretHashMatches = secretHashMatches;
+const normalizeEmail = (email) => email.trim().toLowerCase();
+exports.normalizeEmail = normalizeEmail;

package/dist/registry/auth/database.d.ts

@@ -0,0 +1,7 @@
+import type { RegistryDatabase } from '../db/client';
+export type RegistryTransaction = RegistryDatabase;
+export declare const withRegistryTransaction: <T>(db: RegistryDatabase, callback: (tx: RegistryTransaction) => Promise<T>) => Promise<T>;
+export declare const acquireRegistryAdvisoryLock: (tx: RegistryTransaction, lockId: number) => Promise<void>;
+/** Stable, package-owned Postgres advisory-lock ids. */
+export declare const REGISTRY_INSTALL_LOCK_ID = 1841111001;
+export declare const REGISTRY_ADMIN_LOCK_ID = 1841111002;

package/dist/registry/auth/database.js

@@ -0,0 +1,22 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REGISTRY_ADMIN_LOCK_ID = exports.REGISTRY_INSTALL_LOCK_ID = exports.acquireRegistryAdvisoryLock = exports.withRegistryTransaction = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const withRegistryTransaction = (db, callback) => __awaiter(void 0, void 0, void 0, function* () { return db.transaction((tx) => callback(tx)); });
+exports.withRegistryTransaction = withRegistryTransaction;
+const acquireRegistryAdvisoryLock = (tx, lockId) => __awaiter(void 0, void 0, void 0, function* () {
+    yield tx.execute((0, drizzle_orm_1.sql) `select pg_advisory_xact_lock(${lockId})`);
+});
+exports.acquireRegistryAdvisoryLock = acquireRegistryAdvisoryLock;
+/** Stable, package-owned Postgres advisory-lock ids. */
+exports.REGISTRY_INSTALL_LOCK_ID = 1841111001;
+exports.REGISTRY_ADMIN_LOCK_ID = 1841111002;

package/dist/registry/auth/device-authorizations.d.ts

@@ -0,0 +1,51 @@
+import type { RegistryDatabase } from '../db/client';
+import { type RegistryAccessTokenSummary } from './access-tokens';
+import { type RegistryAccessScope, type RegistryUser } from './types';
+export declare const DEVICE_AUTHORIZATION_LIFETIME_SECONDS: number;
+export declare const DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = 5;
+export declare const generateRegistryUserCode: () => string;
+export declare const normalizeRegistryUserCode: (value: string) => string;
+export interface CreateRegistryDeviceAuthorizationResult {
+    deviceCode: string;
+    userCode: string;
+    expiresIn: number;
+    interval: number;
+    expiresAt: Date;
+}
+export declare const createRegistryDeviceAuthorization: (db: RegistryDatabase, options?: {
+    now?: Date;
+    expiresInSeconds?: number;
+}) => Promise<CreateRegistryDeviceAuthorizationResult>;
+export type RegistryDeviceApprovalResult = {
+    ok: true;
+    user: RegistryUser;
+    scopes: RegistryAccessScope[];
+} | {
+    ok: false;
+    reason: 'invalid_or_expired_code' | 'user_inactive';
+};
+export declare const approveRegistryDeviceAuthorization: (db: RegistryDatabase, input: {
+    userCode: string;
+    userId: string;
+    now?: Date;
+}) => Promise<RegistryDeviceApprovalResult>;
+export declare const denyRegistryDeviceAuthorization: (db: RegistryDatabase, userCode: string, now?: Date) => Promise<boolean>;
+export type ExchangeRegistryDeviceAuthorizationResult = {
+    ok: true;
+    accessToken: string;
+    tokenType: 'Bearer';
+    expiresIn: number;
+    scopes: RegistryAccessScope[];
+    user: RegistryUser;
+    record: RegistryAccessTokenSummary;
+} | {
+    ok: false;
+    error: 'invalid_grant' | 'expired_token' | 'authorization_pending' | 'access_denied';
+    errorDescription: string;
+};
+export declare const exchangeRegistryDeviceAuthorization: (db: RegistryDatabase, input: {
+    deviceCode: string;
+    tokenName?: string;
+    now?: Date;
+}) => Promise<ExchangeRegistryDeviceAuthorizationResult>;
+export declare const purgeExpiredRegistryDeviceAuthorizations: (db: RegistryDatabase, now?: Date) => Promise<number>;

package/dist/registry/auth/device-authorizations.js

@@ -0,0 +1,170 @@
+"use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.purgeExpiredRegistryDeviceAuthorizations = exports.exchangeRegistryDeviceAuthorization = exports.denyRegistryDeviceAuthorization = exports.approveRegistryDeviceAuthorization = exports.createRegistryDeviceAuthorization = exports.normalizeRegistryUserCode = exports.generateRegistryUserCode = exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = void 0;
+const drizzle_orm_1 = require("drizzle-orm");
+const node_crypto_1 = require("node:crypto");
+const schema_1 = require("../db/schema");
+const access_tokens_1 = require("./access-tokens");
+const crypto_1 = require("./crypto");
+const database_1 = require("./database");
+const types_1 = require("./types");
+const user_record_1 = require("./user-record");
+const USER_CODE_ALPHABET = 'BCDFGHJKLMNPQRSTVWXYZ23456789';
+exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = 15 * 60;
+exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = 5;
+const randomUserCodeSegment = (length) => {
+    const bytes = (0, node_crypto_1.randomBytes)(length);
+    let result = '';
+    for (let index = 0; index < length; index += 1) {
+        result += USER_CODE_ALPHABET[bytes[index] % USER_CODE_ALPHABET.length];
+    }
+    return result;
+};
+const generateRegistryUserCode = () => `${randomUserCodeSegment(4)}-${randomUserCodeSegment(4)}`;
+exports.generateRegistryUserCode = generateRegistryUserCode;
+const normalizeRegistryUserCode = (value) => {
+    const compact = value.toUpperCase().replace(/[^A-Z0-9]/g, '');
+    return compact.length === 8 ? `${compact.slice(0, 4)}-${compact.slice(4)}` : value.trim().toUpperCase();
+};
+exports.normalizeRegistryUserCode = normalizeRegistryUserCode;
+const createRegistryDeviceAuthorization = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, options = {}) {
+    var _a, _b;
+    const now = (_a = options.now) !== null && _a !== void 0 ? _a : new Date();
+    const expiresIn = (_b = options.expiresInSeconds) !== null && _b !== void 0 ? _b : exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS;
+    const deviceCode = (0, node_crypto_1.randomBytes)(32).toString('base64url');
+    const userCode = (0, exports.generateRegistryUserCode)();
+    const expiresAt = new Date(now.getTime() + expiresIn * 1000);
+    yield db.insert(schema_1.registryDeviceAuthorizations).values({
+        id: (0, node_crypto_1.randomUUID)(),
+        deviceCodeHash: (0, crypto_1.hashSecret)(deviceCode),
+        userCode,
+        status: 'pending',
+        scopes: [],
+        expiresAt,
+        createdAt: now,
+    });
+    return {
+        deviceCode,
+        userCode,
+        expiresIn,
+        interval: exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS,
+        expiresAt,
+    };
+});
+exports.createRegistryDeviceAuthorization = createRegistryDeviceAuthorization;
+const approveRegistryDeviceAuthorization = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a;
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const [user] = yield db.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, input.userId)).limit(1);
+    if (!user || user.status !== 'active')
+        return { ok: false, reason: 'user_inactive' };
+    const scopes = (0, types_1.scopesForRegistryRole)(user.role);
+    const [authorization] = yield db
+        .update(schema_1.registryDeviceAuthorizations)
+        .set({
+        status: 'approved',
+        userId: user.id,
+        scopes,
+        approvedAt: now,
+    })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.userCode, (0, exports.normalizeRegistryUserCode)(input.userCode)), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'pending'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return authorization ? { ok: true, user: (0, user_record_1.toRegistryUser)(user), scopes } : { ok: false, reason: 'invalid_or_expired_code' };
+});
+exports.approveRegistryDeviceAuthorization = approveRegistryDeviceAuthorization;
+const denyRegistryDeviceAuthorization = (db_1, userCode_1, ...args_1) => __awaiter(void 0, [db_1, userCode_1, ...args_1], void 0, function* (db, userCode, now = new Date()) {
+    const rows = yield db
+        .update(schema_1.registryDeviceAuthorizations)
+        .set({ status: 'denied' })
+        .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.userCode, (0, exports.normalizeRegistryUserCode)(userCode)), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'pending'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return rows.length > 0;
+});
+exports.denyRegistryDeviceAuthorization = denyRegistryDeviceAuthorization;
+const exchangeRegistryDeviceAuthorization = (db, input) => __awaiter(void 0, void 0, void 0, function* () {
+    var _a, _b;
+    const now = (_a = input.now) !== null && _a !== void 0 ? _a : new Date();
+    const tokenName = ((_b = input.tokenName) === null || _b === void 0 ? void 0 : _b.trim()) || 'Handoff CLI';
+    return (0, database_1.withRegistryTransaction)(db, (tx) => __awaiter(void 0, void 0, void 0, function* () {
+        const [authorization] = yield tx
+            .select()
+            .from(schema_1.registryDeviceAuthorizations)
+            .where((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.deviceCodeHash, (0, crypto_1.hashSecret)(input.deviceCode)))
+            .limit(1);
+        if (!authorization) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Unknown device code.' };
+        }
+        if (authorization.expiresAt <= now) {
+            return { ok: false, error: 'expired_token', errorDescription: 'Device authorization expired.' };
+        }
+        if (authorization.status === 'pending') {
+            return {
+                ok: false,
+                error: 'authorization_pending',
+                errorDescription: 'The authorization request is still pending.',
+            };
+        }
+        if (authorization.status === 'denied') {
+            return { ok: false, error: 'access_denied', errorDescription: 'The authorization request was denied.' };
+        }
+        if (authorization.status === 'consumed') {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device code has already been used.' };
+        }
+        if (!authorization.userId) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device authorization has no user.' };
+        }
+        const [consumed] = yield tx
+            .update(schema_1.registryDeviceAuthorizations)
+            .set({ status: 'consumed', consumedAt: now })
+            .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.id, authorization.id), (0, drizzle_orm_1.eq)(schema_1.registryDeviceAuthorizations.status, 'approved'), (0, drizzle_orm_1.gt)(schema_1.registryDeviceAuthorizations.expiresAt, now)))
+            .returning({ id: schema_1.registryDeviceAuthorizations.id });
+        if (!consumed) {
+            return { ok: false, error: 'invalid_grant', errorDescription: 'Device code has already been used.' };
+        }
+        const [user] = yield tx.select().from(schema_1.registryUsers).where((0, drizzle_orm_1.eq)(schema_1.registryUsers.id, authorization.userId)).limit(1);
+        if (!user || user.status !== 'active') {
+            return { ok: false, error: 'access_denied', errorDescription: 'The approving account is inactive.' };
+        }
+        let scopes = (0, access_tokens_1.normalizeRegistryScopes)(authorization.scopes);
+        if (!(0, access_tokens_1.registryRoleAllowsScopes)(user.role, scopes))
+            scopes = (0, types_1.scopesForRegistryRole)(user.role);
+        const expiresAt = new Date(now.getTime() + 365 * 24 * 60 * 60 * 1000);
+        const token = yield (0, access_tokens_1.createRegistryAccessToken)(tx, {
+            userId: user.id,
+            name: tokenName,
+            scopes,
+            expiresAt,
+            now,
+        });
+        if (!token.ok) {
+            return { ok: false, error: 'access_denied', errorDescription: 'The account cannot issue this token.' };
+        }
+        return {
+            ok: true,
+            accessToken: token.token,
+            tokenType: 'Bearer',
+            expiresIn: Math.floor((expiresAt.getTime() - now.getTime()) / 1000),
+            scopes: token.record.scopes,
+            user: (0, user_record_1.toRegistryUser)(user),
+            record: token.record,
+        };
+    }));
+});
+exports.exchangeRegistryDeviceAuthorization = exchangeRegistryDeviceAuthorization;
+const purgeExpiredRegistryDeviceAuthorizations = (db_1, ...args_1) => __awaiter(void 0, [db_1, ...args_1], void 0, function* (db, now = new Date()) {
+    const rows = yield db
+        .delete(schema_1.registryDeviceAuthorizations)
+        .where((0, drizzle_orm_1.lt)(schema_1.registryDeviceAuthorizations.expiresAt, now))
+        .returning({ id: schema_1.registryDeviceAuthorizations.id });
+    return rows.length;
+});
+exports.purgeExpiredRegistryDeviceAuthorizations = purgeExpiredRegistryDeviceAuthorizations;

package/dist/registry/auth/gravatar.d.ts

@@ -0,0 +1 @@
+export declare const buildGravatarUrl: (email: string) => string;

package/dist/registry/auth/gravatar.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildGravatarUrl = void 0;
+const crypto_1 = require("./crypto");
+// Gravatar resolves an avatar from the SHA-256 hash of the trimmed, lowercased email.
+// `d=identicon` guarantees a generated image renders even when the user has no Gravatar.
+const buildGravatarUrl = (email) => `https://www.gravatar.com/avatar/${(0, crypto_1.hashSecret)((0, crypto_1.normalizeEmail)(email))}?d=identicon`;
+exports.buildGravatarUrl = buildGravatarUrl;

package/dist/registry/auth/index.d.ts

@@ -0,0 +1,11 @@
+export { createRegistryAccessToken, listRegistryAccessTokens, revokeRegistryAccessToken, revokeAllRegistryAccessTokens, authenticateRegistryAccessToken, formatRegistryAccessToken, parseRegistryAccessToken, normalizeRegistryScopes, registryRoleAllowsScopes, type RegistryAccessTokenSummary, type CreateRegistryAccessTokenResult, } from './access-tokens';
+export { createUserInvitation, resendUserInvitation, acceptUserInvitation, createPasswordReset, resetPassword, INVITATION_LIFETIME_MS, PASSWORD_RESET_LIFETIME_MS, type CreateUserInvitationResult, type ResendUserInvitationResult, type ConsumeAuthActionResult, } from './action-tokens';
+export { createOpaqueSecret, hashSecret, normalizeEmail, secretHashMatches } from './crypto';
+export { buildGravatarUrl } from './gravatar';
+export { createRegistryDeviceAuthorization, approveRegistryDeviceAuthorization, denyRegistryDeviceAuthorization, exchangeRegistryDeviceAuthorization, purgeExpiredRegistryDeviceAuthorizations, generateRegistryUserCode, normalizeRegistryUserCode, DEVICE_AUTHORIZATION_LIFETIME_SECONDS, DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS, type CreateRegistryDeviceAuthorizationResult, type RegistryDeviceApprovalResult, type ExchangeRegistryDeviceAuthorizationResult, } from './device-authorizations';
+export { getRegistryInstallation, getRegistryInstallationState, installRegistry, REGISTRY_AUTH_SCHEMA_VERSION, REGISTRY_INSTALLATION_ID, type RegistryInstallation, type RegistryInstallationState, type RegistryInstallInput, type RegistryInstallResult, } from './installation';
+export { hashPassword, verifyPassword, validatePassword, MINIMUM_PASSWORD_LENGTH, MAXIMUM_PASSWORD_LENGTH, type PasswordValidationResult, } from './password';
+export { consumeAuthRateLimit, clearAuthRateLimit, purgeExpiredAuthRateLimits, hashRateLimitIdentifier, type ConsumeAuthRateLimitInput, type AuthRateLimitResult, } from './rate-limits';
+export { getRegistryUserById, listRegistryUsers, authenticateRegistryCredentials, updateRegistryUserProfile, updateRegistryUserRole, setRegistryUserStatus, type RegistryUserMutationResult, } from './users';
+export { REGISTRY_READ_SCOPE, REGISTRY_WRITE_SCOPE, scopesForRegistryRole, registryPrincipalHasScope, type RegistryAccessScope, type RegistryPrincipal, type RegistryUser, type RegistryUserRole, type RegistryUserStatus, } from './types';
+export { validateRegistryDisplayName, validateRegistryEmail, validateRegistryImageUrl } from './validation';

package/dist/registry/auth/index.js

@@ -0,0 +1,72 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.setRegistryUserStatus = exports.updateRegistryUserRole = exports.updateRegistryUserProfile = exports.authenticateRegistryCredentials = exports.listRegistryUsers = exports.getRegistryUserById = exports.hashRateLimitIdentifier = exports.purgeExpiredAuthRateLimits = exports.clearAuthRateLimit = exports.consumeAuthRateLimit = exports.MAXIMUM_PASSWORD_LENGTH = exports.MINIMUM_PASSWORD_LENGTH = exports.validatePassword = exports.verifyPassword = exports.hashPassword = exports.REGISTRY_INSTALLATION_ID = exports.REGISTRY_AUTH_SCHEMA_VERSION = exports.installRegistry = exports.getRegistryInstallationState = exports.getRegistryInstallation = exports.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS = exports.DEVICE_AUTHORIZATION_LIFETIME_SECONDS = exports.normalizeRegistryUserCode = exports.generateRegistryUserCode = exports.purgeExpiredRegistryDeviceAuthorizations = exports.exchangeRegistryDeviceAuthorization = exports.denyRegistryDeviceAuthorization = exports.approveRegistryDeviceAuthorization = exports.createRegistryDeviceAuthorization = exports.buildGravatarUrl = exports.secretHashMatches = exports.normalizeEmail = exports.hashSecret = exports.createOpaqueSecret = exports.PASSWORD_RESET_LIFETIME_MS = exports.INVITATION_LIFETIME_MS = exports.resetPassword = exports.createPasswordReset = exports.acceptUserInvitation = exports.resendUserInvitation = exports.createUserInvitation = exports.registryRoleAllowsScopes = exports.normalizeRegistryScopes = exports.parseRegistryAccessToken = exports.formatRegistryAccessToken = exports.authenticateRegistryAccessToken = exports.revokeAllRegistryAccessTokens = exports.revokeRegistryAccessToken = exports.listRegistryAccessTokens = exports.createRegistryAccessToken = void 0;
+exports.validateRegistryImageUrl = exports.validateRegistryEmail = exports.validateRegistryDisplayName = exports.registryPrincipalHasScope = exports.scopesForRegistryRole = exports.REGISTRY_WRITE_SCOPE = exports.REGISTRY_READ_SCOPE = void 0;
+var access_tokens_1 = require("./access-tokens");
+Object.defineProperty(exports, "createRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.createRegistryAccessToken; } });
+Object.defineProperty(exports, "listRegistryAccessTokens", { enumerable: true, get: function () { return access_tokens_1.listRegistryAccessTokens; } });
+Object.defineProperty(exports, "revokeRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.revokeRegistryAccessToken; } });
+Object.defineProperty(exports, "revokeAllRegistryAccessTokens", { enumerable: true, get: function () { return access_tokens_1.revokeAllRegistryAccessTokens; } });
+Object.defineProperty(exports, "authenticateRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.authenticateRegistryAccessToken; } });
+Object.defineProperty(exports, "formatRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.formatRegistryAccessToken; } });
+Object.defineProperty(exports, "parseRegistryAccessToken", { enumerable: true, get: function () { return access_tokens_1.parseRegistryAccessToken; } });
+Object.defineProperty(exports, "normalizeRegistryScopes", { enumerable: true, get: function () { return access_tokens_1.normalizeRegistryScopes; } });
+Object.defineProperty(exports, "registryRoleAllowsScopes", { enumerable: true, get: function () { return access_tokens_1.registryRoleAllowsScopes; } });
+var action_tokens_1 = require("./action-tokens");
+Object.defineProperty(exports, "createUserInvitation", { enumerable: true, get: function () { return action_tokens_1.createUserInvitation; } });
+Object.defineProperty(exports, "resendUserInvitation", { enumerable: true, get: function () { return action_tokens_1.resendUserInvitation; } });
+Object.defineProperty(exports, "acceptUserInvitation", { enumerable: true, get: function () { return action_tokens_1.acceptUserInvitation; } });
+Object.defineProperty(exports, "createPasswordReset", { enumerable: true, get: function () { return action_tokens_1.createPasswordReset; } });
+Object.defineProperty(exports, "resetPassword", { enumerable: true, get: function () { return action_tokens_1.resetPassword; } });
+Object.defineProperty(exports, "INVITATION_LIFETIME_MS", { enumerable: true, get: function () { return action_tokens_1.INVITATION_LIFETIME_MS; } });
+Object.defineProperty(exports, "PASSWORD_RESET_LIFETIME_MS", { enumerable: true, get: function () { return action_tokens_1.PASSWORD_RESET_LIFETIME_MS; } });
+var crypto_1 = require("./crypto");
+Object.defineProperty(exports, "createOpaqueSecret", { enumerable: true, get: function () { return crypto_1.createOpaqueSecret; } });
+Object.defineProperty(exports, "hashSecret", { enumerable: true, get: function () { return crypto_1.hashSecret; } });
+Object.defineProperty(exports, "normalizeEmail", { enumerable: true, get: function () { return crypto_1.normalizeEmail; } });
+Object.defineProperty(exports, "secretHashMatches", { enumerable: true, get: function () { return crypto_1.secretHashMatches; } });
+var gravatar_1 = require("./gravatar");
+Object.defineProperty(exports, "buildGravatarUrl", { enumerable: true, get: function () { return gravatar_1.buildGravatarUrl; } });
+var device_authorizations_1 = require("./device-authorizations");
+Object.defineProperty(exports, "createRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.createRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "approveRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.approveRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "denyRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.denyRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "exchangeRegistryDeviceAuthorization", { enumerable: true, get: function () { return device_authorizations_1.exchangeRegistryDeviceAuthorization; } });
+Object.defineProperty(exports, "purgeExpiredRegistryDeviceAuthorizations", { enumerable: true, get: function () { return device_authorizations_1.purgeExpiredRegistryDeviceAuthorizations; } });
+Object.defineProperty(exports, "generateRegistryUserCode", { enumerable: true, get: function () { return device_authorizations_1.generateRegistryUserCode; } });
+Object.defineProperty(exports, "normalizeRegistryUserCode", { enumerable: true, get: function () { return device_authorizations_1.normalizeRegistryUserCode; } });
+Object.defineProperty(exports, "DEVICE_AUTHORIZATION_LIFETIME_SECONDS", { enumerable: true, get: function () { return device_authorizations_1.DEVICE_AUTHORIZATION_LIFETIME_SECONDS; } });
+Object.defineProperty(exports, "DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS", { enumerable: true, get: function () { return device_authorizations_1.DEVICE_AUTHORIZATION_POLL_INTERVAL_SECONDS; } });
+var installation_1 = require("./installation");
+Object.defineProperty(exports, "getRegistryInstallation", { enumerable: true, get: function () { return installation_1.getRegistryInstallation; } });
+Object.defineProperty(exports, "getRegistryInstallationState", { enumerable: true, get: function () { return installation_1.getRegistryInstallationState; } });
+Object.defineProperty(exports, "installRegistry", { enumerable: true, get: function () { return installation_1.installRegistry; } });
+Object.defineProperty(exports, "REGISTRY_AUTH_SCHEMA_VERSION", { enumerable: true, get: function () { return installation_1.REGISTRY_AUTH_SCHEMA_VERSION; } });
+Object.defineProperty(exports, "REGISTRY_INSTALLATION_ID", { enumerable: true, get: function () { return installation_1.REGISTRY_INSTALLATION_ID; } });
+var password_1 = require("./password");
+Object.defineProperty(exports, "hashPassword", { enumerable: true, get: function () { return password_1.hashPassword; } });
+Object.defineProperty(exports, "verifyPassword", { enumerable: true, get: function () { return password_1.verifyPassword; } });
+Object.defineProperty(exports, "validatePassword", { enumerable: true, get: function () { return password_1.validatePassword; } });
+Object.defineProperty(exports, "MINIMUM_PASSWORD_LENGTH", { enumerable: true, get: function () { return password_1.MINIMUM_PASSWORD_LENGTH; } });
+Object.defineProperty(exports, "MAXIMUM_PASSWORD_LENGTH", { enumerable: true, get: function () { return password_1.MAXIMUM_PASSWORD_LENGTH; } });
+var rate_limits_1 = require("./rate-limits");
+Object.defineProperty(exports, "consumeAuthRateLimit", { enumerable: true, get: function () { return rate_limits_1.consumeAuthRateLimit; } });
+Object.defineProperty(exports, "clearAuthRateLimit", { enumerable: true, get: function () { return rate_limits_1.clearAuthRateLimit; } });
+Object.defineProperty(exports, "purgeExpiredAuthRateLimits", { enumerable: true, get: function () { return rate_limits_1.purgeExpiredAuthRateLimits; } });
+Object.defineProperty(exports, "hashRateLimitIdentifier", { enumerable: true, get: function () { return rate_limits_1.hashRateLimitIdentifier; } });
+var users_1 = require("./users");
+Object.defineProperty(exports, "getRegistryUserById", { enumerable: true, get: function () { return users_1.getRegistryUserById; } });
+Object.defineProperty(exports, "listRegistryUsers", { enumerable: true, get: function () { return users_1.listRegistryUsers; } });
+Object.defineProperty(exports, "authenticateRegistryCredentials", { enumerable: true, get: function () { return users_1.authenticateRegistryCredentials; } });
+Object.defineProperty(exports, "updateRegistryUserProfile", { enumerable: true, get: function () { return users_1.updateRegistryUserProfile; } });
+Object.defineProperty(exports, "updateRegistryUserRole", { enumerable: true, get: function () { return users_1.updateRegistryUserRole; } });
+Object.defineProperty(exports, "setRegistryUserStatus", { enumerable: true, get: function () { return users_1.setRegistryUserStatus; } });
+var types_1 = require("./types");
+Object.defineProperty(exports, "REGISTRY_READ_SCOPE", { enumerable: true, get: function () { return types_1.REGISTRY_READ_SCOPE; } });
+Object.defineProperty(exports, "REGISTRY_WRITE_SCOPE", { enumerable: true, get: function () { return types_1.REGISTRY_WRITE_SCOPE; } });
+Object.defineProperty(exports, "scopesForRegistryRole", { enumerable: true, get: function () { return types_1.scopesForRegistryRole; } });
+Object.defineProperty(exports, "registryPrincipalHasScope", { enumerable: true, get: function () { return types_1.registryPrincipalHasScope; } });
+var validation_1 = require("./validation");
+Object.defineProperty(exports, "validateRegistryDisplayName", { enumerable: true, get: function () { return validation_1.validateRegistryDisplayName; } });
+Object.defineProperty(exports, "validateRegistryEmail", { enumerable: true, get: function () { return validation_1.validateRegistryEmail; } });
+Object.defineProperty(exports, "validateRegistryImageUrl", { enumerable: true, get: function () { return validation_1.validateRegistryImageUrl; } });

package/dist/registry/auth/installation.d.ts

@@ -0,0 +1,42 @@
+import type { RegistryDatabase } from '../db/client';
+import { registryInstallations } from '../db/schema';
+import type { RegistryUser } from './types';
+/** Migration number that introduced the registry authentication schema. */
+export declare const REGISTRY_AUTH_SCHEMA_VERSION = 5;
+export declare const REGISTRY_INSTALLATION_ID = "default";
+export type RegistryInstallation = typeof registryInstallations.$inferSelect;
+export type RegistryInstallationState = {
+    status: 'ready';
+    installation: null;
+    userCount: 0;
+} | {
+    status: 'installed';
+    installation: RegistryInstallation;
+    userCount: number;
+} | {
+    status: 'inconsistent';
+    installation: null;
+    userCount: number;
+};
+export interface RegistryInstallInput {
+    email: string;
+    name: string;
+    password: string;
+    now?: Date;
+}
+export type RegistryInstallResult = {
+    ok: true;
+    user: RegistryUser;
+    installation: RegistryInstallation;
+} | {
+    ok: false;
+    reason: 'invalid_email' | 'invalid_name' | 'invalid_password' | 'already_installed' | 'users_exist';
+    error?: string;
+};
+export declare const getRegistryInstallation: (db: RegistryDatabase) => Promise<RegistryInstallation | null>;
+export declare const getRegistryInstallationState: (db: RegistryDatabase) => Promise<RegistryInstallationState>;
+/**
+ * Complete first-visitor installation under a transaction-scoped advisory lock. Password hashing is
+ * intentionally performed before taking the lock; all state checks are repeated inside it.
+ */
+export declare const installRegistry: (db: RegistryDatabase, input: RegistryInstallInput) => Promise<RegistryInstallResult>;