pipework 0.7.26 → 0.8.1

package/dist/audit/emit.d.ts

@@ -1,3 +0,0 @@
-import type { AuditConfig, Audit } from './types.js';
-export declare function createAudit(config: AuditConfig): Audit;
-//# sourceMappingURL=emit.d.ts.map

package/dist/audit/emit.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAoB,KAAK,EAAE,MAAM,YAAY,CAAA;AAItE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAyEtD"}

package/dist/audit/emit.js

@@ -1,66 +0,0 @@
-import { sql } from '../db/sql.js';
-import { getContext } from '../context/store.js';
-import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
-export function createAudit(config) {
-    const table = config.table ?? 'pipework_audit_events';
-    assertValidIdentifier(table, 'audit table');
-    return {
-        async emit(options) {
-            const ctx = getContext();
-            if (!ctx) {
-                throw new Error('[pipework] audit.emit() called outside a managed context. ' +
-                    'It must run inside a request handler or job.');
-            }
-            if (ctx.tenant === null) {
-                throw new Error('[pipework] audit.emit() requires tenant context. ' +
-                    'Configure tenant extraction in createServer().');
-            }
-            if (ctx.auth === null) {
-                throw new Error('[pipework] audit.emit() requires authenticated context. ' +
-                    'Ensure the handler uses .auth() or the route is not .public().');
-            }
-            const userId = extractUserId(ctx.auth);
-            if (userId === null) {
-                throw new Error('[pipework] audit.emit() requires auth.userId. ' +
-                    'Ensure the auth object has a userId field.');
-            }
-            const bound = ctx.transactions.get(config.database);
-            if (!bound) {
-                throw new Error(`[pipework] audit.emit() requires an active transaction on database "${config.database}". ` +
-                    `Configure transactionPerRequest: ['${config.database}'] in createServer().`);
-            }
-            const tx = bound.drizzle;
-            const sessionId = config.sessionIdField !== undefined && typeof ctx.auth === 'object'
-                ? ctx.auth[config.sessionIdField] ?? null
-                : null;
-            const beforeJson = options.before !== undefined ? JSON.stringify(options.before) : null;
-            const afterJson = options.after !== undefined ? JSON.stringify(options.after) : null;
-            const metadataJson = options.metadata !== undefined ? JSON.stringify(options.metadata) : null;
-            const result = await tx.execute(sql `
-        INSERT INTO ${sql.raw(quoteIdentifier(table, 'audit table'))} (tenant_id, request_id, user_id, session_id, action_type, entity_type, entity_id, before_state, after_state, metadata)
-        VALUES (
-          ${ctx.tenant},
-          ${ctx.requestId},
-          ${userId},
-          ${sessionId ?? null},
-          ${options.actionType},
-          ${options.entityType ?? null},
-          ${options.entityId ?? null},
-          ${beforeJson !== null ? sql `${beforeJson}::jsonb` : sql `NULL`},
-          ${afterJson !== null ? sql `${afterJson}::jsonb` : sql `NULL`},
-          ${metadataJson !== null ? sql `${metadataJson}::jsonb` : sql `NULL`}
-        )
-        RETURNING id::text
-      `);
-            return result[0].id;
-        },
-    };
-}
-function extractUserId(auth) {
-    if (auth !== null && auth !== undefined && typeof auth === 'object' && 'userId' in auth) {
-        const val = auth.userId;
-        return typeof val === 'string' ? val : null;
-    }
-    return null;
-}
-//# sourceMappingURL=emit.js.map

package/dist/audit/emit.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAA;IACrD,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAE3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAyB;YAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;YACxB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,4DAA4D;oBAC5D,8CAA8C,CAC/C,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,mDAAmD;oBACnD,gDAAgD,CACjD,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,0DAA0D;oBAC1D,gEAAgE,CACjE,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAChD,4CAA4C,CAC7C,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,QAAQ,KAAK;oBAC3F,sCAAsC,MAAM,CAAC,QAAQ,uBAAuB,CAC7E,CAAA;YACH,CAAC;YACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAA;YAExB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnF,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,MAAM,CAAC,cAAc,CAAkB,IAAI,IAAI;gBACvF,CAAC,CAAC,IAAI,CAAA;YAER,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACvF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACpF,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAE7F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACnB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;;YAExD,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,SAAS;YACb,MAAM;YACN,SAAS,IAAI,IAAI;YACjB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,UAAU,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YAC3D,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YACzD,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;;;OAGpE,CAAC,CAAA;YAEF,OAAQ,MAAM,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACxF,MAAM,GAAG,GAAI,IAA4B,CAAC,MAAM,CAAA;QAChD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/audit/index.d.ts

@@ -1,3 +0,0 @@
-export type { AuditConfig, AuditEmitOptions, Audit } from './types.js';
-export { createAudit } from './emit.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/index.js

@@ -1,2 +0,0 @@
-export { createAudit } from './emit.js';
-//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/namespace.d.ts

@@ -1,7 +0,0 @@
-import { createAudit } from './index.js';
-/** Audit logging namespace — structured audit trail for data changes. */
-export declare const audit: {
-    /** Creates an Audit instance that writes audit records to a Postgres table. */
-    create: typeof createAudit;
-};
-//# sourceMappingURL=namespace.d.ts.map

package/dist/audit/namespace.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,yEAAyE;AACzE,eAAO,MAAM,KAAK;IAChB,+EAA+E;;CAEhF,CAAA"}

package/dist/audit/namespace.js

@@ -1,7 +0,0 @@
-import { createAudit } from './index.js';
-/** Audit logging namespace — structured audit trail for data changes. */
-export const audit = {
-    /** Creates an Audit instance that writes audit records to a Postgres table. */
-    create: createAudit,
-};
-//# sourceMappingURL=namespace.js.map

package/dist/audit/namespace.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,yEAAyE;AACzE,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,+EAA+E;IAC/E,MAAM,EAAE,WAAW;CACpB,CAAA"}

package/dist/audit/types.d.ts

@@ -1,17 +0,0 @@
-export interface AuditConfig {
-    readonly database: string;
-    readonly table?: string;
-    readonly sessionIdField?: string;
-}
-export interface AuditEmitOptions {
-    readonly actionType: string;
-    readonly entityType?: string;
-    readonly entityId?: string;
-    readonly before?: unknown;
-    readonly after?: unknown;
-    readonly metadata?: Record<string, unknown>;
-}
-export interface Audit {
-    emit(options: AuditEmitOptions): Promise<string>;
-}
-//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD"}

package/dist/audit/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":""}

package/dist/auth/chain.d.ts

@@ -1,26 +0,0 @@
-import type { AuthStrategy, AuthRequest, AuthContext } from './types.js';
-/** Post-authentication hook — enrich the resolved auth with additional data (roles, permissions, etc.). */
-export interface AuthEnricher<TAuth> {
-    readonly name: string;
-    enrich(auth: TAuth): Promise<TAuth>;
-}
-/** Resolves tenant ID from auth context — called after authentication in the chain. */
-export interface TenantResolver<TAuth> {
-    resolve(auth: TAuth): string;
-}
-/** Configuration for the auth chain — strategies, enrichers, tenant resolver. */
-export interface AuthChainConfig<TAuth> {
-    readonly strategies: readonly AuthStrategy<TAuth>[];
-    readonly enrichers?: readonly AuthEnricher<TAuth>[];
-    readonly tenantResolver?: TenantResolver<TAuth>;
-}
-/** Result of running the auth chain — resolved auth and tenant (both nullable for public routes). */
-export interface AuthChainResult<TAuth> {
-    readonly auth: TAuth | null;
-    readonly tenant: string | null;
-}
-/** Executes the auth chain: tries strategies in order, enriches, resolves tenant. */
-export declare function runAuthChain<TAuth>(config: AuthChainConfig<TAuth>, request: AuthRequest, options: {
-    optional: boolean;
-}, context: AuthContext): Promise<AuthChainResult<TAuth>>;
-//# sourceMappingURL=chain.d.ts.map

package/dist/auth/chain.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGxE,2GAA2G;AAC3G,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CACpC;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAA;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;CAChD;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,KAAK,EACtC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,EAC9B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAqCjC"}

package/dist/auth/chain.js

@@ -1,46 +0,0 @@
-import { UnauthorizedError } from '../errors/index.js';
-/** Executes the auth chain: tries strategies in order, enriches, resolves tenant. */
-export async function runAuthChain(config, request, options, context) {
-    let extracted = null;
-    let matchedStrategy = null;
-    for (const strategy of config.strategies) {
-        extracted = await strategy.extract(request, context);
-        if (extracted !== null) {
-            matchedStrategy = strategy;
-            break;
-        }
-    }
-    if (extracted === null) {
-        if (options.optional)
-            return { auth: null, tenant: null };
-        throw new UnauthorizedError();
-    }
-    let auth;
-    try {
-        auth = await matchedStrategy.verify(extracted, context);
-    }
-    catch (error) {
-        if (error instanceof UnauthorizedError)
-            throw error;
-        throw new UnauthorizedError('Authentication failed', {
-            strategy: matchedStrategy.name,
-            cause: error instanceof Error ? error.message : String(error),
-        });
-    }
-    if (config.enrichers) {
-        for (const enricher of config.enrichers) {
-            auth = await enricher.enrich(auth);
-        }
-    }
-    const tenant = config.tenantResolver ? config.tenantResolver.resolve(auth) : extractTenant(auth);
-    return { auth, tenant };
-}
-function extractTenant(auth) {
-    if (auth !== null && typeof auth === 'object' && 'tenantId' in auth) {
-        const tenantId = auth.tenantId;
-        if (typeof tenantId === 'string')
-            return tenantId;
-    }
-    return null;
-}
-//# sourceMappingURL=chain.js.map

package/dist/auth/chain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AA0BtD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA8B,EAC9B,OAAoB,EACpB,OAA8B,EAC9B,OAAoB;IAEpB,IAAI,SAAS,GAAiB,IAAI,CAAA;IAClC,IAAI,eAAe,GAA+B,IAAI,CAAA;IAEtD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,eAAe,GAAG,QAAQ,CAAA;YAC1B,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;IAC/B,CAAC;IAED,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAA;QACnD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,eAAgB,CAAC,IAAI;YAC/B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAEhG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAI,IAA8B,CAAC,QAAQ,CAAA;QACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;IACnD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/auth/cookie.d.ts

@@ -1,24 +0,0 @@
-/** Cookie configuration for token delivery — name, domain, path, secure, sameSite, httpOnly. */
-export interface CookieConfig {
-    readonly name?: string;
-    readonly secure?: 'auto' | boolean;
-    readonly sameSite?: 'strict' | 'lax' | 'none';
-    readonly path?: string;
-}
-/** CookieConfig with all defaults resolved — every field is required. */
-export interface ResolvedCookieConfig {
-    readonly name: string;
-    readonly secure: boolean;
-    readonly sameSite: string;
-    readonly path: string;
-    readonly httpOnly: true;
-}
-/** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
-export declare function resolveCookieConfig(cookie: CookieConfig, env: string): ResolvedCookieConfig;
-/** Builds a Set-Cookie header string from name, value, and resolved config. */
-export declare function buildSetCookieHeader(resolved: ResolvedCookieConfig, value: string, maxAge: number): string;
-/** Builds a Set-Cookie header that expires (clears) a cookie. */
-export declare function buildClearCookieHeader(resolved: ResolvedCookieConfig): string;
-/** Parses a Cookie header string into a Record of key-value pairs. */
-export declare function parseCookieHeader(header: string | undefined, name: string): string | undefined;
-//# sourceMappingURL=cookie.d.ts.map

package/dist/auth/cookie.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAY3F;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAU1G;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAU7E;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY9F"}

package/dist/auth/cookie.js

@@ -1,59 +0,0 @@
-/** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
-export function resolveCookieConfig(cookie, env) {
-    const secure = cookie.secure === 'auto' || cookie.secure === undefined
-        ? env === 'production'
-        : cookie.secure;
-    return {
-        name: cookie.name ?? '__pipework_refresh',
-        secure,
-        sameSite: cookie.sameSite ?? 'strict',
-        path: cookie.path ?? '/',
-        httpOnly: true,
-    };
-}
-/** Builds a Set-Cookie header string from name, value, and resolved config. */
-export function buildSetCookieHeader(resolved, value, maxAge) {
-    const parts = [
-        `${resolved.name}=${encodeURIComponent(value)}`,
-        `HttpOnly`,
-        `Path=${resolved.path}`,
-        `Max-Age=${maxAge}`,
-        `SameSite=${capitalize(resolved.sameSite)}`,
-    ];
-    if (resolved.secure)
-        parts.push('Secure');
-    return parts.join('; ');
-}
-/** Builds a Set-Cookie header that expires (clears) a cookie. */
-export function buildClearCookieHeader(resolved) {
-    const parts = [
-        `${resolved.name}=`,
-        `HttpOnly`,
-        `Path=${resolved.path}`,
-        `Max-Age=0`,
-        `SameSite=${capitalize(resolved.sameSite)}`,
-    ];
-    if (resolved.secure)
-        parts.push('Secure');
-    return parts.join('; ');
-}
-/** Parses a Cookie header string into a Record of key-value pairs. */
-export function parseCookieHeader(header, name) {
-    if (header === undefined)
-        return undefined;
-    for (const pair of header.split(';')) {
-        const trimmed = pair.trim();
-        const eqIdx = trimmed.indexOf('=');
-        if (eqIdx === -1)
-            continue;
-        const key = trimmed.slice(0, eqIdx).trim();
-        if (key === name) {
-            return decodeURIComponent(trimmed.slice(eqIdx + 1).trim());
-        }
-    }
-    return undefined;
-}
-function capitalize(s) {
-    return s.charAt(0).toUpperCase() + s.slice(1);
-}
-//# sourceMappingURL=cookie.js.map

package/dist/auth/cookie.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAiBA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,oBAAoB;QACzC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -1,10 +0,0 @@
-export type { AuthStrategy, AuthRequest, AuthContext, BaseAuth } from './types.js';
-export { runAuthChain } from './chain.js';
-export type { AuthEnricher, TenantResolver, AuthChainConfig, AuthChainResult } from './chain.js';
-export { createSessions } from './sessions.js';
-export type { Sessions, SessionConfig, TokenPair, TokenPayload, HttpTokenResult, HttpRequest, HttpResponse } from './sessions.js';
-export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
-export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
-export { createMultiOrgSessions } from './multi-org.js';
-export type { MultiOrgConfig, MultiOrgSessions, ResolveLoginResult, AuthenticatedResult, OrgSelectResult, OrgMembership, OrgInfo, OrgMembershipDetail } from './multi-org.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/index.js

@@ -1,5 +0,0 @@
-export { runAuthChain } from './chain.js';
-export { createSessions } from './sessions.js';
-export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
-export { createMultiOrgSessions } from './multi-org.js';
-//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/multi-org.d.ts

@@ -1,77 +0,0 @@
-import type { DB } from '../db/index.js';
-import type { Sessions, HttpResponse, HttpRequest, HttpTokenResult } from './sessions.js';
-/** Configuration for multi-org sessions — base sessions, signing keys, org-select token TTL. */
-export interface MultiOrgConfig {
-    readonly sessions: Sessions;
-    readonly signing: {
-        algorithm: 'ES256';
-        privateKey: string;
-        publicKey: string;
-    };
-    readonly issuer: string;
-    readonly audience: string;
-    readonly orgSelectToken?: {
-        readonly expiresIn?: string;
-    };
-    readonly table?: string;
-    readonly resolveOrgNames?: (db: DB, orgIds: string[]) => Promise<Map<string, string>>;
-}
-/** A user's membership in an organization — userId, orgId, role. */
-export interface OrgMembership {
-    readonly id: string;
-    readonly orgId: string;
-    readonly role: string | null;
-    readonly joinedAt: Date;
-}
-/** Basic organization info — id and display name. */
-export interface OrgInfo {
-    readonly id: string;
-    readonly name: string;
-}
-/** Organization membership with display name — extends OrgMembership with org info. */
-export interface OrgMembershipDetail {
-    readonly id: string;
-    readonly name: string;
-    readonly role: string | null;
-}
-/** Result when user has exactly one org — direct authentication, no org selection needed. */
-export interface AuthenticatedResult {
-    readonly type: 'authenticated';
-    readonly accessToken: string;
-    readonly expiresIn: number;
-}
-/** Result when user has multiple orgs — returns a session token for org selection. */
-export interface OrgSelectResult {
-    readonly type: 'org_select';
-    readonly sessionToken: string;
-    readonly orgs: readonly OrgInfo[];
-}
-/** Union result from resolveLogin() — either AuthenticatedResult or OrgSelectResult. */
-export type ResolveLoginResult = AuthenticatedResult | OrgSelectResult;
-/** Multi-org session manager — login resolution, org selection, switching, membership CRUD. */
-export interface MultiOrgSessions {
-    resolveLogin(response: HttpResponse, db: DB, user: {
-        id: string;
-    }): Promise<ResolveLoginResult>;
-    selectOrg(response: HttpResponse, db: DB, sessionToken: string, orgId: string): Promise<HttpTokenResult>;
-    switchOrg(response: HttpResponse, db: DB, request: HttpRequest, orgId: string, userId: string): Promise<HttpTokenResult>;
-    listOrgs(db: DB, userId: string): Promise<{
-        orgs: readonly OrgMembershipDetail[];
-    }>;
-    addMember(db: DB, params: {
-        userId: string;
-        orgId: string;
-        role?: string;
-        addedBy?: string;
-    }): Promise<{
-        id: string;
-    }>;
-    removeMember(db: DB, params: {
-        userId: string;
-        orgId: string;
-    }): Promise<void>;
-    checkMembership(db: DB, userId: string, orgId: string): Promise<OrgMembership | null>;
-}
-/** Creates a multi-org session manager with org selection flow and membership management. */
-export declare function createMultiOrgSessions(config: MultiOrgConfig): MultiOrgSessions;
-//# sourceMappingURL=multi-org.d.ts.map

package/dist/auth/multi-org.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../src/auth/multi-org.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAGxC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoO/E"}

package/dist/auth/multi-org.js

@@ -1,164 +0,0 @@
-import { SignJWT, jwtVerify, importPKCS8, importSPKI } from 'jose';
-import { sql } from '../db/sql.js';
-import { ForbiddenError, UnauthorizedError, ConflictError, NotFoundError } from '../errors/index.js';
-import { assertValidIdentifier } from '../db/identifiers.js';
-/** Creates a multi-org session manager with org selection flow and membership management. */
-export function createMultiOrgSessions(config) {
-    const tableName = config.table ?? 'pipework_user_orgs';
-    assertValidIdentifier(tableName, 'multi-org membership table');
-    const t = sql.raw(`"${tableName}"`);
-    const orgSelectAudience = `${config.audience}:org-select`;
-    const orgSelectExpiresIn = config.orgSelectToken?.expiresIn ?? '10m';
-    let cachedPrivateKey = null;
-    let cachedPublicKey = null;
-    async function getPrivateKey() {
-        if (cachedPrivateKey === null) {
-            cachedPrivateKey = await importPKCS8(config.signing.privateKey, config.signing.algorithm);
-        }
-        return cachedPrivateKey;
-    }
-    async function getPublicKey() {
-        if (cachedPublicKey === null) {
-            cachedPublicKey = await importSPKI(config.signing.publicKey, config.signing.algorithm);
-        }
-        return cachedPublicKey;
-    }
-    function parseExpiry(exp) {
-        const match = exp.match(/^(\d+)([smhd])$/);
-        if (match === null)
-            throw new Error(`Invalid expiry format: ${exp}`);
-        const value = parseInt(match[1], 10);
-        const unit = match[2];
-        switch (unit) {
-            case 's': return value;
-            case 'm': return value * 60;
-            case 'h': return value * 3600;
-            case 'd': return value * 86400;
-            default: return value;
-        }
-    }
-    async function signOrgSelectToken(userId) {
-        const key = await getPrivateKey();
-        const expiresInSeconds = parseExpiry(orgSelectExpiresIn);
-        return new SignJWT({ purpose: 'org_select' })
-            .setProtectedHeader({ alg: config.signing.algorithm })
-            .setSubject(userId)
-            .setIssuer(config.issuer)
-            .setAudience(orgSelectAudience)
-            .setIssuedAt()
-            .setExpirationTime(`${expiresInSeconds}s`)
-            .sign(key);
-    }
-    async function verifyOrgSelectToken(token) {
-        const key = await getPublicKey();
-        try {
-            const { payload } = await jwtVerify(token, key, {
-                algorithms: [config.signing.algorithm],
-                issuer: config.issuer,
-                audience: orgSelectAudience,
-            });
-            if (payload['purpose'] !== 'org_select') {
-                throw new Error('wrong purpose');
-            }
-            return payload.sub;
-        }
-        catch {
-            throw new UnauthorizedError('Invalid or expired organization selection token. Please log in again.');
-        }
-    }
-    async function requireMembership(db, userId, orgId) {
-        const rows = await db.execute(sql `SELECT 1 FROM ${t} WHERE user_id = ${userId} AND org_id = ${orgId}`);
-        if (rows.length === 0) {
-            throw new ForbiddenError('You are not a member of this organization.');
-        }
-    }
-    async function resolveLogin(response, db, user) {
-        const rows = await db.execute(sql `SELECT org_id, role FROM ${t} WHERE user_id = ${user.id} ORDER BY joined_at`);
-        if (rows.length === 0) {
-            throw new ForbiddenError('User has no organization memberships. Contact your administrator to be added to an organization.');
-        }
-        if (rows.length === 1) {
-            const orgId = rows[0]['org_id'];
-            const result = await config.sessions.issueTokensHttp(response, db, { id: user.id, tenantId: orgId });
-            return { type: 'authenticated', accessToken: result.accessToken, expiresIn: result.expiresIn };
-        }
-        const orgIds = rows.map(r => r['org_id']);
-        let orgNames = null;
-        if (config.resolveOrgNames !== undefined) {
-            orgNames = await config.resolveOrgNames(db, orgIds);
-        }
-        const orgs = orgIds.map(id => ({
-            id,
-            name: orgNames?.get(id) ?? id,
-        }));
-        const sessionToken = await signOrgSelectToken(user.id);
-        return { type: 'org_select', sessionToken, orgs };
-    }
-    async function selectOrg(response, db, sessionToken, orgId) {
-        const userId = await verifyOrgSelectToken(sessionToken);
-        await requireMembership(db, userId, orgId);
-        return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
-    }
-    async function switchOrg(response, db, _request, orgId, userId) {
-        await requireMembership(db, userId, orgId);
-        return config.sessions.issueTokensHttp(response, db, { id: userId, tenantId: orgId });
-    }
-    async function listOrgs(db, userId) {
-        const rows = await db.execute(sql `SELECT org_id, role FROM ${t} WHERE user_id = ${userId} ORDER BY joined_at`);
-        const orgIds = rows.map(r => r['org_id']);
-        let orgNames = null;
-        if (config.resolveOrgNames !== undefined && orgIds.length > 0) {
-            orgNames = await config.resolveOrgNames(db, orgIds);
-        }
-        const orgs = rows.map(r => {
-            const orgId = r['org_id'];
-            return {
-                id: orgId,
-                name: orgNames?.get(orgId) ?? orgId,
-                role: r['role'] ?? null,
-            };
-        });
-        return { orgs };
-    }
-    async function addMember(db, params) {
-        const role = params.role ?? null;
-        const addedBy = params.addedBy ?? null;
-        const rows = await db.execute(sql `INSERT INTO ${t} (user_id, org_id, role, added_by)
-          VALUES (${params.userId}, ${params.orgId}, ${role}, ${addedBy})
-          ON CONFLICT (user_id, org_id) DO NOTHING
-          RETURNING id`);
-        if (rows.length === 0) {
-            throw new ConflictError('User is already a member of this organization.');
-        }
-        return { id: rows[0]['id'] };
-    }
-    async function removeMember(db, params) {
-        const rows = await db.execute(sql `DELETE FROM ${t} WHERE user_id = ${params.userId} AND org_id = ${params.orgId} RETURNING id`);
-        if (rows.length === 0) {
-            throw new NotFoundError('Membership');
-        }
-        await config.sessions.bumpVersion(db, params.userId);
-    }
-    async function checkMembershipFn(db, userId, orgId) {
-        const rows = await db.execute(sql `SELECT id, org_id, role, joined_at FROM ${t} WHERE user_id = ${userId} AND org_id = ${orgId}`);
-        if (rows.length === 0)
-            return null;
-        const row = rows[0];
-        return {
-            id: row['id'],
-            orgId: row['org_id'],
-            role: row['role'] ?? null,
-            joinedAt: new Date(row['joined_at']),
-        };
-    }
-    return {
-        resolveLogin,
-        selectOrg,
-        switchOrg,
-        listOrgs,
-        addMember,
-        removeMember,
-        checkMembership: checkMembershipFn,
-    };
-}
-//# sourceMappingURL=multi-org.js.map

package/dist/auth/multi-org.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"multi-org.js","sourceRoot":"","sources":["../../src/auth/multi-org.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,MAAM,CAAA;AAClE,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AACpG,OAAO,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAA;AAiG5D,6FAA6F;AAC7F,MAAM,UAAU,sBAAsB,CAAC,MAAsB;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,oBAAoB,CAAA;IACtD,qBAAqB,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAA;IAC9D,MAAM,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,IAAI,SAAS,GAAG,CAAC,CAAA;IAEnC,MAAM,iBAAiB,GAAG,GAAG,MAAM,CAAC,QAAQ,aAAa,CAAA;IACzD,MAAM,kBAAkB,GAAG,MAAM,CAAC,cAAc,EAAE,SAAS,IAAI,KAAK,CAAA;IAEpE,IAAI,gBAAgB,GAAqB,IAAI,CAAA;IAC7C,IAAI,eAAe,GAAqB,IAAI,CAAA;IAE5C,KAAK,UAAU,aAAa;QAC1B,IAAI,gBAAgB,KAAK,IAAI,EAAE,CAAC;YAC9B,gBAAgB,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QAC3F,CAAC;QACD,OAAO,gBAAgB,CAAA;IACzB,CAAC;IAED,KAAK,UAAU,YAAY;QACzB,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,eAAe,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;QACxF,CAAC;QACD,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,SAAS,WAAW,CAAC,GAAW;QAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAA;QAC1C,IAAI,KAAK,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,GAAG,EAAE,CAAC,CAAA;QACpE,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAA;QACrC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAA;QACrB,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,CAAA;YACtB,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,EAAE,CAAA;YAC3B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,IAAI,CAAA;YAC7B,KAAK,GAAG,CAAC,CAAC,OAAO,KAAK,GAAG,KAAK,CAAA;YAC9B,OAAO,CAAC,CAAC,OAAO,KAAK,CAAA;QACvB,CAAC;IACH,CAAC;IAED,KAAK,UAAU,kBAAkB,CAAC,MAAc;QAC9C,MAAM,GAAG,GAAG,MAAM,aAAa,EAAE,CAAA;QACjC,MAAM,gBAAgB,GAAG,WAAW,CAAC,kBAAkB,CAAC,CAAA;QACxD,OAAO,IAAI,OAAO,CAAC,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;aAC1C,kBAAkB,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;aACrD,UAAU,CAAC,MAAM,CAAC;aAClB,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC;aACxB,WAAW,CAAC,iBAAiB,CAAC;aAC9B,WAAW,EAAE;aACb,iBAAiB,CAAC,GAAG,gBAAgB,GAAG,CAAC;aACzC,IAAI,CAAC,GAAG,CAAC,CAAA;IACd,CAAC;IAED,KAAK,UAAU,oBAAoB,CAAC,KAAa;QAC/C,MAAM,GAAG,GAAG,MAAM,YAAY,EAAE,CAAA;QAChC,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE;gBAC9C,UAAU,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;gBACtC,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,iBAAiB;aAC5B,CAAC,CAAA;YACF,IAAI,OAAO,CAAC,SAAS,CAAC,KAAK,YAAY,EAAE,CAAC;gBACxC,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAA;YAClC,CAAC;YACD,OAAO,OAAO,CAAC,GAAI,CAAA;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,iBAAiB,CACzB,uEAAuE,CACxE,CAAA;QACH,CAAC;IACH,CAAC;IAED,KAAK,UAAU,iBAAiB,CAAC,EAAM,EAAE,MAAc,EAAE,KAAa;QACpE,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,iBAAiB,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CACxE,CAAA;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CAAC,4CAA4C,CAAC,CAAA;QACxE,CAAC;IACH,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,QAAsB,EACtB,EAAM,EACN,IAAoB;QAEpB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,IAAI,CAAC,EAAE,qBAAqB,CACjF,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,cAAc,CACtB,kGAAkG,CACnG,CAAA;QACH,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAW,CAAA;YAC1C,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;YACpG,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,CAAA;QAChG,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACzC,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAAc,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACxC,EAAE;YACF,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE;SAC9B,CAAC,CAAC,CAAA;QAEH,MAAM,YAAY,GAAG,MAAM,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,YAAY,EAAE,IAAI,EAAE,CAAA;IACnD,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,YAAoB,EACpB,KAAa;QAEb,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACvD,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,QAAsB,EACtB,EAAM,EACN,QAAqB,EACrB,KAAa,EACb,MAAc;QAEd,MAAM,iBAAiB,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;QAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,QAAQ,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAA;IACvF,CAAC;IAED,KAAK,UAAU,QAAQ,CACrB,EAAM,EACN,MAAc;QAEd,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,4BAA4B,CAAC,oBAAoB,MAAM,qBAAqB,CAChF,CAAA;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAW,CAAC,CAAA;QACnD,IAAI,QAAQ,GAA+B,IAAI,CAAA;QAC/C,IAAI,MAAM,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9D,QAAQ,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM,CAAC,CAAA;QACrD,CAAC;QAED,MAAM,IAAI,GAA0B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;YAC/C,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAW,CAAA;YACnC,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK;gBACnC,IAAI,EAAG,CAAC,CAAC,MAAM,CAAmB,IAAI,IAAI;aAC3C,CAAA;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,IAAI,EAAE,CAAA;IACjB,CAAC;IAED,KAAK,UAAU,SAAS,CACtB,EAAM,EACN,MAA0E;QAE1E,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,IAAI,CAAA;QAChC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,IAAI,CAAA;QACtC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC;oBACL,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,KAAK,KAAK,IAAI,KAAK,OAAO;;uBAEhD,CAClB,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,gDAAgD,CAAC,CAAA;QAC3E,CAAC;QAED,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC,CAAE,CAAC,IAAI,CAAW,EAAE,CAAA;IACzC,CAAC;IAED,KAAK,UAAU,YAAY,CACzB,EAAM,EACN,MAAyC;QAEzC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,eAAe,CAAC,oBAAoB,MAAM,CAAC,MAAM,iBAAiB,MAAM,CAAC,KAAK,eAAe,CACjG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,MAAM,IAAI,aAAa,CAAC,YAAY,CAAC,CAAA;QACvC,CAAC;QAED,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,UAAU,iBAAiB,CAC9B,EAAM,EACN,MAAc,EACd,KAAa;QAEb,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,OAAO,CAC3B,GAAG,CAAA,2CAA2C,CAAC,oBAAoB,MAAM,iBAAiB,KAAK,EAAE,CAClG,CAAA;QAED,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;QAElC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QACpB,OAAO;YACL,EAAE,EAAE,GAAG,CAAC,IAAI,CAAW;YACvB,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAW;YAC9B,IAAI,EAAG,GAAG,CAAC,MAAM,CAAmB,IAAI,IAAI;YAC5C,QAAQ,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAW,CAAC;SAC/C,CAAA;IACH,CAAC;IAED,OAAO;QACL,YAAY;QACZ,SAAS;QACT,SAAS;QACT,QAAQ;QACR,SAAS;QACT,YAAY;QACZ,eAAe,EAAE,iBAAiB;KACnC,CAAA;AACH,CAAC"}