pipework 0.8.6 → 0.8.8

package/dist/audit/emit.d.ts

@@ -0,0 +1,3 @@
+import type { AuditConfig, Audit } from './types.js';
+export declare function createAudit(config: AuditConfig): Audit;
+//# sourceMappingURL=emit.d.ts.map

package/dist/audit/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAoB,KAAK,EAAE,MAAM,YAAY,CAAA;AAItE,wBAAgB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,KAAK,CAyEtD"}

package/dist/audit/emit.js

@@ -0,0 +1,66 @@
+import { sql } from '../db/sql.js';
+import { getContext } from '../context/store.js';
+import { assertValidIdentifier, quoteIdentifier } from '../db/identifiers.js';
+export function createAudit(config) {
+    const table = config.table ?? 'pipework_audit_events';
+    assertValidIdentifier(table, 'audit table');
+    return {
+        async emit(options) {
+            const ctx = getContext();
+            if (!ctx) {
+                throw new Error('[pipework] audit.emit() called outside a managed context. ' +
+                    'It must run inside a request handler or job.');
+            }
+            if (ctx.tenant === null) {
+                throw new Error('[pipework] audit.emit() requires tenant context. ' +
+                    'Configure tenant extraction in createServer().');
+            }
+            if (ctx.auth === null) {
+                throw new Error('[pipework] audit.emit() requires authenticated context. ' +
+                    'Ensure the handler uses .auth() or the route is not .public().');
+            }
+            const userId = extractUserId(ctx.auth);
+            if (userId === null) {
+                throw new Error('[pipework] audit.emit() requires auth.userId. ' +
+                    'Ensure the auth object has a userId field.');
+            }
+            const bound = ctx.transactions.get(config.database);
+            if (!bound) {
+                throw new Error(`[pipework] audit.emit() requires an active transaction on database "${config.database}". ` +
+                    `Configure transactionPerRequest: ['${config.database}'] in createServer().`);
+            }
+            const tx = bound.drizzle;
+            const sessionId = config.sessionIdField !== undefined && typeof ctx.auth === 'object'
+                ? ctx.auth[config.sessionIdField] ?? null
+                : null;
+            const beforeJson = options.before !== undefined ? JSON.stringify(options.before) : null;
+            const afterJson = options.after !== undefined ? JSON.stringify(options.after) : null;
+            const metadataJson = options.metadata !== undefined ? JSON.stringify(options.metadata) : null;
+            const result = await tx.execute(sql `
+        INSERT INTO ${sql.raw(quoteIdentifier(table, 'audit table'))} (tenant_id, request_id, user_id, session_id, action_type, entity_type, entity_id, before_state, after_state, metadata)
+        VALUES (
+          ${ctx.tenant},
+          ${ctx.requestId},
+          ${userId},
+          ${sessionId ?? null},
+          ${options.actionType},
+          ${options.entityType ?? null},
+          ${options.entityId ?? null},
+          ${beforeJson !== null ? sql `${beforeJson}::jsonb` : sql `NULL`},
+          ${afterJson !== null ? sql `${afterJson}::jsonb` : sql `NULL`},
+          ${metadataJson !== null ? sql `${metadataJson}::jsonb` : sql `NULL`}
+        )
+        RETURNING id::text
+      `);
+            return result[0].id;
+        },
+    };
+}
+function extractUserId(auth) {
+    if (auth !== null && auth !== undefined && typeof auth === 'object' && 'userId' in auth) {
+        const val = auth.userId;
+        return typeof val === 'string' ? val : null;
+    }
+    return null;
+}
+//# sourceMappingURL=emit.js.map

package/dist/audit/emit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.js","sourceRoot":"","sources":["../../src/audit/emit.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,cAAc,CAAA;AAElC,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAA;AAChD,OAAO,EAAE,qBAAqB,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAE7E,MAAM,UAAU,WAAW,CAAC,MAAmB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,uBAAuB,CAAA;IACrD,qBAAqB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAA;IAE3C,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,OAAyB;YAClC,MAAM,GAAG,GAAG,UAAU,EAAE,CAAA;YACxB,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,IAAI,KAAK,CACb,4DAA4D;oBAC5D,8CAA8C,CAC/C,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,IAAI,KAAK,CACb,mDAAmD;oBACnD,gDAAgD,CACjD,CAAA;YACH,CAAC;YAED,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CACb,0DAA0D;oBAC1D,gEAAgE,CACjE,CAAA;YACH,CAAC;YAED,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;YACtC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,gDAAgD;oBAChD,4CAA4C,CAC7C,CAAA;YACH,CAAC;YAED,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAA;YACnD,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,KAAK,CACb,uEAAuE,MAAM,CAAC,QAAQ,KAAK;oBAC3F,sCAAsC,MAAM,CAAC,QAAQ,uBAAuB,CAC7E,CAAA;YACH,CAAC;YACD,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAA;YAExB,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;gBACnF,CAAC,CAAE,GAAG,CAAC,IAAgC,CAAC,MAAM,CAAC,cAAc,CAAkB,IAAI,IAAI;gBACvF,CAAC,CAAC,IAAI,CAAA;YAER,MAAM,UAAU,GAAG,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACvF,MAAM,SAAS,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YACpF,MAAM,YAAY,GAAG,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;YAE7F,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;sBACnB,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;;YAExD,GAAG,CAAC,MAAM;YACV,GAAG,CAAC,SAAS;YACb,MAAM;YACN,SAAS,IAAI,IAAI;YACjB,OAAO,CAAC,UAAU;YAClB,OAAO,CAAC,UAAU,IAAI,IAAI;YAC1B,OAAO,CAAC,QAAQ,IAAI,IAAI;YACxB,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,UAAU,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YAC3D,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,SAAS,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;YACzD,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAA,GAAG,YAAY,SAAS,CAAC,CAAC,CAAC,GAAG,CAAA,MAAM;;;OAGpE,CAAC,CAAA;YAEF,OAAQ,MAAM,CAAC,CAAC,CAAoB,CAAC,EAAE,CAAA;QACzC,CAAC;KACF,CAAA;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;QACxF,MAAM,GAAG,GAAI,IAA4B,CAAC,MAAM,CAAA;QAChD,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;IAC7C,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,3 @@
+export type { AuditConfig, AuditEmitOptions, Audit } from './types.js';
+export { createAudit } from './emit.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,WAAW,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,YAAY,CAAA;AACtE,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/index.js

@@ -0,0 +1,2 @@
+export { createAudit } from './emit.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA"}

package/dist/audit/namespace.d.ts

@@ -0,0 +1,7 @@
+import { createAudit } from './index.js';
+/** Audit logging namespace — structured audit trail for data changes. */
+export declare const audit: {
+    /** Creates an Audit instance that writes audit records to a Postgres table. */
+    create: typeof createAudit;
+};
+//# sourceMappingURL=namespace.d.ts.map

package/dist/audit/namespace.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.d.ts","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,yEAAyE;AACzE,eAAO,MAAM,KAAK;IAChB,+EAA+E;;CAEhF,CAAA"}

package/dist/audit/namespace.js

@@ -0,0 +1,7 @@
+import { createAudit } from './index.js';
+/** Audit logging namespace — structured audit trail for data changes. */
+export const audit = {
+    /** Creates an Audit instance that writes audit records to a Postgres table. */
+    create: createAudit,
+};
+//# sourceMappingURL=namespace.js.map

package/dist/audit/namespace.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"namespace.js","sourceRoot":"","sources":["../../src/audit/namespace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAExC,yEAAyE;AACzE,MAAM,CAAC,MAAM,KAAK,GAAG;IACnB,+EAA+E;IAC/E,MAAM,EAAE,WAAW;CACpB,CAAA"}

package/dist/audit/schema/audit-record-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-record-fields.d.ts","sourceRoot":"","sources":["../../../src/audit/schema/audit-record-fields.ts"],"names":[],"mappings":"AAkBA,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;CAgC7B,CAAA"}
+{"version":3,"file":"audit-record-fields.d.ts","sourceRoot":"","sources":["../../../src/audit/schema/audit-record-fields.ts"],"names":[],"mappings":"AAoBA,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;CAiC7B,CAAA"}

package/dist/audit/schema/audit-record-fields.js

@@ -14,18 +14,21 @@
 // to join. `occurredAt` records when the operation completed.
 import { field } from '../../data/domain/index.js';
 import { schema } from '../../data/schema/namespace.js';
+import { trace } from '../../trace/schema/trace.js';
+import { traceStep } from '../../trace/schema/trace-step.js';
 export const auditRecordFields = {
     id: field.uuid().brand('AuditRecordId').defaultRandom(),
     // Partition key — the parent trace's `openedDay`. The audit row files under
     // the same calendar day as its trace step; retention is independent of
     // trace storage so the partition can outlive the trace it came from.
     traceDay: field.date(),
-    // The trace this audit row was emitted under. No foreign key: trace's
+    // Logical reference to the originating trace. `enforced: false` means the
+    // brand is inherited (TraceId) but no FK constraint is emitted — trace's
     // partition can retire while the audit row is still in retention.
-    traceId: field.uuid().brand('TraceId'),
-    // The specific flow step the row was emitted from. Same retention argument
-    // as `traceId` — plain uuid, no FK.
-    traceStepId: field.uuid().brand('TraceStepId'),
+    traceId: field.uuid().references(trace, 'id', { enforced: false }),
+    // Logical reference to the originating trace step. Same retention argument
+    // as `traceId` — branded TraceStepId without an enforced FK.
+    traceStepId: field.uuid().references(traceStep, 'id', { enforced: false }),
     tenantId: field.uuid().tenant().nullable(),
     // The user who performed the action. Null for system-actor traces (cron,
     // worker-claimed jobs without an auth principal). Plain text, not branded —

package/dist/audit/schema/audit-record-fields.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-record-fields.js","sourceRoot":"","sources":["../../../src/audit/schema/audit-record-fields.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,wBAAwB;AACxB,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AAEvD,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE;IACvD,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,sEAAsE;IACtE,kEAAkE;IAClE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC;IACtC,2EAA2E;IAC3E,oCAAoC;IACpC,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC;IAC9C,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;IAClB,2EAA2E;IAC3E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,8BAA8B;IAC9B,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE;CAC9B,CAAA"}
+{"version":3,"file":"audit-record-fields.js","sourceRoot":"","sources":["../../../src/audit/schema/audit-record-fields.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAC3E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,4EAA4E;AAC5E,2EAA2E;AAC3E,wBAAwB;AACxB,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,oEAAoE;AACpE,0EAA0E;AAC1E,2EAA2E;AAC3E,8DAA8D;AAE9D,OAAO,EAAE,KAAK,EAAE,MAAM,4BAA4B,CAAA;AAClD,OAAO,EAAE,MAAM,EAAE,MAAM,gCAAgC,CAAA;AACvD,OAAO,EAAE,KAAK,EAAE,MAAM,6BAA6B,CAAA;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,kCAAkC,CAAA;AAE5D,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC/B,EAAE,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,aAAa,EAAE;IACvD,4EAA4E;IAC5E,uEAAuE;IACvE,qEAAqE;IACrE,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE;IACtB,0EAA0E;IAC1E,yEAAyE;IACzE,kEAAkE;IAClE,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAClE,2EAA2E;IAC3E,6DAA6D;IAC7D,WAAW,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC1E,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC1C,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,OAAO,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,QAAQ,EAAE;IAChC,0EAA0E;IAC1E,2DAA2D;IAC3D,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE;IACpB,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;IAClB,2EAA2E;IAC3E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACnD,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAClD,4EAA4E;IAC5E,4EAA4E;IAC5E,0EAA0E;IAC1E,8BAA8B;IAC9B,cAAc,EAAE,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IAC3D,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE;CAC9B,CAAA"}

package/dist/audit/schema/audit-record.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"audit-record.d.ts","sourceRoot":"","sources":["../../../src/audit/schema/audit-record.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,WAAW;;;;;;;;;;;;;EAGtB,CAAA"}
+{"version":3,"file":"audit-record.d.ts","sourceRoot":"","sources":["../../../src/audit/schema/audit-record.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,WAAW;;;;;;;;;;;;;EAGtB,CAAA"}

package/dist/audit/schema/audit-record.js

@@ -1,8 +1,9 @@
 // The `audit_record` table — durable per-(entity × affected row) audit
 // projection. RANGE-partitioned by `traceDay`; retention is independent of
-// the trace tables (long / indefinite, configured separately). No foreign
-// key to `trace` — the audit partition is free to outlive its source trace
-// partition.
+// the trace tables (long / indefinite, configured separately). The `traceId`
+// and `traceStepId` columns declare a logical reference (`enforced: false`)
+// to inherit the TraceId/TraceStepId brands without emitting an FK — the
+// audit partition is free to outlive its source trace partition.
 import { define } from '../../data/domain/index.js';
 import { auditRecordFields } from './audit-record-fields.js';
 export const auditRecord = define('audit_record', auditRecordFields, {

package/dist/audit/schema/audit-record.js.map

@@ -1 +1 @@
-{"version":3,"file":"audit-record.js","sourceRoot":"","sources":["../../../src/audit/schema/audit-record.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,0EAA0E;AAC1E,2EAA2E;AAC3E,aAAa;AAEb,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;IAC9B,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;CACvD,CAAC,CAAA"}
+{"version":3,"file":"audit-record.js","sourceRoot":"","sources":["../../../src/audit/schema/audit-record.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,2EAA2E;AAC3E,6EAA6E;AAC7E,4EAA4E;AAC5E,yEAAyE;AACzE,iEAAiE;AAEjE,OAAO,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAA;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAA;AAE5D,MAAM,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,EAAE,iBAAiB,EAAE;IACnE,UAAU,EAAE,CAAC,IAAI,EAAE,UAAU,CAAC;IAC9B,WAAW,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE;CACvD,CAAC,CAAA"}

package/dist/audit/types.d.ts

@@ -0,0 +1,17 @@
+export interface AuditConfig {
+    readonly database: string;
+    readonly table?: string;
+    readonly sessionIdField?: string;
+}
+export interface AuditEmitOptions {
+    readonly actionType: string;
+    readonly entityType?: string;
+    readonly entityId?: string;
+    readonly before?: unknown;
+    readonly after?: unknown;
+    readonly metadata?: Record<string, unknown>;
+}
+export interface Audit {
+    emit(options: AuditEmitOptions): Promise<string>;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAA;CACjC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;IAC3B,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAC5C;AAED,MAAM,WAAW,KAAK;IACpB,IAAI,CAAC,OAAO,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CACjD"}

package/dist/audit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":""}

package/dist/auth/chain.d.ts

@@ -0,0 +1,26 @@
+import type { AuthStrategy, AuthRequest, AuthContext } from './types.js';
+/** Post-authentication hook — enrich the resolved auth with additional data (roles, permissions, etc.). */
+export interface AuthEnricher<TAuth> {
+    readonly name: string;
+    enrich(auth: TAuth): Promise<TAuth>;
+}
+/** Resolves tenant ID from auth context — called after authentication in the chain. */
+export interface TenantResolver<TAuth> {
+    resolve(auth: TAuth): string;
+}
+/** Configuration for the auth chain — strategies, enrichers, tenant resolver. */
+export interface AuthChainConfig<TAuth> {
+    readonly strategies: readonly AuthStrategy<TAuth>[];
+    readonly enrichers?: readonly AuthEnricher<TAuth>[];
+    readonly tenantResolver?: TenantResolver<TAuth>;
+}
+/** Result of running the auth chain — resolved auth and tenant (both nullable for public routes). */
+export interface AuthChainResult<TAuth> {
+    readonly auth: TAuth | null;
+    readonly tenant: string | null;
+}
+/** Executes the auth chain: tries strategies in order, enriches, resolves tenant. */
+export declare function runAuthChain<TAuth>(config: AuthChainConfig<TAuth>, request: AuthRequest, options: {
+    optional: boolean;
+}, context: AuthContext): Promise<AuthChainResult<TAuth>>;
+//# sourceMappingURL=chain.d.ts.map

package/dist/auth/chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.d.ts","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,YAAY,CAAA;AAGxE,2GAA2G;AAC3G,MAAM,WAAW,YAAY,CAAC,KAAK;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,MAAM,CAAC,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;CACpC;AAED,uFAAuF;AACvF,MAAM,WAAW,cAAc,CAAC,KAAK;IACnC,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,MAAM,CAAA;CAC7B;AAED,iFAAiF;AACjF,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,UAAU,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,YAAY,CAAC,KAAK,CAAC,EAAE,CAAA;IACnD,QAAQ,CAAC,cAAc,CAAC,EAAE,cAAc,CAAC,KAAK,CAAC,CAAA;CAChD;AAED,qGAAqG;AACrG,MAAM,WAAW,eAAe,CAAC,KAAK;IACpC,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED,qFAAqF;AACrF,wBAAsB,YAAY,CAAC,KAAK,EACtC,MAAM,EAAE,eAAe,CAAC,KAAK,CAAC,EAC9B,OAAO,EAAE,WAAW,EACpB,OAAO,EAAE;IAAE,QAAQ,EAAE,OAAO,CAAA;CAAE,EAC9B,OAAO,EAAE,WAAW,GACnB,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAqCjC"}

package/dist/auth/chain.js

@@ -0,0 +1,46 @@
+import { UnauthorizedError } from '../errors/index.js';
+/** Executes the auth chain: tries strategies in order, enriches, resolves tenant. */
+export async function runAuthChain(config, request, options, context) {
+    let extracted = null;
+    let matchedStrategy = null;
+    for (const strategy of config.strategies) {
+        extracted = await strategy.extract(request, context);
+        if (extracted !== null) {
+            matchedStrategy = strategy;
+            break;
+        }
+    }
+    if (extracted === null) {
+        if (options.optional)
+            return { auth: null, tenant: null };
+        throw new UnauthorizedError();
+    }
+    let auth;
+    try {
+        auth = await matchedStrategy.verify(extracted, context);
+    }
+    catch (error) {
+        if (error instanceof UnauthorizedError)
+            throw error;
+        throw new UnauthorizedError('Authentication failed', {
+            strategy: matchedStrategy.name,
+            cause: error instanceof Error ? error.message : String(error),
+        });
+    }
+    if (config.enrichers) {
+        for (const enricher of config.enrichers) {
+            auth = await enricher.enrich(auth);
+        }
+    }
+    const tenant = config.tenantResolver ? config.tenantResolver.resolve(auth) : extractTenant(auth);
+    return { auth, tenant };
+}
+function extractTenant(auth) {
+    if (auth !== null && typeof auth === 'object' && 'tenantId' in auth) {
+        const tenantId = auth.tenantId;
+        if (typeof tenantId === 'string')
+            return tenantId;
+    }
+    return null;
+}
+//# sourceMappingURL=chain.js.map

package/dist/auth/chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chain.js","sourceRoot":"","sources":["../../src/auth/chain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAA;AA0BtD,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAA8B,EAC9B,OAAoB,EACpB,OAA8B,EAC9B,OAAoB;IAEpB,IAAI,SAAS,GAAiB,IAAI,CAAA;IAClC,IAAI,eAAe,GAA+B,IAAI,CAAA;IAEtD,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;QACzC,SAAS,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QACpD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;YACvB,eAAe,GAAG,QAAQ,CAAA;YAC1B,MAAK;QACP,CAAC;IACH,CAAC;IAED,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAA;QACzD,MAAM,IAAI,iBAAiB,EAAE,CAAA;IAC/B,CAAC;IAED,IAAI,IAAW,CAAA;IACf,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,eAAgB,CAAC,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IAC1D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,YAAY,iBAAiB;YAAE,MAAM,KAAK,CAAA;QACnD,MAAM,IAAI,iBAAiB,CAAC,uBAAuB,EAAE;YACnD,QAAQ,EAAE,eAAgB,CAAC,IAAI;YAC/B,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAA;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;QACrB,KAAK,MAAM,QAAQ,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACxC,IAAI,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,CAAC,CAAA;IAEhG,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QACpE,MAAM,QAAQ,GAAI,IAA8B,CAAC,QAAQ,CAAA;QACzD,IAAI,OAAO,QAAQ,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAA;IACnD,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC"}

package/dist/auth/cookie.d.ts

@@ -0,0 +1,24 @@
+/** Cookie configuration for token delivery — name, domain, path, secure, sameSite, httpOnly. */
+export interface CookieConfig {
+    readonly name?: string;
+    readonly secure?: 'auto' | boolean;
+    readonly sameSite?: 'strict' | 'lax' | 'none';
+    readonly path?: string;
+}
+/** CookieConfig with all defaults resolved — every field is required. */
+export interface ResolvedCookieConfig {
+    readonly name: string;
+    readonly secure: boolean;
+    readonly sameSite: string;
+    readonly path: string;
+    readonly httpOnly: true;
+}
+/** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
+export declare function resolveCookieConfig(cookie: CookieConfig, env: string): ResolvedCookieConfig;
+/** Builds a Set-Cookie header string from name, value, and resolved config. */
+export declare function buildSetCookieHeader(resolved: ResolvedCookieConfig, value: string, maxAge: number): string;
+/** Builds a Set-Cookie header that expires (clears) a cookie. */
+export declare function buildClearCookieHeader(resolved: ResolvedCookieConfig): string;
+/** Parses a Cookie header string into a Record of key-value pairs. */
+export declare function parseCookieHeader(header: string | undefined, name: string): string | undefined;
+//# sourceMappingURL=cookie.d.ts.map

package/dist/auth/cookie.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.d.ts","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAAA,gGAAgG;AAChG,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IAC7C,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,yEAAyE;AACzE,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAA;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,wFAAwF;AACxF,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,GAAG,oBAAoB,CAY3F;AAED,+EAA+E;AAC/E,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,oBAAoB,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,CAU1G;AAED,iEAAiE;AACjE,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,oBAAoB,GAAG,MAAM,CAU7E;AAED,sEAAsE;AACtE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAY9F"}

package/dist/auth/cookie.js

@@ -0,0 +1,59 @@
+/** Resolves a partial CookieConfig into a ResolvedCookieConfig with secure defaults. */
+export function resolveCookieConfig(cookie, env) {
+    const secure = cookie.secure === 'auto' || cookie.secure === undefined
+        ? env === 'production'
+        : cookie.secure;
+    return {
+        name: cookie.name ?? '__pipework_refresh',
+        secure,
+        sameSite: cookie.sameSite ?? 'strict',
+        path: cookie.path ?? '/',
+        httpOnly: true,
+    };
+}
+/** Builds a Set-Cookie header string from name, value, and resolved config. */
+export function buildSetCookieHeader(resolved, value, maxAge) {
+    const parts = [
+        `${resolved.name}=${encodeURIComponent(value)}`,
+        `HttpOnly`,
+        `Path=${resolved.path}`,
+        `Max-Age=${maxAge}`,
+        `SameSite=${capitalize(resolved.sameSite)}`,
+    ];
+    if (resolved.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+/** Builds a Set-Cookie header that expires (clears) a cookie. */
+export function buildClearCookieHeader(resolved) {
+    const parts = [
+        `${resolved.name}=`,
+        `HttpOnly`,
+        `Path=${resolved.path}`,
+        `Max-Age=0`,
+        `SameSite=${capitalize(resolved.sameSite)}`,
+    ];
+    if (resolved.secure)
+        parts.push('Secure');
+    return parts.join('; ');
+}
+/** Parses a Cookie header string into a Record of key-value pairs. */
+export function parseCookieHeader(header, name) {
+    if (header === undefined)
+        return undefined;
+    for (const pair of header.split(';')) {
+        const trimmed = pair.trim();
+        const eqIdx = trimmed.indexOf('=');
+        if (eqIdx === -1)
+            continue;
+        const key = trimmed.slice(0, eqIdx).trim();
+        if (key === name) {
+            return decodeURIComponent(trimmed.slice(eqIdx + 1).trim());
+        }
+    }
+    return undefined;
+}
+function capitalize(s) {
+    return s.charAt(0).toUpperCase() + s.slice(1);
+}
+//# sourceMappingURL=cookie.js.map

package/dist/auth/cookie.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie.js","sourceRoot":"","sources":["../../src/auth/cookie.ts"],"names":[],"mappings":"AAiBA,wFAAwF;AACxF,MAAM,UAAU,mBAAmB,CAAC,MAAoB,EAAE,GAAW;IACnE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QACpE,CAAC,CAAC,GAAG,KAAK,YAAY;QACtB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAA;IAEjB,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,oBAAoB;QACzC,MAAM;QACN,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,GAAG;QACxB,QAAQ,EAAE,IAAI;KACf,CAAA;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB,CAAC,QAA8B,EAAE,KAAa,EAAE,MAAc;IAChG,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC/C,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW,MAAM,EAAE;QACnB,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,sBAAsB,CAAC,QAA8B;IACnE,MAAM,KAAK,GAAG;QACZ,GAAG,QAAQ,CAAC,IAAI,GAAG;QACnB,UAAU;QACV,QAAQ,QAAQ,CAAC,IAAI,EAAE;QACvB,WAAW;QACX,YAAY,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE;KAC5C,CAAA;IACD,IAAI,QAAQ,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,MAA0B,EAAE,IAAY;IACxE,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAA;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC1C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,OAAO,kBAAkB,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAA;AAClB,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;AAC/C,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,10 @@
+export type { AuthStrategy, AuthRequest, AuthContext, BaseAuth } from './types.js';
+export { runAuthChain } from './chain.js';
+export type { AuthEnricher, TenantResolver, AuthChainConfig, AuthChainResult } from './chain.js';
+export { createSessions } from './sessions.js';
+export type { Sessions, SessionConfig, TokenPair, TokenPayload, HttpTokenResult, HttpRequest, HttpResponse } from './sessions.js';
+export type { CookieConfig, ResolvedCookieConfig } from './cookie.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+export type { MultiOrgConfig, MultiOrgSessions, ResolveLoginResult, AuthenticatedResult, OrgSelectResult, OrgMembership, OrgInfo, OrgMembershipDetail } from './multi-org.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAA;AAClF,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AACzC,YAAY,EAAE,YAAY,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAA;AAChG,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAC9C,YAAY,EAAE,QAAQ,EAAE,aAAa,EAAE,SAAS,EAAE,YAAY,EAAE,eAAe,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AACjI,YAAY,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA;AACvD,YAAY,EAAE,cAAc,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,5 @@
+export { runAuthChain } from './chain.js';
+export { createSessions } from './sessions.js';
+export { resolveCookieConfig, buildSetCookieHeader, buildClearCookieHeader, parseCookieHeader } from './cookie.js';
+export { createMultiOrgSessions } from './multi-org.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAA;AAEzC,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AAG9C,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAClH,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAA"}

package/dist/auth/multi-org.d.ts

@@ -0,0 +1,77 @@
+import type { DB } from '../db/index.js';
+import type { Sessions, HttpResponse, HttpRequest, HttpTokenResult } from './sessions.js';
+/** Configuration for multi-org sessions — base sessions, signing keys, org-select token TTL. */
+export interface MultiOrgConfig {
+    readonly sessions: Sessions;
+    readonly signing: {
+        algorithm: 'ES256';
+        privateKey: string;
+        publicKey: string;
+    };
+    readonly issuer: string;
+    readonly audience: string;
+    readonly orgSelectToken?: {
+        readonly expiresIn?: string;
+    };
+    readonly table?: string;
+    readonly resolveOrgNames?: (db: DB, orgIds: string[]) => Promise<Map<string, string>>;
+}
+/** A user's membership in an organization — userId, orgId, role. */
+export interface OrgMembership {
+    readonly id: string;
+    readonly orgId: string;
+    readonly role: string | null;
+    readonly joinedAt: Date;
+}
+/** Basic organization info — id and display name. */
+export interface OrgInfo {
+    readonly id: string;
+    readonly name: string;
+}
+/** Organization membership with display name — extends OrgMembership with org info. */
+export interface OrgMembershipDetail {
+    readonly id: string;
+    readonly name: string;
+    readonly role: string | null;
+}
+/** Result when user has exactly one org — direct authentication, no org selection needed. */
+export interface AuthenticatedResult {
+    readonly type: 'authenticated';
+    readonly accessToken: string;
+    readonly expiresIn: number;
+}
+/** Result when user has multiple orgs — returns a session token for org selection. */
+export interface OrgSelectResult {
+    readonly type: 'org_select';
+    readonly sessionToken: string;
+    readonly orgs: readonly OrgInfo[];
+}
+/** Union result from resolveLogin() — either AuthenticatedResult or OrgSelectResult. */
+export type ResolveLoginResult = AuthenticatedResult | OrgSelectResult;
+/** Multi-org session manager — login resolution, org selection, switching, membership CRUD. */
+export interface MultiOrgSessions {
+    resolveLogin(response: HttpResponse, db: DB, user: {
+        id: string;
+    }): Promise<ResolveLoginResult>;
+    selectOrg(response: HttpResponse, db: DB, sessionToken: string, orgId: string): Promise<HttpTokenResult>;
+    switchOrg(response: HttpResponse, db: DB, request: HttpRequest, orgId: string, userId: string): Promise<HttpTokenResult>;
+    listOrgs(db: DB, userId: string): Promise<{
+        orgs: readonly OrgMembershipDetail[];
+    }>;
+    addMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+        role?: string;
+        addedBy?: string;
+    }): Promise<{
+        id: string;
+    }>;
+    removeMember(db: DB, params: {
+        userId: string;
+        orgId: string;
+    }): Promise<void>;
+    checkMembership(db: DB, userId: string, orgId: string): Promise<OrgMembership | null>;
+}
+/** Creates a multi-org session manager with org selection flow and membership management. */
+export declare function createMultiOrgSessions(config: MultiOrgConfig): MultiOrgSessions;
+//# sourceMappingURL=multi-org.d.ts.map

package/dist/auth/multi-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"multi-org.d.ts","sourceRoot":"","sources":["../../src/auth/multi-org.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,gBAAgB,CAAA;AAGxC,OAAO,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAEzF,gGAAgG;AAChG,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,OAAO,EAAE;QAAE,SAAS,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAA;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;IACzB,QAAQ,CAAC,cAAc,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACzD,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;IACvB,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAA;CACtF;AAED,oEAAoE;AACpE,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAA;CACxB;AAED,qDAAqD;AACrD,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CACtB;AAED,uFAAuF;AACvF,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAC3B;AAED,sFAAsF;AACtF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,CAAA;CAClC;AAED,wFAAwF;AACxF,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,GAAG,eAAe,CAAA;AAEtE,+FAA+F;AAC/F,MAAM,WAAW,gBAAgB;IAC/B,YAAY,CACV,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GACnB,OAAO,CAAC,kBAAkB,CAAC,CAAA;IAE9B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,SAAS,CACP,QAAQ,EAAE,YAAY,EACtB,EAAE,EAAE,EAAE,EACN,OAAO,EAAE,WAAW,EACpB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,eAAe,CAAC,CAAA;IAE3B,QAAQ,CACN,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,SAAS,mBAAmB,EAAE,CAAA;KAAE,CAAC,CAAA;IAEpD,SAAS,CACP,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GACzE,OAAO,CAAC;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAE1B,YAAY,CACV,EAAE,EAAE,EAAE,EACN,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GACxC,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhB,eAAe,CACb,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAA;CACjC;AAED,6FAA6F;AAC7F,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,cAAc,GAAG,gBAAgB,CAoO/E"}