@adatechnology/user-contracts 0.1.0-rc.1

package/dist/index.cjs

@@ -0,0 +1,295 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  AUTH_PROVIDER_TYPE: () => AUTH_PROVIDER_TYPE,
+  ConfigMissingError: () => ConfigMissingError,
+  EmailAlreadyExistsError: () => EmailAlreadyExistsError,
+  InvalidCredentialsError: () => InvalidCredentialsError,
+  NotAuthenticatedError: () => NotAuthenticatedError,
+  ProviderDisabledError: () => ProviderDisabledError,
+  ProviderMisconfiguredError: () => ProviderMisconfiguredError,
+  ResetTokenAlreadyUsedError: () => ResetTokenAlreadyUsedError,
+  ResetTokenExpiredError: () => ResetTokenExpiredError,
+  ResetTokenInvalidError: () => ResetTokenInvalidError,
+  USER_ERROR_CODE: () => USER_ERROR_CODE,
+  USER_EVENT: () => USER_EVENT,
+  UserError: () => UserError,
+  UserNotFoundError: () => UserNotFoundError,
+  WeakPasswordError: () => WeakPasswordError,
+  confirmPasswordResetSchema: () => confirmPasswordResetSchema,
+  createUserSchema: () => createUserSchema,
+  keycloakCallbackSchema: () => keycloakCallbackSchema,
+  localCredentialsSchema: () => localCredentialsSchema,
+  requestPasswordResetSchema: () => requestPasswordResetSchema,
+  updateProfileSchema: () => updateProfileSchema
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var USER_ERROR_CODE = {
+  INVALID_CREDENTIALS: "USER_INVALID_CREDENTIALS",
+  USER_NOT_FOUND: "USER_NOT_FOUND",
+  EMAIL_ALREADY_EXISTS: "USER_EMAIL_ALREADY_EXISTS",
+  NOT_AUTHENTICATED: "USER_NOT_AUTHENTICATED",
+  RESET_TOKEN_INVALID: "USER_RESET_TOKEN_INVALID",
+  RESET_TOKEN_EXPIRED: "USER_RESET_TOKEN_EXPIRED",
+  RESET_TOKEN_ALREADY_USED: "USER_RESET_TOKEN_ALREADY_USED",
+  WEAK_PASSWORD: "USER_WEAK_PASSWORD",
+  PROVIDER_MISCONFIGURED: "USER_PROVIDER_MISCONFIGURED",
+  PROVIDER_DISABLED: "USER_PROVIDER_DISABLED",
+  CONFIG_MISSING: "USER_CONFIG_MISSING"
+};
+var UserError = class extends Error {
+  static {
+    __name(this, "UserError");
+  }
+  statusCode;
+  code;
+  details;
+  constructor(params) {
+    super(params.message);
+    this.name = "UserError";
+    this.statusCode = params.statusCode;
+    this.code = params.code;
+    this.details = params.details;
+  }
+};
+var InvalidCredentialsError = class extends UserError {
+  static {
+    __name(this, "InvalidCredentialsError");
+  }
+  constructor() {
+    super({
+      message: "Invalid credentials",
+      statusCode: 401,
+      code: USER_ERROR_CODE.INVALID_CREDENTIALS
+    });
+    this.name = "InvalidCredentialsError";
+  }
+};
+var UserNotFoundError = class extends UserError {
+  static {
+    __name(this, "UserNotFoundError");
+  }
+  constructor() {
+    super({
+      message: "User not found",
+      statusCode: 404,
+      code: USER_ERROR_CODE.USER_NOT_FOUND
+    });
+    this.name = "UserNotFoundError";
+  }
+};
+var EmailAlreadyExistsError = class extends UserError {
+  static {
+    __name(this, "EmailAlreadyExistsError");
+  }
+  constructor() {
+    super({
+      message: "Email already exists",
+      statusCode: 409,
+      code: USER_ERROR_CODE.EMAIL_ALREADY_EXISTS
+    });
+    this.name = "EmailAlreadyExistsError";
+  }
+};
+var NotAuthenticatedError = class extends UserError {
+  static {
+    __name(this, "NotAuthenticatedError");
+  }
+  constructor() {
+    super({
+      message: "Not authenticated",
+      statusCode: 401,
+      code: USER_ERROR_CODE.NOT_AUTHENTICATED
+    });
+    this.name = "NotAuthenticatedError";
+  }
+};
+var ResetTokenInvalidError = class extends UserError {
+  static {
+    __name(this, "ResetTokenInvalidError");
+  }
+  constructor() {
+    super({
+      message: "Invalid reset token",
+      statusCode: 400,
+      code: USER_ERROR_CODE.RESET_TOKEN_INVALID
+    });
+    this.name = "ResetTokenInvalidError";
+  }
+};
+var ResetTokenExpiredError = class extends UserError {
+  static {
+    __name(this, "ResetTokenExpiredError");
+  }
+  constructor() {
+    super({
+      message: "Reset token expired",
+      statusCode: 400,
+      code: USER_ERROR_CODE.RESET_TOKEN_EXPIRED
+    });
+    this.name = "ResetTokenExpiredError";
+  }
+};
+var ResetTokenAlreadyUsedError = class extends UserError {
+  static {
+    __name(this, "ResetTokenAlreadyUsedError");
+  }
+  constructor() {
+    super({
+      message: "Reset token already used",
+      statusCode: 400,
+      code: USER_ERROR_CODE.RESET_TOKEN_ALREADY_USED
+    });
+    this.name = "ResetTokenAlreadyUsedError";
+  }
+};
+var WeakPasswordError = class extends UserError {
+  static {
+    __name(this, "WeakPasswordError");
+  }
+  constructor() {
+    super({
+      message: "Password does not meet security requirements",
+      statusCode: 400,
+      code: USER_ERROR_CODE.WEAK_PASSWORD
+    });
+    this.name = "WeakPasswordError";
+  }
+};
+var ProviderMisconfiguredError = class extends UserError {
+  static {
+    __name(this, "ProviderMisconfiguredError");
+  }
+  constructor(details) {
+    super({
+      message: "Authentication provider is misconfigured",
+      statusCode: 500,
+      code: USER_ERROR_CODE.PROVIDER_MISCONFIGURED,
+      details
+    });
+    this.name = "ProviderMisconfiguredError";
+  }
+};
+var ProviderDisabledError = class extends UserError {
+  static {
+    __name(this, "ProviderDisabledError");
+  }
+  constructor() {
+    super({
+      message: "Authentication provider is not available",
+      statusCode: 503,
+      code: USER_ERROR_CODE.PROVIDER_DISABLED
+    });
+    this.name = "ProviderDisabledError";
+  }
+};
+var ConfigMissingError = class extends UserError {
+  static {
+    __name(this, "ConfigMissingError");
+  }
+  constructor(field) {
+    super({
+      message: `Missing required configuration: ${field}`,
+      statusCode: 500,
+      code: USER_ERROR_CODE.CONFIG_MISSING,
+      details: {
+        field
+      }
+    });
+    this.name = "ConfigMissingError";
+  }
+};
+
+// src/events.ts
+var USER_EVENT = {
+  USER_CREATED: "user.user.created",
+  USER_UPDATED: "user.user.updated",
+  LOGIN_SUCCEEDED: "user.login.succeeded",
+  LOGIN_FAILED: "user.login.failed",
+  PASSWORD_CHANGED: "user.password.changed",
+  PASSWORD_RESET_REQUESTED: "user.password_reset.requested",
+  PASSWORD_RESET_COMPLETED: "user.password_reset.completed",
+  PROFILE_UPDATED: "user.profile.updated"
+};
+
+// src/providers.ts
+var AUTH_PROVIDER_TYPE = {
+  LOCAL: "local",
+  OAUTH2: "oauth2",
+  OIDC: "oidc"
+};
+
+// src/schemas.ts
+var import_zod = require("zod");
+var PASSWORD_MIN_LENGTH = 8;
+var PASSWORD_MAX_LENGTH = 128;
+var localCredentialsSchema = import_zod.z.object({
+  email: import_zod.z.string().trim().toLowerCase().email().max(320),
+  password: import_zod.z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH)
+});
+var requestPasswordResetSchema = import_zod.z.object({
+  email: import_zod.z.string().trim().toLowerCase().email().max(320)
+});
+var confirmPasswordResetSchema = import_zod.z.object({
+  token: import_zod.z.string().min(1),
+  newPassword: import_zod.z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH)
+});
+var updateProfileSchema = import_zod.z.object({
+  name: import_zod.z.string().trim().min(1).max(255).optional()
+});
+var createUserSchema = import_zod.z.object({
+  email: import_zod.z.string().trim().toLowerCase().email().max(320),
+  name: import_zod.z.string().trim().min(1).max(255),
+  password: import_zod.z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),
+  role: import_zod.z.string().min(1).max(40)
+});
+var keycloakCallbackSchema = import_zod.z.object({
+  accessToken: import_zod.z.string().min(1)
+});
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  AUTH_PROVIDER_TYPE,
+  ConfigMissingError,
+  EmailAlreadyExistsError,
+  InvalidCredentialsError,
+  NotAuthenticatedError,
+  ProviderDisabledError,
+  ProviderMisconfiguredError,
+  ResetTokenAlreadyUsedError,
+  ResetTokenExpiredError,
+  ResetTokenInvalidError,
+  USER_ERROR_CODE,
+  USER_EVENT,
+  UserError,
+  UserNotFoundError,
+  WeakPasswordError,
+  confirmPasswordResetSchema,
+  createUserSchema,
+  keycloakCallbackSchema,
+  localCredentialsSchema,
+  requestPasswordResetSchema,
+  updateProfileSchema
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/events.ts","../src/providers.ts","../src/schemas.ts"],"sourcesContent":["/**\n * Copyright (c) 2026 Ada Technology. All rights reserved.\n *\n * This source code is proprietary and confidential. Unauthorized copying,\n * modification, distribution, or use of this file, via any medium, is\n * strictly prohibited without prior written permission from Ada Technology.\n */\n\nexport * from './user.types'\nexport * from './errors'\nexport * from './events'\nexport * from './providers'\nexport * from './schemas'\n","/**\n * Copyright (c) 2026 Ada Technology. All rights reserved.\n *\n * This source code is proprietary and confidential. Unauthorized copying,\n * modification, distribution, or use of this file, via any medium, is\n * strictly prohibited without prior written permission from Ada Technology.\n */\n\nexport const USER_ERROR_CODE = {\n  INVALID_CREDENTIALS: 'USER_INVALID_CREDENTIALS',\n  USER_NOT_FOUND: 'USER_NOT_FOUND',\n  EMAIL_ALREADY_EXISTS: 'USER_EMAIL_ALREADY_EXISTS',\n  NOT_AUTHENTICATED: 'USER_NOT_AUTHENTICATED',\n  RESET_TOKEN_INVALID: 'USER_RESET_TOKEN_INVALID',\n  RESET_TOKEN_EXPIRED: 'USER_RESET_TOKEN_EXPIRED',\n  RESET_TOKEN_ALREADY_USED: 'USER_RESET_TOKEN_ALREADY_USED',\n  WEAK_PASSWORD: 'USER_WEAK_PASSWORD',\n  PROVIDER_MISCONFIGURED: 'USER_PROVIDER_MISCONFIGURED',\n  PROVIDER_DISABLED: 'USER_PROVIDER_DISABLED',\n  CONFIG_MISSING: 'USER_CONFIG_MISSING',\n} as const\n\nexport type UserErrorCode = (typeof USER_ERROR_CODE)[keyof typeof USER_ERROR_CODE]\n\nexport class UserError extends Error {\n  readonly statusCode: number\n  readonly code: UserErrorCode\n  readonly details?: unknown\n\n  constructor(params: { message: string; statusCode: number; code: UserErrorCode; details?: unknown }) {\n    super(params.message)\n    this.name = 'UserError'\n    this.statusCode = params.statusCode\n    this.code = params.code\n    this.details = params.details\n  }\n}\n\nexport class InvalidCredentialsError extends UserError {\n  constructor() {\n    super({\n      message: 'Invalid credentials',\n      statusCode: 401,\n      code: USER_ERROR_CODE.INVALID_CREDENTIALS,\n    })\n    this.name = 'InvalidCredentialsError'\n  }\n}\n\nexport class UserNotFoundError extends UserError {\n  constructor() {\n    super({\n      message: 'User not found',\n      statusCode: 404,\n      code: USER_ERROR_CODE.USER_NOT_FOUND,\n    })\n    this.name = 'UserNotFoundError'\n  }\n}\n\nexport class EmailAlreadyExistsError extends UserError {\n  constructor() {\n    super({\n      message: 'Email already exists',\n      statusCode: 409,\n      code: USER_ERROR_CODE.EMAIL_ALREADY_EXISTS,\n    })\n    this.name = 'EmailAlreadyExistsError'\n  }\n}\n\nexport class NotAuthenticatedError extends UserError {\n  constructor() {\n    super({\n      message: 'Not authenticated',\n      statusCode: 401,\n      code: USER_ERROR_CODE.NOT_AUTHENTICATED,\n    })\n    this.name = 'NotAuthenticatedError'\n  }\n}\n\nexport class ResetTokenInvalidError extends UserError {\n  constructor() {\n    super({\n      message: 'Invalid reset token',\n      statusCode: 400,\n      code: USER_ERROR_CODE.RESET_TOKEN_INVALID,\n    })\n    this.name = 'ResetTokenInvalidError'\n  }\n}\n\nexport class ResetTokenExpiredError extends UserError {\n  constructor() {\n    super({\n      message: 'Reset token expired',\n      statusCode: 400,\n      code: USER_ERROR_CODE.RESET_TOKEN_EXPIRED,\n    })\n    this.name = 'ResetTokenExpiredError'\n  }\n}\n\nexport class ResetTokenAlreadyUsedError extends UserError {\n  constructor() {\n    super({\n      message: 'Reset token already used',\n      statusCode: 400,\n      code: USER_ERROR_CODE.RESET_TOKEN_ALREADY_USED,\n    })\n    this.name = 'ResetTokenAlreadyUsedError'\n  }\n}\n\nexport class WeakPasswordError extends UserError {\n  constructor() {\n    super({\n      message: 'Password does not meet security requirements',\n      statusCode: 400,\n      code: USER_ERROR_CODE.WEAK_PASSWORD,\n    })\n    this.name = 'WeakPasswordError'\n  }\n}\n\nexport class ProviderMisconfiguredError extends UserError {\n  constructor(details?: unknown) {\n    super({\n      message: 'Authentication provider is misconfigured',\n      statusCode: 500,\n      code: USER_ERROR_CODE.PROVIDER_MISCONFIGURED,\n      details,\n    })\n    this.name = 'ProviderMisconfiguredError'\n  }\n}\n\nexport class ProviderDisabledError extends UserError {\n  constructor() {\n    super({\n      message: 'Authentication provider is not available',\n      statusCode: 503,\n      code: USER_ERROR_CODE.PROVIDER_DISABLED,\n    })\n    this.name = 'ProviderDisabledError'\n  }\n}\n\nexport class ConfigMissingError extends UserError {\n  constructor(field: string) {\n    super({\n      message: `Missing required configuration: ${field}`,\n      statusCode: 500,\n      code: USER_ERROR_CODE.CONFIG_MISSING,\n      details: { field },\n    })\n    this.name = 'ConfigMissingError'\n  }\n}\n","/**\n * Copyright (c) 2026 Ada Technology. All rights reserved.\n *\n * This source code is proprietary and confidential. Unauthorized copying,\n * modification, distribution, or use of this file, via any medium, is\n * strictly prohibited without prior written permission from Ada Technology.\n */\n\nimport type { UserProfile } from './user.types'\n\nexport const USER_EVENT = {\n  USER_CREATED: 'user.user.created',\n  USER_UPDATED: 'user.user.updated',\n  LOGIN_SUCCEEDED: 'user.login.succeeded',\n  LOGIN_FAILED: 'user.login.failed',\n  PASSWORD_CHANGED: 'user.password.changed',\n  PASSWORD_RESET_REQUESTED: 'user.password_reset.requested',\n  PASSWORD_RESET_COMPLETED: 'user.password_reset.completed',\n  PROFILE_UPDATED: 'user.profile.updated',\n} as const\n\nexport type UserEventType = (typeof USER_EVENT)[keyof typeof USER_EVENT]\n\nexport type BaseEvent = {\n  readonly companyId?: string\n  readonly occurredAt: Date\n}\n\nexport type UserCreatedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.USER_CREATED\n  readonly userId: string\n  readonly email: string\n}\n\nexport type UserUpdatedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.USER_UPDATED\n  readonly userId: string\n  readonly user: UserProfile\n}\n\nexport type LoginSucceededEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.LOGIN_SUCCEEDED\n  readonly userId: string\n  readonly email: string\n  readonly ipAddress: string\n}\n\nexport type LoginFailedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.LOGIN_FAILED\n  readonly email: string\n  readonly ipAddress: string\n  readonly reason: string\n}\n\nexport type PasswordChangedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.PASSWORD_CHANGED\n  readonly userId: string\n}\n\nexport type PasswordResetRequestedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.PASSWORD_RESET_REQUESTED\n  readonly email: string\n  readonly resetUrl: string\n}\n\nexport type PasswordResetCompletedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.PASSWORD_RESET_COMPLETED\n  readonly userId: string\n  readonly email: string\n}\n\nexport type ProfileUpdatedEvent = BaseEvent & {\n  readonly type: typeof USER_EVENT.PROFILE_UPDATED\n  readonly userId: string\n  readonly user: UserProfile\n}\n\nexport type UserDomainEvent =\n  | UserCreatedEvent\n  | UserUpdatedEvent\n  | LoginSucceededEvent\n  | LoginFailedEvent\n  | PasswordChangedEvent\n  | PasswordResetRequestedEvent\n  | PasswordResetCompletedEvent\n  | ProfileUpdatedEvent\n\nexport type UserHooks = {\n  readonly onUserCreated?: (event: UserCreatedEvent) => Promise<void> | void\n  readonly onUserUpdated?: (event: UserUpdatedEvent) => Promise<void> | void\n  readonly onLoginSucceeded?: (event: LoginSucceededEvent) => Promise<void> | void\n  readonly onLoginFailed?: (event: LoginFailedEvent) => Promise<void> | void\n  readonly onPasswordChanged?: (event: PasswordChangedEvent) => Promise<void> | void\n  readonly onPasswordResetRequested?: (event: PasswordResetRequestedEvent) => Promise<void> | void\n  readonly onPasswordResetCompleted?: (event: PasswordResetCompletedEvent) => Promise<void> | void\n  readonly onProfileUpdated?: (event: ProfileUpdatedEvent) => Promise<void> | void\n}\n","/**\n * Copyright (c) 2026 Ada Technology. All rights reserved.\n *\n * This source code is proprietary and confidential. Unauthorized copying,\n * modification, distribution, or use of this file, via any medium, is\n * strictly prohibited without prior written permission from Ada Technology.\n */\n\nimport type { UserSession } from './user.types'\n\nexport const AUTH_PROVIDER_TYPE = {\n  LOCAL: 'local',\n  OAUTH2: 'oauth2',\n  OIDC: 'oidc',\n} as const\n\nexport type AuthProviderType = (typeof AUTH_PROVIDER_TYPE)[keyof typeof AUTH_PROVIDER_TYPE]\n\nexport type AuthProviderInterface<TCredentials = unknown> = {\n  readonly id: string\n  readonly type: AuthProviderType\n  authenticate(params: { readonly credentials: TCredentials; readonly ipAddress?: string }): Promise<UserSession>\n}\n\nexport type AttributeMappingRule<TClaims extends Record<string, unknown>> =\n  | { readonly from: keyof TClaims }\n  | { readonly value: string }\n\nexport type AttributeMapping<TClaims extends Record<string, unknown>> = {\n  readonly email: AttributeMappingRule<TClaims>\n  readonly name?: AttributeMappingRule<TClaims>\n  readonly role?: AttributeMappingRule<TClaims>\n}\n\n/**\n * `issue` devolve o token cru; `rotate`/`revoke` recebem o **sha256 hex** dele — o token cru nunca\n * chega ao armazenamento, então um dump do Redis ou da tabela não vale sessão.\n *\n * `revokeAllForUser` é o que faz uma troca de senha realmente encerrar as sessões abertas. Sem ela,\n * a sessão comprometida sobrevive à redefinição feita justamente para matá-la — por isso é\n * obrigatória no contrato, e não uma capacidade opcional.\n */\nexport type RefreshTokenStorePort = {\n  issue(params: { readonly userId: string; readonly expiresInSeconds: number }): Promise<string>\n  rotate(params: {\n    readonly tokenHash: string\n    readonly newExpiresInSeconds: number\n  }): Promise<{ readonly token: string; readonly userId: string } | null>\n  revoke(params: { readonly tokenHash: string }): Promise<void>\n  revokeAllForUser(params: { readonly userId: string }): Promise<void>\n}\n\nexport type SendEmailParams = {\n  readonly to: string\n  readonly subject: string\n  readonly body: string\n  readonly html?: string\n}\n\nexport type DeliveryAttemptResult = {\n  readonly success: boolean\n  readonly messageId?: string\n  readonly error?: string\n}\n\nexport type EmailDriverPort = {\n  readonly driver: string\n  send(params: SendEmailParams): Promise<DeliveryAttemptResult>\n}\n\nexport type ClockPort = {\n  now(): Date\n}\n\nexport type LogMeta = Readonly<Record<string, unknown>>\n\n/** Mesma forma do `LoggerPort` dos outros contratos do ecossistema — o host escreve um adapter só. */\nexport type LoggerPort = {\n  error(message: string, meta?: LogMeta): void\n  warn(message: string, meta?: LogMeta): void\n  info(message: string, meta?: LogMeta): void\n  debug(message: string, meta?: LogMeta): void\n}\n\nexport type TenancyConfig = { readonly mode: 'single'; readonly defaultCompanyId: string } | { readonly mode: 'multi' }\n\n/**\n * `issuer`/`audience` são opcionais, mas quando declarados valem na assinatura **e** na\n * verificação: um token emitido para outra plateia é recusado. Um host que já emite JWT por conta\n * própria (migração gradual, dois emissores sobre o mesmo segredo) precisa declarar os mesmos\n * valores aqui, ou os dois lados não reconhecem o token um do outro.\n */\nexport type AccessTokenConfig = {\n  readonly secret: string\n  readonly expiresInSeconds?: number\n  readonly issuer?: string\n  readonly audience?: string\n}\n\nexport type RefreshTokenConfig = {\n  readonly expiresInSeconds?: number\n}\n\nexport type PasswordResetConfig = {\n  readonly resetUrlTemplate: string // must contain {token}\n  readonly tokenExpiresInSeconds?: number\n}\n\nexport type KeycloakConfig = {\n  readonly realm: string\n  readonly authServerUrl: string\n  readonly clientId: string\n  readonly clientSecret?: string\n  readonly attributeMapping?: AttributeMapping<Record<string, unknown>>\n}\n\nexport type UserModuleConfig = {\n  readonly tenancy: TenancyConfig\n  readonly accessToken: AccessTokenConfig\n  readonly refreshToken?: RefreshTokenConfig\n  readonly passwordReset?: PasswordResetConfig\n  readonly keycloak?: KeycloakConfig\n}\n\n/**\n * `keycloak` não entra aqui: a verificação de token é plumbing específico do módulo (ver\n * `KeycloakVerifierPort` em `user-module`), não um contrato genérico reutilizável por outro host.\n */\nexport type UserModuleProviders = {\n  readonly refreshTokenStore?: RefreshTokenStorePort\n  readonly email?: EmailDriverPort\n  readonly clock?: ClockPort\n  readonly logger?: LoggerPort\n}\n","/**\n * Copyright (c) 2026 Ada Technology. All rights reserved.\n *\n * This source code is proprietary and confidential. Unauthorized copying,\n * modification, distribution, or use of this file, via any medium, is\n * strictly prohibited without prior written permission from Ada Technology.\n */\n\nimport { z } from 'zod'\n\nconst PASSWORD_MIN_LENGTH = 8\nconst PASSWORD_MAX_LENGTH = 128\n\nexport const localCredentialsSchema = z.object({\n  email: z.string().trim().toLowerCase().email().max(320),\n  password: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),\n})\n\nexport type LocalCredentials = z.infer<typeof localCredentialsSchema>\n\nexport const requestPasswordResetSchema = z.object({\n  email: z.string().trim().toLowerCase().email().max(320),\n})\n\nexport type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>\n\nexport const confirmPasswordResetSchema = z.object({\n  token: z.string().min(1),\n  newPassword: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),\n})\n\nexport type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>\n\nexport const updateProfileSchema = z.object({\n  name: z.string().trim().min(1).max(255).optional(),\n})\n\nexport type UpdateProfileInput = z.infer<typeof updateProfileSchema>\n\nexport const createUserSchema = z.object({\n  email: z.string().trim().toLowerCase().email().max(320),\n  name: z.string().trim().min(1).max(255),\n  password: z.string().min(PASSWORD_MIN_LENGTH).max(PASSWORD_MAX_LENGTH),\n  role: z.string().min(1).max(40),\n})\n\nexport type CreateUserInput = z.infer<typeof createUserSchema>\n\n/**\n * `accessToken`, não `code`/`state`: o módulo verifica localmente um token já emitido pelo\n * Keycloak (`@adatechnology/auth-keycloak`, verificação via JWKS) — a troca do `code` da\n * authorization code flow é responsabilidade do host/frontend, antes de chegar aqui.\n */\nexport const keycloakCallbackSchema = z.object({\n  accessToken: z.string().min(1),\n})\n\nexport type KeycloakCallbackInput = z.infer<typeof keycloakCallbackSchema>\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;ACQO,IAAMA,kBAAkB;EAC7BC,qBAAqB;EACrBC,gBAAgB;EAChBC,sBAAsB;EACtBC,mBAAmB;EACnBC,qBAAqB;EACrBC,qBAAqB;EACrBC,0BAA0B;EAC1BC,eAAe;EACfC,wBAAwB;EACxBC,mBAAmB;EACnBC,gBAAgB;AAClB;AAIO,IAAMC,YAAN,cAAwBC,MAAAA;EAxB/B,OAwB+BA;;;EACpBC;EACAC;EACAC;EAET,YAAYC,QAAyF;AACnG,UAAMA,OAAOC,OAAO;AACpB,SAAKC,OAAO;AACZ,SAAKL,aAAaG,OAAOH;AACzB,SAAKC,OAAOE,OAAOF;AACnB,SAAKC,UAAUC,OAAOD;EACxB;AACF;AAEO,IAAMI,0BAAN,cAAsCR,UAAAA;EAtC7C,OAsC6CA;;;EAC3C,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBC;IACxB,CAAA;AACA,SAAKkB,OAAO;EACd;AACF;AAEO,IAAME,oBAAN,cAAgCT,UAAAA;EAjDvC,OAiDuCA;;;EACrC,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBE;IACxB,CAAA;AACA,SAAKiB,OAAO;EACd;AACF;AAEO,IAAMG,0BAAN,cAAsCV,UAAAA;EA5D7C,OA4D6CA;;;EAC3C,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBG;IACxB,CAAA;AACA,SAAKgB,OAAO;EACd;AACF;AAEO,IAAMI,wBAAN,cAAoCX,UAAAA;EAvE3C,OAuE2CA;;;EACzC,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBI;IACxB,CAAA;AACA,SAAKe,OAAO;EACd;AACF;AAEO,IAAMK,yBAAN,cAAqCZ,UAAAA;EAlF5C,OAkF4CA;;;EAC1C,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBK;IACxB,CAAA;AACA,SAAKc,OAAO;EACd;AACF;AAEO,IAAMM,yBAAN,cAAqCb,UAAAA;EA7F5C,OA6F4CA;;;EAC1C,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBM;IACxB,CAAA;AACA,SAAKa,OAAO;EACd;AACF;AAEO,IAAMO,6BAAN,cAAyCd,UAAAA;EAxGhD,OAwGgDA;;;EAC9C,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBO;IACxB,CAAA;AACA,SAAKY,OAAO;EACd;AACF;AAEO,IAAMQ,oBAAN,cAAgCf,UAAAA;EAnHvC,OAmHuCA;;;EACrC,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBQ;IACxB,CAAA;AACA,SAAKW,OAAO;EACd;AACF;AAEO,IAAMS,6BAAN,cAAyChB,UAAAA;EA9HhD,OA8HgDA;;;EAC9C,YAAYI,SAAmB;AAC7B,UAAM;MACJE,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBS;MACtBO;IACF,CAAA;AACA,SAAKG,OAAO;EACd;AACF;AAEO,IAAMU,wBAAN,cAAoCjB,UAAAA;EA1I3C,OA0I2CA;;;EACzC,cAAc;AACZ,UAAM;MACJM,SAAS;MACTJ,YAAY;MACZC,MAAMf,gBAAgBU;IACxB,CAAA;AACA,SAAKS,OAAO;EACd;AACF;AAEO,IAAMW,qBAAN,cAAiClB,UAAAA;EArJxC,OAqJwCA;;;EACtC,YAAYmB,OAAe;AACzB,UAAM;MACJb,SAAS,mCAAmCa,KAAAA;MAC5CjB,YAAY;MACZC,MAAMf,gBAAgBW;MACtBK,SAAS;QAAEe;MAAM;IACnB,CAAA;AACA,SAAKZ,OAAO;EACd;AACF;;;ACrJO,IAAMa,aAAa;EACxBC,cAAc;EACdC,cAAc;EACdC,iBAAiB;EACjBC,cAAc;EACdC,kBAAkB;EAClBC,0BAA0B;EAC1BC,0BAA0B;EAC1BC,iBAAiB;AACnB;;;ACTO,IAAMC,qBAAqB;EAChCC,OAAO;EACPC,QAAQ;EACRC,MAAM;AACR;;;ACNA,iBAAkB;AAElB,IAAMC,sBAAsB;AAC5B,IAAMC,sBAAsB;AAErB,IAAMC,yBAAyBC,aAAEC,OAAO;EAC7CC,OAAOF,aAAEG,OAAM,EAAGC,KAAI,EAAGC,YAAW,EAAGH,MAAK,EAAGI,IAAI,GAAA;EACnDC,UAAUP,aAAEG,OAAM,EAAGK,IAAIX,mBAAAA,EAAqBS,IAAIR,mBAAAA;AACpD,CAAA;AAIO,IAAMW,6BAA6BT,aAAEC,OAAO;EACjDC,OAAOF,aAAEG,OAAM,EAAGC,KAAI,EAAGC,YAAW,EAAGH,MAAK,EAAGI,IAAI,GAAA;AACrD,CAAA;AAIO,IAAMI,6BAA6BV,aAAEC,OAAO;EACjDU,OAAOX,aAAEG,OAAM,EAAGK,IAAI,CAAA;EACtBI,aAAaZ,aAAEG,OAAM,EAAGK,IAAIX,mBAAAA,EAAqBS,IAAIR,mBAAAA;AACvD,CAAA;AAIO,IAAMe,sBAAsBb,aAAEC,OAAO;EAC1Ca,MAAMd,aAAEG,OAAM,EAAGC,KAAI,EAAGI,IAAI,CAAA,EAAGF,IAAI,GAAA,EAAKS,SAAQ;AAClD,CAAA;AAIO,IAAMC,mBAAmBhB,aAAEC,OAAO;EACvCC,OAAOF,aAAEG,OAAM,EAAGC,KAAI,EAAGC,YAAW,EAAGH,MAAK,EAAGI,IAAI,GAAA;EACnDQ,MAAMd,aAAEG,OAAM,EAAGC,KAAI,EAAGI,IAAI,CAAA,EAAGF,IAAI,GAAA;EACnCC,UAAUP,aAAEG,OAAM,EAAGK,IAAIX,mBAAAA,EAAqBS,IAAIR,mBAAAA;EAClDmB,MAAMjB,aAAEG,OAAM,EAAGK,IAAI,CAAA,EAAGF,IAAI,EAAA;AAC9B,CAAA;AASO,IAAMY,yBAAyBlB,aAAEC,OAAO;EAC7CkB,aAAanB,aAAEG,OAAM,EAAGK,IAAI,CAAA;AAC9B,CAAA;","names":["USER_ERROR_CODE","INVALID_CREDENTIALS","USER_NOT_FOUND","EMAIL_ALREADY_EXISTS","NOT_AUTHENTICATED","RESET_TOKEN_INVALID","RESET_TOKEN_EXPIRED","RESET_TOKEN_ALREADY_USED","WEAK_PASSWORD","PROVIDER_MISCONFIGURED","PROVIDER_DISABLED","CONFIG_MISSING","UserError","Error","statusCode","code","details","params","message","name","InvalidCredentialsError","UserNotFoundError","EmailAlreadyExistsError","NotAuthenticatedError","ResetTokenInvalidError","ResetTokenExpiredError","ResetTokenAlreadyUsedError","WeakPasswordError","ProviderMisconfiguredError","ProviderDisabledError","ConfigMissingError","field","USER_EVENT","USER_CREATED","USER_UPDATED","LOGIN_SUCCEEDED","LOGIN_FAILED","PASSWORD_CHANGED","PASSWORD_RESET_REQUESTED","PASSWORD_RESET_COMPLETED","PROFILE_UPDATED","AUTH_PROVIDER_TYPE","LOCAL","OAUTH2","OIDC","PASSWORD_MIN_LENGTH","PASSWORD_MAX_LENGTH","localCredentialsSchema","z","object","email","string","trim","toLowerCase","max","password","min","requestPasswordResetSchema","confirmPasswordResetSchema","token","newPassword","updateProfileSchema","name","optional","createUserSchema","role","keycloakCallbackSchema","accessToken"]}