@authup/server-core 1.0.0-beta.63 → 1.0.0-beta.64

package/dist/cli/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAM9D,wBAAgB,qBAAqB,CAAC,QAAQ,GAAE,mBAAwB,uDAkCvE"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAIjD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEjE,wBAAgB,qBAAqB,CACjC,QAAQ,GAAE,mBAAmB,CAAC,MAAM,CAAM,uDAY7C"}

package/dist/cli/commands/start.mjs

@@ -3,35 +3,17 @@ import "node:url";
 import.meta.url;
 import { createApplication } from "../../app/factory.mjs";
 import "../../app/index.mjs";
-import { createCLIConfigModule } from "../config.mjs";
-import process from "node:process";
+import { createCLIConfigModule } from "./config.mjs";
+import { registerShutdownHandlers } from "./shutdown.mjs";
 import { defineCommand } from "citty";
 //#region src/cli/commands/start.ts
-const FORCE_EXIT_TIMEOUT_MS = 1e4;
 function defineCLIStartCommand(configFs = {}) {
 	return defineCommand({
 		meta: { name: "start" },
 		async setup() {
 			const app = createApplication({ config: createCLIConfigModule(configFs) });
 			await app.setup();
-			let shuttingDown = false;
-			const shutdown = async (signal) => {
-				if (shuttingDown) process.exit(1);
-				shuttingDown = true;
-				setTimeout(() => {
-					process.stderr.write(`\n${signal} teardown timed out after ${FORCE_EXIT_TIMEOUT_MS}ms — forcing exit.\n`);
-					process.exit(1);
-				}, FORCE_EXIT_TIMEOUT_MS).unref();
-				try {
-					await app.teardown();
-					process.exit(0);
-				} catch (err) {
-					process.stderr.write(`Error during ${signal} teardown: ${err.stack ?? String(err)}\n`);
-					process.exit(1);
-				}
-			};
-			process.on("SIGINT", shutdown);
-			process.on("SIGTERM", shutdown);
+			registerShutdownHandlers(app);
 		}
 	});
 }

package/dist/cli/commands/start.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"start.mjs","names":["defineCommand","process","createApplication","createCLIConfigModule","FORCE_EXIT_TIMEOUT_MS","defineCLIStartCommand","configFs","meta","name","setup","app","config","shuttingDown","shutdown","signal","exit","force","setTimeout","stderr","write","unref","teardown","err","stack","String","on"],"sources":["../../../src/cli/commands/start.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport process from 'node:process';\nimport type { ConfigReadFsOptions } from '../../app/index.ts';\nimport { createApplication } from '../../app/index.ts';\nimport { createCLIConfigModule } from '../config.ts';\n\nconst FORCE_EXIT_TIMEOUT_MS = 10_000;\n\nexport function defineCLIStartCommand(configFs: ConfigReadFsOptions = {}) {\n    return defineCommand({\n        meta: { name: 'start' },\n        async setup() {\n            const app = createApplication({ config: createCLIConfigModule(configFs) });\n\n            await app.setup();\n\n            let shuttingDown = false;\n            const shutdown = async (signal: NodeJS.Signals) => {\n                if (shuttingDown) {\n                    process.exit(1);\n                }\n                shuttingDown = true;\n\n                const force = setTimeout(() => {\n                    process.stderr.write(`\\n${signal} teardown timed out after ${FORCE_EXIT_TIMEOUT_MS}ms — forcing exit.\\n`);\n                    process.exit(1);\n                }, FORCE_EXIT_TIMEOUT_MS);\n                force.unref();\n\n                try {\n                    await app.teardown();\n                    process.exit(0);\n                } catch (err) {\n                    process.stderr.write(`Error during ${signal} teardown: ${(err as Error).stack ?? String(err)}\\n`);\n                    process.exit(1);\n                }\n            };\n\n            process.on('SIGINT', shutdown);\n            process.on('SIGTERM', shutdown);\n        },\n    });\n}\n"],"mappings":";;;;;;;;;AAaA,MAAMI,wBAAwB;AAE9B,SAAgBC,sBAAsBC,WAAgC,CAAC,GAAC;CACpE,OAAON,cAAc;EACjBO,MAAM,EAAEC,MAAM,QAAQ;EACtB,MAAMC,QAAAA;GACF,MAAMC,MAAMR,kBAAkB,EAAES,QAAQR,sBAAsBG,QAAAA,EAAU,CAAA;GAExE,MAAMI,IAAID,MAAK;GAEf,IAAIG,eAAe;GACnB,MAAMC,WAAW,OAAOC,WAAAA;IACpB,IAAIF,cACAX,QAAQc,KAAK,CAAA;IAEjBH,eAAe;IAMfI,iBAJyB;KACrBf,QAAQiB,OAAOC,MAAM,KAAKL,OAAO,4BAA4BV,sBAAsB,qBAAqB;KACxGH,QAAQc,KAAK,CAAA;IACjB,GAAGX,qBACHY,CAAAA,CAAMI,MAAK;IAEX,IAAI;KACA,MAAMV,IAAIW,SAAQ;KAClBpB,QAAQc,KAAK,CAAA;IACjB,SAASO,KAAK;KACVrB,QAAQiB,OAAOC,MAAM,gBAAgBL,OAAO,aAAa,IAAeS,SAASC,OAAOF,GAAAA,EAAK,GAAG;KAChGrB,QAAQc,KAAK,CAAA;IACjB;GACJ;GAEAd,QAAQwB,GAAG,UAAUZ,QAAAA;GACrBZ,QAAQwB,GAAG,WAAWZ,QAAAA;EAC1B;CACJ,CAAA;AACJ"}
+{"version":3,"file":"start.mjs","names":["defineCommand","createApplication","createCLIConfigModule","registerShutdownHandlers","defineCLIStartCommand","configFs","meta","name","setup","app","config"],"sources":["../../../src/cli/commands/start.ts"],"sourcesContent":["/*\n * Copyright (c) 2021-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport type { Config } from '../../app/index.ts';\nimport { createApplication } from '../../app/index.ts';\nimport { createCLIConfigModule } from './config.ts';\nimport { registerShutdownHandlers } from './shutdown.ts';\nimport type { ConfigReadFsOptions } from '@authup/server-config';\n\nexport function defineCLIStartCommand(\n    configFs: ConfigReadFsOptions<Config> = {},\n) {\n    return defineCommand({\n        meta: { name: 'start' },\n        async setup() {\n            const app = createApplication({ config: createCLIConfigModule(configFs) });\n\n            await app.setup();\n\n            registerShutdownHandlers(app);\n        },\n    });\n}\n"],"mappings":";;;;;;;;;AAcA,SAAgBI,sBACZC,WAAwC,CAAC,GAAC;CAE1C,OAAOL,cAAc;EACjBM,MAAM,EAAEC,MAAM,QAAQ;EACtB,MAAMC,QAAAA;GACF,MAAMC,MAAMR,kBAAkB,EAAES,QAAQR,sBAAsBG,QAAAA,EAAU,CAAA;GAExE,MAAMI,IAAID,MAAK;GAEfL,yBAAyBM,GAAAA;EAC7B;CACJ,CAAA;AACJ"}

package/dist/cli/commands/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/types.ts"],"names":[],"mappings":"AAOA,MAAM,MAAM,aAAa,GAAG;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC"}

package/dist/cli/index.d.ts

@@ -1,3 +1,11 @@
 #!/usr/bin/env node
+/**
+ * Development-only entry point, not published as a binary.
+ * Operators run the `authup` CLI.
+ *
+ * This file backs the `cli` and `cli-dev` package scripts, so
+ * `migration generate` has a runner, and because `cli-dev` is the only
+ * route to the just-in-time code-transformation gate.
+ */
 import 'reflect-metadata';
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AASA,OAAO,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AASA;;;;;;;GAOG;AAEH,OAAO,kBAAkB,CAAC"}

package/dist/cli/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":["runMain","dotenv","createCLIEntryPointCommand","config","debug","quiet","Promise","resolve","then","command","catch","err","console","log","process","exit"],"sources":["../../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport 'reflect-metadata';\nimport { runMain } from 'citty';\nimport dotenv from 'dotenv';\nimport { createCLIEntryPointCommand } from './module.ts';\n\ndotenv.config({\n    debug: false,\n    quiet: true,\n});\n\nPromise.resolve()\n    .then(() => createCLIEntryPointCommand())\n    .then((command) => runMain(command))\n    .catch((err) => {\n        console.log(err); // eslint-disable-line no-console\n        process.exit(1);\n    });\n"],"mappings":";;;;;;;;;AAcAC,OAAOE,OAAO;CACVC,OAAO;CACPC,OAAO;AACX,CAAA;AAEAC,QAAQC,QAAO,CAAA,CACVC,WAAWN,2BAAAA,CAAAA,CAAAA,CACXM,MAAMC,YAAYT,QAAQS,OAAAA,CAAAA,CAAAA,CAC1BC,OAAOC,QAAAA;CACJC,QAAQC,IAAIF,GAAAA;CACZG,QAAQC,KAAK,CAAA;AACjB,CAAA"}
+{"version":3,"file":"index.mjs","names":["runMain","dotenv","createCLIEntryPointCommand","config","debug","quiet","Promise","resolve","then","command","catch","err","console","log","process","exit"],"sources":["../../src/cli/index.ts"],"sourcesContent":["#!/usr/bin/env node\n\n/*\n * Copyright (c) 2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Development-only entry point, not published as a binary.\n * Operators run the `authup` CLI.\n *\n * This file backs the `cli` and `cli-dev` package scripts, so\n * `migration generate` has a runner, and because `cli-dev` is the only\n * route to the just-in-time code-transformation gate.\n */\n\nimport 'reflect-metadata';\nimport { runMain } from 'citty';\nimport dotenv from 'dotenv';\nimport { createCLIEntryPointCommand } from './module.ts';\n\ndotenv.config({\n    debug: false,\n    quiet: true,\n});\n\nPromise.resolve()\n    .then(() => createCLIEntryPointCommand())\n    .then((command) => runMain(command))\n    .catch((err) => {\n        console.log(err); // eslint-disable-line no-console\n        process.exit(1);\n    });\n"],"mappings":";;;;;;;;;AAuBAC,OAAOE,OAAO;CACVC,OAAO;CACPC,OAAO;AACX,CAAA;AAEAC,QAAQC,QAAO,CAAA,CACVC,WAAWN,2BAAAA,CAAAA,CAAAA,CACXM,MAAMC,YAAYT,QAAQS,OAAAA,CAAAA,CAAAA,CAC1BC,OAAOC,QAAAA;CACJC,QAAQC,IAAIF,GAAAA;CACZG,QAAQC,KAAK,CAAA;AACjB,CAAA"}

package/dist/cli/module.d.ts

@@ -2,12 +2,10 @@ export declare function createCLIEntryPointCommand(): Promise<import("citty").Co
     configDirectory: {
         type: "string";
         description: string;
-        alias: string;
     };
     configFile: {
         type: "string";
         description: string;
-        alias: string;
     };
 }>>;
 //# sourceMappingURL=module.d.ts.map

package/dist/cli/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/cli/module.ts"],"names":[],"mappings":"AAmBA,wBAAsB,0BAA0B;;;;;;;;;;;IAyB/C"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../src/cli/module.ts"],"names":[],"mappings":"AAoBA,wBAAsB,0BAA0B;;;;;;;;;IA0B/C"}

package/dist/cli/module.mjs

@@ -1,18 +1,18 @@
 import "node:path";
 import "node:url";
 import.meta.url;
-import { CLI_CONFIG_ARGS, applyCLIConfigArgs } from "./config.mjs";
+import { PACKAGE_PATH } from "../path.mjs";
+import { CLI_CONFIG_ARGS, applyCLIConfigArgs, assertNoStrayPositionals } from "./commands/config.mjs";
 import { defineCLIHealthCheckCommand } from "./commands/healthcheck.mjs";
 import { defineCLIMigrationCommand } from "./commands/migration.mjs";
 import { defineCLIStartCommand } from "./commands/start.mjs";
 import "./commands/index.mjs";
 import path from "node:path";
-import process from "node:process";
 import fs from "node:fs";
 import { defineCommand } from "citty";
 //#region src/cli/module.ts
 async function createCLIEntryPointCommand() {
-	const pkgRaw = await fs.promises.readFile(path.join(process.cwd(), "package.json"), { encoding: "utf8" });
+	const pkgRaw = await fs.promises.readFile(path.join(PACKAGE_PATH, "package.json"), { encoding: "utf8" });
 	const pkg = JSON.parse(pkgRaw);
 	const configFs = {};
 	return defineCommand({
@@ -28,6 +28,7 @@ async function createCLIEntryPointCommand() {
 		},
 		args: CLI_CONFIG_ARGS,
 		setup(context) {
+			assertNoStrayPositionals(context.args);
 			applyCLIConfigArgs(configFs, context.args);
 		}
 	});

package/dist/cli/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["defineCommand","fs","path","process","CLI_CONFIG_ARGS","applyCLIConfigArgs","defineCLIHealthCheckCommand","defineCLIMigrationCommand","defineCLIStartCommand","createCLIEntryPointCommand","pkgRaw","promises","readFile","join","cwd","encoding","pkg","JSON","parse","configFs","meta","name","version","description","subCommands","healthcheck","migration","start","args","setup","context"],"sources":["../../src/cli/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport process from 'node:process';\nimport type { ConfigReadFsOptions } from '../app/index.ts';\nimport { CLI_CONFIG_ARGS, applyCLIConfigArgs } from './config.ts';\nimport {\n    defineCLIHealthCheckCommand,\n    defineCLIMigrationCommand,\n    defineCLIStartCommand,\n} from './commands/index.ts';\n\nexport async function createCLIEntryPointCommand() {\n    const pkgRaw = await fs.promises.readFile(\n        path.join(process.cwd(), 'package.json'),\n        { encoding: 'utf8' },\n    );\n    const pkg = JSON.parse(pkgRaw);\n\n    const configFs : ConfigReadFsOptions = {};\n\n    return defineCommand({\n        meta: {\n            name: pkg.name,\n            version: pkg.version,\n            description: pkg.description,\n        },\n        subCommands: {\n            healthcheck: defineCLIHealthCheckCommand(configFs),\n            migration: defineCLIMigrationCommand(configFs),\n            start: defineCLIStartCommand(configFs),\n        },\n        args: CLI_CONFIG_ARGS,\n        setup(context) {\n            applyCLIConfigArgs(configFs, context.args);\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;AAmBA,eAAsBS,6BAAAA;CAClB,MAAMC,SAAS,MAAMT,GAAGU,SAASC,SAC7BV,KAAKW,KAAKV,QAAQW,IAAG,GAAI,cAAA,GACzB,EAAEC,UAAU,OAAO,CAAA;CAEvB,MAAMC,MAAMC,KAAKC,MAAMR,MAAAA;CAEvB,MAAMS,WAAiC,CAAC;CAExC,OAAOnB,cAAc;EACjBoB,MAAM;GACFC,MAAML,IAAIK;GACVC,SAASN,IAAIM;GACbC,aAAaP,IAAIO;EACrB;EACAC,aAAa;GACTC,aAAanB,4BAA4Ba,QAAAA;GACzCO,WAAWnB,0BAA0BY,QAAAA;GACrCQ,OAAOnB,sBAAsBW,QAAAA;EACjC;EACAS,MAAMxB;EACNyB,MAAMC,SAAO;GACTzB,mBAAmBc,UAAUW,QAAQF,IAAI;EAC7C;CACJ,CAAA;AACJ"}
+{"version":3,"file":"module.mjs","names":["defineCommand","fs","path","PACKAGE_PATH","CLI_CONFIG_ARGS","applyCLIConfigArgs","assertNoStrayPositionals","defineCLIHealthCheckCommand","defineCLIMigrationCommand","defineCLIStartCommand","createCLIEntryPointCommand","pkgRaw","promises","readFile","join","encoding","pkg","JSON","parse","configFs","meta","name","version","description","subCommands","healthcheck","migration","start","args","setup","context"],"sources":["../../src/cli/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2024.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport { defineCommand } from 'citty';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport type { Config } from '../app/index.ts';\nimport { PACKAGE_PATH } from '../path.ts';\nimport { CLI_CONFIG_ARGS, applyCLIConfigArgs, assertNoStrayPositionals } from './commands/config.ts';\nimport {\n    defineCLIHealthCheckCommand,\n    defineCLIMigrationCommand,\n    defineCLIStartCommand,\n} from './commands/index.ts';\nimport type { ConfigReadFsOptions } from '@authup/server-config';\n\nexport async function createCLIEntryPointCommand() {\n    const pkgRaw = await fs.promises.readFile(\n        path.join(PACKAGE_PATH, 'package.json'),\n        { encoding: 'utf8' },\n    );\n    const pkg = JSON.parse(pkgRaw);\n\n    const configFs : ConfigReadFsOptions<Config> = {};\n\n    return defineCommand({\n        meta: {\n            name: pkg.name,\n            version: pkg.version,\n            description: pkg.description,\n        },\n        subCommands: {\n            healthcheck: defineCLIHealthCheckCommand(configFs),\n            migration: defineCLIMigrationCommand(configFs),\n            start: defineCLIStartCommand(configFs),\n        },\n        args: CLI_CONFIG_ARGS,\n        setup(context) {\n            assertNoStrayPositionals(context.args);\n            applyCLIConfigArgs(configFs, context.args);\n        },\n    });\n}\n"],"mappings":";;;;;;;;;;;;;AAoBA,eAAsBU,6BAAAA;CAClB,MAAMC,SAAS,MAAMV,GAAGW,SAASC,SAC7BX,KAAKY,KAAKX,cAAc,cAAA,GACxB,EAAEY,UAAU,OAAO,CAAA;CAEvB,MAAMC,MAAMC,KAAKC,MAAMP,MAAAA;CAEvB,MAAMQ,WAAyC,CAAC;CAEhD,OAAOnB,cAAc;EACjBoB,MAAM;GACFC,MAAML,IAAIK;GACVC,SAASN,IAAIM;GACbC,aAAaP,IAAIO;EACrB;EACAC,aAAa;GACTC,aAAalB,4BAA4BY,QAAAA;GACzCO,WAAWlB,0BAA0BW,QAAAA;GACrCQ,OAAOlB,sBAAsBU,QAAAA;EACjC;EACAS,MAAMxB;EACNyB,MAAMC,SAAO;GACTxB,yBAAyBwB,QAAQF,IAAI;GACrCvB,mBAAmBc,UAAUW,QAAQF,IAAI;EAC7C;CACJ,CAAA;AACJ"}

package/dist/components/oauth2-cleaner/module.d.ts

@@ -1,5 +1,5 @@
-import type { Logger } from '@authup/server-kit';
+import type { ICache, Logger } from '@authup/server-kit';
 import type { DataSource } from 'typeorm';
 import type { Component } from '../types.ts';
-export declare function createOAuth2CleanerComponent(dataSource: DataSource, logger?: Logger): Component;
+export declare function createOAuth2CleanerComponent(dataSource: DataSource, cache: ICache, logger?: Logger): Component;
 //# sourceMappingURL=module.d.ts.map

package/dist/components/oauth2-cleaner/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAG1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CACxC,UAAU,EAAE,UAAU,EACtB,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CAiDZ"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../src/components/oauth2-cleaner/module.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAI1C,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAE7C,wBAAgB,4BAA4B,CACxC,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,EACb,MAAM,CAAC,EAAE,MAAM,GACf,SAAS,CAqDZ"}

package/dist/components/oauth2-cleaner/module.mjs

@@ -2,23 +2,26 @@ import "node:path";
 import "node:url";
 import.meta.url;
 import { SessionEntity } from "../../adapters/database/domains/session/entity.mjs";
-import { SessionTokenEntity } from "../../adapters/database/domains/session-token/entity.mjs";
 import "../../adapters/database/domains/index.mjs";
-import { LessThan } from "typeorm";
+import { SessionTokenRepositoryAdapter } from "../../app/modules/oauth2/repositories/session-token/repository.mjs";
+import { SessionRepository } from "../../app/modules/authentication/repositories/session.mjs";
 import cron from "node-cron";
 //#region src/components/oauth2-cleaner/module.ts
-function createOAuth2CleanerComponent(dataSource, logger) {
+function createOAuth2CleanerComponent(dataSource, cache, logger) {
 	let task;
 	let stopped = false;
 	return {
 		async start() {
-			const sessionRepository = dataSource.getRepository(SessionEntity);
-			const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);
+			const sessionRepository = new SessionRepository({
+				repository: dataSource.getRepository(SessionEntity),
+				cache
+			});
+			const sessionTokenRepository = new SessionTokenRepositoryAdapter(dataSource);
 			const execute = async () => {
 				try {
 					const isoDate = (/* @__PURE__ */ new Date()).toISOString();
-					await sessionTokenRepository.delete({ expiresAt: LessThan(isoDate) });
-					await sessionRepository.delete({ expiresAt: LessThan(isoDate) });
+					await sessionTokenRepository.deleteExpired(isoDate);
+					await sessionRepository.deleteExpired(isoDate);
 				} catch (e) {
 					logger?.warn("Sweeping expired sessions failed.");
 					logger?.warn(e);

package/dist/components/oauth2-cleaner/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["cron","LessThan","SessionEntity","SessionTokenEntity","createOAuth2CleanerComponent","dataSource","logger","task","stopped","start","sessionRepository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","delete","expiresAt","e","warn","schedule","stop","undefined"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ScheduledTask } from 'node-cron';\nimport cron from 'node-cron';\nimport type { Logger } from '@authup/server-kit';\nimport type { DataSource } from 'typeorm';\nimport { LessThan } from 'typeorm';\nimport { SessionEntity, SessionTokenEntity } from '../../adapters/database/domains/index.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n    dataSource: DataSource,\n    logger?: Logger,\n) : Component {\n    let task : ScheduledTask | undefined;\n    let stopped = false;\n\n    return {\n        async start() {\n            const sessionRepository = dataSource.getRepository(SessionEntity);\n            const sessionTokenRepository = dataSource.getRepository(SessionTokenEntity);\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    const isoDate = new Date().toISOString();\n\n                    // Sweep expired session-token rows first: the auth_session_tokens\n                    // volume dominates (one row per access token, ~15min TTL) and a\n                    // deleted session cascade-drops its remaining rows anyway.\n                    await sessionTokenRepository\n                        .delete({ expiresAt: LessThan(isoDate) });\n\n                    await sessionRepository\n                        .delete({ expiresAt: LessThan(isoDate) });\n                } catch (e) {\n                    logger?.warn('Sweeping expired sessions failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            if (stopped) {\n                return;\n            }\n\n            task = cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n        async stop() {\n            stopped = true;\n\n            if (task) {\n                await task.stop();\n                task = undefined;\n            }\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAeA,SAAgBI,6BACZC,YACAC,QAAe;CAEf,IAAIC;CACJ,IAAIC,UAAU;CAEd,OAAO;EACH,MAAMC,QAAAA;GACF,MAAMC,oBAAoBL,WAAWM,cAAcT,aAAAA;GACnD,MAAMU,yBAAyBP,WAAWM,cAAcR,kBAAAA;GAKxD,MAAMU,UAAU,YAAA;IACZ,IAAI;KACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;KAKtC,MAAMJ,uBACDK,OAAO,EAAEC,WAAWjB,SAASa,OAAAA,EAAS,CAAA;KAE3C,MAAMJ,kBACDO,OAAO,EAAEC,WAAWjB,SAASa,OAAAA,EAAS,CAAA;IAC/C,SAASK,GAAG;KACRb,QAAQc,KAAK,mCAAA;KACbd,QAAQc,KAAKD,CAAAA;IACjB;GACJ;GAEA,MAAMN,QAAAA;GAEN,IAAIL,SACA;GAGJD,OAAOP,KAAKqB,SAAS,aAAa,YAAA;IAC9B,MAAMR,QAAAA;GACV,CAAA;EACJ;EACA,MAAMS,OAAAA;GACFd,UAAU;GAEV,IAAID,MAAM;IACN,MAAMA,KAAKe,KAAI;IACff,OAAOgB,KAAAA;GACX;EACJ;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["cron","SessionEntity","SessionRepository","SessionTokenRepositoryAdapter","createOAuth2CleanerComponent","dataSource","cache","logger","task","stopped","start","sessionRepository","repository","getRepository","sessionTokenRepository","execute","isoDate","Date","toISOString","deleteExpired","e","warn","schedule","stop","undefined"],"sources":["../../../src/components/oauth2-cleaner/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2022-2022.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ScheduledTask } from 'node-cron';\nimport cron from 'node-cron';\nimport type { ICache, Logger } from '@authup/server-kit';\nimport type { Session } from '@authup/core-kit';\nimport type { DataSource } from 'typeorm';\nimport { SessionEntity } from '../../adapters/database/domains/index.ts';\nimport { SessionRepository } from '../../app/modules/authentication/repositories/session.ts';\nimport { SessionTokenRepositoryAdapter } from '../../app/modules/oauth2/repositories/session-token/repository.ts';\nimport type { Component } from '../types.ts';\n\nexport function createOAuth2CleanerComponent(\n    dataSource: DataSource,\n    cache: ICache,\n    logger?: Logger,\n) : Component {\n    let task : ScheduledTask | undefined;\n    let stopped = false;\n\n    return {\n        async start() {\n            // Both sweeps run through the repository layer, which owns the\n            // batching: an unbounded predicate DELETE on either table would be\n            // one long transaction, issued by every replica once a minute.\n            const sessionRepository = new SessionRepository({\n                repository: dataSource.getRepository<Session>(SessionEntity),\n                cache,\n            });\n            const sessionTokenRepository = new SessionTokenRepositoryAdapter(dataSource);\n\n            // A failed sweep must never take the process down (start() is\n            // fire-and-forget → an uncaught rejection is fatal on modern\n            // node); the next tick simply retries.\n            const execute = async () => {\n                try {\n                    const isoDate = new Date().toISOString();\n\n                    // Sweep expired session-token rows first: the auth_session_tokens\n                    // volume dominates (one row per access token, ~15min TTL) and a\n                    // deleted session cascade-drops its remaining rows anyway.\n                    await sessionTokenRepository.deleteExpired(isoDate);\n\n                    await sessionRepository.deleteExpired(isoDate);\n                } catch (e) {\n                    logger?.warn('Sweeping expired sessions failed.');\n                    logger?.warn(e);\n                }\n            };\n\n            await execute();\n\n            if (stopped) {\n                return;\n            }\n\n            task = cron.schedule('* * * * *', async () => {\n                await execute();\n            });\n        },\n        async stop() {\n            stopped = true;\n\n            if (task) {\n                await task.stop();\n                task = undefined;\n            }\n        },\n    };\n}\n"],"mappings":";;;;;;;;;AAiBA,SAAgBI,6BACZC,YACAC,OACAC,QAAe;CAEf,IAAIC;CACJ,IAAIC,UAAU;CAEd,OAAO;EACH,MAAMC,QAAAA;GAIF,MAAMC,oBAAoB,IAAIT,kBAAkB;IAC5CU,YAAYP,WAAWQ,cAAuBZ,aAAAA;IAC9CK;GACJ,CAAA;GACA,MAAMQ,yBAAyB,IAAIX,8BAA8BE,UAAAA;GAKjE,MAAMU,UAAU,YAAA;IACZ,IAAI;KACA,MAAMC,2BAAU,IAAIC,KAAAA,EAAAA,CAAOC,YAAW;KAKtC,MAAMJ,uBAAuBK,cAAcH,OAAAA;KAE3C,MAAML,kBAAkBQ,cAAcH,OAAAA;IAC1C,SAASI,GAAG;KACRb,QAAQc,KAAK,mCAAA;KACbd,QAAQc,KAAKD,CAAAA;IACjB;GACJ;GAEA,MAAML,QAAAA;GAEN,IAAIN,SACA;GAGJD,OAAOR,KAAKsB,SAAS,aAAa,YAAA;IAC9B,MAAMP,QAAAA;GACV,CAAA;EACJ;EACA,MAAMQ,OAAAA;GACFd,UAAU;GAEV,IAAID,MAAM;IACN,MAAMA,KAAKe,KAAI;IACff,OAAOgB,KAAAA;GACX;EACJ;CACJ;AACJ"}

package/dist/core/authentication/index.mjs

@@ -11,7 +11,8 @@ import "./entities/index.mjs";
 import { LoginThrottleService } from "./login-throttle/service.mjs";
 import "./login-throttle/index.mjs";
 import { CredentialsAuthenticator } from "./module.mjs";
+import { SESSION_EXPIRY_SWEEP_BATCH_SIZE } from "./session/constants.mjs";
 import { SessionManager } from "./session/module.mjs";
 import { SESSION_FILTER_KEYS } from "./session/types.mjs";
 import "./session/index.mjs";
-export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };
+export { BaseCredentialsAuthenticator, ClientAuthenticator, ClientCredentialsService, CredentialsAuthenticator, LoginThrottleService, SESSION_EXPIRY_SWEEP_BATCH_SIZE, SESSION_FILTER_KEYS, SessionManager, UserAuthenticator, UserCredentialsService };

package/dist/core/authentication/session/constants.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Rows removed per statement by the session expiry sweep. The sweep runs every
+ * minute on every replica, and an instance that has never swept (or one whose
+ * session lifetime was just shortened) can match a full backlog at once. A
+ * single unbounded DELETE would be one long transaction, issued concurrently
+ * by every replica. Batching keeps each statement bounded; the sweep still
+ * drains by looping.
+ */
+export declare const SESSION_EXPIRY_SWEEP_BATCH_SIZE = 1000;
+//# sourceMappingURL=constants.d.ts.map

package/dist/core/authentication/session/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/constants.ts"],"names":[],"mappings":"AAOA;;;;;;;GAOG;AACH,eAAO,MAAM,+BAA+B,OAAO,CAAC"}

package/dist/core/authentication/session/constants.mjs

@@ -0,0 +1,16 @@
+import "node:path";
+import "node:url";
+import.meta.url;
+//#region src/core/authentication/session/constants.ts
+/**
+* Rows removed per statement by the session expiry sweep. The sweep runs every
+* minute on every replica, and an instance that has never swept (or one whose
+* session lifetime was just shortened) can match a full backlog at once. A
+* single unbounded DELETE would be one long transaction, issued concurrently
+* by every replica. Batching keeps each statement bounded; the sweep still
+* drains by looping.
+*/ const SESSION_EXPIRY_SWEEP_BATCH_SIZE = 1e3;
+//#endregion
+export { SESSION_EXPIRY_SWEEP_BATCH_SIZE };
+
+//# sourceMappingURL=constants.mjs.map

package/dist/core/authentication/session/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":["SESSION_EXPIRY_SWEEP_BATCH_SIZE"],"sources":["../../../../src/core/authentication/session/constants.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\n/**\n * Rows removed per statement by the session expiry sweep. The sweep runs every\n * minute on every replica, and an instance that has never swept (or one whose\n * session lifetime was just shortened) can match a full backlog at once. A\n * single unbounded DELETE would be one long transaction, issued concurrently\n * by every replica. Batching keeps each statement bounded; the sweep still\n * drains by looping.\n */\nexport const SESSION_EXPIRY_SWEEP_BATCH_SIZE = 1000;\n"],"mappings":";;;;;;;;;;;GAeA,MAAaA,kCAAkC"}

package/dist/core/authentication/session/index.d.ts

@@ -1,3 +1,4 @@
+export * from './constants.ts';
 export * from './module.ts';
 export * from './types.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/authentication/session/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/index.ts"],"names":[],"mappings":"AAOA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,YAAY,CAAC"}

package/dist/core/authentication/session/index.mjs

@@ -1,6 +1,7 @@
 import "node:path";
 import "node:url";
 import.meta.url;
+import { SESSION_EXPIRY_SWEEP_BATCH_SIZE } from "./constants.mjs";
 import { SessionManager } from "./module.mjs";
 import { SESSION_FILTER_KEYS } from "./types.mjs";
-export { SESSION_FILTER_KEYS, SessionManager };
+export { SESSION_EXPIRY_SWEEP_BATCH_SIZE, SESSION_FILTER_KEYS, SessionManager };

package/dist/core/authentication/session/module.d.ts

@@ -1,8 +1,9 @@
 import type { Session } from '@authup/core-kit';
-import type { ISessionManager, ISessionRepository, SessionManagerContext, SessionManagerOptions } from './types.ts';
+import type { ISessionManager, ISessionRepository, ISessionRevokeNotifier, SessionManagerContext, SessionManagerOptions } from './types.ts';
 export declare class SessionManager implements ISessionManager {
     protected options: SessionManagerOptions;
     protected repository: ISessionRepository;
+    protected revokeNotifier?: ISessionRevokeNotifier;
     constructor(ctx: SessionManagerContext);
     /**
      * Create/Update session

package/dist/core/authentication/session/module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBAI7B,GAAG,EAAE,qBAAqB;IAOtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAMjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}
+{"version":3,"file":"module.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/module.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAGhD,OAAO,KAAK,EACR,eAAe,EACf,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACxB,MAAM,YAAY,CAAC;AAEpB,qBAAa,cAAe,YAAW,eAAe;IAClD,SAAS,CAAC,OAAO,EAAE,qBAAqB,CAAC;IAEzC,SAAS,CAAC,UAAU,EAAE,kBAAkB,CAAC;IAEzC,SAAS,CAAC,cAAc,CAAC,EAAE,sBAAsB,CAAC;gBAItC,GAAG,EAAE,qBAAqB;IAQtC;;;;OAIG;IACG,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAuBjD,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAiBxC,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAc3C,eAAe,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAQzD;;;;;OAKG;IACG,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAMhD,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAyBjC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAShD"}

package/dist/core/authentication/session/module.mjs

@@ -7,9 +7,11 @@ import { JWTError } from "@authup/specs";
 var SessionManager = class {
 	options;
 	repository;
+	revokeNotifier;
 	constructor(ctx) {
 		this.options = ctx.options;
 		this.repository = ctx.repository;
+		this.revokeNotifier = ctx.revokeNotifier;
 	}
 	/**
 	* Create/Update session
@@ -54,7 +56,11 @@ var SessionManager = class {
 		return this.repository.findOneById(id);
 	}
 	async revoke(id) {
-		await this.repository.removeById(id);
+		const session = await this.repository.findOneById(id);
+		if (!session) return;
+		const clients = this.revokeNotifier ? await this.revokeNotifier.resolve(session) : [];
+		await this.repository.remove({ ...session });
+		if (this.revokeNotifier && clients.length > 0) await this.revokeNotifier.notify(session, clients);
 	}
 	async verify(session) {
 		const ms = new Date(session.expiresAt).getTime();

package/dist/core/authentication/session/module.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","removeById","verify","ms","remove","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type {\n    ISessionManager, \n    ISessionRepository, \n    SessionManagerContext, \n    SessionManagerOptions,\n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ipAddress = input.ipAddress || '127.0.0.1';\n        input.userAgent = input.userAgent || 'system';\n        input.expiresAt = input.expiresAt || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.subKind) {\n            case IdentityType.CLIENT: {\n                input.clientId = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.userId = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seenAt) {\n            const seenAt = new Date(session.seenAt).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seenAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshedAt = now;\n        session.seenAt = now;\n\n        session.expiresAt = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfaAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        await this.repository.removeById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expiresAt).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAiBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKF,UAAUE,IAAIF;EACnB,KAAKC,aAAaC,IAAID;CAC1B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKf,aAAagB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKlB,aAAamB,MACdZ,MAAMa,SAASb,MAAMW;EAG7B;EAEA,OAAO,KAAKd,WAAWiB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,MAEZb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKT,QAAQU,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKV,WAAWiB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK5B,WAAW2B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAM,KAAK5B,WAAW8B,WAAWF,EAAAA;CACrC;CAIA,MAAMG,OAAOZ,SAAiC;EAC1C,MAAMa,KAAK,IAAIzB,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAKwB,IAAI;GACjB,MAAM,KAAKhC,WAAWiC,OAAOd,OAAAA;GAG7B,MAAMtB,SAASqC,QAAO;EAC1B;CACJ;AACJ"}
+{"version":3,"file":"module.mjs","names":["IdentityType","JWTError","SessionManager","options","repository","revokeNotifier","ctx","create","input","ipAddress","userAgent","expiresAt","Date","now","maxAge","toISOString","subKind","CLIENT","clientId","sub","USER","userId","save","ping","session","seenAt","getTime","threshold","refresh","refreshedAt","markMfaVerified","mfaAt","findOneById","id","revoke","clients","resolve","remove","length","notify","verify","ms","expired"],"sources":["../../../../src/core/authentication/session/module.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport { IdentityType } from '@authup/core-kit';\nimport { JWTError } from '@authup/specs';\nimport type { \n    ISessionManager, \n    ISessionRepository, \n    ISessionRevokeNotifier, \n    SessionManagerContext, \n    SessionManagerOptions, \n} from './types.ts';\n\nexport class SessionManager implements ISessionManager {\n    protected options: SessionManagerOptions;\n\n    protected repository: ISessionRepository;\n\n    protected revokeNotifier?: ISessionRevokeNotifier;\n\n    // -----------------------------------------------------\n\n    constructor(ctx: SessionManagerContext) {\n        this.options = ctx.options;\n        this.repository = ctx.repository;\n        this.revokeNotifier = ctx.revokeNotifier;\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Create/Update session\n     *\n     * @param input\n     */\n    async create(input: Partial<Session>): Promise<Session> {\n        input.ipAddress = input.ipAddress || '127.0.0.1';\n        input.userAgent = input.userAgent || 'system';\n        input.expiresAt = input.expiresAt || new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        switch (input.subKind) {\n            case IdentityType.CLIENT: {\n                input.clientId = input.sub;\n                break;\n            }\n            case IdentityType.USER: {\n                input.userId = input.sub;\n                break;\n            }\n        }\n\n        return this.repository.save(input);\n    }\n\n    // -----------------------------------------------------\n\n    async ping(session: Session): Promise<Session> {\n        if (session.seenAt) {\n            const seenAt = new Date(session.seenAt).getTime();\n            const threshold = seenAt + (5 * 1_000);\n\n            if (threshold > Date.now()) {\n                return session;\n            }\n        }\n\n        session.seenAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async refresh(session: Session): Promise<Session> {\n        const now = new Date().toISOString();\n        session.refreshedAt = now;\n        session.seenAt = now;\n\n        session.expiresAt = new Date(\n            Date.now() + (this.options.maxAge * 1_000),\n        ).toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    async markMfaVerified(session: Session): Promise<Session> {\n        session.mfaAt = new Date().toISOString();\n\n        return this.repository.save(session);\n    }\n\n    // -----------------------------------------------------\n\n    /**\n     * Verify session on token inspection/verification.\n     *\n     * @param id\n     * @throws JWTError\n     */\n    async findOneById(id: string): Promise<Session | null> {\n        return this.repository.findOneById(id);\n    }\n\n    // -----------------------------------------------------\n\n    async revoke(id: string): Promise<void> {\n        const session = await this.repository.findOneById(id);\n        if (!session) {\n            return;\n        }\n\n        // The audience is read BEFORE the row goes: it derives from the\n        // session's token rows, which cascade-delete with it. Delivery waits\n        // until AFTER, so a client is never told about a session that still\n        // exists.\n        const clients = this.revokeNotifier ?\n            await this.revokeNotifier.resolve(session) :\n            [];\n\n        // A copy goes to the repository: TypeORM unsets the primary key on\n        // the entity it removed, and the notifier still needs `sid`.\n        await this.repository.remove({ ...session });\n\n        if (this.revokeNotifier && clients.length > 0) {\n            await this.revokeNotifier.notify(session, clients);\n        }\n    }\n\n    // -----------------------------------------------------\n\n    async verify(session: Session): Promise<void> {\n        const ms = new Date(session.expiresAt).getTime();\n        if (Date.now() > ms) {\n            await this.repository.remove(session);\n\n            // todo: better error\n            throw JWTError.expired();\n        }\n    }\n}\n"],"mappings":";;;;;;AAkBA,IAAaE,iBAAb,MAAaA;CACCC;CAEAC;CAEAC;CAIV,YAAYC,KAA4B;EACpC,KAAKH,UAAUG,IAAIH;EACnB,KAAKC,aAAaE,IAAIF;EACtB,KAAKC,iBAAiBC,IAAID;CAC9B;;;;;IASA,MAAME,OAAOC,OAA2C;EACpDA,MAAMC,YAAYD,MAAMC,aAAa;EACrCD,MAAME,YAAYF,MAAME,aAAa;EACrCF,MAAMG,YAAYH,MAAMG,aAAa,IAAIC,KACrCA,KAAKC,IAAG,IAAM,KAAKV,QAAQW,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,QAAQP,MAAMQ,SAAd;GACI,KAAKhB,aAAaiB;IACdT,MAAMU,WAAWV,MAAMW;IACvB;GAEJ,KAAKnB,aAAaoB,MACdZ,MAAMa,SAASb,MAAMW;EAG7B;EAEA,OAAO,KAAKf,WAAWkB,KAAKd,KAAAA;CAChC;CAIA,MAAMe,KAAKC,SAAoC;EAC3C,IAAIA,QAAQC,QACO;OAAA,IAAIb,KAAKY,QAAQC,MAAM,CAAA,CAAEC,QACtBD,IAAU,MAEZb,KAAKC,IAAG,GACpB,OAAOW;EAAAA;EAIfA,QAAQC,0BAAS,IAAIb,KAAAA,EAAAA,CAAOG,YAAW;EAEvC,OAAO,KAAKX,WAAWkB,KAAKE,OAAAA;CAChC;CAIA,MAAMI,QAAQJ,SAAoC;EAC9C,MAAMX,uBAAM,IAAID,KAAAA,EAAAA,CAAOG,YAAW;EAClCS,QAAQK,cAAchB;EACtBW,QAAQC,SAASZ;EAEjBW,QAAQb,YAAY,IAAIC,KACpBA,KAAKC,IAAG,IAAM,KAAKV,QAAQW,SAAS,GAAA,CAAA,CACtCC,YAAW;EAEb,OAAO,KAAKX,WAAWkB,KAAKE,OAAAA;CAChC;CAIA,MAAMM,gBAAgBN,SAAoC;EACtDA,QAAQO,yBAAQ,IAAInB,KAAAA,EAAAA,CAAOG,YAAW;EAEtC,OAAO,KAAKX,WAAWkB,KAAKE,OAAAA;CAChC;;;;;;IAUA,MAAMQ,YAAYC,IAAqC;EACnD,OAAO,KAAK7B,WAAW4B,YAAYC,EAAAA;CACvC;CAIA,MAAMC,OAAOD,IAA2B;EACpC,MAAMT,UAAU,MAAM,KAAKpB,WAAW4B,YAAYC,EAAAA;EAClD,IAAI,CAACT,SACD;EAOJ,MAAMW,UAAU,KAAK9B,iBACjB,MAAM,KAAKA,eAAe+B,QAAQZ,OAAAA,IAClC,CAAA;EAIJ,MAAM,KAAKpB,WAAWiC,OAAO,EAAE,GAAGb,QAAQ,CAAA;EAE1C,IAAI,KAAKnB,kBAAkB8B,QAAQG,SAAS,GACxC,MAAM,KAAKjC,eAAekC,OAAOf,SAASW,OAAAA;CAElD;CAIA,MAAMK,OAAOhB,SAAiC;EAC1C,MAAMiB,KAAK,IAAI7B,KAAKY,QAAQb,SAAS,CAAA,CAAEe,QAAO;EAC9C,IAAId,KAAKC,IAAG,IAAK4B,IAAI;GACjB,MAAM,KAAKrC,WAAWiC,OAAOb,OAAAA;GAG7B,MAAMvB,SAASyC,QAAO;EAC1B;CACJ;AACJ"}

package/dist/core/authentication/session/types.d.ts

@@ -1,4 +1,4 @@
-import type { Session } from '@authup/core-kit';
+import type { Client, Session } from '@authup/core-kit';
 import type { IQuery } from '@rapiq/core';
 import type { EntityRepositoryFindManyResult } from '@authup/server-kit';
 export type SessionOwner = {
@@ -18,8 +18,36 @@ export type SessionFindManyOptions = {
      */
     owner?: SessionOwner;
 };
+export type SessionDeleteExpiredOptions = {
+    /**
+     * Rows removed per statement. Defaults to
+     * SESSION_EXPIRY_SWEEP_BATCH_SIZE, which anything that is not a positive
+     * safe integer also falls back to.
+     */
+    batchSize?: number;
+};
 export interface ISessionRepository {
     findOneById(id: string): Promise<Session | null> | null;
+    /**
+     * Resolve a session by the opaque credential a console browser presents
+     * (plan 088). The ONLY read that touches the `select: false` `secret`
+     * column, and it does so in the WHERE clause: the returned session carries
+     * no secret, like every other read.
+     *
+     * Never cached: the id-keyed session cache cannot answer it, and a
+     * multi-day credential must resolve against the row rather than against a
+     * blob a replica may never have seen.
+     */
+    findOneBySecret(secret: string): Promise<Session | null>;
+    /**
+     * Write or clear the opaque credential on one session row.
+     *
+     * A dedicated write rather than a `save()` of the whole session: `save()`
+     * round-trips every column, so a session read back without its
+     * `select: false` secret would silently clear it, and one read back with
+     * only an id would evict the cached row.
+     */
+    updateSecret(id: string, secret: string | null): Promise<void>;
     findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;
     findAllByOwner(owner: SessionOwner): Promise<Session[]>;
     /**
@@ -32,6 +60,15 @@ export interface ISessionRepository {
     save(session: Partial<Session>): Promise<Session>;
     removeById(id: string): Promise<void>;
     remove(session: Session): Promise<void>;
+    /**
+     * Expiry sweep: delete every session whose `expiresAt` is before the given
+     * timestamp. Returns the number of removed rows. Removal is batched (see
+     * SESSION_EXPIRY_SWEEP_BATCH_SIZE).
+     *
+     * @param before iso timestamp
+     * @param options
+     */
+    deleteExpired(before: string, options?: SessionDeleteExpiredOptions): Promise<number>;
 }
 export type SessionManagerOptions = {
     /**
@@ -39,9 +76,37 @@ export type SessionManagerOptions = {
      */
     maxAge: number;
 };
+/**
+ * Tells the clients that rode a session that it was revoked. The OAuth2
+ * implementation pushes an OIDC back-channel logout token; the manager only
+ * knows the two steps and their order.
+ */
+export interface ISessionRevokeNotifier {
+    /**
+     * The clients to notify once the session is gone. Runs BEFORE the row is
+     * removed, because what the audience derives from (the session's token
+     * rows) cascade-deletes with it.
+     *
+     * @param session
+     */
+    resolve(session: Session): Promise<Client[]>;
+    /**
+     * Notify the resolved clients. Best effort: a refusing or unreachable
+     * client is logged and never fails the revoke.
+     *
+     * @param session
+     * @param clients
+     */
+    notify(session: Session, clients: Client[]): Promise<void>;
+}
 export type SessionManagerContext = {
     options: SessionManagerOptions;
     repository: ISessionRepository;
+    /**
+     * Notified on every revoke (plan 064: the OAuth2 back-channel logout).
+     * Optional so a fake-backed spec constructs the manager without one.
+     */
+    revokeNotifier?: ISessionRevokeNotifier;
 };
 export interface ISessionManager {
     /**
@@ -85,6 +150,10 @@ export interface ISessionManager {
      * Revoke (delete) a session by id, forcing re-authentication. Idempotent —
      * a no-op when the session does not exist.
      *
+     * The ONE chokepoint every session end goes through, because it is where
+     * the back-channel logout is pushed: a caller deleting the row on the
+     * repository directly ends the session without telling any client.
+     *
      * @param id
      */
     revoke(id: string): Promise<void>;

package/dist/core/authentication/session/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;OAKG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/core/authentication/session/types.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,8BAA8B,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,MAAM,YAAY,GAAG;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,oEAOtB,CAAC;AAEX,MAAM,MAAM,sBAAsB,GAAG;IACjC;;;OAGG;IACH,KAAK,CAAC,EAAE,YAAY,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,2BAA2B,GAAG;IACtC;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;CACtB,CAAC;AAEF,MAAM,WAAW,kBAAkB;IAC/B,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAExD;;;;;;;;;OASG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEzD;;;;;;;OAOG;IACH,YAAY,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE/D,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,8BAA8B,CAAC,OAAO,CAAC,CAAC,CAAC;IAE5G,cAAc,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAExD;;;;;OAKG;IACH,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAElD,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAElD,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtC,MAAM,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzC;;;;;;;OAOG;IACH,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,2BAA2B,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC;;OAEG;IACH,MAAM,EAAE,MAAM,CAAA;CACjB,CAAC;AAEF;;;;GAIG;AACH,MAAM,WAAW,sBAAsB;IACnC;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAE7C;;;;;;OAMG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC9D;AAED,MAAM,MAAM,qBAAqB,GAAG;IAChC,OAAO,EAAE,qBAAqB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B;;;OAGG;IACH,cAAc,CAAC,EAAE,sBAAsB,CAAC;CAC3C,CAAC;AAEF,MAAM,WAAW,eAAe;IAC5B;;;;OAIG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEpD;;;;OAIG;IACH,IAAI,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE1C;;;;OAIG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAE7C;;;;OAIG;IACH,eAAe,CAAC,OAAO,EAAE,OAAO,GAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAErD;;;;;OAKG;IACH,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC;;;;OAIG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IAEjD;;;;;;;;;OASG;IACH,MAAM,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrC"}

package/dist/core/authentication/session/types.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'subKind',\n    'userId',\n    'clientId',\n    'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: IQuery): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seenAt with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshedAt, seenAt with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfaAt) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACH"}
+{"version":3,"file":"types.mjs","names":["SESSION_FILTER_KEYS"],"sources":["../../../../src/core/authentication/session/types.ts"],"sourcesContent":["/*\n * Copyright (c) 2025.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { Client, Session } from '@authup/core-kit';\nimport type { IQuery } from '@rapiq/core';\nimport type { EntityRepositoryFindManyResult } from '@authup/server-kit';\n\nexport type SessionOwner = {\n    sub: string,\n    subKind: string,\n};\n\n/**\n * Filter keys a session query (list + bulk revoke) may target. Shared by the\n * repository's rapiq `filters.allowed` and the service's \"is this a targeted\n * bulk revoke?\" discriminator, so the two can never drift.\n */\nexport const SESSION_FILTER_KEYS = [\n    'id',\n    'sub',\n    'subKind',\n    'userId',\n    'clientId',\n    'realmId',\n] as const;\n\nexport type SessionFindManyOptions = {\n    /**\n     * Force the result to a single subject (self-service). Applied as a\n     * mandatory WHERE that a rapiq query filter cannot override.\n     */\n    owner?: SessionOwner,\n};\n\nexport type SessionDeleteExpiredOptions = {\n    /**\n     * Rows removed per statement. Defaults to\n     * SESSION_EXPIRY_SWEEP_BATCH_SIZE, which anything that is not a positive\n     * safe integer also falls back to.\n     */\n    batchSize?: number,\n};\n\nexport interface ISessionRepository {\n    findOneById(id: string): Promise<Session | null> | null;\n\n    /**\n     * Resolve a session by the opaque credential a console browser presents\n     * (plan 088). The ONLY read that touches the `select: false` `secret`\n     * column, and it does so in the WHERE clause: the returned session carries\n     * no secret, like every other read.\n     *\n     * Never cached: the id-keyed session cache cannot answer it, and a\n     * multi-day credential must resolve against the row rather than against a\n     * blob a replica may never have seen.\n     */\n    findOneBySecret(secret: string): Promise<Session | null>;\n\n    /**\n     * Write or clear the opaque credential on one session row.\n     *\n     * A dedicated write rather than a `save()` of the whole session: `save()`\n     * round-trips every column, so a session read back without its\n     * `select: false` secret would silently clear it, and one read back with\n     * only an id would evict the cached row.\n     */\n    updateSecret(id: string, secret: string | null): Promise<void>;\n\n    findMany(query: IQuery, options?: SessionFindManyOptions): Promise<EntityRepositoryFindManyResult<Session>>;\n\n    findAllByOwner(owner: SessionOwner): Promise<Session[]>;\n\n    /**\n     * Load EVERY session matching a rapiq query filter — **unbounded** (no\n     * pagination cap), because a bulk revoke must reach every match. Used by\n     * the admin \"force-logout\" path; per-session authorization is enforced by\n     * the caller (`SessionService`).\n     */\n    findAllByQuery(query: IQuery): Promise<Session[]>;\n\n    save(session: Partial<Session>): Promise<Session>;\n\n    removeById(id: string): Promise<void>;\n\n    remove(session: Session) : Promise<void>;\n\n    /**\n     * Expiry sweep: delete every session whose `expiresAt` is before the given\n     * timestamp. Returns the number of removed rows. Removal is batched (see\n     * SESSION_EXPIRY_SWEEP_BATCH_SIZE).\n     *\n     * @param before iso timestamp\n     * @param options\n     */\n    deleteExpired(before: string, options?: SessionDeleteExpiredOptions): Promise<number>;\n}\n\nexport type SessionManagerOptions = {\n    /**\n     * Max age in seconds (sec).\n     */\n    maxAge: number\n};\n\n/**\n * Tells the clients that rode a session that it was revoked. The OAuth2\n * implementation pushes an OIDC back-channel logout token; the manager only\n * knows the two steps and their order.\n */\nexport interface ISessionRevokeNotifier {\n    /**\n     * The clients to notify once the session is gone. Runs BEFORE the row is\n     * removed, because what the audience derives from (the session's token\n     * rows) cascade-deletes with it.\n     *\n     * @param session\n     */\n    resolve(session: Session): Promise<Client[]>;\n\n    /**\n     * Notify the resolved clients. Best effort: a refusing or unreachable\n     * client is logged and never fails the revoke.\n     *\n     * @param session\n     * @param clients\n     */\n    notify(session: Session, clients: Client[]): Promise<void>;\n}\n\nexport type SessionManagerContext = {\n    options: SessionManagerOptions,\n    repository: ISessionRepository,\n    /**\n     * Notified on every revoke (plan 064: the OAuth2 back-channel logout).\n     * Optional so a fake-backed spec constructs the manager without one.\n     */\n    revokeNotifier?: ISessionRevokeNotifier,\n};\n\nexport interface ISessionManager {\n    /**\n     * Create new session.\n     *\n     * @param session\n     */\n    create(session: Partial<Session>): Promise<Session>;\n\n    /**\n     * Updates seenAt with current time.\n     *\n     * @param session\n     */\n    ping(session: Session) : Promise<Session>;\n\n    /**\n     * Updates refreshedAt, seenAt with current time.\n     *\n     * @param session\n     */\n    refresh(session: Session) : Promise<Session>;\n\n    /**\n     * Stamp a successful second-factor challenge (mfaAt) onto the session.\n     *\n     * @param session\n     */\n    markMfaVerified(session: Session) : Promise<Session>;\n\n    /**\n     * Check if session exists and is valid.\n     *\n     * @throws JWTError\n     * @param session\n     */\n    verify(session: Session): Promise<void>;\n\n    /**\n     * Find session by id.\n     *\n     * @param id\n     */\n    findOneById(id: string): Promise<Session | null>;\n\n    /**\n     * Revoke (delete) a session by id, forcing re-authentication. Idempotent —\n     * a no-op when the session does not exist.\n     *\n     * The ONE chokepoint every session end goes through, because it is where\n     * the back-channel logout is pushed: a caller deleting the row on the\n     * repository directly ends the session without telling any client.\n     *\n     * @param id\n     */\n    revoke(id: string): Promise<void>;\n}\n"],"mappings":";;;;;;;;GAqBA,MAAaA,sBAAsB;CAC/B;CACA;CACA;CACA;CACA;CACA;AACH"}

package/dist/core/entities/client/schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CA2CvB,CAAC"}
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/schema.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AA2D/C,eAAO,MAAM,YAAY,2CA0CvB,CAAC"}

package/dist/core/entities/client/schema.mjs

@@ -68,11 +68,10 @@ const clientSchema = defineSchema({
 			"secretHashed",
 			"secretEncrypted",
 			"baseUrl",
-			"rootUrl",
 			"redirectUri",
 			"postLogoutRedirectUri",
+			"backchannelLogoutUri",
 			"grantTypes",
-			"scope",
 			"authMethod",
 			"tokenBindingMethod",
 			"accessPolicyId",

package/dist/core/entities/client/schema.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","indexes","fields","default","allowed","validateMany","secret","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['realmId'],\n        ['active'],\n        ['builtIn'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'rootUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'grantTypes',\n            'scope',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'displayName', 'realmId', 'active', 'builtIn'], indexed: true },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc5B,qBAAqB,EAAE6B,QAAQrB,eAAe,CAAA;CAChE;CACAsB,SAAS;EAAEH,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAW;GAAU;EAAU;EAAEI,SAAS;CAAK;CACjGC,WAAW;EAAEL,SAAS,CAAC,SAAS,cAAe;EAAEM,UAAUhC,wBAAwBE,aAAAA;CAAe;CAClG+B,OAAO;EAAEP,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEI,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BjC;AACJ,CAAA"}
+{"version":3,"file":"schema.mjs","names":["and","defineSchema","eq","ne","or","EntityType","IdentityType","createFieldsReadGate","createRelationsReadGate","CLIENT_READ_PERMISSIONS","schemaMapping","realm","REALM","accessPolicy","POLICY","secretReadGate","actor","compiled","permissionEvaluator","compile","name","verdict","visible","push","condition","identity","type","CLIENT","data","id","clientSchema","indexes","fields","default","allowed","validateMany","secret","filters","indexed","relations","validate","sorts","pagination","maxLimit"],"sources":["../../../../src/core/entities/client/schema.ts"],"sourcesContent":["/*\n * Copyright (c) 2026.\n * Author Peter Placzek (tada5hi)\n * For the full copyright and license information,\n * view the LICENSE file that was distributed with this source code.\n */\n\nimport type { ICondition, KeyValidationVerdict } from '@rapiq/core';\nimport {\n    and,\n    defineSchema,\n    eq,\n    ne,\n    or,\n} from '@rapiq/core';\nimport type { Client } from '@authup/core-kit';\nimport { EntityType, IdentityType } from '@authup/core-kit';\nimport type { ActorContext } from '@authup/server-kit';\nimport { createFieldsReadGate } from '../../query/fields.ts';\nimport { createRelationsReadGate } from '../../query/relations.ts';\nimport { CLIENT_READ_PERMISSIONS } from './constants.ts';\n\nconst schemaMapping = { realm: EntityType.REALM, accessPolicy: EntityType.POLICY };\n\n/**\n * Per-row visibility gate for the `secret` column (issue #3322) —\n * schema-level, so it applies wherever the client schema governs a\n * projection: the `/clients` root AND the `include=client` paths of\n * client-permission / client-role / client-scope, which never run\n * `ClientService`'s read path.\n *\n * Only rows exposing a PLAINTEXT secret are guarded: `null`, hashed\n * and encrypted values stay visible to any actor that passed the read\n * pre-gate (the historical service semantics). A plaintext value is\n * additionally visible on the actor's OWN client row (the `getOne`\n * isMe bypass, list-shaped) and on rows the compiled permission\n * condition covers. A non-expressible (`post`) or settled-deny compile\n * yields no permission leg — fail closed for plaintext rows rather\n * than falling back to per-row evaluation.\n *\n * The outer `ne('realmId', null)` guard is semantically inert (clients\n * are realm-bound) but makes the condition fail closed on rows whose\n * gate columns were not fetched — an `ownOrNull` reach compiles to a\n * null-inclusive realm leg that would otherwise MATCH a missing\n * column. The SQL adapter force-selects every column the condition\n * reads (rapiq#830's operand projection), so this is defense in depth.\n */\nasync function secretReadGate(actor: ActorContext) : Promise<KeyValidationVerdict> {\n    const compiled = await actor.permissionEvaluator.compile({ name: CLIENT_READ_PERMISSIONS });\n    if (compiled.verdict === 'allow') {\n        return true;\n    }\n\n    const visible : ICondition[] = [\n        eq('secret', null),\n        eq('secretHashed', true),\n        eq('secretEncrypted', true),\n    ];\n\n    if (compiled.verdict === 'conditional') {\n        visible.push(compiled.condition);\n    }\n\n    if (\n        actor.identity &&\n        actor.identity.type === IdentityType.CLIENT &&\n        actor.identity.data.id\n    ) {\n        visible.push(eq('id', actor.identity.data.id));\n    }\n\n    return and(ne('realmId', null), or(...visible));\n}\n\nexport const clientSchema = defineSchema<Client>({\n    name: EntityType.CLIENT,\n    indexes: [\n        ['id'],\n        ['name', 'realmId'],\n        ['displayName'],\n        ['realmId'],\n        ['active'],\n        ['builtIn'],\n        ['createdAt'],\n        ['updatedAt'],\n    ],\n    fields: {\n        default: [\n            'id',\n            'active',\n            'builtIn',\n            'name',\n            'displayName',\n            'description',\n            'secretHashed',\n            'secretEncrypted',\n            'baseUrl',\n            'redirectUri',\n            'postLogoutRedirectUri',\n            'backchannelLogoutUri',\n            'grantTypes',\n            'authMethod',\n            'tokenBindingMethod',\n            'accessPolicyId',\n            'realmId',\n            'updatedAt',\n            'createdAt',\n        ],\n        allowed: ['secret'],\n        validateMany: createFieldsReadGate({ secret: secretReadGate }),\n    },\n    filters: { allowed: ['id', 'name', 'displayName', 'realmId', 'active', 'builtIn'], indexed: true },\n    relations: { allowed: ['realm', 'accessPolicy'], validate: createRelationsReadGate(schemaMapping) },\n    sorts: { allowed: ['id', 'createdAt', 'updatedAt'], indexed: true },\n    pagination: { maxLimit: 50 },\n    schemaMapping,\n});\n"],"mappings":";;;;;;;;;AAsBA,MAAMU,gBAAgB;CAAEC,OAAON,WAAWO;CAAOC,cAAcR,WAAWS;AAAO;;;;;;;;;;;;;;;;;;;;;;;GAyBjF,eAAeC,eAAeC,OAAmB;CAC7C,MAAMC,WAAW,MAAMD,MAAME,oBAAoBC,QAAQ,EAAEC,MAAMX,wBAAwB,CAAA;CACzF,IAAIQ,SAASI,YAAY,SACrB,OAAO;CAGX,MAAMC,UAAyB;EAC3BpB,GAAG,UAAU,IAAA;EACbA,GAAG,gBAAgB,IAAA;EACnBA,GAAG,mBAAmB,IAAA;CACzB;CAED,IAAIe,SAASI,YAAY,eACrBC,QAAQC,KAAKN,SAASO,SAAS;CAGnC,IACIR,MAAMS,YACNT,MAAMS,SAASC,SAASpB,aAAaqB,UACrCX,MAAMS,SAASG,KAAKC,IAEpBP,QAAQC,KAAKrB,GAAG,MAAMc,MAAMS,SAASG,KAAKC,EAAE,CAAA;CAGhD,OAAO7B,IAAIG,GAAG,WAAW,IAAA,GAAOC,GAAAA,GAAMkB,OAAAA,CAAAA;AAC1C;AAEA,MAAaQ,eAAe7B,aAAqB;CAC7CmB,MAAMf,WAAWsB;CACjBI,SAAS;EACL,CAAC,IAAK;EACN,CAAC,QAAQ,SAAU;EACnB,CAAC,aAAc;EACf,CAAC,SAAU;EACX,CAAC,QAAS;EACV,CAAC,SAAU;EACX,CAAC,WAAY;EACb,CAAC,WAAY;CAChB;CACDC,QAAQ;EACJC,SAAS;GACL;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;GACA;EACH;EACDC,SAAS,CAAC,QAAS;EACnBC,cAAc5B,qBAAqB,EAAE6B,QAAQrB,eAAe,CAAA;CAChE;CACAsB,SAAS;EAAEH,SAAS;GAAC;GAAM;GAAQ;GAAe;GAAW;GAAU;EAAU;EAAEI,SAAS;CAAK;CACjGC,WAAW;EAAEL,SAAS,CAAC,SAAS,cAAe;EAAEM,UAAUhC,wBAAwBE,aAAAA;CAAe;CAClG+B,OAAO;EAAEP,SAAS;GAAC;GAAM;GAAa;EAAY;EAAEI,SAAS;CAAK;CAClEI,YAAY,EAAEC,UAAU,GAAG;CAC3BjC;AACJ,CAAA"}

package/dist/core/entities/client/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IA6JI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../../src/core/entities/client/service.ts"],"names":[],"mappings":"AAUA,OAAO,EAGH,eAAe,EAElB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,8BAA8B,EAAG,MAAM,oBAAoB,CAAC;AACxF,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,OAAO,KAAK,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAKpE,MAAM,MAAM,oBAAoB,GAAG;IAC/B,UAAU,EAAE,iBAAiB,CAAC;IAC9B,eAAe,EAAE,gBAAgB,CAAC;CACrC,CAAC;AAEF,qBAAa,aAAc,SAAQ,qBAAsB,YAAW,cAAc;IAC9E,SAAS,CAAC,UAAU,EAAE,iBAAiB,CAAC;IAExC,SAAS,CAAC,eAAe,EAAE,gBAAgB,CAAC;IAE5C,SAAS,CAAC,SAAS,EAAE,eAAe,CAAC;gBAEzB,GAAG,EAAE,oBAAoB;IAO/B,OAAO,CACT,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,8BAA8B,CAAC,MAAM,CAAC,CAAC;IAY5C,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,YAAY,EACnB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,OAAO,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,MAAM,CAAC;IA6CZ,MAAM,CACR,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,MAAM,CACR,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;IAKZ,IAAI,CACN,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,KAAK,EAAE,YAAY,EACnB,OAAO,GAAE;QAAE,UAAU,CAAC,EAAE,OAAO,CAAA;KAAO,GACvC,OAAO,CAAC;QACP,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,OAAO,CAAA;KACnB,CAAC;IAkMI,MAAM,CACR,EAAE,EAAE,MAAM,EACV,KAAK,EAAE,YAAY,GACpB,OAAO,CAAC,MAAM,CAAC;CAmBrB"}