@azlib/identity 0.2.0 → 0.2.1

package/dist/{identity-router-Dib30Waj.d.cts → identity-router-tj3-teBI.d.mts}

@@ -1,7 +1,6 @@
-import { F as IdentityLogger } from "./errors-C2xZAatu.cjs";
-import { t as IdentityService } from "./identity-service-CLzKx8Z7.cjs";
-import { Request, Response, Router } from "express";
-
+import { F as IdentityLogger } from "./errors-_OcodtdV.mjs";
+import { t as IdentityService } from "./identity-service-WpOKb0MK.mjs";
+import { NextFunction, Request, Response, Router } from "express";
 //#region core/express/identity-router.d.ts
 /** Options for controlling the refresh-token cookie. */
 interface CookieRefreshOptions {
@@ -110,6 +109,23 @@ interface IdentityRouterOptions {
  * | GET  | `/:provider/callback` | Handle an OAuth 2.0 callback *(optional)* |
  */
 declare function createIdentityRouter(service: IdentityService, options?: IdentityRouterOptions): Router;
+/**
+ * Factory that creates an Express error-handling middleware which converts
+ * {@link IdentityError} instances to structured JSON responses.
+ * Mount it after the identity router:
+ *
+ * ```ts
+ * app.use(createIdentityRouter(service, { prefix: "auth" }));
+ * app.use(identityErrorHandler());                // default console logger
+ * app.use(identityErrorHandler({ logger: false })); // silent
+ * ```
+ *
+ * @param options.logger - Logger for recording serialised error details.
+ *   Pass `false` to disable. Defaults to the console logger.
+ */
+declare function identityErrorHandler(options?: {
+  logger?: IdentityLogger | false;
+}): (err: unknown, req: Request, res: Response, next: NextFunction) => void;
 //#endregion
-export { IdentityRouterOptions as n, createIdentityRouter as r, CookieRefreshOptions as t };
-//# sourceMappingURL=identity-router-Dib30Waj.d.cts.map
+export { identityErrorHandler as i, IdentityRouterOptions as n, createIdentityRouter as r, CookieRefreshOptions as t };
+//# sourceMappingURL=identity-router-tj3-teBI.d.mts.map

package/dist/identity-router-tj3-teBI.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-router-tj3-teBI.d.mts","names":[],"sources":["../core/express/identity-router.ts"],"mappings":";;;;;UAeiB;;EAEf;;EAEA;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;;;UAMe;;;;;;;;;;;;EAYf;IAA0B,QAAQ;;;;;;;;;;EAUlC;;;;;;;;;;;;;;EAeA;;;;;;;;;;;;;;EAeA,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAsIK,qBACd,SAAS,iBACT,UAAS,wBACR;;;;;;;;;;;;;;;iBAkUa,qBACd;EAAW,SAAS;KAClB,cAAc,KAAK,SAAS,KAAK,UAAU,MAAM"}

package/dist/{identity-service-CLzKx8Z7.d.cts → identity-service---OTann1.d.cts}

@@ -1,6 +1,5 @@
 import { T as TotpSetupResult, c as AuthResult, d as AuthenticatedIdentity, r as IdentityStore, v as LoginResult } from "./identity-store-BRRahxcS.cjs";
-import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-C2xZAatu.cjs";
-
+import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
 //#region core/password-hasher.d.ts
 interface PasswordHasher {
   hash(password: string): Promise<string>;
@@ -125,4 +124,4 @@ interface IdentityServiceConfig extends IdentityConfigInput {
 declare function createIdentityService(configInput: IdentityServiceConfig, store: IdentityStore): IdentityService;
 //#endregion
 export { RegisterInput as a, registerUser as c, loginUser as d, PasswordHasher as f, RegisterDeps as i, LoginDeps as l, IdentityServiceConfig as n, RegistrationValidationError as o, createPasswordHasher as p, createIdentityService as r, normalizeEmail as s, IdentityService as t, LoginInput as u };
-//# sourceMappingURL=identity-service-CLzKx8Z7.d.cts.map
+//# sourceMappingURL=identity-service---OTann1.d.cts.map

package/dist/identity-service---OTann1.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-service---OTann1.d.cts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UAuBiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCnBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UAAU,MAAM,WAAW,OAAO,aAAa,QAAQ;;;;UCtB5D,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EACnC,YAAA;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}

package/dist/{identity-service-B9zrvE9z.d.mts → identity-service-WpOKb0MK.d.mts}

@@ -1,6 +1,5 @@
 import { T as TotpSetupResult, c as AuthResult, d as AuthenticatedIdentity, r as IdentityStore, v as LoginResult } from "./identity-store-BRRahxcS.mjs";
-import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-BGMwaW5s.mjs";
-
+import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
 //#region core/password-hasher.d.ts
 interface PasswordHasher {
   hash(password: string): Promise<string>;
@@ -125,4 +124,4 @@ interface IdentityServiceConfig extends IdentityConfigInput {
 declare function createIdentityService(configInput: IdentityServiceConfig, store: IdentityStore): IdentityService;
 //#endregion
 export { RegisterInput as a, registerUser as c, loginUser as d, PasswordHasher as f, RegisterDeps as i, LoginDeps as l, IdentityServiceConfig as n, RegistrationValidationError as o, createPasswordHasher as p, createIdentityService as r, normalizeEmail as s, IdentityService as t, LoginInput as u };
-//# sourceMappingURL=identity-service-B9zrvE9z.d.mts.map
+//# sourceMappingURL=identity-service-WpOKb0MK.d.mts.map

package/dist/identity-service-WpOKb0MK.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-service-WpOKb0MK.d.mts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UAuBiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCnBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UAAU,MAAM,WAAW,OAAO,aAAa,QAAQ;;;;UCtB5D,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EACnC,YAAA;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}

package/dist/identity-store-BRRahxcS.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store-BRRahxcS.d.cts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;AAQA;;;;AAA8B;AAG9B;AAAA,KAHY,kBAAA;;UAGK,YAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,eAAA,EAAiB,IAAA;EAqBF;;;EAjBf,gBAAA;EALA;;;;EAUA,WAAA;EAAA;;;;EAKA,mBAAA;EAMW;;;;EADX,WAAA,EAAa,IAAA;EACb,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,gBAAA;EACf,MAAA;EAGA;EADA,YAAA;EACA,SAAA,EAAW,IAAI;AAAA;AAOjB;;;;AAAA,UAAiB,WAAA;EACf,SAAA;EACA,MAAA;EAMe;EAJf,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;EADX;EAGA,SAAA,EAAW,IAAA;AAAA;;KAID,UAAA;;UAGK,IAAA;EACf,MAAA;EACA,IAAA;EACA,WAAA;AAAA;;UAIe,kBAAA;EACf,MAAA;EACA,MAAM;AAAA;;UAIS,mBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZX;AAAA,UAgBI,qBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZhB;AAAA,KAgBI,iBAAA;;UAoBK,kBAAA;EACf,MAAA;EAhCA;EAkCA,QAAA;EAjCY;EAmCZ,cAAA;EACA,KAAA;EACA,WAAA;EACA,QAAA,EAAU,IAAI;AAAA;;UAIC,aAAA;EACf,IAAA,EAAM,iBAAA;EACN,MAAA;EAtCsB;EAwCtB,QAAA,EAAU,MAAA;EACV,UAAA,EAAY,IAAA;AAAA;;;AArCe;AAoB7B;UAwBiB,qBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,aAAA;EACA,KAAA;EACA,WAAA,WAAsB,UAAU;AAAA;;UAIjB,UAAA;EACf,WAAA;EACA,YAAA;EACA,oBAAA,EAAsB,IAAA;EACtB,qBAAA,EAAuB,IAAI;AAAA;;UAIZ,UAAA;EACf,IAAA,EAAM,qBAAA;EACN,MAAA,EAAQ,UAAU;AAAA;;;;;UAOH,iBAAA;EACf,IAAA;EApCgB;EAsChB,QAAQ;AAAA;;KAIE,WAAA,GAAc,UAAA,GAAa,iBAAiB;;KAG5C,qBAAA;;UAGK,iBAAA;EArCf;EAuCA,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAA;EAvCW;EAyCtB,MAAA,EAAQ,IAAA;AAAA;AArCV;AAAA,UAyCiB,UAAA;EACf,MAAA;EAtC2B;EAwC3B,YAAA;EA1CA;EA4CA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;UAIA,eAAA;EA/CY;EAiD3B,MAAA;EA7CyB;EA+CzB,UAAU;AAAA;;UAIK,iBAAA;EAjDf;EAmDA,GAAA;EAnDkB;EAqDlB,WAAA;EA9Ce;EAgDf,GAAA;;EAEA,GAAA;AAAA;;;;UC/Me,4BAAA;EDCa;ECC5B,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAI;AAAA;;;;;iBAOD,yBAAA,CAAA;EAA+B,KAAA;EAAe,SAAS;AAAA;;iBAOvD,qBAAA,CAAsB,KAAa;;;;UCTlC,uBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,YAAA;EACR,WAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,sBAAA;EACf,SAAA;EACA,MAAA;EACA,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;;;;;;;;UAWA,aAAA;EAEf,eAAA,CAAgB,KAAA,WAAgB,OAAA,CAAQ,YAAA;EACxC,YAAA,CAAa,MAAA,WAAiB,OAAA,CAAQ,YAAA;EACtC,UAAA,CAAW,KAAA,EAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;EACpD,UAAA,CACE,MAAA,UACA,KAAA,EAAO,OAAA,CACL,IAAA,CACE,YAAA,gIAUH,OAAA,CAAQ,YAAA;EAEX,cAAA,CAAe,MAAA,WAAiB,OAAA,CAAQ,gBAAA;EACxC,gBAAA,CAAiB,MAAA,EAAQ,gBAAA,GAAmB,OAAA;EAG5C,aAAA,CAAc,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,WAAA;EACtD,eAAA,CAAgB,SAAA,WAAoB,OAAA,CAAQ,WAAA;EFzB7B;EE2Bf,aAAA,CAAc,SAAA,UAAmB,SAAA,EAAW,IAAA,GAAO,OAAA;EF5BnD;EE8BA,aAAA,CAAc,SAAA,UAAmB,gBAAA,UAA0B,SAAA,EAAW,IAAA,GAAO,OAAA;EF7BlE;EE+BX,iBAAA,CAAkB,MAAA,UAAgB,SAAA,EAAW,IAAA,GAAO,OAAA;EAGpD,gBAAA,CAAiB,MAAA,WAAiB,OAAA,UAAiB,IAAA;EACnD,sBAAA,CAAuB,MAAA,WAAiB,OAAA,UAAiB,UAAA;EACzD,UAAA,CAAW,UAAA,EAAY,kBAAA,GAAqB,OAAA;EAC5C,mBAAA,CAAoB,KAAA,EAAO,mBAAA,GAAsB,OAAA;EACjD,qBAAA,CAAsB,KAAA,EAAO,qBAAA,GAAwB,OAAA;EFzB1C;EE6BX,uBAAA,EAAyB,KAAA,EAAO,4BAAA,GAA+B,OAAA;EF3BhD;EE6Bf,qBAAA,EAAuB,SAAA,WAAoB,OAAA,CAAQ,iBAAA;EFpCnD;EEsCA,yBAAA,EAA2B,SAAA,UAAmB,MAAA,EAAQ,IAAA,GAAO,OAAA;EFnC7D;EEuCA,cAAA,EAAgB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EFtC9B;EEwCX,gBAAA,EAAkB,MAAA,EAAQ,UAAA,GAAa,OAAA;EFvC5B;EEyCX,gBAAA,EAAkB,MAAA,WAAiB,OAAA;EAGnC,WAAA,EAAa,KAAA,EAAO,aAAA,GAAgB,OAAA;EF1CrB;AAAA;AAIjB;;EE6CE,iBAAA,EAAmB,QAAA,UAAkB,cAAA,WAAyB,OAAA,CAAQ,YAAA;EF7ClD;EE+CpB,eAAA,EAAiB,IAAA,EAAM,kBAAA,GAAqB,OAAA;EF5C7B;EE8Cf,cAAA,EAAgB,MAAA,WAAiB,OAAA,UAAiB,kBAAA;AAAA"}
+{"version":3,"file":"identity-store-BRRahxcS.d.cts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EAA+B;EAAe;;;iBAO9C,sBAAsB;;;;UCTrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cAAc,mBAAmB,0BAA0B,WAAW,OAAO;;EAE7E,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBAAmB,kBAAkB,yBAAyB,QAAQ;;EAEtE,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}

package/dist/identity-store-BRRahxcS.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store-BRRahxcS.d.mts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;AAQA;;;;AAA8B;AAG9B;AAAA,KAHY,kBAAA;;UAGK,YAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,eAAA,EAAiB,IAAA;EAqBF;;;EAjBf,gBAAA;EALA;;;;EAUA,WAAA;EAAA;;;;EAKA,mBAAA;EAMW;;;;EADX,WAAA,EAAa,IAAA;EACb,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,gBAAA;EACf,MAAA;EAGA;EADA,YAAA;EACA,SAAA,EAAW,IAAI;AAAA;AAOjB;;;;AAAA,UAAiB,WAAA;EACf,SAAA;EACA,MAAA;EAMe;EAJf,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;EADX;EAGA,SAAA,EAAW,IAAA;AAAA;;KAID,UAAA;;UAGK,IAAA;EACf,MAAA;EACA,IAAA;EACA,WAAA;AAAA;;UAIe,kBAAA;EACf,MAAA;EACA,MAAM;AAAA;;UAIS,mBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZX;AAAA,UAgBI,qBAAA;EACf,MAAA;EACA,UAAA,EAAY,UAAU;AAAA;AAZhB;AAAA,KAgBI,iBAAA;;UAoBK,kBAAA;EACf,MAAA;EAhCA;EAkCA,QAAA;EAjCY;EAmCZ,cAAA;EACA,KAAA;EACA,WAAA;EACA,QAAA,EAAU,IAAI;AAAA;;UAIC,aAAA;EACf,IAAA,EAAM,iBAAA;EACN,MAAA;EAtCsB;EAwCtB,QAAA,EAAU,MAAA;EACV,UAAA,EAAY,IAAA;AAAA;;;AArCe;AAoB7B;UAwBiB,qBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,kBAAA;EACR,aAAA;EACA,KAAA;EACA,WAAA,WAAsB,UAAU;AAAA;;UAIjB,UAAA;EACf,WAAA;EACA,YAAA;EACA,oBAAA,EAAsB,IAAA;EACtB,qBAAA,EAAuB,IAAI;AAAA;;UAIZ,UAAA;EACf,IAAA,EAAM,qBAAA;EACN,MAAA,EAAQ,UAAU;AAAA;;;;;UAOH,iBAAA;EACf,IAAA;EApCgB;EAsChB,QAAQ;AAAA;;KAIE,WAAA,GAAc,UAAA,GAAa,iBAAiB;;KAG5C,qBAAA;;UAGK,iBAAA;EArCf;EAuCA,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAA;EAvCW;EAyCtB,MAAA,EAAQ,IAAA;AAAA;AArCV;AAAA,UAyCiB,UAAA;EACf,MAAA;EAtC2B;EAwC3B,YAAA;EA1CA;EA4CA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;UAIA,eAAA;EA/CY;EAiD3B,MAAA;EA7CyB;EA+CzB,UAAU;AAAA;;UAIK,iBAAA;EAjDf;EAmDA,GAAA;EAnDkB;EAqDlB,WAAA;EA9Ce;EAgDf,GAAA;;EAEA,GAAA;AAAA;;;;UC/Me,4BAAA;EDCa;ECC5B,SAAA;EACA,MAAA;EACA,IAAA,EAAM,qBAAA;EACN,SAAA,EAAW,IAAI;AAAA;;;;;iBAOD,yBAAA,CAAA;EAA+B,KAAA;EAAe,SAAS;AAAA;;iBAOvD,qBAAA,CAAsB,KAAa;;;;UCTlC,uBAAA;EACf,MAAA;EACA,KAAA;EACA,WAAA;EACA,MAAA,EAAQ,YAAA;EACR,WAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAA;AAAA;;UAII,sBAAA;EACf,SAAA;EACA,MAAA;EACA,gBAAA;EACA,SAAA,EAAW,IAAA;EACX,SAAA,EAAW,IAAI;AAAA;;;;;;;;;UAWA,aAAA;EAEf,eAAA,CAAgB,KAAA,WAAgB,OAAA,CAAQ,YAAA;EACxC,YAAA,CAAa,MAAA,WAAiB,OAAA,CAAQ,YAAA;EACtC,UAAA,CAAW,KAAA,EAAO,uBAAA,GAA0B,OAAA,CAAQ,YAAA;EACpD,UAAA,CACE,MAAA,UACA,KAAA,EAAO,OAAA,CACL,IAAA,CACE,YAAA,gIAUH,OAAA,CAAQ,YAAA;EAEX,cAAA,CAAe,MAAA,WAAiB,OAAA,CAAQ,gBAAA;EACxC,gBAAA,CAAiB,MAAA,EAAQ,gBAAA,GAAmB,OAAA;EAG5C,aAAA,CAAc,KAAA,EAAO,sBAAA,GAAyB,OAAA,CAAQ,WAAA;EACtD,eAAA,CAAgB,SAAA,WAAoB,OAAA,CAAQ,WAAA;EFzB7B;EE2Bf,aAAA,CAAc,SAAA,UAAmB,SAAA,EAAW,IAAA,GAAO,OAAA;EF5BnD;EE8BA,aAAA,CAAc,SAAA,UAAmB,gBAAA,UAA0B,SAAA,EAAW,IAAA,GAAO,OAAA;EF7BlE;EE+BX,iBAAA,CAAkB,MAAA,UAAgB,SAAA,EAAW,IAAA,GAAO,OAAA;EAGpD,gBAAA,CAAiB,MAAA,WAAiB,OAAA,UAAiB,IAAA;EACnD,sBAAA,CAAuB,MAAA,WAAiB,OAAA,UAAiB,UAAA;EACzD,UAAA,CAAW,UAAA,EAAY,kBAAA,GAAqB,OAAA;EAC5C,mBAAA,CAAoB,KAAA,EAAO,mBAAA,GAAsB,OAAA;EACjD,qBAAA,CAAsB,KAAA,EAAO,qBAAA,GAAwB,OAAA;EFzB1C;EE6BX,uBAAA,EAAyB,KAAA,EAAO,4BAAA,GAA+B,OAAA;EF3BhD;EE6Bf,qBAAA,EAAuB,SAAA,WAAoB,OAAA,CAAQ,iBAAA;EFpCnD;EEsCA,yBAAA,EAA2B,SAAA,UAAmB,MAAA,EAAQ,IAAA,GAAO,OAAA;EFnC7D;EEuCA,cAAA,EAAgB,MAAA,WAAiB,OAAA,CAAQ,UAAA;EFtC9B;EEwCX,gBAAA,EAAkB,MAAA,EAAQ,UAAA,GAAa,OAAA;EFvC5B;EEyCX,gBAAA,EAAkB,MAAA,WAAiB,OAAA;EAGnC,WAAA,EAAa,KAAA,EAAO,aAAA,GAAgB,OAAA;EF1CrB;AAAA;AAIjB;;EE6CE,iBAAA,EAAmB,QAAA,UAAkB,cAAA,WAAyB,OAAA,CAAQ,YAAA;EF7ClD;EE+CpB,eAAA,EAAiB,IAAA,EAAM,kBAAA,GAAqB,OAAA;EF5C7B;EE8Cf,cAAA,EAAgB,MAAA,WAAiB,OAAA,UAAiB,kBAAA;AAAA"}
+{"version":3,"file":"identity-store-BRRahxcS.d.mts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EAA+B;EAAe;;;iBAO9C,sBAAsB;;;;UCTrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cAAc,mBAAmB,0BAA0B,WAAW,OAAO;;EAE7E,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBAAmB,kBAAkB,yBAAyB,QAAQ;;EAEtE,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}

package/dist/index-CpufYgyn.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"index-CpufYgyn.d.cts","names":[],"sources":["../schema/model.ts"],"mappings":";;AAYA;;;;;;;;AAGU;AAGV;;UANiB,YAAA;EACf,IAAA;EACA,WAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;EACf,IAAA;EACA,WAAA;EACA,OAAA,WAAkB,YAAY;AAAA;AAAA,UAGf,WAAA;EACf,MAAA,WAAiB,WAAW;AAAA;AAAA,cAGjB,mBAAA,EAAqB,WAuEjC"}
+{"version":3,"file":"index-CpufYgyn.d.cts","names":[],"sources":["../schema/model.ts"],"mappings":";;;;;;;;;;;;;UAYiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA,kBAAkB;;UAGH;EACf,iBAAiB;;cAGN,qBAAqB"}

package/dist/index-CpufYgyn.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index-CpufYgyn.d.mts","names":[],"sources":["../schema/model.ts"],"mappings":";;AAYA;;;;;;;;AAGU;AAGV;;UANiB,YAAA;EACf,IAAA;EACA,WAAA;EACA,QAAA;AAAA;AAAA,UAGe,WAAA;EACf,IAAA;EACA,WAAA;EACA,OAAA,WAAkB,YAAY;AAAA;AAAA,UAGf,WAAA;EACf,MAAA,WAAiB,WAAW;AAAA;AAAA,cAGjB,mBAAA,EAAqB,WAuEjC"}
+{"version":3,"file":"index-CpufYgyn.d.mts","names":[],"sources":["../schema/model.ts"],"mappings":";;;;;;;;;;;;;UAYiB;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA,kBAAkB;;UAGH;EACf,iBAAiB;;cAGN,qBAAqB"}

package/dist/index.d.cts

@@ -1,4 +1,4 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-C2xZAatu.cjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
 import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
 export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };

package/dist/index.d.mts

@@ -1,4 +1,4 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-BGMwaW5s.mjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
 import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
 export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };

package/dist/nestjs.cjs

@@ -2,19 +2,19 @@ Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("./errors-Bcjx9o6g.cjs");
 let _nestjs_common = require("@nestjs/common");
 let _nestjs_core = require("@nestjs/core");
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateParam.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorate.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -373,7 +373,6 @@ function createIdentityController(prefix, controllerOptions = {}) {
 * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and
 * `reflect-metadata` are optional peer dependencies — only required when this entry is used.
 */
-var _ref;
 /** Token used to inject the configured {@link IdentityService} in Nest providers. */
 const IDENTITY_SERVICE = Symbol.for("azlib.identity.service");
 /** Metadata key holding the authorization requirement for a route. */
@@ -429,7 +428,7 @@ let IdentityAuthorizationGuard = class IdentityAuthorizationGuard {
 IdentityAuthorizationGuard = __decorate([
 	(0, _nestjs_common.Injectable)(),
 	__decorateParam(0, (0, _nestjs_common.Inject)(IDENTITY_SERVICE)),
-	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof _nestjs_core.Reflector !== "undefined" && _nestjs_core.Reflector) === "function" ? _ref : Object])
+	__decorateMetadata("design:paramtypes", [Object, typeof _nestjs_core.Reflector === "undefined" ? Object : _nestjs_core.Reflector])
 ], IdentityAuthorizationGuard);
 /** Declares the authorization requirement for a route or controller. */
 const RequireAuthorization = (requirement) => (0, _nestjs_common.SetMetadata)(IDENTITY_REQUIREMENT, requirement);

package/dist/nestjs.d.cts

@@ -1,10 +1,9 @@
-import { V as AuthorizationRequirement } from "./errors-C2xZAatu.cjs";
-import { t as IdentityService } from "./identity-service-CLzKx8Z7.cjs";
-import { t as CookieRefreshOptions } from "./identity-router-Dib30Waj.cjs";
+import { V as AuthorizationRequirement } from "./errors-CBbiRO2n.cjs";
+import { t as IdentityService } from "./identity-service---OTann1.cjs";
+import { t as CookieRefreshOptions } from "./identity-router-D1xJ5H7y.cjs";
 import { Request, Response } from "express";
 import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-
 //#region core/nestjs/identity-controller.d.ts
 /** Options accepted by {@link createIdentityController}. */
 interface IdentityControllerOptions {

package/dist/nestjs.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}
+{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAkGiB;;;;;EAKf,SAAS;;;;;cC1EE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBACe;EAAA,YAAA,SAAS;EAE1D,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAD0B,YAAA,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAyBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAIvC,iBAAW,2BAAA;cAsBX;SACJ,QAAQ,SAAS,wBAAwB;SAczC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.d.mts

@@ -1,10 +1,9 @@
-import { V as AuthorizationRequirement } from "./errors-BGMwaW5s.mjs";
-import { t as IdentityService } from "./identity-service-B9zrvE9z.mjs";
-import { t as CookieRefreshOptions } from "./identity-router-DBL20UWT.mjs";
+import { V as AuthorizationRequirement } from "./errors-_OcodtdV.mjs";
+import { t as IdentityService } from "./identity-service-WpOKb0MK.mjs";
+import { t as CookieRefreshOptions } from "./identity-router-tj3-teBI.mjs";
 import { Request, Response } from "express";
 import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-
 //#region core/nestjs/identity-controller.d.ts
 /** Options accepted by {@link createIdentityController}. */
 interface IdentityControllerOptions {

package/dist/nestjs.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}
+{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAkGiB;;;;;EAKf,SAAS;;;;;cC1EE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBACe;EAAA,YAAA,SAAS;EAE1D,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAD0B,YAAA,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAyBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAIvC,iBAAW,2BAAA;cAsBX;SACJ,QAAQ,SAAS,wBAAwB;SAczC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.mjs

@@ -1,19 +1,19 @@
 import { a as IdentityError, c as UnauthenticatedError } from "./errors-CEmnZxIn.mjs";
 import { Body, Controller, ForbiddenException, Get, HttpCode, HttpException, Inject, Injectable, Param, Post, Req, Res, SetMetadata, UnauthorizedException, UseGuards, createParamDecorator } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateParam.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorate.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -372,7 +372,6 @@ function createIdentityController(prefix, controllerOptions = {}) {
 * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and
 * `reflect-metadata` are optional peer dependencies — only required when this entry is used.
 */
-var _ref;
 /** Token used to inject the configured {@link IdentityService} in Nest providers. */
 const IDENTITY_SERVICE = Symbol.for("azlib.identity.service");
 /** Metadata key holding the authorization requirement for a route. */
@@ -428,7 +427,7 @@ let IdentityAuthorizationGuard = class IdentityAuthorizationGuard {
 IdentityAuthorizationGuard = __decorate([
 	Injectable(),
 	__decorateParam(0, Inject(IDENTITY_SERVICE)),
-	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref : Object])
+	__decorateMetadata("design:paramtypes", [Object, typeof Reflector === "undefined" ? Object : Reflector])
 ], IdentityAuthorizationGuard);
 /** Declares the authorization requirement for a route or controller. */
 const RequireAuthorization = (requirement) => SetMetadata(IDENTITY_REQUIREMENT, requirement);

package/dist/nestjs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException({ code: err.code, message: err.message }, err.statusCode as HttpStatus);\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(result: AuthResult, cookieOpts: CookieRefreshOptions | undefined, res: Response) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? \"/\" });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(@Body() body: { token?: string; newPassword?: string }) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(body.mfaToken, body.code);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(@Inject(IDENTITY_SERVICE) private readonly service: IdentityService) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<AuthorizationRequirement | undefined>(\n      IDENTITY_REQUIREMENT,\n      [context.getHandler(), context.getClass()],\n    );\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, { permission } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, context: ExecutionContext): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = { cookie: routesOpts.cookie };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GAAG,IAAI,UAAwB;CAEhG,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EAAE,cAAc,KAAK,uBAAuB,MAAM,GAAG,eAAe;CAC1E,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAoB,YAA8C,KAAe;CAC1G,IAAI,YAAY;EACd,MAAM,SAAS,8BAA8B,KAAK,OAAO,QAAQ,UAAU;EAC3E,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IAAA,qBAAA,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QAAQ,KAAqB,KAA2C;GAC5E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OAAO,KAAqB,KAA2C;GAC3E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAAE,MAAM,WAAW,QAAQ,IAAI,CAAC;GAEnF,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBAAyB,KAAyD;GACtF,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,MAAwD;GAC1E,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAElE,OAAO,kBAAkB,MADJ,KAAK,QAAQ,mBAAmB,KAAK,UAAU,KAAK,IAAI,GAC5C,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA/MG,KAAK,UAAU;qBAEb,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;qBAEV,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;qBACA,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAa5D,KAAK,QAAQ;EACb,SAAS,GAAG;qBACC,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3D,IAAI,IAAI;EACR,UAAU,iBAAiB;qBACrB,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBACI,IAAI,CAAA;;;;;;EAQnC,KAAK,cAAc;EACnB,SAAS,GAAG;qBACM,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;qBACe,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;qBACQ,KAAK,CAAA;;;;;;EAczB,KAAK,YAAY;qBAEf,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAY3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;qBACZ,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;qBACM,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;qBACQ,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;qBACS,MAAM,QAAQ,CAAA;;;;;;EA5MrC,WAAW,MAAM;qBAEH,OAAO,gBAAgB,CAAA;;;CAmNtC,OAAO;AACT;;;;;;;;;;;;ACvUA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,EAAE,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAA,oBAAA,MAAM,kBAAyC;CACG;CAAvD,YAAY,SAAqE;EAA1B,KAAA,UAAA;CAA2B;CAElF,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,EAAE,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAjBC,WAAW;oBAEG,OAAO,gBAAgB,CAAA;;;AAsB/B,IAAA,6BAAA,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBACjC,sBACA,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAC3C;EAEA,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,EAAE,WACf,EAAE;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,GACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA7BC,WAAW;oBAGP,OAAO,gBAAgB,CAAA;;;;AA6B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAAE,WAAW,CAAoC;;AAGrF,MAAa,cAAc,sBACxB,OAAgB,YAAiE;CAEhF,OADY,QAAQ,aAAa,EAAE,WAC1B,EAAE;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAG1C,OAAO,CAAC,yBAFO,WAAW,UAAU,QAEK,EADW,QAAQ,WAAW,OACjB,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;AACF"}
+{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException({ code: err.code, message: err.message }, err.statusCode as HttpStatus);\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(result: AuthResult, cookieOpts: CookieRefreshOptions | undefined, res: Response) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? \"/\" });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(@Body() body: { token?: string; newPassword?: string }) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(body.mfaToken, body.code);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(@Inject(IDENTITY_SERVICE) private readonly service: IdentityService) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<AuthorizationRequirement | undefined>(\n      IDENTITY_REQUIREMENT,\n      [context.getHandler(), context.getClass()],\n    );\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, { permission } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, context: ExecutionContext): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = { cookie: routesOpts.cookie };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GAAG,IAAI,UAAwB;CAEhG,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EAAE,cAAc,KAAK,uBAAuB,MAAM,GAAG,eAAe;CAC1E,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAoB,YAA8C,KAAe;CAC1G,IAAI,YAAY;EACd,MAAM,SAAS,8BAA8B,KAAK,OAAO,QAAQ,UAAU;EAC3E,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IACM,qBADN,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QAAQ,KAAqB,KAA2C;GAC5E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OAAO,KAAqB,KAA2C;GAC3E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAAE,MAAM,WAAW,QAAQ,IAAI,CAAC;GAEnF,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBAAyB,KAAyD;GACtF,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,MAAwD;GAC1E,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAElE,OAAO,kBAAkB,MADJ,KAAK,QAAQ,mBAAmB,KAAK,UAAU,KAAK,IAAI,GAC5C,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA/MG,KAAK,UAAU;EAEb,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;EAEV,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;EACA,gBAAA,GAAA,IAAI,CAAA;EAAiB,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAa5D,KAAK,QAAQ;EACb,SAAS,GAAG;EACC,gBAAA,GAAA,IAAI,CAAA;EAAiB,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3D,IAAI,IAAI;EACR,UAAU,iBAAiB;EACrB,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;EACI,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnC,KAAK,cAAc;EACnB,SAAS,GAAG;EACM,gBAAA,GAAA,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;EACe,gBAAA,GAAA,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;EACQ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAczB,KAAK,YAAY;EAEf,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAY3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;EACZ,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;EACM,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;EACQ,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;EACS,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EA5MrC,WAAW,MAAM;EAEH,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;CAmNtC,OAAO;AACT;;;;;;;;;;;ACvUA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,CAAC,CAAC,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAM,oBAAN,MAAM,kBAAyC;CACG;CAAvD,YAAY,SAAqE;EAA1B,KAAA,UAAA;CAA2B;CAElF,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,CAAC,CAAC,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAjBC,WAAW;CAEG,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;AAsB/B,IAAM,6BAAN,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBACjC,sBACA,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAC3C;EAEA,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,CAAC,CAAC,WACf,CAAC,CAAC;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,EAAA,CACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA7BC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;;AA6B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAAE,WAAW,CAAoC;;AAGrF,MAAa,cAAc,sBACxB,OAAgB,YAAiE;CAEhF,OADY,QAAQ,aAAa,CAAC,CAAC,WAC1B,CAAC,CAAC;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAG1C,OAAO,CAAC,yBAFO,WAAW,UAAU,QAEK,EADW,QAAQ,WAAW,OACjB,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;AACF"}

package/dist/node.d.cts

@@ -1,8 +1,7 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-C2xZAatu.cjs";
-import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-CLzKx8Z7.cjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service---OTann1.cjs";
 import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
-
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}

package/dist/node.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.cts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;AAYA;;;;iBAAgB,YAAA,CACd,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA;;;;;iBAYS,mBAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA,GACV,OAAA;;;;;iBAwBmB,YAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,GACL,OAAA;;;;UClDc,WAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,YAAA,EAAc,YAAA;EACd,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,cAAA,CACpB,IAAA,EAAM,WAAA,EACN,cAAA,WACC,OAAA,CAAQ,UAAA;;iBAoDW,aAAA,CACpB,IAAA,EAAM,IAAA,CAAK,WAAA,kDACX,cAAA,WACC,OAAA;;;;UCjDc,iBAAA;EFjBf;EEmBA,QAAA;EFnBe;AAYjB;;;EEYE,YAAA;EFVM;;;EEcN,MAAA;AAAA;;;;;;;;;;iBA+Bc,yBAAA,CAA0B,MAAA,EAAQ,iBAAA,GAAoB,aAAa;;;;UC3ClE,oBAAA;EHJK;EGMpB,QAAA;;;;;EAKA,YAAA;EHNC;;;;;EGYD,QAAA;EHfA;;;;EGoBA,MAAA;AAAA;;AHjBQ;AAwBV;;;;;;;iBGwBgB,4BAAA,CAA6B,MAAA,EAAQ,oBAAA,GAAuB,aAAa;;;;cCrE5E,sBAAA,SAA+B,aAAa;cAC3C,OAAA;AAAA;AAAA,UAKG,qBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,wBAAA,CACpB,IAAA,EAAM,qBAAA,EACN,MAAA,WACC,OAAO;;AJjBO;AAYjB;;;iBIsCsB,WAAA,CACpB,IAAA,EAAM,qBAAA,EACN,QAAA,WACC,OAAO;;;;cCrDG,kBAAA,SAA2B,aAAa;cACvC,OAAA;AAAA;AAAA,UAKG,iBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,oBAAA,CACpB,IAAA,EAAM,iBAAA,EACN,KAAA,WACC,OAAO;ALVV;;;;;;AAAA,iBKgDsB,aAAA,CACpB,IAAA,EAAM,iBAAA,EACN,QAAA,UACA,WAAA,WACC,OAAO;;;;iBCtEM,YAAA,CAAa,MAAc,EAAN,MAAM;;iBAoB3B,YAAA,CAAa,OAAA,WAAkB,MAAM;;;ANjBrD;;iBMiEgB,kBAAA,CAAA;;;;iBAOA,YAAA,CAAa,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;;;;iBAUzD,UAAA,CAAW,IAAA,UAAc,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;AN/EpE;AAYjB;iBM6EgB,eAAA,CAAgB,MAAA;EAC9B,MAAA;EACA,WAAA;EACA,MAAA;AAAA;;;;cC5FW,cAAA,SAAuB,aAAa;cACnC,OAAA;AAAA;;;;;cASD,sBAAA,SAA+B,aAAa;EAAb,WAAA,CAAA;AAAA;AAAA,UAU3B,aAAA,SAAsB,WAAW;EAChD,KAAA,EAAO,WAAA;AAAA;;;APrBQ;AAYjB;;;iBOsBsB,QAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,WACC,OAAA,CAAQ,eAAA;;;;;iBAoCW,SAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA2BY,UAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA6BY,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,MAAA,WACC,OAAO;;AP3HA;AAwBV;;;;iBOwHsB,kBAAA,CACpB,IAAA,EAAM,aAAA,EACN,QAAA,UACA,QAAA,WACC,OAAA,CAAQ,UAAA;;;;cC9KE,iBAAA,SAA0B,aAAa;cACtC,OAAA;AAAA;AAAA,UAKG,gBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,WAAA,CAAY,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;ARVjE;AAYjB;;;AAZiB,iBQ2BK,aAAA,CAAc,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;;;;;;iBAoB9D,cAAA,CAAe,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO"}
+{"version":3,"file":"node.d.cts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBAoDW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UCjDc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BAA0B,QAAQ,oBAAoB;;;;UC3CrD;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BAA6B,QAAQ,uBAAuB;;;;cCrE/D,+BAA+B;EAC9B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAiCmB,YACpB,MAAM,uBACN,mBACC;;;;cCrDU,2BAA2B;EAC1B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAsCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBCtEa,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAgD/B;;;;iBAOA,aAAa,sBAAsB,MAAK;;;;;;iBAUxC,WAAW,cAAc,sBAAsB,MAAK;;;;;iBAUpD,gBAAgB;EAC9B;EACA;EACA;;;;;cC5FW,uBAAuB;EACtB,YAAA;;;;;;cASD,+BAA+B;EAAA;;UAU3B,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA2BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cC9KE,0BAA0B;EACzB,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YAAY,MAAM,kBAAkB,iBAAiB;;;;;iBAiBrD,cAAc,MAAM,kBAAkB,iBAAiB;;;;;;iBAoBvD,eAAe,MAAM,kBAAkB,iBAAiB"}

package/dist/node.d.mts

@@ -1,8 +1,7 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-BGMwaW5s.mjs";
-import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-B9zrvE9z.mjs";
+import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-WpOKb0MK.mjs";
 import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
-
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}

package/dist/node.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.mts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;AAYA;;;;iBAAgB,YAAA,CACd,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA;;;;;iBAYS,mBAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,EACN,MAAA,EAAQ,aAAA,EACR,GAAA,QAAW,IAAA,GACV,OAAA;;;;;iBAwBmB,YAAA,CACpB,KAAA,EAAO,aAAA,EACP,IAAA,EAAM,YAAA,GACL,OAAA;;;;UClDc,WAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,YAAA,EAAc,YAAA;EACd,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,cAAA,CACpB,IAAA,EAAM,WAAA,EACN,cAAA,WACC,OAAA,CAAQ,UAAA;;iBAoDW,aAAA,CACpB,IAAA,EAAM,IAAA,CAAK,WAAA,kDACX,cAAA,WACC,OAAA;;;;UCjDc,iBAAA;EFjBf;EEmBA,QAAA;EFnBe;AAYjB;;;EEYE,YAAA;EFVM;;;EEcN,MAAA;AAAA;;;;;;;;;;iBA+Bc,yBAAA,CAA0B,MAAA,EAAQ,iBAAA,GAAoB,aAAa;;;;UC3ClE,oBAAA;EHJK;EGMpB,QAAA;;;;;EAKA,YAAA;EHNC;;;;;EGYD,QAAA;EHfA;;;;EGoBA,MAAA;AAAA;;AHjBQ;AAwBV;;;;;;;iBGwBgB,4BAAA,CAA6B,MAAA,EAAQ,oBAAA,GAAuB,aAAa;;;;cCrE5E,sBAAA,SAA+B,aAAa;cAC3C,OAAA;AAAA;AAAA,UAKG,qBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,wBAAA,CACpB,IAAA,EAAM,qBAAA,EACN,MAAA,WACC,OAAO;;AJjBO;AAYjB;;;iBIsCsB,WAAA,CACpB,IAAA,EAAM,qBAAA,EACN,QAAA,WACC,OAAO;;;;cCrDG,kBAAA,SAA2B,aAAa;cACvC,OAAA;AAAA;AAAA,UAKG,iBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,WAAA;AAAA;;;;;;;iBASa,oBAAA,CACpB,IAAA,EAAM,iBAAA,EACN,KAAA,WACC,OAAO;ALVV;;;;;;AAAA,iBKgDsB,aAAA,CACpB,IAAA,EAAM,iBAAA,EACN,QAAA,UACA,WAAA,WACC,OAAO;;;;iBCtEM,YAAA,CAAa,MAAc,EAAN,MAAM;;iBAoB3B,YAAA,CAAa,OAAA,WAAkB,MAAM;;;ANjBrD;;iBMiEgB,kBAAA,CAAA;;;;iBAOA,YAAA,CAAa,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;;;;iBAUzD,UAAA,CAAW,IAAA,UAAc,YAAA,UAAsB,GAAA,GAAK,IAAiB;;;AN/EpE;AAYjB;iBM6EgB,eAAA,CAAgB,MAAA;EAC9B,MAAA;EACA,WAAA;EACA,MAAA;AAAA;;;;cC5FW,cAAA,SAAuB,aAAa;cACnC,OAAA;AAAA;;;;;cASD,sBAAA,SAA+B,aAAa;EAAb,WAAA,CAAA;AAAA;AAAA,UAU3B,aAAA,SAAsB,WAAW;EAChD,KAAA,EAAO,WAAA;AAAA;;;APrBQ;AAYjB;;;iBOsBsB,QAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,WACC,OAAA,CAAQ,eAAA;;;;;iBAoCW,SAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA2BY,UAAA,CACpB,IAAA,EAAM,aAAA,EACN,MAAA,UACA,QAAA,WACC,OAAO;;;;;iBA6BY,sBAAA,CACpB,MAAA,EAAQ,cAAA,EACR,MAAA,WACC,OAAO;;AP3HA;AAwBV;;;;iBOwHsB,kBAAA,CACpB,IAAA,EAAM,aAAA,EACN,QAAA,UACA,QAAA,WACC,OAAA,CAAQ,UAAA;;;;cC9KE,iBAAA,SAA0B,aAAa;cACtC,OAAA;AAAA;AAAA,UAKG,gBAAA;EACf,MAAA,EAAQ,cAAA;EACR,KAAA,EAAO,aAAA;EACP,KAAA,EAAO,WAAA;AAAA;;;;;;;;iBAUa,WAAA,CAAY,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;ARVjE;AAYjB;;;AAZiB,iBQ2BK,aAAA,CAAc,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO;;;;;;iBAoB9D,cAAA,CAAe,IAAA,EAAM,gBAAA,EAAkB,MAAA,WAAiB,OAAO"}
+{"version":3,"file":"node.d.mts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBAoDW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UCjDc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BAA0B,QAAQ,oBAAoB;;;;UC3CrD;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BAA6B,QAAQ,uBAAuB;;;;cCrE/D,+BAA+B;EAC9B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAiCmB,YACpB,MAAM,uBACN,mBACC;;;;cCrDU,2BAA2B;EAC1B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAsCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBCtEa,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAgD/B;;;;iBAOA,aAAa,sBAAsB,MAAK;;;;;;iBAUxC,WAAW,cAAc,sBAAsB,MAAK;;;;;iBAUpD,gBAAgB;EAC9B;EACA;EACA;;;;;cC5FW,uBAAuB;EACtB,YAAA;;;;;;cASD,+BAA+B;EAAA;;UAU3B,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA2BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cC9KE,0BAA0B;EACzB,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YAAY,MAAM,kBAAkB,iBAAiB;;;;;iBAiBrD,cAAc,MAAM,kBAAkB,iBAAiB;;;;;;iBAoBvD,eAAe,MAAM,kBAAkB,iBAAiB"}