@azlib/identity 0.2.0 → 0.3.0

package/dist/nestjs.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}
+{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAiHiB;;;;;EAKf,SAAS;;;;;cCzFE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBAEK;EAD7C,YAC6C,SAAS;EAGhD,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAFnB,YAC6C,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAwBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAMvC,iBAAW,2BAAA;cA2BX;SACJ,QAAQ,SAAS,wBAAwB;SAkBzC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.d.mts

@@ -1,10 +1,9 @@
-import { V as AuthorizationRequirement } from "./errors-BGMwaW5s.mjs";
-import { t as IdentityService } from "./identity-service-B9zrvE9z.mjs";
-import { t as CookieRefreshOptions } from "./identity-router-DBL20UWT.mjs";
+import { H as AuthorizationRequirement } from "./errors-DVDEUk9-.mjs";
+import { t as IdentityService } from "./identity-service-JtsoA6lv.mjs";
+import { t as CookieRefreshOptions } from "./identity-router-BiratpJR.mjs";
 import { Request, Response } from "express";
 import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-
 //#region core/nestjs/identity-controller.d.ts
 /** Options accepted by {@link createIdentityController}. */
 interface IdentityControllerOptions {

package/dist/nestjs.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}
+{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAiHiB;;;;;EAKf,SAAS;;;;;cCzFE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBAEK;EAD7C,YAC6C,SAAS;EAGhD,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAFnB,YAC6C,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAwBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAMvC,iBAAW,2BAAA;cA2BX;SACJ,QAAQ,SAAS,wBAAwB;SAkBzC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.mjs

@@ -1,19 +1,19 @@
 import { a as IdentityError, c as UnauthenticatedError } from "./errors-CEmnZxIn.mjs";
 import { Body, Controller, ForbiddenException, Get, HttpCode, HttpException, Inject, Injectable, Param, Post, Req, Res, SetMetadata, UnauthorizedException, UseGuards, createParamDecorator } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateMetadata.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateMetadata.js
 function __decorateMetadata(k, v) {
 	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorateParam.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorateParam.js
 function __decorateParam(paramIndex, decorator) {
 	return function(target, key) {
 		decorator(target, key, paramIndex);
 	};
 }
 //#endregion
-//#region \0@oxc-project+runtime@0.132.0/helpers/decorate.js
+//#region \0@oxc-project+runtime@0.140.0/helpers/esm/decorate.js
 function __decorate(decorators, target, key, desc) {
 	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
 	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -372,7 +372,6 @@ function createIdentityController(prefix, controllerOptions = {}) {
 * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and
 * `reflect-metadata` are optional peer dependencies — only required when this entry is used.
 */
-var _ref;
 /** Token used to inject the configured {@link IdentityService} in Nest providers. */
 const IDENTITY_SERVICE = Symbol.for("azlib.identity.service");
 /** Metadata key holding the authorization requirement for a route. */
@@ -428,7 +427,7 @@ let IdentityAuthorizationGuard = class IdentityAuthorizationGuard {
 IdentityAuthorizationGuard = __decorate([
 	Injectable(),
 	__decorateParam(0, Inject(IDENTITY_SERVICE)),
-	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof Reflector !== "undefined" && Reflector) === "function" ? _ref : Object])
+	__decorateMetadata("design:paramtypes", [Object, typeof Reflector === "undefined" ? Object : Reflector])
 ], IdentityAuthorizationGuard);
 /** Declares the authorization requirement for a route or controller. */
 const RequireAuthorization = (requirement) => SetMetadata(IDENTITY_REQUIREMENT, requirement);

package/dist/nestjs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException({ code: err.code, message: err.message }, err.statusCode as HttpStatus);\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(result: AuthResult, cookieOpts: CookieRefreshOptions | undefined, res: Response) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? \"/\" });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(@Body() body: { token?: string; newPassword?: string }) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(body.mfaToken, body.code);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(@Inject(IDENTITY_SERVICE) private readonly service: IdentityService) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<AuthorizationRequirement | undefined>(\n      IDENTITY_REQUIREMENT,\n      [context.getHandler(), context.getClass()],\n    );\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, { permission } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, context: ExecutionContext): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = { cookie: routesOpts.cookie };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GAAG,IAAI,UAAwB;CAEhG,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EAAE,cAAc,KAAK,uBAAuB,MAAM,GAAG,eAAe;CAC1E,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAoB,YAA8C,KAAe;CAC1G,IAAI,YAAY;EACd,MAAM,SAAS,8BAA8B,KAAK,OAAO,QAAQ,UAAU;EAC3E,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IAAA,qBAAA,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QAAQ,KAAqB,KAA2C;GAC5E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OAAO,KAAqB,KAA2C;GAC3E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAAE,MAAM,WAAW,QAAQ,IAAI,CAAC;GAEnF,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBAAyB,KAAyD;GACtF,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,MAAwD;GAC1E,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAElE,OAAO,kBAAkB,MADJ,KAAK,QAAQ,mBAAmB,KAAK,UAAU,KAAK,IAAI,GAC5C,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA/MG,KAAK,UAAU;qBAEb,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;qBAEV,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;qBACA,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAa5D,KAAK,QAAQ;EACb,SAAS,GAAG;qBACC,IAAI,CAAA;qBAAiB,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3D,IAAI,IAAI;EACR,UAAU,iBAAiB;qBACrB,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBACI,IAAI,CAAA;;;;;;EAQnC,KAAK,cAAc;EACnB,SAAS,GAAG;qBACM,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;qBACe,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;qBACQ,KAAK,CAAA;;;;;;EAczB,KAAK,YAAY;qBAEf,KAAK,CAAA;qBACL,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAY3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;qBACZ,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;qBAEzB,IAAI,CAAA;qBACJ,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;qBACM,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;qBACQ,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;qBACS,MAAM,QAAQ,CAAA;;;;;;EA5MrC,WAAW,MAAM;qBAEH,OAAO,gBAAgB,CAAA;;;CAmNtC,OAAO;AACT;;;;;;;;;;;;ACvUA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,EAAE,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAA,oBAAA,MAAM,kBAAyC;CACG;CAAvD,YAAY,SAAqE;EAA1B,KAAA,UAAA;CAA2B;CAElF,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,EAAE,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAjBC,WAAW;oBAEG,OAAO,gBAAgB,CAAA;;;AAsB/B,IAAA,6BAAA,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBACjC,sBACA,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAC3C;EAEA,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,EAAE,WACf,EAAE;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,GACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA7BC,WAAW;oBAGP,OAAO,gBAAgB,CAAA;;;;AA6B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAAE,WAAW,CAAoC;;AAGrF,MAAa,cAAc,sBACxB,OAAgB,YAAiE;CAEhF,OADY,QAAQ,aAAa,EAAE,WAC1B,EAAE;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAG1C,OAAO,CAAC,yBAFO,WAAW,UAAU,QAEK,EADW,QAAQ,WAAW,OACjB,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;AACF"}
+{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException(\n      { code: err.code, message: err.message },\n      err.statusCode as HttpStatus,\n    );\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const {\n    refreshToken: _rt,\n    refreshTokenExpiresAt: _exp,\n    ...bodyTokens\n  } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(\n  result: AuthResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(\n      res,\n      result.tokens,\n      cookieOpts,\n    );\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(\n      @Req() req: Request,\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(\n      @Req() req: Request,\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), {\n            path: cookieOpts.path ?? \"/\",\n          });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(\n      @Req() req: Request & { identity?: { userId: string } },\n    ) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(\n      @Body() body: { token?: string; newPassword?: string },\n    ) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(\n          body.mfaToken,\n          body.code,\n        );\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<\n      AuthorizationRequirement | undefined\n    >(IDENTITY_REQUIREMENT, [context.getHandler(), context.getClass()]);\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, {\n    permission,\n  } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (\n    _data: unknown,\n    context: ExecutionContext,\n  ): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = {\n    cookie: routesOpts.cookie,\n  };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [\n        IDENTITY_SERVICE,\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [\n        IDENTITY_SERVICE,\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cACR;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GACvC,IAAI,UACN;CAEF,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EACJ,cAAc,KACd,uBAAuB,MACvB,GAAG,eACD;CACJ,OAAO;AACT;AAEA,SAAS,kBACP,QACA,YACA,KACA;CACA,IAAI,YAAY;EACd,MAAM,SAAS,8BACb,KACA,OAAO,QACP,UACF;EACA,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IACM,qBADN,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QACJ,KACA,KACA;GACA,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OACJ,KACA,KACA;GACA,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAC7C,MAAM,WAAW,QAAQ,IAC3B,CAAC;GAEL,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBACJ,KACA;GACA,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cACJ,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAKlE,OAAO,kBAAkB,MAJJ,KAAK,QAAQ,mBAChC,KAAK,UACL,KAAK,IACP,GACiC,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA9NG,KAAK,UAAU;EAEb,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;EAEV,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;EAEZ,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3B,KAAK,QAAQ;EACb,SAAS,GAAG;EAEV,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAiB3B,IAAI,IAAI;EACR,UAAU,iBAAiB;EACrB,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;;;;;;EASN,KAAK,cAAc;EACnB,SAAS,GAAG;EACM,gBAAA,GAAA,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;EACe,gBAAA,GAAA,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;EAEV,gBAAA,GAAA,KAAK,CAAA;;;;;;EAeP,KAAK,YAAY;EAEf,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAe3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;EACZ,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;EACM,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;EACQ,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;EACS,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EA3NrC,WAAW,MAAM;EAEH,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;CAkOtC,OAAO;AACT;;;;;;;;;;;ACrWA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,CAAC,CAAC,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAM,oBAAN,MAAM,kBAAyC;CAEP;CAD7C,YACE,SACA;EAD2C,KAAA,UAAA;CAC1C;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,CAAC,CAAC,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAnBC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;AAuBrB,IAAM,6BAAN,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBAEjC,sBAAsB,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAAC;EAElE,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,CAAC,CAAC,WACf,CAAC,CAAC;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,EAAA,CACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA5BC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;;AA4B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAChC,WACF,CAAoC;;AAGtC,MAAa,cAAc,sBAEvB,OACA,YACsC;CAEtC,OADY,QAAQ,aAAa,CAAC,CAAC,WAC1B,CAAC,CAAC;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAK1C,OAAO,CAAC,yBAJO,WAAW,UAAU,QAIK,EAFvC,QAAQ,WAAW,OAEiC,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IACP;IACA;IACA;GACF;EACF;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IACP;IACA;IACA;GACF;EACF;CACF;AACF"}

package/dist/next.cjs

@@ -0,0 +1,285 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-Bcjx9o6g.cjs");
+const require_cookie_header = require("./cookie-header-Dqd5k5BU.cjs");
+//#region core/next/cookies.ts
+function maxAgeSeconds(expiresAt, now) {
+	return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1e3));
+}
+function writeAttributes(options, expiresAt, now) {
+	const attrs = require_cookie_header.resolveCookieAttributes(options);
+	return {
+		httpOnly: attrs.httpOnly,
+		secure: attrs.secure,
+		sameSite: attrs.sameSite,
+		path: attrs.path,
+		domain: attrs.domain,
+		maxAge: maxAgeSeconds(expiresAt, now),
+		expires: expiresAt
+	};
+}
+/**
+* Writes the access and refresh tokens as HttpOnly cookies.
+* `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+*/
+function applyAuthCookies(cookies, tokens, options = {}, now = /* @__PURE__ */ new Date()) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	cookies.set(names.access, tokens.accessToken, writeAttributes(options, tokens.accessTokenExpiresAt, now));
+	cookies.set(names.refresh, tokens.refreshToken, writeAttributes(options, tokens.refreshTokenExpiresAt, now));
+}
+/** Clears both identity cookies (logout or failed session). */
+function clearAuthCookies(cookies, options = {}) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	const attrs = require_cookie_header.resolveCookieAttributes(options);
+	const deleteOpts = {
+		path: attrs.path,
+		domain: attrs.domain
+	};
+	cookies.delete(names.access, deleteOpts);
+	cookies.delete(names.refresh, deleteOpts);
+}
+/**
+* In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+* Not for production browser storage.
+*/
+function createMemoryCookieStore(initial = {}) {
+	const values = new Map(Object.entries(initial).filter(([, value]) => value.length > 0));
+	return {
+		get(name) {
+			const value = values.get(name);
+			return value === void 0 ? void 0 : { value };
+		},
+		set(name, value) {
+			if (value.length === 0) {
+				values.delete(name);
+				return;
+			}
+			values.set(name, value);
+		},
+		delete(name) {
+			values.delete(name);
+		}
+	};
+}
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+function cookieStoreFromHeader(header) {
+	return createMemoryCookieStore(Object.fromEntries(require_cookie_header.parseCookieHeader(header)));
+}
+//#endregion
+//#region core/next/session.ts
+/**
+* Resolves the current principal from identity cookies.
+*
+* - Valid access cookie → `service.authenticate`.
+* - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+* - Failure → clear cookies and return `null` (degrade to logged out).
+*
+* Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+* rotates the refresh token; skipping the write would invalidate the browser session.
+*/
+async function getIdentity(service, cookies, options = {}) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	const access = require_cookie_header.readCookieValue(cookies, names.access);
+	const refresh = require_cookie_header.readCookieValue(cookies, names.refresh);
+	if (access) try {
+		return await service.authenticate(access);
+	} catch (error) {
+		if (error instanceof require_errors.AccountUnavailableError) {
+			clearAuthCookies(cookies, options);
+			return null;
+		}
+		if (!(error instanceof require_errors.InvalidTokenError)) throw error;
+	}
+	if (!refresh) {
+		if (access) clearAuthCookies(cookies, options);
+		return null;
+	}
+	try {
+		const result = await service.refresh(refresh);
+		applyAuthCookies(cookies, result.tokens, options);
+		return result.user;
+	} catch (error) {
+		clearAuthCookies(cookies, options);
+		if (error instanceof require_errors.InvalidTokenError || error instanceof require_errors.AccountUnavailableError) return null;
+		throw error;
+	}
+}
+//#endregion
+//#region core/next/handlers.ts
+function json(body, status, cookies) {
+	const headers = new Headers({ "content-type": "application/json" });
+	if (cookies) for (const header of cookies.headers) headers.append("set-cookie", header);
+	return new Response(JSON.stringify(body), {
+		status,
+		headers
+	});
+}
+function errorResponse(error) {
+	if (error instanceof require_errors.IdentityError) return json({
+		code: error.code,
+		message: error.message
+	}, error.statusCode);
+	throw error;
+}
+function serializeSetCookie(cookie) {
+	const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];
+	const opts = cookie.options ?? {};
+	if (opts.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);
+	if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
+	parts.push(`Path=${opts.path ?? "/"}`);
+	if (opts.domain) parts.push(`Domain=${opts.domain}`);
+	if (opts.httpOnly !== false) parts.push("HttpOnly");
+	if (opts.secure) parts.push("Secure");
+	const sameSite = opts.sameSite ?? "lax";
+	parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+	return parts.join("; ");
+}
+function recordingStore(header) {
+	const inner = cookieStoreFromHeader(header);
+	const writes = [];
+	const deleted = [];
+	const expired = /* @__PURE__ */ new Date(0);
+	return {
+		store: {
+			get: inner.get.bind(inner),
+			set(name, value, options) {
+				inner.set(name, value, options);
+				writes.push({
+					name,
+					value,
+					options
+				});
+			},
+			delete(name, options) {
+				inner.delete(name, options);
+				deleted.push({
+					name,
+					value: "",
+					options: {
+						...options,
+						maxAge: 0,
+						expires: expired
+					}
+				});
+			}
+		},
+		headers() {
+			return [...writes.map(serializeSetCookie), ...deleted.map(serializeSetCookie)];
+		}
+	};
+}
+async function readJsonBody(request) {
+	try {
+		const body = await request.json();
+		if (typeof body === "object" && body !== null && !Array.isArray(body)) return body;
+		return {};
+	} catch {
+		return {};
+	}
+}
+function actionFromUrl(url, prefix) {
+	const pathname = new URL(url).pathname.replace(/\/+$/, "");
+	const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
+	if (normalizedPrefix) {
+		const marker = `/${normalizedPrefix}/`;
+		const idx = pathname.lastIndexOf(marker);
+		if (idx >= 0) return pathname.slice(idx + marker.length);
+	}
+	const slash = pathname.lastIndexOf("/");
+	return slash >= 0 ? pathname.slice(slash + 1) : pathname;
+}
+function createIdentityHandlers(service, options = {}) {
+	const prefix = options.prefix ?? "";
+	const names = require_cookie_header.resolveCookieNames(options);
+	const login = async (request) => {
+		try {
+			const body = await readJsonBody(request);
+			const email = typeof body.email === "string" ? body.email : "";
+			const password = typeof body.password === "string" ? body.password : "";
+			const result = await service.login({
+				email,
+				password
+			});
+			if ("kind" in result) return json(result, 200);
+			const recorded = recordingStore(request.headers.get("cookie"));
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const logout = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const refresh = require_cookie_header.readCookieValue(recorded.store, names.refresh);
+			if (refresh) await service.logout(refresh);
+			clearAuthCookies(recorded.store, options);
+			return json({ ok: true }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const refresh = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const token = require_cookie_header.readCookieValue(recorded.store, names.refresh);
+			if (!token) throw new require_errors.InvalidTokenError();
+			const result = await service.refresh(token);
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			clearAuthCookies(recorded.store, options);
+			if (error instanceof require_errors.IdentityError) return json({
+				code: error.code,
+				message: error.message
+			}, error.statusCode, { headers: recorded.headers() });
+			throw error;
+		}
+	};
+	const me = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const identity = await getIdentity(service, recorded.store, options);
+			if (!identity) return json({
+				code: "identity/unauthenticated",
+				message: "Authentication is required."
+			}, 401, { headers: recorded.headers() });
+			return json({ user: identity }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const dispatch = async (request) => {
+		const action = actionFromUrl(request.url, prefix);
+		const method = request.method.toUpperCase();
+		if (method === "POST" && action === "login") return login(request);
+		if (method === "POST" && action === "logout") return logout(request);
+		if (method === "POST" && action === "refresh") return refresh(request);
+		if (method === "GET" && action === "me") return me(request);
+		return json({
+			code: "identity/not-found",
+			message: "Not found."
+		}, 404);
+	};
+	return {
+		login,
+		logout,
+		refresh,
+		me,
+		dispatch
+	};
+}
+//#endregion
+exports.DEFAULT_ACCESS_COOKIE = require_cookie_header.DEFAULT_ACCESS_COOKIE;
+exports.DEFAULT_REFRESH_COOKIE = require_cookie_header.DEFAULT_REFRESH_COOKIE;
+exports.applyAuthCookies = applyAuthCookies;
+exports.clearAuthCookies = clearAuthCookies;
+exports.cookieStoreFromHeader = cookieStoreFromHeader;
+exports.createIdentityHandlers = createIdentityHandlers;
+exports.createMemoryCookieStore = createMemoryCookieStore;
+exports.getIdentity = getIdentity;
+exports.hasIdentityCookies = require_cookie_header.hasIdentityCookies;
+exports.parseCookieHeader = require_cookie_header.parseCookieHeader;
+exports.readCookieValue = require_cookie_header.readCookieValue;
+exports.resolveCookieAttributes = require_cookie_header.resolveCookieAttributes;
+exports.resolveCookieNames = require_cookie_header.resolveCookieNames;

package/dist/next.d.cts

@@ -0,0 +1,58 @@
+import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.cjs";
+import { t as IdentityService } from "./identity-service-DE0Ffguz.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+//#region core/next/cookies.d.ts
+/**
+ * Writes the access and refresh tokens as HttpOnly cookies.
+ * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+ */
+declare function applyAuthCookies(cookies: CookieWriter, tokens: AuthTokens, options?: IdentityCookieOptions, now?: Date): void;
+/** Clears both identity cookies (logout or failed session). */
+declare function clearAuthCookies(cookies: CookieWriter, options?: IdentityCookieOptions): void;
+/**
+ * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+ * Not for production browser storage.
+ */
+declare function createMemoryCookieStore(initial?: Record<string, string>): CookieStore;
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+declare function cookieStoreFromHeader(header: string | null | undefined): CookieStore;
+//#endregion
+//#region core/next/session.d.ts
+/** Subset of {@link IdentityService} used to read and rotate a cookie session. */
+type IdentitySessionService = Pick<IdentityService, "authenticate" | "refresh">;
+/**
+ * Resolves the current principal from identity cookies.
+ *
+ * - Valid access cookie → `service.authenticate`.
+ * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+ * - Failure → clear cookies and return `null` (degrade to logged out).
+ *
+ * Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+ * rotates the refresh token; skipping the write would invalidate the browser session.
+ */
+declare function getIdentity(service: IdentitySessionService, cookies: CookieStore, options?: IdentityCookieOptions): Promise<AuthenticatedIdentity | null>;
+//#endregion
+//#region core/next/handlers.d.ts
+interface IdentityHandlerOptions extends IdentityCookieOptions {
+  /**
+   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.
+   * Default: `""` (last path segment is the action: `login`, `logout`, …).
+   */
+  prefix?: string;
+}
+/**
+ * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).
+ *
+ * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.
+ */
+interface IdentityHandlers {
+  login(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  refresh(request: Request): Promise<Response>;
+  me(request: Request): Promise<Response>;
+  dispatch(request: Request): Promise<Response>;
+}
+declare function createIdentityHandlers(service: IdentityService, options?: IdentityHandlerOptions): IdentityHandlers;
+//#endregion
+export { type CookieReader, type CookieSource, type CookieStore, type CookieWriter, DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, type IdentityHandlerOptions, type IdentityHandlers, type IdentitySessionService, applyAuthCookies, clearAuthCookies, cookieStoreFromHeader, createIdentityHandlers, createMemoryCookieStore, getIdentity, hasIdentityCookies, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames };
+//# sourceMappingURL=next.d.cts.map

package/dist/next.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.cts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}

package/dist/next.d.mts

@@ -0,0 +1,58 @@
+import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.mjs";
+import { t as IdentityService } from "./identity-service-JtsoA6lv.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+//#region core/next/cookies.d.ts
+/**
+ * Writes the access and refresh tokens as HttpOnly cookies.
+ * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+ */
+declare function applyAuthCookies(cookies: CookieWriter, tokens: AuthTokens, options?: IdentityCookieOptions, now?: Date): void;
+/** Clears both identity cookies (logout or failed session). */
+declare function clearAuthCookies(cookies: CookieWriter, options?: IdentityCookieOptions): void;
+/**
+ * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+ * Not for production browser storage.
+ */
+declare function createMemoryCookieStore(initial?: Record<string, string>): CookieStore;
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+declare function cookieStoreFromHeader(header: string | null | undefined): CookieStore;
+//#endregion
+//#region core/next/session.d.ts
+/** Subset of {@link IdentityService} used to read and rotate a cookie session. */
+type IdentitySessionService = Pick<IdentityService, "authenticate" | "refresh">;
+/**
+ * Resolves the current principal from identity cookies.
+ *
+ * - Valid access cookie → `service.authenticate`.
+ * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+ * - Failure → clear cookies and return `null` (degrade to logged out).
+ *
+ * Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+ * rotates the refresh token; skipping the write would invalidate the browser session.
+ */
+declare function getIdentity(service: IdentitySessionService, cookies: CookieStore, options?: IdentityCookieOptions): Promise<AuthenticatedIdentity | null>;
+//#endregion
+//#region core/next/handlers.d.ts
+interface IdentityHandlerOptions extends IdentityCookieOptions {
+  /**
+   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.
+   * Default: `""` (last path segment is the action: `login`, `logout`, …).
+   */
+  prefix?: string;
+}
+/**
+ * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).
+ *
+ * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.
+ */
+interface IdentityHandlers {
+  login(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  refresh(request: Request): Promise<Response>;
+  me(request: Request): Promise<Response>;
+  dispatch(request: Request): Promise<Response>;
+}
+declare function createIdentityHandlers(service: IdentityService, options?: IdentityHandlerOptions): IdentityHandlers;
+//#endregion
+export { type CookieReader, type CookieSource, type CookieStore, type CookieWriter, DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, type IdentityHandlerOptions, type IdentityHandlers, type IdentitySessionService, applyAuthCookies, clearAuthCookies, cookieStoreFromHeader, createIdentityHandlers, createMemoryCookieStore, getIdentity, hasIdentityCookies, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames };
+//# sourceMappingURL=next.d.mts.map

package/dist/next.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.mts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}