@azlib/identity 0.2.0

package/dist/nestjs.cjs

@@ -0,0 +1,516 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-Bcjx9o6g.cjs");
+let _nestjs_common = require("@nestjs/common");
+let _nestjs_core = require("@nestjs/core");
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorateMetadata.js
+function __decorateMetadata(k, v) {
+	if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorateParam.js
+function __decorateParam(paramIndex, decorator) {
+	return function(target, key) {
+		decorator(target, key, paramIndex);
+	};
+}
+//#endregion
+//#region \0@oxc-project+runtime@0.132.0/helpers/decorate.js
+function __decorate(decorators, target, key, desc) {
+	var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+	if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+	else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+	return c > 3 && r && Object.defineProperty(target, key, r), r;
+}
+//#endregion
+//#region core/nestjs/identity-controller.ts
+/**
+* Pre-built NestJS controller for `@azlib/identity`.
+*
+* Register it automatically via `IdentityModule.forRoot({ routes: true })`.
+* `@nestjs/common` is an optional peer dependency — only required when this file is used.
+*/
+function resolveCookieName(opts) {
+	return opts.name ?? "azlib_rt";
+}
+function rethrowAsHttp(err) {
+	if (err instanceof require_errors.IdentityError) throw new _nestjs_common.HttpException({
+		code: err.code,
+		message: err.message
+	}, err.statusCode);
+	throw err;
+}
+function setCookieAndStripRefreshToken(res, tokens, opts) {
+	const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();
+	res.cookie(resolveCookieName(opts), tokens.refreshToken, {
+		httpOnly: opts.httpOnly ?? true,
+		secure: opts.secure ?? process.env.NODE_ENV === "production",
+		sameSite: opts.sameSite ?? "lax",
+		path: opts.path ?? "/",
+		domain: opts.domain,
+		maxAge
+	});
+	const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;
+	return bodyTokens;
+}
+function buildAuthResponse(result, cookieOpts, res) {
+	if (cookieOpts) {
+		const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);
+		return {
+			user: result.user,
+			tokens
+		};
+	}
+	return result;
+}
+function buildLoginResponse(result, cookieOpts, res) {
+	if ("mfaToken" in result) return result;
+	return buildAuthResponse(result, cookieOpts, res);
+}
+function readRefreshTokenFromRequest(req, cookieOpts) {
+	if (cookieOpts) return req.cookies?.[resolveCookieName(cookieOpts)];
+	const token = req.body?.["refreshToken"];
+	return typeof token === "string" ? token : void 0;
+}
+/**
+* Returns a dynamically created NestJS controller class with all standard identity
+* routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`
+* when `routes` is configured — consumers do not need to define this controller.
+*
+* Pre-wired routes (relative to the module prefix, default `"auth"`):
+*
+* | Method | Path | Description |
+* |--------|------|-------------|
+* | POST | `/register` | Create a new account |
+* | POST | `/login` | Email + password login; may return MFA challenge |
+* | POST | `/refresh` | Rotate the refresh token |
+* | POST | `/logout` | Revoke the current session |
+* | GET  | `/me` | Return the authenticated principal (requires auth) |
+* | POST | `/request-email-verification` | Re-send verification link (requires auth) |
+* | POST | `/verify-email` | Consume an email verification token |
+* | POST | `/request-password-reset` | Send a password reset link |
+* | POST | `/reset-password` | Set a new password using a reset token |
+* | POST | `/mfa/verify` | Complete an MFA challenge after login |
+* | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |
+* | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |
+* | POST | `/2fa/disable` | Disable 2FA (requires auth) |
+* | POST | `/admin/lock/:userId` | Lock an account |
+* | POST | `/admin/unlock/:userId` | Unlock an account |
+* | POST | `/admin/disable/:userId` | Disable an account |
+*/
+function createIdentityController(prefix, controllerOptions = {}) {
+	const cookieOpts = controllerOptions.cookie;
+	let IdentityController = class IdentityController {
+		service;
+		constructor(service) {
+			this.service = service;
+		}
+		async register(body, res) {
+			try {
+				return buildAuthResponse(await this.service.register(body), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async login(body, res) {
+			try {
+				return buildLoginResponse(await this.service.login(body), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async refresh(req, res) {
+			try {
+				const token = readRefreshTokenFromRequest(req, cookieOpts);
+				if (!token) throw new require_errors.UnauthenticatedError("Refresh token is missing.");
+				return buildAuthResponse(await this.service.refresh(token), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async logout(req, res) {
+			try {
+				const token = readRefreshTokenFromRequest(req, cookieOpts);
+				if (token) await this.service.logout(token);
+				if (cookieOpts) res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? "/" });
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		getMe(req) {
+			return req.identity;
+		}
+		async requestEmailVerification(req) {
+			try {
+				await this.service.requestEmailVerification(req.identity.userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async verifyEmail(body) {
+			try {
+				if (!body.token) throw new require_errors.UnauthenticatedError("token is required.");
+				await this.service.verifyEmail(body.token);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async requestPasswordReset(body) {
+			try {
+				if (!body.email) throw new require_errors.UnauthenticatedError("email is required.");
+				await this.service.requestPasswordReset(body.email);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async resetPassword(body) {
+			try {
+				if (!body.token || !body.newPassword) throw new require_errors.UnauthenticatedError("token and newPassword are required.");
+				await this.service.resetPassword(body.token, body.newPassword);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async verifyMfaChallenge(body, res) {
+			try {
+				if (!body.mfaToken || !body.code) throw new require_errors.UnauthenticatedError("mfaToken and code are required.");
+				return buildAuthResponse(await this.service.verifyMfaChallenge(body.mfaToken, body.code), cookieOpts, res);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async setup2FA(req) {
+			try {
+				return await this.service.setup2FA(req.identity.userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async enable2FA(req, body) {
+			try {
+				if (!body.code) throw new require_errors.UnauthenticatedError("code is required.");
+				await this.service.enable2FA(req.identity.userId, body.code);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async disable2FA(req, body) {
+			try {
+				if (!body.code) throw new require_errors.UnauthenticatedError("code is required.");
+				await this.service.disable2FA(req.identity.userId, body.code);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async lockAccount(userId) {
+			try {
+				await this.service.lockAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async unlockAccount(userId) {
+			try {
+				await this.service.unlockAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+		async disableAccount(userId) {
+			try {
+				await this.service.disableAccount(userId);
+			} catch (err) {
+				rethrowAsHttp(err);
+			}
+		}
+	};
+	__decorate([
+		(0, _nestjs_common.Post)("register"),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateParam(1, (0, _nestjs_common.Res)({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "register", null);
+	__decorate([
+		(0, _nestjs_common.Post)("login"),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateParam(1, (0, _nestjs_common.Res)({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "login", null);
+	__decorate([
+		(0, _nestjs_common.Post)("refresh"),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateParam(1, (0, _nestjs_common.Res)({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "refresh", null);
+	__decorate([
+		(0, _nestjs_common.Post)("logout"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateParam(1, (0, _nestjs_common.Res)({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "logout", null);
+	__decorate([
+		(0, _nestjs_common.Get)("me"),
+		(0, _nestjs_common.UseGuards)(IdentityAuthGuard),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", void 0)
+	], IdentityController.prototype, "getMe", null);
+	__decorate([
+		(0, _nestjs_common.Post)("request-email-verification"),
+		(0, _nestjs_common.HttpCode)(204),
+		(0, _nestjs_common.UseGuards)(IdentityAuthGuard),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "requestEmailVerification", null);
+	__decorate([
+		(0, _nestjs_common.Post)("verify-email"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "verifyEmail", null);
+	__decorate([
+		(0, _nestjs_common.Post)("request-password-reset"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "requestPasswordReset", null);
+	__decorate([
+		(0, _nestjs_common.Post)("reset-password"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "resetPassword", null);
+	__decorate([
+		(0, _nestjs_common.Post)("mfa/verify"),
+		__decorateParam(0, (0, _nestjs_common.Body)()),
+		__decorateParam(1, (0, _nestjs_common.Res)({ passthrough: true })),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "verifyMfaChallenge", null);
+	__decorate([
+		(0, _nestjs_common.Post)("2fa/setup"),
+		(0, _nestjs_common.UseGuards)(IdentityAuthGuard),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "setup2FA", null);
+	__decorate([
+		(0, _nestjs_common.Post)("2fa/enable"),
+		(0, _nestjs_common.HttpCode)(204),
+		(0, _nestjs_common.UseGuards)(IdentityAuthGuard),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateParam(1, (0, _nestjs_common.Body)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "enable2FA", null);
+	__decorate([
+		(0, _nestjs_common.Post)("2fa/disable"),
+		(0, _nestjs_common.HttpCode)(204),
+		(0, _nestjs_common.UseGuards)(IdentityAuthGuard),
+		__decorateParam(0, (0, _nestjs_common.Req)()),
+		__decorateParam(1, (0, _nestjs_common.Body)()),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [Object, Object]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "disable2FA", null);
+	__decorate([
+		(0, _nestjs_common.Post)("admin/lock/:userId"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Param)("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "lockAccount", null);
+	__decorate([
+		(0, _nestjs_common.Post)("admin/unlock/:userId"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Param)("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "unlockAccount", null);
+	__decorate([
+		(0, _nestjs_common.Post)("admin/disable/:userId"),
+		(0, _nestjs_common.HttpCode)(204),
+		__decorateParam(0, (0, _nestjs_common.Param)("userId")),
+		__decorateMetadata("design:type", Function),
+		__decorateMetadata("design:paramtypes", [String]),
+		__decorateMetadata("design:returntype", Promise)
+	], IdentityController.prototype, "disableAccount", null);
+	IdentityController = __decorate([
+		(0, _nestjs_common.Controller)(prefix),
+		__decorateParam(0, (0, _nestjs_common.Inject)(IDENTITY_SERVICE)),
+		__decorateMetadata("design:paramtypes", [Object])
+	], IdentityController);
+	return IdentityController;
+}
+//#endregion
+//#region core/nestjs/identity.module.ts
+/**
+* NestJS integration for `@azlib/identity`.
+*
+* Provides a configurable module, an authentication guard, an authorization guard driven
+* by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and
+* `reflect-metadata` are optional peer dependencies — only required when this entry is used.
+*/
+var _ref;
+/** Token used to inject the configured {@link IdentityService} in Nest providers. */
+const IDENTITY_SERVICE = Symbol.for("azlib.identity.service");
+/** Metadata key holding the authorization requirement for a route. */
+const IDENTITY_REQUIREMENT = Symbol.for("azlib.identity.requirement");
+const extractBearerToken = (req) => {
+	const header = req.headers.authorization;
+	const value = Array.isArray(header) ? header[0] : header;
+	if (!value || !value.startsWith("Bearer ")) return null;
+	const token = value.slice(7).trim();
+	return token.length > 0 ? token : null;
+};
+let IdentityAuthGuard = class IdentityAuthGuard {
+	service;
+	constructor(service) {
+		this.service = service;
+	}
+	async canActivate(context) {
+		const req = context.switchToHttp().getRequest();
+		const token = extractBearerToken(req);
+		if (!token) throw new _nestjs_common.UnauthorizedException("Missing bearer token.");
+		try {
+			req.identity = await this.service.authenticate(token);
+		} catch {
+			throw new _nestjs_common.UnauthorizedException("Invalid or expired token.");
+		}
+		return true;
+	}
+};
+IdentityAuthGuard = __decorate([
+	(0, _nestjs_common.Injectable)(),
+	__decorateParam(0, (0, _nestjs_common.Inject)(IDENTITY_SERVICE)),
+	__decorateMetadata("design:paramtypes", [Object])
+], IdentityAuthGuard);
+let IdentityAuthorizationGuard = class IdentityAuthorizationGuard {
+	service;
+	reflector;
+	constructor(service, reflector) {
+		this.service = service;
+		this.reflector = reflector;
+	}
+	async canActivate(context) {
+		const requirement = this.reflector.getAllAndOverride(IDENTITY_REQUIREMENT, [context.getHandler(), context.getClass()]);
+		if (!requirement) return true;
+		const principal = context.switchToHttp().getRequest().identity;
+		if (!principal) throw new _nestjs_common.UnauthorizedException("Not authenticated.");
+		if (!(await this.service.authorize(requirement, {
+			principal,
+			action: requirement.permission ?? "custom"
+		})).allowed) throw new _nestjs_common.ForbiddenException();
+		return true;
+	}
+};
+IdentityAuthorizationGuard = __decorate([
+	(0, _nestjs_common.Injectable)(),
+	__decorateParam(0, (0, _nestjs_common.Inject)(IDENTITY_SERVICE)),
+	__decorateMetadata("design:paramtypes", [Object, typeof (_ref = typeof _nestjs_core.Reflector !== "undefined" && _nestjs_core.Reflector) === "function" ? _ref : Object])
+], IdentityAuthorizationGuard);
+/** Declares the authorization requirement for a route or controller. */
+const RequireAuthorization = (requirement) => (0, _nestjs_common.SetMetadata)(IDENTITY_REQUIREMENT, requirement);
+/** Convenience: declare a single required permission for a route or controller. */
+const RequirePermission = (permission) => (0, _nestjs_common.SetMetadata)(IDENTITY_REQUIREMENT, { permission });
+/** Param decorator that resolves the authenticated principal from the request. */
+const CurrentUser = (0, _nestjs_common.createParamDecorator)((_data, context) => {
+	return context.switchToHttp().getRequest().identity;
+});
+/**
+* NestJS module exposing the identity service plus guards. Register once at the root:
+*
+* ```ts
+* IdentityModule.forRoot({ service: createIdentityService(config, store) })
+* ```
+*/
+function buildControllers(routes) {
+	if (!routes) return [];
+	const routesOpts = routes === true ? {} : routes;
+	return [createIdentityController(routesOpts.prefix ?? "auth", { cookie: routesOpts.cookie })];
+}
+var IdentityModule = class IdentityModule {
+	static forRoot(options) {
+		return {
+			module: IdentityModule,
+			global: true,
+			controllers: buildControllers(options.routes),
+			providers: [
+				{
+					provide: IDENTITY_SERVICE,
+					useValue: options.service
+				},
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			],
+			exports: [
+				IDENTITY_SERVICE,
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			]
+		};
+	}
+	static forRootAsync(options) {
+		return {
+			module: IdentityModule,
+			global: true,
+			imports: options.imports ?? [],
+			controllers: buildControllers(options.routes),
+			providers: [
+				{
+					provide: IDENTITY_SERVICE,
+					useFactory: options.useFactory,
+					inject: options.inject
+				},
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			],
+			exports: [
+				IDENTITY_SERVICE,
+				IdentityAuthGuard,
+				IdentityAuthorizationGuard
+			]
+		};
+	}
+};
+//#endregion
+exports.CurrentUser = CurrentUser;
+exports.IDENTITY_REQUIREMENT = IDENTITY_REQUIREMENT;
+exports.IDENTITY_SERVICE = IDENTITY_SERVICE;
+Object.defineProperty(exports, "IdentityAuthGuard", {
+	enumerable: true,
+	get: function() {
+		return IdentityAuthGuard;
+	}
+});
+Object.defineProperty(exports, "IdentityAuthorizationGuard", {
+	enumerable: true,
+	get: function() {
+		return IdentityAuthorizationGuard;
+	}
+});
+exports.IdentityModule = IdentityModule;
+exports.RequireAuthorization = RequireAuthorization;
+exports.RequirePermission = RequirePermission;

package/dist/nestjs.d.cts

@@ -0,0 +1,102 @@
+import { V as AuthorizationRequirement } from "./errors-C2xZAatu.cjs";
+import { t as IdentityService } from "./identity-service-CLzKx8Z7.cjs";
+import { t as CookieRefreshOptions } from "./identity-router-Dib30Waj.cjs";
+import { Request, Response } from "express";
+import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
+import { Reflector } from "@nestjs/core";
+
+//#region core/nestjs/identity-controller.d.ts
+/** Options accepted by {@link createIdentityController}. */
+interface IdentityControllerOptions {
+  /**
+   * Cookie-based refresh-token transport. When set, the refresh token is stored in an
+   * `HttpOnly` cookie instead of the response body. Omit for body mode.
+   */
+  cookie?: CookieRefreshOptions;
+}
+//#endregion
+//#region core/nestjs/identity.module.d.ts
+/** Token used to inject the configured {@link IdentityService} in Nest providers. */
+declare const IDENTITY_SERVICE: unique symbol;
+/** Metadata key holding the authorization requirement for a route. */
+declare const IDENTITY_REQUIREMENT: unique symbol;
+/**
+ * Options for enabling the pre-built REST routes in {@link IdentityModule}.
+ */
+interface IdentityRoutesOptions extends IdentityControllerOptions {
+  /**
+   * URL prefix for the built-in controller. Default: `"auth"`.
+   *
+   * The controller is mounted at this prefix relative to the application's global
+   * prefix (if any).
+   */
+  prefix?: string;
+}
+interface IdentityModuleOptions {
+  /** A fully wired identity service (see `createIdentityService`). */
+  service: IdentityService;
+  /**
+   * When set, the module automatically registers a built-in REST controller with all
+   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,
+   * `POST /logout`, `GET /me`).
+   *
+   * Pass `true` to use the defaults (`prefix: "auth"`, body-mode refresh tokens), or
+   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.
+   *
+   * @example
+   * ```ts
+   * // Minimal — everything works out of the box
+   * IdentityModule.forRoot({ service, routes: true })
+   *
+   * // With a custom prefix and HttpOnly refresh-token cookie
+   * IdentityModule.forRoot({
+   *   service,
+   *   routes: { prefix: "v1/auth", cookie: { name: "rt", secure: true } },
+   * })
+   * ```
+   */
+  routes?: true | IdentityRoutesOptions;
+}
+interface IdentityModuleAsyncOptions {
+  imports?: DynamicModule["imports"];
+  /** Factory returning the configured identity service. */
+  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;
+  inject?: unknown[];
+  /**
+   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes
+   * alongside the async service factory.
+   */
+  routes?: true | IdentityRoutesOptions;
+}
+/**
+ * Authentication guard: verifies the Bearer access token and attaches the hydrated
+ * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.
+ */
+declare class IdentityAuthGuard implements CanActivate {
+  private readonly service;
+  constructor(service: IdentityService);
+  canActivate(context: ExecutionContext): Promise<boolean>;
+}
+/**
+ * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`
+ * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.
+ */
+declare class IdentityAuthorizationGuard implements CanActivate {
+  private readonly service;
+  private readonly reflector;
+  constructor(service: IdentityService, reflector: Reflector);
+  canActivate(context: ExecutionContext): Promise<boolean>;
+}
+/** Declares the authorization requirement for a route or controller. */
+declare const RequireAuthorization: (requirement: AuthorizationRequirement) => import("@nestjs/common").CustomDecorator<typeof IDENTITY_REQUIREMENT>;
+/** Convenience: declare a single required permission for a route or controller. */
+declare const RequirePermission: (permission: string) => import("@nestjs/common").CustomDecorator<typeof IDENTITY_REQUIREMENT>;
+/** Param decorator that resolves the authenticated principal from the request. */
+declare const CurrentUser: (...dataOrPipes: unknown[]) => ParameterDecorator;
+declare class IdentityModule {
+  static forRoot(options: IdentityModuleOptions): DynamicModule;
+  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule;
+}
+//#endregion
+export { CurrentUser, IDENTITY_REQUIREMENT, IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard, type IdentityControllerOptions, IdentityModule, IdentityModuleAsyncOptions, IdentityModuleOptions, IdentityRoutesOptions, RequireAuthorization, RequirePermission };
+//# sourceMappingURL=nestjs.d.cts.map

package/dist/nestjs.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;;UAkGiB,yBAAA;;;AAAjB;;EAKE,MAAA,GAAS,oBAAoB;AAAA;;;AAAA;AAAA,cC1ElB,gBAAA;;cAGA,oBAAA;AAHb;;;AAAA,UAQiB,qBAAA,SAA8B,yBAAyB;EARJ;AAGpE;;;;AAA4E;EAY1E,MAAM;AAAA;AAAA,UAGS,qBAAA;EAV8B;EAY7C,OAAA,EAAS,eAAA;EAFM;;;;;;;;;AAuBsB;AAGvC;;;;;;;;;;EAHE,MAAA,UAAgB,qBAAqB;AAAA;AAAA,UAGtB,0BAAA;EACf,OAAA,GAAU,aAAA;EAEwB;EAAlC,UAAA,MAAgB,IAAA,cAAkB,eAAA,GAAkB,OAAA,CAAQ,eAAA;EAC5D,MAAA;EAAA;;;;EAKA,MAAA,UAAgB,qBAAA;AAAA;;;;;cAqBL,iBAAA,YAA6B,WAAA;EAAA,iBACe,OAAA;cAAA,OAAA,EAAS,eAAA;EAE1D,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;;;;;cAoBnC,0BAAA,YAAsC,WAAA;EAAA,iBAEJ,OAAA;EAAA,iBAC1B,SAAA;cAD0B,OAAA,EAAS,eAAA,EACnC,SAAA,EAAW,SAAA;EAGxB,WAAA,CAAY,OAAA,EAAS,gBAAA,GAAmB,OAAA;AAAA;AAPhD;AAAA,cAgCa,oBAAA,GAAoB,WAAA,EAAiB,wBAAA,8BAAwB,eAAA,QAAA,oBAAA;;cAI7D,iBAAA,GAAiB,UAAA,sCAAsB,eAAA,QAAA,oBAAA;;cAIvC,WAAA,MAAW,WAAA,gBAAA,kBAKvB;AAAA,cAiBY,cAAA;EAAA,OACJ,OAAA,CAAQ,OAAA,EAAS,qBAAA,GAAwB,aAAA;EAAA,OAczC,YAAA,CAAa,OAAA,EAAS,0BAAA,GAA6B,aAAA;AAAA"}