@azlib/identity 0.2.1 → 0.3.0

package/dist/identity-router-D4oqYI60.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-router-D4oqYI60.d.cts","names":[],"sources":["../core/express/identity-router.ts"],"mappings":";;;;;UAoBiB;;EAEf;;EAEA;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;;;UAMe;;;;;;;;;;;;EAYf;IAA0B,QAAQ;;;;;;;;;;EAUlC;;;;;;;;;;;;;;EAeA;;;;;;;;;;;;;;EAeA,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiJK,qBACd,SAAS,iBACT,UAAS,wBACR;;;;;;;;;;;;;;;iBA0Wa,qBACd;EAAW,SAAS;KAClB,cAAc,KAAK,SAAS,KAAK,UAAU,MAAM"}

package/dist/{identity-service---OTann1.d.cts → identity-service-DE0Ffguz.d.cts}

@@ -1,5 +1,5 @@
 import { T as TotpSetupResult, c as AuthResult, d as AuthenticatedIdentity, r as IdentityStore, v as LoginResult } from "./identity-store-BRRahxcS.cjs";
-import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
+import { B as AuthorizationContext, H as AuthorizationRequirement, O as IdentityConfigInput, V as AuthorizationDecision, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps } from "./errors-0Zh7EG06.cjs";
 //#region core/password-hasher.d.ts
 interface PasswordHasher {
   hash(password: string): Promise<string>;
@@ -119,9 +119,9 @@ interface IdentityServiceConfig extends IdentityConfigInput {
 }
 /**
  * Wires the framework-agnostic identity runtime with Node defaults (scrypt hashing,
- * `jose` HS256 tokens). Express and NestJS adapters build on top of this service.
+ * `jose` HS256 tokens). Express, NestJS, and Next.js adapters build on top of this service.
  */
 declare function createIdentityService(configInput: IdentityServiceConfig, store: IdentityStore): IdentityService;
 //#endregion
 export { RegisterInput as a, registerUser as c, loginUser as d, PasswordHasher as f, RegisterDeps as i, LoginDeps as l, IdentityServiceConfig as n, RegistrationValidationError as o, createPasswordHasher as p, createIdentityService as r, normalizeEmail as s, IdentityService as t, LoginInput as u };
-//# sourceMappingURL=identity-service---OTann1.d.cts.map
+//# sourceMappingURL=identity-service-DE0Ffguz.d.cts.map

package/dist/{identity-service---OTann1.d.cts.map → identity-service-DE0Ffguz.d.cts.map}

@@ -1 +1 @@
-{"version":3,"file":"identity-service---OTann1.d.cts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UAuBiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCnBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UAAU,MAAM,WAAW,OAAO,aAAa,QAAQ;;;;UCtB5D,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EACnC,YAAA;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}
+{"version":3,"file":"identity-service-DE0Ffguz.d.cts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UA6BiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCzBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UACpB,MAAM,WACN,OAAO,aACN,QAAQ;;;;UCzBM,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EAC/C,YAAY;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}

package/dist/{identity-service-WpOKb0MK.d.mts → identity-service-JtsoA6lv.d.mts}

@@ -1,5 +1,5 @@
 import { T as TotpSetupResult, c as AuthResult, d as AuthenticatedIdentity, r as IdentityStore, v as LoginResult } from "./identity-store-BRRahxcS.mjs";
-import { B as AuthorizationDecision, D as IdentityConfigInput, V as AuthorizationRequirement, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
+import { B as AuthorizationContext, H as AuthorizationRequirement, O as IdentityConfigInput, V as AuthorizationDecision, a as IdentityError, f as OAuthService, v as OAuthProvider, w as AuditLogger, x as SessionDeps } from "./errors-DVDEUk9-.mjs";
 //#region core/password-hasher.d.ts
 interface PasswordHasher {
   hash(password: string): Promise<string>;
@@ -119,9 +119,9 @@ interface IdentityServiceConfig extends IdentityConfigInput {
 }
 /**
  * Wires the framework-agnostic identity runtime with Node defaults (scrypt hashing,
- * `jose` HS256 tokens). Express and NestJS adapters build on top of this service.
+ * `jose` HS256 tokens). Express, NestJS, and Next.js adapters build on top of this service.
  */
 declare function createIdentityService(configInput: IdentityServiceConfig, store: IdentityStore): IdentityService;
 //#endregion
 export { RegisterInput as a, registerUser as c, loginUser as d, PasswordHasher as f, RegisterDeps as i, LoginDeps as l, IdentityServiceConfig as n, RegistrationValidationError as o, createPasswordHasher as p, createIdentityService as r, normalizeEmail as s, IdentityService as t, LoginInput as u };
-//# sourceMappingURL=identity-service-WpOKb0MK.d.mts.map
+//# sourceMappingURL=identity-service-JtsoA6lv.d.mts.map

package/dist/{identity-service-WpOKb0MK.d.mts.map → identity-service-JtsoA6lv.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"identity-service-WpOKb0MK.d.mts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UAuBiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCnBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UAAU,MAAM,WAAW,OAAO,aAAa,QAAQ;;;;UCtB5D,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EACnC,YAAA;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}
+{"version":3,"file":"identity-service-JtsoA6lv.d.mts","names":[],"sources":["../core/password-hasher.ts","../core/login.ts","../core/register.ts","../core/identity-service.ts"],"mappings":";;;UA6BiB;EACf,KAAK,mBAAmB;EACxB,OAAO,kBAAkB,qBAAqB;;;iBAIhC,qBAAqB,eAAe;;;;UCzBnC,kBAAkB;EACjC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;;;;;;;;;;iBAWoB,UACpB,MAAM,WACN,OAAO,aACN,QAAQ;;;;UCzBM,qBAAqB;EACpC,QAAQ;EACR,OAAO;;;UAIQ;EACf;EACA;EACA;;;cAIW,oCAAoC;EAC/C,YAAY;;;iBASE,eAAe;;;;;iBAQT,aACpB,MAAM,cACN,OAAO,gBACN,QAAQ;;;;UCDM;EACf,SAAS,OAAO,gBAAgB,QAAQ;;;;;;EAMxC,MAAM,OAAO,aAAa,QAAQ;EAClC,QAAQ,uBAAuB,QAAQ;EACvC,OAAO,uBAAuB;;;;;EAK9B,aAAa,sBAAsB,QAAQ;EAC3C,UAAU,qBACR,aAAa,yBAAyB,YACtC,SAAS,qBAAqB,aAC7B,QAAQ;;EAIX,yBAAyB,iBAAiB;;EAE1C,YAAY,gBAAgB;;EAI5B,qBAAqB,gBAAgB;;EAErC,cAAc,eAAe,sBAAsB;;;;;EAOnD,SAAS,iBAAiB,QAAQ;;EAElC,UAAU,gBAAgB,mBAAmB;;EAE7C,WAAW,gBAAgB,mBAAmB;;;;;EAK9C,mBAAmB,kBAAkB,mBAAmB,QAAQ;;EAIhE,YAAY,iBAAiB;;EAE7B,cAAc,iBAAiB;;EAE/B,eAAe,iBAAiB;;;;;EAMhC,QAAQ;;;UAIO,8BAA8B;;EAE7C;;;;;;IAME,WAAW;;;;;;;iBAQC,sBACd,aAAa,uBACb,OAAO,gBACN"}

package/dist/identity-store-BRRahxcS.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store-BRRahxcS.d.cts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EAA+B;EAAe;;;iBAO9C,sBAAsB;;;;UCTrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cAAc,mBAAmB,0BAA0B,WAAW,OAAO;;EAE7E,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBAAmB,kBAAkB,yBAAyB,QAAQ;;EAEtE,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}
+{"version":3,"file":"identity-store-BRRahxcS.d.cts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EACd;EACA;;;iBAQc,sBAAsB;;;;UCZrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cACE,mBACA,0BACA,WAAW,OACV;;EAEH,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBACE,kBACA,yBACC,QAAQ;;EAEX,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}

package/dist/identity-store-BRRahxcS.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"identity-store-BRRahxcS.d.mts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EAA+B;EAAe;;;iBAO9C,sBAAsB;;;;UCTrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cAAc,mBAAmB,0BAA0B,WAAW,OAAO;;EAE7E,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBAAmB,kBAAkB,yBAAyB,QAAQ;;EAEtE,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}
+{"version":3,"file":"identity-store-BRRahxcS.d.mts","names":[],"sources":["../core/types.ts","../core/verification-token.ts","../core/identity-store.ts"],"mappings":";;;;;;;;KAQY;;UAGK;EACf;EACA;EACA;EACA,QAAQ;EACR,iBAAiB;;;;EAIjB;;;;;EAKA;;;;;EAKA;;;;;EAKA,aAAa;EACb,WAAW;EACX,WAAW;;;UAII;EACf;;EAEA;EACA,WAAW;;;;;;UAOI;EACf;EACA;;EAEA;EACA,WAAW;EACX,WAAW;;EAEX,WAAW;;;KAID;;UAGK;EACf;EACA;EACA;;;UAIe;EACf;EACA;;;UAIe;EACf;EACA,YAAY;;;UAIG;EACf;EACA,YAAY;;;KAIF;;UAoBK;EACf;;EAEA;;EAEA;EACA;EACA;EACA,UAAU;;;UAIK;EACf,MAAM;EACN;;EAEA,UAAU;EACV,YAAY;;;;;;UAOG;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA;EACA,sBAAsB;;;UAIP;EACf;EACA;EACA,sBAAsB;EACtB,uBAAuB;;;UAIR;EACf,MAAM;EACN,QAAQ;;;;;;UAOO;EACf;;EAEA;;;KAIU,cAAc,aAAa;;KAG3B;;UAGK;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;EAEX,QAAQ;;;UAIO;EACf;;EAEA;;EAEA,WAAW;EACX,WAAW;;;UAII;;EAEf;;EAEA;;;UAIe;;EAEf;;EAEA;;EAEA;;EAEA;;;;;UC/Me;;EAEf;EACA;EACA,MAAM;EACN,WAAW;;;;;;iBAOG;EACd;EACA;;;iBAQc,sBAAsB;;;;UCZrB;EACf;EACA;EACA;EACA,QAAQ;EACR;EACA,WAAW;EACX,WAAW;;;UAII;EACf;EACA;EACA;EACA,WAAW;EACX,WAAW;;;;;;;;;;UAWI;EAEf,gBAAgB,gBAAgB,QAAQ;EACxC,aAAa,iBAAiB,QAAQ;EACtC,WAAW,OAAO,0BAA0B,QAAQ;EACpD,WACE,gBACA,OAAO,QACL,KACE,4IAUH,QAAQ;EAEX,eAAe,iBAAiB,QAAQ;EACxC,iBAAiB,QAAQ,mBAAmB;EAG5C,cAAc,OAAO,yBAAyB,QAAQ;EACtD,gBAAgB,oBAAoB,QAAQ;;EAE5C,cAAc,mBAAmB,WAAW,OAAO;;EAEnD,cACE,mBACA,0BACA,WAAW,OACV;;EAEH,kBAAkB,gBAAgB,WAAW,OAAO;EAGpD,iBAAiB,iBAAiB,iBAAiB;EACnD,uBAAuB,iBAAiB,iBAAiB;EACzD,WAAW,YAAY,qBAAqB;EAC5C,oBAAoB,OAAO,sBAAsB;EACjD,sBAAsB,OAAO,wBAAwB;;EAIrD,yBAAyB,OAAO,+BAA+B;;EAE/D,uBAAuB,oBAAoB,QAAQ;;EAEnD,2BAA2B,mBAAmB,QAAQ,OAAO;;EAI7D,gBAAgB,iBAAiB,QAAQ;;EAEzC,kBAAkB,QAAQ,aAAa;;EAEvC,kBAAkB,iBAAiB;EAGnC,aAAa,OAAO,gBAAgB;;;;;EAOpC,mBACE,kBACA,yBACC,QAAQ;;EAEX,iBAAiB,MAAM,qBAAqB;;EAE5C,gBAAgB,iBAAiB,iBAAiB"}

package/dist/index-CsYqHPvK.d.cts

@@ -0,0 +1,54 @@
+import { s as AccessTokenClaims } from "./identity-store-BRRahxcS.cjs";
+//#region core/access-token.d.ts
+/**
+ * Options for {@link verifyAccessToken}. Edge-safe: depends only on `jose`.
+ */
+interface VerifyAccessTokenOptions {
+  /** HMAC secret used to sign access tokens. Must match `accessTokenSecret`. */
+  secret: string;
+  /** Expected JWT issuer. Default {@link DEFAULT_ISSUER}. */
+  issuer?: string;
+  /** Expected JWT audience. Omit when tokens are minted without `aud`. */
+  audience?: string;
+}
+/**
+ * Verifies an HS256 access token and returns its claims.
+ *
+ * This helper is framework-agnostic and safe to run on the Edge (no `node:crypto`).
+ * Hydrating the principal still requires {@link IdentityService.authenticate} in Node.
+ *
+ * Throws {@link InvalidTokenError} when the token is missing, malformed, expired,
+ * signed with the wrong secret, or missing required claims.
+ */
+declare function verifyAccessToken(token: string, options: VerifyAccessTokenOptions): Promise<AccessTokenClaims>;
+//#endregion
+//#region schema/model.d.ts
+/**
+ * Logical description of the relational schema `@azlib/identity` expects.
+ *
+ * Concrete DDL is shipped alongside this module:
+ * - `@azlib/identity/schema/postgres.sql`
+ * - `@azlib/identity/schema/mysql.sql`
+ * - `@azlib/identity/schema/sqlite.sql`
+ * - `@azlib/identity/schema/prisma.schema`
+ *
+ * This object is documentation-as-data so consumers and tooling can introspect the
+ * expected tables without parsing SQL.
+ */
+interface SchemaColumn {
+  name: string;
+  description: string;
+  nullable: boolean;
+}
+interface SchemaTable {
+  name: string;
+  description: string;
+  columns: readonly SchemaColumn[];
+}
+interface SchemaModel {
+  tables: readonly SchemaTable[];
+}
+declare const identitySchemaModel: SchemaModel;
+//#endregion
+export { VerifyAccessTokenOptions as n, verifyAccessToken as r, identitySchemaModel as t };
+//# sourceMappingURL=index-CsYqHPvK.d.cts.map

package/dist/index-CsYqHPvK.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-CsYqHPvK.d.cts","names":[],"sources":["../core/access-token.ts","../schema/model.ts"],"mappings":";;;;;UASiB;;EAEf;;EAEA;;EAEA;;;;;;;;;;;iBAYoB,kBACpB,eACA,SAAS,2BACR,QAAQ;;;;;;;;;;;;;;;UClBM;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA,kBAAkB;;UAGH;EACf,iBAAiB;;cAGN,qBAAqB"}

package/dist/index-LhSdoWEP.d.mts

@@ -0,0 +1,54 @@
+import { s as AccessTokenClaims } from "./identity-store-BRRahxcS.mjs";
+//#region core/access-token.d.ts
+/**
+ * Options for {@link verifyAccessToken}. Edge-safe: depends only on `jose`.
+ */
+interface VerifyAccessTokenOptions {
+  /** HMAC secret used to sign access tokens. Must match `accessTokenSecret`. */
+  secret: string;
+  /** Expected JWT issuer. Default {@link DEFAULT_ISSUER}. */
+  issuer?: string;
+  /** Expected JWT audience. Omit when tokens are minted without `aud`. */
+  audience?: string;
+}
+/**
+ * Verifies an HS256 access token and returns its claims.
+ *
+ * This helper is framework-agnostic and safe to run on the Edge (no `node:crypto`).
+ * Hydrating the principal still requires {@link IdentityService.authenticate} in Node.
+ *
+ * Throws {@link InvalidTokenError} when the token is missing, malformed, expired,
+ * signed with the wrong secret, or missing required claims.
+ */
+declare function verifyAccessToken(token: string, options: VerifyAccessTokenOptions): Promise<AccessTokenClaims>;
+//#endregion
+//#region schema/model.d.ts
+/**
+ * Logical description of the relational schema `@azlib/identity` expects.
+ *
+ * Concrete DDL is shipped alongside this module:
+ * - `@azlib/identity/schema/postgres.sql`
+ * - `@azlib/identity/schema/mysql.sql`
+ * - `@azlib/identity/schema/sqlite.sql`
+ * - `@azlib/identity/schema/prisma.schema`
+ *
+ * This object is documentation-as-data so consumers and tooling can introspect the
+ * expected tables without parsing SQL.
+ */
+interface SchemaColumn {
+  name: string;
+  description: string;
+  nullable: boolean;
+}
+interface SchemaTable {
+  name: string;
+  description: string;
+  columns: readonly SchemaColumn[];
+}
+interface SchemaModel {
+  tables: readonly SchemaTable[];
+}
+declare const identitySchemaModel: SchemaModel;
+//#endregion
+export { VerifyAccessTokenOptions as n, verifyAccessToken as r, identitySchemaModel as t };
+//# sourceMappingURL=index-LhSdoWEP.d.mts.map

package/dist/index-LhSdoWEP.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index-LhSdoWEP.d.mts","names":[],"sources":["../core/access-token.ts","../schema/model.ts"],"mappings":";;;;;UASiB;;EAEf;;EAEA;;EAEA;;;;;;;;;;;iBAYoB,kBACpB,eACA,SAAS,2BACR,QAAQ;;;;;;;;;;;;;;;UClBM;EACf;EACA;EACA;;UAGe;EACf;EACA;EACA,kBAAkB;;UAGH;EACf,iBAAiB;;cAGN,qBAAqB"}

package/dist/index.cjs

@@ -1,7 +1,11 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("./errors-Bcjx9o6g.cjs");
-const require_identity = require("./identity-4eP45YIP.cjs");
+const require_identity = require("./identity-Yz1BVkrM.cjs");
+const require_cookie_header = require("./cookie-header-Dqd5k5BU.cjs");
 exports.AccountUnavailableError = require_errors.AccountUnavailableError;
+exports.DEFAULT_ACCESS_COOKIE = require_cookie_header.DEFAULT_ACCESS_COOKIE;
+exports.DEFAULT_ISSUER = require_identity.DEFAULT_ISSUER;
+exports.DEFAULT_REFRESH_COOKIE = require_cookie_header.DEFAULT_REFRESH_COOKIE;
 exports.EmailAlreadyRegisteredError = require_errors.EmailAlreadyRegisteredError;
 exports.ForbiddenError = require_errors.ForbiddenError;
 exports.IdentityConfigError = require_errors.IdentityConfigError;
@@ -13,6 +17,12 @@ exports.OAuthStateMismatchError = require_identity.OAuthStateMismatchError;
 exports.UnauthenticatedError = require_errors.UnauthenticatedError;
 exports.createOAuthService = require_identity.createOAuthService;
 exports.evaluateAuthorization = require_identity.evaluateAuthorization;
+exports.hasIdentityCookies = require_cookie_header.hasIdentityCookies;
 exports.identitySchemaModel = require_identity.identitySchemaModel;
 exports.isAuthorized = require_identity.isAuthorized;
+exports.parseCookieHeader = require_cookie_header.parseCookieHeader;
+exports.readCookieValue = require_cookie_header.readCookieValue;
+exports.resolveCookieAttributes = require_cookie_header.resolveCookieAttributes;
+exports.resolveCookieNames = require_cookie_header.resolveCookieNames;
 exports.resolveIdentityConfig = require_identity.resolveIdentityConfig;
+exports.verifyAccessToken = require_identity.verifyAccessToken;

package/dist/index.d.cts

@@ -1,4 +1,5 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
-import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
-export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };
+import { A as LockoutConfig, B as AuthorizationContext, D as IdentityConfig, E as DEFAULT_ISSUER, G as isAuthorized, H as AuthorizationRequirement, O as IdentityConfigInput, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens } from "./errors-0Zh7EG06.cjs";
+import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-CsYqHPvK.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, createOAuthService, evaluateAuthorization, hasIdentityCookies, identitySchemaModel, isAuthorized, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, verifyAccessToken };

package/dist/index.d.mts

@@ -1,4 +1,5 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, D as IdentityConfigInput, E as IdentityConfig, H as PolicyRule, O as IdentityOverrides, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
-import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
-export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };
+import { A as LockoutConfig, B as AuthorizationContext, D as IdentityConfig, E as DEFAULT_ISSUER, G as isAuthorized, H as AuthorizationRequirement, O as IdentityConfigInput, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens } from "./errors-DVDEUk9-.mjs";
+import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-LhSdoWEP.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, createOAuthService, evaluateAuthorization, hasIdentityCookies, identitySchemaModel, isAuthorized, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, verifyAccessToken };

package/dist/index.mjs

@@ -1,3 +1,4 @@
 import { a as IdentityError, c as UnauthenticatedError, i as IdentityConfigError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError } from "./errors-CEmnZxIn.mjs";
-import { c as isAuthorized, i as createOAuthService, l as resolveIdentityConfig, n as OAuthProviderNotFoundError, r as OAuthStateMismatchError, s as evaluateAuthorization, t as identitySchemaModel } from "./identity-Bz9RDOvT.mjs";
-export { AccountUnavailableError, EmailAlreadyRegisteredError, ForbiddenError, IdentityConfigError, IdentityError, InvalidCredentialsError, InvalidTokenError, OAuthProviderNotFoundError, OAuthStateMismatchError, UnauthenticatedError, createOAuthService, evaluateAuthorization, identitySchemaModel, isAuthorized, resolveIdentityConfig };
+import { a as createOAuthService, c as evaluateAuthorization, d as resolveIdentityConfig, i as OAuthStateMismatchError, l as isAuthorized, n as verifyAccessToken, r as OAuthProviderNotFoundError, t as identitySchemaModel, u as DEFAULT_ISSUER } from "./identity-D0qyca_c.mjs";
+import { a as readCookieValue, i as parseCookieHeader, n as DEFAULT_REFRESH_COOKIE, o as resolveCookieAttributes, r as hasIdentityCookies, s as resolveCookieNames, t as DEFAULT_ACCESS_COOKIE } from "./cookie-header-DptIxRmW.mjs";
+export { AccountUnavailableError, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, EmailAlreadyRegisteredError, ForbiddenError, IdentityConfigError, IdentityError, InvalidCredentialsError, InvalidTokenError, OAuthProviderNotFoundError, OAuthStateMismatchError, UnauthenticatedError, createOAuthService, evaluateAuthorization, hasIdentityCookies, identitySchemaModel, isAuthorized, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, verifyAccessToken };

package/dist/logger-CcCHJVVe.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"logger-CcCHJVVe.mjs","names":[],"sources":["../core/logger.ts"],"sourcesContent":["/**\n * Pluggable logger interface for `@azlib/identity`.\n *\n * The package uses this interface for request/response logging in the Express router and\n * for operational messages throughout the module. Consumers can hook any structured\n * logging library (Winston, Pino, Bunyan, etc.) by implementing this interface.\n *\n * @example\n * ```ts\n * import pino from \"pino\";\n *\n * const logger = pino();\n * createIdentityRouter(service, { logger });\n * ```\n */\nexport interface IdentityLogger {\n  debug(message: string, meta?: Record<string, unknown>): void;\n  info(message: string, meta?: Record<string, unknown>): void;\n  warn(message: string, meta?: Record<string, unknown>): void;\n  error(message: string, meta?: Record<string, unknown>): void;\n}\n\n/**\n * Default logger that writes to the Node.js console with an `[identity]` prefix.\n * Used when no custom logger is provided.\n */\nexport const consoleLogger: IdentityLogger = {\n  debug: (msg, meta) => console.debug(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  info: (msg, meta) => console.info(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  warn: (msg, meta) => console.warn(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  error: (msg, meta) => console.error(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n};\n\n/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */\nexport const noopLogger: IdentityLogger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\n/**\n * Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.\n *\n * - `false` → {@link noopLogger}\n * - `undefined` → {@link consoleLogger}\n * - anything else → returned as-is\n */\nexport function resolveLogger(logger?: IdentityLogger | false): IdentityLogger {\n  if (logger === false) return noopLogger;\n  return logger ?? consoleLogger;\n}\n"],"mappings":";;;;;AA0BA,MAAa,gBAAgC;CAC3C,QAAQ,KAAK,SAAS,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC9F,OAAO,KAAK,SAAS,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC5F,OAAO,KAAK,SAAS,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC5F,QAAQ,KAAK,SAAS,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;AAChG;;AAGA,MAAa,aAA6B;CACxC,aAAa,CAAC;CACd,YAAY,CAAC;CACb,YAAY,CAAC;CACb,aAAa,CAAC;AAChB;;;;;;;;AASA,SAAgB,cAAc,QAAiD;CAC7E,IAAI,WAAW,OAAO,OAAO;CAC7B,OAAO,UAAU;AACnB"}
+{"version":3,"file":"logger-CcCHJVVe.mjs","names":[],"sources":["../core/logger.ts"],"sourcesContent":["/**\n * Pluggable logger interface for `@azlib/identity`.\n *\n * The package uses this interface for request/response logging in the Express router and\n * for operational messages throughout the module. Consumers can hook any structured\n * logging library (Winston, Pino, Bunyan, etc.) by implementing this interface.\n *\n * @example\n * ```ts\n * import pino from \"pino\";\n *\n * const logger = pino();\n * createIdentityRouter(service, { logger });\n * ```\n */\nexport interface IdentityLogger {\n  debug(message: string, meta?: Record<string, unknown>): void;\n  info(message: string, meta?: Record<string, unknown>): void;\n  warn(message: string, meta?: Record<string, unknown>): void;\n  error(message: string, meta?: Record<string, unknown>): void;\n}\n\n/**\n * Default logger that writes to the Node.js console with an `[identity]` prefix.\n * Used when no custom logger is provided.\n */\nexport const consoleLogger: IdentityLogger = {\n  debug: (msg, meta) =>\n    console.debug(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  info: (msg, meta) =>\n    console.info(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  warn: (msg, meta) =>\n    console.warn(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n  error: (msg, meta) =>\n    console.error(`[identity] ${msg}`, ...(meta !== undefined ? [meta] : [])),\n};\n\n/** No-op logger. Pass `false` or `noopLogger` to disable all identity logging. */\nexport const noopLogger: IdentityLogger = {\n  debug: () => {},\n  info: () => {},\n  warn: () => {},\n  error: () => {},\n};\n\n/**\n * Resolves an `IdentityLogger | false | undefined` to a concrete `IdentityLogger`.\n *\n * - `false` → {@link noopLogger}\n * - `undefined` → {@link consoleLogger}\n * - anything else → returned as-is\n */\nexport function resolveLogger(logger?: IdentityLogger | false): IdentityLogger {\n  if (logger === false) return noopLogger;\n  return logger ?? consoleLogger;\n}\n"],"mappings":";;;;;AA0BA,MAAa,gBAAgC;CAC3C,QAAQ,KAAK,SACX,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CAC1E,OAAO,KAAK,SACV,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CACzE,OAAO,KAAK,SACV,QAAQ,KAAK,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;CACzE,QAAQ,KAAK,SACX,QAAQ,MAAM,cAAc,OAAO,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,IAAI,CAAC,CAAE;AAC5E;;AAGA,MAAa,aAA6B;CACxC,aAAa,CAAC;CACd,YAAY,CAAC;CACb,YAAY,CAAC;CACb,aAAa,CAAC;AAChB;;;;;;;;AASA,SAAgB,cAAc,QAAiD;CAC7E,IAAI,WAAW,OAAO,OAAO;CAC7B,OAAO,UAAU;AACnB"}

package/dist/nestjs.d.cts

@@ -1,6 +1,6 @@
-import { V as AuthorizationRequirement } from "./errors-CBbiRO2n.cjs";
-import { t as IdentityService } from "./identity-service---OTann1.cjs";
-import { t as CookieRefreshOptions } from "./identity-router-D1xJ5H7y.cjs";
+import { H as AuthorizationRequirement } from "./errors-0Zh7EG06.cjs";
+import { t as IdentityService } from "./identity-service-DE0Ffguz.cjs";
+import { t as CookieRefreshOptions } from "./identity-router-D4oqYI60.cjs";
 import { Request, Response } from "express";
 import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";

package/dist/nestjs.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAkGiB;;;;;EAKf,SAAS;;;;;cC1EE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBACe;EAAA,YAAA,SAAS;EAE1D,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAD0B,YAAA,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAyBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAIvC,iBAAW,2BAAA;cAsBX;SACJ,QAAQ,SAAS,wBAAwB;SAczC,aAAa,SAAS,6BAA6B"}
+{"version":3,"file":"nestjs.d.cts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAiHiB;;;;;EAKf,SAAS;;;;;cCzFE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBAEK;EAD7C,YAC6C,SAAS;EAGhD,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAFnB,YAC6C,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAwBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAMvC,iBAAW,2BAAA;cA2BX;SACJ,QAAQ,SAAS,wBAAwB;SAkBzC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.d.mts

@@ -1,6 +1,6 @@
-import { V as AuthorizationRequirement } from "./errors-_OcodtdV.mjs";
-import { t as IdentityService } from "./identity-service-WpOKb0MK.mjs";
-import { t as CookieRefreshOptions } from "./identity-router-tj3-teBI.mjs";
+import { H as AuthorizationRequirement } from "./errors-DVDEUk9-.mjs";
+import { t as IdentityService } from "./identity-service-JtsoA6lv.mjs";
+import { t as CookieRefreshOptions } from "./identity-router-BiratpJR.mjs";
 import { Request, Response } from "express";
 import { CanActivate, DynamicModule, ExecutionContext } from "@nestjs/common";
 import { Reflector } from "@nestjs/core";

package/dist/nestjs.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAkGiB;;;;;EAKf,SAAS;;;;;cC1EE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBACe;EAAA,YAAA,SAAS;EAE1D,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAD0B,YAAA,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAyBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAIvC,iBAAW,2BAAA;cAsBX;SACJ,QAAQ,SAAS,wBAAwB;SAczC,aAAa,SAAS,6BAA6B"}
+{"version":3,"file":"nestjs.d.mts","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"mappings":";;;;;;;;UAiHiB;;;;;EAKf,SAAS;;;;;cCzFE;;cAGA;;;;UAKI,8BAA8B;;;;;;;EAO7C;;UAGe;;EAEf,SAAS;;;;;;;;;;;;;;;;;;;;;EAqBT,gBAAgB;;UAGD;EACf,UAAU;;EAEV,gBAAgB,kBAAkB,kBAAkB,QAAQ;EAC5D;;;;;EAKA,gBAAgB;;;;;;cAqBL,6BAA6B;mBAEK;EAD7C,YAC6C,SAAS;EAGhD,YAAY,SAAS,mBAAmB;;;;;;cAoBnC,sCAAsC;mBAEJ;mBAC1B;EAFnB,YAC6C,SAAS,iBACnC,WAAW;EAGxB,YAAY,SAAS,mBAAmB;;;cAwBnC,uBAAoB,aAAiB,sDAAwB,uBAAA;;cAI7D,oBAAiB,gDAAsB,uBAAA;;cAMvC,iBAAW,2BAAA;cA2BX;SACJ,QAAQ,SAAS,wBAAwB;SAkBzC,aAAa,SAAS,6BAA6B"}

package/dist/nestjs.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException({ code: err.code, message: err.message }, err.statusCode as HttpStatus);\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const { refreshToken: _rt, refreshTokenExpiresAt: _exp, ...bodyTokens } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(result: AuthResult, cookieOpts: CookieRefreshOptions | undefined, res: Response) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(res, result.tokens, cookieOpts);\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(@Req() req: Request, @Res({ passthrough: true }) res: Response) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), { path: cookieOpts.path ?? \"/\" });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(@Body() body: { token?: string; newPassword?: string }) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(body.mfaToken, body.code);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(@Inject(IDENTITY_SERVICE) private readonly service: IdentityService) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<AuthorizationRequirement | undefined>(\n      IDENTITY_REQUIREMENT,\n      [context.getHandler(), context.getClass()],\n    );\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, { permission } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (_data: unknown, context: ExecutionContext): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = { cookie: routesOpts.cookie };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [IDENTITY_SERVICE, IdentityAuthGuard, IdentityAuthorizationGuard],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cAAc;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GAAG,IAAI,UAAwB;CAEhG,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EAAE,cAAc,KAAK,uBAAuB,MAAM,GAAG,eAAe;CAC1E,OAAO;AACT;AAEA,SAAS,kBAAkB,QAAoB,YAA8C,KAAe;CAC1G,IAAI,YAAY;EACd,MAAM,SAAS,8BAA8B,KAAK,OAAO,QAAQ,UAAU;EAC3E,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IACM,qBADN,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QAAQ,KAAqB,KAA2C;GAC5E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OAAO,KAAqB,KAA2C;GAC3E,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAAE,MAAM,WAAW,QAAQ,IAAI,CAAC;GAEnF,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBAAyB,KAAyD;GACtF,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,MAAwD;GAC1E,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAElE,OAAO,kBAAkB,MADJ,KAAK,QAAQ,mBAAmB,KAAK,UAAU,KAAK,IAAI,GAC5C,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA/MG,KAAK,UAAU;EAEb,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;EAEV,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;EACA,gBAAA,GAAA,IAAI,CAAA;EAAiB,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAa5D,KAAK,QAAQ;EACb,SAAS,GAAG;EACC,gBAAA,GAAA,IAAI,CAAA;EAAiB,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3D,IAAI,IAAI;EACR,UAAU,iBAAiB;EACrB,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;EACI,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnC,KAAK,cAAc;EACnB,SAAS,GAAG;EACM,gBAAA,GAAA,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;EACe,gBAAA,GAAA,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;EACQ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAczB,KAAK,YAAY;EAEf,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAY3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;EACZ,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;EACM,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;EACQ,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;EACS,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EA5MrC,WAAW,MAAM;EAEH,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;CAmNtC,OAAO;AACT;;;;;;;;;;;ACvUA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,CAAC,CAAC,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAM,oBAAN,MAAM,kBAAyC;CACG;CAAvD,YAAY,SAAqE;EAA1B,KAAA,UAAA;CAA2B;CAElF,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,CAAC,CAAC,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAjBC,WAAW;CAEG,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;AAsB/B,IAAM,6BAAN,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBACjC,sBACA,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAC3C;EAEA,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,CAAC,CAAC,WACf,CAAC,CAAC;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,EAAA,CACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA7BC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;;AA6B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAAE,WAAW,CAAoC;;AAGrF,MAAa,cAAc,sBACxB,OAAgB,YAAiE;CAEhF,OADY,QAAQ,aAAa,CAAC,CAAC,WAC1B,CAAC,CAAC;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAG1C,OAAO,CAAC,yBAFO,WAAW,UAAU,QAEK,EADW,QAAQ,WAAW,OACjB,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IAAC;IAAkB;IAAmB;GAA0B;EAC3E;CACF;AACF"}
+{"version":3,"file":"nestjs.mjs","names":[],"sources":["../core/nestjs/identity-controller.ts","../core/nestjs/identity.module.ts"],"sourcesContent":["/**\n * Pre-built NestJS controller for `@azlib/identity`.\n *\n * Register it automatically via `IdentityModule.forRoot({ routes: true })`.\n * `@nestjs/common` is an optional peer dependency — only required when this file is used.\n */\nimport {\n  Body,\n  Controller,\n  Get,\n  HttpCode,\n  HttpException,\n  type HttpStatus,\n  Inject,\n  Param,\n  Post,\n  Req,\n  Res,\n  UseGuards,\n} from \"@nestjs/common\";\nimport type { Request, Response } from \"express\";\n\nimport { IdentityError, UnauthenticatedError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthResult, AuthTokens, LoginResult } from \"../types\";\nimport type { CookieRefreshOptions } from \"../express/identity-router\";\nimport { IdentityAuthGuard, IDENTITY_SERVICE } from \"./identity.module\";\n\n// ---------------------------------------------------------------------------\n// Internal helpers\n// ---------------------------------------------------------------------------\n\nfunction resolveCookieName(opts: CookieRefreshOptions): string {\n  return opts.name ?? \"azlib_rt\";\n}\n\nfunction rethrowAsHttp(err: unknown): never {\n  if (err instanceof IdentityError) {\n    throw new HttpException(\n      { code: err.code, message: err.message },\n      err.statusCode as HttpStatus,\n    );\n  }\n  throw err;\n}\n\nfunction setCookieAndStripRefreshToken(\n  res: Response,\n  tokens: AuthTokens,\n  opts: CookieRefreshOptions,\n): Omit<AuthTokens, \"refreshToken\" | \"refreshTokenExpiresAt\"> {\n  const maxAge = tokens.refreshTokenExpiresAt.getTime() - Date.now();\n  res.cookie(resolveCookieName(opts), tokens.refreshToken, {\n    httpOnly: opts.httpOnly ?? true,\n    secure: opts.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: opts.sameSite ?? \"lax\",\n    path: opts.path ?? \"/\",\n    domain: opts.domain,\n    maxAge,\n  });\n  const {\n    refreshToken: _rt,\n    refreshTokenExpiresAt: _exp,\n    ...bodyTokens\n  } = tokens;\n  return bodyTokens;\n}\n\nfunction buildAuthResponse(\n  result: AuthResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (cookieOpts) {\n    const tokens = setCookieAndStripRefreshToken(\n      res,\n      result.tokens,\n      cookieOpts,\n    );\n    return { user: result.user, tokens };\n  }\n  return result;\n}\n\nfunction buildLoginResponse(\n  result: LoginResult,\n  cookieOpts: CookieRefreshOptions | undefined,\n  res: Response,\n) {\n  if (\"mfaToken\" in result) {\n    return result; // { kind: \"mfa_required\", mfaToken: \"...\" }\n  }\n  return buildAuthResponse(result, cookieOpts, res);\n}\n\nfunction readRefreshTokenFromRequest(\n  req: Request,\n  cookieOpts: CookieRefreshOptions | undefined,\n): string | undefined {\n  if (cookieOpts) {\n    const cookies = req.cookies as Record<string, string> | undefined;\n    return cookies?.[resolveCookieName(cookieOpts)];\n  }\n  const body = req.body as Record<string, unknown> | undefined;\n  const token = body?.[\"refreshToken\"];\n  return typeof token === \"string\" ? token : undefined;\n}\n\n// ---------------------------------------------------------------------------\n// Controller options\n// ---------------------------------------------------------------------------\n\n/** Options accepted by {@link createIdentityController}. */\nexport interface IdentityControllerOptions {\n  /**\n   * Cookie-based refresh-token transport. When set, the refresh token is stored in an\n   * `HttpOnly` cookie instead of the response body. Omit for body mode.\n   */\n  cookie?: CookieRefreshOptions;\n}\n\n// ---------------------------------------------------------------------------\n// Controller factory\n// ---------------------------------------------------------------------------\n\n/**\n * Returns a dynamically created NestJS controller class with all standard identity\n * routes pre-wired. The class is registered directly in `IdentityModule.forRoot()`\n * when `routes` is configured — consumers do not need to define this controller.\n *\n * Pre-wired routes (relative to the module prefix, default `\"auth\"`):\n *\n * | Method | Path | Description |\n * |--------|------|-------------|\n * | POST | `/register` | Create a new account |\n * | POST | `/login` | Email + password login; may return MFA challenge |\n * | POST | `/refresh` | Rotate the refresh token |\n * | POST | `/logout` | Revoke the current session |\n * | GET  | `/me` | Return the authenticated principal (requires auth) |\n * | POST | `/request-email-verification` | Re-send verification link (requires auth) |\n * | POST | `/verify-email` | Consume an email verification token |\n * | POST | `/request-password-reset` | Send a password reset link |\n * | POST | `/reset-password` | Set a new password using a reset token |\n * | POST | `/mfa/verify` | Complete an MFA challenge after login |\n * | POST | `/2fa/setup` | Begin TOTP 2FA setup (requires auth) |\n * | POST | `/2fa/enable` | Confirm and enable 2FA (requires auth) |\n * | POST | `/2fa/disable` | Disable 2FA (requires auth) |\n * | POST | `/admin/lock/:userId` | Lock an account |\n * | POST | `/admin/unlock/:userId` | Unlock an account |\n * | POST | `/admin/disable/:userId` | Disable an account |\n */\nexport function createIdentityController(\n  prefix: string,\n  controllerOptions: IdentityControllerOptions = {},\n) {\n  const cookieOpts = controllerOptions.cookie;\n\n  @Controller(prefix)\n  class IdentityController {\n    constructor(@Inject(IDENTITY_SERVICE) readonly service: IdentityService) {}\n\n    @Post(\"register\")\n    async register(\n      @Body() body: { email: string; password: string; displayName?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.register(body);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"login\")\n    async login(\n      @Body() body: { email: string; password: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const result = await this.service.login(body);\n        return buildLoginResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"refresh\")\n    async refresh(\n      @Req() req: Request,\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (!token) {\n          throw new UnauthenticatedError(\"Refresh token is missing.\");\n        }\n        const result = await this.service.refresh(token);\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"logout\")\n    @HttpCode(204)\n    async logout(\n      @Req() req: Request,\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        const token = readRefreshTokenFromRequest(req, cookieOpts);\n        if (token) {\n          await this.service.logout(token);\n        }\n        if (cookieOpts) {\n          res.clearCookie(resolveCookieName(cookieOpts), {\n            path: cookieOpts.path ?? \"/\",\n          });\n        }\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Get(\"me\")\n    @UseGuards(IdentityAuthGuard)\n    getMe(@Req() req: Request & { identity?: unknown }) {\n      return req.identity;\n    }\n\n    // -------------------------------------------------------------------------\n    // Email verification\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-email-verification\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async requestEmailVerification(\n      @Req() req: Request & { identity?: { userId: string } },\n    ) {\n      try {\n        await this.service.requestEmailVerification(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"verify-email\")\n    @HttpCode(204)\n    async verifyEmail(@Body() body: { token?: string }) {\n      try {\n        if (!body.token) throw new UnauthenticatedError(\"token is required.\");\n        await this.service.verifyEmail(body.token);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Password reset\n    // -------------------------------------------------------------------------\n\n    @Post(\"request-password-reset\")\n    @HttpCode(204)\n    async requestPasswordReset(@Body() body: { email?: string }) {\n      try {\n        if (!body.email) throw new UnauthenticatedError(\"email is required.\");\n        await this.service.requestPasswordReset(body.email);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"reset-password\")\n    @HttpCode(204)\n    async resetPassword(\n      @Body() body: { token?: string; newPassword?: string },\n    ) {\n      try {\n        if (!body.token || !body.newPassword)\n          throw new UnauthenticatedError(\"token and newPassword are required.\");\n        await this.service.resetPassword(body.token, body.newPassword);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Two-factor authentication\n    // -------------------------------------------------------------------------\n\n    @Post(\"mfa/verify\")\n    async verifyMfaChallenge(\n      @Body() body: { mfaToken?: string; code?: string },\n      @Res({ passthrough: true }) res: Response,\n    ) {\n      try {\n        if (!body.mfaToken || !body.code)\n          throw new UnauthenticatedError(\"mfaToken and code are required.\");\n        const result = await this.service.verifyMfaChallenge(\n          body.mfaToken,\n          body.code,\n        );\n        return buildAuthResponse(result, cookieOpts, res);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/setup\")\n    @UseGuards(IdentityAuthGuard)\n    async setup2FA(@Req() req: Request & { identity?: { userId: string } }) {\n      try {\n        return await this.service.setup2FA(req.identity!.userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/enable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async enable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.enable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"2fa/disable\")\n    @HttpCode(204)\n    @UseGuards(IdentityAuthGuard)\n    async disable2FA(\n      @Req() req: Request & { identity?: { userId: string } },\n      @Body() body: { code?: string },\n    ) {\n      try {\n        if (!body.code) throw new UnauthenticatedError(\"code is required.\");\n        await this.service.disable2FA(req.identity!.userId, body.code);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    // -------------------------------------------------------------------------\n    // Account management (admin)\n    // -------------------------------------------------------------------------\n\n    @Post(\"admin/lock/:userId\")\n    @HttpCode(204)\n    async lockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.lockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/unlock/:userId\")\n    @HttpCode(204)\n    async unlockAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.unlockAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n\n    @Post(\"admin/disable/:userId\")\n    @HttpCode(204)\n    async disableAccount(@Param(\"userId\") userId: string) {\n      try {\n        await this.service.disableAccount(userId);\n      } catch (err) {\n        rethrowAsHttp(err);\n      }\n    }\n  }\n\n  return IdentityController;\n}\n","/**\n * NestJS integration for `@azlib/identity`.\n *\n * Provides a configurable module, an authentication guard, an authorization guard driven\n * by metadata decorators, and a `@CurrentUser()` param decorator. `@nestjs/common` and\n * `reflect-metadata` are optional peer dependencies — only required when this entry is used.\n */\nimport {\n  type CanActivate,\n  type DynamicModule,\n  type ExecutionContext,\n  ForbiddenException,\n  Inject,\n  Injectable,\n  SetMetadata,\n  UnauthorizedException,\n  createParamDecorator,\n} from \"@nestjs/common\";\nimport { Reflector } from \"@nestjs/core\";\n\nimport type { AuthorizationRequirement } from \"../authorization\";\nimport type { IdentityService } from \"../identity-service\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport {\n  createIdentityController,\n  type IdentityControllerOptions,\n} from \"./identity-controller\";\n\n/** Token used to inject the configured {@link IdentityService} in Nest providers. */\nexport const IDENTITY_SERVICE = Symbol.for(\"azlib.identity.service\");\n\n/** Metadata key holding the authorization requirement for a route. */\nexport const IDENTITY_REQUIREMENT = Symbol.for(\"azlib.identity.requirement\");\n\n/**\n * Options for enabling the pre-built REST routes in {@link IdentityModule}.\n */\nexport interface IdentityRoutesOptions extends IdentityControllerOptions {\n  /**\n   * URL prefix for the built-in controller. Default: `\"auth\"`.\n   *\n   * The controller is mounted at this prefix relative to the application's global\n   * prefix (if any).\n   */\n  prefix?: string;\n}\n\nexport interface IdentityModuleOptions {\n  /** A fully wired identity service (see `createIdentityService`). */\n  service: IdentityService;\n  /**\n   * When set, the module automatically registers a built-in REST controller with all\n   * standard auth endpoints (`POST /register`, `POST /login`, `POST /refresh`,\n   * `POST /logout`, `GET /me`).\n   *\n   * Pass `true` to use the defaults (`prefix: \"auth\"`, body-mode refresh tokens), or\n   * supply an `IdentityRoutesOptions` object to customise the prefix and cookie behaviour.\n   *\n   * @example\n   * ```ts\n   * // Minimal — everything works out of the box\n   * IdentityModule.forRoot({ service, routes: true })\n   *\n   * // With a custom prefix and HttpOnly refresh-token cookie\n   * IdentityModule.forRoot({\n   *   service,\n   *   routes: { prefix: \"v1/auth\", cookie: { name: \"rt\", secure: true } },\n   * })\n   * ```\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\nexport interface IdentityModuleAsyncOptions {\n  imports?: DynamicModule[\"imports\"];\n  /** Factory returning the configured identity service. */\n  useFactory: (...args: never[]) => IdentityService | Promise<IdentityService>;\n  inject?: unknown[];\n  /**\n   * Same as {@link IdentityModuleOptions.routes} — enable built-in REST routes\n   * alongside the async service factory.\n   */\n  routes?: true | IdentityRoutesOptions;\n}\n\ninterface RequestWithIdentity {\n  headers: Record<string, string | string[] | undefined>;\n  identity?: AuthenticatedIdentity;\n}\n\nconst extractBearerToken = (req: RequestWithIdentity): string | null => {\n  const header = req.headers.authorization;\n  const value = Array.isArray(header) ? header[0] : header;\n  if (!value || !value.startsWith(\"Bearer \")) return null;\n  const token = value.slice(\"Bearer \".length).trim();\n  return token.length > 0 ? token : null;\n};\n\n/**\n * Authentication guard: verifies the Bearer access token and attaches the hydrated\n * principal to `request.identity`. Apply with `@UseGuards(IdentityAuthGuard)`.\n */\n@Injectable()\nexport class IdentityAuthGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const token = extractBearerToken(req);\n    if (!token) {\n      throw new UnauthorizedException(\"Missing bearer token.\");\n    }\n    try {\n      req.identity = await this.service.authenticate(token);\n    } catch {\n      throw new UnauthorizedException(\"Invalid or expired token.\");\n    }\n    return true;\n  }\n}\n\n/**\n * Authorization guard: enforces the requirement declared by `@RequireAuthorization()`\n * (or `@RequirePermission()`). Must run after {@link IdentityAuthGuard}. Deny-by-default.\n */\n@Injectable()\nexport class IdentityAuthorizationGuard implements CanActivate {\n  constructor(\n    @Inject(IDENTITY_SERVICE) private readonly service: IdentityService,\n    private readonly reflector: Reflector,\n  ) {}\n\n  async canActivate(context: ExecutionContext): Promise<boolean> {\n    const requirement = this.reflector.getAllAndOverride<\n      AuthorizationRequirement | undefined\n    >(IDENTITY_REQUIREMENT, [context.getHandler(), context.getClass()]);\n    // No requirement declared: nothing extra to enforce beyond authentication.\n    if (!requirement) return true;\n\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    const principal = req.identity;\n    if (!principal) {\n      throw new UnauthorizedException(\"Not authenticated.\");\n    }\n    const decision = await this.service.authorize(requirement, {\n      principal,\n      action: requirement.permission ?? \"custom\",\n    });\n    if (!decision.allowed) {\n      throw new ForbiddenException();\n    }\n    return true;\n  }\n}\n\n/** Declares the authorization requirement for a route or controller. */\nexport const RequireAuthorization = (requirement: AuthorizationRequirement) =>\n  SetMetadata(IDENTITY_REQUIREMENT, requirement);\n\n/** Convenience: declare a single required permission for a route or controller. */\nexport const RequirePermission = (permission: string) =>\n  SetMetadata(IDENTITY_REQUIREMENT, {\n    permission,\n  } satisfies AuthorizationRequirement);\n\n/** Param decorator that resolves the authenticated principal from the request. */\nexport const CurrentUser = createParamDecorator(\n  (\n    _data: unknown,\n    context: ExecutionContext,\n  ): AuthenticatedIdentity | undefined => {\n    const req = context.switchToHttp().getRequest<RequestWithIdentity>();\n    return req.identity;\n  },\n);\n\n/**\n * NestJS module exposing the identity service plus guards. Register once at the root:\n *\n * ```ts\n * IdentityModule.forRoot({ service: createIdentityService(config, store) })\n * ```\n */\nfunction buildControllers(routes: true | IdentityRoutesOptions | undefined) {\n  if (!routes) return [];\n  const routesOpts = routes === true ? {} : routes;\n  const prefix = routesOpts.prefix ?? \"auth\";\n  const controllerOpts: IdentityControllerOptions = {\n    cookie: routesOpts.cookie,\n  };\n  return [createIdentityController(prefix, controllerOpts)];\n}\n\nexport class IdentityModule {\n  static forRoot(options: IdentityModuleOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      controllers: buildControllers(options.routes),\n      providers: [\n        { provide: IDENTITY_SERVICE, useValue: options.service },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [\n        IDENTITY_SERVICE,\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n    };\n  }\n\n  static forRootAsync(options: IdentityModuleAsyncOptions): DynamicModule {\n    return {\n      module: IdentityModule,\n      global: true,\n      imports: options.imports ?? [],\n      controllers: buildControllers(options.routes),\n      providers: [\n        {\n          provide: IDENTITY_SERVICE,\n          useFactory: options.useFactory,\n          inject: options.inject as never[],\n        },\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n      exports: [\n        IDENTITY_SERVICE,\n        IdentityAuthGuard,\n        IdentityAuthorizationGuard,\n      ],\n    };\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAgCA,SAAS,kBAAkB,MAAoC;CAC7D,OAAO,KAAK,QAAQ;AACtB;AAEA,SAAS,cAAc,KAAqB;CAC1C,IAAI,eAAe,eACjB,MAAM,IAAI,cACR;EAAE,MAAM,IAAI;EAAM,SAAS,IAAI;CAAQ,GACvC,IAAI,UACN;CAEF,MAAM;AACR;AAEA,SAAS,8BACP,KACA,QACA,MAC4D;CAC5D,MAAM,SAAS,OAAO,sBAAsB,QAAQ,IAAI,KAAK,IAAI;CACjE,IAAI,OAAO,kBAAkB,IAAI,GAAG,OAAO,cAAc;EACvD,UAAU,KAAK,YAAY;EAC3B,QAAQ,KAAK,UAAU,QAAQ,IAAI,aAAa;EAChD,UAAU,KAAK,YAAY;EAC3B,MAAM,KAAK,QAAQ;EACnB,QAAQ,KAAK;EACb;CACF,CAAC;CACD,MAAM,EACJ,cAAc,KACd,uBAAuB,MACvB,GAAG,eACD;CACJ,OAAO;AACT;AAEA,SAAS,kBACP,QACA,YACA,KACA;CACA,IAAI,YAAY;EACd,MAAM,SAAS,8BACb,KACA,OAAO,QACP,UACF;EACA,OAAO;GAAE,MAAM,OAAO;GAAM;EAAO;CACrC;CACA,OAAO;AACT;AAEA,SAAS,mBACP,QACA,YACA,KACA;CACA,IAAI,cAAc,QAChB,OAAO;CAET,OAAO,kBAAkB,QAAQ,YAAY,GAAG;AAClD;AAEA,SAAS,4BACP,KACA,YACoB;CACpB,IAAI,YAEF,OADgB,IAAI,UACH,kBAAkB,UAAU;CAG/C,MAAM,QADO,IAAI,OACI;CACrB,OAAO,OAAO,UAAU,WAAW,QAAQ,KAAA;AAC7C;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CA,SAAgB,yBACd,QACA,oBAA+C,CAAC,GAChD;CACA,MAAM,aAAa,kBAAkB;CAErC,IACM,qBADN,MACM,mBAAmB;EACwB;EAA/C,YAAY,SAA6D;GAA1B,KAAA,UAAA;EAA2B;EAE1E,MACM,SACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,kBAAkB,MADJ,KAAK,QAAQ,SAAS,IAAI,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,MACJ,MACA,KACA;GACA,IAAI;IAEF,OAAO,mBAAmB,MADL,KAAK,QAAQ,MAAM,IAAI,GACV,YAAY,GAAG;GACnD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MACM,QACJ,KACA,KACA;GACA,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,CAAC,OACH,MAAM,IAAI,qBAAqB,2BAA2B;IAG5D,OAAO,kBAAkB,MADJ,KAAK,QAAQ,QAAQ,KAAK,GACd,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,OACJ,KACA,KACA;GACA,IAAI;IACF,MAAM,QAAQ,4BAA4B,KAAK,UAAU;IACzD,IAAI,OACF,MAAM,KAAK,QAAQ,OAAO,KAAK;IAEjC,IAAI,YACF,IAAI,YAAY,kBAAkB,UAAU,GAAG,EAC7C,MAAM,WAAW,QAAQ,IAC3B,CAAC;GAEL,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,KAA8C;GAClD,OAAO,IAAI;EACb;EAMA,MAGM,yBACJ,KACA;GACA,IAAI;IACF,MAAM,KAAK,QAAQ,yBAAyB,IAAI,SAAU,MAAM;GAClE,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,YAAY,MAAkC;GAClD,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,YAAY,KAAK,KAAK;GAC3C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,qBAAqB,MAAkC;GAC3D,IAAI;IACF,IAAI,CAAC,KAAK,OAAO,MAAM,IAAI,qBAAqB,oBAAoB;IACpE,MAAM,KAAK,QAAQ,qBAAqB,KAAK,KAAK;GACpD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cACJ,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,SAAS,CAAC,KAAK,aACvB,MAAM,IAAI,qBAAqB,qCAAqC;IACtE,MAAM,KAAK,QAAQ,cAAc,KAAK,OAAO,KAAK,WAAW;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MACM,mBACJ,MACA,KACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,MAC1B,MAAM,IAAI,qBAAqB,iCAAiC;IAKlE,OAAO,kBAAkB,MAJJ,KAAK,QAAQ,mBAChC,KAAK,UACL,KAAK,IACP,GACiC,YAAY,GAAG;GAClD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,SAAS,KAAyD;GACtE,IAAI;IACF,OAAO,MAAM,KAAK,QAAQ,SAAS,IAAI,SAAU,MAAM;GACzD,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,UACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,UAAU,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC9D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAGM,WACJ,KACA,MACA;GACA,IAAI;IACF,IAAI,CAAC,KAAK,MAAM,MAAM,IAAI,qBAAqB,mBAAmB;IAClE,MAAM,KAAK,QAAQ,WAAW,IAAI,SAAU,QAAQ,KAAK,IAAI;GAC/D,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAMA,MAEM,YAAY,QAAiC;GACjD,IAAI;IACF,MAAM,KAAK,QAAQ,YAAY,MAAM;GACvC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,cAAc,QAAiC;GACnD,IAAI;IACF,MAAM,KAAK,QAAQ,cAAc,MAAM;GACzC,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;EAEA,MAEM,eAAe,QAAiC;GACpD,IAAI;IACF,MAAM,KAAK,QAAQ,eAAe,MAAM;GAC1C,SAAS,KAAK;IACZ,cAAc,GAAG;GACnB;EACF;CACF;;EA9NG,KAAK,UAAU;EAEb,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,OAAO;EAEV,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAU3B,KAAK,SAAS;EAEZ,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAc3B,KAAK,QAAQ;EACb,SAAS,GAAG;EAEV,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAiB3B,IAAI,IAAI;EACR,UAAU,iBAAiB;EACrB,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQV,KAAK,4BAA4B;EACjC,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;;;;;;EASN,KAAK,cAAc;EACnB,SAAS,GAAG;EACM,gBAAA,GAAA,KAAK,CAAA;;;;;;EAavB,KAAK,wBAAwB;EAC7B,SAAS,GAAG;EACe,gBAAA,GAAA,KAAK,CAAA;;;;;;EAShC,KAAK,gBAAgB;EACrB,SAAS,GAAG;EAEV,gBAAA,GAAA,KAAK,CAAA;;;;;;EAeP,KAAK,YAAY;EAEf,gBAAA,GAAA,KAAK,CAAA;EACL,gBAAA,GAAA,IAAI,EAAE,aAAa,KAAK,CAAC,CAAA;;;;;;EAe3B,KAAK,WAAW;EAChB,UAAU,iBAAiB;EACZ,gBAAA,GAAA,IAAI,CAAA;;;;;;EAQnB,KAAK,YAAY;EACjB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAUP,KAAK,aAAa;EAClB,SAAS,GAAG;EACZ,UAAU,iBAAiB;EAEzB,gBAAA,GAAA,IAAI,CAAA;EACJ,gBAAA,GAAA,KAAK,CAAA;;;;;;EAcP,KAAK,oBAAoB;EACzB,SAAS,GAAG;EACM,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQhC,KAAK,sBAAsB;EAC3B,SAAS,GAAG;EACQ,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EAQlC,KAAK,uBAAuB;EAC5B,SAAS,GAAG;EACS,gBAAA,GAAA,MAAM,QAAQ,CAAA;;;;;;EA3NrC,WAAW,MAAM;EAEH,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;CAkOtC,OAAO;AACT;;;;;;;;;;;ACrWA,MAAa,mBAAmB,OAAO,IAAI,wBAAwB;;AAGnE,MAAa,uBAAuB,OAAO,IAAI,4BAA4B;AA0D3E,MAAM,sBAAsB,QAA4C;CACtE,MAAM,SAAS,IAAI,QAAQ;CAC3B,MAAM,QAAQ,MAAM,QAAQ,MAAM,IAAI,OAAO,KAAK;CAClD,IAAI,CAAC,SAAS,CAAC,MAAM,WAAW,SAAS,GAAG,OAAO;CACnD,MAAM,QAAQ,MAAM,MAAM,CAAgB,CAAC,CAAC,KAAK;CACjD,OAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAOO,IAAM,oBAAN,MAAM,kBAAyC;CAEP;CAD7C,YACE,SACA;EAD2C,KAAA,UAAA;CAC1C;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,MAAM,QAAQ,aAAa,CAAC,CAAC,WAAgC;EACnE,MAAM,QAAQ,mBAAmB,GAAG;EACpC,IAAI,CAAC,OACH,MAAM,IAAI,sBAAsB,uBAAuB;EAEzD,IAAI;GACF,IAAI,WAAW,MAAM,KAAK,QAAQ,aAAa,KAAK;EACtD,QAAQ;GACN,MAAM,IAAI,sBAAsB,2BAA2B;EAC7D;EACA,OAAO;CACT;AACF;;CAnBC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;AAuBrB,IAAM,6BAAN,MAAM,2BAAkD;CAEhB;CAC1B;CAFnB,YACE,SACA,WACA;EAF2C,KAAA,UAAA;EAC1B,KAAA,YAAA;CAChB;CAEH,MAAM,YAAY,SAA6C;EAC7D,MAAM,cAAc,KAAK,UAAU,kBAEjC,sBAAsB,CAAC,QAAQ,WAAW,GAAG,QAAQ,SAAS,CAAC,CAAC;EAElE,IAAI,CAAC,aAAa,OAAO;EAGzB,MAAM,YADM,QAAQ,aAAa,CAAC,CAAC,WACf,CAAC,CAAC;EACtB,IAAI,CAAC,WACH,MAAM,IAAI,sBAAsB,oBAAoB;EAMtD,IAAI,EAAC,MAJkB,KAAK,QAAQ,UAAU,aAAa;GACzD;GACA,QAAQ,YAAY,cAAc;EACpC,CAAC,EAAA,CACa,SACZ,MAAM,IAAI,mBAAmB;EAE/B,OAAO;CACT;AACF;;CA5BC,WAAW;CAGP,gBAAA,GAAA,OAAO,gBAAgB,CAAA;;;;AA4B5B,MAAa,wBAAwB,gBACnC,YAAY,sBAAsB,WAAW;;AAG/C,MAAa,qBAAqB,eAChC,YAAY,sBAAsB,EAChC,WACF,CAAoC;;AAGtC,MAAa,cAAc,sBAEvB,OACA,YACsC;CAEtC,OADY,QAAQ,aAAa,CAAC,CAAC,WAC1B,CAAC,CAAC;AACb,CACF;;;;;;;;AASA,SAAS,iBAAiB,QAAkD;CAC1E,IAAI,CAAC,QAAQ,OAAO,CAAC;CACrB,MAAM,aAAa,WAAW,OAAO,CAAC,IAAI;CAK1C,OAAO,CAAC,yBAJO,WAAW,UAAU,QAIK,EAFvC,QAAQ,WAAW,OAEiC,CAAC,CAAC;AAC1D;AAEA,IAAa,iBAAb,MAAa,eAAe;CAC1B,OAAO,QAAQ,SAA+C;EAC5D,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KAAE,SAAS;KAAkB,UAAU,QAAQ;IAAQ;IACvD;IACA;GACF;GACA,SAAS;IACP;IACA;IACA;GACF;EACF;CACF;CAEA,OAAO,aAAa,SAAoD;EACtE,OAAO;GACL,QAAQ;GACR,QAAQ;GACR,SAAS,QAAQ,WAAW,CAAC;GAC7B,aAAa,iBAAiB,QAAQ,MAAM;GAC5C,WAAW;IACT;KACE,SAAS;KACT,YAAY,QAAQ;KACpB,QAAQ,QAAQ;IAClB;IACA;IACA;GACF;GACA,SAAS;IACP;IACA;IACA;GACF;EACF;CACF;AACF"}