@burdenoff/microfe-auth 2026.1101.4 → 2026.1102.1

package/dist/auth/utils/validation.js

@@ -12,7 +12,7 @@ function t(e) {
 function n(e) {
 	return [...e].length;
 }
-var r = /^[\p{L}\p{M} '.\-\u00B7\u30FB\u200C\u200D]*\p{L}[\p{L}\p{M} '.\-\u00B7\u30FB\u200C\u200D]*$/u, i = /[\u2018\u2019\u02BC]/g, a = /[\u2010\u2011]/g;
+var r = /^[\p{L}\p{M} '.\-\u00B7\u30FB\u200C\u200D]+$/u, i = /[\u2018\u2019\u02BC]/g, a = /[\u2010\u2011]/g;
 function o(e) {
 	let t = (e ?? "").normalize("NFC").replace(i, "'").replace(a, "-").trim();
 	return n(t) < 1 ? {
@@ -23,10 +23,7 @@ function o(e) {
 		valid: !1,
 		code: "too_long",
 		message: "Name must be 100 characters or fewer"
-	} : r.test(t) ? {
-		valid: !0,
-		value: t
-	} : /\p{L}/u.test(t) ? {
+	} : !/\p{L}/u.test(t) || !r.test(t) ? /\p{L}/u.test(t) ? {
 		valid: !1,
 		code: "invalid_chars",
 		message: "Name can only contain letters, spaces, periods, hyphens, and apostrophes"
@@ -34,6 +31,9 @@ function o(e) {
 		valid: !1,
 		code: "no_letter",
 		message: "Name must contain at least one letter"
+	} : {
+		valid: !0,
+		value: t
 	};
 }
 var s = /^[a-zA-Z0-9_-]+$/;

package/dist/auth/utils/validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"validation.js","names":["validateEmail","email","validatePassword","errors","password","lengthInCodePoints","s","NAME_ALLOWED_CHARS","TYPOGRAPHIC_APOSTROPHES","TYPOGRAPHIC_HYPHENS","validateName","trimmed","name","USERNAME_ALLOWED_CHARS","validateUsername","value","username","validateUserFields","requireAll","options","isBlank","v","firstName","input","lastName","valueOr","result","fallback","validatePhoneNumber","phone","digits"],"sources":["../../../src/auth/utils/validation.ts"],"sourcesContent":["import type { PasswordStrength } from \"../types\";\n\n/**\n * Validate email format\n */\nexport function validateEmail(email: string): boolean {\n  const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n  return emailRegex.test(email);\n}\n\n/**\n * Validate password requirements\n */\nexport function validatePassword(password: string): {\n  valid: boolean;\n  errors: string[];\n} {\n  const errors: string[] = [];\n\n  if (password.length < 12) {\n    errors.push(\"Password must be at least 12 characters long\");\n  }\n\n  if (!/[A-Z]/.test(password)) {\n    errors.push(\"Password must contain at least one uppercase letter\");\n  }\n\n  if (!/[a-z]/.test(password)) {\n    errors.push(\"Password must contain at least one lowercase letter\");\n  }\n\n  if (!/[0-9]/.test(password)) {\n    errors.push(\"Password must contain at least one number\");\n  }\n\n  if (!/[!@#$%^&*(),.?\":{}|<>]/.test(password)) {\n    errors.push(\"Password must contain at least one special character\");\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors,\n  };\n}\n\n/**\n * Calculate password strength using Zxcvbn-like algorithm\n * Returns a score from 0-4 (0 = very weak, 4 = very strong)\n */\nexport function calculatePasswordStrength(password: string): PasswordStrength {\n  let score: 0 | 1 | 2 | 3 | 4 = 0;\n  const feedback: string[] = [];\n\n  // Length check\n  if (password.length >= 8) score++;\n  if (password.length >= 12) score++;\n  if (password.length >= 16) score++;\n\n  // Complexity checks\n  if (/[a-z]/.test(password) && /[A-Z]/.test(password)) score++;\n  if (/[0-9]/.test(password)) score++;\n  if (/[!@#$%^&*(),.?\":{}|<>]/.test(password)) score++;\n\n  // Common patterns\n  if (/^[a-z]+$/.test(password.toLowerCase())) {\n    feedback.push(\"Add uppercase letters, numbers, and symbols\");\n    score = Math.max(0, score - 1) as 0 | 1 | 2 | 3 | 4;\n  }\n\n  if (/^[0-9]+$/.test(password)) {\n    feedback.push(\"Avoid using only numbers\");\n    score = 0;\n  }\n\n  if (/(.)\\1{2,}/.test(password)) {\n    feedback.push(\"Avoid repeating characters\");\n    score = Math.max(0, score - 1) as 0 | 1 | 2 | 3 | 4;\n  }\n\n  // Common passwords\n  const commonPasswords = [\"password\", \"123456\", \"qwerty\", \"admin\", \"letmein\"];\n  if (commonPasswords.some((p) => password.toLowerCase().includes(p))) {\n    feedback.push(\"Avoid using common passwords\");\n    score = 0;\n  }\n\n  // Ensure score is 0-4\n  score = Math.min(4, Math.max(0, score)) as 0 | 1 | 2 | 3 | 4;\n\n  // Crack time estimation\n  const crackTime =\n    score === 0\n      ? \"less than 1 second\"\n      : score === 1\n        ? \"less than 1 minute\"\n        : score === 2\n          ? \"less than 1 hour\"\n          : score === 3\n            ? \"less than 1 day\"\n            : \"centuries\";\n\n  return { score, feedback, crackTime };\n}\n\n/**\n * Validate MFA code format (6 digits)\n */\nexport function validateMfaCode(code: string): boolean {\n  return /^\\d{6}$/.test(code);\n}\n\n/**\n * Validate API key name\n */\nexport function validateApiKeyName(name: string): {\n  valid: boolean;\n  error?: string;\n} {\n  if (!name || name.trim().length === 0) {\n    return { valid: false, error: \"API key name is required\" };\n  }\n\n  if (name.length > 100) {\n    return {\n      valid: false,\n      error: \"API key name must be less than 100 characters\",\n    };\n  }\n\n  return { valid: true };\n}\n/**\n * Minimum/maximum lengths for a person's name (first or last), measured in\n * Unicode code points (NOT JavaScript `.length`, which counts UTF-16 code\n * units — see `lengthInCodePoints`).\n *\n * Picked to stay well under the 255-char Prisma `User.firstName/lastName`\n * columns with headroom.\n */\nconst NAME_MIN_LENGTH = 1;\nconst NAME_MAX_LENGTH = 100;\n\n/**\n * Count Unicode code points in `s` instead of UTF-16 code units. Names\n * written in scripts that live in the supplementary plane (Adlam 𞤁𞤔𞤣,\n * many CJK extensions, etc.) have each letter encoded as two UTF-16 units,\n * so a 51-letter Adlam name would otherwise be miscounted as 102 and\n * rejected as too long (Codex P2 review).\n *\n * Code-point counting is sufficient for the name validator — grapheme-\n * cluster counting would also handle emoji ZWJ sequences, but the name\n * regex already disallows emoji.\n */\nfunction lengthInCodePoints(s: string): number {\n  return [...s].length;\n}\n\n/**\n * Regex for an acceptable name. Must contain at least one letter (so \"12345\",\n * \"12 34\", \"---\" all fail). Every character must be a letter, mark, literal\n * space, hyphen, apostrophe, period, middle-dot, or join control —\n * diacritics-friendly across scripts (Latin, Tamil, Chinese, etc.).\n *\n * Note: a literal space, not `\\s` — `\\s` matches tabs/newlines/other Unicode\n * whitespace which has no business being inside a person's name (review #2).\n *\n * Two middle-dot codepoints are allowed as-is, NOT folded to `.` — they're\n * orthographically distinct and silently rewriting the user's name would\n * corrupt their identity (Codex P2 reviews):\n *   U+00B7 — middle dot, used in Catalan (`Joan·Maria`), Chinese\n *            (`阿布杜拉·阿扎姆`), and Russian.\n *   U+30FB — katakana middle dot, the standard Japanese separator for\n *            foreign personal names (`ジョン・スミス`).\n *\n * Zero-width join controls are also allowed as-is:\n *   U+200C ZERO WIDTH NON-JOINER — required for Persian compound names\n *           like `محمد‌رضا` so the letters don't ligate.\n *   U+200D ZERO WIDTH JOINER — used in some Indic scripts and emoji\n *           sequences (we don't allow emoji ZWJ, but the codepoint is\n *           accepted as a generic join marker).\n *\n * Typographic apostrophes (U+2018 / U+2019) and modifier letter apostrophe\n * (U+02BC), and typographic hyphens (U+2010 / U+2011), ARE folded to their\n * ASCII equivalents before validation — they're typographic variants of the\n * same character, not semantically distinct (Codex P2 review).\n *\n * BOFF-7214.\n */\nconst NAME_ALLOWED_CHARS =\n  /^[\\p{L}\\p{M} '.\\-\\u00B7\\u30FB\\u200C\\u200D]*\\p{L}[\\p{L}\\p{M} '.\\-\\u00B7\\u30FB\\u200C\\u200D]*$/u;\nconst TYPOGRAPHIC_APOSTROPHES = /[\\u2018\\u2019\\u02BC]/g;\nconst TYPOGRAPHIC_HYPHENS = /[\\u2010\\u2011]/g;\n\n/**\n * Machine-readable name-validation error codes. The caller maps each code\n * to a distinct i18n key (review #1) so that one validator error doesn't\n * collapse N different messages into one translated string.\n */\nexport type NameErrorCode =\n  | \"required\"\n  | \"too_long\"\n  | \"no_letter\"\n  | \"invalid_chars\";\n\nexport type NameValidationResult =\n  | { valid: true; value: string }\n  | { valid: false; code: NameErrorCode; message: string };\n\n/**\n * Validate a person's name (first or last).\n * Accepts `string | undefined | null` because the signup form types name\n * fields as optional (matching the `SignUpInput` contract); an absent value\n * is treated as \"missing\" and fails the validation.\n * On success the result carries the canonicalised `value` (trimmed, with\n * typographic apostrophes folded to ASCII) so the caller can submit the\n * exact same string the validator approved — otherwise the validated\n * string and the value sent to `signUp()` would diverge (e.g. user types\n * `\"  O'Connor  \"`, validator normalises to `\"O'Connor\"`, but signUp\n * receives the original raw value).\n * Returns a structured result so the caller can decide how to render errors.\n */\nexport function validateName(\n  name: string | undefined | null,\n): NameValidationResult {\n  // Normalise typographic apostrophes and hyphens to their ASCII\n  // equivalents before testing — these are typographic variants of the\n  // same character, so the canonical ASCII form is what reaches the DB.\n  // (Middle-dot U+00B7 is preserved as-is: see NAME_ALLOWED_CHARS comment.)\n  // NFC normalisation happens before trim/length so combining-mark\n  // sequences (e.g. `e\\u0301` for `é`) fold to their precomposed\n  // form first — otherwise `(\"e\\u0301\").repeat(51)` would over-count\n  // to 102 code points and reject a valid 51-character name (Codex P2).\n  const trimmed = (name ?? \"\")\n    .normalize(\"NFC\")\n    .replace(TYPOGRAPHIC_APOSTROPHES, \"'\")\n    .replace(TYPOGRAPHIC_HYPHENS, \"-\")\n    .trim();\n\n  if (lengthInCodePoints(trimmed) < NAME_MIN_LENGTH) {\n    return { valid: false, code: \"required\", message: \"Name is required\" };\n  }\n\n  if (lengthInCodePoints(trimmed) > NAME_MAX_LENGTH) {\n    return {\n      valid: false,\n      code: \"too_long\",\n      message: `Name must be ${NAME_MAX_LENGTH} characters or fewer`,\n    };\n  }\n\n  if (!NAME_ALLOWED_CHARS.test(trimmed)) {\n    // The combined regex distinguishes the two failure modes that matter\n    // to the user: a value with no letters vs. a value with disallowed\n    // characters. Surface the right hint for each.\n    if (!/\\p{L}/u.test(trimmed)) {\n      return {\n        valid: false,\n        code: \"no_letter\",\n        message: \"Name must contain at least one letter\",\n      };\n    }\n    return {\n      valid: false,\n      code: \"invalid_chars\",\n      message:\n        \"Name can only contain letters, spaces, periods, hyphens, and apostrophes\",\n    };\n  }\n\n  return { valid: true, value: trimmed };\n}\n\n/**\n * Regex for characters allowed in a username. Letters, digits, underscores,\n * hyphens — the existing rule. The new rule layered on top (BOFF-7214):\n * a username must contain at least one letter, so an attacker cannot create\n * an account like \"12345\" with a throwaway email.\n */\nconst USERNAME_ALLOWED_CHARS = /^[a-zA-Z0-9_-]+$/;\nconst USERNAME_MIN_LENGTH = 3;\nconst USERNAME_MAX_LENGTH = 30;\n/**\n * Machine-readable username-validation error codes — one per failing rule\n * (review #1) so each can map to its own i18n key.\n */\nexport type UsernameErrorCode =\n  | \"required\"\n  | \"too_short\"\n  | \"too_long\"\n  | \"invalid_chars\"\n  | \"no_letter\";\n\nexport type UsernameValidationResult =\n  | { valid: true; value: string }\n  | {\n      valid: false;\n      errors: Array<{ code: UsernameErrorCode; message: string }>;\n    };\n\n/**\n * Validate a username.\n * Accepts `string | undefined | null` for parity with `validateName` and the\n * optional `SignUpInput.username` contract.\n *\n * Surrounding whitespace is trimmed before the length / character checks —\n * a pasted `\" alice_01 \"` would otherwise fail with a misleading\n * \"can only contain letters, numbers, underscores, and hyphens\" error\n * when the actual problem is invisible whitespace. On success the result\n * carries the trimmed `value` so the caller submits the same string the\n * validator approved (Claude LOW review).\n * Returns a structured result with a list of errors so the caller can\n * render every failing rule at once (mirrors `validatePassword`).\n */\nexport function validateUsername(\n  username: string | undefined | null,\n): UsernameValidationResult {\n  const errors: Array<{ code: UsernameErrorCode; message: string }> = [];\n  const value = (username ?? \"\").trim();\n\n  if (lengthInCodePoints(value) === 0) {\n    errors.push({\n      code: \"required\",\n      message: \"Username is required\",\n    });\n  } else {\n    if (lengthInCodePoints(value) < USERNAME_MIN_LENGTH) {\n      errors.push({\n        code: \"too_short\",\n        message: `Username must be at least ${USERNAME_MIN_LENGTH} characters`,\n      });\n    }\n\n    if (lengthInCodePoints(value) > USERNAME_MAX_LENGTH) {\n      errors.push({\n        code: \"too_long\",\n        message: `Username must be ${USERNAME_MAX_LENGTH} characters or fewer`,\n      });\n    }\n\n    if (!USERNAME_ALLOWED_CHARS.test(value)) {\n      errors.push({\n        code: \"invalid_chars\",\n        message:\n          \"Username can only contain letters, numbers, underscores, and hyphens\",\n      });\n    }\n\n    // Must contain at least one letter — guards against all-numeric or\n    // all-symbol usernames slipping through. Pure numeric values like\n    // \"12345\" previously passed the character allow-list alone.\n    if (\n      lengthInCodePoints(value) >= USERNAME_MIN_LENGTH &&\n      !/[a-zA-Z]/.test(value)\n    ) {\n      errors.push({\n        code: \"no_letter\",\n        message: \"Username must contain at least one letter\",\n      });\n    }\n  }\n\n  return errors.length === 0\n    ? { valid: true, value }\n    : { valid: false, errors };\n}\n\n/**\n * Bundle validation across all three user-identity fields so callers\n * (RegisterPage, UserProfilePage, UsersPage) can fail fast on the whole\n * form instead of piecemeal — and so the BOFF-7214 invariant\n * (firstName / lastName contain a letter; username contains a letter)\n * is enforced at every mutation surface, not just signup.\n *\n * On success, the result carries the canonicalised values from each\n * individual validator so the caller submits the same strings the\n * validators approved (no validate/submit divergence).\n *\n * The caller is responsible for mapping each `{ field, code, message }`\n * error to its own i18n key — different surfaces have different key\n * namespaces (`auth.register.*`, `auth.profile.*`, `auth.users.*`).\n */\nexport type UserFieldKey = \"firstName\" | \"lastName\" | \"username\";\n\nexport interface UserFieldError {\n  field: UserFieldKey;\n  code: string;\n  message: string;\n}\n\nexport interface ValidatedUserFields {\n  firstName: string;\n  lastName: string;\n  username: string;\n}\n\nexport type UserFieldsValidationResult =\n  | { valid: true; values: ValidatedUserFields }\n  | { valid: false; errors: UserFieldError[] };\n\nexport function validateUserFields(\n  input: {\n    firstName?: string | null;\n    lastName?: string | null;\n    username?: string | null;\n  },\n  options: { requireAll?: boolean } = {},\n): UserFieldsValidationResult {\n  // Default to requiring every field. Profile-edit surfaces pass\n  // `requireAll: false` so an existing user whose optional firstName /\n  // lastName is unset (e.g. provisioned via an identity provider) can\n  // still update unrelated fields like phone or role (Codex P2 review).\n  const requireAll = options.requireAll ?? true;\n  const errors: UserFieldError[] = [];\n\n  // Skip the validator entirely when a field is empty AND requireAll is\n  // false — that means \"user is leaving this field blank\". The signup\n  // form always requires every field; profile edit does not.\n  const isBlank = (v: string | null | undefined): boolean =>\n    !v || v.trim().length === 0;\n\n  const firstName =\n    !isBlank(input.firstName) || requireAll\n      ? validateName(input.firstName)\n      : null;\n  if (firstName && !firstName.valid) {\n    errors.push({\n      field: \"firstName\",\n      code: firstName.code,\n      message: firstName.message,\n    });\n  }\n\n  const lastName =\n    !isBlank(input.lastName) || requireAll\n      ? validateName(input.lastName)\n      : null;\n  if (lastName && !lastName.valid) {\n    errors.push({\n      field: \"lastName\",\n      code: lastName.code,\n      message: lastName.message,\n    });\n  }\n\n  const username =\n    !isBlank(input.username) || requireAll\n      ? validateUsername(input.username)\n      : null;\n  if (username && !username.valid) {\n    for (const e of username.errors) {\n      errors.push({ field: \"username\", code: e.code, message: e.message });\n    }\n  }\n\n  if (errors.length > 0) return { valid: false, errors };\n\n  // Return canonical values: trimmed/NFC-normalised when validated, the\n  // original trimmed value when the field was optional and left blank.\n  // The cast is sound because the `errors.length > 0` early-return above\n  // guarantees each result, when non-null, is the `{ valid: true }` arm.\n  const valueOr = (\n    result: { valid: true; value: string } | null,\n    fallback: string | null | undefined,\n  ): string => (result ? result.value : (fallback ?? \"\").trim());\n\n  return {\n    valid: true,\n    values: {\n      firstName: valueOr(\n        firstName as { valid: true; value: string } | null,\n        input.firstName,\n      ),\n      lastName: valueOr(\n        lastName as { valid: true; value: string } | null,\n        input.lastName,\n      ),\n      username: valueOr(\n        username as { valid: true; value: string } | null,\n        input.username,\n      ),\n    },\n  };\n}\n\n/**\n * Validate a phone number (BOFF-7216).\n *\n * Phone numbers are optional on profile / admin edit forms — an empty input\n * is accepted. When a value is supplied it must:\n *   - contain only digits, spaces, and the formatting characters + - ( )\n *   - include 7–15 digits (E.164-style length bounds; we don't strip \"+\"\n *     country prefix here, we just count digits)\n *   - start with +, a digit, or (\n *\n * Returns `{ valid: true }` on an empty / whitespace-only input.\n * Returns `{ valid: false, error }` with a human-readable message on\n * rejection. The message is intentionally plain English so the caller can\n * either display it verbatim or pipe it through `tr()` with an i18n key.\n */\nexport function validatePhoneNumber(phone: string): {\n  valid: boolean;\n  error?: string;\n} {\n  const trimmed = phone.trim();\n\n  if (trimmed.length === 0) {\n    return { valid: true };\n  }\n\n  if (!/^[0-9+\\-() ]+$/.test(trimmed)) {\n    return {\n      valid: false,\n      error:\n        \"Phone number can only contain digits, spaces, and the characters + - ( )\",\n    };\n  }\n\n  const digits = trimmed.replace(/[^\\d]/g, \"\");\n  if (digits.length < 7) {\n    return { valid: false, error: \"Phone number is too short\" };\n  }\n\n  if (digits.length > 15) {\n    return { valid: false, error: \"Phone number is too long\" };\n  }\n\n  if (!/^[+\\d(]/.test(trimmed)) {\n    return {\n      valid: false,\n      error: \"Phone number must start with +, a digit, or (\",\n    };\n  }\n\n  return { valid: true };\n}\n"],"mappings":";AAKA,SAAgBA,EAAc,GAAwB;CAEpD,OAAO,6BAAW,KAAKC,CAAK;AAC9B;AAKA,SAAgBC,EAAiB,GAG/B;CACA,IAAMC,IAAmB,CAAC;CAsB1B,OApBIC,EAAS,SAAS,MACpBD,EAAO,KAAK,8CAA8C,GAGvD,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,qDAAqD,GAG9D,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,qDAAqD,GAG9D,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,2CAA2C,GAGpD,yBAAyB,KAAKC,CAAQ,KACzCD,EAAO,KAAK,sDAAsD,GAG7D;EACL,OAAOA,EAAO,WAAW;EACzB;CACF;AACF;AA8GA,SAASE,EAAmB,GAAmB;CAC7C,OAAO,CAAC,GAAGC,CAAC,CAAC,CAAC;AAChB;AAiCA,IAAMC,IACJ,gGACIC,IAA0B,yBAC1BC,IAAsB;AA8B5B,SAAgBC,EACd,GACsB;CAStB,IAAMC,KAAWC,KAAQ,GAAA,CACtB,UAAU,KAAK,CAAC,CAChB,QAAQJ,GAAyB,GAAG,CAAC,CACrC,QAAQC,GAAqB,GAAG,CAAC,CACjC,KAAK;CAiCR,OA/BIJ,EAAmBM,CAAO,IAAI,IACzB;EAAE,OAAO;EAAO,MAAM;EAAY,SAAS;CAAmB,IAGnEN,EAAmBM,CAAO,IAAI,MACzB;EACL,OAAO;EACP,MAAM;EACN,SAAS;CACX,IAGGJ,EAAmB,KAAKI,CAAO,IAmB7B;EAAE,OAAO;EAAM,OAAOA;CAAQ,IAf9B,SAAS,KAAKA,CAAO,IAOnB;EACL,OAAO;EACP,MAAM;EACN,SACE;CACJ,IAXS;EACL,OAAO;EACP,MAAM;EACN,SAAS;CACX;AAWN;AAQA,IAAME,IAAyB;AAmC/B,SAAgBC,EACd,GAC0B;CAC1B,IAAMX,IAA8D,CAAC,GAC/DY,KAASC,KAAY,GAAA,CAAI,KAAK;CA4CpC,OA1CIX,EAAmBU,CAAK,MAAM,IAChCZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,KAEGE,EAAmBU,CAAK,IAAI,KAC9BZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,GAGCE,EAAmBU,CAAK,IAAI,MAC9BZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,GAGEU,EAAuB,KAAKE,CAAK,KACpCZ,EAAO,KAAK;EACV,MAAM;EACN,SACE;CACJ,CAAC,GAODE,EAAmBU,CAAK,KAAK,KAC7B,CAAC,WAAW,KAAKA,CAAK,KAEtBZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,IAIEA,EAAO,WAAW,IACrB;EAAE,OAAO;EAAM;CAAM,IACrB;EAAE,OAAO;EAAO;CAAO;AAC7B;AAmCA,SAAgBc,EACd,GAKA,IAAoC,CAAC,GACT;CAK5B,IAAMC,IAAaC,EAAQ,cAAc,IACnChB,IAA2B,CAAC,GAK5BiB,KAAW,MACf,CAACC,KAAKA,EAAE,KAAK,CAAC,CAAC,WAAW,GAEtBC,IACJ,CAACF,EAAQG,EAAM,SAAS,KAAKL,IACzBR,EAAaa,EAAM,SAAS,IAC5B;CACN,AAAID,KAAa,CAACA,EAAU,SAC1BnB,EAAO,KAAK;EACV,OAAO;EACP,MAAMmB,EAAU;EAChB,SAASA,EAAU;CACrB,CAAC;CAGH,IAAME,IACJ,CAACJ,EAAQG,EAAM,QAAQ,KAAKL,IACxBR,EAAaa,EAAM,QAAQ,IAC3B;CACN,AAAIC,KAAY,CAACA,EAAS,SACxBrB,EAAO,KAAK;EACV,OAAO;EACP,MAAMqB,EAAS;EACf,SAASA,EAAS;CACpB,CAAC;CAGH,IAAMR,IACJ,CAACI,EAAQG,EAAM,QAAQ,KAAKL,IACxBJ,EAAiBS,EAAM,QAAQ,IAC/B;CACN,IAAIP,KAAY,CAACA,EAAS,OACxB,KAAK,IAAM,KAAKA,EAAS,QACvB,EAAO,KAAK;EAAE,OAAO;EAAY,MAAM,EAAE;EAAM,SAAS,EAAE;CAAQ,CAAC;CAIvE,IAAIb,EAAO,SAAS,GAAG,OAAO;EAAE,OAAO;EAAO;CAAO;CAMrD,IAAMsB,KACJ,GACA,MACYC,IAASA,EAAO,SAASC,KAAY,GAAA,CAAI,KAAK;CAE5D,OAAO;EACL,OAAO;EACP,QAAQ;GACN,WAAWF,EACTH,GACAC,EAAM,SACR;GACA,UAAUE,EACRD,GACAD,EAAM,QACR;GACA,UAAUE,EACRT,GACAO,EAAM,QACR;EACF;CACF;AACF;AAiBA,SAAgBK,EAAoB,GAGlC;CACA,IAAMjB,IAAUkB,EAAM,KAAK;CAE3B,IAAIlB,EAAQ,WAAW,GACrB,OAAO,EAAE,OAAO,GAAK;CAGvB,IAAI,CAAC,iBAAiB,KAAKA,CAAO,GAChC,OAAO;EACL,OAAO;EACP,OACE;CACJ;CAGF,IAAMmB,IAASnB,EAAQ,QAAQ,UAAU,EAAE;CAgB3C,OAfImB,EAAO,SAAS,IACX;EAAE,OAAO;EAAO,OAAO;CAA4B,IAGxDA,EAAO,SAAS,KACX;EAAE,OAAO;EAAO,OAAO;CAA2B,IAGtD,UAAU,KAAKnB,CAAO,IAOpB,EAAE,OAAO,GAAK,IANZ;EACL,OAAO;EACP,OAAO;CACT;AAIJ"}
+{"version":3,"file":"validation.js","names":["validateEmail","email","validatePassword","errors","password","lengthInCodePoints","s","NAME_ALLOWED_CHARS","TYPOGRAPHIC_APOSTROPHES","TYPOGRAPHIC_HYPHENS","validateName","trimmed","name","USERNAME_ALLOWED_CHARS","validateUsername","value","username","validateUserFields","requireAll","options","isBlank","v","firstName","input","lastName","valueOr","result","fallback","validatePhoneNumber","phone","digits"],"sources":["../../../src/auth/utils/validation.ts"],"sourcesContent":["import type { PasswordStrength } from \"../types\";\n\n/**\n * Validate email format\n */\nexport function validateEmail(email: string): boolean {\n  const emailRegex = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/;\n  return emailRegex.test(email);\n}\n\n/**\n * Validate password requirements\n */\nexport function validatePassword(password: string): {\n  valid: boolean;\n  errors: string[];\n} {\n  const errors: string[] = [];\n\n  if (password.length < 12) {\n    errors.push(\"Password must be at least 12 characters long\");\n  }\n\n  if (!/[A-Z]/.test(password)) {\n    errors.push(\"Password must contain at least one uppercase letter\");\n  }\n\n  if (!/[a-z]/.test(password)) {\n    errors.push(\"Password must contain at least one lowercase letter\");\n  }\n\n  if (!/[0-9]/.test(password)) {\n    errors.push(\"Password must contain at least one number\");\n  }\n\n  if (!/[!@#$%^&*(),.?\":{}|<>]/.test(password)) {\n    errors.push(\"Password must contain at least one special character\");\n  }\n\n  return {\n    valid: errors.length === 0,\n    errors,\n  };\n}\n\n/**\n * Calculate password strength using Zxcvbn-like algorithm\n * Returns a score from 0-4 (0 = very weak, 4 = very strong)\n */\nexport function calculatePasswordStrength(password: string): PasswordStrength {\n  let score: 0 | 1 | 2 | 3 | 4 = 0;\n  const feedback: string[] = [];\n\n  // Length check\n  if (password.length >= 8) score++;\n  if (password.length >= 12) score++;\n  if (password.length >= 16) score++;\n\n  // Complexity checks\n  if (/[a-z]/.test(password) && /[A-Z]/.test(password)) score++;\n  if (/[0-9]/.test(password)) score++;\n  if (/[!@#$%^&*(),.?\":{}|<>]/.test(password)) score++;\n\n  // Common patterns\n  if (/^[a-z]+$/.test(password.toLowerCase())) {\n    feedback.push(\"Add uppercase letters, numbers, and symbols\");\n    score = Math.max(0, score - 1) as 0 | 1 | 2 | 3 | 4;\n  }\n\n  if (/^[0-9]+$/.test(password)) {\n    feedback.push(\"Avoid using only numbers\");\n    score = 0;\n  }\n\n  if (/(.)\\1{2,}/.test(password)) {\n    feedback.push(\"Avoid repeating characters\");\n    score = Math.max(0, score - 1) as 0 | 1 | 2 | 3 | 4;\n  }\n\n  // Common passwords\n  const commonPasswords = [\"password\", \"123456\", \"qwerty\", \"admin\", \"letmein\"];\n  if (commonPasswords.some((p) => password.toLowerCase().includes(p))) {\n    feedback.push(\"Avoid using common passwords\");\n    score = 0;\n  }\n\n  // Ensure score is 0-4\n  score = Math.min(4, Math.max(0, score)) as 0 | 1 | 2 | 3 | 4;\n\n  // Crack time estimation\n  const crackTime =\n    score === 0\n      ? \"less than 1 second\"\n      : score === 1\n        ? \"less than 1 minute\"\n        : score === 2\n          ? \"less than 1 hour\"\n          : score === 3\n            ? \"less than 1 day\"\n            : \"centuries\";\n\n  return { score, feedback, crackTime };\n}\n\n/**\n * Validate MFA code format (6 digits)\n */\nexport function validateMfaCode(code: string): boolean {\n  return /^\\d{6}$/.test(code);\n}\n\n/**\n * Validate API key name\n */\nexport function validateApiKeyName(name: string): {\n  valid: boolean;\n  error?: string;\n} {\n  if (!name || name.trim().length === 0) {\n    return { valid: false, error: \"API key name is required\" };\n  }\n\n  if (name.length > 100) {\n    return {\n      valid: false,\n      error: \"API key name must be less than 100 characters\",\n    };\n  }\n\n  return { valid: true };\n}\n/**\n * Minimum/maximum lengths for a person's name (first or last), measured in\n * Unicode code points (NOT JavaScript `.length`, which counts UTF-16 code\n * units — see `lengthInCodePoints`).\n *\n * Picked to stay well under the 255-char Prisma `User.firstName/lastName`\n * columns with headroom.\n */\nconst NAME_MIN_LENGTH = 1;\nconst NAME_MAX_LENGTH = 100;\n\n/**\n * Count Unicode code points in `s` instead of UTF-16 code units. Names\n * written in scripts that live in the supplementary plane (Adlam 𞤁𞤔𞤣,\n * many CJK extensions, etc.) have each letter encoded as two UTF-16 units,\n * so a 51-letter Adlam name would otherwise be miscounted as 102 and\n * rejected as too long (Codex P2 review).\n *\n * Code-point counting is sufficient for the name validator — grapheme-\n * cluster counting would also handle emoji ZWJ sequences, but the name\n * regex already disallows emoji.\n */\nfunction lengthInCodePoints(s: string): number {\n  return [...s].length;\n}\n\n/**\n * Allowed-character regex; a separate letter check rejects \"12345\",\n * \"12 34\", and \"---\" without overlapping repetitions (BOFF-8547).\n * Every character must be a letter, mark, literal\n * space, hyphen, apostrophe, period, middle-dot, or join control —\n * diacritics-friendly across scripts (Latin, Tamil, Chinese, etc.).\n *\n * Note: a literal space, not `\\s` — `\\s` matches tabs/newlines/other Unicode\n * whitespace which has no business being inside a person's name (review #2).\n *\n * Two middle-dot codepoints are allowed as-is, NOT folded to `.` — they're\n * orthographically distinct and silently rewriting the user's name would\n * corrupt their identity (Codex P2 reviews):\n *   U+00B7 — middle dot, used in Catalan (`Joan·Maria`), Chinese\n *            (`阿布杜拉·阿扎姆`), and Russian.\n *   U+30FB — katakana middle dot, the standard Japanese separator for\n *            foreign personal names (`ジョン・スミス`).\n *\n * Zero-width join controls are also allowed as-is:\n *   U+200C ZERO WIDTH NON-JOINER — required for Persian compound names\n *           like `محمد‌رضا` so the letters don't ligate.\n *   U+200D ZERO WIDTH JOINER — used in some Indic scripts and emoji\n *           sequences (we don't allow emoji ZWJ, but the codepoint is\n *           accepted as a generic join marker).\n *\n * Typographic apostrophes (U+2018 / U+2019) and modifier letter apostrophe\n * (U+02BC), and typographic hyphens (U+2010 / U+2011), ARE folded to their\n * ASCII equivalents before validation — they're typographic variants of the\n * same character, not semantically distinct (Codex P2 review).\n *\n * BOFF-7214.\n */\nconst NAME_ALLOWED_CHARS = /^[\\p{L}\\p{M} '.\\-\\u00B7\\u30FB\\u200C\\u200D]+$/u;\nconst TYPOGRAPHIC_APOSTROPHES = /[\\u2018\\u2019\\u02BC]/g;\nconst TYPOGRAPHIC_HYPHENS = /[\\u2010\\u2011]/g;\n\n/**\n * Machine-readable name-validation error codes. The caller maps each code\n * to a distinct i18n key (review #1) so that one validator error doesn't\n * collapse N different messages into one translated string.\n */\nexport type NameErrorCode =\n  | \"required\"\n  | \"too_long\"\n  | \"no_letter\"\n  | \"invalid_chars\";\n\nexport type NameValidationResult =\n  | { valid: true; value: string }\n  | { valid: false; code: NameErrorCode; message: string };\n\n/**\n * Validate a person's name (first or last).\n * Accepts `string | undefined | null` because the signup form types name\n * fields as optional (matching the `SignUpInput` contract); an absent value\n * is treated as \"missing\" and fails the validation.\n * On success the result carries the canonicalised `value` (trimmed, with\n * typographic apostrophes folded to ASCII) so the caller can submit the\n * exact same string the validator approved — otherwise the validated\n * string and the value sent to `signUp()` would diverge (e.g. user types\n * `\"  O'Connor  \"`, validator normalises to `\"O'Connor\"`, but signUp\n * receives the original raw value).\n * Returns a structured result so the caller can decide how to render errors.\n */\nexport function validateName(\n  name: string | undefined | null,\n): NameValidationResult {\n  // Normalise typographic apostrophes and hyphens to their ASCII\n  // equivalents before testing — these are typographic variants of the\n  // same character, so the canonical ASCII form is what reaches the DB.\n  // (Middle-dot U+00B7 is preserved as-is: see NAME_ALLOWED_CHARS comment.)\n  // NFC normalisation happens before trim/length so combining-mark\n  // sequences (e.g. `e\\u0301` for `é`) fold to their precomposed\n  // form first — otherwise `(\"e\\u0301\").repeat(51)` would over-count\n  // to 102 code points and reject a valid 51-character name (Codex P2).\n  const trimmed = (name ?? \"\")\n    .normalize(\"NFC\")\n    .replace(TYPOGRAPHIC_APOSTROPHES, \"'\")\n    .replace(TYPOGRAPHIC_HYPHENS, \"-\")\n    .trim();\n\n  if (lengthInCodePoints(trimmed) < NAME_MIN_LENGTH) {\n    return { valid: false, code: \"required\", message: \"Name is required\" };\n  }\n\n  if (lengthInCodePoints(trimmed) > NAME_MAX_LENGTH) {\n    return {\n      valid: false,\n      code: \"too_long\",\n      message: `Name must be ${NAME_MAX_LENGTH} characters or fewer`,\n    };\n  }\n\n  if (!/\\p{L}/u.test(trimmed) || !NAME_ALLOWED_CHARS.test(trimmed)) {\n    // Independent linear scans distinguish the two failure modes that matter\n    // to the user: a value with no letters vs. a value with disallowed\n    // characters. Surface the right hint for each.\n    if (!/\\p{L}/u.test(trimmed)) {\n      return {\n        valid: false,\n        code: \"no_letter\",\n        message: \"Name must contain at least one letter\",\n      };\n    }\n    return {\n      valid: false,\n      code: \"invalid_chars\",\n      message:\n        \"Name can only contain letters, spaces, periods, hyphens, and apostrophes\",\n    };\n  }\n\n  return { valid: true, value: trimmed };\n}\n\n/**\n * Regex for characters allowed in a username. Letters, digits, underscores,\n * hyphens — the existing rule. The new rule layered on top (BOFF-7214):\n * a username must contain at least one letter, so an attacker cannot create\n * an account like \"12345\" with a throwaway email.\n */\nconst USERNAME_ALLOWED_CHARS = /^[a-zA-Z0-9_-]+$/;\nconst USERNAME_MIN_LENGTH = 3;\nconst USERNAME_MAX_LENGTH = 30;\n/**\n * Machine-readable username-validation error codes — one per failing rule\n * (review #1) so each can map to its own i18n key.\n */\nexport type UsernameErrorCode =\n  | \"required\"\n  | \"too_short\"\n  | \"too_long\"\n  | \"invalid_chars\"\n  | \"no_letter\";\n\nexport type UsernameValidationResult =\n  | { valid: true; value: string }\n  | {\n      valid: false;\n      errors: Array<{ code: UsernameErrorCode; message: string }>;\n    };\n\n/**\n * Validate a username.\n * Accepts `string | undefined | null` for parity with `validateName` and the\n * optional `SignUpInput.username` contract.\n *\n * Surrounding whitespace is trimmed before the length / character checks —\n * a pasted `\" alice_01 \"` would otherwise fail with a misleading\n * \"can only contain letters, numbers, underscores, and hyphens\" error\n * when the actual problem is invisible whitespace. On success the result\n * carries the trimmed `value` so the caller submits the same string the\n * validator approved (Claude LOW review).\n * Returns a structured result with a list of errors so the caller can\n * render every failing rule at once (mirrors `validatePassword`).\n */\nexport function validateUsername(\n  username: string | undefined | null,\n): UsernameValidationResult {\n  const errors: Array<{ code: UsernameErrorCode; message: string }> = [];\n  const value = (username ?? \"\").trim();\n\n  if (lengthInCodePoints(value) === 0) {\n    errors.push({\n      code: \"required\",\n      message: \"Username is required\",\n    });\n  } else {\n    if (lengthInCodePoints(value) < USERNAME_MIN_LENGTH) {\n      errors.push({\n        code: \"too_short\",\n        message: `Username must be at least ${USERNAME_MIN_LENGTH} characters`,\n      });\n    }\n\n    if (lengthInCodePoints(value) > USERNAME_MAX_LENGTH) {\n      errors.push({\n        code: \"too_long\",\n        message: `Username must be ${USERNAME_MAX_LENGTH} characters or fewer`,\n      });\n    }\n\n    if (!USERNAME_ALLOWED_CHARS.test(value)) {\n      errors.push({\n        code: \"invalid_chars\",\n        message:\n          \"Username can only contain letters, numbers, underscores, and hyphens\",\n      });\n    }\n\n    // Must contain at least one letter — guards against all-numeric or\n    // all-symbol usernames slipping through. Pure numeric values like\n    // \"12345\" previously passed the character allow-list alone.\n    if (\n      lengthInCodePoints(value) >= USERNAME_MIN_LENGTH &&\n      !/[a-zA-Z]/.test(value)\n    ) {\n      errors.push({\n        code: \"no_letter\",\n        message: \"Username must contain at least one letter\",\n      });\n    }\n  }\n\n  return errors.length === 0\n    ? { valid: true, value }\n    : { valid: false, errors };\n}\n\n/**\n * Bundle validation across all three user-identity fields so callers\n * (RegisterPage, UserProfilePage, UsersPage) can fail fast on the whole\n * form instead of piecemeal — and so the BOFF-7214 invariant\n * (firstName / lastName contain a letter; username contains a letter)\n * is enforced at every mutation surface, not just signup.\n *\n * On success, the result carries the canonicalised values from each\n * individual validator so the caller submits the same strings the\n * validators approved (no validate/submit divergence).\n *\n * The caller is responsible for mapping each `{ field, code, message }`\n * error to its own i18n key — different surfaces have different key\n * namespaces (`auth.register.*`, `auth.profile.*`, `auth.users.*`).\n */\nexport type UserFieldKey = \"firstName\" | \"lastName\" | \"username\";\n\nexport interface UserFieldError {\n  field: UserFieldKey;\n  code: string;\n  message: string;\n}\n\nexport interface ValidatedUserFields {\n  firstName: string;\n  lastName: string;\n  username: string;\n}\n\nexport type UserFieldsValidationResult =\n  | { valid: true; values: ValidatedUserFields }\n  | { valid: false; errors: UserFieldError[] };\n\nexport function validateUserFields(\n  input: {\n    firstName?: string | null;\n    lastName?: string | null;\n    username?: string | null;\n  },\n  options: { requireAll?: boolean } = {},\n): UserFieldsValidationResult {\n  // Default to requiring every field. Profile-edit surfaces pass\n  // `requireAll: false` so an existing user whose optional firstName /\n  // lastName is unset (e.g. provisioned via an identity provider) can\n  // still update unrelated fields like phone or role (Codex P2 review).\n  const requireAll = options.requireAll ?? true;\n  const errors: UserFieldError[] = [];\n\n  // Skip the validator entirely when a field is empty AND requireAll is\n  // false — that means \"user is leaving this field blank\". The signup\n  // form always requires every field; profile edit does not.\n  const isBlank = (v: string | null | undefined): boolean =>\n    !v || v.trim().length === 0;\n\n  const firstName =\n    !isBlank(input.firstName) || requireAll\n      ? validateName(input.firstName)\n      : null;\n  if (firstName && !firstName.valid) {\n    errors.push({\n      field: \"firstName\",\n      code: firstName.code,\n      message: firstName.message,\n    });\n  }\n\n  const lastName =\n    !isBlank(input.lastName) || requireAll\n      ? validateName(input.lastName)\n      : null;\n  if (lastName && !lastName.valid) {\n    errors.push({\n      field: \"lastName\",\n      code: lastName.code,\n      message: lastName.message,\n    });\n  }\n\n  const username =\n    !isBlank(input.username) || requireAll\n      ? validateUsername(input.username)\n      : null;\n  if (username && !username.valid) {\n    for (const e of username.errors) {\n      errors.push({ field: \"username\", code: e.code, message: e.message });\n    }\n  }\n\n  if (errors.length > 0) return { valid: false, errors };\n\n  // Return canonical values: trimmed/NFC-normalised when validated, the\n  // original trimmed value when the field was optional and left blank.\n  // The cast is sound because the `errors.length > 0` early-return above\n  // guarantees each result, when non-null, is the `{ valid: true }` arm.\n  const valueOr = (\n    result: { valid: true; value: string } | null,\n    fallback: string | null | undefined,\n  ): string => (result ? result.value : (fallback ?? \"\").trim());\n\n  return {\n    valid: true,\n    values: {\n      firstName: valueOr(\n        firstName as { valid: true; value: string } | null,\n        input.firstName,\n      ),\n      lastName: valueOr(\n        lastName as { valid: true; value: string } | null,\n        input.lastName,\n      ),\n      username: valueOr(\n        username as { valid: true; value: string } | null,\n        input.username,\n      ),\n    },\n  };\n}\n\n/**\n * Validate a phone number (BOFF-7216).\n *\n * Phone numbers are optional on profile / admin edit forms — an empty input\n * is accepted. When a value is supplied it must:\n *   - contain only digits, spaces, and the formatting characters + - ( )\n *   - include 7–15 digits (E.164-style length bounds; we don't strip \"+\"\n *     country prefix here, we just count digits)\n *   - start with +, a digit, or (\n *\n * Returns `{ valid: true }` on an empty / whitespace-only input.\n * Returns `{ valid: false, error }` with a human-readable message on\n * rejection. The message is intentionally plain English so the caller can\n * either display it verbatim or pipe it through `tr()` with an i18n key.\n */\nexport function validatePhoneNumber(phone: string): {\n  valid: boolean;\n  error?: string;\n} {\n  const trimmed = phone.trim();\n\n  if (trimmed.length === 0) {\n    return { valid: true };\n  }\n\n  if (!/^[0-9+\\-() ]+$/.test(trimmed)) {\n    return {\n      valid: false,\n      error:\n        \"Phone number can only contain digits, spaces, and the characters + - ( )\",\n    };\n  }\n\n  const digits = trimmed.replace(/[^\\d]/g, \"\");\n  if (digits.length < 7) {\n    return { valid: false, error: \"Phone number is too short\" };\n  }\n\n  if (digits.length > 15) {\n    return { valid: false, error: \"Phone number is too long\" };\n  }\n\n  if (!/^[+\\d(]/.test(trimmed)) {\n    return {\n      valid: false,\n      error: \"Phone number must start with +, a digit, or (\",\n    };\n  }\n\n  return { valid: true };\n}\n"],"mappings":";AAKA,SAAgBA,EAAc,GAAwB;CAEpD,OAAO,6BAAW,KAAKC,CAAK;AAC9B;AAKA,SAAgBC,EAAiB,GAG/B;CACA,IAAMC,IAAmB,CAAC;CAsB1B,OApBIC,EAAS,SAAS,MACpBD,EAAO,KAAK,8CAA8C,GAGvD,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,qDAAqD,GAG9D,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,qDAAqD,GAG9D,QAAQ,KAAKC,CAAQ,KACxBD,EAAO,KAAK,2CAA2C,GAGpD,yBAAyB,KAAKC,CAAQ,KACzCD,EAAO,KAAK,sDAAsD,GAG7D;EACL,OAAOA,EAAO,WAAW;EACzB;CACF;AACF;AA8GA,SAASE,EAAmB,GAAmB;CAC7C,OAAO,CAAC,GAAGC,CAAC,CAAC,CAAC;AAChB;AAkCA,IAAMC,IAAqB,iDACrBC,IAA0B,yBAC1BC,IAAsB;AA8B5B,SAAgBC,EACd,GACsB;CAStB,IAAMC,KAAWC,KAAQ,GAAA,CACtB,UAAU,KAAK,CAAC,CAChB,QAAQJ,GAAyB,GAAG,CAAC,CACrC,QAAQC,GAAqB,GAAG,CAAC,CACjC,KAAK;CAiCR,OA/BIJ,EAAmBM,CAAO,IAAI,IACzB;EAAE,OAAO;EAAO,MAAM;EAAY,SAAS;CAAmB,IAGnEN,EAAmBM,CAAO,IAAI,MACzB;EACL,OAAO;EACP,MAAM;EACN,SAAS;CACX,IAGE,CAAC,SAAS,KAAKA,CAAO,KAAK,CAACJ,EAAmB,KAAKI,CAAO,IAIxD,SAAS,KAAKA,CAAO,IAOnB;EACL,OAAO;EACP,MAAM;EACN,SACE;CACJ,IAXS;EACL,OAAO;EACP,MAAM;EACN,SAAS;CACX,IAUG;EAAE,OAAO;EAAM,OAAOA;CAAQ;AACvC;AAQA,IAAME,IAAyB;AAmC/B,SAAgBC,EACd,GAC0B;CAC1B,IAAMX,IAA8D,CAAC,GAC/DY,KAASC,KAAY,GAAA,CAAI,KAAK;CA4CpC,OA1CIX,EAAmBU,CAAK,MAAM,IAChCZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,KAEGE,EAAmBU,CAAK,IAAI,KAC9BZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,GAGCE,EAAmBU,CAAK,IAAI,MAC9BZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,GAGEU,EAAuB,KAAKE,CAAK,KACpCZ,EAAO,KAAK;EACV,MAAM;EACN,SACE;CACJ,CAAC,GAODE,EAAmBU,CAAK,KAAK,KAC7B,CAAC,WAAW,KAAKA,CAAK,KAEtBZ,EAAO,KAAK;EACV,MAAM;EACN,SAAS;CACX,CAAC,IAIEA,EAAO,WAAW,IACrB;EAAE,OAAO;EAAM;CAAM,IACrB;EAAE,OAAO;EAAO;CAAO;AAC7B;AAmCA,SAAgBc,EACd,GAKA,IAAoC,CAAC,GACT;CAK5B,IAAMC,IAAaC,EAAQ,cAAc,IACnChB,IAA2B,CAAC,GAK5BiB,KAAW,MACf,CAACC,KAAKA,EAAE,KAAK,CAAC,CAAC,WAAW,GAEtBC,IACJ,CAACF,EAAQG,EAAM,SAAS,KAAKL,IACzBR,EAAaa,EAAM,SAAS,IAC5B;CACN,AAAID,KAAa,CAACA,EAAU,SAC1BnB,EAAO,KAAK;EACV,OAAO;EACP,MAAMmB,EAAU;EAChB,SAASA,EAAU;CACrB,CAAC;CAGH,IAAME,IACJ,CAACJ,EAAQG,EAAM,QAAQ,KAAKL,IACxBR,EAAaa,EAAM,QAAQ,IAC3B;CACN,AAAIC,KAAY,CAACA,EAAS,SACxBrB,EAAO,KAAK;EACV,OAAO;EACP,MAAMqB,EAAS;EACf,SAASA,EAAS;CACpB,CAAC;CAGH,IAAMR,IACJ,CAACI,EAAQG,EAAM,QAAQ,KAAKL,IACxBJ,EAAiBS,EAAM,QAAQ,IAC/B;CACN,IAAIP,KAAY,CAACA,EAAS,OACxB,KAAK,IAAM,KAAKA,EAAS,QACvB,EAAO,KAAK;EAAE,OAAO;EAAY,MAAM,EAAE;EAAM,SAAS,EAAE;CAAQ,CAAC;CAIvE,IAAIb,EAAO,SAAS,GAAG,OAAO;EAAE,OAAO;EAAO;CAAO;CAMrD,IAAMsB,KACJ,GACA,MACYC,IAASA,EAAO,SAASC,KAAY,GAAA,CAAI,KAAK;CAE5D,OAAO;EACL,OAAO;EACP,QAAQ;GACN,WAAWF,EACTH,GACAC,EAAM,SACR;GACA,UAAUE,EACRD,GACAD,EAAM,QACR;GACA,UAAUE,EACRT,GACAO,EAAM,QACR;EACF;CACF;AACF;AAiBA,SAAgBK,EAAoB,GAGlC;CACA,IAAMjB,IAAUkB,EAAM,KAAK;CAE3B,IAAIlB,EAAQ,WAAW,GACrB,OAAO,EAAE,OAAO,GAAK;CAGvB,IAAI,CAAC,iBAAiB,KAAKA,CAAO,GAChC,OAAO;EACL,OAAO;EACP,OACE;CACJ;CAGF,IAAMmB,IAASnB,EAAQ,QAAQ,UAAU,EAAE;CAgB3C,OAfImB,EAAO,SAAS,IACX;EAAE,OAAO;EAAO,OAAO;CAA4B,IAGxDA,EAAO,SAAS,KACX;EAAE,OAAO;EAAO,OAAO;CAA2B,IAGtD,UAAU,KAAKnB,CAAO,IAOpB,EAAE,OAAO,GAAK,IANZ;EACL,OAAO;EACP,OAAO;CACT;AAIJ"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burdenoff/microfe-auth",
-  "version": "2026.1101.4",
+  "version": "2026.1102.1",
   "description": "Auth microfrontend for Burdenoff products",
   "type": "module",
   "imports": {