@corgelabs/corge 0.0.1 → 1.0.0

package/dist/auth/service.d.ts

@@ -0,0 +1,96 @@
+import { type EntryId } from '../db';
+import type { Core } from '../index';
+import type { StepRunner } from '../tasks';
+import { type AuthUser, type CompleteAccountRecoveryInput, type EraseUserInput, type EraseUserOutput, type ForgotPasswordInput, type InitiateAccountRecoveryInput, type ResetPasswordInput, type SetRecoveryEmailInput, type SocialSignInInput, type VerifyEmailInput, type VerifyRecoveryEmailInput } from './schema';
+import { hashToken, resolveUserRole } from './utils';
+export declare class AuthService {
+    #private;
+    constructor(coreClient: Core);
+    signInSocial: (raw: SocialSignInInput) => Promise<{
+        user: AuthUser;
+        sessionCookie: string;
+    }>;
+    sendVerificationEmail: (userId?: EntryId) => Promise<{
+        sent: true;
+        expiresInMinutes: number;
+    }>;
+    verifyEmail: (raw: VerifyEmailInput) => Promise<{
+        verified: true;
+        userId: string;
+    }>;
+    forgotPassword: (raw: ForgotPasswordInput) => Promise<{
+        sent: true;
+    }>;
+    resetPassword: (raw: ResetPasswordInput) => Promise<{
+        reset: true;
+    }>;
+    setRecoveryEmail: (raw: SetRecoveryEmailInput, userId?: EntryId) => Promise<{
+        recoveryEmail: string;
+        recoveryEmailVerified: false;
+        sent: true;
+    }>;
+    verifyRecoveryEmail: (raw: VerifyRecoveryEmailInput, userId?: EntryId) => Promise<{
+        recoveryEmail: string;
+        recoveryEmailVerified: true;
+        verified: true;
+    }>;
+    initiateAccountRecovery: (raw: InitiateAccountRecoveryInput) => Promise<{
+        initiated: true;
+    }>;
+    completeAccountRecovery: (raw: CompleteAccountRecoveryInput) => Promise<{
+        user: AuthUser;
+        sessionCookie: string;
+    }>;
+    getUser: (uid: EntryId) => Promise<AuthUser | undefined>;
+    setClaims: (uid: EntryId, claims: Record<string, unknown> | null) => Promise<void>;
+    listUsers: (includeDeleted?: boolean) => Promise<AuthUser[]>;
+    blockUser: (userId?: EntryId, blocked?: boolean) => Promise<{
+        userId: EntryId;
+        blocked: boolean;
+        deleted: boolean;
+    }>;
+    eraseUser: (raw: EraseUserInput, step?: StepRunner) => Promise<EraseUserOutput>;
+    get internals(): {
+        verifyToken: (token: string, isCookie: boolean, checkRevoked: boolean, isDev?: boolean) => Promise<{
+            uid: EntryId;
+            role: import("../config").DbRole;
+            emailVerified: boolean;
+        }>;
+        hashToken: typeof hashToken;
+        resolveUserRole: typeof resolveUserRole;
+        tokenCache: Map<string, import("./schema").CachedTokenEntry>;
+        setTokenCache: (token: string, uid: EntryId, role?: import("../config").DbRole, exp?: number, strictVerified?: boolean, emailVerified?: boolean) => void;
+        recordRevocation: (uid: EntryId, isDev?: boolean) => Promise<number>;
+        syncRevocations: (isDev?: boolean, force?: boolean) => Promise<Record<string, number>>;
+        getLastDevEmail: (to: string, purpose: import("./schema").AuthEmailPurpose) => import("./schema").TransactionalEmailPayload | undefined;
+        registerTestOidcPublicKey: (jwk: (import("crypto").JsonWebKey & {
+            kid?: string;
+        }) | null) => void;
+        readonly sessionCookie: string;
+        readonly authWarm: Promise<unknown>;
+        mintCustomToken: (uid?: string) => Promise<{
+            uid: string;
+            customToken: string;
+        }>;
+        createSession: (idToken: string, profile?: {
+            email?: string;
+            name?: string;
+            avatarUrl?: string;
+            emailVerified?: boolean;
+        }) => Promise<{
+            user: AuthUser;
+            sessionCookie: string;
+        }>;
+        signUpEmail: (email: string, password: string, name?: string) => Promise<{
+            user: AuthUser;
+            sessionCookie: string;
+        }>;
+        signInEmail: (email: string, password: string) => Promise<{
+            user: AuthUser;
+            sessionCookie: string;
+        }>;
+        revokeSession: (sessionCookie: string, deleteUser?: boolean) => Promise<void>;
+        setSessionCookie: (c: import("hono").Context<import("../config").AppEnv>, sessionCookie: string) => void;
+    };
+}
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAgC,KAAK,OAAO,EAAE,MAAM,OAAO,CAAA;AAClE,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAG1C,OAAO,EAGL,KAAK,QAAQ,EACb,KAAK,4BAA4B,EACjC,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,4BAA4B,EACjC,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC9B,MAAM,UAAU,CAAA;AAEjB,OAAO,EAAE,SAAS,EAAiB,eAAe,EAAE,MAAM,SAAS,CAAA;AAEnE,qBAAa,WAAW;;IAMtB,YAAY,UAAU,EAAE,IAAI,EAK3B;IAED,YAAY,QAAS,iBAAiB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAC7D;IAE9B,qBAAqB,YAAa,OAAO,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAA;KAAE,CAAC,CAC/C;IAE9C,WAAW,QAAS,gBAAgB,KAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,IAAI,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CACjD;IAEjC,cAAc,QAAS,mBAAmB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAsC;IAE1G,aAAa,QAAS,kBAAkB,KAAG,OAAO,CAAC;QAAE,KAAK,EAAE,IAAI,CAAA;KAAE,CAAC,CAAqC;IAExG,gBAAgB,QACT,qBAAqB,WACjB,OAAO,KACf,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,KAAK,CAAC;QAAC,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CACjC;IAE9C,mBAAmB,QACZ,wBAAwB,WACpB,OAAO,KACf,OAAO,CAAC;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,qBAAqB,EAAE,IAAI,CAAC;QAAC,QAAQ,EAAE,IAAI,CAAA;KAAE,CAAC,CACjC;IAEjD,uBAAuB,QAAS,4BAA4B,KAAG,OAAO,CAAC;QAAE,SAAS,EAAE,IAAI,CAAA;KAAE,CAAC,CAC9C;IAE7C,uBAAuB,QAAS,4BAA4B,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CACpE;IAE7C,OAAO,QAAe,OAAO,KAAG,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAU5D;IAED,SAAS,QAAe,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,KAAG,OAAO,CAAC,IAAI,CAAC,CAItF;IAED,SAAS,gCAAmC,OAAO,CAAC,QAAQ,EAAE,CAAC,CAG9D;IAED,SAAS,YACC,OAAO,wBAEd,OAAO,CAAC;QAAE,MAAM,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAWlE;IAuBD,SAAS,QAAe,cAAc,SAAQ,UAAU,KAAqB,OAAO,CAAC,eAAe,CAAC,CA0BpG;IAED,IAAI,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MAyBZ;CACF"}

package/dist/auth/service.js

@@ -0,0 +1,129 @@
+import { CORE_CONFIG } from '../config';
+import { getRegisteredCollectionNames } from '../db';
+import { AuthOidcEngine } from './oidc';
+import { AuthRecoveryEngine } from './recovery';
+import { eraseUserInput, eraseUserOutput } from './schema';
+import { AuthSessionEngine, tokenCache } from './session';
+import { hashToken, mapUserRecord, resolveUserRole } from './utils';
+export class AuthService {
+    #core;
+    #session;
+    #oidc;
+    #recovery;
+    constructor(coreClient) {
+        this.#core = coreClient;
+        this.#session = new AuthSessionEngine(coreClient);
+        this.#oidc = new AuthOidcEngine(coreClient, this.#session);
+        this.#recovery = new AuthRecoveryEngine(coreClient, this.#session);
+    }
+    signInSocial = (raw) => this.#oidc.signInSocial(raw);
+    sendVerificationEmail = (userId) => this.#recovery.sendVerificationEmail(userId);
+    verifyEmail = (raw) => this.#recovery.verifyEmail(raw);
+    forgotPassword = (raw) => this.#recovery.forgotPassword(raw);
+    resetPassword = (raw) => this.#recovery.resetPassword(raw);
+    setRecoveryEmail = (raw, userId) => this.#recovery.setRecoveryEmail(raw, userId);
+    verifyRecoveryEmail = (raw, userId) => this.#recovery.verifyRecoveryEmail(raw, userId);
+    initiateAccountRecovery = (raw) => this.#recovery.initiateAccountRecovery(raw);
+    completeAccountRecovery = (raw) => this.#recovery.completeAccountRecovery(raw);
+    getUser = async (uid) => {
+        try {
+            const [u, meta] = await Promise.all([
+                this.#session.getAuth().getUser(uid),
+                this.#session.getUserAuthMeta(uid, this.#core.env.isDev)
+            ]);
+            return mapUserRecord(u, meta);
+        }
+        catch {
+            return undefined;
+        }
+    };
+    setClaims = async (uid, claims) => {
+        await this.#session.getAuth().setCustomUserClaims(uid, claims);
+        this.#session.evictUserTokens(uid);
+        await this.#session.recordRevocation(uid, this.#core.env.isDev);
+    };
+    listUsers = async (includeDeleted = false) => {
+        const { users } = await this.#session.getAuth().listUsers(1000);
+        return users.map((u) => mapUserRecord(u)).filter((u) => includeDeleted || !u.deleted);
+    };
+    blockUser = async (userId = this.#core.userId, blocked = true) => {
+        const auth = this.#session.getAuth();
+        this.#session.evictUserTokens(userId);
+        await Promise.all([
+            blocked
+                ? this.#session.recordRevocation(userId, this.#core.env.isDev)
+                : this.#session.clearUserRevocation(userId, this.#core.env.isDev),
+            ...(blocked ? [auth.revokeRefreshTokens(userId).catch(() => { })] : []),
+            auth.updateUser(userId, { disabled: blocked }).catch(() => { })
+        ]);
+        return { userId, blocked, deleted: blocked };
+    };
+    #triggerFirestoreBackup = async (userId) => {
+        const projectId = this.#core.config.gcpProject;
+        const dbId = this.#core.env.isDev ? this.#core.config.firestoreDbs.dev : this.#core.config.firestoreDbs.prod;
+        const bucketName = this.#core.env.isDev
+            ? this.#core.config.storageBuckets.dev
+            : this.#core.config.storageBuckets.prod;
+        const outputUriPrefix = `gs://${bucketName}/backups/${dbId}-${userId}-${Date.now()}`;
+        const accessToken = await this.#core.internals.registry.getGcpAccessToken();
+        const res = await fetch(`https://firestore.googleapis.com/v1/projects/${projectId}/databases/${dbId}:exportDocuments`, {
+            method: 'POST',
+            headers: { Authorization: `Bearer ${accessToken}`, 'content-type': 'application/json' },
+            body: JSON.stringify({ outputUriPrefix, collectionIds: getRegisteredCollectionNames() })
+        });
+        if (!res.ok)
+            throw new Error(`Firestore exportDocuments failed (${res.status}): ${await res.text()}`);
+        const data = (await res.json());
+        return data.name ?? outputUriPrefix;
+    };
+    eraseUser = async (raw, step = this.#core.step) => {
+        const { userId, backupBeforeErase } = eraseUserInput.parse(raw);
+        const backupOperation = backupBeforeErase
+            ? await step('backup', () => this.#triggerFirestoreBackup(userId))
+            : undefined;
+        const { erasedFiles, erasedChats, erasedCollections } = await this.#core.internals.registry.cascadeEraseUserCollections(userId, step);
+        const erasedUser = await step('erase-user', async () => {
+            this.#session.evictUserTokens(userId);
+            await Promise.all([
+                this.#session.recordRevocation(userId, this.#core.env.isDev),
+                this.#session.getAuth().deleteUser(userId).catch(() => { })
+            ]);
+            return true;
+        });
+        return eraseUserOutput.parse({
+            userId,
+            ...(backupOperation ? { backupOperation } : {}),
+            erasedFiles,
+            erasedChats,
+            ...(Object.keys(erasedCollections).length ? { erasedCollections } : {}),
+            erasedUser
+        });
+    };
+    get internals() {
+        const getAuthWarm = this.#session.getAuthWarm;
+        return {
+            verifyToken: this.#session.verifyToken,
+            hashToken,
+            resolveUserRole,
+            tokenCache,
+            setTokenCache: this.#session.setTokenCache,
+            recordRevocation: this.#session.recordRevocation,
+            syncRevocations: this.#session.syncRevocations,
+            getLastDevEmail: this.#recovery.getLastDevEmail,
+            registerTestOidcPublicKey: this.#oidc.registerTestOidcPublicKey,
+            get sessionCookie() {
+                return CORE_CONFIG.auth.sessionCookie;
+            },
+            get authWarm() {
+                return getAuthWarm();
+            },
+            mintCustomToken: this.#session.mintCustomToken,
+            createSession: this.#session.createSession,
+            signUpEmail: this.#oidc.signUpEmail,
+            signInEmail: this.#oidc.signInEmail,
+            revokeSession: this.#session.revokeSession,
+            setSessionCookie: this.#session.setSessionCookie
+        };
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,WAAW,CAAA;AACvC,OAAO,EAAE,4BAA4B,EAAgB,MAAM,OAAO,CAAA;AAGlE,OAAO,EAAE,cAAc,EAAE,MAAM,QAAQ,CAAA;AACvC,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAA;AAC/C,OAAO,EACL,cAAc,EACd,eAAe,EAYhB,MAAM,UAAU,CAAA;AACjB,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,WAAW,CAAA;AACzD,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,SAAS,CAAA;AAEnE,MAAM,OAAO,WAAW;IACb,KAAK,CAAM;IACX,QAAQ,CAAmB;IAC3B,KAAK,CAAgB;IACrB,SAAS,CAAoB;IAEtC,YAAY,UAAgB;QAC1B,IAAI,CAAC,KAAK,GAAG,UAAU,CAAA;QACvB,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,UAAU,CAAC,CAAA;QACjD,IAAI,CAAC,KAAK,GAAG,IAAI,cAAc,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;QAC1D,IAAI,CAAC,SAAS,GAAG,IAAI,kBAAkB,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAA;IACpE,CAAC;IAED,YAAY,GAAG,CAAC,GAAsB,EAAsD,EAAE,CAC5F,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;IAE9B,qBAAqB,GAAG,CAAC,MAAgB,EAAqD,EAAE,CAC9F,IAAI,CAAC,SAAS,CAAC,qBAAqB,CAAC,MAAM,CAAC,CAAA;IAE9C,WAAW,GAAG,CAAC,GAAqB,EAA+C,EAAE,CACnF,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IAEjC,cAAc,GAAG,CAAC,GAAwB,EAA2B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;IAE1G,aAAa,GAAG,CAAC,GAAuB,EAA4B,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;IAExG,gBAAgB,GAAG,CACjB,GAA0B,EAC1B,MAAgB,EAC8D,EAAE,CAChF,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAE9C,mBAAmB,GAAG,CACpB,GAA6B,EAC7B,MAAgB,EACiE,EAAE,CACnF,IAAI,CAAC,SAAS,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAEjD,uBAAuB,GAAG,CAAC,GAAiC,EAAgC,EAAE,CAC5F,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAE7C,uBAAuB,GAAG,CAAC,GAAiC,EAAsD,EAAE,CAClH,IAAI,CAAC,SAAS,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAA;IAE7C,OAAO,GAAG,KAAK,EAAE,GAAY,EAAiC,EAAE;QAC9D,IAAI,CAAC;YACH,MAAM,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;gBACpC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;aACzD,CAAC,CAAA;YACF,OAAO,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAA;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,SAAS,CAAA;QAClB,CAAC;IACH,CAAC,CAAA;IAED,SAAS,GAAG,KAAK,EAAE,GAAY,EAAE,MAAsC,EAAiB,EAAE;QACxF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;QAC9D,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,CAAA;QAClC,MAAM,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjE,CAAC,CAAA;IAED,SAAS,GAAG,KAAK,EAAE,cAAc,GAAG,KAAK,EAAuB,EAAE;QAChE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;QAC/D,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAA;IACvF,CAAC,CAAA;IAED,SAAS,GAAG,KAAK,EACf,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,EACnC,OAAO,GAAG,IAAI,EACoD,EAAE;QACpE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAA;QACpC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;QACrC,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,OAAO;gBACL,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC9D,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;YACnE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;SAC/D,CAAC,CAAA;QACF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAA;IAC9C,CAAC,CAAA;IAED,uBAAuB,GAAG,KAAK,EAAE,MAAc,EAAmB,EAAE;QAClE,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAA;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,CAAA;QAC5G,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK;YACrC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG;YACtC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAA;QACzC,MAAM,eAAe,GAAG,QAAQ,UAAU,YAAY,IAAI,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAA;QACpF,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAA;QAC3E,MAAM,GAAG,GAAG,MAAM,KAAK,CACrB,gDAAgD,SAAS,cAAc,IAAI,kBAAkB,EAC7F;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YACvF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,aAAa,EAAE,4BAA4B,EAAE,EAAE,CAAC;SACzF,CACF,CAAA;QACD,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAA;QACrG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsB,CAAA;QACpD,OAAO,IAAI,CAAC,IAAI,IAAI,eAAe,CAAA;IACrC,CAAC,CAAA;IAED,SAAS,GAAG,KAAK,EAAE,GAAmB,EAAE,IAAI,GAAe,IAAI,CAAC,KAAK,CAAC,IAAI,EAA4B,EAAE;QACtG,MAAM,EAAE,MAAM,EAAE,iBAAiB,EAAE,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC/D,MAAM,eAAe,GAAG,iBAAiB;YACvC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,uBAAuB,CAAC,MAAM,CAAC,CAAC;YAClE,CAAC,CAAC,SAAS,CAAA;QAEb,MAAM,EAAE,WAAW,EAAE,WAAW,EAAE,iBAAiB,EAAE,GACnD,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,2BAA2B,CAAC,MAAM,EAAE,IAAI,CAAC,CAAA;QAE/E,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,YAAY,EAAE,KAAK,IAAI,EAAE;YACrD,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,MAAM,CAAC,CAAA;YACrC,MAAM,OAAO,CAAC,GAAG,CAAC;gBAChB,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;gBAC5D,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC;aAC3D,CAAC,CAAA;YACF,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QAEF,OAAO,eAAe,CAAC,KAAK,CAAC;YAC3B,MAAM;YACN,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,WAAW;YACX,WAAW;YACX,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,UAAU;SACX,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,IAAI,SAAS;QACX,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAA;QAC7C,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,WAAW;YACtC,SAAS;YACT,eAAe;YACf,UAAU;YACV,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;YAChD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC9C,eAAe,EAAE,IAAI,CAAC,SAAS,CAAC,eAAe;YAC/C,yBAAyB,EAAE,IAAI,CAAC,KAAK,CAAC,yBAAyB;YAC/D,IAAI,aAAa;gBACf,OAAO,WAAW,CAAC,IAAI,CAAC,aAAa,CAAA;YACvC,CAAC;YACD,IAAI,QAAQ;gBACV,OAAO,WAAW,EAAE,CAAA;YACtB,CAAC;YACD,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,eAAe;YAC9C,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW;YACnC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,aAAa;YAC1C,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,gBAAgB;SACjD,CAAA;IACH,CAAC;CACF"}

package/dist/auth/session.d.ts

@@ -0,0 +1,51 @@
+import { type Auth } from 'firebase-admin/auth';
+import type { Context } from 'hono';
+import { type AppEnv, type DbRole } from '../config';
+import type { EntryId } from '../db';
+import type { Core } from '../index';
+import type { AuthUser, CachedTokenEntry, UserAuthMetaRecord } from './schema';
+export declare const tokenCache: Map<string, CachedTokenEntry>;
+export declare class AuthSessionEngine {
+    #private;
+    constructor(coreClient: Core);
+    getAuth: () => Auth;
+    getAuthWarm: () => Promise<unknown>;
+    resolveDefaultIsDev: (isDev?: boolean) => boolean;
+    setTokenCache: (token: string, uid: EntryId, role?: DbRole, exp?: number, strictVerified?: boolean, emailVerified?: boolean) => void;
+    evictUserTokens: (uid: EntryId, revokedAt?: number) => void;
+    recordRevocation: (uid: EntryId, isDev?: boolean) => Promise<number>;
+    clearUserRevocation: (uid: EntryId, isDev?: boolean) => Promise<void>;
+    syncRevocations: (isDev?: boolean, force?: boolean) => Promise<Record<string, number>>;
+    verifyToken: (token: string, isCookie: boolean, checkRevoked: boolean, isDev?: boolean) => Promise<{
+        uid: EntryId;
+        role: DbRole;
+        emailVerified: boolean;
+    }>;
+    getUserAuthMeta: (uid: EntryId, isDev?: boolean) => Promise<UserAuthMetaRecord | undefined>;
+    upsertUserAuthMeta: (uid: EntryId, patch: Partial<UserAuthMetaRecord>, isDev?: boolean) => Promise<UserAuthMetaRecord>;
+    setSessionCookie: (c: Context<AppEnv>, sessionCookie: string) => void;
+    mintCustomToken: (uid?: string) => Promise<{
+        uid: string;
+        customToken: string;
+    }>;
+    createSession: (idToken: string, profile?: {
+        email?: string;
+        name?: string;
+        avatarUrl?: string;
+        emailVerified?: boolean;
+    }) => Promise<{
+        user: AuthUser;
+        sessionCookie: string;
+    }>;
+    mintSessionForUid: (uid: EntryId, profile?: {
+        email?: string;
+        name?: string;
+        avatarUrl?: string;
+        emailVerified?: boolean;
+    }) => Promise<{
+        user: AuthUser;
+        sessionCookie: string;
+    }>;
+    revokeSession: (sessionCookie: string, deleteUser?: boolean) => Promise<void>;
+}
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,IAAI,EAAE,MAAM,qBAAqB,CAAA;AAExD,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AACnC,OAAO,EAAe,KAAK,MAAM,EAAE,KAAK,MAAM,EAAE,MAAM,WAAW,CAAA;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,OAAO,CAAA;AACpC,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAA;AACpC,OAAO,KAAK,EAAE,QAAQ,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAA;AAS9E,eAAO,MAAM,UAAU,+BAAsC,CAAA;AAc7D,qBAAa,iBAAiB;;IAG5B,YAAY,UAAU,EAAE,IAAI,EAE3B;IAED,OAAO,QAAO,IAAI,CAGjB;IAED,WAAW,QAAO,OAAO,CAAC,OAAO,CAAC,CAcjC;IAED,mBAAmB,WAAY,OAAO,KAAG,OAAO,CAAiC;IAuBjF,aAAa,UACJ,MAAM,OACR,OAAO,SACN,MAAM,sEAIX,IAAI,CAcN;IAED,eAAe,QAAS,OAAO,cAAc,MAAM,KAAG,IAAI,CAMzD;IAED,gBAAgB,QAAe,OAAO,UAAU,OAAO,KAAG,OAAO,CAAC,MAAM,CAAC,CA8BxE;IAED,mBAAmB,QAAe,OAAO,UAAU,OAAO,KAAG,OAAO,CAAC,IAAI,CAAC,CAkBzE;IAED,eAAe,WAAkB,OAAO,sBAAkB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAyBxF;IAED,WAAW,UACF,MAAM,YACH,OAAO,gBACH,OAAO,UACb,OAAO,KACd,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,OAAO,CAAA;KAAE,CAAC,CAqCjE;IAED,eAAe,QAAe,OAAO,UAAU,OAAO,KAAG,OAAO,CAAC,kBAAkB,GAAG,SAAS,CAAC,CA+B/F;IAED,kBAAkB,QACX,OAAO,SACL,OAAO,CAAC,kBAAkB,CAAC,UAC1B,OAAO,KACd,OAAO,CAAC,kBAAkB,CAAC,CAkD7B;IAED,gBAAgB,MAAO,OAAO,CAAC,MAAM,CAAC,iBAAiB,MAAM,KAAG,IAAI,CAQnE;IAED,eAAe,oBAEZ,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC,CAG9C;IAEF,aAAa,YACF,MAAM,YACL;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,KACvF,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAwCpD;IAED,iBAAiB,QACV,OAAO,YACF;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAE,KACvF,OAAO,CAAC;QAAE,IAAI,EAAE,QAAQ,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,CAYpD;IAED,aAAa,kBAAyB,MAAM,2BAAuB,OAAO,CAAC,IAAI,CAAC,CAU/E;CACF"}

package/dist/auth/session.js

@@ -0,0 +1,344 @@
+import { getAuth } from 'firebase-admin/auth';
+import { setCookie } from 'hono/cookie';
+import { CORE_CONFIG } from '../config';
+import { fetchIdentityToolkit, normalizeDate, parseLinkedProviders, resolveTokenRole } from './utils';
+let authWarmPromise;
+const REVOCATION_SYNC_TTL_MS = 3_000;
+const AUTH_REVOCATIONS_DOC_PATH = '_system/auth_revocations';
+export const tokenCache = new Map();
+const revocationWatermarks = [
+    { lastSyncedAt: 0, revokedUsers: {} },
+    { lastSyncedAt: 0, revokedUsers: {} }
+];
+let bgSyncTimer = null;
+export class AuthSessionEngine {
+    #core;
+    constructor(coreClient) {
+        this.#core = coreClient;
+    }
+    getAuth = () => {
+        this.#core.internals.registry.ensureFirebaseApp();
+        return getAuth();
+    };
+    getAuthWarm = () => {
+        if (!authWarmPromise) {
+            const auth = this.getAuth();
+            const rawAuth = auth;
+            authWarmPromise = Promise.all([
+                rawAuth.idTokenVerifier?.signatureVerifier?.keyFetcher?.fetchPublicKeys?.(),
+                rawAuth.sessionCookieVerifier?.signatureVerifier?.keyFetcher?.fetchPublicKeys?.(),
+                auth.getUser(CORE_CONFIG.auth.adminUserId).catch(() => { })
+            ]).catch(() => { });
+        }
+        return authWarmPromise;
+    };
+    resolveDefaultIsDev = (isDev) => isDev ?? this.#core.env.isDev;
+    #ensureBackgroundRevocationSync = () => {
+        if (bgSyncTimer)
+            return;
+        bgSyncTimer = setInterval(() => {
+            if (tokenCache.size === 0) {
+                if (bgSyncTimer) {
+                    clearInterval(bgSyncTimer);
+                    bgSyncTimer = null;
+                }
+                return;
+            }
+            const defaultIsDev = this.#core.env.isDev;
+            for (const isDevSlot of [false, true]) {
+                const idx = isDevSlot ? 1 : 0;
+                if (isDevSlot === defaultIsDev || revocationWatermarks[idx].lastSyncedAt > 0) {
+                    void this.syncRevocations(isDevSlot, true);
+                }
+            }
+        }, 2_000);
+        bgSyncTimer.unref?.();
+    };
+    setTokenCache = (token, uid, role = uid === CORE_CONFIG.auth.adminUserId ? 'admin' : 'user', exp = Date.now() + CORE_CONFIG.auth.tokenCacheTtlMs, strictVerified = false, emailVerified = false) => {
+        const existing = tokenCache.get(token);
+        if (!existing && tokenCache.size >= CORE_CONFIG.auth.tokenCacheMaxSize) {
+            tokenCache.delete(tokenCache.keys().next().value);
+        }
+        tokenCache.set(token, {
+            uid,
+            role,
+            exp,
+            cachedAt: Date.now(),
+            strictVerified: Boolean(strictVerified || existing?.strictVerified),
+            emailVerified: Boolean(emailVerified || existing?.emailVerified)
+        });
+        this.#ensureBackgroundRevocationSync();
+    };
+    evictUserTokens = (uid, revokedAt) => {
+        for (const [k, v] of tokenCache) {
+            if (v.uid === uid && (revokedAt === undefined || v.cachedAt <= revokedAt)) {
+                tokenCache.delete(k);
+            }
+        }
+    };
+    recordRevocation = async (uid, isDev) => {
+        let revokedAt = Date.now();
+        this.evictUserTokens(uid);
+        const ttlMs = CORE_CONFIG.auth.tokenCacheTtlMs;
+        const targetIsDev = this.resolveDefaultIsDev(isDev);
+        const localState = revocationWatermarks[targetIsDev ? 1 : 0];
+        localState.revokedUsers[uid] = revokedAt;
+        localState.lastSyncedAt = revokedAt;
+        const db = this.#core.db.firestore(targetIsDev);
+        const docRef = db.doc(AUTH_REVOCATIONS_DOC_PATH);
+        try {
+            await db.runTransaction(async (tx) => {
+                const snap = await tx.get(docRef);
+                const now = Date.now();
+                revokedAt = now;
+                const data = snap.data();
+                const existing = data?.revokedUsers ?? {};
+                const pruned = {};
+                const cutoff = now - ttlMs;
+                for (const [k, ts] of Object.entries(existing)) {
+                    if (typeof ts === 'number' && ts > cutoff)
+                        pruned[k] = ts;
+                }
+                pruned[uid] = now;
+                tx.set(docRef, { revokedUsers: pruned, updatedAt: now });
+            });
+            localState.revokedUsers[uid] = revokedAt;
+            localState.lastSyncedAt = revokedAt;
+        }
+        catch { }
+        return revokedAt;
+    };
+    clearUserRevocation = async (uid, isDev) => {
+        const targetIsDev = this.resolveDefaultIsDev(isDev);
+        const localState = revocationWatermarks[targetIsDev ? 1 : 0];
+        delete localState.revokedUsers[uid];
+        localState.lastSyncedAt = Date.now();
+        const db = this.#core.db.firestore(targetIsDev);
+        const docRef = db.doc(AUTH_REVOCATIONS_DOC_PATH);
+        try {
+            await db.runTransaction(async (tx) => {
+                const snap = await tx.get(docRef);
+                const data = snap.data();
+                if (!data?.revokedUsers || !(uid in data.revokedUsers))
+                    return;
+                const next = { ...data.revokedUsers };
+                delete next[uid];
+                tx.set(docRef, { revokedUsers: next, updatedAt: Date.now() });
+            });
+        }
+        catch { }
+    };
+    syncRevocations = async (isDev, force = false) => {
+        const targetIsDev = this.resolveDefaultIsDev(isDev);
+        const state = revocationWatermarks[targetIsDev ? 1 : 0];
+        const now = Date.now();
+        if (!force && state.lastSyncedAt > 0 && now - state.lastSyncedAt < REVOCATION_SYNC_TTL_MS) {
+            return state.revokedUsers;
+        }
+        return this.#core.internals.resilience.singleflight(`auth:revocations:${targetIsDev ? 'dev' : 'prod'}`, async () => {
+            try {
+                const snap = await this.#core.db.firestore(targetIsDev).doc(AUTH_REVOCATIONS_DOC_PATH).get();
+                const remote = snap.data()?.revokedUsers ?? {};
+                state.revokedUsers = remote;
+                state.lastSyncedAt = Date.now();
+                for (const [uid, revokedAt] of Object.entries(remote)) {
+                    if (typeof revokedAt === 'number')
+                        this.evictUserTokens(uid, revokedAt);
+                }
+            }
+            catch {
+                state.lastSyncedAt = Date.now();
+            }
+            return state.revokedUsers;
+        }, { scope: 'global' });
+    };
+    verifyToken = async (token, isCookie, checkRevoked, isDev) => {
+        const targetIsDev = this.resolveDefaultIsDev(isDev);
+        const state = revocationWatermarks[targetIsDev ? 1 : 0];
+        let hit = tokenCache.get(token);
+        if (hit && hit.exp > Date.now()) {
+            if (Date.now() - state.lastSyncedAt >= REVOCATION_SYNC_TTL_MS) {
+                void this.syncRevocations(targetIsDev);
+            }
+            const revokedAt = state.revokedUsers[hit.uid];
+            if (typeof revokedAt === 'number' && revokedAt >= hit.cachedAt) {
+                this.evictUserTokens(hit.uid, revokedAt);
+                hit = undefined;
+            }
+        }
+        if (hit && hit.exp > Date.now() && (!checkRevoked || hit.strictVerified)) {
+            return { uid: hit.uid, role: hit.role, emailVerified: Boolean(hit.emailVerified) };
+        }
+        return this.#core.internals.resilience.singleflight(`auth:${isCookie ? 'c' : 'b'}:${checkRevoked ? '1' : '0'}:${token}`, async () => {
+            const auth = this.getAuth();
+            const d = isCookie
+                ? await auth.verifySessionCookie(token, checkRevoked)
+                : await auth.verifyIdToken(token, checkRevoked);
+            const role = resolveTokenRole(d, d.uid);
+            const emailVerified = Boolean(d.email_verified);
+            this.setTokenCache(token, d.uid, role, Math.min(d.exp * 1000, Date.now() + CORE_CONFIG.auth.tokenCacheTtlMs), checkRevoked, emailVerified);
+            return { uid: d.uid, role, emailVerified };
+        });
+    };
+    getUserAuthMeta = async (uid, isDev) => {
+        if (!uid)
+            return undefined;
+        try {
+            const snap = await this.#core.db
+                .firestore(this.resolveDefaultIsDev(isDev))
+                .collection('user_auth_meta')
+                .doc(uid)
+                .get();
+            if (!snap.exists)
+                return undefined;
+            const raw = snap.data();
+            if (!raw || raw.deleted === true)
+                return undefined;
+            const linkedProviders = parseLinkedProviders(raw.linkedProviders);
+            return {
+                ...(typeof raw.email === 'string' || raw.email === null ? { email: raw.email } : {}),
+                ...(typeof raw.emailVerified === 'boolean' ? { emailVerified: raw.emailVerified } : {}),
+                ...(typeof raw.name === 'string' || raw.name === null ? { name: raw.name } : {}),
+                ...(typeof raw.avatarUrl === 'string' || raw.avatarUrl === null ? { avatarUrl: raw.avatarUrl } : {}),
+                ...(typeof raw.recoveryEmail === 'string' || raw.recoveryEmail === null
+                    ? { recoveryEmail: raw.recoveryEmail }
+                    : {}),
+                ...(typeof raw.recoveryEmailVerified === 'boolean'
+                    ? { recoveryEmailVerified: raw.recoveryEmailVerified }
+                    : {}),
+                ...(linkedProviders.length > 0 ? { linkedProviders } : {}),
+                ...(Array.isArray(raw.providerKeys) ? { providerKeys: raw.providerKeys.map(String) } : {}),
+                createdAt: normalizeDate(raw.createdAt),
+                updatedAt: normalizeDate(raw.updatedAt)
+            };
+        }
+        catch {
+            return undefined;
+        }
+    };
+    upsertUserAuthMeta = async (uid, patch, isDev) => {
+        const db = this.#core.db.firestore(this.resolveDefaultIsDev(isDev));
+        const docRef = db.collection('user_auth_meta').doc(uid);
+        const now = new Date();
+        let merged = { ...patch, updatedAt: now };
+        await db.runTransaction(async (tx) => {
+            const snap = await tx.get(docRef);
+            const existing = snap.exists ? snap.data() : undefined;
+            const createdAt = existing?.createdAt ? normalizeDate(existing.createdAt, now) : now;
+            const existingProviders = parseLinkedProviders(existing?.linkedProviders, now);
+            const nextProviders = patch.linkedProviders ?? existingProviders;
+            const providerKeys = Array.from(new Set([
+                ...(Array.isArray(existing?.providerKeys) ? existing.providerKeys.map(String) : []),
+                ...(patch.providerKeys ?? []),
+                ...nextProviders.map((p) => `${p.provider}:${p.providerUserId}`)
+            ]));
+            const nextDoc = {
+                id: uid,
+                deleted: false,
+                email: patch.email !== undefined ? patch.email : (existing?.email ?? null),
+                emailVerified: patch.emailVerified !== undefined ? patch.emailVerified : Boolean(existing?.emailVerified),
+                name: patch.name !== undefined ? patch.name : (existing?.name ?? null),
+                avatarUrl: patch.avatarUrl !== undefined ? patch.avatarUrl : (existing?.avatarUrl ?? null),
+                recoveryEmail: patch.recoveryEmail !== undefined ? patch.recoveryEmail : (existing?.recoveryEmail ?? null),
+                recoveryEmailVerified: patch.recoveryEmailVerified !== undefined
+                    ? patch.recoveryEmailVerified
+                    : Boolean(existing?.recoveryEmailVerified),
+                linkedProviders: nextProviders,
+                providerKeys,
+                createdAt,
+                updatedAt: now
+            };
+            tx.set(docRef, nextDoc, { merge: true });
+            merged = {
+                email: nextDoc.email,
+                emailVerified: nextDoc.emailVerified,
+                name: nextDoc.name,
+                avatarUrl: nextDoc.avatarUrl,
+                recoveryEmail: nextDoc.recoveryEmail,
+                recoveryEmailVerified: nextDoc.recoveryEmailVerified,
+                linkedProviders: nextProviders,
+                providerKeys,
+                createdAt,
+                updatedAt: now
+            };
+        });
+        return merged;
+    };
+    setSessionCookie = (c, sessionCookie) => {
+        setCookie(c, CORE_CONFIG.auth.sessionCookie, sessionCookie, {
+            httpOnly: true,
+            secure: c.req.header('x-forwarded-proto') === 'https' || c.req.url.startsWith('https://'),
+            path: '/',
+            sameSite: 'Lax',
+            maxAge: Math.floor(CORE_CONFIG.auth.sessionExpiresInMs / 1000)
+        });
+    };
+    mintCustomToken = async (uid = `anon_${crypto.randomUUID().replace(/-/g, '').slice(0, 16)}`) => ({
+        uid,
+        customToken: await this.getAuth().createCustomToken(uid)
+    });
+    createSession = async (idToken, profile) => {
+        const auth = this.getAuth();
+        const cacheTtl = CORE_CONFIG.auth.tokenCacheTtlMs;
+        const sessionExpiresIn = CORE_CONFIG.auth.sessionExpiresInMs;
+        const now = new Date();
+        const [{ decoded, meta }, sessionCookie] = await Promise.all([
+            auth.verifyIdToken(idToken, true).then(async (d) => {
+                const role = resolveTokenRole(d, d.uid);
+                const emailVerified = Boolean(d.email_verified || profile?.emailVerified);
+                this.setTokenCache(idToken, d.uid, role, Math.min(d.exp * 1000, Date.now() + cacheTtl), true, emailVerified);
+                const updates = {};
+                if (profile?.name && d.name !== profile.name)
+                    updates.displayName = profile.name;
+                if (profile?.avatarUrl && d.picture !== profile.avatarUrl)
+                    updates.photoURL = profile.avatarUrl;
+                const [m] = await Promise.all([
+                    this.getUserAuthMeta(d.uid, this.#core.env.isDev),
+                    Object.keys(updates).length > 0 ? auth.updateUser(d.uid, updates).catch(() => { }) : Promise.resolve()
+                ]);
+                return { decoded: d, meta: m };
+            }),
+            auth.createSessionCookie(idToken, { expiresIn: sessionExpiresIn })
+        ]);
+        const role = resolveTokenRole(decoded, decoded.uid);
+        const emailVerified = Boolean(decoded.email_verified || profile?.emailVerified || meta?.emailVerified);
+        const avatarUrl = profile?.avatarUrl ?? decoded.picture ?? meta?.avatarUrl;
+        const user = {
+            id: decoded.uid,
+            email: decoded.email ?? profile?.email ?? meta?.email ?? null,
+            emailVerified,
+            name: profile?.name ?? decoded.name ?? meta?.name ?? null,
+            ...(avatarUrl !== undefined ? { avatarUrl } : {}),
+            ...(meta?.recoveryEmail !== undefined ? { recoveryEmail: meta.recoveryEmail } : {}),
+            ...(meta?.recoveryEmailVerified !== undefined ? { recoveryEmailVerified: meta.recoveryEmailVerified } : {}),
+            ...(meta?.linkedProviders?.length ? { linkedProviders: meta.linkedProviders } : {}),
+            ...(decoded.role || decoded.admin ? { customClaims: { role } } : {}),
+            deleted: false,
+            createdAt: meta?.createdAt ?? now,
+            updatedAt: now
+        };
+        this.setTokenCache(sessionCookie, user.id, role, Date.now() + cacheTtl, true, emailVerified);
+        return { user, sessionCookie };
+    };
+    mintSessionForUid = async (uid, profile) => {
+        const customToken = await this.getAuth().createCustomToken(uid);
+        const { ok, data } = await fetchIdentityToolkit('accounts:signInWithCustomToken', this.#core.env.WEB_API_KEY, { token: customToken, returnSecureToken: true });
+        if (!ok || !data.idToken) {
+            const msg = data.error?.message ?? 'CUSTOM_TOKEN_EXCHANGE_FAILED';
+            return this.#core.errors.httpError(401, msg, msg);
+        }
+        return this.createSession(data.idToken, profile);
+    };
+    revokeSession = async (sessionCookie, deleteUser = false) => {
+        const auth = this.getAuth();
+        const uid = tokenCache.get(sessionCookie)?.uid ?? (await auth.verifySessionCookie(sessionCookie)).sub;
+        this.evictUserTokens(uid);
+        tokenCache.delete(sessionCookie);
+        await Promise.all([
+            this.recordRevocation(uid, this.#core.env.isDev),
+            auth.revokeRefreshTokens(uid).catch(() => { }),
+            ...(deleteUser ? [auth.updateUser(uid, { disabled: true }).catch(() => { })] : [])
+        ]);
+    };
+}
+//# sourceMappingURL=session.js.map