@fluojs/passport 1.0.4 → 2.0.0

package/dist/adapters/passport-js.d.ts

@@ -1,6 +1,7 @@
 import type { Token } from '@fluojs/core';
-import type { GuardContext, Principal } from '@fluojs/http';
 import type { Provider } from '@fluojs/di';
+import type { GuardContext, Principal } from '@fluojs/http';
+import type { OnApplicationShutdown } from '@fluojs/runtime';
 import type { AuthHandledResult, AuthStrategy, AuthStrategyRegistration } from '../types.js';
 /**
  * Represents a Passport.js strategy-like object that implements
@@ -10,9 +11,14 @@ export interface PassportJsStrategyLike {
     /**
      * Performs authentication for the given request and options.
      *
-     * @param request - The raw request object from the underlying framework.
+     * @param request - The active platform adapter's raw host request when one exists,
+     *   otherwise the normalized fluo request. The bridge never constructs a
+     *   Passport-initialized host request.
      * @param options - Strategy-specific authentication options.
-     * @returns An execution result or a promise resolving to one.
+     * @returns The bridge ignores the returned value. Strategy implementations must
+     *   settle the request by calling one of the bound Passport actions (`success`,
+     *   `fail`, `redirect`, `pass`, or `error`). A returned promise only propagates
+     *   rejections; resolving it without calling an action fails authentication.
      */
     authenticate(request: unknown, options?: unknown): unknown;
 }
@@ -38,7 +44,10 @@ export type PassportJsPrincipalMapper = (input: PassportJsPrincipalMapperInput)
 export interface PassportJsAuthStrategyOptions {
     /** Optional options to pass to the Passport strategy's `authenticate` method. */
     authenticateOptions?: Readonly<Record<string, unknown>>;
-    /** Maximum time to wait for callback-style strategies to call a bound Passport action. */
+    /**
+     * Maximum time to wait for callback-style strategies to call a bound Passport action.
+     * Must be a non-negative finite number. A value of `0` schedules settlement on the next timer turn.
+     */
     actionTimeoutMs?: number;
     /** Optional custom mapper for converting user data to a principal. */
     mapPrincipal?: PassportJsPrincipalMapper;
@@ -55,13 +64,19 @@ export interface PassportJsStrategyBridge {
 /**
  * A bridge strategy that allows using Passport.js strategies within the fluo
  * authentication framework.
+ *
+ * @throws {RangeError} When `actionTimeoutMs` is negative or non-finite.
  */
-export declare class PassportJsAuthStrategy implements AuthStrategy {
+export declare class PassportJsAuthStrategy implements AuthStrategy, OnApplicationShutdown {
     private readonly strategyTemplate;
     private readonly options;
+    private readonly actionTimeoutMs;
     private readonly requestState;
+    private acceptingAuthentications;
     constructor(strategyTemplate: PassportJsStrategyLike, options?: PassportJsAuthStrategyOptions);
     authenticate(context: GuardContext): Promise<Principal | AuthHandledResult>;
+    /** Cancels every unsettled Passport.js execution when application shutdown starts. */
+    onApplicationShutdown(): void;
     private createExecutableStrategy;
     private settle;
     private bindStrategyActions;

package/dist/adapters/passport-js.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"passport-js.d.ts","sourceRoot":"","sources":["../../src/adapters/passport-js.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAI3C,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAU7F;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5D;AAcD;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,8BAA8B,KAAK,SAAS,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD,0FAA0F;IAC1F,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,yBAAyB,CAAC;CAC1C;AAID;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,EAAE,wBAAwB,CAAC;CACpC;AAoGD;;;GAGG;AACH,qBAAa,sBAAuB,YAAW,YAAY;IAIvD,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAuE;gBAGjF,gBAAgB,EAAE,sBAAsB,EACxC,OAAO,GAAE,6BAAkC;IAG9D,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC;IAgE3E,OAAO,CAAC,wBAAwB;IAmBhC,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,mBAAmB;IAqC3B,OAAO,CAAC,kBAAkB;CAS3B;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAC5C,OAAO,GAAE,6BAAkC,GAC1C,wBAAwB,CAwB1B"}
+{"version":3,"file":"passport-js.d.ts","sourceRoot":"","sources":["../../src/adapters/passport-js.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAI7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAU7F;;;GAGG;AACH,MAAM,WAAW,sBAAsB;IACrC;;;;;;;;;;;OAWG;IACH,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;CAC5D;AAcD;;;GAGG;AACH,MAAM,WAAW,8BAA8B;IAC7C,iDAAiD;IACjD,OAAO,EAAE,YAAY,CAAC;IACtB,8DAA8D;IAC9D,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,yDAAyD;IACzD,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;GAEG;AACH,MAAM,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,8BAA8B,KAAK,SAAS,CAAC;AAE7F;;GAEG;AACH,MAAM,WAAW,6BAA6B;IAC5C,iFAAiF;IACjF,mBAAmB,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;IACxD;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,sEAAsE;IACtE,YAAY,CAAC,EAAE,yBAAyB,CAAC;CAC1C;AAID;;GAEG;AACH,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,+DAA+D;IAC/D,QAAQ,EAAE,wBAAwB,CAAC;CACpC;AAoGD;;;;;GAKG;AACH,qBAAa,sBAAuB,YAAW,YAAY,EAAE,qBAAqB;IAM9E,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAmE;IAChG,OAAO,CAAC,wBAAwB,CAAQ;gBAGrB,gBAAgB,EAAE,sBAAsB,EACxC,OAAO,GAAE,6BAAkC;IAW9D,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,GAAG,iBAAiB,CAAC;IAkE3E,sFAAsF;IACtF,qBAAqB,IAAI,IAAI;IAY7B,OAAO,CAAC,wBAAwB;IAmBhC,OAAO,CAAC,MAAM;IAiBd,OAAO,CAAC,mBAAmB;IAqC3B,OAAO,CAAC,kBAAkB;CAS3B;AAED;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,MAAM,EACZ,aAAa,EAAE,KAAK,CAAC,sBAAsB,CAAC,EAC5C,OAAO,GAAE,6BAAkC,GAC1C,wBAAwB,CAwB1B"}

package/dist/adapters/passport-js.js

@@ -1,3 +1,5 @@
+// allow: SIZE_OK — Keep the Passport.js action-binding state machine with its public bridge contracts for auditability.
+
 import { AuthenticationFailedError, AuthenticationRequiredError } from '../errors.js';
 import { normalizePrincipalScopes } from '../scope.js';
 
@@ -101,14 +103,26 @@ function isPromiseLike(value) {
 /**
  * A bridge strategy that allows using Passport.js strategies within the fluo
  * authentication framework.
+ *
+ * @throws {RangeError} When `actionTimeoutMs` is negative or non-finite.
  */
 export class PassportJsAuthStrategy {
-  requestState = new WeakMap();
+  actionTimeoutMs;
+  requestState = new Map();
+  acceptingAuthentications = true;
   constructor(strategyTemplate, options = {}) {
     this.strategyTemplate = strategyTemplate;
     this.options = options;
+    const actionTimeoutMs = options.actionTimeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS;
+    if (!Number.isFinite(actionTimeoutMs) || actionTimeoutMs < 0) {
+      throw new RangeError('Passport.js actionTimeoutMs must be a non-negative finite number.');
+    }
+    this.actionTimeoutMs = actionTimeoutMs;
   }
   authenticate(context) {
+    if (!this.acceptingAuthentications) {
+      return Promise.reject(new AuthenticationRequiredError('Passport strategy authentication was cancelled during application shutdown.'));
+    }
     const response = context.requestContext.response;
     const request = context.requestContext.request.raw ?? context.requestContext.request;
     const strategy = this.createExecutableStrategy();
@@ -131,14 +145,11 @@ export class PassportJsAuthStrategy {
         settled: false
       });
       this.bindStrategyActions(strategy);
-      const actionTimeoutMs = this.options.actionTimeoutMs ?? DEFAULT_ACTION_TIMEOUT_MS;
-      if (Number.isFinite(actionTimeoutMs) && actionTimeoutMs >= 0) {
-        actionTimeout = setTimeout(() => {
-          this.settle(strategy, state => {
-            state.reject(new AuthenticationRequiredError('Passport strategy did not settle authentication.'));
-          });
-        }, actionTimeoutMs);
-      }
+      actionTimeout = setTimeout(() => {
+        this.settle(strategy, state => {
+          state.reject(new AuthenticationRequiredError('Passport strategy did not settle authentication.'));
+        });
+      }, this.actionTimeoutMs);
       try {
         const result = strategy.authenticate(request, this.options.authenticateOptions);
         if (isPromiseLike(result)) {
@@ -155,11 +166,22 @@ export class PassportJsAuthStrategy {
           });
         }
       } catch (error) {
+        // no-excuse-ok: catch — convert synchronous strategy throws to promise rejection.
         clearActionTimeout();
         this.settle(strategy, () => reject(error));
       }
     });
   }
+
+  /** Cancels every unsettled Passport.js execution when application shutdown starts. */
+  onApplicationShutdown() {
+    this.acceptingAuthentications = false;
+    for (const strategy of this.requestState.keys()) {
+      this.settle(strategy, state => {
+        state.reject(new AuthenticationRequiredError('Passport strategy authentication was cancelled during application shutdown.'));
+      });
+    }
+  }
   createExecutableStrategy() {
     const template = this.strategyTemplate;
     const strategy = Object.create(Object.getPrototypeOf(this.strategyTemplate));
@@ -196,6 +218,7 @@ export class PassportJsAuthStrategy {
             user
           }));
         } catch (error) {
+          // no-excuse-ok: catch — convert mapper throws to authentication promise rejection.
           state.reject(error);
         }
       });

package/dist/bearer/bearer-jwt.d.ts

@@ -0,0 +1,90 @@
+import { type GuardContext } from '@fluojs/http';
+import { DefaultJwtVerifier } from '@fluojs/jwt';
+import type { AuthStrategy, AuthStrategyRegistration, AuthStrategyResult } from '../types.js';
+/**
+ * Identifies the built-in bearer JWT strategy in the `PassportModule` strategy registry.
+ *
+ * @remarks
+ * The name is intentionally `'jwt'` so existing routes stay on `@UseAuth('jwt')`
+ * when an application adopts the built-in preset instead of an application-owned
+ * bearer strategy.
+ */
+export declare const BEARER_JWT_STRATEGY_NAME = "jwt";
+/**
+ * Authenticates requests by verifying `Authorization: Bearer <token>` credentials.
+ *
+ * @remarks
+ * Credential extraction is strict and matches the documented preset contract:
+ * an absent or empty `Authorization` header (including an array-valued header
+ * whose first entry is empty) raises {@link AuthenticationRequiredError}; a
+ * wrong-scheme or malformed header raises {@link AuthenticationFailedError}.
+ * Credentials use the RFC 6750 `b64token` grammar: one or more ASCII letters,
+ * digits, `-`, `.`, `_`, `~`, `+`, or `/`, followed only by optional trailing
+ * `=` padding. Missing or malformed credentials set the bare
+ * `WWW-Authenticate: Bearer` challenge, while expired and invalid verifier
+ * failures set `WWW-Authenticate: Bearer error="invalid_token"`;
+ * an expired token raises {@link AuthenticationExpiredError} with the original
+ * `JwtExpiredTokenError` preserved as `cause`; an invalid token raises
+ * {@link AuthenticationFailedError} with the original `JwtInvalidTokenError`
+ * preserved as `cause`; JWT configuration and verifier-provider errors
+ * propagate unchanged. The Bearer scheme is matched case-insensitively per RFC
+ * 7235 and is separated from the token by one or more ASCII spaces. When an
+ * adapter surfaces an array-valued `Authorization` header, only the first entry
+ * is read.
+ *
+ * The strategy returns the normalized `JwtPrincipal` produced by
+ * `DefaultJwtVerifier.verifyAccessToken(...)` unchanged, so `subject`,
+ * `claims`, `issuer`, `audience`, `roles`, and `scopes` normalization stays
+ * owned by `@fluojs/jwt` and `AuthGuard` continues to write the principal to
+ * `requestContext.principal`.
+ *
+ * Register the class as a provider in the module that imports
+ * `PassportModule.forRoot(...)` (which also imports `JwtModule.forRoot(...)` so
+ * `DefaultJwtVerifier` resolves), and register its name with
+ * {@link createBearerJwtStrategyRegistration}.
+ *
+ * Use a custom `AuthStrategy` instead when the application needs token
+ * revocation, account-state checks, alternate extraction, or other
+ * application-owned policy beyond this contract.
+ */
+export declare class BearerJwtStrategy implements AuthStrategy {
+    private readonly verifier;
+    constructor(verifier: DefaultJwtVerifier);
+    authenticate(context: GuardContext): Promise<AuthStrategyResult>;
+}
+/**
+ * Creates the passport strategy registration for the built-in bearer JWT preset.
+ *
+ * @returns The named strategy registration consumed by `PassportModule.forRoot(...)`.
+ *
+ * @example
+ * ```ts
+ * import { Module } from '@fluojs/core';
+ * import { JwtModule } from '@fluojs/jwt';
+ * import {
+ *   BEARER_JWT_STRATEGY_NAME,
+ *   BearerJwtStrategy,
+ *   createBearerJwtStrategyRegistration,
+ *   PassportModule,
+ * } from '@fluojs/passport';
+ *
+ * @Module({
+ *   imports: [
+ *     JwtModule.forRoot({
+ *       algorithms: ['HS256'],
+ *       audience: 'my-app',
+ *       issuer: 'my-api',
+ *       secret: 'your-secure-secret',
+ *     }),
+ *     PassportModule.forRoot(
+ *       { defaultStrategy: BEARER_JWT_STRATEGY_NAME },
+ *       [createBearerJwtStrategyRegistration()],
+ *     ),
+ *   ],
+ *   providers: [BearerJwtStrategy],
+ * })
+ * export class AuthModule {}
+ * ```
+ */
+export declare function createBearerJwtStrategyRegistration(): AuthStrategyRegistration;
+//# sourceMappingURL=bearer-jwt.d.ts.map

package/dist/bearer/bearer-jwt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer-jwt.d.ts","sourceRoot":"","sources":["../../src/bearer/bearer-jwt.ts"],"names":[],"mappings":"AACA,OAAO,EAAoB,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAO7F,OAAO,KAAK,EAAE,YAAY,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAE9F;;;;;;;GAOG;AACH,eAAO,MAAM,wBAAwB,QAAQ,CAAC;AA8B9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,qBACa,iBAAkB,YAAW,YAAY;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,kBAAkB;IAEnD,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA+BvE;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,wBAAgB,mCAAmC,IAAI,wBAAwB,CAK9E"}

package/dist/bearer/bearer-jwt.js

@@ -0,0 +1,160 @@
+let _initClass;
+function _applyDecs(e, t, n, r, o, i) { var a, c, u, s, f, l, p, d = Symbol.metadata || Symbol.for("Symbol.metadata"), m = Object.defineProperty, h = Object.create, y = [h(null), h(null)], v = t.length; function g(t, n, r) { return function (o, i) { n && (i = o, o = e); for (var a = 0; a < t.length; a++) i = t[a].apply(o, r ? [i] : []); return r ? i : o; }; } function b(e, t, n, r) { if ("function" != typeof e && (r || void 0 !== e)) throw new TypeError(t + " must " + (n || "be") + " a function" + (r ? "" : " or undefined")); return e; } function applyDec(e, t, n, r, o, i, u, s, f, l, p) { function d(e) { if (!p(e)) throw new TypeError("Attempted to access private element on non-instance"); } var h = [].concat(t[0]), v = t[3], w = !u, D = 1 === o, S = 3 === o, j = 4 === o, E = 2 === o; function I(t, n, r) { return function (o, i) { return n && (i = o, o = e), r && r(o), P[t].call(o, i); }; } if (!w) { var P = {}, k = [], F = S ? "get" : j || D ? "set" : "value"; if (f ? (l || D ? P = { get: _setFunctionName(function () { return v(this); }, r, "get"), set: function (e) { t[4](this, e); } } : P[F] = v, l || _setFunctionName(P[F], r, E ? "" : F)) : l || (P = Object.getOwnPropertyDescriptor(e, r)), !l && !f) { if ((c = y[+s][r]) && 7 !== (c ^ o)) throw Error("Decorating two elements with the same name (" + P[F].name + ") is not supported yet"); y[+s][r] = o < 3 ? 1 : o; } } for (var N = e, O = h.length - 1; O >= 0; O -= n ? 2 : 1) { var T = b(h[O], "A decorator", "be", !0), z = n ? h[O - 1] : void 0, A = {}, H = { kind: ["field", "accessor", "method", "getter", "setter", "class"][o], name: r, metadata: a, addInitializer: function (e, t) { if (e.v) throw new TypeError("attempted to call addInitializer after decoration was finished"); b(t, "An initializer", "be", !0), i.push(t); }.bind(null, A) }; if (w) c = T.call(z, N, H), A.v = 1, b(c, "class decorators", "return") && (N = c);else if (H.static = s, H.private = f, c = H.access = { has: f ? p.bind() : function (e) { return r in e; } }, j || (c.get = f ? E ? function (e) { return d(e), P.value; } : I("get", 0, d) : function (e) { return e[r]; }), E || S || (c.set = f ? I("set", 0, d) : function (e, t) { e[r] = t; }), N = T.call(z, D ? { get: P.get, set: P.set } : P[F], H), A.v = 1, D) { if ("object" == typeof N && N) (c = b(N.get, "accessor.get")) && (P.get = c), (c = b(N.set, "accessor.set")) && (P.set = c), (c = b(N.init, "accessor.init")) && k.unshift(c);else if (void 0 !== N) throw new TypeError("accessor decorators must return an object with get, set, or init properties or undefined"); } else b(N, (l ? "field" : "method") + " decorators", "return") && (l ? k.unshift(N) : P[F] = N); } return o < 2 && u.push(g(k, s, 1), g(i, s, 0)), l || w || (f ? D ? u.splice(-1, 0, I("get", s), I("set", s)) : u.push(E ? P[F] : b.call.bind(P[F])) : m(e, r, P)), N; } function w(e) { return m(e, d, { configurable: !0, enumerable: !0, value: a }); } return void 0 !== i && (a = i[d]), a = h(null == a ? null : a), f = [], l = function (e) { e && f.push(g(e)); }, p = function (t, r) { for (var i = 0; i < n.length; i++) { var a = n[i], c = a[1], l = 7 & c; if ((8 & c) == t && !l == r) { var p = a[2], d = !!a[3], m = 16 & c; applyDec(t ? e : e.prototype, a, m, d ? "#" + p : _toPropertyKey(p), l, l < 2 ? [] : t ? s = s || [] : u = u || [], f, !!t, d, r, t && d ? function (t) { return _checkInRHS(t) === e; } : o); } } }, p(8, 0), p(0, 0), p(8, 1), p(0, 1), l(u), l(s), c = f, v || w(e), { e: c, get c() { var n = []; return v && [w(e = applyDec(e, [t], r, e.name, 5, n)), g(n, 1)]; } }; }
+function _toPropertyKey(t) { var i = _toPrimitive(t, "string"); return "symbol" == typeof i ? i : i + ""; }
+function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e = t[Symbol.toPrimitive]; if (void 0 !== e) { var i = e.call(t, r || "default"); if ("object" != typeof i) return i; throw new TypeError("@@toPrimitive must return a primitive value."); } return ("string" === r ? String : Number)(t); }
+function _setFunctionName(e, t, n) { "symbol" == typeof t && (t = (t = t.description) ? "[" + t + "]" : ""); try { Object.defineProperty(e, "name", { configurable: !0, value: n ? n + " " + t : t }); } catch (e) {} return e; }
+function _checkInRHS(e) { if (Object(e) !== e) throw TypeError("right-hand side of 'in' should be an object, got " + (null !== e ? typeof e : "null")); return e; }
+import { Inject } from '@fluojs/core';
+import { getRequestHeader } from '@fluojs/http';
+import { DefaultJwtVerifier, JwtExpiredTokenError, JwtInvalidTokenError } from '@fluojs/jwt';
+import { AuthenticationExpiredError, AuthenticationFailedError, AuthenticationRequiredError } from '../errors.js';
+/**
+ * Identifies the built-in bearer JWT strategy in the `PassportModule` strategy registry.
+ *
+ * @remarks
+ * The name is intentionally `'jwt'` so existing routes stay on `@UseAuth('jwt')`
+ * when an application adopts the built-in preset instead of an application-owned
+ * bearer strategy.
+ */
+export const BEARER_JWT_STRATEGY_NAME = 'jwt';
+const BEARER_CREDENTIAL = /^Bearer +([A-Za-z0-9\-._~+/]+=*)$/i;
+function isNonEmptyString(value) {
+  return typeof value === 'string' && value.length > 0;
+}
+function parseBearerCredential(authorization) {
+  return BEARER_CREDENTIAL.exec(authorization)?.[1];
+}
+function addBearerChallenge(context, value = 'Bearer') {
+  context.requestContext.response?.setHeader('WWW-Authenticate', value);
+}
+function readAuthorizationHeader(context) {
+  const value = getRequestHeader(context.requestContext.request, 'Authorization');
+  if (isNonEmptyString(value)) {
+    return value;
+  }
+  if (Array.isArray(value) && isNonEmptyString(value[0])) {
+    return value[0];
+  }
+  return undefined;
+}
+
+/**
+ * Authenticates requests by verifying `Authorization: Bearer <token>` credentials.
+ *
+ * @remarks
+ * Credential extraction is strict and matches the documented preset contract:
+ * an absent or empty `Authorization` header (including an array-valued header
+ * whose first entry is empty) raises {@link AuthenticationRequiredError}; a
+ * wrong-scheme or malformed header raises {@link AuthenticationFailedError}.
+ * Credentials use the RFC 6750 `b64token` grammar: one or more ASCII letters,
+ * digits, `-`, `.`, `_`, `~`, `+`, or `/`, followed only by optional trailing
+ * `=` padding. Missing or malformed credentials set the bare
+ * `WWW-Authenticate: Bearer` challenge, while expired and invalid verifier
+ * failures set `WWW-Authenticate: Bearer error="invalid_token"`;
+ * an expired token raises {@link AuthenticationExpiredError} with the original
+ * `JwtExpiredTokenError` preserved as `cause`; an invalid token raises
+ * {@link AuthenticationFailedError} with the original `JwtInvalidTokenError`
+ * preserved as `cause`; JWT configuration and verifier-provider errors
+ * propagate unchanged. The Bearer scheme is matched case-insensitively per RFC
+ * 7235 and is separated from the token by one or more ASCII spaces. When an
+ * adapter surfaces an array-valued `Authorization` header, only the first entry
+ * is read.
+ *
+ * The strategy returns the normalized `JwtPrincipal` produced by
+ * `DefaultJwtVerifier.verifyAccessToken(...)` unchanged, so `subject`,
+ * `claims`, `issuer`, `audience`, `roles`, and `scopes` normalization stays
+ * owned by `@fluojs/jwt` and `AuthGuard` continues to write the principal to
+ * `requestContext.principal`.
+ *
+ * Register the class as a provider in the module that imports
+ * `PassportModule.forRoot(...)` (which also imports `JwtModule.forRoot(...)` so
+ * `DefaultJwtVerifier` resolves), and register its name with
+ * {@link createBearerJwtStrategyRegistration}.
+ *
+ * Use a custom `AuthStrategy` instead when the application needs token
+ * revocation, account-state checks, alternate extraction, or other
+ * application-owned policy beyond this contract.
+ */
+let _BearerJwtStrategy;
+class BearerJwtStrategy {
+  static {
+    [_BearerJwtStrategy, _initClass] = _applyDecs(this, [Inject(DefaultJwtVerifier)], []).c;
+  }
+  constructor(verifier) {
+    this.verifier = verifier;
+  }
+  async authenticate(context) {
+    const authorization = readAuthorizationHeader(context);
+    if (!authorization) {
+      addBearerChallenge(context);
+      throw new AuthenticationRequiredError('Authorization header is required.');
+    }
+    const token = parseBearerCredential(authorization);
+    if (!token) {
+      addBearerChallenge(context);
+      throw new AuthenticationFailedError('Authorization header must use Bearer token format.');
+    }
+    try {
+      return await this.verifier.verifyAccessToken(token);
+    } catch (error) {
+      if (error instanceof JwtExpiredTokenError) {
+        addBearerChallenge(context, 'Bearer error="invalid_token"');
+        throw new AuthenticationExpiredError('Access token has expired.', {
+          cause: error
+        });
+      }
+      if (error instanceof JwtInvalidTokenError) {
+        addBearerChallenge(context, 'Bearer error="invalid_token"');
+        throw new AuthenticationFailedError('Access token verification failed.', {
+          cause: error
+        });
+      }
+      throw error;
+    }
+  }
+  static {
+    _initClass();
+  }
+}
+
+/**
+ * Creates the passport strategy registration for the built-in bearer JWT preset.
+ *
+ * @returns The named strategy registration consumed by `PassportModule.forRoot(...)`.
+ *
+ * @example
+ * ```ts
+ * import { Module } from '@fluojs/core';
+ * import { JwtModule } from '@fluojs/jwt';
+ * import {
+ *   BEARER_JWT_STRATEGY_NAME,
+ *   BearerJwtStrategy,
+ *   createBearerJwtStrategyRegistration,
+ *   PassportModule,
+ * } from '@fluojs/passport';
+ *
+ * @Module({
+ *   imports: [
+ *     JwtModule.forRoot({
+ *       algorithms: ['HS256'],
+ *       audience: 'my-app',
+ *       issuer: 'my-api',
+ *       secret: 'your-secure-secret',
+ *     }),
+ *     PassportModule.forRoot(
+ *       { defaultStrategy: BEARER_JWT_STRATEGY_NAME },
+ *       [createBearerJwtStrategyRegistration()],
+ *     ),
+ *   ],
+ *   providers: [BearerJwtStrategy],
+ * })
+ * export class AuthModule {}
+ * ```
+ */
+export { _BearerJwtStrategy as BearerJwtStrategy };
+export function createBearerJwtStrategyRegistration() {
+  return {
+    name: BEARER_JWT_STRATEGY_NAME,
+    token: _BearerJwtStrategy
+  };
+}

package/dist/cookie/cookie-auth-module.d.ts

@@ -1,8 +1,8 @@
 import type { Provider } from '@fluojs/di';
 import { type ModuleType } from '@fluojs/runtime';
+import type { AuthStrategyRegistration } from '../types.js';
 import { type CookieAuthOptions } from './cookie-auth.js';
 import { type CookieManagerConfig } from './cookie-manager.js';
-import type { AuthStrategyRegistration } from '../types.js';
 type CookieAuthModuleType = ModuleType;
 /**
  * Configures the built-in cookie-auth strategy and cookie manager preset.
@@ -40,6 +40,7 @@ export declare class CookieAuthModule {
      * @example
      * ```ts
      * import { Module } from '@fluojs/core';
+     * import { JwtModule } from '@fluojs/jwt';
      * import {
      *   CookieAuthModule,
      *   CookieAuthStrategy,
@@ -50,6 +51,11 @@ export declare class CookieAuthModule {
      * @Module({
      *   imports: [
      *     CookieAuthModule.forRoot(),
+     *     JwtModule.forRoot({
+     *       algorithms: ['HS256'],
+     *       global: true,
+     *       secret: 'your-secure-secret',
+     *     }),
      *     PassportModule.forRoot(
      *       { defaultStrategy: COOKIE_AUTH_STRATEGY_NAME },
      *       [{ name: COOKIE_AUTH_STRATEGY_NAME, token: CookieAuthStrategy }],

package/dist/cookie/cookie-auth-module.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-auth-module.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAEhE,OAAO,EAIL,KAAK,iBAAiB,EACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC9E,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAE5D,KAAK,oBAAoB,GAAG,UAAU,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAiBD;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,wBAAwB,CAK/E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG;IACvE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,wBAAwB,CAAC;CACpC,CAKA;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2BG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,oBAAoB;CAQtE"}
+{"version":3,"file":"cookie-auth-module.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAChE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAiB,KAAK,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAE9E,KAAK,oBAAoB,GAAG,UAAU,CAAC;AAEvC;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B,aAAa,CAAC,EAAE,mBAAmB,CAAC;CACrC;AAiBD;;;;GAIG;AACH,wBAAgB,oCAAoC,IAAI,wBAAwB,CAK/E;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG;IACvE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACtB,QAAQ,EAAE,wBAAwB,CAAC;CACpC,CAKA;AAED;;GAEG;AACH,qBAAa,gBAAgB;IAC3B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAiCG;IACH,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,sBAAsB,GAAG,oBAAoB;CAQtE"}

package/dist/cookie/cookie-auth-module.js

@@ -55,6 +55,7 @@ export class CookieAuthModule {
    * @example
    * ```ts
    * import { Module } from '@fluojs/core';
+   * import { JwtModule } from '@fluojs/jwt';
    * import {
    *   CookieAuthModule,
    *   CookieAuthStrategy,
@@ -65,6 +66,11 @@ export class CookieAuthModule {
    * @Module({
    *   imports: [
    *     CookieAuthModule.forRoot(),
+   *     JwtModule.forRoot({
+   *       algorithms: ['HS256'],
+   *       global: true,
+   *       secret: 'your-secure-secret',
+   *     }),
    *     PassportModule.forRoot(
    *       { defaultStrategy: COOKIE_AUTH_STRATEGY_NAME },
    *       [{ name: COOKIE_AUTH_STRATEGY_NAME, token: CookieAuthStrategy }],

package/dist/cookie/cookie-auth.d.ts

@@ -31,6 +31,12 @@ export declare function normalizeCookieAuthOptions(options?: CookieAuthOptions):
  * When `requireAccessToken` is `false`, missing cookies now resolve to an explicit
  * unauthenticated result. Protected routes still reject that result unless they opt in
  * with `@UseOptionalAuth(...)`.
+ *
+ * Verifier failures keep the documented typed-error classification: expired access
+ * tokens raise {@link AuthenticationExpiredError}, invalid access tokens raise
+ * {@link AuthenticationFailedError}, and missing or malformed cookies raise
+ * {@link AuthenticationRequiredError}. `AuthGuard` still responds with HTTP 401 for
+ * every variant while preserving the typed error as the cause.
  */
 export declare class CookieAuthStrategy implements AuthStrategy {
     private readonly verifier;

package/dist/cookie/cookie-auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-auth.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAGjD,OAAO,KAAK,EAAsB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAUxF;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,iBAAiB,CAInE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAMnG;AAED;;;;;;;GAOG;AACH,qBACa,kBAAmB,YAAW,YAAY;IAInD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAGnC,QAAQ,EAAE,kBAAkB,EAC7C,OAAO,CAAC,EAAE,iBAAiB;IAKvB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA6CvE;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAW,CAAC"}
+{"version":3,"file":"cookie-auth.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,kBAAkB,EAA8C,MAAM,aAAa,CAAC;AAO7F,OAAO,KAAK,EAAsB,YAAY,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAUxF;;GAEG;AACH,eAAO,MAAM,mBAAmB,eAAkD,CAAC;AAEnF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED;;GAEG;AACH,eAAO,MAAM,2BAA2B,EAAE,QAAQ,CAAC,iBAAiB,CAInE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,iBAAiB,GAAG,QAAQ,CAAC,iBAAiB,CAAC,CAMnG;AAED;;;;;;;;;;;;;GAaG;AACH,qBACa,kBAAmB,YAAW,YAAY;IAInD,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAH3B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;gBAGnC,QAAQ,EAAE,kBAAkB,EAC7C,OAAO,CAAC,EAAE,iBAAiB;IAKvB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;CAqDvE;AAED;;GAEG;AACH,eAAO,MAAM,yBAAyB,WAAW,CAAC"}

package/dist/cookie/cookie-auth.js

@@ -5,8 +5,8 @@ function _toPrimitive(t, r) { if ("object" != typeof t || !t) return t; var e =
 function _setFunctionName(e, t, n) { "symbol" == typeof t && (t = (t = t.description) ? "[" + t + "]" : ""); try { Object.defineProperty(e, "name", { configurable: !0, value: n ? n + " " + t : t }); } catch (e) {} return e; }
 function _checkInRHS(e) { if (Object(e) !== e) throw TypeError("right-hand side of 'in' should be an object, got " + (null !== e ? typeof e : "null")); return e; }
 import { Inject } from '@fluojs/core';
-import { DefaultJwtVerifier } from '@fluojs/jwt';
-import { AuthenticationRequiredError } from '../errors.js';
+import { DefaultJwtVerifier, JwtExpiredTokenError, JwtInvalidTokenError } from '@fluojs/jwt';
+import { AuthenticationExpiredError, AuthenticationFailedError, AuthenticationRequiredError } from '../errors.js';
 const unauthenticatedCookieAuthResult = {
   authenticated: false
 };
@@ -53,6 +53,12 @@ export function normalizeCookieAuthOptions(options) {
  * When `requireAccessToken` is `false`, missing cookies now resolve to an explicit
  * unauthenticated result. Protected routes still reject that result unless they opt in
  * with `@UseOptionalAuth(...)`.
+ *
+ * Verifier failures keep the documented typed-error classification: expired access
+ * tokens raise {@link AuthenticationExpiredError}, invalid access tokens raise
+ * {@link AuthenticationFailedError}, and missing or malformed cookies raise
+ * {@link AuthenticationRequiredError}. `AuthGuard` still responds with HTTP 401 for
+ * every variant while preserving the typed error as the cause.
  */
 let _CookieAuthStrategy;
 class CookieAuthStrategy {
@@ -94,8 +100,20 @@ class CookieAuthStrategy {
         subject: principal.subject
       };
     } catch (error) {
+      if (error instanceof JwtExpiredTokenError) {
+        throw new AuthenticationExpiredError('Access token has expired.', {
+          cause: error
+        });
+      }
+      if (error instanceof JwtInvalidTokenError) {
+        throw new AuthenticationFailedError('Access token is invalid.', {
+          cause: error
+        });
+      }
       if (error instanceof Error) {
-        throw new AuthenticationRequiredError(error.message);
+        throw new AuthenticationRequiredError(error.message, {
+          cause: error
+        });
       }
       throw new AuthenticationRequiredError('Access token verification failed.');
     }

package/dist/cookie/cookie-manager.d.ts

@@ -1,4 +1,4 @@
-import type { FrameworkResponse } from '@fluojs/http';
+import { type FrameworkResponse } from '@fluojs/http';
 import { type CookieAuthOptions } from './cookie-auth.js';
 /**
  * Describes the cookie options contract.
@@ -12,7 +12,13 @@ export interface CookieOptions {
     maxAge?: number;
 }
 /**
- * Describes the set cookie options contract.
+ * Describes the set cookie options contract accepted by {@link CookieManagerConfig}.
+ *
+ * @remarks
+ * `accessTokenTtlSeconds` and `refreshTokenTtlSeconds` become the default `Max-Age`
+ * for the matching token cookie when the positional TTL argument of
+ * `CookieManager.setAccessTokenCookie(...)` / `setRefreshTokenCookie(...)` is omitted.
+ * An explicit positional TTL always wins over these defaults.
  */
 export interface SetCookieOptions extends CookieOptions {
     accessTokenTtlSeconds?: number;
@@ -22,7 +28,10 @@ export interface SetCookieOptions extends CookieOptions {
  * Describes the cookie manager config contract.
  */
 export interface CookieManagerConfig extends CookieAuthOptions {
-    cookieOptions?: CookieOptions;
+    /**
+     * Response-cookie defaults, including optional per-token TTL defaults.
+     */
+    cookieOptions?: SetCookieOptions;
 }
 type NormalizedCookieOptions = Omit<Required<CookieOptions>, 'domain' | 'maxAge'> & Pick<CookieOptions, 'domain' | 'maxAge'>;
 /**
@@ -35,6 +44,8 @@ export declare const DEFAULT_COOKIE_OPTIONS: NormalizedCookieOptions;
 export declare class CookieManager {
     private readonly options;
     private readonly cookieOptions;
+    private readonly accessTokenTtlSeconds;
+    private readonly refreshTokenTtlSeconds;
     constructor(config?: CookieManagerConfig);
     setAccessTokenCookie(response: FrameworkResponse, token: string, ttlSeconds?: number): void;
     setRefreshTokenCookie(response: FrameworkResponse, token: string, ttlSeconds?: number): void;
@@ -42,7 +53,7 @@ export declare class CookieManager {
     clearRefreshTokenCookie(response: FrameworkResponse): void;
     clearAllCookies(response: FrameworkResponse): void;
     setAuthCookies(response: FrameworkResponse, accessToken: string, accessTokenTtlSeconds?: number, refreshToken?: string, refreshTokenTtlSeconds?: number): void;
-    private appendSetCookie;
+    private writeCookie;
 }
 /**
  * Create cookie manager.

package/dist/cookie/cookie-manager.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-manager.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAEtD,OAAO,EAAE,KAAK,iBAAiB,EAA8B,MAAM,kBAAkB,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D,aAAa,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,KAAK,uBAAuB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAC/E,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAE3C;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAOpC,CAAC;AA4DF;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;gBAE5C,MAAM,CAAC,EAAE,mBAAmB;IAYxC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa3F,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAa5F,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IASzD,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAS1D,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAKlD,cAAc,CACZ,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,MAAM,EACnB,qBAAqB,CAAC,EAAE,MAAM,EAC9B,YAAY,CAAC,EAAE,MAAM,EACrB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,IAAI;IAQP,OAAO,CAAC,eAAe;CAcxB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAE/E"}
+{"version":3,"file":"cookie-manager.d.ts","sourceRoot":"","sources":["../../src/cookie/cookie-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,iBAAiB,EAAa,MAAM,cAAc,CAAC;AAEjE,OAAO,EAAE,KAAK,iBAAiB,EAA8B,MAAM,kBAAkB,CAAC;AAEtF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACrC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAiB,SAAQ,aAAa;IACrD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,sBAAsB,CAAC,EAAE,MAAM,CAAC;CACjC;AAED;;GAEG;AACH,MAAM,WAAW,mBAAoB,SAAQ,iBAAiB;IAC5D;;OAEG;IACH,aAAa,CAAC,EAAE,gBAAgB,CAAC;CAClC;AAED,KAAK,uBAAuB,GAAG,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC,GAC/E,IAAI,CAAC,aAAa,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;AAQ3C;;GAEG;AACH,eAAO,MAAM,sBAAsB,EAAE,uBAOpC,CAAC;AAuBF;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA8B;IACtD,OAAO,CAAC,QAAQ,CAAC,aAAa,CAA0B;IACxD,OAAO,CAAC,QAAQ,CAAC,qBAAqB,CAAqB;IAC3D,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAqB;gBAEhD,MAAM,CAAC,EAAE,mBAAmB;IAcxC,oBAAoB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAQ3F,qBAAqB,CAAC,QAAQ,EAAE,iBAAiB,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI;IAQ5F,sBAAsB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAQzD,uBAAuB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAQ1D,eAAe,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAKlD,cAAc,CACZ,QAAQ,EAAE,iBAAiB,EAC3B,WAAW,EAAE,MAAM,EACnB,qBAAqB,CAAC,EAAE,MAAM,EAC9B,YAAY,CAAC,EAAE,MAAM,EACrB,sBAAsB,CAAC,EAAE,MAAM,GAC9B,IAAI;IAQP,OAAO,CAAC,WAAW;CA2BpB;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,CAAC,EAAE,mBAAmB,GAAG,aAAa,CAE/E"}