@furystack/rest-service 13.0.0 → 14.1.0

package/CHANGELOG.md

@@ -1,5 +1,129 @@
 # Changelog
 
+## [14.1.0] - 2026-05-21
+
+### ⬆️ Dependencies
+
+- Bump `ajv` to `^8.20.0`.
+- Bump dev `vitest` to `^4.1.5`.
+- Adds `@furystack/cross-node-bus` as a runtime dependency. Resolves to the in-process default bus unless an adapter is bound.
+- Bumped `@furystack/cache` to its new major version. The removed `obsoleteRange` / `removeRange` APIs are not used by `@furystack/rest-service`, so no source changes were required. See the `@furystack/cache` changelog for the migration if you import the cache directly alongside this package.
+- Added `@furystack/cache` as a runtime dependency (`workspace:^`). Used internally by `UserResolutionCache`; not part of `@furystack/rest-service`'s public API surface.
+- Bumped `ws` from `^8.20.0` to `^8.20.1` (dev dependency used in tests).
+- Bumped `@types/node` to `^25.9.1` and `vitest` to `^4.1.7`. Dev-tooling only.
+
+### 📚 Documentation
+
+- Rewrote JSDoc across the public API — built-in actions (`getCurrentUser`, `isAuthenticated`, `logout`, `passwordLoginAction`, `errorAction`, `notFoundAction`), `authenticate`, `authorize`, `validate`, `HttpAuthenticationSettings`, `HttpUserContext`, the login response strategy, and the request-action implementation — to follow the new value-test guidance: dropped restate-the-type narration, kept intent / trade-offs / constraints around session handling, validation, and error mapping.
+- Expanded `UserResolutionCache` JSDoc to cross-link `invalidateByUser` and document the multi-node trade-off.
+
+### ✨ Features
+
+### `IdentityEventBus` — cross-node identity invalidation
+
+A typed wrapper over `@furystack/cross-node-bus` that bridges the per-process `UserResolutionCache` to a shared bus, so logouts, role flips, password resets and account deletions invalidate cached identities on every node — not just the one that originated the change. Collapses the staleness window from `userCacheTtlMs` (default 30 s) to bus latency (single-digit ms with Redis pub/sub).
+
+```typescript
+import { IdentityEventBus } from '@furystack/rest-service'
+
+const bus = injector.get(IdentityEventBus)
+await bus.publish({ type: 'userRolesChanged', username: 'alice' })
+// → invalidates every cached entry that resolved to alice on this node
+//   AND every sibling node, synchronously locally and at bus speed remotely.
+```
+
+Supported event variants (`IdentityEvent`):
+
+- `userLoggedOut` / `sessionInvalidated` — drop the cache entry for a single session id.
+- `userRolesChanged` / `userDeleted` / `passwordChanged` — drop every cached entry that resolved to the named user, regardless of which session originally populated it.
+
+**Self-delivery contract:** `publish()` applies the matching local invalidation and fires local subscribers synchronously **before** awaiting the bus broadcast. Sibling nodes receive the message via a `subscribeRemoteOnly` bridge — own publishes never round-trip through the transport, so duplicate work is impossible.
+
+`HttpUserContext.cookieLogout` now broadcasts `userLoggedOut` on the bus instead of dropping the local cache directly. Apps that have not bound a transport adapter run against the in-process default `CrossNodeBus` and behave exactly as before.
+
+### `UserResolutionCache.invalidateByUser(username)`
+
+Drops every cached entry that resolved to `username`, backed by the cache's reverse tag index — no per-call O(n) scan. Use after role / password / account-state changes that must take effect immediately on the next request, instead of waiting for the TTL window to elapse.
+
+```typescript
+const userCache = injector.get(UserResolutionCache)
+userCache.invalidateByUser('alice')
+```
+
+For multi-node deployments, prefer publishing the corresponding `IdentityEvent` on `IdentityEventBus` — it calls `invalidateByUser` locally and on every sibling.
+
+### `identity-cache-keys` exports
+
+New module exporting the cache-key / cache-tag shapes shared by the cookie-auth provider, `UserResolutionCache`, and `IdentityEventBus`:
+
+- `SessionCacheKey` (type) — `` `cookie:${string}` ``.
+- `UserCacheTag` (type) — `` `user:${string}` ``.
+- `sessionCacheKey(sessionId)` — builds the cookie-auth cache key.
+- `userCacheTag(username)` — builds the user-resolution cache tag.
+
+Centralising these strings means the local-vs-replicated invalidation paths cannot drift.
+
+### Short-TTL user-resolution cache for `HttpUserContext`
+
+`HttpUserContext.getCurrentUser` now consults a singleton `UserResolutionCache` before walking the configured authentication providers. Successful resolutions are cached per-process under a key produced by the matching provider (e.g. session id for cookie auth) and expire after `HttpAuthenticationSettings.userCacheTtlMs` (default **30 000 ms**, capacity **10 000** entries).
+
+This bounds cross-instance staleness for out-of-band identity changes — session invalidation on a sibling node, role mutation in storage, etc. — while sharply cutting the auth-store load on chatty clients (every authenticated request used to walk the provider chain on every call).
+
+**New configuration on `HttpAuthenticationSettings`:**
+
+| Field               | Default | Effect                                                        |
+| ------------------- | ------- | ------------------------------------------------------------- |
+| `userCacheTtlMs`    | `30000` | TTL for cached `User` entries. `0` disables caching entirely. |
+| `userCacheCapacity` | `10000` | LRU capacity ceiling.                                         |
+
+### Cache-key contract on `AuthenticationProvider`
+
+Added an optional `getCacheKey?(request): string | null` method to `AuthenticationProvider`. Providers that opt in produce stable per-identity keys consumed by the user-resolution cache; providers that omit it (or return `null`) cause the request to bypass the cache.
+
+Built-in providers:
+
+- **`createCookieAuthProvider`** — keys requests by `cookie:${sessionId}`. Cache hits skip both the session-store and user-store lookups.
+- **`createBasicAuthProvider`** — intentionally does **not** opt in. Caching by username would skip password verification on every cache hit.
+- **`createJwtAuthProvider`** (in `@furystack/auth-jwt`) — also intentionally does **not** opt in. See the `@furystack/auth-jwt` changelog for the rationale (token expiry / revocation must be re-checked per request).
+
+### `UserResolutionCache` token
+
+Exported a new singleton DI token. Consumers can call `injector.get(UserResolutionCache).invalidate(cacheKey)` to drop a specific entry (e.g. after an out-of-band role mutation), or `invalidateAll()` to flush every entry.
+
+`HttpUserContext.cookieLogout` automatically invalidates the local cache entry for the logged-out session, so the very next request on the same node re-authenticates immediately. Sibling nodes still rely on TTL expiry.
+
+**Example — invalidate after an admin mutates roles in storage:**
+
+```typescript
+import { UserResolutionCache, UserDataSet } from '@furystack/rest-service'
+
+await injector.get(UserDataSet).update(injector, 'alice', { roles: ['admin'] })
+injector.get(UserResolutionCache).invalidate(`cookie:${sessionId}`)
+```
+
+### ♻️ Refactoring
+
+### `HttpUserContext` no longer maintains a per-request `WeakMap`
+
+The previous `WeakMap<headers, Promise<User>>` cache (per-`HttpUserContext`-instance) has been removed in favor of the shared `UserResolutionCache`. With the request-scoped HUC, the WeakMap was effectively single-shot per request anyway. Anonymous-style requests (no provider yields a key) now bypass the cache entirely instead of being dedup-cached for the lifetime of the HUC instance.
+
+## [14.0.0] - 2026-04-25
+
+### 💥 Breaking Changes
+
+Server managers are gone — every subsystem is now a DI token. See the [v7 migration guide](../../docs/migrations/v7-functional-di.md) for rationale, recipes, and pitfalls.
+
+- Removed the `ServerManager`, `ApiManager`, `StaticServerManager`, and `ProxyManager` classes. They are replaced by:
+  - `HttpServerPoolToken` — shared HTTP server pool (singleton).
+  - `ServerTelemetryToken` — event hub for `onApiRequestError`, `onProxyFailed`, `onWebSocketActionFailed`, `onWebSocketProxyFailed`. Subscribe via `injector.get(ServerTelemetryToken).subscribe(...)`.
+  - `HttpAuthenticationSettings` interface + token.
+  - `HttpUserContext` interface + token.
+- `useRestService` / `useHttpAuthentication` / `useStaticFiles` / `useProxy` keep their public shapes; internals are fully token-based.
+- Endpoint generators (`createGetCollectionEndpoint`, `createGetEntityEndpoint`, `createPostEndpoint`, `createPatchEndpoint`, `createDeleteEndpoint`) now take a `DataSetToken` from `@furystack/repository` instead of `{ model, primaryKey }`.
+- `UserStore` and `SessionStore` are throw-by-default. Apps must bind concrete persistent stores at bootstrap.
+- `HttpUserContext.user` is no longer a shared field. Per-request identity is stored in a `WeakMap<request.headers, Promise<User>>` so ancestor-cached instances don't leak identity across scopes.
+- `useHttpAuthentication` takes a `userDataSet: DataSetToken` — the old `getUserDataSet(injector)` / `getSessionDataSet(injector)` callbacks are gone.
+
 ## [13.0.0] - 2026-04-22
 
 ### 💥 Breaking Changes

package/README.md

@@ -19,8 +19,8 @@ Start by importing your custom API endpoint interface (see `@furystack/rest`) an
 Usage example – authenticated GET, GET collection, and POST APIs for a custom entity that has a physical store and repository set up:
 
 ```ts
-import { MyApi, MyEntity } from 'my-common-package'
-import { Injector } from '@furystack/inject'
+import { MyApi, MyEntity, MyEntityDataSet } from 'my-common-package'
+import { createInjector } from '@furystack/inject'
 import {
   createGetCollectionEndpoint,
   createGetEntityEndpoint,
@@ -30,7 +30,7 @@ import {
   useRestService,
 } from '@furystack/rest-service'
 
-const myInjector = new Injector()
+const myInjector = createInjector()
 useHttpAuthentication(myInjector)
 await useRestService<MyApi>({
   injector: myInjector,
@@ -45,20 +45,24 @@ await useRestService<MyApi>({
   api: {
     // Endpoints that can be called with GET HTTP method
     GET: {
-      '/my-entities': Authenticate()(createGetCollectionEndpoint({ model: MyEntity, primaryKey: 'id' })),
-      '/my-entities/:id': Authenticate()(createGetEntityEndpoint({ model: MyEntity, primaryKey: 'id' })),
+      '/my-entities': Authenticate()(createGetCollectionEndpoint(MyEntityDataSet)),
+      '/my-entities/:id': Authenticate()(createGetEntityEndpoint(MyEntityDataSet)),
     },
     // Endpoints that can be called with POST HTTP method
     POST: {
-      '/my-entities': Authenticate()(createPostEndpoint({ model: MyEntity, primaryKey: 'id' })),
+      '/my-entities': Authenticate()(createPostEndpoint(MyEntityDataSet)),
     },
   },
 })
 ```
 
-### Endpoint Generators (Based on Repository DataSets)
+Endpoint generators now take a `DataSetToken` directly. Define the token
+once with `defineDataSet` in a shared module and import it in both the
+server and any generators that need it.
+
+### Endpoint Generators (Based on DataSets)
 
-If you use the underlying layers of FuryStack (`PhysicalStore` -> `Repository`) for an entity type, you can easily create some CRUD endpoints for them. These include:
+If you use the underlying layers of FuryStack (`defineStore` → `defineDataSet`) for an entity type, you can easily create some CRUD endpoints for them. These include:
 
 - createDeleteEndpoint()
 - createGetCollectionEndpoint()
@@ -66,7 +70,7 @@ If you use the underlying layers of FuryStack (`PhysicalStore` -> `Repository`)
 - createPatchEndpoint()
 - createPostEndpoint()
 
-The endpoints will use the defined Physical Stores for retrieving entities and the Repository for authorization / event subscriptions.
+Each generator takes a `DataSetToken` and resolves it via the per-request injector. Authorization, hooks, and events configured on the DataSet apply transparently.
 
 ### Custom Endpoint Implementation
 
@@ -109,9 +113,10 @@ export interface MyApiWithCustomEndpoint extends RestApi {
 
 /** In the Backend code */
 
+import { createInjector } from '@furystack/inject'
 import { JsonResult, useRestService } from '@furystack/rest-service'
 
-const i = new Injector()
+const i = createInjector()
 
 await useRestService<MyApiWithCustomEndpoint>({
   injector: i,
@@ -139,7 +144,8 @@ await useRestService<MyApiWithCustomEndpoint>({
 
         console.log('The headers are:', headers) /** {foo: 'asd', bar: 2, baz: false} */
 
-        const currentUser = await injector.getCurrentUser() // Injector is scoped to the Request
+        const httpUser = injector.get(HttpUserContext) // Injector is scoped to the Request
+        const currentUser = await httpUser.getCurrentUser()
         console.log('The current user is:', currentUser)
 
         return JsonResult({ success: true }, 200)
@@ -208,21 +214,32 @@ In that way, you will get full validation for _all_ defined endpoint data (heade
 You can use the built-in authentication that comes with this package. It contains a session (~cookie) based authentication and Basic Auth. You can use it with the `useHttpAuthentication()` helper:
 
 ```ts
-import { useHttpAuthentication, useRestService } from '@furystack/rest-service'
-import { Injector } from '@furystack/inject'
-import { getDataSetFor } from '@furystack/repository'
+import { createInjector } from '@furystack/inject'
+import { useHttpAuthentication, useRestService, UserStore, SessionStore } from '@furystack/rest-service'
+// Persistent store factories and your app-specific DataSet tokens
+import { applicationUserStoreFactory, applicationSessionStoreFactory, ApplicationUserDataSet } from './my-app/stores.js'
+
+const myInjector = createInjector()
+
+// Wire persistent stores behind the throw-by-default tokens
+myInjector.bind(UserStore, applicationUserStoreFactory)
+myInjector.bind(SessionStore, applicationSessionStoreFactory)
 
-const myInjector = new Injector()
 useHttpAuthentication(myInjector, {
-  cookieName: 'sessionId', // The session ID will be stored in this cookie
-  enableBasicAuth: true, // Enables / disables standard Basic Authentication
-  model: ApplicationUserModel, // The custom User model. Should implement `User`
-  getUserDataSet: (injector) => getDataSetFor(injector, ApplicationUserModel, 'username'),
-  getSessionDataSet: (injector) => getDataSetFor(injector, MySessionModel, 'sessionId'),
+  cookieName: 'sessionId',
+  enableBasicAuth: true,
+  userDataSet: ApplicationUserDataSet,
 })
+
 await useRestService<MyApi>({ injector: myInjector, ...apiOptions })
 ```
 
+`useHttpAuthentication` binds the `HttpAuthenticationSettings` and
+`HttpUserContext` tokens. Your app is responsible for binding the
+`UserStore` / `SessionStore` tokens (which throw by default) to concrete
+persistent implementations, and for passing the `DataSetToken` that backs
+user lookups.
+
 ### Static File Serving
 
 You can serve static files using the `useStaticFiles` helper:
@@ -322,14 +339,14 @@ The proxy server acts as an intermediary, forwarding requests and responses whil
 
 **Error Handling and Monitoring:**
 
-The proxy emits events when requests fail, allowing you to monitor and log errors:
+Proxy failures are routed through the `ServerTelemetryToken`, which is a
+singleton event hub shared by every `useXxx` helper in this package:
 
 ```ts
-import { ProxyManager } from '@furystack/rest-service'
+import { ServerTelemetryToken } from '@furystack/rest-service'
 
-// Set up error monitoring
-const proxyManager = injector.getInstance(ProxyManager)
-proxyManager.subscribe('onProxyFailed', ({ from, to, error }) => {
+const telemetry = injector.get(ServerTelemetryToken)
+telemetry.subscribe('onProxyFailed', ({ from, to, error }) => {
   console.error(`Proxy failed: ${from} -> ${to}`, error)
   // Send to your logging service
 })
@@ -369,11 +386,13 @@ When enabled, the proxy will forward WebSocket upgrade requests to the target se
 - Timeout configuration (applies to upgrade handshake)
 - Error monitoring via `onWebSocketProxyFailed` events
 
-Monitor WebSocket proxy errors:
+Monitor WebSocket proxy errors via the same telemetry token:
 
 ```ts
-const proxyManager = injector.getInstance(ProxyManager)
-proxyManager.subscribe('onWebSocketProxyFailed', ({ from, to, error }) => {
+import { ServerTelemetryToken } from '@furystack/rest-service'
+
+const telemetry = injector.get(ServerTelemetryToken)
+telemetry.subscribe('onWebSocketProxyFailed', ({ from, to, error }) => {
   console.error(`WebSocket proxy failed: ${from} -> ${to}`, error)
 })
 ```

package/esm/actions/error-action.d.ts

@@ -1,7 +1,12 @@
 import type { RequestAction } from '../request-action-implementation.js';
 /**
- * Action for unhandled (500) errors
- * Returns a serialized error instance in JSON format.
+ * Default error handler. Maps thrown errors to HTTP responses:
+ *
+ * - {@link SchemaValidationError} → 400 with `{ message, errors }`
+ * - {@link RequestError} → its `responseCode` with `{ message }`
+ * - {@link AuthorizationError} → 403 with `{ message }`
+ * - other `Error` → 500 with `{ message }`
+ * - non-Error throwables → 500 with a generic message
  */
 export declare const ErrorAction: RequestAction<{
     body: unknown;

package/esm/actions/error-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"error-action.d.ts","sourceRoot":"","sources":["../../src/actions/error-action.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAIxE;;;GAGG;AAEH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC;IACtC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5B,CAoBA,CAAA"}
+{"version":3,"file":"error-action.d.ts","sourceRoot":"","sources":["../../src/actions/error-action.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAIxE;;;;;;;;GAQG;AACH,eAAO,MAAM,WAAW,EAAE,aAAa,CAAC;IACtC,IAAI,EAAE,OAAO,CAAA;IACb,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5B,CAoBA,CAAA"}

package/esm/actions/error-action.js

@@ -3,8 +3,13 @@ import { AuthorizationError } from '@furystack/core';
 import { JsonResult } from '../request-action-implementation.js';
 import { SchemaValidationError } from '../schema-validator/schema-validation-error.js';
 /**
- * Action for unhandled (500) errors
- * Returns a serialized error instance in JSON format.
+ * Default error handler. Maps thrown errors to HTTP responses:
+ *
+ * - {@link SchemaValidationError} → 400 with `{ message, errors }`
+ * - {@link RequestError} → its `responseCode` with `{ message }`
+ * - {@link AuthorizationError} → 403 with `{ message }`
+ * - other `Error` → 500 with `{ message }`
+ * - non-Error throwables → 500 with a generic message
  */
 export const ErrorAction = async ({ getBody }) => {
     const body = await getBody();

package/esm/actions/error-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"error-action.js","sourceRoot":"","sources":["../../src/actions/error-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AAEtF;;;GAGG;AAEH,MAAM,CAAC,MAAM,WAAW,GAGnB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAA;IAE5B,IAAI,IAAI,YAAY,qBAAqB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,IAAI,YAAY,YAAY,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,IAAI,YAAY,kBAAkB,EAAE,CAAC;QACvC,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAA;AACrE,CAAC,CAAA"}
+{"version":3,"file":"error-action.js","sourceRoot":"","sources":["../../src/actions/error-action.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAC9C,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAA;AAEpD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAChE,OAAO,EAAE,qBAAqB,EAAE,MAAM,gDAAgD,CAAA;AAEtF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,WAAW,GAGnB,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;IACzB,MAAM,IAAI,GAAG,MAAM,OAAO,EAAE,CAAA;IAE5B,IAAI,IAAI,YAAY,qBAAqB,EAAE,CAAC;QAC1C,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,GAAG,CAAC,CAAA;IACxE,CAAC;IAED,IAAI,IAAI,YAAY,YAAY,EAAE,CAAC;QACjC,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,YAAY,CAAC,CAAA;IACjE,CAAC;IAED,IAAI,IAAI,YAAY,kBAAkB,EAAE,CAAC;QACvC,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,IAAI,IAAI,YAAY,KAAK,EAAE,CAAC;QAC1B,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAA;IACnD,CAAC;IAED,OAAO,UAAU,CAAC,EAAE,OAAO,EAAE,8BAA8B,EAAE,EAAE,GAAG,CAAC,CAAA;AACrE,CAAC,CAAA"}

package/esm/actions/get-current-user.d.ts

@@ -1,9 +1,6 @@
 import type { User } from '@furystack/core';
 import type { RequestAction } from '../request-action-implementation.js';
-/**
- * Action that returns the current authenticated user
- * @param injector The injector from the current stack
- */
+/** Returns the current authenticated user; 401 if no user is bound. */
 export declare const GetCurrentUser: RequestAction<{
     result: User;
 }>;

package/esm/actions/get-current-user.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"get-current-user.d.ts","sourceRoot":"","sources":["../../src/actions/get-current-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC;IACzC,MAAM,EAAE,IAAI,CAAA;CACb,CAGC,CAAA"}
+{"version":3,"file":"get-current-user.d.ts","sourceRoot":"","sources":["../../src/actions/get-current-user.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAA;AAG3C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE,uEAAuE;AACvE,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC;IACzC,MAAM,EAAE,IAAI,CAAA;CACb,CAGC,CAAA"}

package/esm/actions/get-current-user.js

@@ -1,10 +1,7 @@
 import { getCurrentUser } from '@furystack/core';
 import { Authenticate } from '../authenticate.js';
 import { JsonResult } from '../request-action-implementation.js';
-/**
- * Action that returns the current authenticated user
- * @param injector The injector from the current stack
- */
+/** Returns the current authenticated user; 401 if no user is bound. */
 export const GetCurrentUser = Authenticate()(async ({ injector }) => {
     const user = await getCurrentUser(injector);
     return JsonResult(user);

package/esm/actions/get-current-user.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-current-user.js","sourceRoot":"","sources":["../../src/actions/get-current-user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAEtB,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAC,CAAA"}
+{"version":3,"file":"get-current-user.js","sourceRoot":"","sources":["../../src/actions/get-current-user.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAA;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE,uEAAuE;AACvE,MAAM,CAAC,MAAM,cAAc,GAEtB,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IACzC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC,CAAC,CAAA"}

package/esm/actions/get-current-user.spec.js

@@ -1,15 +1,19 @@
-import { Injector } from '@furystack/inject';
+import { IdentityContext } from '@furystack/core';
+import { createInjector } from '@furystack/inject';
 import { usingAsync } from '@furystack/utils';
+import { describe, expect, it } from 'vitest';
 import { GetCurrentUser } from './get-current-user.js';
-import { IdentityContext } from '@furystack/core';
-import { describe, it, expect } from 'vitest';
 describe('getCurrentUser', () => {
     const request = { url: 'https://google.com' };
     const response = {};
-    it('exec', async () => {
+    it('returns the current user in a JSON result', async () => {
         const testUser = { Name: 'Userke' };
-        await usingAsync(new Injector(), async (i) => {
-            i.setExplicitInstance({ getCurrentUser: async () => testUser, isAuthenticated: async () => true }, IdentityContext);
+        await usingAsync(createInjector(), async (i) => {
+            i.bind(IdentityContext, () => ({
+                getCurrentUser: () => Promise.resolve(testUser),
+                isAuthenticated: () => Promise.resolve(true),
+                isAuthorized: () => Promise.resolve(true),
+            }));
             const result = await GetCurrentUser({ injector: i, request, response });
             expect(result.statusCode).toBe(200);
             expect(result.chunk).toEqual(testUser);

package/esm/actions/get-current-user.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"get-current-user.spec.js","sourceRoot":"","sources":["../../src/actions/get-current-user.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IAErC,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACpB,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QACnC,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,CAAC,CAAC,mBAAmB,CACnB,EAAE,cAAc,EAAE,KAAK,IAAI,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAC3E,eAAe,CAChB,CAAA;YACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"get-current-user.spec.js","sourceRoot":"","sources":["../../src/actions/get-current-user.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAEtD,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IAErC,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAA;QACnC,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7B,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAiB,CAAC;gBACxD,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;aAC1C,CAAC,CAAC,CAAA;YACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;YACvE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/esm/actions/is-authenticated.d.ts

@@ -1,9 +1,8 @@
 import type { RequestAction } from '../request-action-implementation.js';
 /**
- * Action that returns if the current user is authenticated
- * @param options The options for the Custom Action
- * @param options.injector The Injector from the current context
- * @returns A standard authentication result
+ * Returns `{ isAuthenticated: boolean }`. Unauthenticated callers receive
+ * a 200 with `false` rather than a 401 — use this when the client needs to
+ * branch on auth state without triggering a re-login flow.
  */
 export declare const IsAuthenticated: RequestAction<{
     result: {

package/esm/actions/is-authenticated.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"is-authenticated.d.ts","sourceRoot":"","sources":["../../src/actions/is-authenticated.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAGnF,CAAA"}
+{"version":3,"file":"is-authenticated.d.ts","sourceRoot":"","sources":["../../src/actions/is-authenticated.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;;;GAIG;AACH,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE;QAAE,eAAe,EAAE,OAAO,CAAA;KAAE,CAAA;CAAE,CAGnF,CAAA"}

package/esm/actions/is-authenticated.js

@@ -1,10 +1,9 @@
 import { isAuthenticated } from '@furystack/core';
 import { JsonResult } from '../request-action-implementation.js';
 /**
- * Action that returns if the current user is authenticated
- * @param options The options for the Custom Action
- * @param options.injector The Injector from the current context
- * @returns A standard authentication result
+ * Returns `{ isAuthenticated: boolean }`. Unauthenticated callers receive
+ * a 200 with `false` rather than a 401 — use this when the client needs to
+ * branch on auth state without triggering a re-login flow.
  */
 export const IsAuthenticated = async ({ injector }) => {
     const isAuthenticatedResult = await isAuthenticated(injector);

package/esm/actions/is-authenticated.js.map

@@ -1 +1 @@
-{"version":3,"file":"is-authenticated.js","sourceRoot":"","sources":["../../src/actions/is-authenticated.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4D,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC7G,MAAM,qBAAqB,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC7D,OAAO,UAAU,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC/D,CAAC,CAAA"}
+{"version":3,"file":"is-authenticated.js","sourceRoot":"","sources":["../../src/actions/is-authenticated.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AAEjD,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE;;;;GAIG;AACH,MAAM,CAAC,MAAM,eAAe,GAA4D,KAAK,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC7G,MAAM,qBAAqB,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC,CAAA;IAC7D,OAAO,UAAU,CAAC,EAAE,eAAe,EAAE,qBAAqB,EAAE,CAAC,CAAA;AAC/D,CAAC,CAAA"}

package/esm/actions/is-authenticated.spec.js

@@ -1,14 +1,18 @@
-import { Injector } from '@furystack/inject';
+import { IdentityContext } from '@furystack/core';
+import { createInjector } from '@furystack/inject';
 import { usingAsync } from '@furystack/utils';
+import { describe, expect, it } from 'vitest';
 import { IsAuthenticated } from './is-authenticated.js';
-import { IdentityContext } from '@furystack/core';
-import { describe, it, expect } from 'vitest';
 describe('isAuthenticated', () => {
     const request = { url: 'https://google.com' };
     const response = {};
-    it('exec', async () => {
-        await usingAsync(new Injector(), async (i) => {
-            i.setExplicitInstance({ isAuthenticated: async () => true }, IdentityContext);
+    it('returns the authentication status from the identity context', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            i.bind(IdentityContext, () => ({
+                isAuthenticated: () => Promise.resolve(true),
+                isAuthorized: () => Promise.resolve(true),
+                getCurrentUser: () => Promise.reject(new Error('not needed')),
+            }));
             const result = await IsAuthenticated({ injector: i, request, response });
             expect(result.statusCode).toBe(200);
             expect(result.chunk).toEqual({ isAuthenticated: true });

package/esm/actions/is-authenticated.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"is-authenticated.spec.js","sourceRoot":"","sources":["../../src/actions/is-authenticated.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE7C,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IACrC,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACpB,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,CAAC,CAAC,mBAAmB,CAAC,EAAE,eAAe,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,eAAe,CAAC,CAAA;YAC7E,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"is-authenticated.spec.js","sourceRoot":"","sources":["../../src/actions/is-authenticated.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AAEvD,QAAQ,CAAC,iBAAiB,EAAE,GAAG,EAAE;IAC/B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IAErC,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC7B,eAAe,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBAC5C,YAAY,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;gBACzC,cAAc,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;aAC9D,CAAC,CAAC,CAAA;YACH,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAA;YACxE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAA;QACzD,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/esm/actions/logout-action.spec.js

@@ -1,21 +1,23 @@
-import { Injector } from '@furystack/inject';
+import { createInjector } from '@furystack/inject';
+import { EventHub } from '@furystack/utils';
 import { usingAsync } from '@furystack/utils';
 import { describe, expect, it, vi } from 'vitest';
-import { HttpUserContext } from '../http-user-context.js';
+import { HttpUserContext as HttpUserContextToken } from '../http-user-context.js';
 import { LogoutAction } from './logout.js';
 describe('LogoutAction', () => {
     const request = { url: 'https://google.com' };
     const response = {};
-    it('exec', async () => {
-        await usingAsync(new Injector(), async (i) => {
-            const cookieLogout = vi.fn(async () => true);
-            i.setExplicitInstance({
-                cookieLogout,
-            }, HttpUserContext);
+    it('delegates to HttpUserContext.cookieLogout and returns an empty result', async () => {
+        await usingAsync(createInjector(), async (i) => {
+            const cookieLogout = vi.fn(async () => {
+                /* noop */
+            });
+            const stub = Object.assign(new EventHub(), { cookieLogout });
+            i.bind(HttpUserContextToken, () => stub);
             const result = await LogoutAction({ request, response, injector: i });
             expect(result.statusCode).toBe(200);
             expect(result.chunk).toBe(undefined);
-            expect(cookieLogout).toBeCalled();
+            expect(cookieLogout).toHaveBeenCalled();
         });
     });
 });

package/esm/actions/logout-action.spec.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout-action.spec.js","sourceRoot":"","sources":["../../src/actions/logout-action.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAA;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IAErC,EAAE,CAAC,MAAM,EAAE,KAAK,IAAI,EAAE;QACpB,MAAM,UAAU,CAAC,IAAI,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC3C,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAA;YAC5C,CAAC,CAAC,mBAAmB,CACnB;gBACE,YAAY;aACb,EACD,eAAe,CAChB,CAAA;YAED,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpC,MAAM,CAAC,YAAY,CAAC,CAAC,UAAU,EAAE,CAAA;QACnC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}
+{"version":3,"file":"logout-action.spec.js","sourceRoot":"","sources":["../../src/actions/logout-action.spec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAA;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAA;AAE7C,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAA;AAEjD,OAAO,EAAE,eAAe,IAAI,oBAAoB,EAAE,MAAM,yBAAyB,CAAA;AACjF,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE;IAC5B,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,oBAAoB,EAAqB,CAAA;IAChE,MAAM,QAAQ,GAAG,EAAoB,CAAA;IAErC,EAAE,CAAC,uEAAuE,EAAE,KAAK,IAAI,EAAE;QACrF,MAAM,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;YAC7C,MAAM,YAAY,GAAG,EAAE,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE;gBACpC,UAAU;YACZ,CAAC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,CAA+B,CAAA;YAC1F,CAAC,CAAC,IAAI,CAAC,oBAAoB,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAA;YAExC,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAA;YACrE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;YACpC,MAAM,CAAC,YAAY,CAAC,CAAC,gBAAgB,EAAE,CAAA;QACzC,CAAC,CAAC,CAAA;IACJ,CAAC,CAAC,CAAA;AACJ,CAAC,CAAC,CAAA"}

package/esm/actions/logout.d.ts

@@ -1,11 +1,7 @@
 import type { RequestAction } from '../request-action-implementation.js';
 /**
- * Action that logs out the current user
- * @param root0 The Options object
- * @param root0.injector The injector from the context
- * @param root0.request The current Request object
- * @param root0.response The Response object
- * @returns An empty result that indicates the success
+ * Logs out via {@link HttpUserContext.cookieLogout} — clears the session
+ * cookie and removes the session row from the session DataSet.
  */
 export declare const LogoutAction: RequestAction<{
     result: unknown;

package/esm/actions/logout.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/actions/logout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAG3D,CAAA"}
+{"version":3,"file":"logout.d.ts","sourceRoot":"","sources":["../../src/actions/logout.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;;GAGG;AACH,eAAO,MAAM,YAAY,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,OAAO,CAAA;CAAE,CAG3D,CAAA"}

package/esm/actions/logout.js

@@ -1,15 +1,11 @@
 import { HttpUserContext } from '../http-user-context.js';
 import { EmptyResult } from '../request-action-implementation.js';
 /**
- * Action that logs out the current user
- * @param root0 The Options object
- * @param root0.injector The injector from the context
- * @param root0.request The current Request object
- * @param root0.response The Response object
- * @returns An empty result that indicates the success
+ * Logs out via {@link HttpUserContext.cookieLogout} — clears the session
+ * cookie and removes the session row from the session DataSet.
  */
 export const LogoutAction = async ({ injector, request, response }) => {
-    await injector.getInstance(HttpUserContext).cookieLogout(request, response);
+    await injector.get(HttpUserContext).cookieLogout(request, response);
     return EmptyResult();
 };
 //# sourceMappingURL=logout.js.map

package/esm/actions/logout.js.map

@@ -1 +1 @@
-{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/actions/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAuC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;IACxG,MAAM,QAAQ,CAAC,WAAW,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC3E,OAAO,WAAW,EAAE,CAAA;AACtB,CAAC,CAAA"}
+{"version":3,"file":"logout.js","sourceRoot":"","sources":["../../src/actions/logout.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAEzD,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAA;AAEjE;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAuC,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE;IACxG,MAAM,QAAQ,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IACnE,OAAO,WAAW,EAAE,CAAA;AACtB,CAAC,CAAA"}

package/esm/actions/not-found-action.d.ts

@@ -1,7 +1,5 @@
 import type { RequestAction } from '../request-action-implementation.js';
-/**
- * @returns The standard Not Found action result
- */
+/** Default `404` action. Returns `{ error: 'Content not found' }`. */
 export declare const NotFoundAction: RequestAction<{
     result: {
         error: string;

package/esm/actions/not-found-action.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"not-found-action.d.ts","sourceRoot":"","sources":["../../src/actions/not-found-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE;;GAEG;AACH,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvE,CAAA"}
+{"version":3,"file":"not-found-action.d.ts","sourceRoot":"","sources":["../../src/actions/not-found-action.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qCAAqC,CAAA;AAGxE,sEAAsE;AACtE,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAOvE,CAAA"}

package/esm/actions/not-found-action.js

@@ -1,7 +1,5 @@
 import { JsonResult } from '../request-action-implementation.js';
-/**
- * @returns The standard Not Found action result
- */
+/** Default `404` action. Returns `{ error: 'Content not found' }`. */
 export const NotFoundAction = async () => {
     return JsonResult({
         error: 'Content not found',

package/esm/actions/not-found-action.js.map

@@ -1 +1 @@
-{"version":3,"file":"not-found-action.js","sourceRoot":"","sources":["../../src/actions/not-found-action.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE;;GAEG;AACH,MAAM,CAAC,MAAM,cAAc,GAAiD,KAAK,IAAI,EAAE;IACrF,OAAO,UAAU,CACf;QACE,KAAK,EAAE,mBAAmB;KAC3B,EACD,GAAG,CACJ,CAAA;AACH,CAAC,CAAA"}
+{"version":3,"file":"not-found-action.js","sourceRoot":"","sources":["../../src/actions/not-found-action.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,qCAAqC,CAAA;AAEhE,sEAAsE;AACtE,MAAM,CAAC,MAAM,cAAc,GAAiD,KAAK,IAAI,EAAE;IACrF,OAAO,UAAU,CACf;QACE,KAAK,EAAE,mBAAmB;KAC3B,EACD,GAAG,CACJ,CAAA;AACH,CAAC,CAAA"}