@happyvertical/smrt-users 0.53.3 → 0.54.0

package/dist/sveltekit/device-credential-handlers.d.ts

@@ -0,0 +1,60 @@
+/**
+ * SvelteKit glue for {@link DeviceCredentialService} (#3276).
+ *
+ * ```ts
+ * // src/lib/server/device-auth.ts
+ * import { createDeviceCredentialHandlers } from '@happyvertical/smrt-users/sveltekit';
+ *
+ * export const deviceAuth = createDeviceCredentialHandlers({
+ *   db: { type: 'postgres', url: DATABASE_URL },
+ *   pin: { pepper: PIN_PEPPER },
+ *   assertEnrolledDevice: async (device) => (await devices.findActiveByUserId(device.user.id)) !== null,
+ * });
+ *
+ * // routes/api/device/pin/sign-in/+server.ts  → export const POST = deviceAuth.pinSignIn;
+ * // routes/api/device/sign-out/+server.ts     → export const POST = deviceAuth.signOut;
+ * // routes/api/device/pin/+server.ts          → export const PUT = deviceAuth.setPin;
+ * //                                              export const DELETE = deviceAuth.clearPin;
+ * // routes/api/device/pin/reset/+server.ts    → export const POST = deviceAuth.resetPin;
+ * ```
+ *
+ * Wire contract:
+ *
+ * - `pinSignIn`: `Authorization: Bearer <device token>` + JSON `{ userId, pin }`
+ *   → 201 `{ sessionId, userId, tenantId, authMethod, expiresAt, mustReset }`;
+ *   401 `{ error, code: 'invalid_credentials' }` for every refusal that is not
+ *   a rate limit (not a device, inactive device, unknown user, wrong PIN, no
+ *   membership); 429 + `Retry-After` when the budget is exhausted.
+ * - `signOut`: `Authorization: Bearer <person token>` → 200 `{ authenticated: false }`
+ *   always (does not reveal whether the token was live). Ends only the
+ *   person's session.
+ * - `setPin` / `resetPin` / `clearPin`: act as the `Authorization: Bearer`
+ *   session when present (resolved here), else as the session
+ *   the host's hook put in `event.locals` (which must include `authMethod` —
+ *   `createSessionHandler` does), JSON
+ *   `{ userId, pin, currentPin? }`; 204 on success, 400 on policy, 403 when
+ *   the actor may not manage that PIN, 429 on a rate-limited current-PIN
+ *   check.
+ *
+ * @packageDocumentation
+ */
+import '../__smrt-register__.js';
+import { DeviceCredentialService, type DeviceCredentialServiceOptions } from '../services/DeviceCredentialService.js';
+type RequestEvent = {
+    getClientAddress?: () => string;
+    locals?: Record<string, unknown>;
+    request: Request;
+    url: URL;
+};
+export interface DeviceCredentialHandlers {
+    pinSignIn: (event: RequestEvent) => Promise<Response>;
+    signOut: (event: RequestEvent) => Promise<Response>;
+    setPin: (event: RequestEvent) => Promise<Response>;
+    resetPin: (event: RequestEvent) => Promise<Response>;
+    clearPin: (event: RequestEvent) => Promise<Response>;
+    /** The lazily created service, for hosts that add their own verifiers. */
+    service: () => Promise<DeviceCredentialService>;
+}
+export declare function createDeviceCredentialHandlers(options: DeviceCredentialServiceOptions): DeviceCredentialHandlers;
+export {};
+//# sourceMappingURL=device-credential-handlers.d.ts.map

package/dist/sveltekit/device-credential-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-credential-handlers.d.ts","sourceRoot":"","sources":["../../src/sveltekit/device-credential-handlers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAGH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,EAIL,uBAAuB,EACvB,KAAK,8BAA8B,EACpC,MAAM,wCAAwC,CAAC;AAMhD,KAAK,YAAY,GAAG;IAClB,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AA8GF,MAAM,WAAW,wBAAwB;IACvC,SAAS,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,QAAQ,EAAE,CAAC,KAAK,EAAE,YAAY,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrD,0EAA0E;IAC1E,OAAO,EAAE,MAAM,OAAO,CAAC,uBAAuB,CAAC,CAAC;CACjD;AAED,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,8BAA8B,GACtC,wBAAwB,CAwH1B"}

package/dist/sveltekit/index.d.ts

@@ -18,11 +18,13 @@
 import '../__smrt-register__.js';
 import type { SmrtClassOptions } from '@happyvertical/smrt-core';
 import type { OidcProfileOwnerAuthorizer, OidcProfileResolver } from '../collections/UserCollection.js';
+import { type SessionAuthMethod } from '../models/Session.js';
 import { type OidcLoginResult, type OidcProviderResolutionOptions, type OidcTransaction } from '../services/OidcLoginService.js';
 import { TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, type TerminalAuthServiceOptions } from '../services/TerminalAuthService.js';
 export { type AppResultContract, type AppResultMetadata, type CommandRequirements, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, type DeclaredActionField, type DiscoveryArtifactIntegrity, DiscoveryArtifactValidationError, type DiscoveryConformanceArtifact, type DiscoveryPayload, deriveCommandRequirements, type JsonValue, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, validateDiscoveryConformanceArtifact, } from '../app-contract.js';
 export type { NormalizedOidcClaims, OidcProfileOwnerAuthorization, OidcProfileOwnerAuthorizer, OidcProfileOwnerAuthorizerContext, OidcProfileResolver, OidcProfileResolverContext, } from '../collections/UserCollection.js';
 export { MobileAuthError, type MobileAuthErrorCode, MobileAuthService, type MobileAuthServiceOptions, type MobileBootstrapContext, type MobileLoginContext, type MobileLogoutResult, type MobileRequestMeta, type MobileResolvedUser, type MobileTenantContext, readMobileBearerToken, validateMobileRedirectUri, } from '../services/MobileAuthService.js';
+export { createDeviceCredentialHandlers, type DeviceCredentialHandlers, } from './device-credential-handlers.js';
 export { type CreateMobileAuthHandlersOptions, createMobileAuthHandlers, type MobileAuthHandlers, type MobileRequestEvent, type MobileRequestHandler, resolveMobileUploadDedupKey, } from './mobile-handlers.js';
 export { type CliResource, type CommandDefinition, type CommandKind, type CommandPolicyContext, type CommandScope, type CreateResourceListHandlerOptions, createResourceListHandler, InvalidBearerError, type ResolvedSession, type ResourceListResponseBody, } from './resource-list-handler.js';
 export { defaultSessionLocals, type SessionLocals } from './types.js';
@@ -188,6 +190,14 @@ export interface CreateSessionCookieOptions {
     ipAddress?: string;
     /** Custom session data */
     data?: Record<string, unknown>;
+    /**
+     * How the session was established (#2944). Login helpers in this package
+     * set it (`oidc`, `pin`, …); hosts minting cookies for their own flows
+     * should pass their own value so gates can tell channels apart.
+     */
+    authMethod?: SessionAuthMethod | null;
+    /** Parent session for a layered session (#3276). */
+    parentSessionId?: string | null;
 }
 /**
  * Helper to create a session and set the cookie after login.

package/dist/sveltekit/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAKL,KAAK,eAAe,EAGpB,KAAK,6BAA6B,EAClC,KAAK,eAAe,EAGrB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAEL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gCAAgC,EACrC,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAItE;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,KAAK,WAAW,GAAG;IACjB,KAAK,EAAE;QACL,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;YAC1C,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,IAAI,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,KAAK,oBAAoB,GACrB,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,KAAK,kBAAkB,CAAC,CAAC,IACrB,CAAC,GACD,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,WAAW,oBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACtD,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAClD,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,kBAAkB,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;IACnD,iDAAiD;IACjD,eAAe,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EACZ,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,eAAe,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAwE3E;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAChC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,gBAAgB,GACvB,0BAA0B,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C,GACF,OAAO,CAAC,MAAM,CAAC,CA2BjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,OAAO,CAAC,CA0ClB;AAiQD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA0DlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,IACpD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,IACvD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAW/D;AAoCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,mDAAmD;AACnD,MAAM,WAAW,qCACf,SAAQ,0BAA0B;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qCAAqC,IAEhC,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,wDAIpC;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,6BACf,SAAQ,0BAA0B;IAClC,0DAA0D;IAC1D,WAAW,EAAE,CACX,KAAK,EAAE,qBAAqB,KACzB;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IACtE,iDAAiD;IACjD,eAAe,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7E,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,OAAO,EAAE,CACP,KAAK,EAAE,qBAAqB,KACzB,OAAO,CACR,2BAA2B,GAC3B;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,2BAA2B,CAAA;KAAE,CACzE,CAAC;CACH;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,wBAAwB,CAuF1B;AAuBD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/sveltekit/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,yBAAyB,CAAC;AAGjC,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,KAAK,EACV,0BAA0B,EAC1B,mBAAmB,EACpB,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EAEL,KAAK,iBAAiB,EACvB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAKL,KAAK,eAAe,EAGpB,KAAK,6BAA6B,EAClC,KAAK,eAAe,EAGrB,MAAM,iCAAiC,CAAC;AAGzC,OAAO,EAEL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,EAChC,MAAM,oCAAoC,CAAC;AAE5C,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACxB,6BAA6B,EAC7B,kCAAkC,EAClC,KAAK,mBAAmB,EACxB,KAAK,0BAA0B,EAC/B,gCAAgC,EAChC,KAAK,4BAA4B,EACjC,KAAK,gBAAgB,EACrB,yBAAyB,EACzB,KAAK,SAAS,EACd,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,0CAA0C,EAC1C,iCAAiC,EACjC,kCAAkC,EAClC,4BAA4B,EAC5B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,oBAAoB,EACpB,6BAA6B,EAC7B,0BAA0B,EAC1B,iCAAiC,EACjC,mBAAmB,EACnB,0BAA0B,GAC3B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,eAAe,EACf,KAAK,mBAAmB,EACxB,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,mBAAmB,EACxB,qBAAqB,EACrB,yBAAyB,GAC1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,EACL,8BAA8B,EAC9B,KAAK,wBAAwB,GAC9B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EACL,KAAK,+BAA+B,EACpC,wBAAwB,EACxB,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EACvB,KAAK,oBAAoB,EACzB,2BAA2B,GAC5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,KAAK,WAAW,EAChB,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,oBAAoB,EACzB,KAAK,YAAY,EACjB,KAAK,gCAAgC,EACrC,yBAAyB,EACzB,kBAAkB,EAClB,KAAK,eAAe,EACpB,KAAK,wBAAwB,GAC9B,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,oBAAoB,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAItE;;GAEG;AACH,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,mCAAmC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,uEAAuE;IACvE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+DAA+D;IAC/D,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,iDAAiD;IACjD,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,4EAA4E;IAC5E,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,sEAAsE;IACtE,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;GAEG;AACH,KAAK,WAAW,GAAG;IACjB,KAAK,EAAE;QACL,OAAO,EAAE;YACP,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;YAC1C,GAAG,EAAE,CACH,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC9B,IAAI,CAAC;YACV,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;SACnE,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAChC,GAAG,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAC7C,OAAO,EAAE;YAAE,OAAO,EAAE,OAAO,CAAA;SAAE,CAAC;KAC/B,CAAC;IACF,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CAChD,CAAC;AAEF,KAAK,MAAM,GAAG,CAAC,KAAK,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAExD,KAAK,qBAAqB,GAAG;IAC3B,OAAO,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC;IACzC,gBAAgB,CAAC,EAAE,MAAM,MAAM,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC5C,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;CACV,CAAC;AAEF,KAAK,oBAAoB,GACrB,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,SAAS,CAAC,CAAC;AAE3D,KAAK,kBAAkB,CAAC,CAAC,IACrB,CAAC,GACD,CAAC,CAAC,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,qBAAqB,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAEhF,MAAM,WAAW,oBACf,SAAQ,gBAAgB,EACtB,6BAA6B;IAC/B,4DAA4D;IAC5D,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,0CAA0C;IAC1C,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACjC,uEAAuE;IACvE,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAChC,+DAA+D;IAC/D,YAAY,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC;IAC3D,6DAA6D;IAC7D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,6DAA6D;IAC7D,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAClC,gEAAgE;IAChE,yBAAyB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IACtD,8EAA8E;IAC9E,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,0CAA0C;IAC1C,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,qEAAqE;IACrE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,6CAA6C;IAC7C,qBAAqB,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAClD,uEAAuE;IACvE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,kBAAkB,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IACzD;;;;OAIG;IACH,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC;;;;OAIG;IACH,qBAAqB,CAAC,EAAE,0BAA0B,CAAC;IACnD,iDAAiD;IACjD,eAAe,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC7C,8EAA8E;IAC9E,eAAe,CAAC,EACZ,MAAM,GACN,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAChE;AAED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,eAAe,CAAC;IAC7B,GAAG,EAAE,GAAG,CAAC;CACV;AAED,MAAM,WAAW,uBAAwB,SAAQ,eAAe;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM,CA4E3E;AAED;;GAEG;AACH,MAAM,WAAW,0BAA0B;IACzC,+CAA+C;IAC/C,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,wBAAwB;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,0BAA0B;IAC1B,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B;;;;OAIG;IACH,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,oDAAoD;IACpD,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AA0BD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,GAAG,SAAS,EAC5B,OAAO,EAAE,gBAAgB,GACvB,0BAA0B,GAAG;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CAC5C,GACF,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,IAAI,CAAC,CAsBf;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AACH,wBAAsB,mBAAmB,CACvC,KAAK,EAAE,WAAW,CAAC,OAAO,CAAC,EAC3B,QAAQ,EAAE,MAAM,GAAG,IAAI,EACvB,OAAO,EAAE,gBAAgB,GAAG;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC3C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,GACA,OAAO,CAAC,OAAO,CAAC,CA0ClB;AAiQD;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,oBAAoB,CAAC,CAyB/B;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,qBAAqB,EAC5B,OAAO,EAAE,oBAAoB,GAC5B,OAAO,CAAC,uBAAuB,CAAC,CA2DlC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,oBAAoB,IACpD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAI/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,oBAAoB,IACvD,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAW/D;AAoCD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAG5E;AAED,mDAAmD;AACnD,MAAM,WAAW,qCACf,SAAQ,0BAA0B;IAClC;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,CAAC,CAAC;CAC1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,qCAAqC,IAEhC,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAU/D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAe/D;AAED;;;;GAIG;AACH,wBAAgB,gCAAgC,CAC9C,OAAO,EAAE,0BAA0B,IAErB,OAAO,qBAAqB,KAAG,OAAO,CAAC,QAAQ,CAAC,CAY/D;AAED;;;;GAIG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,0BAA0B,wDAIpC;AAED,qDAAqD;AACrD,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,QAAQ,EAAE,IAAI,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,kEAAkE;AAClE,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,WAAW,6BACf,SAAQ,0BAA0B;IAClC,0DAA0D;IAC1D,WAAW,EAAE,CACX,KAAK,EAAE,qBAAqB,KACzB;QAAE,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,IAAI,GAAG,SAAS,CAAC;IACtE,iDAAiD;IACjD,eAAe,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC7E,oEAAoE;IACpE,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,CAAC,KAAK,EAAE,qBAAqB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACvE,OAAO,EAAE,CACP,KAAK,EAAE,qBAAqB,KACzB,OAAO,CACR,2BAA2B,GAC3B;QAAE,IAAI,EAAE,SAAS,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,2BAA2B,CAAA;KAAE,CACzE,CAAC;CACH;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,6BAA6B,GACrC,wBAAwB,CAuF1B;AAuBD,OAAO,EACL,iBAAiB,EACjB,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,0BAA0B,GAChC,CAAC"}

package/dist/sveltekit/types.d.ts

@@ -3,7 +3,9 @@
  * @packageDocumentation
  */
 import type { Membership } from '../models/Membership.js';
+import type { SessionAuthMethod } from '../models/Session.js';
 import type { User } from '../models/User.js';
+import type { SessionParentContext } from '../services/SessionService.js';
 /**
  * Extended locals interface for SvelteKit
  *
@@ -27,6 +29,10 @@ export interface SessionLocals {
     tenantId: string | null;
     /** Session ID (null if no session) */
     sessionId: string | null;
+    /** How the session was established (#2944); null when unknown or unauthenticated. */
+    authMethod?: SessionAuthMethod | null;
+    /** For a layered (e.g. PIN) session, the device session it rides on (#3276). */
+    sessionParent?: SessionParentContext | null;
 }
 /**
  * Default session locals values

package/dist/sveltekit/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sveltekit/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAE9C;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAMlC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/sveltekit/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AAE1E;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,aAAa;IAC5B,yDAAyD;IACzD,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC;IAClB,8DAA8D;IAC9D,UAAU,CAAC,EAAE,UAAU,GAAG,IAAI,CAAC;IAC/B,kCAAkC;IAClC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,0DAA0D;IAC1D,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,sCAAsC;IACtC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,qFAAqF;IACrF,UAAU,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACtC,gFAAgF;IAChF,aAAa,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAAC;CAC7C;AAED;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,aAQlC,CAAC"}

package/dist/sveltekit.js

@@ -1,9 +1,180 @@
-import { C as OidcLoginService, D as resolveOidcProviderConfig, E as getUsersOidcConfig, S as OidcLoginError, T as encodeOidcTransaction, _ as readMobileBearerToken, a as TerminalAuthRateLimitError, g as MobileAuthService, h as MobileAuthError, i as TerminalAuthError, m as withSessionPermissionContext, o as TerminalAuthService, s as OperationPermissionError, v as validateMobileRedirectUri, w as decodeOidcTransaction, y as SessionService } from "./chunks/TerminalAuthService-DoadwiqV.js";
+import { A as DeviceCredentialForbiddenError, C as encodeOidcTransaction, L as SessionService, M as DeviceCredentialService, S as decodeOidcTransaction, T as resolveOidcProviderConfig, _ as MobileAuthService, a as TerminalAuthError, b as OidcLoginError, c as OperationPermissionError, g as MobileAuthError, h as withSessionPermissionContext, j as DeviceCredentialPolicyError, k as DeviceCredentialError, o as TerminalAuthRateLimitError, q as LoginRateLimitError, s as TerminalAuthService, v as readMobileBearerToken, w as getUsersOidcConfig, x as OidcLoginService, y as validateMobileRedirectUri } from "./chunks/TerminalAuthService-BfxG493c.js";
 import { DiscoveryArtifactValidationError, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, canonicalizeDiscoveryArtifact, createDiscoveryConformanceArtifact, deriveCommandRequirements, validateDiscoveryConformanceArtifact } from "./app-contract.js";
 import { ObjectRegistry, createClassNamePredicate, resolveCustomActionMetadata, resolveEffectiveActionMetadata } from "@happyvertical/smrt-core";
 import { createLogger } from "@happyvertical/logger";
 import { classnameToTablename } from "@happyvertical/smrt-core/utils";
 import { methodNameToKebab, resolveApiActionSet } from "@happyvertical/smrt-core/vite-plugin";
+//#region src/sveltekit/device-credential-handlers.ts
+var logger$2 = createLogger({ level: "info" });
+var NO_STORE_HEADERS$2 = {
+	"cache-control": "private, no-store",
+	pragma: "no-cache"
+};
+function json(body2, status = 200, headers) {
+	return new Response(JSON.stringify(body2), {
+		status,
+		headers: {
+			"content-type": "application/json",
+			...headers
+		}
+	});
+}
+function bearer(event) {
+	return (event.request.headers.get("authorization")?.match(/^Bearer\s+(.+)$/iu))?.[1]?.trim() || null;
+}
+async function body(event) {
+	const parsed = await event.request.json().catch(() => null);
+	return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
+}
+function str(value) {
+	return typeof value === "string" ? value : "";
+}
+function errorResponse$1(error) {
+	if (error instanceof LoginRateLimitError) return json({
+		error: "Too many attempts. Try again later.",
+		code: "rate_limited"
+	}, 429, {
+		...NO_STORE_HEADERS$2,
+		"retry-after": String(error.retryAfterSeconds)
+	});
+	if (error instanceof DeviceCredentialError) return json({
+		error: "Invalid credentials.",
+		code: "invalid_credentials"
+	}, 401, NO_STORE_HEADERS$2);
+	if (error instanceof DeviceCredentialForbiddenError) return json({
+		error: error.message,
+		code: "forbidden"
+	}, 403, NO_STORE_HEADERS$2);
+	if (error instanceof DeviceCredentialPolicyError) return json({
+		error: error.message,
+		code: "pin_policy"
+	}, 400, NO_STORE_HEADERS$2);
+	logger$2.error("Device credential handler error", { error });
+	return json({
+		error: "Internal error.",
+		code: "internal"
+	}, 500, NO_STORE_HEADERS$2);
+}
+async function resolveActor(event, service) {
+	const token = bearer(event);
+	if (token) return service.resolveActor(token);
+	const locals = event.locals ?? {};
+	const user = locals.user;
+	const sessionId = locals.sessionId;
+	if (!user || !sessionId) return null;
+	if (!("authMethod" in locals)) return null;
+	return {
+		user,
+		membership: locals.membership ?? null,
+		permissions: Array.isArray(locals.permissions) ? locals.permissions : [],
+		tenantId: locals.tenantId ?? null,
+		sessionId,
+		authMethod: locals.authMethod ?? null,
+		parent: locals.sessionParent ?? null
+	};
+}
+function createDeviceCredentialHandlers(options) {
+	let servicePromise = null;
+	const service = () => {
+		servicePromise ??= DeviceCredentialService.create(options);
+		return servicePromise;
+	};
+	const meta = (event) => ({
+		ipAddress: event.getClientAddress?.(),
+		userAgent: event.request.headers.get("user-agent") ?? void 0
+	});
+	return {
+		service,
+		pinSignIn: async (event) => {
+			const deviceToken = bearer(event);
+			const input = await body(event);
+			const userId = str(input.userId).trim();
+			const pin = str(input.pin);
+			if (!deviceToken || !userId || !pin) return json({
+				error: "Invalid credentials.",
+				code: "invalid_credentials"
+			}, 401, NO_STORE_HEADERS$2);
+			try {
+				return json(await (await service()).signInWithPin({
+					deviceToken,
+					userId,
+					pin,
+					...meta(event)
+				}), 201, NO_STORE_HEADERS$2);
+			} catch (error) {
+				return errorResponse$1(error);
+			}
+		},
+		signOut: async (event) => {
+			const token = bearer(event);
+			if (token) try {
+				await (await service()).signOut(token);
+			} catch (error) {
+				logger$2.error("Device credential sign-out error", { error });
+			}
+			return json({ authenticated: false }, 200, NO_STORE_HEADERS$2);
+		},
+		setPin: async (event) => {
+			const actor = await resolveActor(event, await service());
+			if (!actor) return json({
+				error: "Unauthenticated.",
+				code: "unauthenticated"
+			}, 401, NO_STORE_HEADERS$2);
+			const input = await body(event);
+			try {
+				await (await service()).setPin({
+					actor,
+					userId: str(input.userId).trim() || (actor.user.id ?? ""),
+					pin: str(input.pin),
+					currentPin: str(input.currentPin) || void 0,
+					ipAddress: event.getClientAddress?.()
+				});
+				return new Response(null, {
+					status: 204,
+					headers: NO_STORE_HEADERS$2
+				});
+			} catch (error) {
+				return errorResponse$1(error);
+			}
+		},
+		resetPin: async (event) => {
+			const actor = await resolveActor(event, await service());
+			if (!actor) return json({
+				error: "Unauthenticated.",
+				code: "unauthenticated"
+			}, 401, NO_STORE_HEADERS$2);
+			const input = await body(event);
+			try {
+				return json(await (await service()).resetPin({
+					actor,
+					userId: str(input.userId).trim(),
+					pin: str(input.pin),
+					ipAddress: event.getClientAddress?.()
+				}), 200, NO_STORE_HEADERS$2);
+			} catch (error) {
+				return errorResponse$1(error);
+			}
+		},
+		clearPin: async (event) => {
+			const actor = await resolveActor(event, await service());
+			if (!actor) return json({
+				error: "Unauthenticated.",
+				code: "unauthenticated"
+			}, 401, NO_STORE_HEADERS$2);
+			const input = await body(event);
+			try {
+				return json(await (await service()).clearPin({
+					actor,
+					userId: str(input.userId).trim() || (actor.user.id ?? ""),
+					ipAddress: event.getClientAddress?.()
+				}), 200, NO_STORE_HEADERS$2);
+			} catch (error) {
+				return errorResponse$1(error);
+			}
+		}
+	};
+}
+//#endregion
 //#region src/sveltekit/mobile-handlers.ts
 var logger$1 = createLogger({ level: "info" });
 var NO_STORE_HEADERS$1 = {
@@ -566,7 +737,9 @@ var defaultSessionLocals = {
 	membership: null,
 	permissions: [],
 	tenantId: null,
-	sessionId: null
+	sessionId: null,
+	authMethod: null,
+	sessionParent: null
 };
 //#endregion
 //#region src/sveltekit/index.ts
@@ -590,6 +763,8 @@ function createSessionHandler(options) {
 		event.locals.permissions = [];
 		event.locals.tenantId = null;
 		event.locals.sessionId = null;
+		event.locals.authMethod = null;
+		event.locals.sessionParent = null;
 		if (skipPaths.some((path) => event.url.pathname.startsWith(path))) return resolve(event);
 		const sessionId = event.cookies.get(cookieName);
 		if (!sessionId && !options.postgresRls) return resolve(event);
@@ -608,6 +783,8 @@ function createSessionHandler(options) {
 					event.locals.permissions = context.permissions;
 					event.locals.tenantId = context.tenantId;
 					event.locals.sessionId = context.sessionId;
+					event.locals.authMethod = context.session.authMethod ?? null;
+					event.locals.sessionParent = context.session.parent ?? null;
 				}
 				return resolve(event);
 			});
@@ -641,7 +818,9 @@ async function createSessionCookie(event, userId, tenantId, options) {
 		ttl,
 		userAgent: options.userAgent,
 		ipAddress: options.ipAddress,
-		data: options.data
+		data: options.data,
+		authMethod: options.authMethod,
+		parentSessionId: options.parentSessionId
 	});
 	event.cookies.set(cookieName, sessionId, {
 		path: cookiePath,
@@ -836,6 +1015,7 @@ async function completeOidcLogin(event, options) {
 			cookiePath: options.sessionCookiePath,
 			cookieSameSite: options.sessionCookieSameSite,
 			cookieSecure: useSecureCookie(event, options.sessionCookieSecure),
+			authMethod: "oidc",
 			data: {
 				oidcIssuer: result.claims.iss,
 				oidcProvider: service.providerName
@@ -1015,6 +1195,6 @@ var NO_STORE_HEADERS = {
 	pragma: "no-cache"
 };
 //#endregion
-export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
+export { DiscoveryArtifactValidationError, InvalidBearerError, MobileAuthError, MobileAuthService, SMRT_APP_RESULT_CONTRACT, SMRT_APP_RESULT_SCHEMA, SMRT_APP_RESULT_VERSION, SMRT_DISCOVERY_CONFORMANCE_ARTIFACT_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_SCHEMA, SMRT_DISCOVERY_CONFORMANCE_VERSION, SMRT_MCP_RESULT_METADATA_KEY, TerminalAuthError, TerminalAuthRateLimitError, TerminalAuthService, beginOidcLogin, canonicalizeDiscoveryArtifact, completeOidcLogin, createBearerSessionDeleteHandler, createDeviceCredentialHandlers, createDiscoveryConformanceArtifact, createMobileAuthHandlers, createOidcCallbackHandler, createOidcLoginHandler, createResourceListHandler, createSessionCookie, createSessionHandler, createTerminalAuthStartHandler, createTerminalAuthTokenHandler, defaultSessionLocals, deriveCommandRequirements, destroySessionCookie, loadBearerSessionContext, mountTerminalLoginPage, parseBearerToken, readMobileBearerToken, resolveMobileUploadDedupKey, switchSessionTenant, validateDiscoveryConformanceArtifact, validateMobileRedirectUri };
 
 //# sourceMappingURL=sveltekit.js.map