@miguelmorales13/nestkit 0.5.0 → 0.6.0

package/dist/auth/oauth/oauth-auth.service.d.ts

@@ -0,0 +1,101 @@
+import { type OAuthProfile, type OAuthProviderConfig } from './oauth-provider.js';
+import { type OAuthAuthOptions, type ResolvedOAuthOptions } from './oauth.options.js';
+import type { OAuthStorePort, OAuthUser, RefreshTokenStorePort } from './oauth.ports.js';
+export interface TokenPair {
+    accessToken: string;
+    refreshToken: string;
+    refreshTokenExpiresAt: Date;
+}
+/**
+ * OAuth sign-in, account linking and rotating refresh sessions.
+ *
+ * Knows nothing about a database: everything it stores goes through
+ * `OAuthStorePort` and `RefreshTokenStorePort`, so the same service runs on
+ * Prisma, Drizzle or a hand-written repository.
+ */
+export declare class OAuthAuthService<U extends OAuthUser = OAuthUser> {
+    private readonly store;
+    private readonly sessions;
+    private readonly options;
+    constructor(options: OAuthAuthOptions<U>, store: OAuthStorePort<U>, sessions: RefreshTokenStorePort);
+    get config(): ResolvedOAuthOptions<U>;
+    /**
+     * Looks up a configured provider, or explains that it is unavailable.
+     *
+     * Missing credentials make one provider stop existing rather than stopping
+     * the boot — the same fail-late rule the rest of nestkit's optional
+     * integrations follow. An unknown name and an unconfigured one answer
+     * identically on purpose: neither is something the caller can act on
+     * differently, and distinguishing them only tells a prober what exists.
+     */
+    provider(name: string): OAuthProviderConfig;
+    authorizeUrl(name: string): string;
+    /** Exchanges the callback's `code` for a normalised profile. */
+    profileFromCode(name: string, code: string): Promise<OAuthProfile>;
+    /**
+     * Signs someone in, creating the account the first time.
+     *
+     * The provider is a parameter because the flow is identical for all of
+     * them: find the linked account, and failing that link by email to whoever
+     * is already registered. That email link is what makes signing in with
+     * Facebook today and Google tomorrow land on one account instead of two.
+     */
+    login(providerName: string, profile: OAuthProfile): Promise<{
+        user: unknown;
+    } & TokenPair>;
+    /**
+     * Rotates a refresh token: the old one is spent, a new pair comes back.
+     *
+     * Revoking before issuing, and only continuing when the revoke actually hit
+     * a live row, is the whole point — replaying a token that has already been
+     * used finds nothing to revoke and is rejected.
+     */
+    refresh(rawRefreshToken: string): Promise<TokenPair>;
+    logout(rawRefreshToken: string): Promise<void>;
+    currentUser(userId: string): Promise<unknown>;
+    /**
+     * Issues the short-lived permission to link another provider.
+     *
+     * Needed because the OAuth leg is a whole-browser navigation, not a request
+     * with headers: the access token does not travel there. So a permission is
+     * minted, parked in an httpOnly cookie, and read back by the callback to
+     * tell "link this to me" from "sign in". It carries its own `typ` so it can
+     * never pass as an access token, or the other way round, despite sharing a
+     * secret.
+     */
+    issueLinkToken(userId: string): {
+        token: string;
+        expiresAt: Date;
+    };
+    /**
+     * The user id behind a link permission, or null.
+     *
+     * Null rather than an exception: with no valid permission the callback just
+     * performs an ordinary sign-in, which is the correct outcome.
+     */
+    readLinkToken(token: string | undefined): string | null;
+    /**
+     * Ties a provider account to the already-signed-in user.
+     *
+     * This is the way out when the emails do not match: if someone's Facebook
+     * is registered under a different address, linking by email can never join
+     * them, and without this they keep two profiles forever.
+     */
+    linkAccount(userId: string, providerName: string, profile: OAuthProfile): Promise<void>;
+    /**
+     * Which providers are linked, and what photo each one offers.
+     *
+     * Enough to build both a "connect another account" screen and an avatar
+     * picker; what the app does with the choice is the app's decision.
+     */
+    linkedAccounts(userId: string): Promise<{
+        connected: string[];
+        avatars: {
+            provider: string;
+            avatarUrl: string;
+        }[];
+    }>;
+    private present;
+    private issueTokenPair;
+    private verifyRefresh;
+}

package/dist/auth/oauth/oauth-callback.filter.d.ts

@@ -0,0 +1,20 @@
+import { type ArgumentsHost, type ExceptionFilter } from '@nestjs/common';
+import { type OAuthAuthOptions } from './oauth.options.js';
+/**
+ * Sends the browser back to the sign-in screen when an OAuth callback fails.
+ *
+ * Without it any failure falls through to the global filter, which answers
+ * JSON — and mid-navigation that leaves a person staring at
+ * `{"statusCode":500,…}` on a blank page with no way back: they did not
+ * arrive by an API call, they were redirected there by the provider.
+ *
+ * The real cause is always logged. Only the text of deliberate HTTP
+ * exceptions is passed on; an internal error gets a generic message, on the
+ * same principle the global exception filter follows.
+ */
+export declare class OAuthCallbackFilter implements ExceptionFilter {
+    private readonly logger;
+    private readonly options;
+    constructor(options: OAuthAuthOptions);
+    catch(exception: unknown, host: ArgumentsHost): void;
+}

package/dist/auth/oauth/oauth-provider.d.ts

@@ -0,0 +1,73 @@
+/**
+ * What nestkit needs to know to run an OAuth 2.0 authorization-code flow
+ * against one provider.
+ *
+ * A provider is a plain object, not a class to subclass or a Passport strategy
+ * to install. Adding Apple, GitHub or Microsoft is declaring four URLs and a
+ * function that maps their JSON onto `OAuthProfile` — no new dependency, no
+ * new file in this library.
+ *
+ * Passport is deliberately absent. Its redirect step calls `res.setHeader()`,
+ * which does not exist on a Fastify reply, so the sign-in leg has to be
+ * hand-built anyway; and its per-provider profile mapping is an undocumented
+ * translation table that silently forwards field names it does not recognise
+ * (`photos.type(large)` reaching Facebook's Graph API as a request for the
+ * user's uploaded photos, which needs a permission the app does not have, is
+ * how that bug presents in production). The whole flow below is roughly forty
+ * lines of `fetch`, and every field it sends is visible in this file.
+ */
+export interface OAuthProfile {
+    /** The provider's own id for this person. Stable; the email is not. */
+    providerAccountId: string;
+    email: string;
+    name?: string;
+    avatarUrl?: string;
+}
+export interface OAuthProviderConfig {
+    /**
+     * Route segment and stored provider key: `/auth/google`. Whatever goes in
+     * here is what `OAuthStorePort` will receive as `provider`, so if the
+     * consumer persists an enum, these names have to match its members.
+     */
+    name: string;
+    clientId?: string;
+    clientSecret?: string;
+    /**
+     * Must match the redirect URI registered with the provider **exactly**,
+     * including the path prefix the app is mounted under. A mismatch is
+     * rejected by the provider, not by us.
+     */
+    callbackUrl?: string;
+    /** Consent screen. */
+    authorizeUrl: string;
+    /** Where the `code` is exchanged for an access token. */
+    tokenUrl: string;
+    scope: string;
+    /** Extra query parameters for the consent screen (`prompt`, `access_type`…). */
+    authorizeParams?: Record<string, string>;
+    /** Fetches the profile with the provider's access token and normalises it. */
+    fetchProfile(accessToken: string): Promise<OAuthProfile>;
+}
+export interface ProviderCredentials {
+    clientId?: string;
+    clientSecret?: string;
+    callbackUrl?: string;
+    /** Overrides the default scope. */
+    scope?: string;
+}
+/**
+ * Google. Returns the email verified by Google itself, so it is safe to link
+ * accounts on.
+ */
+export declare function googleProvider(credentials?: ProviderCredentials): OAuthProviderConfig;
+/**
+ * Facebook. Note that unlike Google it may return no email at all — the
+ * account can be registered with a phone number, or the person can withhold
+ * the permission on the consent screen. `OAuthAuthService` turns that into a
+ * message they can act on rather than an internal failure.
+ */
+export declare function facebookProvider(credentials?: ProviderCredentials): OAuthProviderConfig;
+/** The consent-screen URL to send the browser to. */
+export declare function buildAuthorizeUrl(provider: OAuthProviderConfig, state?: string): string;
+/** Trades the `code` from the callback for the provider's access token. */
+export declare function exchangeCodeForToken(provider: OAuthProviderConfig, code: string): Promise<string>;

package/dist/auth/oauth/oauth.controller.d.ts

@@ -0,0 +1,38 @@
+import { type CanActivate, type Type } from '@nestjs/common';
+export interface CreateOAuthControllerOptions {
+    /** Route prefix. Default `auth`. */
+    path?: string;
+    /**
+     * Guard for the routes that need a session. Defaults to nestkit's
+     * `JwtAuthGuard`.
+     *
+     * An app that already has its own guard should pass it, rather than end up
+     * with two of them verifying the same token in the same codebase — and with
+     * `request.user` shaped one way on these routes and another way everywhere
+     * else.
+     */
+    guard?: Type<CanActivate>;
+    /**
+     * Reads the user id out of whatever the guard attached. Defaults to the
+     * `sub` claim, which is what nestkit's guard puts there; a guard that maps
+     * it to `id` needs `(user) => user.id`.
+     */
+    userId?(user: unknown): string;
+}
+/**
+ * Generates the routes for OAuth sign-in, session refresh and account
+ * linking, wired to `OAuthAuthService`.
+ *
+ * A factory rather than a fixed class so the prefix can move, and so an app
+ * can skip it entirely and call the service from its own controller — the
+ * same composition-over-inheritance shape as `createCrudController`.
+ *
+ *   `@Module({ controllers: [class AuthController extends createOAuthController() {}] })`
+ *
+ * The provider is a route parameter instead of one pair of routes per
+ * provider, so adding Apple later touches configuration only. The static
+ * routes are declared first on purpose: Fastify's router always prefers a
+ * static segment over a parametric one, but Express matches in declaration
+ * order, and `me` would otherwise be read as a provider name.
+ */
+export declare function createOAuthController(options?: CreateOAuthControllerOptions): Type<object>;

package/dist/auth/oauth/oauth.options.d.ts

@@ -0,0 +1,89 @@
+import type { OAuthProviderConfig } from './oauth-provider.js';
+import type { OAuthUser, ProfileSyncPolicy } from './oauth.ports.js';
+export declare const OAUTH_AUTH_OPTIONS: unique symbol;
+/** Bind to an implementation of `OAuthStorePort`. */
+export declare const OAUTH_STORE: unique symbol;
+/** Bind to an implementation of `RefreshTokenStorePort`. */
+export declare const REFRESH_TOKEN_STORE: unique symbol;
+export interface OAuthCookieOptions {
+    /** Default `refresh_token`. */
+    name?: string;
+    /**
+     * Default `/auth`. Scope it as narrowly as the routes allow: the cookie is
+     * then never sent to the rest of the API, which is the cheapest CSRF
+     * mitigation available. Apps mounted under a prefix want `/api/auth`.
+     */
+    path?: string;
+    /** Default `lax` — has to survive the redirect back from the provider. */
+    sameSite?: 'lax' | 'strict' | 'none';
+    /** Default: on outside development. */
+    secure?: boolean;
+}
+export interface OAuthAuthOptions<U extends OAuthUser = OAuthUser> {
+    /** Every provider the app offers. Order is irrelevant; `name` is the key. */
+    providers: OAuthProviderConfig[];
+    /** Front-end origin. Used to build the default redirects below. */
+    webUrl: string;
+    /**
+     * Where the browser lands after signing in. The access token cannot go in a
+     * cookie — the client has to read it — and it must not go in the query
+     * string, which is logged by proxies and kept in browser history. The
+     * default puts it in the fragment, which never leaves the browser.
+     */
+    onLoginRedirect?(accessToken: string): string;
+    /** Where a failed callback lands. Default `${webUrl}/login?error=…`. */
+    onErrorRedirect?(message: string): string;
+    /** Where a finished account link lands. Default `${webUrl}/profile?…`. */
+    onLinkRedirect?(provider: string, error?: string): string;
+    cookie?: OAuthCookieOptions;
+    /**
+     * Cookie carrying the short-lived permission to link another provider to an
+     * already signed-in account. Default `link_intent`.
+     */
+    linkCookieName?: string;
+    /** Defaults: 15 min access, 30 days refresh, 10 min link permission. */
+    accessTtlSeconds?: number;
+    refreshTtlSeconds?: number;
+    linkTtlSeconds?: number;
+    /** Read from `JWT_ACCESS_SECRET` / `JWT_REFRESH_SECRET` when omitted. */
+    accessSecret?: string;
+    refreshSecret?: string;
+    /**
+     * Whether signing in closes every other session. Default `true`.
+     *
+     * Right for a phone-and-laptop consumer app, wrong for anything people use
+     * in several browsers at once — there it logs them out of the other one on
+     * every sign-in, which reads as a bug.
+     */
+    singleSession?: boolean;
+    /** See `ProfileSyncPolicy`. Default resyncs name and photo every login. */
+    syncProfile?: ProfileSyncPolicy<U>;
+    /**
+     * Shapes the user in API responses. Without it the stored row goes out
+     * whole, password hashes and internal columns included — so anything with
+     * fields not meant to be public should pass one.
+     */
+    mapUser?(user: U): unknown;
+    /**
+     * Message when a provider is offered but not configured. Reaches the user,
+     * so it belongs in the app's language.
+     */
+    unavailableMessage?(provider: string): string;
+    /** Message when the provider hands back no email. */
+    missingEmailMessage?(provider: string): string;
+    /**
+     * Shown when the callback fails for any reason the user cannot be told
+     * about — an internal error, or a consent screen they cancelled. Reaches
+     * the user, so it belongs in the app's language.
+     */
+    genericErrorMessage?(): string;
+}
+/** Everything above, with the defaults filled in. Internal. */
+export interface ResolvedOAuthOptions<U extends OAuthUser = OAuthUser> extends Required<Omit<OAuthAuthOptions<U>, 'accessSecret' | 'refreshSecret' | 'cookie' | 'mapUser' | 'syncProfile'>> {
+    accessSecret?: string;
+    refreshSecret?: string;
+    cookie: Required<OAuthCookieOptions>;
+    mapUser?(user: U): unknown;
+    syncProfile: ProfileSyncPolicy<U>;
+}
+export declare function resolveOAuthOptions<U extends OAuthUser>(options: OAuthAuthOptions<U>): ResolvedOAuthOptions<U>;

package/dist/auth/oauth/oauth.ports.d.ts

@@ -0,0 +1,86 @@
+import type { OAuthProfile } from './oauth-provider.js';
+/**
+ * The minimum nestkit needs a user to have. Consumers keep their own columns
+ * — the service passes whatever the port returns straight back out, so the
+ * app's `subscriptionTier`, `roles` or `tenantId` survive untouched.
+ */
+export interface OAuthUser {
+    id: string;
+    email: string;
+    name?: string | null;
+    avatarUrl?: string | null;
+}
+export interface OAuthAccount {
+    userId: string;
+    provider: string;
+    providerAccountId: string;
+    avatarUrl: string | null;
+}
+/**
+ * Persistence for identities: who someone is, and which provider accounts
+ * point at them.
+ *
+ * Kept apart from `RefreshTokenStorePort` because they answer different
+ * questions — identity outlives any session, and a project may well want the
+ * sessions in Redis and the users in Postgres.
+ */
+export interface OAuthStorePort<U extends OAuthUser = OAuthUser> {
+    /** The linked account, with its user — the fast path of every login. */
+    findAccount(provider: string, providerAccountId: string): Promise<(OAuthAccount & {
+        user: U;
+    }) | null>;
+    /** Used to refuse linking a second account of a provider already linked. */
+    findAccountByUserAndProvider(userId: string, provider: string): Promise<OAuthAccount | null>;
+    /** Everything linked to this user — what the avatar picker is built from. */
+    listAccountsByUser(userId: string): Promise<OAuthAccount[]>;
+    createAccount(account: OAuthAccount): Promise<void>;
+    updateAccountAvatar(provider: string, providerAccountId: string, avatarUrl: string | null): Promise<void>;
+    /** Must compare on the normalised (trimmed, lower-cased) email. */
+    findUserByEmail(email: string): Promise<U | null>;
+    findUserById(id: string): Promise<U | null>;
+    createUser(data: {
+        email: string;
+        name?: string;
+        avatarUrl?: string;
+    }): Promise<U>;
+    updateUser(id: string, data: {
+        name?: string | null;
+        avatarUrl?: string | null;
+    }): Promise<U>;
+}
+/**
+ * Persistence for sessions.
+ *
+ * Only ever sees a SHA-256 of the token, never the token: a leaked database
+ * then yields nothing that can be replayed. Rotation is what makes that
+ * worth doing — `revokeIfActive` has to be atomic (a conditional UPDATE, not
+ * read-then-write), because that single row is what stops a stolen refresh
+ * token from being used twice.
+ */
+export interface RefreshTokenStorePort {
+    create(userId: string, tokenHash: string, expiresAt: Date): Promise<void>;
+    /**
+     * Revokes the token if it is still active, and reports whether it was.
+     * A count of 0 means already used, revoked or unknown — all of which are
+     * a rejected refresh.
+     */
+    revokeIfActive(tokenHash: string): Promise<{
+        count: number;
+    }>;
+    /** Closes every other session. Called on login when `singleSession`. */
+    revokeAllForUser(userId: string): Promise<void>;
+}
+/**
+ * Decides what a fresh sign-in is allowed to overwrite on the stored user.
+ *
+ * The default resyncs name and photo from the provider on every login, which
+ * is right until the app lets people choose their own — at which point the
+ * default silently undoes their choice the next time they sign in. Apps with
+ * a picker return the values they want kept instead.
+ *
+ * Returning `null` means "change nothing".
+ */
+export type ProfileSyncPolicy<U extends OAuthUser = OAuthUser> = (user: U, profile: OAuthProfile) => {
+    name?: string | null;
+    avatarUrl?: string | null;
+} | null;

package/dist/chunk-A3B2EY4V.js

@@ -0,0 +1,75 @@
+import {
+  UnauthorizedAppException
+} from "./chunk-ORWJ7LES.js";
+import {
+  __decorateClass
+} from "./chunk-4MGIQFAJ.js";
+
+// src/auth/token.service.ts
+import jwt from "jsonwebtoken";
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`TokenService: ${name} environment variable is not set`);
+  }
+  return value;
+}
+var TokenService = class {
+  signAccessToken(payload) {
+    return jwt.sign(payload, requireEnv("JWT_ACCESS_SECRET"), {
+      expiresIn: process.env.JWT_ACCESS_EXPIRES_IN ?? "15m"
+    });
+  }
+  signRefreshToken(payload) {
+    return jwt.sign(payload, requireEnv("JWT_REFRESH_SECRET"), {
+      expiresIn: process.env.JWT_REFRESH_EXPIRES_IN ?? "30d"
+    });
+  }
+  verifyAccessToken(token) {
+    try {
+      return jwt.verify(token, requireEnv("JWT_ACCESS_SECRET"));
+    } catch {
+      throw new UnauthorizedAppException("Invalid or expired access token");
+    }
+  }
+  verifyRefreshToken(token) {
+    try {
+      return jwt.verify(token, requireEnv("JWT_REFRESH_SECRET"));
+    } catch {
+      throw new UnauthorizedAppException("Invalid or expired refresh token");
+    }
+  }
+};
+
+// src/auth/jwt-auth.guard.ts
+import { Injectable } from "@nestjs/common";
+var JwtAuthGuard = class {
+  constructor() {
+    this.tokens = new TokenService();
+  }
+  canActivate(context) {
+    const req = context.switchToHttp().getRequest();
+    const header = req.headers.authorization;
+    const token = header?.startsWith("Bearer ") ? header.slice("Bearer ".length) : void 0;
+    if (!token) {
+      throw new UnauthorizedAppException("Missing Authorization bearer token");
+    }
+    req.user = this.tokens.verifyAccessToken(token);
+    return true;
+  }
+};
+JwtAuthGuard = __decorateClass([
+  Injectable()
+], JwtAuthGuard);
+
+// src/auth/current-user.decorator.ts
+import { createParamDecorator } from "@nestjs/common";
+var CurrentUser = createParamDecorator(
+  (_, ctx) => ctx.switchToHttp().getRequest().user
+);
+
+export {
+  TokenService,
+  JwtAuthGuard,
+  CurrentUser
+};

package/dist/chunk-NVCI3CQI.cjs

@@ -0,0 +1,75 @@
+"use strict";Object.defineProperty(exports, "__esModule", {value: true}); function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; } function _nullishCoalesce(lhs, rhsFn) { if (lhs != null) { return lhs; } else { return rhsFn(); } } function _optionalChain(ops) { let lastAccessLHS = undefined; let value = ops[0]; let i = 1; while (i < ops.length) { const op = ops[i]; const fn = ops[i + 1]; i += 2; if ((op === 'optionalAccess' || op === 'optionalCall') && value == null) { return undefined; } if (op === 'access' || op === 'optionalAccess') { lastAccessLHS = value; value = fn(value); } else if (op === 'call' || op === 'optionalCall') { value = fn((...args) => value.call(lastAccessLHS, ...args)); lastAccessLHS = undefined; } } return value; }
+
+var _chunkFDNGAYTZcjs = require('./chunk-FDNGAYTZ.cjs');
+
+
+var _chunk2REOCMUDcjs = require('./chunk-2REOCMUD.cjs');
+
+// src/auth/token.service.ts
+var _jsonwebtoken = require('jsonwebtoken'); var _jsonwebtoken2 = _interopRequireDefault(_jsonwebtoken);
+function requireEnv(name) {
+  const value = process.env[name];
+  if (!value) {
+    throw new Error(`TokenService: ${name} environment variable is not set`);
+  }
+  return value;
+}
+var TokenService = class {
+  signAccessToken(payload) {
+    return _jsonwebtoken2.default.sign(payload, requireEnv("JWT_ACCESS_SECRET"), {
+      expiresIn: _nullishCoalesce(process.env.JWT_ACCESS_EXPIRES_IN, () => ( "15m"))
+    });
+  }
+  signRefreshToken(payload) {
+    return _jsonwebtoken2.default.sign(payload, requireEnv("JWT_REFRESH_SECRET"), {
+      expiresIn: _nullishCoalesce(process.env.JWT_REFRESH_EXPIRES_IN, () => ( "30d"))
+    });
+  }
+  verifyAccessToken(token) {
+    try {
+      return _jsonwebtoken2.default.verify(token, requireEnv("JWT_ACCESS_SECRET"));
+    } catch (e) {
+      throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid or expired access token");
+    }
+  }
+  verifyRefreshToken(token) {
+    try {
+      return _jsonwebtoken2.default.verify(token, requireEnv("JWT_REFRESH_SECRET"));
+    } catch (e2) {
+      throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Invalid or expired refresh token");
+    }
+  }
+};
+
+// src/auth/jwt-auth.guard.ts
+var _common = require('@nestjs/common');
+var JwtAuthGuard = class {
+  constructor() {
+    this.tokens = new TokenService();
+  }
+  canActivate(context) {
+    const req = context.switchToHttp().getRequest();
+    const header = req.headers.authorization;
+    const token = _optionalChain([header, 'optionalAccess', _2 => _2.startsWith, 'call', _3 => _3("Bearer ")]) ? header.slice("Bearer ".length) : void 0;
+    if (!token) {
+      throw new (0, _chunkFDNGAYTZcjs.UnauthorizedAppException)("Missing Authorization bearer token");
+    }
+    req.user = this.tokens.verifyAccessToken(token);
+    return true;
+  }
+};
+JwtAuthGuard = exports.JwtAuthGuard = _chunk2REOCMUDcjs.__decorateClass.call(void 0, [
+  _common.Injectable.call(void 0, )
+], JwtAuthGuard);
+
+// src/auth/current-user.decorator.ts
+
+var CurrentUser = _common.createParamDecorator.call(void 0, 
+  (_, ctx) => ctx.switchToHttp().getRequest().user
+);
+
+
+
+
+
+exports.TokenService = TokenService; exports.JwtAuthGuard = JwtAuthGuard; exports.CurrentUser = CurrentUser;

package/dist/index.cjs

@@ -1,17 +1,14 @@
-"use strict";Object.defineProperty(exports, "__esModule", {value: true});
+"use strict";Object.defineProperty(exports, "__esModule", {value: true});require('./chunk-KVBQBT3D.cjs');
 
 
 
-var _chunkRF75KC63cjs = require('./chunk-RF75KC63.cjs');
-require('./chunk-KVBQBT3D.cjs');
 
+var _chunkSPTDXUEDcjs = require('./chunk-SPTDXUED.cjs');
 
 
 
-var _chunkSPTDXUEDcjs = require('./chunk-SPTDXUED.cjs');
 
-
-var _chunkQS2W5XCQcjs = require('./chunk-QS2W5XCQ.cjs');
+var _chunkRF75KC63cjs = require('./chunk-RF75KC63.cjs');
 require('./chunk-MR2IFCZE.cjs');
 
 
@@ -28,6 +25,13 @@ var _chunkTJHRABMLcjs = require('./chunk-TJHRABML.cjs');
 
 
 var _chunk3CLYZC3Tcjs = require('./chunk-3CLYZC3T.cjs');
+
+
+var _chunkQS2W5XCQcjs = require('./chunk-QS2W5XCQ.cjs');
+
+
+
+var _chunkM3EL5O6Tcjs = require('./chunk-M3EL5O6T.cjs');
 require('./chunk-7SOM7EZP.cjs');
 
 
@@ -45,10 +49,6 @@ var _chunkZA56XBCKcjs = require('./chunk-ZA56XBCK.cjs');
 
 
 var _chunkR7BVS6CIcjs = require('./chunk-R7BVS6CI.cjs');
-
-
-
-var _chunkM3EL5O6Tcjs = require('./chunk-M3EL5O6T.cjs');
 require('./chunk-2REOCMUD.cjs');
 
 

package/dist/index.js

@@ -1,8 +1,3 @@
-import {
-  PG_POOL,
-  PgModule,
-  withTenantScope
-} from "./chunk-VKOPDDCC.js";
 import "./chunk-EPVKCBPT.js";
 import {
   SUPABASE_ANON_CLIENT,
@@ -10,8 +5,10 @@ import {
   SupabaseModule
 } from "./chunk-PA24P76K.js";
 import {
-  BaseResponseDto
-} from "./chunk-XX2HPTRU.js";
+  PG_POOL,
+  PgModule,
+  withTenantScope
+} from "./chunk-VKOPDDCC.js";
 import "./chunk-NAK4WDKS.js";
 import {
   REQUEST_ID_HEADER,
@@ -28,6 +25,13 @@ import {
   BaseCrudService,
   createCrudController
 } from "./chunk-JOVBJDJ2.js";
+import {
+  BaseResponseDto
+} from "./chunk-XX2HPTRU.js";
+import {
+  I18nModule,
+  translateOr
+} from "./chunk-IYUUYCP5.js";
 import "./chunk-DQYAIQQ5.js";
 import {
   ConflictAppException,
@@ -45,10 +49,6 @@ import {
 import {
   AppException
 } from "./chunk-YFYHLYHN.js";
-import {
-  I18nModule,
-  translateOr
-} from "./chunk-IYUUYCP5.js";
 import "./chunk-4MGIQFAJ.js";
 export {
   AppException,