@openora/core 0.4.0

package/dist/pam/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/pam/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/pam/identity/migrate.d.ts

@@ -0,0 +1,3 @@
+/** Apply the identity module migrations (idempotent: drizzle skips already-recorded ones). */
+export declare function migrate(databaseUrl?: string): Promise<void>;
+//# sourceMappingURL=migrate.d.ts.map

package/dist/pam/identity/migrate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.d.ts","sourceRoot":"","sources":["../../../src/pam/identity/migrate.ts"],"names":[],"mappings":"AAMA,8FAA8F;AAC9F,wBAAgB,OAAO,CAAC,WAAW,CAAC,EAAE,MAAM,iBAS3C"}

package/dist/pam/identity/migrate.js

@@ -0,0 +1,17 @@
+// Applies this module's own migration set against its own tracking table, so it
+// never collides with sibling modules that share the database. SQL ships in the
+// tarball ('files') and loads via an import.meta.url-relative path. See ADR-0020/0027.
+import { fileURLToPath } from 'node:url';
+import { runMigrations } from '@openora/core/server/migrate';
+/** Apply the identity module migrations (idempotent: drizzle skips already-recorded ones). */
+export function migrate(databaseUrl) {
+    return runMigrations({
+        migrationsFolder: fileURLToPath(new URL('./drizzle/migrations', import.meta.url)),
+        migrationsTable: '__drizzle_migrations_identity',
+        migrationsSchema: 'drizzle',
+        // user.email GIN trgm index (admin substring search) needs the pg_trgm extension.
+        extensions: ['pg_trgm'],
+        ...(databaseUrl ? { databaseUrl } : {}),
+    });
+}
+//# sourceMappingURL=migrate.js.map

package/dist/pam/identity/migrate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migrate.js","sourceRoot":"","sources":["../../../src/pam/identity/migrate.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,gFAAgF;AAChF,uFAAuF;AACvF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAE7D,8FAA8F;AAC9F,MAAM,UAAU,OAAO,CAAC,WAAoB;IAC1C,OAAO,aAAa,CAAC;QACnB,gBAAgB,EAAE,aAAa,CAAC,IAAI,GAAG,CAAC,sBAAsB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,eAAe,EAAE,+BAA+B;QAChD,gBAAgB,EAAE,SAAS;QAC3B,kFAAkF;QAClF,UAAU,EAAE,CAAC,SAAS,CAAC;QACvB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACxC,CAAC,CAAC;AACL,CAAC"}

package/dist/pam/identity/plugin.d.ts

@@ -0,0 +1,3 @@
+declare const _default: import("@openora/core/server").Plugin;
+export default _default;
+//# sourceMappingURL=plugin.d.ts.map

package/dist/pam/identity/plugin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.d.ts","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":";AAqBA,wBA+CG"}

package/dist/pam/identity/plugin.js

@@ -0,0 +1,40 @@
+import { ADMIN_USER_DIRECTORY, IDENTITY_READER, KYC_ADAPTER, LOGIN_ENFORCEMENT, NOTIFICATION_DELIVERY_ADAPTER, SEND_EMAIL, IDENTITY_OPTIONS, RATE_LIMITER, PLATFORM_CONFIG, SESSION_COMMANDS, } from '@openora/core/contracts';
+import { definePlugin, ADMIN_GUARD, EVENT_BUS, DRIZZLE } from '@openora/core/server';
+import { MockKycAdapter } from './adapters/mock/mock-kyc-adapter.js';
+import { DrizzleAdminUserDirectory } from './admin-user-directory.js';
+import { IdentityReaderService } from './adapters/identity-reader.service.js';
+import { createIdentityRouter } from './router/index.js';
+import { IdentityService } from './service/identity.service.js';
+import { SessionService } from './service/session.service.js';
+import { LoginEnforcementService } from './service/login-enforcement.service.js';
+export default definePlugin({
+    id: 'identity',
+    register(ctx) {
+        ctx.provide(KYC_ADAPTER, () => new MockKycAdapter());
+        // The back-office depends on this port, not on the identity schema directly.
+        ctx.provide(ADMIN_USER_DIRECTORY, (c) => new DrizzleAdminUserDirectory(c.get(DRIZZLE), c.get(EVENT_BUS)));
+        // Read-only session queries for cross-module consumers (eg tag inactive evaluation).
+        ctx.provide(IDENTITY_READER, (c) => new IdentityReaderService(c.get(DRIZZLE)));
+        // Resolved lazily so identity does not depend on the notifications plugin's load order.
+        ctx.provide(SEND_EMAIL, (c) => ({
+            send: ({ to, subject, body }) => c.get(NOTIFICATION_DELIVERY_ADAPTER).sendEmail(to, subject, body),
+        }));
+        // RG login-block writer. compliance drives it through the port, never the schema.
+        ctx.provide(LOGIN_ENFORCEMENT, (c) => new LoginEnforcementService(c.get(DRIZZLE), new SessionService({ drizzle: c.get(DRIZZLE), events: c.get(EVENT_BUS) })));
+        ctx.provide(SESSION_COMMANDS, (c) => {
+            const sessionSvc = new SessionService({ drizzle: c.get(DRIZZLE), events: c.get(EVENT_BUS) });
+            return {
+                revokeAll: (userId, actorId) => sessionSvc.revokeAllSessions(userId, actorId),
+            };
+        });
+        ctx.routers.add('identity', (c) => createIdentityRouter(new IdentityService({
+            drizzle: c.get(DRIZZLE),
+            events: c.get(EVENT_BUS),
+            email: c.get(SEND_EMAIL),
+            options: c.has(IDENTITY_OPTIONS) ? c.get(IDENTITY_OPTIONS) : undefined,
+            limiter: c.get(RATE_LIMITER),
+            platformConfig: c.has(PLATFORM_CONFIG) ? c.get(PLATFORM_CONFIG) : undefined,
+        }), new SessionService({ drizzle: c.get(DRIZZLE), events: c.get(EVENT_BUS) }), c.get(ADMIN_GUARD), c.get(EVENT_BUS)));
+    },
+});
+//# sourceMappingURL=plugin.js.map

package/dist/pam/identity/plugin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin.js","sourceRoot":"","sources":["../../../src/pam/identity/plugin.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,eAAe,EACf,WAAW,EACX,iBAAiB,EACjB,6BAA6B,EAC7B,UAAU,EACV,gBAAgB,EAChB,YAAY,EACZ,eAAe,EACf,gBAAgB,GACjB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AACrE,OAAO,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AAC9E,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,wCAAwC,CAAC;AAEjF,eAAe,YAAY,CAAC;IAC1B,EAAE,EAAE,UAAU;IACd,QAAQ,CAAC,GAAG;QACV,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,GAAG,EAAE,CAAC,IAAI,cAAc,EAAE,CAAC,CAAC;QACrD,6EAA6E;QAC7E,GAAG,CAAC,OAAO,CACT,oBAAoB,EACpB,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CACvE,CAAC;QACF,qFAAqF;QACrF,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC/E,wFAAwF;QACxF,GAAG,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC9B,IAAI,EAAE,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAC9B,CAAC,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC;SACpE,CAAC,CAAC,CAAC;QACJ,kFAAkF;QAClF,GAAG,CAAC,OAAO,CACT,iBAAiB,EACjB,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,uBAAuB,CACzB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EACd,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAC1E,CACJ,CAAC;QACF,GAAG,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC,EAAE,EAAE;YAClC,MAAM,UAAU,GAAG,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7F,OAAO;gBACL,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,iBAAiB,CAAC,MAAM,EAAE,OAAO,CAAC;aAC9E,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAChC,oBAAoB,CAClB,IAAI,eAAe,CAAC;YAClB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC;YACxB,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC;YACxB,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,SAAS;YACtE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC;YAC5B,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5E,CAAC,EACF,IAAI,cAAc,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,EACzE,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,EAClB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CACjB,CACF,CAAC;IACJ,CAAC;CACF,CAAC,CAAC"}

package/dist/pam/identity/react/account.d.ts

@@ -0,0 +1,51 @@
+import type { Enable2faResult } from '@openora/core/contracts';
+export type { Enable2faResult };
+export declare function useEnable2fa(): import("@tanstack/react-query").UseMutationResult<{
+    totpUri: string;
+    backupCodes: string[];
+}, Error, {
+    password: string;
+}, unknown>;
+export declare function useVerify2fa(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    code: string;
+}, unknown>;
+export declare function useDisable2fa(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    password: string;
+}, unknown>;
+export declare function useVerifyEmail(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    token: string;
+}, unknown>;
+export declare function useUpdateProfile(): import("@tanstack/react-query").UseMutationResult<{
+    user: {
+        id: string;
+        email: string;
+        name: string;
+        emailVerified: boolean;
+        theme: "light" | "dark" | "system";
+        language: string;
+        createdAt: string;
+        updatedAt: string;
+        image?: string | null | undefined;
+    };
+}, Error, {
+    name?: string | undefined;
+    image?: string | null | undefined;
+    theme?: "light" | "dark" | "system" | undefined;
+    language?: string | undefined;
+}, unknown>;
+export declare function useChangePassword(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    currentPassword: string;
+    newPassword: string;
+}, unknown>;
+export declare function useSendEmailVerification(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, unknown, unknown>;
+//# sourceMappingURL=account.d.ts.map

package/dist/pam/identity/react/account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/account.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,YAAY,EAAE,eAAe,EAAE,CAAC;AAOhC,wBAAgB,YAAY;;;;;YAO3B;AAED,wBAAgB,YAAY;;;;YAO3B;AAED,wBAAgB,aAAa;;;;YAO5B;AAED,wBAAgB,cAAc;;;;YAO7B;AAED,wBAAgB,gBAAgB;;;;;;;;;;;;;;;;;YAO/B;AAED,wBAAgB,iBAAiB;;;;;YAOhC;AAED,wBAAgB,wBAAwB;;4BAKvC"}

package/dist/pam/identity/react/account.js

@@ -0,0 +1,60 @@
+'use client';
+import { useMutation, useQueryClient } from '@tanstack/react-query';
+import { useOrpcQueryUtils } from '@openora/core/react';
+import { identityContract } from '../contract/index.js';
+const invalidateMe = (utils, queryClient) => () => queryClient.invalidateQueries({ queryKey: utils.me.key() });
+export function useEnable2fa() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.enable2fa.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useVerify2fa() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.verify2fa.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useDisable2fa() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.disable2fa.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useVerifyEmail() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.verifyEmail.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useUpdateProfile() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.updateProfile.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useChangePassword() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.changePassword.mutationOptions(),
+        onSuccess: invalidateMe(utils, queryClient),
+    });
+}
+export function useSendEmailVerification() {
+    const utils = useOrpcQueryUtils(identityContract);
+    return useMutation({
+        ...utils.sendEmailVerification.mutationOptions(),
+    });
+}
+//# sourceMappingURL=account.js.map

package/dist/pam/identity/react/account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"account.js","sourceRoot":"","sources":["../../../../src/pam/identity/react/account.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,cAAc,EAAoB,MAAM,uBAAuB,CAAC;AAEtF,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAMxD,MAAM,YAAY,GAAG,CAAC,KAAoB,EAAE,WAAwB,EAAE,EAAE,CAAC,GAAG,EAAE,CAC5E,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;AAE9D,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE;QACpC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,SAAS,CAAC,eAAe,EAAE;QACpC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,aAAa;IAC3B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,UAAU,CAAC,eAAe,EAAE;QACrC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,WAAW,CAAC,eAAe,EAAE;QACtC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE;QACxC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,cAAc,CAAC,eAAe,EAAE;QACzC,SAAS,EAAE,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC;KAC5C,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,qBAAqB,CAAC,eAAe,EAAE;KACjD,CAAC,CAAC;AACL,CAAC"}

package/dist/pam/identity/react/auth.d.ts

@@ -0,0 +1,65 @@
+export declare function useCurrentUser(): import("@tanstack/react-query").UseQueryResult<NoInfer<{
+    id: string;
+    email: string;
+    name: string;
+    emailVerified: boolean;
+    theme: "light" | "dark" | "system";
+    language: string;
+    createdAt: string;
+    updatedAt: string;
+    image?: string | null | undefined;
+} | null>, Error>;
+export declare function useLogin(): import("@tanstack/react-query").UseMutationResult<{
+    user?: {
+        id: string;
+        email: string;
+        name: string;
+        emailVerified: boolean;
+        theme: "light" | "dark" | "system";
+        language: string;
+        createdAt: string;
+        updatedAt: string;
+        image?: string | null | undefined;
+    } | undefined;
+    session?: {
+        token: string;
+        expiresAt: string;
+    } | undefined;
+    twoFactorRedirect?: boolean | undefined;
+}, Error, {
+    email: string;
+    password: string;
+    rememberMe?: boolean | undefined;
+}, unknown>;
+export declare function useLogout(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, unknown, unknown>;
+export declare function useRegister(): import("@tanstack/react-query").UseMutationResult<{
+    user: {
+        id: string;
+        email: string;
+        name: string;
+        emailVerified: boolean;
+        theme: "light" | "dark" | "system";
+        language: string;
+        createdAt: string;
+        updatedAt: string;
+        image?: string | null | undefined;
+    };
+}, Error, {
+    email: string;
+    password: string;
+    name: string;
+}, unknown>;
+export declare function useRequestPasswordReset(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    email: string;
+}, unknown>;
+export declare function useResetPassword(): import("@tanstack/react-query").UseMutationResult<{
+    success: true;
+}, Error, {
+    token: string;
+    newPassword: string;
+}, unknown>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/pam/identity/react/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/react/auth.ts"],"names":[],"mappings":"AAMA,wBAAgB,cAAc;;;;;;;;;;kBAG7B;AAED,wBAAgB,QAAQ;;;;;;;;;;;;;;;;;;;;;YAOvB;AAED,wBAAgB,SAAS;;4BAOxB;AAED,wBAAgB,WAAW;;;;;;;;;;;;;;;;YAO1B;AAED,wBAAgB,uBAAuB;;;;YAKtC;AAED,wBAAgB,gBAAgB;;;;;YAK/B"}

package/dist/pam/identity/react/auth.js

@@ -0,0 +1,45 @@
+'use client';
+import { useMutation, useQuery, useQueryClient } from '@tanstack/react-query';
+import { useOrpcQueryUtils } from '@openora/core/react';
+import { identityContract } from '../contract/index.js';
+export function useCurrentUser() {
+    const utils = useOrpcQueryUtils(identityContract);
+    return useQuery({ ...utils.me.queryOptions(), retry: false });
+}
+export function useLogin() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.login.mutationOptions(),
+        onSuccess: () => queryClient.invalidateQueries({ queryKey: utils.me.key() }),
+    });
+}
+export function useLogout() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.logout.mutationOptions(),
+        onSuccess: () => queryClient.setQueryData(utils.me.queryKey(), null),
+    });
+}
+export function useRegister() {
+    const utils = useOrpcQueryUtils(identityContract);
+    const queryClient = useQueryClient();
+    return useMutation({
+        ...utils.register.mutationOptions(),
+        onSuccess: () => queryClient.invalidateQueries({ queryKey: utils.me.key() }),
+    });
+}
+export function useRequestPasswordReset() {
+    const utils = useOrpcQueryUtils(identityContract);
+    return useMutation({
+        ...utils.requestPasswordReset.mutationOptions(),
+    });
+}
+export function useResetPassword() {
+    const utils = useOrpcQueryUtils(identityContract);
+    return useMutation({
+        ...utils.resetPassword.mutationOptions(),
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/pam/identity/react/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../src/pam/identity/react/auth.ts"],"names":[],"mappings":"AAAA,YAAY,CAAC;AAEb,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC9E,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,MAAM,UAAU,cAAc;IAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,QAAQ,CAAC,EAAE,GAAG,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,UAAU,QAAQ;IACtB,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,KAAK,CAAC,eAAe,EAAE;QAChC,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,MAAM,CAAC,eAAe,EAAE;QACjC,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,CAAC;KACrE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,QAAQ,CAAC,eAAe,EAAE;QACnC,SAAS,EAAE,GAAG,EAAE,CAAC,WAAW,CAAC,iBAAiB,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC;KAC7E,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,uBAAuB;IACrC,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,oBAAoB,CAAC,eAAe,EAAE;KAChD,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,MAAM,KAAK,GAAG,iBAAiB,CAAC,gBAAgB,CAAC,CAAC;IAClD,OAAO,WAAW,CAAC;QACjB,GAAG,KAAK,CAAC,aAAa,CAAC,eAAe,EAAE;KACzC,CAAC,CAAC;AACL,CAAC"}

package/dist/pam/identity/router/index.d.ts

@@ -0,0 +1,182 @@
+import { type OssContext, AdminGuard, type EventBus } from '@openora/core/server';
+import { IdentityService } from '../service/identity.service.js';
+import { SessionService } from '../service/session.service.js';
+export declare function createIdentityRouter(identity: IdentityService, sessionSvc: SessionService, adminGuard: AdminGuard, eventBus: EventBus): {
+    register: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        email: import("zod").ZodEmail;
+        password: import("zod").ZodString;
+        name: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        user: import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+            email: import("zod").ZodEmail;
+            name: import("zod").ZodString;
+            emailVerified: import("zod").ZodBoolean;
+            image: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodURL>>;
+            theme: import("zod").ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: import("zod").ZodString;
+            createdAt: import("zod").ZodISODateTime;
+            updatedAt: import("zod").ZodISODateTime;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    login: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        email: import("zod").ZodEmail;
+        password: import("zod").ZodString;
+        rememberMe: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        user: import("zod").ZodOptional<import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+            email: import("zod").ZodEmail;
+            name: import("zod").ZodString;
+            emailVerified: import("zod").ZodBoolean;
+            image: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodURL>>;
+            theme: import("zod").ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: import("zod").ZodString;
+            createdAt: import("zod").ZodISODateTime;
+            updatedAt: import("zod").ZodISODateTime;
+        }, import("zod/v4/core").$strip>>;
+        session: import("zod").ZodOptional<import("zod").ZodObject<{
+            token: import("zod").ZodString;
+            expiresAt: import("zod").ZodISODateTime;
+        }, import("zod/v4/core").$strip>>;
+        twoFactorRedirect: import("zod").ZodOptional<import("zod").ZodBoolean>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    logout: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    me: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodNullable<import("zod").ZodObject<{
+        id: import("zod").ZodUUID;
+        email: import("zod").ZodEmail;
+        name: import("zod").ZodString;
+        emailVerified: import("zod").ZodBoolean;
+        image: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodURL>>;
+        theme: import("zod").ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>;
+        language: import("zod").ZodString;
+        createdAt: import("zod").ZodISODateTime;
+        updatedAt: import("zod").ZodISODateTime;
+    }, import("zod/v4/core").$strip>>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    streamSession: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("@orpc/server").Schema<AsyncIteratorObject<{
+        type: "revoked";
+    }, unknown, void>, import("@orpc/server").AsyncIteratorClass<{
+        type: "revoked";
+    }, unknown, void>>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    enable2fa: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        password: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        totpUri: import("zod").ZodString;
+        backupCodes: import("zod").ZodArray<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    verify2fa: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        code: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    disable2fa: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        password: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    requestPasswordReset: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        email: import("zod").ZodEmail;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    resetPassword: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        token: import("zod").ZodString;
+        newPassword: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    changePassword: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        currentPassword: import("zod").ZodString;
+        newPassword: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    sendEmailVerification: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("@orpc/server").Schema<unknown, unknown>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    verifyEmail: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        token: import("zod").ZodString;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    changeEmail: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        newEmail: import("zod").ZodEmail;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    updateProfile: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        name: import("zod").ZodOptional<import("zod").ZodString>;
+        image: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodURL>>;
+        theme: import("zod").ZodOptional<import("zod").ZodEnum<{
+            light: "light";
+            dark: "dark";
+            system: "system";
+        }>>;
+        language: import("zod").ZodOptional<import("zod").ZodString>;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        user: import("zod").ZodObject<{
+            id: import("zod").ZodUUID;
+            email: import("zod").ZodEmail;
+            name: import("zod").ZodString;
+            emailVerified: import("zod").ZodBoolean;
+            image: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodURL>>;
+            theme: import("zod").ZodEnum<{
+                light: "light";
+                dark: "dark";
+                system: "system";
+            }>;
+            language: import("zod").ZodString;
+            createdAt: import("zod").ZodISODateTime;
+            updatedAt: import("zod").ZodISODateTime;
+        }, import("zod/v4/core").$strip>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    unlockUser: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+        userId: import("zod").ZodUUID;
+    }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+        success: import("zod").ZodLiteral<true>;
+    }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    sessions: {
+        list: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            page: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+            limit: import("zod").ZodDefault<import("zod").ZodCoercedNumber<unknown>>;
+            userId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            items: import("zod").ZodArray<import("zod").ZodObject<{
+                id: import("zod").ZodUUID;
+                expiresAt: import("zod").ZodISODateTime;
+                createdAt: import("zod").ZodISODateTime;
+                ipAddress: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+                userAgent: import("zod").ZodOptional<import("zod").ZodNullable<import("zod").ZodString>>;
+            }, import("zod/v4/core").$strip>>;
+            total: import("zod").ZodNumber;
+            page: import("zod").ZodNumber;
+            limit: import("zod").ZodNumber;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        revoke: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+            id: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+        revokeAll: import("@orpc/server").Procedure<import("@orpc/server").MergedInitialContext<OssContext & Record<never, never>, OssContext & Record<never, never>, OssContext>, OssContext, import("zod").ZodObject<{
+            userId: import("zod").ZodUUID;
+        }, import("zod/v4/core").$strip>, import("zod").ZodObject<{
+            success: import("zod").ZodLiteral<true>;
+        }, import("zod/v4/core").$strip>, import("@orpc/server").MergedErrorMap<Record<never, never>, Record<never, never>>, Record<never, never>>;
+    };
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/pam/identity/router/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,UAAU,EACf,UAAU,EAIV,KAAK,QAAQ,EACd,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EAAE,eAAe,EAAE,MAAM,gCAAgC,CAAC;AACjE,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAG/D,wBAAgB,oBAAoB,CAClC,QAAQ,EAAE,eAAe,EACzB,UAAU,EAAE,cAAc,EAC1B,UAAU,EAAE,UAAU,EACtB,QAAQ,EAAE,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA4GnB"}

package/dist/pam/identity/router/index.js

@@ -0,0 +1,63 @@
+import { implement } from '@orpc/server';
+import { mapErrors, getUserId, createEventStreamGenerator, } from '@openora/core/server';
+import { identityContract } from '../contract/index.js';
+import { UnsupportedLanguageError } from '../../shared/language.js';
+export function createIdentityRouter(identity, sessionSvc, adminGuard, eventBus) {
+    const os = implement(identityContract).$context();
+    return os.router({
+        register: os.register.handler(({ input, context }) => identity.register(input, context.request.headers, context.resHeaders ?? new Headers())),
+        login: os.login.handler(({ input, context }) => identity.login(input, context.request.headers, context.resHeaders ?? new Headers())),
+        logout: os.logout.handler(({ context }) => identity.logout(context.request.headers, context.resHeaders ?? new Headers())),
+        me: os.me.handler(({ context }) => {
+            // Disable browser caching for the session state query. This prevents aggressive
+            // heuristic caching (e.g. in Chrome/Safari) from serving a stale logged-in session
+            // state after the session is revoked or logged out.
+            if (context.resHeaders) {
+                context.resHeaders.set('Cache-Control', 'no-store, no-cache, must-revalidate');
+                context.resHeaders.set('Pragma', 'no-cache');
+                context.resHeaders.set('Expires', '0');
+            }
+            return identity.me(context.request.headers);
+        }),
+        streamSession: os.streamSession.handler(({ signal, context }) => {
+            const userId = getUserId(context);
+            return createEventStreamGenerator((push) => {
+                const unsubscribe = eventBus.on('identity.sessions.revoked_all', (event) => {
+                    if (event.userId === userId) {
+                        push({ type: 'revoked' });
+                    }
+                });
+                return unsubscribe;
+            }, { signal });
+        }),
+        enable2fa: os.enable2fa.handler(({ input, context }) => identity.enableTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
+        verify2fa: os.verify2fa.handler(({ input, context }) => identity.verifyTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
+        disable2fa: os.disable2fa.handler(({ input, context }) => identity.disableTwoFactor(input, context.request.headers, context.resHeaders ?? new Headers())),
+        requestPasswordReset: os.requestPasswordReset.handler(({ input }) => identity.requestPasswordReset(input)),
+        resetPassword: os.resetPassword.handler(({ input }) => identity.resetPassword(input)),
+        changePassword: os.changePassword.handler(({ input, context }) => identity.changePassword(input, context.request.headers, context.resHeaders ?? new Headers())),
+        sendEmailVerification: os.sendEmailVerification.handler(({ context }) => identity.sendEmailVerification(context.request.headers)),
+        verifyEmail: os.verifyEmail.handler(({ input, context }) => identity.verifyEmail(input, context.request.headers)),
+        changeEmail: os.changeEmail.handler(({ input, context }) => identity.changeEmail(input, context.request.headers, context.resHeaders ?? new Headers())),
+        updateProfile: os.updateProfile.handler(({ input, context }) => mapErrors({ BAD_REQUEST: UnsupportedLanguageError }, () => identity.updateProfile(input, context.request.headers, context.resHeaders ?? new Headers()))),
+        unlockUser: os.unlockUser.handler(async ({ input, context }) => {
+            const caller = await adminGuard.assert(context, 'player', 'update');
+            return identity.unlockUser(input.userId, caller.userId);
+        }),
+        sessions: {
+            list: os.sessions.list.handler(async ({ input, context }) => {
+                await adminGuard.assert(context, 'sessions', 'view');
+                return sessionSvc.listSessions(input.userId, input.page, input.limit);
+            }),
+            revoke: os.sessions.revoke.handler(async ({ input, context }) => {
+                const caller = await adminGuard.assert(context, 'sessions', 'revoke');
+                return sessionSvc.revokeSession(input.userId, input.id, caller.userId);
+            }),
+            revokeAll: os.sessions.revokeAll.handler(async ({ input, context }) => {
+                const caller = await adminGuard.assert(context, 'sessions', 'revoke');
+                return sessionSvc.revokeAllSessions(input.userId, caller.userId);
+            }),
+        },
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/pam/identity/router/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/pam/identity/router/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACzC,OAAO,EAGL,SAAS,EACT,SAAS,EACT,0BAA0B,GAE3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAGxD,OAAO,EAAE,wBAAwB,EAAE,MAAM,0BAA0B,CAAC;AAEpE,MAAM,UAAU,oBAAoB,CAClC,QAAyB,EACzB,UAA0B,EAC1B,UAAsB,EACtB,QAAkB;IAElB,MAAM,EAAE,GAAG,SAAS,CAAC,gBAAgB,CAAC,CAAC,QAAQ,EAAc,CAAC;IAE9D,OAAO,EAAE,CAAC,MAAM,CAAC;QACf,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACnD,QAAQ,CAAC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACvF;QAED,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7C,QAAQ,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CACpF;QAED,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACxC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9E;QAED,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE;YAChC,gFAAgF;YAChF,mFAAmF;YACnF,oDAAoD;YACpD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBACvB,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,qCAAqC,CAAC,CAAC;gBAC/E,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;gBAC7C,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YACD,OAAO,QAAQ,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,CAAC,CAAC;QAEF,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,EAAE;YAC9D,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;YAClC,OAAO,0BAA0B,CAC/B,CAAC,IAAI,EAAE,EAAE;gBACP,MAAM,WAAW,GAAG,QAAQ,CAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,KAAK,EAAE,EAAE;oBACzE,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;wBAC5B,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;oBAC5B,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO,WAAW,CAAC;YACrB,CAAC,EACD,EAAE,MAAM,EAAE,CACX,CAAC;QACJ,CAAC,CAAC;QAEF,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACrD,QAAQ,CAAC,eAAe,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC9F;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACvD,QAAQ,CAAC,gBAAgB,CACvB,KAAK,EACL,OAAO,CAAC,OAAO,CAAC,OAAO,EACvB,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CACpC,CACF;QAED,oBAAoB,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAClE,QAAQ,CAAC,oBAAoB,CAAC,KAAK,CAAC,CACrC;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAErF,cAAc,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC/D,QAAQ,CAAC,cAAc,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC7F;QAED,qBAAqB,EAAE,EAAE,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CACtE,QAAQ,CAAC,qBAAqB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACxD;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CACrD;QAED,WAAW,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CACzD,QAAQ,CAAC,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC1F;QAED,aAAa,EAAE,EAAE,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,wBAAwB,EAAE,EAAE,GAAG,EAAE,CACxD,QAAQ,CAAC,aAAa,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,UAAU,IAAI,IAAI,OAAO,EAAE,CAAC,CAC5F,CACF;QAED,UAAU,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;YAC7D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACpE,OAAO,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;QAC1D,CAAC,CAAC;QAEF,QAAQ,EAAE;YACR,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC1D,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;gBACrD,OAAO,UAAU,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACxE,CAAC,CAAC;YACF,MAAM,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBAC9D,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACzE,CAAC,CAAC;YACF,SAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;gBACpE,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO,UAAU,CAAC,iBAAiB,CAAC,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;YACnE,CAAC,CAAC;SACH;KACF,CAAC,CAAC;AACL,CAAC"}