@opensaas/stack-core 0.39.1 → 0.40.0

package/dist/mcp/projection.js

@@ -0,0 +1,390 @@
+import { checkAccess, getRelatedListConfig } from '../access/engine.js';
+import { validateQueryFieldReadAccess, validateQueryKeys } from '../access/query-validation.js';
+import { pickFields } from '../query/index.js';
+import { MCP_NESTED_TAKE_DEFAULT, MCP_NESTED_TAKE_MAX } from './constants.js';
+/** A scalar/virtual field in a `fields` projection is selected by naming it `true` — this advertises that, not the field's own value shape (`fieldToJsonSchema`, used for `create`/`update`, is a different schema entirely). */
+function scalarSelectorSchema(fieldName) {
+    return { type: 'boolean', description: `Include the "${fieldName}" field` };
+}
+/**
+ * `id`/`createdAt`/`updatedAt` are added to every list automatically and
+ * excluded from `listConfig.fields` (CLAUDE.md's "System Fields"), so they
+ * need their own selector entries at every level a `fields` projection can
+ * name fields — a scalar-only loop over `listConfig.fields` would otherwise
+ * never advertise or accept them. `id` is additionally forced into every
+ * `FieldSelection` this module builds (`withId`, below), never left to the
+ * caller: a record projected down to none of its own identifying columns
+ * cannot be the target of a follow-up `update`/`delete` call.
+ */
+function systemFieldProperties() {
+    return {
+        id: {
+            type: 'boolean',
+            description: 'Include the "id" field (always returned regardless of selection)',
+        },
+        createdAt: scalarSelectorSchema('createdAt'),
+        updatedAt: scalarSelectorSchema('updatedAt'),
+    };
+}
+function isSystemFieldName(name) {
+    return name === 'id' || name === 'createdAt' || name === 'updatedAt';
+}
+/** Force `id` into a field selection being built for one level of a `fields` projection — see `systemFieldProperties`'s doc comment. */
+function withId(selection) {
+    return { ...selection, id: true };
+}
+/**
+ * Thrown when a `query` tool's `fields` argument names something the
+ * generated projection schema does not advertise — an unknown field, a
+ * relation two levels deeper than enumerated, or the wrong shape for what
+ * it named. Caught in the MCP handler and turned into an `isError` tool
+ * result (never a JSON-RPC protocol error, #995) naming what was asked for
+ * and what is available, so the calling model can retry narrower.
+ */
+export class McpProjectionRefusedError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'McpProjectionRefusedError';
+    }
+}
+function isRelationshipField(fieldConfig) {
+    return (!!fieldConfig &&
+        fieldConfig.type === 'relationship' &&
+        'ref' in fieldConfig &&
+        !!fieldConfig.ref);
+}
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- RelationshipField must accept any TypeInfo
+function isMany(fieldConfig) {
+    return fieldConfig.many === true;
+}
+/**
+ * Resolve a relation field's target list, or `null` if it should not be
+ * advertised/selectable at all: the ref doesn't resolve, its MCP tools are
+ * disabled (ADR-0033 — a list with `mcp.enabled: false` is unreachable
+ * through MCP, including as a relation target), or this session's
+ * operation-level `query` access on it is denied outright.
+ */
+async function relatedListIfVisible(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- RelationshipField must accept any TypeInfo
+fieldConfig, config, session, context) {
+    const related = getRelatedListConfig(fieldConfig.ref, config);
+    if (!related)
+        return null;
+    if (related.listConfig.mcp?.enabled === false)
+        return null;
+    const queryAccess = related.listConfig.access?.operation?.query;
+    const result = await checkAccess(queryAccess, { session, context });
+    if (result === false)
+        return null;
+    return related;
+}
+/**
+ * Generate the JSON Schema for the `query` tool's `fields` projection
+ * argument: two levels of the list's own vocabulary (ADR-0033). Level 1 is
+ * this list's own scalar/virtual fields (booleans) and relations (nested
+ * objects); level 2, inside a relation's own `fields`, is the related
+ * list's scalar/virtual fields only — a relation named there terminates
+ * (not itself selectable further), which is what keeps the schema finite
+ * against a self-referential relationship. Denied/MCP-disabled relation
+ * targets are omitted from the vocabulary entirely, per-session.
+ */
+export async function generateFieldsProjectionSchema(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, config, session, context) {
+    const properties = systemFieldProperties();
+    for (const [fieldName, fieldConfig] of Object.entries(listConfig.fields)) {
+        if (!isRelationshipField(fieldConfig)) {
+            properties[fieldName] = scalarSelectorSchema(fieldName);
+            continue;
+        }
+        const related = await relatedListIfVisible(fieldConfig, config, session, context);
+        if (!related)
+            continue;
+        const level2Properties = systemFieldProperties();
+        for (const [relFieldName, relFieldConfig] of Object.entries(related.listConfig.fields)) {
+            if (isRelationshipField(relFieldConfig))
+                continue;
+            level2Properties[relFieldName] = scalarSelectorSchema(relFieldName);
+        }
+        const many = isMany(fieldConfig);
+        properties[fieldName] = {
+            type: 'object',
+            description: many
+                ? `Select fields from the related ${related.listName} records`
+                : `Select fields from the related ${related.listName} record`,
+            properties: {
+                fields: {
+                    type: 'object',
+                    description: `Fields to return from ${related.listName}`,
+                    properties: level2Properties,
+                    additionalProperties: false,
+                },
+                ...(many
+                    ? {
+                        where: { type: 'object', description: `Prisma where clause for ${related.listName}` },
+                        orderBy: { type: 'object', description: 'Sort order' },
+                        take: {
+                            type: 'number',
+                            description: `Max rows to return (default ${MCP_NESTED_TAKE_DEFAULT}, hard cap ${MCP_NESTED_TAKE_MAX})`,
+                        },
+                        skip: { type: 'number', description: 'Rows to skip' },
+                        count: {
+                            type: 'boolean',
+                            description: 'Return the total row count instead of, or alongside, the rows themselves',
+                        },
+                    }
+                    : {}),
+            },
+            ...(many ? {} : { required: ['fields'] }),
+            additionalProperties: false,
+        };
+    }
+    return {
+        type: 'object',
+        description: 'Select which fields (and, for relations, which nested fields) to return. Omit to get scalars and virtuals only, unchanged from today.',
+        properties,
+        additionalProperties: false,
+    };
+}
+/**
+ * Build the `context.db` include entry for a to-many relation's own rows —
+ * shared by a `fields`-selected relation and a count-only one (the latter
+ * fetches identically, just never adds the key to `fieldSelection`, so the
+ * rows reach field-visibility's access check but never the caller).
+ */
+function buildManyIncludeEntry(many, entry) {
+    if (!many)
+        return true;
+    const includeEntry = {};
+    if (entry.where !== undefined)
+        includeEntry.where = entry.where;
+    if (entry.orderBy !== undefined)
+        includeEntry.orderBy = entry.orderBy;
+    const requestedTake = entry.take !== undefined ? Number(entry.take) : MCP_NESTED_TAKE_DEFAULT;
+    includeEntry.take = Math.min(requestedTake, MCP_NESTED_TAKE_MAX);
+    if (entry.skip !== undefined)
+        includeEntry.skip = entry.skip;
+    return includeEntry;
+}
+/** Access-scoped `_count.select` entry for one to-many relation: the related list's `query` access ANDed with any caller `where` on that same relation — mirrors how `buildAccessScopedInclude` scopes the relation's own rows (`andWhere`), since Prisma's `_count` is a sibling key that walk does not itself touch. */
+async function accessScopedCountEntry(
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- RelationshipField must accept any TypeInfo
+fieldConfig, config, session, context, callerWhere) {
+    const related = getRelatedListConfig(fieldConfig.ref, config);
+    if (!related)
+        return null;
+    const queryAccess = related.listConfig.access?.operation?.query;
+    const result = await checkAccess(queryAccess, { session, context });
+    if (result === false)
+        return null;
+    const accessWhere = typeof result === 'object' ? result : undefined;
+    const merged = accessWhere && callerWhere ? { AND: [accessWhere, callerWhere] } : (accessWhere ?? callerWhere);
+    return merged ? { where: merged } : true;
+}
+/**
+ * Validate a caller-supplied `fields` argument against the same vocabulary
+ * `generateFieldsProjectionSchema` advertises, and translate it into a
+ * `context.db` `include` (so the normal read pipeline — access scoping,
+ * `needs` folding, the depth cap — applies exactly as it does for any other
+ * caller `include`; no parallel read path) plus a `FieldSelection` for
+ * projecting the result down to what was asked for. Throws
+ * `McpProjectionRefusedError` naming what was asked for and what's
+ * available on any mismatch, never serves on a best-effort basis.
+ */
+export async function resolveFieldsProjection(fieldsArg, listKey, 
+// eslint-disable-next-line @typescript-eslint/no-explicit-any -- ListConfig must accept any TypeInfo
+listConfig, config, session, context) {
+    if (fieldsArg === null || typeof fieldsArg !== 'object' || Array.isArray(fieldsArg)) {
+        throw new McpProjectionRefusedError(`"fields" must be an object mapping field names to \`true\` or a relation selector.`);
+    }
+    const include = {};
+    // `id` is always projected back, whether or not the caller asked for it —
+    // see `systemFieldProperties`'s doc comment.
+    const fieldSelection = { id: true };
+    const countRequests = new Map();
+    let hasIncludeEntries = false;
+    for (const [fieldName, rawValue] of Object.entries(fieldsArg)) {
+        if (isSystemFieldName(fieldName)) {
+            if (rawValue !== true) {
+                throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" is a scalar — select it with \`true\`, not ${JSON.stringify(rawValue)}.`);
+            }
+            fieldSelection[fieldName] = true;
+            continue;
+        }
+        const fieldConfig = listConfig.fields[fieldName];
+        if (!fieldConfig) {
+            throw new McpProjectionRefusedError(`"${listKey}" has no field "${fieldName}". Available fields: ${Object.keys(listConfig.fields).join(', ')}.`);
+        }
+        if (!isRelationshipField(fieldConfig)) {
+            if (rawValue !== true) {
+                throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" is a scalar — select it with \`true\`, not ${JSON.stringify(rawValue)}.`);
+            }
+            fieldSelection[fieldName] = true;
+            continue;
+        }
+        const related = await relatedListIfVisible(fieldConfig, config, session, context);
+        if (!related) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" is not available for selection — its related list is not ` +
+                `queryable by this session, or has MCP disabled.`);
+        }
+        if (rawValue === null || typeof rawValue !== 'object' || Array.isArray(rawValue)) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" is a relation — select it with an object, e.g. { "fields": { ... } }.`);
+        }
+        const entry = rawValue;
+        const many = isMany(fieldConfig);
+        const allowedKeys = many
+            ? new Set(['fields', 'where', 'orderBy', 'take', 'skip', 'count'])
+            : new Set(['fields']);
+        for (const key of Object.keys(entry)) {
+            if (!allowedKeys.has(key)) {
+                throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" does not accept "${key}" (allowed: ${[...allowedKeys].join(', ')}).`);
+            }
+        }
+        // Type-check each key before it reaches Prisma — a malformed value here
+        // would otherwise only surface as an opaque Prisma error out of the
+        // `context.db` call below, instead of a clear refusal naming the shape
+        // that was expected (mirrors `access-filter.ts`'s `asEntryObject`).
+        if (entry.where !== undefined && (entry.where === null || typeof entry.where !== 'object')) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.where" must be an object.`);
+        }
+        if (entry.orderBy !== undefined &&
+            (entry.orderBy === null || typeof entry.orderBy !== 'object')) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.orderBy" must be an object or an array of objects.`);
+        }
+        if (entry.take !== undefined && typeof entry.take !== 'number') {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.take" must be a number.`);
+        }
+        if (entry.skip !== undefined && typeof entry.skip !== 'number') {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.skip" must be a number.`);
+        }
+        if (entry.count !== undefined && typeof entry.count !== 'boolean') {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.count" must be a boolean.`);
+        }
+        if (entry.take !== undefined && entry.take < 0) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.take" must not be negative (nested reverse pagination isn't supported).`);
+        }
+        // A nested `where`/`orderBy` names fields on the RELATED list — validate
+        // them the same way the root read path validates the root list's own
+        // `where`/`orderBy` (#912/#915), or a session could infer a field-level-
+        // denied related field's value from which rows come back, their order,
+        // or (via `count`, below) how many there are.
+        if (entry.where !== undefined || entry.orderBy !== undefined) {
+            validateQueryKeys({
+                where: entry.where,
+                orderBy: entry.orderBy,
+                listConfig: related.listConfig,
+                listName: related.listName,
+                config,
+                isSudo: false,
+            });
+            await validateQueryFieldReadAccess({
+                where: entry.where,
+                orderBy: entry.orderBy,
+                listConfig: related.listConfig,
+                listName: related.listName,
+                session,
+                context,
+                isSudo: false,
+            });
+        }
+        const nestedFieldsArg = entry.fields;
+        const wantsCount = many && entry.count === true;
+        if (nestedFieldsArg === undefined && !wantsCount) {
+            throw new McpProjectionRefusedError(`"${listKey}.${fieldName}" needs "fields"${many ? ' or "count"' : ''}.`);
+        }
+        const nestedSelection = {};
+        if (nestedFieldsArg !== undefined) {
+            if (nestedFieldsArg === null ||
+                typeof nestedFieldsArg !== 'object' ||
+                Array.isArray(nestedFieldsArg)) {
+                throw new McpProjectionRefusedError(`"${listKey}.${fieldName}.fields" must be an object.`);
+            }
+            for (const [relFieldName, relValue] of Object.entries(nestedFieldsArg)) {
+                if (!isSystemFieldName(relFieldName)) {
+                    const relFieldConfig = related.listConfig.fields[relFieldName];
+                    if (!relFieldConfig || isRelationshipField(relFieldConfig)) {
+                        throw new McpProjectionRefusedError(`"${related.listName}" has no selectable field "${relFieldName}" at this depth — relations ` +
+                            `are not selectable two levels deep; issue a second query for that.`);
+                    }
+                }
+                if (relValue !== true) {
+                    throw new McpProjectionRefusedError(`"${related.listName}.${relFieldName}" is a scalar — select it with \`true\`.`);
+                }
+                nestedSelection[relFieldName] = true;
+            }
+            include[fieldName] = buildManyIncludeEntry(many, entry);
+            hasIncludeEntries = true;
+            fieldSelection[fieldName] = { _type: 'fragment', _fields: withId(nestedSelection) };
+        }
+        else if (wantsCount) {
+            // Count-only (no `fields`): still name the relation in the include,
+            // with the SAME rows a `fields`-and-`count` request would fetch —
+            // never a synthetic zero-row placeholder. Field-visibility's read-
+            // access check for the relationship field runs against whatever the
+            // include actually fetched (`accessItem: workingItem`); a rule that
+            // inspects the relation's own value (e.g. `item.comments.length`)
+            // would see a permanently-empty array under `take: 0` regardless of
+            // the true content, which is wrong in the opposite direction from
+            // what this whole mechanism exists to prevent. The rows themselves
+            // never reach the caller — `fieldSelection` has no entry for this key
+            // — only the access decision `filterReadableFields` made against them
+            // does, read off in `projectMcpResult` below via whether the key
+            // survived into the filtered result.
+            include[fieldName] = buildManyIncludeEntry(many, entry);
+            hasIncludeEntries = true;
+        }
+        if (wantsCount) {
+            countRequests.set(fieldName, nestedFieldsArg !== undefined ? 'alongside' : 'only');
+        }
+    }
+    if (countRequests.size > 0) {
+        const countSelect = {};
+        for (const fieldName of countRequests.keys()) {
+            const fieldConfig = listConfig.fields[fieldName];
+            const rawEntry = fieldsArg[fieldName];
+            const scoped = await accessScopedCountEntry(fieldConfig, config, session, context, rawEntry.where);
+            if (scoped)
+                countSelect[fieldName] = scoped;
+        }
+        if (Object.keys(countSelect).length > 0) {
+            include._count = { select: countSelect };
+            hasIncludeEntries = true;
+        }
+    }
+    return {
+        include: hasIncludeEntries ? include : undefined,
+        fieldSelection: fieldSelection,
+        countRequests,
+    };
+}
+/**
+ * Project one raw (already access-checked and field-visibility-filtered)
+ * result row down to a resolved `fields` projection, folding in any
+ * requested relation counts from Prisma's `_count`.
+ *
+ * `_count` is not a declared field, so field-visibility (`filterReadableFields`)
+ * never applies the relationship field's own field-level `read` access to it
+ * the way it already does for the relation's rows. Rather than re-deriving
+ * that decision here — which would mean evaluating the field's access rule
+ * a second time against `rawItem`, a row `filterReadableFields` may have
+ * already stripped OTHER fields from, risking a different answer than the
+ * canonical one it computed against the true raw row — `resolveFieldsProjection`
+ * names every counted relation in the include (even a count-only one, with
+ * `take: 0`) purely so the ordinary pipeline makes that decision once, at the
+ * right place. A count is emitted only for a relation whose key survived
+ * into `rawItem`; one field-visibility dropped is a relation whose count
+ * must stay hidden too.
+ */
+export function projectMcpResult(rawItem, resolved) {
+    const picked = pickFields(rawItem, resolved.fieldSelection);
+    const rawCounts = rawItem._count;
+    const counts = rawCounts && typeof rawCounts === 'object' ? rawCounts : {};
+    for (const [key, mode] of resolved.countRequests) {
+        if (!(key in rawItem))
+            continue;
+        const count = typeof counts[key] === 'number' ? counts[key] : 0;
+        picked[key] = mode === 'only' ? count : { items: picked[key], count };
+    }
+    return picked;
+}
+//# sourceMappingURL=projection.js.map

package/dist/mcp/projection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projection.js","sourceRoot":"","sources":["../../src/mcp/projection.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AACvE,OAAO,EAAE,4BAA4B,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAA;AAE/F,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAA;AAC9C,OAAO,EAAE,uBAAuB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAA;AAE7E,iOAAiO;AACjO,SAAS,oBAAoB,CAAC,SAAiB;IAC7C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,WAAW,EAAE,gBAAgB,SAAS,SAAS,EAAE,CAAA;AAC7E,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,qBAAqB;IAC5B,OAAO;QACL,EAAE,EAAE;YACF,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,kEAAkE;SAChF;QACD,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC;QAC5C,SAAS,EAAE,oBAAoB,CAAC,WAAW,CAAC;KAC7C,CAAA;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAY;IACrC,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,CAAA;AACtE,CAAC;AAED,wIAAwI;AACxI,SAAS,MAAM,CAAC,SAAkC;IAChD,OAAO,EAAE,GAAG,SAAS,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;AACnC,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAA;IACzC,CAAC;CACF;AAED,SAAS,mBAAmB,CAC1B,WAAoC;IAGpC,OAAO,CACL,CAAC,CAAC,WAAW;QACb,WAAW,CAAC,IAAI,KAAK,cAAc;QACnC,KAAK,IAAI,WAAW;QACpB,CAAC,CAAC,WAAW,CAAC,GAAG,CAClB,CAAA;AACH,CAAC;AAED,4GAA4G;AAC5G,SAAS,MAAM,CAAC,WAAmC;IACjD,OAAO,WAAW,CAAC,IAAI,KAAK,IAAI,CAAA;AAClC,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,oBAAoB;AACjC,4GAA4G;AAC5G,WAAmC,EACnC,MAAsB,EACtB,OAAuB,EACvB,OAAsB;IAGtB,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAE1D,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACnE,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAEjC,OAAO,OAAO,CAAA;AAChB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,8BAA8B;AAClD,qGAAqG;AACrG,UAA2B,EAC3B,MAAsB,EACtB,OAAuB,EACvB,OAAsB;IAEtB,MAAM,UAAU,GAA4B,qBAAqB,EAAE,CAAA;IAEnE,KAAK,MAAM,CAAC,SAAS,EAAE,WAAW,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACzE,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,UAAU,CAAC,SAAS,CAAC,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAA;YACvD,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO;YAAE,SAAQ;QAEtB,MAAM,gBAAgB,GAA4B,qBAAqB,EAAE,CAAA;QACzE,KAAK,MAAM,CAAC,YAAY,EAAE,cAAc,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACvF,IAAI,mBAAmB,CAAC,cAAc,CAAC;gBAAE,SAAQ;YACjD,gBAAgB,CAAC,YAAY,CAAC,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAA;QACrE,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;QAChC,UAAU,CAAC,SAAS,CAAC,GAAG;YACtB,IAAI,EAAE,QAAQ;YACd,WAAW,EAAE,IAAI;gBACf,CAAC,CAAC,kCAAkC,OAAO,CAAC,QAAQ,UAAU;gBAC9D,CAAC,CAAC,kCAAkC,OAAO,CAAC,QAAQ,SAAS;YAC/D,UAAU,EAAE;gBACV,MAAM,EAAE;oBACN,IAAI,EAAE,QAAQ;oBACd,WAAW,EAAE,yBAAyB,OAAO,CAAC,QAAQ,EAAE;oBACxD,UAAU,EAAE,gBAAgB;oBAC5B,oBAAoB,EAAE,KAAK;iBAC5B;gBACD,GAAG,CAAC,IAAI;oBACN,CAAC,CAAC;wBACE,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,2BAA2B,OAAO,CAAC,QAAQ,EAAE,EAAE;wBACrF,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE;wBACtD,IAAI,EAAE;4BACJ,IAAI,EAAE,QAAQ;4BACd,WAAW,EAAE,+BAA+B,uBAAuB,cAAc,mBAAmB,GAAG;yBACxG;wBACD,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,cAAc,EAAE;wBACrD,KAAK,EAAE;4BACL,IAAI,EAAE,SAAS;4BACf,WAAW,EACT,0EAA0E;yBAC7E;qBACF;oBACH,CAAC,CAAC,EAAE,CAAC;aACR;YACD,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzC,oBAAoB,EAAE,KAAK;SAC5B,CAAA;IACH,CAAC;IAED,OAAO;QACL,IAAI,EAAE,QAAQ;QACd,WAAW,EACT,uIAAuI;QACzI,UAAU;QACV,oBAAoB,EAAE,KAAK;KAC5B,CAAA;AACH,CAAC;AASD;;;;;GAKG;AACH,SAAS,qBAAqB,CAC5B,IAAa,EACb,KAA8B;IAE9B,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,YAAY,GAA4B,EAAE,CAAA;IAChD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,YAAY,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAA;IAC/D,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS;QAAE,YAAY,CAAC,OAAO,GAAG,KAAK,CAAC,OAAO,CAAA;IACrE,MAAM,aAAa,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,uBAAuB,CAAA;IAC7F,YAAY,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAA;IAChE,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;QAAE,YAAY,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAA;IAC5D,OAAO,YAAY,CAAA;AACrB,CAAC;AAED,0TAA0T;AAC1T,KAAK,UAAU,sBAAsB;AACnC,4GAA4G;AAC5G,WAAmC,EACnC,MAAsB,EACtB,OAAuB,EACvB,OAAsB,EACtB,WAAgD;IAEhD,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAA;IAC7D,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAA;IAEzB,MAAM,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,CAAA;IAC/D,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,CAAA;IACnE,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAEjC,MAAM,WAAW,GAAG,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACnE,MAAM,MAAM,GACV,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,IAAI,WAAW,CAAC,CAAA;IACjG,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,CAAA;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,SAAkB,EAClB,OAAe;AACf,qGAAqG;AACrG,UAA2B,EAC3B,MAAsB,EACtB,OAAuB,EACvB,OAAsB;IAEtB,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QACpF,MAAM,IAAI,yBAAyB,CACjC,oFAAoF,CACrF,CAAA;IACH,CAAC;IAED,MAAM,OAAO,GAA4B,EAAE,CAAA;IAC3C,0EAA0E;IAC1E,6CAA6C;IAC7C,MAAM,cAAc,GAA4B,EAAE,EAAE,EAAE,IAAI,EAAE,CAAA;IAC5D,MAAM,aAAa,GAAG,IAAI,GAAG,EAAgC,CAAA;IAC7D,IAAI,iBAAiB,GAAG,KAAK,CAAA;IAE7B,KAAK,MAAM,CAAC,SAAS,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAoC,CAAC,EAAE,CAAC;QACzF,IAAI,iBAAiB,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,gDAAgD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CACpG,CAAA;YACH,CAAC;YACD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAA;QAChD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,mBAAmB,SAAS,wBAAwB,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC5G,CAAA;QACH,CAAC;QAED,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC;YACtC,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;gBACtB,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,gDAAgD,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CACpG,CAAA;YACH,CAAC;YACD,cAAc,CAAC,SAAS,CAAC,GAAG,IAAI,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;QACjF,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,6DAA6D;gBACnF,iDAAiD,CACpD,CAAA;QACH,CAAC;QAED,IAAI,QAAQ,KAAK,IAAI,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACjF,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,yEAAyE,CAClG,CAAA;QACH,CAAC;QAED,MAAM,KAAK,GAAG,QAAmC,CAAA;QACjD,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,CAAA;QAChC,MAAM,WAAW,GAAG,IAAI;YACtB,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;YAClE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAA;QACvB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,sBAAsB,GAAG,eAAe,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAChG,CAAA;YACH,CAAC;QACH,CAAC;QAED,wEAAwE;QACxE,oEAAoE;QACpE,uEAAuE;QACvE,oEAAoE;QACpE,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,yBAAyB,CAAC,IAAI,OAAO,IAAI,SAAS,4BAA4B,CAAC,CAAA;QAC3F,CAAC;QACD,IACE,KAAK,CAAC,OAAO,KAAK,SAAS;YAC3B,CAAC,KAAK,CAAC,OAAO,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAAC,EAC7D,CAAC;YACD,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,qDAAqD,CAC9E,CAAA;QACH,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAyB,CAAC,IAAI,OAAO,IAAI,SAAS,0BAA0B,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,yBAAyB,CAAC,IAAI,OAAO,IAAI,SAAS,0BAA0B,CAAC,CAAA;QACzF,CAAC;QACD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAClE,MAAM,IAAI,yBAAyB,CAAC,IAAI,OAAO,IAAI,SAAS,4BAA4B,CAAC,CAAA;QAC3F,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,IAAK,KAAK,CAAC,IAAe,GAAG,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,0EAA0E,CACnG,CAAA;QACH,CAAC;QAED,yEAAyE;QACzE,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,8CAA8C;QAC9C,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YAC7D,iBAAiB,CAAC;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM;gBACN,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;YACF,MAAM,4BAA4B,CAAC;gBACjC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,UAAU,EAAE,OAAO,CAAC,UAAU;gBAC9B,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,OAAO;gBACP,OAAO;gBACP,MAAM,EAAE,KAAK;aACd,CAAC,CAAA;QACJ,CAAC;QAED,MAAM,eAAe,GAAG,KAAK,CAAC,MAAM,CAAA;QACpC,MAAM,UAAU,GAAG,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAA;QAE/C,IAAI,eAAe,KAAK,SAAS,IAAI,CAAC,UAAU,EAAE,CAAC;YACjD,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,IAAI,SAAS,mBAAmB,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG,CACxE,CAAA;QACH,CAAC;QAED,MAAM,eAAe,GAAyB,EAAE,CAAA;QAChD,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,IACE,eAAe,KAAK,IAAI;gBACxB,OAAO,eAAe,KAAK,QAAQ;gBACnC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,EAC9B,CAAC;gBACD,MAAM,IAAI,yBAAyB,CAAC,IAAI,OAAO,IAAI,SAAS,6BAA6B,CAAC,CAAA;YAC5F,CAAC;YACD,KAAK,MAAM,CAAC,YAAY,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CACnD,eAA0C,CAC3C,EAAE,CAAC;gBACF,IAAI,CAAC,iBAAiB,CAAC,YAAY,CAAC,EAAE,CAAC;oBACrC,MAAM,cAAc,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;oBAC9D,IAAI,CAAC,cAAc,IAAI,mBAAmB,CAAC,cAAc,CAAC,EAAE,CAAC;wBAC3D,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,CAAC,QAAQ,8BAA8B,YAAY,8BAA8B;4BAC1F,oEAAoE,CACvE,CAAA;oBACH,CAAC;gBACH,CAAC;gBACD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;oBACtB,MAAM,IAAI,yBAAyB,CACjC,IAAI,OAAO,CAAC,QAAQ,IAAI,YAAY,0CAA0C,CAC/E,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,YAAY,CAAC,GAAG,IAAI,CAAA;YACtC,CAAC;YAED,OAAO,CAAC,SAAS,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACvD,iBAAiB,GAAG,IAAI,CAAA;YACxB,cAAc,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,eAAe,CAAC,EAAE,CAAA;QACrF,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,oEAAoE;YACpE,oEAAoE;YACpE,kEAAkE;YAClE,oEAAoE;YACpE,kEAAkE;YAClE,mEAAmE;YACnE,sEAAsE;YACtE,sEAAsE;YACtE,iEAAiE;YACjE,qCAAqC;YACrC,OAAO,CAAC,SAAS,CAAC,GAAG,qBAAqB,CAAC,IAAI,EAAE,KAAK,CAAC,CAAA;YACvD,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,aAAa,CAAC,GAAG,CAAC,SAAS,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAA;QACpF,CAAC;IACH,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QAC3B,MAAM,WAAW,GAA4B,EAAE,CAAA;QAC/C,KAAK,MAAM,SAAS,IAAI,aAAa,CAAC,IAAI,EAAE,EAAE,CAAC;YAC7C,MAAM,WAAW,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAsB,CAAA;YACrE,MAAM,QAAQ,GAAI,SAAqC,CAAC,SAAS,CAA4B,CAAA;YAC7F,MAAM,MAAM,GAAG,MAAM,sBAAsB,CACzC,WAAW,EACX,MAAM,EACN,OAAO,EACP,OAAO,EACP,QAAQ,CAAC,KAA4C,CACtD,CAAA;YACD,IAAI,MAAM;gBAAE,WAAW,CAAC,SAAS,CAAC,GAAG,MAAM,CAAA;QAC7C,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,MAAM,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAA;YACxC,iBAAiB,GAAG,IAAI,CAAA;QAC1B,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,iBAAiB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;QAChD,cAAc,EAAE,cAAyC;QACzD,aAAa;KACd,CAAA;AACH,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,OAAgC,EAChC,QAAkC;IAElC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,cAAc,CAA4B,CAAA;IACtF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAA;IAChC,MAAM,MAAM,GACV,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAE,SAAqC,CAAC,CAAC,CAAC,EAAE,CAAA;IAE1F,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,QAAQ,CAAC,aAAa,EAAE,CAAC;QACjD,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC;YAAE,SAAQ;QAE/B,MAAM,KAAK,GAAG,OAAO,MAAM,CAAC,GAAG,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,MAAM,CAAC,GAAG,CAAY,CAAC,CAAC,CAAC,CAAC,CAAA;QAC3E,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,EAAE,CAAA;IACvE,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/utils/password.d.ts

@@ -7,7 +7,9 @@ export declare class HashedPassword {
     compare(plainPassword: string): Promise<boolean>;
     toString(): string;
     [Symbol.toPrimitive](hint: string): string;
-    toJSON(): string;
+    toJSON(): {
+        isSet: boolean;
+    };
     valueOf(): string;
 }
 //# sourceMappingURL=password.d.ts.map

package/dist/utils/password.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAKA,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIvD;AAID,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,MAAM,EAIxC;IAEK,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErD;IAED,QAAQ,IAAI,MAAM,CAEjB;IAGD,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzC;IAGD,MAAM,IAAI,MAAM,CAEf;IAED,OAAO,IAAI,MAAM,CAEhB;CACF"}
+{"version":3,"file":"password.d.ts","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAKA,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,UAAU,GAAE,MAA4B,GACvC,OAAO,CAAC,MAAM,CAAC,CAMjB;AAED,wBAAsB,eAAe,CACnC,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAIvD;AAID,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,IAAI;IAAjC,YAA6B,IAAI,EAAE,MAAM,EAIxC;IAEK,OAAO,CAAC,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAErD;IAED,QAAQ,IAAI,MAAM,CAEjB;IAGD,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAKzC;IAKD,MAAM,IAAI;QAAE,KAAK,EAAE,OAAO,CAAA;KAAE,CAE3B;IAED,OAAO,IAAI,MAAM,CAEhB;CACF"}

package/dist/utils/password.js

@@ -52,9 +52,11 @@ export class HashedPassword {
         }
         return this.hash;
     }
-    // JSON.stringify calls this when present, so the hash serializes as a plain string.
+    // JSON.stringify calls this when present, so this is the serialize-for-output
+    // redaction point — never return the hash here. toString()/valueOf()/
+    // Symbol.toPrimitive stay unredacted for internal string/compare use.
     toJSON() {
-        return this.hash;
+        return { isSet: !!this.hash };
     }
     valueOf() {
         return this.hash;

package/dist/utils/password.js.map

@@ -1 +1 @@
-{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAAU,GAAW,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,OAAO,cAAc;IACI,IAAI;IAAjC,YAA6B,IAAY;oBAAZ,IAAI;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,6EAA6E;IAC7E,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,oFAAoF;IACpF,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}
+{"version":3,"file":"password.js","sourceRoot":"","sources":["../../src/utils/password.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,UAAU,CAAA;AAE7B,0EAA0E;AAC1E,MAAM,mBAAmB,GAAG,EAAE,CAAA;AAE9B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,aAAqB,EACrB,UAAU,GAAW,mBAAmB;IAExC,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,UAAU,CAAC,CAAA;AAC/C,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,aAAqB,EACrB,cAAsB;IAEtB,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9D,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,cAAc,CAAC,CAAA;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,qEAAqE;QACrE,iEAAiE;QACjE,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,CAAA;QACnD,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAA;IAE3C,OAAO,0BAA0B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AAC/C,CAAC;AAED,yEAAyE;AACzE,iEAAiE;AACjE,MAAM,OAAO,cAAc;IACI,IAAI;IAAjC,YAA6B,IAAY;oBAAZ,IAAI;QAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAA;QACpE,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,aAAqB;QACjC,OAAO,eAAe,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;IAClD,CAAC;IAED,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,6EAA6E;IAC7E,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAY;QAC/B,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5C,OAAO,IAAI,CAAC,IAAI,CAAA;QAClB,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;IAED,8EAA8E;IAC9E,sEAAsE;IACtE,sEAAsE;IACtE,MAAM;QACJ,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,CAAA;IAC/B,CAAC;IAED,OAAO;QACL,OAAO,IAAI,CAAC,IAAI,CAAA;IAClB,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opensaas/stack-core",
-  "version": "0.39.1",
+  "version": "0.40.0",
   "description": "Core stack for OpenSaas - schema definition, access control, and runtime utilities",
   "type": "module",
   "main": "./dist/index.js",