@os.io/nest-kit 0.0.1-alpha.0

package/dist/auth/decorators/public.decorator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.d.ts","sourceRoot":"","sources":["../../../packages/auth/decorators/public.decorator.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,MAAM,wDAA2C,CAAC"}

package/dist/auth/decorators/public.decorator.js

@@ -0,0 +1,15 @@
+import { SetMetadata } from '@nestjs/common';
+import { METADATA_PUBLIC } from '../auth.constants';
+/**
+ * Mark a route handler or controller as publicly accessible
+ * (bypasses the global AuthGuard).
+ *
+ * @example
+ * ```typescript
+ * @Public()
+ * @Get('login')
+ * login() { … }
+ * ```
+ */
+export const Public = () => SetMetadata(METADATA_PUBLIC, true);
+//# sourceMappingURL=public.decorator.js.map

package/dist/auth/decorators/public.decorator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"public.decorator.js","sourceRoot":"","sources":["../../../packages/auth/decorators/public.decorator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,MAAM,MAAM,GAAG,GAAG,EAAE,CAAC,WAAW,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,63 @@
+/**
+ * @os.io/nest-kit/auth
+ *
+ * Authentication & Authorization toolkit for NestJS applications.
+ *
+ * ## Features
+ *
+ * - **Authentication**: Credentials (email/password), OAuth (Google, GitHub,
+ *   Facebook, Apple, Microsoft, Discord, custom), TOTP 2FA, Anonymous sessions,
+ *   Magic Link, OTP (email/phone), Passkey (WebAuthn/FIDO2), OneTap (Google
+ *   & Apple), SSO (SAML & OpenID Connect).
+ * - **Authorization**: RBAC (Role-Based) and PBAC (Policy-Based) — use either
+ *   or both independently on different routes.
+ * - **Session**: Stateless JWT with refresh-token rotation, multi-device tracking,
+ *   per-device logout (Telegram-style).
+ * - **Security**: bcrypt password hashing, rate limiting, token blacklisting
+ *   via Redis/Valkey, token versioning.
+ * - **Scalability**: Horizontal scaling via shared cache; asymmetric JWT
+ *   (RS256/ES256) enables service-to-service token validation without
+ *   centralised auth calls.
+ *
+ * ## Quick Start
+ *
+ * ```typescript
+ * import { AuthModule } from '@os.io/nest-kit/auth';
+ *
+ * @Module({
+ *   imports: [
+ *     AuthModule.forRoot({
+ *       jwtSecret: process.env.JWT_SECRET,
+ *       credentials: true,
+ *       rbac: true,
+ *     }),
+ *   ],
+ *   providers: [
+ *     { provide: 'USER_SERVICE', useClass: MyUserService },
+ *     { provide: 'CACHE_SERVICE', useExisting: getCache() },
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ *
+ * @module
+ * @packageDocumentation
+ */
+export { AuthModule } from './auth.module';
+export { AuthService } from './auth.service';
+export { AuthGuard } from './auth.guard';
+export { AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, AUTH_STRATEGIES, METADATA_PUBLIC, METADATA_ROLES, METADATA_PERMISSIONS, METADATA_POLICY, } from './auth.constants';
+export type { AuthModuleOptions, AuthModuleAsyncOptions, CredentialsOptions, OAuthOptions, OAuthProviderConfig, TOTPOptions, AnonymousOptions, MagicLinkOptions, OTPOptions, PasskeyOptions, OneTapOptions, SSOOptions, SamlProviderConfig, OidcProviderConfig, RBACOptions, PBACOptions, SessionOptions, ThrottleOptions, } from './auth.options';
+export type { IAuthUser, IAuthRequest, ITokenPair, IAuthResult, IAuthStrategy, ICacheService, IUserService, } from './interfaces';
+export { AuthMethod } from './interfaces';
+export { CurrentUser, Public } from './decorators';
+export { JwtService, TokenBlacklistService, DeviceSessionService } from './session';
+export type { IDeviceInfo } from './session';
+export { PasswordService } from './password/password.service';
+export { ThrottleService } from './throttling/throttle.service';
+export { BaseStrategy, CredentialsStrategy, OAuthStrategy, OAuthProviderRegistry, TotpStrategy, AnonymousStrategy, MagicLinkStrategy, OtpStrategy, PasskeyStrategy, OneTapStrategy, SsoStrategy, } from './strategies';
+export { RbacService, RbacGuard, Roles } from './authorization/rbac';
+export { PbacService, PbacGuard, RequirePolicy } from './authorization/pbac';
+export type { PolicyDecoratorOptions } from './authorization/pbac';
+export type { PolicyStatement, PolicyDocument, PolicyContext, PolicyEffect, } from './authorization/pbac';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../packages/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAGzC,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAG1B,YAAY,EACV,iBAAiB,EACjB,sBAAsB,EACtB,kBAAkB,EAClB,YAAY,EACZ,mBAAmB,EACnB,WAAW,EACX,gBAAgB,EAChB,gBAAgB,EAChB,UAAU,EACV,cAAc,EACd,aAAa,EACb,UAAU,EACV,kBAAkB,EAClB,kBAAkB,EAClB,WAAW,EACX,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAGxB,YAAY,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,WAAW,EACX,aAAa,EACb,aAAa,EACb,YAAY,GACb,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAGnD,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACpF,YAAY,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAG7C,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAG9D,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAGhE,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AAGtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAC7E,YAAY,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AACnE,YAAY,EACV,eAAe,EACf,cAAc,EACd,aAAa,EACb,YAAY,GACb,MAAM,sBAAsB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,65 @@
+/**
+ * @os.io/nest-kit/auth
+ *
+ * Authentication & Authorization toolkit for NestJS applications.
+ *
+ * ## Features
+ *
+ * - **Authentication**: Credentials (email/password), OAuth (Google, GitHub,
+ *   Facebook, Apple, Microsoft, Discord, custom), TOTP 2FA, Anonymous sessions,
+ *   Magic Link, OTP (email/phone), Passkey (WebAuthn/FIDO2), OneTap (Google
+ *   & Apple), SSO (SAML & OpenID Connect).
+ * - **Authorization**: RBAC (Role-Based) and PBAC (Policy-Based) — use either
+ *   or both independently on different routes.
+ * - **Session**: Stateless JWT with refresh-token rotation, multi-device tracking,
+ *   per-device logout (Telegram-style).
+ * - **Security**: bcrypt password hashing, rate limiting, token blacklisting
+ *   via Redis/Valkey, token versioning.
+ * - **Scalability**: Horizontal scaling via shared cache; asymmetric JWT
+ *   (RS256/ES256) enables service-to-service token validation without
+ *   centralised auth calls.
+ *
+ * ## Quick Start
+ *
+ * ```typescript
+ * import { AuthModule } from '@os.io/nest-kit/auth';
+ *
+ * @Module({
+ *   imports: [
+ *     AuthModule.forRoot({
+ *       jwtSecret: process.env.JWT_SECRET,
+ *       credentials: true,
+ *       rbac: true,
+ *     }),
+ *   ],
+ *   providers: [
+ *     { provide: 'USER_SERVICE', useClass: MyUserService },
+ *     { provide: 'CACHE_SERVICE', useExisting: getCache() },
+ *   ],
+ * })
+ * export class AppModule {}
+ * ```
+ *
+ * @module
+ * @packageDocumentation
+ */
+export { AuthModule } from './auth.module';
+export { AuthService } from './auth.service';
+export { AuthGuard } from './auth.guard';
+// ── Constants ──
+export { AUTH_MODULE_OPTIONS, CACHE_SERVICE, USER_SERVICE, AUTH_STRATEGIES, METADATA_PUBLIC, METADATA_ROLES, METADATA_PERMISSIONS, METADATA_POLICY, } from './auth.constants';
+export { AuthMethod } from './interfaces';
+// ── Decorators ──
+export { CurrentUser, Public } from './decorators';
+// ── Session ──
+export { JwtService, TokenBlacklistService, DeviceSessionService } from './session';
+// ── Password ──
+export { PasswordService } from './password/password.service';
+// ── Throttling ──
+export { ThrottleService } from './throttling/throttle.service';
+// ── Strategies ──
+export { BaseStrategy, CredentialsStrategy, OAuthStrategy, OAuthProviderRegistry, TotpStrategy, AnonymousStrategy, MagicLinkStrategy, OtpStrategy, PasskeyStrategy, OneTapStrategy, SsoStrategy, } from './strategies';
+// ── Authorization ──
+export { RbacService, RbacGuard, Roles } from './authorization/rbac';
+export { PbacService, PbacGuard, RequirePolicy } from './authorization/pbac';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../packages/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEzC,kBAAkB;AAClB,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,YAAY,EACZ,eAAe,EACf,eAAe,EACf,cAAc,EACd,oBAAoB,EACpB,eAAe,GAChB,MAAM,kBAAkB,CAAC;AAkC1B,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,mBAAmB;AACnB,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAEnD,gBAAgB;AAChB,OAAO,EAAE,UAAU,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AAGpF,iBAAiB;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAE9D,mBAAmB;AACnB,OAAO,EAAE,eAAe,EAAE,MAAM,+BAA+B,CAAC;AAEhE,mBAAmB;AACnB,OAAO,EACL,YAAY,EACZ,mBAAmB,EACnB,aAAa,EACb,qBAAqB,EACrB,YAAY,EACZ,iBAAiB,EACjB,iBAAiB,EACjB,WAAW,EACX,eAAe,EACf,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AAEtB,sBAAsB;AACtB,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/auth/interfaces/auth-request.interface.d.ts

@@ -0,0 +1,18 @@
+import type { IAuthUser } from './auth-user.interface';
+/**
+ * Extended Express/NestJS request with authenticated user info.
+ * Attached by AuthGuard after successful token validation.
+ */
+export interface IAuthRequest {
+    /** Authenticated user entity */
+    user?: IAuthUser;
+    /** Raw access token from the request */
+    accessToken?: string;
+    /** Raw refresh token (if present in request) */
+    refreshToken?: string;
+    /** Device / session identifier for multi-device tracking */
+    deviceId?: string;
+    /** Session identifier */
+    sessionId?: string;
+}
+//# sourceMappingURL=auth-request.interface.d.ts.map

package/dist/auth/interfaces/auth-request.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-request.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-request.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,IAAI,CAAC,EAAE,SAAS,CAAC;IAEjB,wCAAwC;IACxC,WAAW,CAAC,EAAE,MAAM,CAAC;IAErB,gDAAgD;IAChD,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,4DAA4D;IAC5D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,yBAAyB;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/interfaces/auth-request.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-request.interface.js.map

package/dist/auth/interfaces/auth-request.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-request.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-request.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/auth-result.interface.d.ts

@@ -0,0 +1,28 @@
+import type { IAuthUser } from './auth-user.interface';
+/**
+ * Pair of access and refresh tokens returned from successful authentication.
+ */
+export interface ITokenPair {
+    /** Short-lived JWT access token (Bearer) */
+    accessToken: string;
+    /** Long-lived refresh token for rotating sessions */
+    refreshToken: string;
+    /** Access token TTL in seconds */
+    expiresIn: number;
+}
+/**
+ * Result returned by every authentication strategy on success.
+ */
+export interface IAuthResult {
+    /** Authenticated user entity */
+    user: IAuthUser;
+    /** Token pair for subsequent requests */
+    tokens: ITokenPair;
+    /** Whether the user was just created (first sign-up) */
+    isNewUser?: boolean;
+    /** Whether the user must complete a second factor */
+    isMfaRequired?: boolean;
+    /** Server-generated session identifier */
+    sessionId?: string;
+}
+//# sourceMappingURL=auth-result.interface.d.ts.map

package/dist/auth/interfaces/auth-result.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-result.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-result.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,4CAA4C;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,YAAY,EAAE,MAAM,CAAC;IACrB,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,gCAAgC;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,yCAAyC;IACzC,MAAM,EAAE,UAAU,CAAC;IACnB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qDAAqD;IACrD,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,0CAA0C;IAC1C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB"}

package/dist/auth/interfaces/auth-result.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-result.interface.js.map

package/dist/auth/interfaces/auth-result.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-result.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-result.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/auth-strategy.interface.d.ts

@@ -0,0 +1,37 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { IAuthResult } from './auth-result.interface';
+/**
+ * Authentication method enum — each value maps to a strategy.
+ */
+export declare enum AuthMethod {
+    CREDENTIALS = "credentials",
+    OAUTH = "oauth",
+    TOTP = "totp",
+    ANONYMOUS = "anonymous",
+    MAGIC_LINK = "magic-link",
+    OTP = "otp",
+    PASSKEY = "passkey",
+    ONETAP = "onetap",
+    SSO = "sso"
+}
+/**
+ * Every authentication strategy must implement this interface.
+ * Strategies are registered in the IoC container and discovered by AuthGuard.
+ */
+export interface IAuthStrategy {
+    /** Unique strategy type identifier */
+    readonly type: AuthMethod;
+    /** Human-readable strategy name for logging / debugging */
+    readonly name: string;
+    /**
+     * Attempt to authenticate the request.
+     *
+     * @param payload  Strategy-specific authentication payload
+     *                 (e.g. { email, password } for credentials,
+     *                  { provider, code } for OAuth, …)
+     * @param context  Optional NestJS execution context for
+     *                 access to request / response objects
+     */
+    authenticate(payload: Record<string, unknown>, context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=auth-strategy.interface.d.ts.map

package/dist/auth/interfaces/auth-strategy.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-strategy.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-strategy.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D;;GAEG;AACH,oBAAY,UAAU;IACpB,WAAW,gBAAgB;IAC3B,KAAK,UAAU;IACf,IAAI,SAAS;IACb,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,GAAG,QAAQ;IACX,OAAO,YAAY;IACnB,MAAM,WAAW;IACjB,GAAG,QAAQ;CACZ;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IAE1B,2DAA2D;IAC3D,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;;;;;;;OAQG;IACH,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;CAClG"}

package/dist/auth/interfaces/auth-strategy.interface.js

@@ -0,0 +1,16 @@
+/**
+ * Authentication method enum — each value maps to a strategy.
+ */
+export var AuthMethod;
+(function (AuthMethod) {
+    AuthMethod["CREDENTIALS"] = "credentials";
+    AuthMethod["OAUTH"] = "oauth";
+    AuthMethod["TOTP"] = "totp";
+    AuthMethod["ANONYMOUS"] = "anonymous";
+    AuthMethod["MAGIC_LINK"] = "magic-link";
+    AuthMethod["OTP"] = "otp";
+    AuthMethod["PASSKEY"] = "passkey";
+    AuthMethod["ONETAP"] = "onetap";
+    AuthMethod["SSO"] = "sso";
+})(AuthMethod || (AuthMethod = {}));
+//# sourceMappingURL=auth-strategy.interface.js.map

package/dist/auth/interfaces/auth-strategy.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-strategy.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-strategy.interface.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,CAAN,IAAY,UAUX;AAVD,WAAY,UAAU;IACpB,yCAA2B,CAAA;IAC3B,6BAAe,CAAA;IACf,2BAAa,CAAA;IACb,qCAAuB,CAAA;IACvB,uCAAyB,CAAA;IACzB,yBAAW,CAAA;IACX,iCAAmB,CAAA;IACnB,+BAAiB,CAAA;IACjB,yBAAW,CAAA;AACb,CAAC,EAVW,UAAU,KAAV,UAAU,QAUrB"}

package/dist/auth/interfaces/auth-user.interface.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Represents an authenticated user across the system.
+ * This interface is used inside JWT payloads, request objects, and guards.
+ */
+export interface IAuthUser {
+    /** Unique user identifier (UUID or numeric ID as string) */
+    id: string;
+    /** Email address (may be absent for anonymous users) */
+    email?: string;
+    /** Phone number (may be absent) */
+    phone?: string;
+    /** Username or display name */
+    username?: string;
+    /** Assigned roles for RBAC */
+    roles?: string[];
+    /** Direct permissions for simple permission checks */
+    permissions?: string[];
+    /** Whether this is an anonymous session */
+    isAnonymous?: boolean;
+    /** Whether the user has passed 2FA in this session */
+    isMfaVerified?: boolean;
+    /** Custom claims bag for extensibility */
+    [key: string]: unknown;
+}
+//# sourceMappingURL=auth-user.interface.d.ts.map

package/dist/auth/interfaces/auth-user.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-user.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-user.interface.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IAEX,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAEjB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IAEvB,2CAA2C;IAC3C,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,sDAAsD;IACtD,aAAa,CAAC,EAAE,OAAO,CAAC;IAExB,0CAA0C;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB"}

package/dist/auth/interfaces/auth-user.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=auth-user.interface.js.map

package/dist/auth/interfaces/auth-user.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-user.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/auth-user.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/cache-service.interface.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Minimal cache abstraction consumed internally by the auth module.
+ *
+ * > IMPORTANT: You must register a provider under the `'CACHE_SERVICE'`
+ * > token (or a custom token via `AuthModuleOptions.cacheServiceToken`).
+ * > The provider can be any compatible cache implementation:
+ * >   - `cache-manager` (`Cache` from `@nestjs/cache-manager`)
+ * >   - `keyv` instance
+ * >   - A custom wrapper implementing this interface
+ *
+ * @example
+ * ```typescript
+ * // Register this in your consumer module:
+ * {
+ *   provide: 'CACHE_SERVICE',
+ *   useExisting: getCache(), // your cache instance
+ * }
+ * ```
+ */
+export interface ICacheService {
+    /** Retrieve a cached value by key */
+    get<T = unknown>(key: string): Promise<T | undefined>;
+    /** Store a value with optional TTL (seconds) */
+    set<T = unknown>(key: string, value: T, ttl?: number): Promise<void>;
+    /** Delete a single key */
+    del(key: string): Promise<void>;
+    /** Flush entire cache (use with care) */
+    reset(): Promise<void>;
+}
+//# sourceMappingURL=cache-service.interface.d.ts.map

package/dist/auth/interfaces/cache-service.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-service.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/cache-service.interface.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,WAAW,aAAa;IAC5B,qCAAqC;IACrC,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;IAEtD,gDAAgD;IAChD,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAErE,0BAA0B;IAC1B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEhC,yCAAyC;IACzC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB"}

package/dist/auth/interfaces/cache-service.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cache-service.interface.js.map

package/dist/auth/interfaces/cache-service.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-service.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/cache-service.interface.ts"],"names":[],"mappings":""}

package/dist/auth/interfaces/index.d.ts

@@ -0,0 +1,8 @@
+export type { IAuthUser } from './auth-user.interface';
+export type { IAuthRequest } from './auth-request.interface';
+export type { ITokenPair, IAuthResult } from './auth-result.interface';
+export { AuthMethod } from './auth-strategy.interface';
+export type { IAuthStrategy } from './auth-strategy.interface';
+export type { ICacheService } from './cache-service.interface';
+export type { IUserService } from './user-service.interface';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/interfaces/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACvD,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAC7D,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/auth/interfaces/index.js

@@ -0,0 +1,2 @@
+export { AuthMethod } from './auth-strategy.interface';
+//# sourceMappingURL=index.js.map

package/dist/auth/interfaces/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/index.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC"}

package/dist/auth/interfaces/user-service.interface.d.ts

@@ -0,0 +1,34 @@
+import type { IAuthUser } from './auth-user.interface';
+/**
+ * Consumer-provided user service.
+ * You must register a provider under the `'USER_SERVICE'` token.
+ */
+export interface IUserService {
+    /** Find a user by their unique ID */
+    findById(id: string): Promise<IAuthUser | null>;
+    /** Find a user by email address */
+    findByEmail(email: string): Promise<IAuthUser | null>;
+    /** Find a user by username */
+    findByUsername(username: string): Promise<IAuthUser | null>;
+    /** Find a user by a social / OAuth provider ID */
+    findBySocialId(provider: string, socialId: string): Promise<IAuthUser | null>;
+    /** Create a new user account */
+    create(data: Partial<IAuthUser> & {
+        password?: string;
+    }): Promise<IAuthUser>;
+    /** Update user fields */
+    update(id: string, data: Partial<IAuthUser>): Promise<IAuthUser>;
+    /** Compare a plaintext password against the stored hash */
+    validatePassword(user: IAuthUser, password: string): Promise<boolean>;
+    /** Store / overwrite the password hash for a user */
+    setPassword(id: string, passwordHash: string): Promise<void>;
+    /** Retrieve the stored TOTP secret (null if 2FA not configured) */
+    getTotpSecret(id: string): Promise<string | null>;
+    /** Persist a new TOTP secret (e.g. after enrollment) */
+    setTotpSecret(id: string, secret: string): Promise<void>;
+    /** Get the list of role identifiers assigned to a user */
+    getRoles(id: string): Promise<string[]>;
+    /** Get the list of permission identifiers assigned to a user */
+    getPermissions(id: string): Promise<string[]>;
+}
+//# sourceMappingURL=user-service.interface.d.ts.map

package/dist/auth/interfaces/user-service.interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.interface.d.ts","sourceRoot":"","sources":["../../../packages/auth/interfaces/user-service.interface.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD;;;GAGG;AACH,MAAM,WAAW,YAAY;IAC3B,qCAAqC;IACrC,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEhD,mCAAmC;IACnC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAEtD,8BAA8B;IAC9B,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAE5D,kDAAkD;IAClD,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;IAE9E,gCAAgC;IAChC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAE7E,yBAAyB;IACzB,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAEjE,2DAA2D;IAC3D,gBAAgB,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAEtE,qDAAqD;IACrD,WAAW,CAAC,EAAE,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAE7D,mEAAmE;IACnE,aAAa,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAElD,wDAAwD;IACxD,aAAa,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEzD,0DAA0D;IAC1D,QAAQ,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IAExC,gEAAgE;IAChE,cAAc,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;CAC/C"}

package/dist/auth/interfaces/user-service.interface.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=user-service.interface.js.map

package/dist/auth/interfaces/user-service.interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-service.interface.js","sourceRoot":"","sources":["../../../packages/auth/interfaces/user-service.interface.ts"],"names":[],"mappings":""}

package/dist/auth/password/password.service.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Service for hashing and verifying passwords using bcrypt.
+ *
+ * Uses dynamic import of `bcrypt` so the dependency is optional.
+ * If `bcrypt` is not installed, operations throw a descriptive error.
+ */
+export declare class PasswordService {
+    private bcrypt;
+    private resolved;
+    /**
+     * Hash a plaintext password.
+     *
+     * @param password - Plaintext password
+     * @param rounds   - Cost factor (default 12)
+     */
+    hash(password: string, rounds?: number): Promise<string>;
+    /**
+     * Compare a plaintext password against a stored hash.
+     */
+    verify(password: string, hash: string): Promise<boolean>;
+    private loadBcrypt;
+}
+//# sourceMappingURL=password.service.d.ts.map

package/dist/auth/password/password.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.service.d.ts","sourceRoot":"","sources":["../../../packages/auth/password/password.service.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AACH,qBACa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAwC;IACtD,OAAO,CAAC,QAAQ,CAAS;IAEzB;;;;;OAKG;IACG,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAK1D;;OAEG;IACG,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;YAKhD,UAAU;CAczB"}

package/dist/auth/password/password.service.js

@@ -0,0 +1,52 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Injectable } from '@nestjs/common';
+/**
+ * Service for hashing and verifying passwords using bcrypt.
+ *
+ * Uses dynamic import of `bcrypt` so the dependency is optional.
+ * If `bcrypt` is not installed, operations throw a descriptive error.
+ */
+let PasswordService = class PasswordService {
+    bcrypt = null;
+    resolved = false;
+    /**
+     * Hash a plaintext password.
+     *
+     * @param password - Plaintext password
+     * @param rounds   - Cost factor (default 12)
+     */
+    async hash(password, rounds = 12) {
+        const bcrypt = await this.loadBcrypt();
+        return bcrypt.hash(password, rounds);
+    }
+    /**
+     * Compare a plaintext password against a stored hash.
+     */
+    async verify(password, hash) {
+        const bcrypt = await this.loadBcrypt();
+        return bcrypt.compare(password, hash);
+    }
+    async loadBcrypt() {
+        if (!this.resolved) {
+            try {
+                this.bcrypt = await import('bcrypt');
+            }
+            catch {
+                throw new Error('PasswordService requires the "bcrypt" package. ' +
+                    'Run: npm install bcrypt && npm install -D @types/bcrypt');
+            }
+            this.resolved = true;
+        }
+        return this.bcrypt;
+    }
+};
+PasswordService = __decorate([
+    Injectable()
+], PasswordService);
+export { PasswordService };
+//# sourceMappingURL=password.service.js.map

package/dist/auth/password/password.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"password.service.js","sourceRoot":"","sources":["../../../packages/auth/password/password.service.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C;;;;;GAKG;AAEI,IAAM,eAAe,GAArB,MAAM,eAAe;IAClB,MAAM,GAAmC,IAAI,CAAC;IAC9C,QAAQ,GAAG,KAAK,CAAC;IAEzB;;;;;OAKG;IACH,KAAK,CAAC,IAAI,CAAC,QAAgB,EAAE,MAAM,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,QAAgB,EAAE,IAAY;QACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;QACvC,OAAO,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,UAAU;QACtB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,CAAC,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,iDAAiD;oBAC/C,yDAAyD,CAC5D,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,MAAO,CAAC;IACtB,CAAC;CACF,CAAA;AArCY,eAAe;IAD3B,UAAU,EAAE;GACA,eAAe,CAqC3B"}

package/dist/auth/session/device-session.service.d.ts

@@ -0,0 +1,43 @@
+import type { ICacheService } from '../interfaces';
+export interface IDeviceInfo {
+    deviceId: string;
+    userId: string;
+    userAgent?: string;
+    ip?: string;
+    lastActivity: number;
+    createdAt: number;
+}
+/**
+ * Tracks active devices / sessions per user so that:
+ *   - Users can view all active sessions
+ *   - Users can log out a specific device (like Telegram)
+ *   - Admins can force-terminate sessions
+ */
+export declare class DeviceSessionService {
+    private readonly cache;
+    constructor(cache: ICacheService);
+    /**
+     * Register a new device session.
+     *
+     * @param info Device and session metadata
+     * @param ttl  Session TTL in seconds (default 30 days)
+     */
+    register(info: Omit<IDeviceInfo, 'createdAt'>, ttl?: number): Promise<void>;
+    /**
+     * Get all active sessions for a user.
+     */
+    getUserSessions(_userId: string): Promise<IDeviceInfo[]>;
+    /**
+     * Get a single device session by user + device ID.
+     */
+    getSession(userId: string, deviceId: string): Promise<IDeviceInfo | null>;
+    /**
+     * Remove a specific device session (per-device logout).
+     */
+    removeSession(userId: string, deviceId: string): Promise<void>;
+    /**
+     * Remove all sessions for a user (global logout).
+     */
+    removeAllUserSessions(_userId: string): Promise<void>;
+}
+//# sourceMappingURL=device-session.service.d.ts.map

package/dist/auth/session/device-session.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.service.d.ts","sourceRoot":"","sources":["../../../packages/auth/session/device-session.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAGnD,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;GAKG;AACH,qBACa,oBAAoB;IAG7B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,aAAa;IAGvC;;;;;OAKG;IACG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,EAAE,GAAG,SAAY,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpF;;OAEG;IACH,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAOxD;;OAEG;IACG,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAO/E;;OAEG;IACG,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIpE;;OAEG;IACG,qBAAqB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAI5D"}