@os.io/nest-kit 0.0.1-alpha.0

package/dist/auth/session/device-session.service.js

@@ -0,0 +1,72 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { CACHE_SERVICE, DEVICE_SESSION_PREFIX } from '../auth.constants';
+/**
+ * Tracks active devices / sessions per user so that:
+ *   - Users can view all active sessions
+ *   - Users can log out a specific device (like Telegram)
+ *   - Admins can force-terminate sessions
+ */
+let DeviceSessionService = class DeviceSessionService {
+    cache;
+    constructor(cache) {
+        this.cache = cache;
+    }
+    /**
+     * Register a new device session.
+     *
+     * @param info Device and session metadata
+     * @param ttl  Session TTL in seconds (default 30 days)
+     */
+    async register(info, ttl = 2_592_000) {
+        const session = { ...info, createdAt: Date.now() };
+        await this.cache.set(`${DEVICE_SESSION_PREFIX}${info.userId}:${info.deviceId}`, session, ttl);
+    }
+    /**
+     * Get all active sessions for a user.
+     */
+    getUserSessions(_userId) {
+        // In production, this would use Redis SCAN or a session DB table.
+        // For simplicity we rely on a key convention and read individually.
+        // Consumers are encouraged to override this method.
+        return Promise.resolve([]);
+    }
+    /**
+     * Get a single device session by user + device ID.
+     */
+    async getSession(userId, deviceId) {
+        const result = await this.cache.get(`${DEVICE_SESSION_PREFIX}${userId}:${deviceId}`);
+        return result ?? null;
+    }
+    /**
+     * Remove a specific device session (per-device logout).
+     */
+    async removeSession(userId, deviceId) {
+        await this.cache.del(`${DEVICE_SESSION_PREFIX}${userId}:${deviceId}`);
+    }
+    /**
+     * Remove all sessions for a user (global logout).
+     */
+    async removeAllUserSessions(_userId) {
+        // TODO: iterate all user sessions. For now, consumer's responsibility.
+        return Promise.resolve();
+    }
+};
+DeviceSessionService = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __metadata("design:paramtypes", [Object])
+], DeviceSessionService);
+export { DeviceSessionService };
+//# sourceMappingURL=device-session.service.js.map

package/dist/auth/session/device-session.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-session.service.js","sourceRoot":"","sources":["../../../packages/auth/session/device-session.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAWzE;;;;;GAKG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAGZ;IAFnB,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,QAAQ,CAAC,IAAoC,EAAE,GAAG,GAAG,SAAS;QAClE,MAAM,OAAO,GAAgB,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAChE,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,qBAAqB,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IAChG,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,OAAe;QAC7B,kEAAkE;QAClE,oEAAoE;QACpE,oDAAoD;QACpD,OAAO,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,MAAc,EAAE,QAAgB;QAC/C,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CACjC,GAAG,qBAAqB,GAAG,MAAM,IAAI,QAAQ,EAAE,CAChD,CAAC;QACF,OAAO,MAAM,IAAI,IAAI,CAAC;IACxB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,MAAc,EAAE,QAAgB;QAClD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,qBAAqB,GAAG,MAAM,IAAI,QAAQ,EAAE,CAAC,CAAC;IACxE,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,qBAAqB,CAAC,OAAe;QACzC,uEAAuE;QACvE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AAnDY,oBAAoB;IADhC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,oBAAoB,CAmDhC"}

package/dist/auth/session/index.d.ts

@@ -0,0 +1,5 @@
+export { JwtService } from './jwt.service';
+export { TokenBlacklistService } from './token-blacklist.service';
+export { DeviceSessionService } from './device-session.service';
+export type { IDeviceInfo } from './device-session.service';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/session/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,YAAY,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/auth/session/index.js

@@ -0,0 +1,4 @@
+export { JwtService } from './jwt.service';
+export { TokenBlacklistService } from './token-blacklist.service';
+export { DeviceSessionService } from './device-session.service';
+//# sourceMappingURL=index.js.map

package/dist/auth/session/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/session/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist/auth/session/jwt.service.d.ts

@@ -0,0 +1,37 @@
+import type { IAuthUser, ITokenPair } from '../interfaces';
+import type { SessionOptions } from '../auth.options';
+/**
+ * Low-level JWT service that signs and verifies tokens
+ * using `@nestjs/jwt` (loaded dynamically so the dependency is optional).
+ */
+export declare class JwtService {
+    private readonly options;
+    private nestJwt;
+    private jwtServiceInstance;
+    private resolved;
+    constructor(options: {
+        jwtSecret?: string;
+        jwtPrivateKey?: string;
+        jwtPublicKey?: string;
+        session?: SessionOptions;
+    });
+    /**
+     * Generate an access + refresh token pair for the given user.
+     */
+    signTokens(user: IAuthUser): Promise<ITokenPair>;
+    /**
+     * Verify and decode an access token. Throws if invalid / expired.
+     */
+    verifyAccess(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Verify a refresh token. Throws if invalid / expired.
+     */
+    verifyRefresh(token: string): Promise<Record<string, unknown>>;
+    /**
+     * Decode a token without verification (useful for extracting metadata).
+     */
+    decode(token: string): Record<string, unknown> | null;
+    private parseExpiresIn;
+    private getInstance;
+}
+//# sourceMappingURL=jwt.service.d.ts.map

package/dist/auth/session/jwt.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.service.d.ts","sourceRoot":"","sources":["../../../packages/auth/session/jwt.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAGtD;;;GAGG;AACH,qBACa,UAAU;IAOnB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAN1B,OAAO,CAAC,OAAO,CAA6C;IAC5D,OAAO,CAAC,kBAAkB,CAAiD;IAC3E,OAAO,CAAC,QAAQ,CAAS;gBAIN,OAAO,EAAE;QACxB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,OAAO,CAAC,EAAE,cAAc,CAAC;KAC1B;IAGH;;OAEG;IACG,UAAU,CAAC,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC;IA+BtD;;OAEG;IACG,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKnE;;OAEG;IACG,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAKpE;;OAEG;IACH,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI;IAKrD,OAAO,CAAC,cAAc;YAcR,WAAW;CAqB1B"}

package/dist/auth/session/jwt.service.js

@@ -0,0 +1,119 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Injectable, Inject } from '@nestjs/common';
+import { AUTH_MODULE_OPTIONS } from '../auth.constants';
+/**
+ * Low-level JWT service that signs and verifies tokens
+ * using `@nestjs/jwt` (loaded dynamically so the dependency is optional).
+ */
+let JwtService = class JwtService {
+    options;
+    nestJwt = null;
+    jwtServiceInstance = null;
+    resolved = false;
+    constructor(options) {
+        this.options = options;
+    }
+    /**
+     * Generate an access + refresh token pair for the given user.
+     */
+    async signTokens(user) {
+        const jwt = await this.getInstance();
+        const session = this.options.session ?? {};
+        const accessExp = session.accessTokenExpiresIn ?? '15m';
+        const refreshExp = session.refreshTokenExpiresIn ?? '7d';
+        const payload = {
+            sub: user.id,
+            email: user.email,
+            username: user.username,
+            roles: user.roles,
+            permissions: user.permissions,
+            isAnonymous: user.isAnonymous ?? false,
+            isMfaVerified: user.isMfaVerified ?? false,
+        };
+        const accessToken = jwt.sign(payload, {
+            expiresIn: accessExp,
+        });
+        const refreshToken = jwt.sign({ sub: user.id, type: 'refresh' }, { expiresIn: refreshExp });
+        return {
+            accessToken,
+            refreshToken,
+            expiresIn: this.parseExpiresIn(accessExp),
+        };
+    }
+    /**
+     * Verify and decode an access token. Throws if invalid / expired.
+     */
+    async verifyAccess(token) {
+        const jwt = await this.getInstance();
+        return jwt.verifyAsync(token);
+    }
+    /**
+     * Verify a refresh token. Throws if invalid / expired.
+     */
+    async verifyRefresh(token) {
+        const jwt = await this.getInstance();
+        return jwt.verifyAsync(token);
+    }
+    /**
+     * Decode a token without verification (useful for extracting metadata).
+     */
+    decode(token) {
+        if (!this.jwtServiceInstance)
+            return null;
+        return this.jwtServiceInstance.decode(token);
+    }
+    parseExpiresIn(value) {
+        const match = value.match(/^(\d+)([smhd])$/);
+        if (!match)
+            return 900;
+        const num = parseInt(match[1], 10);
+        const unit = match[2];
+        const multipliers = {
+            s: 1,
+            m: 60,
+            h: 3600,
+            d: 86400,
+        };
+        return num * (multipliers[unit] ?? 1);
+    }
+    async getInstance() {
+        if (!this.resolved) {
+            try {
+                this.nestJwt = await import('@nestjs/jwt');
+                const secretOrPrivateKey = this.options.jwtSecret ?? this.options.jwtPrivateKey;
+                this.jwtServiceInstance = new this.nestJwt.JwtService({
+                    secret: secretOrPrivateKey,
+                    publicKey: this.options.jwtPublicKey,
+                    signOptions: {
+                        algorithm: this.options.session?.algorithm ?? 'HS256',
+                        issuer: this.options.session?.issuer,
+                        audience: this.options.session?.audience,
+                    },
+                });
+            }
+            catch {
+                throw new Error('JwtService requires "@nestjs/jwt". Run: npm install @nestjs/jwt');
+            }
+            this.resolved = true;
+        }
+        return this.jwtServiceInstance;
+    }
+};
+JwtService = __decorate([
+    Injectable(),
+    __param(0, Inject(AUTH_MODULE_OPTIONS)),
+    __metadata("design:paramtypes", [Object])
+], JwtService);
+export { JwtService };
+//# sourceMappingURL=jwt.service.js.map

package/dist/auth/session/jwt.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt.service.js","sourceRoot":"","sources":["../../../packages/auth/session/jwt.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAGpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAExD;;;GAGG;AAEI,IAAM,UAAU,GAAhB,MAAM,UAAU;IAOF;IANX,OAAO,GAAwC,IAAI,CAAC;IACpD,kBAAkB,GAA4C,IAAI,CAAC;IACnE,QAAQ,GAAG,KAAK,CAAC;IAEzB,YAEmB,OAKhB;QALgB,YAAO,GAAP,OAAO,CAKvB;IACA,CAAC;IAEJ;;OAEG;IACH,KAAK,CAAC,UAAU,CAAC,IAAe;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,oBAAoB,IAAI,KAAK,CAAC;QACxD,MAAM,UAAU,GAAG,OAAO,CAAC,qBAAqB,IAAI,IAAI,CAAC;QAEzD,MAAM,OAAO,GAA4B;YACvC,GAAG,EAAE,IAAI,CAAC,EAAE;YACZ,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,IAAI,CAAC,WAAW,IAAI,KAAK;YACtC,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,KAAK;SAC3C,CAAC;QAEF,MAAM,WAAW,GAAG,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE;YACpC,SAAS,EAAE,SAAgD;SAC5D,CAAC,CAAC;QACH,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAC3B,EAAE,GAAG,EAAE,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,EAAE,SAAS,EAAE,UAAiD,EAAE,CACjE,CAAC;QAEF,OAAO;YACL,WAAW;YACX,YAAY;YACZ,SAAS,EAAE,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC;SAC1C,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,YAAY,CAAC,KAAa;QAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,KAAa;QAC/B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,KAAa;QAClB,IAAI,CAAC,IAAI,CAAC,kBAAkB;YAAE,OAAO,IAAI,CAAC;QAC1C,OAAO,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAEO,cAAc,CAAC,KAAa;QAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAC7C,IAAI,CAAC,KAAK;YAAE,OAAO,GAAG,CAAC;QACvB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,WAAW,GAA2B;YAC1C,CAAC,EAAE,CAAC;YACJ,CAAC,EAAE,EAAE;YACL,CAAC,EAAE,IAAI;YACP,CAAC,EAAE,KAAK;SACT,CAAC;QACF,OAAO,GAAG,GAAG,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,CAAC;IAEO,KAAK,CAAC,WAAW;QACvB,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,IAAI,CAAC,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;gBAC3C,MAAM,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;gBAChF,IAAI,CAAC,kBAAkB,GAAG,IAAI,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;oBACpD,MAAM,EAAE,kBAAkB;oBAC1B,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,YAAY;oBACpC,WAAW,EAAE;wBACX,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,IAAI,OAAO;wBACrD,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM;wBACpC,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ;qBACzC;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,iEAAiE,CAAC,CAAC;YACrF,CAAC;YACD,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;QACvB,CAAC;QACD,OAAO,IAAI,CAAC,kBAAmB,CAAC;IAClC,CAAC;CACF,CAAA;AA5GY,UAAU;IADtB,UAAU,EAAE;IAOR,WAAA,MAAM,CAAC,mBAAmB,CAAC,CAAA;;GANnB,UAAU,CA4GtB"}

package/dist/auth/session/token-blacklist.service.d.ts

@@ -0,0 +1,37 @@
+import type { ICacheService } from '../interfaces';
+/**
+ * Redis-backed token blacklist that enables immediate token revocation.
+ *
+ * Tokens are stored with a TTL matching the token's remaining lifespan
+ * so the blacklist does not grow unbounded.
+ */
+export declare class TokenBlacklistService {
+    private readonly cache;
+    constructor(cache: ICacheService);
+    /**
+     * Blacklist an access token (by its `jti`) until its natural expiry.
+     *
+     * @param jti        Token ID (unique per token)
+     * @param ttlSeconds Seconds until the token would have expired
+     */
+    blacklistAccess(jti: string, ttlSeconds: number): Promise<void>;
+    /**
+     * Check whether an access token has been blacklisted.
+     */
+    isBlacklisted(jti: string): Promise<boolean>;
+    /**
+     * Flag a refresh token family as revoked.
+     * When rotation detects a reused old refresh token, the entire
+     * family is revoked to prevent token theft.
+     */
+    revokeFamily(familyId: string, ttlSeconds: number): Promise<void>;
+    /**
+     * Check whether a refresh token family has been revoked.
+     */
+    isFamilyRevoked(familyId: string): Promise<boolean>;
+    /**
+     * Remove a specific token from the blacklist (used during cleanup).
+     */
+    remove(jti: string): Promise<void>;
+}
+//# sourceMappingURL=token-blacklist.service.d.ts.map

package/dist/auth/session/token-blacklist.service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-blacklist.service.d.ts","sourceRoot":"","sources":["../../../packages/auth/session/token-blacklist.service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAOnD;;;;;GAKG;AACH,qBACa,qBAAqB;IAG9B,OAAO,CAAC,QAAQ,CAAC,KAAK;gBAAL,KAAK,EAAE,aAAa;IAGvC;;;;;OAKG;IACG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIrE;;OAEG;IACG,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKlD;;;;OAIG;IACG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIvE;;OAEG;IACG,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAKzD;;OAEG;IACG,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAGzC"}

package/dist/auth/session/token-blacklist.service.js

@@ -0,0 +1,70 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { CACHE_SERVICE, TOKEN_BLACKLIST_PREFIX, REFRESH_TOKEN_FAMILY_PREFIX, } from '../auth.constants';
+/**
+ * Redis-backed token blacklist that enables immediate token revocation.
+ *
+ * Tokens are stored with a TTL matching the token's remaining lifespan
+ * so the blacklist does not grow unbounded.
+ */
+let TokenBlacklistService = class TokenBlacklistService {
+    cache;
+    constructor(cache) {
+        this.cache = cache;
+    }
+    /**
+     * Blacklist an access token (by its `jti`) until its natural expiry.
+     *
+     * @param jti        Token ID (unique per token)
+     * @param ttlSeconds Seconds until the token would have expired
+     */
+    async blacklistAccess(jti, ttlSeconds) {
+        await this.cache.set(`${TOKEN_BLACKLIST_PREFIX}${jti}`, true, ttlSeconds);
+    }
+    /**
+     * Check whether an access token has been blacklisted.
+     */
+    async isBlacklisted(jti) {
+        const result = await this.cache.get(`${TOKEN_BLACKLIST_PREFIX}${jti}`);
+        return result === true;
+    }
+    /**
+     * Flag a refresh token family as revoked.
+     * When rotation detects a reused old refresh token, the entire
+     * family is revoked to prevent token theft.
+     */
+    async revokeFamily(familyId, ttlSeconds) {
+        await this.cache.set(`${REFRESH_TOKEN_FAMILY_PREFIX}${familyId}`, true, ttlSeconds);
+    }
+    /**
+     * Check whether a refresh token family has been revoked.
+     */
+    async isFamilyRevoked(familyId) {
+        const result = await this.cache.get(`${REFRESH_TOKEN_FAMILY_PREFIX}${familyId}`);
+        return result === true;
+    }
+    /**
+     * Remove a specific token from the blacklist (used during cleanup).
+     */
+    async remove(jti) {
+        await this.cache.del(`${TOKEN_BLACKLIST_PREFIX}${jti}`);
+    }
+};
+TokenBlacklistService = __decorate([
+    Injectable(),
+    __param(0, Inject(CACHE_SERVICE)),
+    __metadata("design:paramtypes", [Object])
+], TokenBlacklistService);
+export { TokenBlacklistService };
+//# sourceMappingURL=token-blacklist.service.js.map

package/dist/auth/session/token-blacklist.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-blacklist.service.js","sourceRoot":"","sources":["../../../packages/auth/session/token-blacklist.service.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,sBAAsB,EACtB,2BAA2B,GAC5B,MAAM,mBAAmB,CAAC;AAE3B;;;;;GAKG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAGb;IAFnB,YAEmB,KAAoB;QAApB,UAAK,GAAL,KAAK,CAAe;IACpC,CAAC;IAEJ;;;;;OAKG;IACH,KAAK,CAAC,eAAe,CAAC,GAAW,EAAE,UAAkB;QACnD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,sBAAsB,GAAG,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAU,GAAG,sBAAsB,GAAG,GAAG,EAAE,CAAC,CAAC;QAChF,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAAC,QAAgB,EAAE,UAAkB;QACrD,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,2BAA2B,GAAG,QAAQ,EAAE,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IACtF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,eAAe,CAAC,QAAgB;QACpC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAU,GAAG,2BAA2B,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC1F,OAAO,MAAM,KAAK,IAAI,CAAC;IACzB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,sBAAsB,GAAG,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC;CACF,CAAA;AA/CY,qBAAqB;IADjC,UAAU,EAAE;IAGR,WAAA,MAAM,CAAC,aAAa,CAAC,CAAA;;GAFb,qBAAqB,CA+CjC"}

package/dist/auth/strategies/anonymous/anonymous.strategy.d.ts

@@ -0,0 +1,19 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Anonymous session strategy.
+ *
+ * Creates a temporary identity without requiring credentials.
+ * These sessions can later be converted to permanent accounts.
+ */
+export declare class AnonymousStrategy extends BaseStrategy {
+    private readonly jwtService;
+    readonly type = AuthMethod.ANONYMOUS;
+    readonly name = "anonymous";
+    private counter;
+    constructor(jwtService: JwtService);
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=anonymous.strategy.d.ts.map

package/dist/auth/strategies/anonymous/anonymous.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymous.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/anonymous/anonymous.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,qBACa,iBAAkB,SAAQ,YAAY;IAMrC,OAAO,CAAC,QAAQ,CAAC,UAAU;IALvC,QAAQ,CAAC,IAAI,wBAAwB;IACrC,QAAQ,CAAC,IAAI,eAAe;IAE5B,OAAO,CAAC,OAAO,CAAK;gBAES,UAAU,EAAE,UAAU;IAIpC,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CAiBxB"}

package/dist/auth/strategies/anonymous/anonymous.strategy.js

@@ -0,0 +1,49 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Anonymous session strategy.
+ *
+ * Creates a temporary identity without requiring credentials.
+ * These sessions can later be converted to permanent accounts.
+ */
+let AnonymousStrategy = class AnonymousStrategy extends BaseStrategy {
+    jwtService;
+    type = AuthMethod.ANONYMOUS;
+    name = 'anonymous';
+    counter = 0;
+    constructor(jwtService) {
+        super();
+        this.jwtService = jwtService;
+    }
+    async authenticate(payload, _context) {
+        this.counter += 1;
+        const idPrefix = payload.idPrefix || 'anon_';
+        const id = `${idPrefix}${Date.now()}_${this.counter}_${Math.random().toString(36).slice(2, 8)}`;
+        const user = {
+            id,
+            username: `Anonymous_${id.slice(-8)}`,
+            isAnonymous: true,
+            roles: [],
+            permissions: [],
+        };
+        const tokens = await this.jwtService.signTokens(user);
+        return { user, tokens, isNewUser: true };
+    }
+};
+AnonymousStrategy = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [JwtService])
+], AnonymousStrategy);
+export { AnonymousStrategy };
+//# sourceMappingURL=anonymous.strategy.js.map

package/dist/auth/strategies/anonymous/anonymous.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anonymous.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/anonymous/anonymous.strategy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AAEI,IAAM,iBAAiB,GAAvB,MAAM,iBAAkB,SAAQ,YAAY;IAMpB;IALpB,IAAI,GAAG,UAAU,CAAC,SAAS,CAAC;IAC5B,IAAI,GAAG,WAAW,CAAC;IAEpB,OAAO,GAAG,CAAC,CAAC;IAEpB,YAA6B,UAAsB;QACjD,KAAK,EAAE,CAAC;QADmB,eAAU,GAAV,UAAU,CAAY;IAEnD,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAI,OAAO,CAAC,QAAmB,IAAI,OAAO,CAAC;QACzD,MAAM,EAAE,GAAG,GAAG,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;QAEhG,MAAM,IAAI,GAAG;YACX,EAAE;YACF,QAAQ,EAAE,aAAa,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE;YACrC,WAAW,EAAE,IAAI;YACjB,KAAK,EAAE,EAAc;YACrB,WAAW,EAAE,EAAc;SAC5B,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;CACF,CAAA;AA9BY,iBAAiB;IAD7B,UAAU,EAAE;qCAO8B,UAAU;GANxC,iBAAiB,CA8B7B"}

package/dist/auth/strategies/base/base.strategy.d.ts

@@ -0,0 +1,11 @@
+import type { ExecutionContext } from '@nestjs/common';
+import type { IAuthStrategy, IAuthResult, AuthMethod } from '../../interfaces';
+/**
+ * Abstract base strategy providing a common type and name for all strategies.
+ */
+export declare abstract class BaseStrategy implements IAuthStrategy {
+    abstract readonly type: AuthMethod;
+    abstract readonly name: string;
+    abstract authenticate(payload: Record<string, unknown>, context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=base.strategy.d.ts.map

package/dist/auth/strategies/base/base.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/base/base.strategy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE/E;;GAEG;AACH,8BAAsB,YAAa,YAAW,aAAa;IACzD,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,UAAU,CAAC;IACnC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAE/B,QAAQ,CAAC,YAAY,CACnB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,OAAO,CAAC,EAAE,gBAAgB,GACzB,OAAO,CAAC,WAAW,CAAC;CACxB"}

package/dist/auth/strategies/base/base.strategy.js

@@ -0,0 +1,6 @@
+/**
+ * Abstract base strategy providing a common type and name for all strategies.
+ */
+export class BaseStrategy {
+}
+//# sourceMappingURL=base.strategy.js.map

package/dist/auth/strategies/base/base.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/base/base.strategy.ts"],"names":[],"mappings":"AAGA;;GAEG;AACH,MAAM,OAAgB,YAAY;CAQjC"}

package/dist/auth/strategies/credentials/credentials.strategy.d.ts

@@ -0,0 +1,21 @@
+import type { ExecutionContext } from '@nestjs/common';
+import { AuthMethod, type IAuthResult } from '../../interfaces';
+import type { IUserService } from '../../interfaces';
+import { PasswordService } from '../../password/password.service';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Authenticates users via email/username + password.
+ *
+ * Enabled by default when `AuthModuleOptions.credentials` is `true`
+ * (or an object).
+ */
+export declare class CredentialsStrategy extends BaseStrategy {
+    private readonly userService;
+    private readonly jwtService;
+    readonly type = AuthMethod.CREDENTIALS;
+    readonly name = "credentials";
+    constructor(userService: IUserService, _passwordService: PasswordService, jwtService: JwtService);
+    authenticate(payload: Record<string, unknown>, _context?: ExecutionContext): Promise<IAuthResult>;
+}
+//# sourceMappingURL=credentials.strategy.d.ts.map

package/dist/auth/strategies/credentials/credentials.strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.strategy.d.ts","sourceRoot":"","sources":["../../../../packages/auth/strategies/credentials/credentials.strategy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,KAAK,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAErD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AACH,qBACa,mBAAoB,SAAQ,YAAY;IAMjD,OAAO,CAAC,QAAQ,CAAC,WAAW;IAE5B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAP7B,QAAQ,CAAC,IAAI,0BAA0B;IACvC,QAAQ,CAAC,IAAI,iBAAiB;gBAIX,WAAW,EAAE,YAAY,EAC1C,gBAAgB,EAAE,eAAe,EAChB,UAAU,EAAE,UAAU;IAK1B,YAAY,CACzB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,QAAQ,CAAC,EAAE,gBAAgB,GAC1B,OAAO,CAAC,WAAW,CAAC;CA+BxB"}

package/dist/auth/strategies/credentials/credentials.strategy.js

@@ -0,0 +1,67 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+import { Inject, Injectable } from '@nestjs/common';
+import { AuthMethod } from '../../interfaces';
+import { USER_SERVICE } from '../../auth.constants';
+import { PasswordService } from '../../password/password.service';
+import { JwtService } from '../../session/jwt.service';
+import { BaseStrategy } from '../base/base.strategy';
+/**
+ * Authenticates users via email/username + password.
+ *
+ * Enabled by default when `AuthModuleOptions.credentials` is `true`
+ * (or an object).
+ */
+let CredentialsStrategy = class CredentialsStrategy extends BaseStrategy {
+    userService;
+    jwtService;
+    type = AuthMethod.CREDENTIALS;
+    name = 'credentials';
+    constructor(userService, _passwordService, jwtService) {
+        super();
+        this.userService = userService;
+        this.jwtService = jwtService;
+    }
+    async authenticate(payload, _context) {
+        const email = payload.email;
+        const username = payload.username;
+        const password = payload.password;
+        if (!password) {
+            throw new Error('Password is required');
+        }
+        const user = email
+            ? await this.userService.findByEmail(email)
+            : username
+                ? await this.userService.findByUsername(username)
+                : null;
+        if (!user) {
+            throw new Error('Invalid credentials');
+        }
+        const valid = await this.userService.validatePassword(user, password);
+        if (!valid) {
+            throw new Error('Invalid credentials');
+        }
+        user.roles = await this.userService.getRoles(user.id);
+        user.permissions = await this.userService.getPermissions(user.id);
+        const tokens = await this.jwtService.signTokens(user);
+        return { user, tokens };
+    }
+};
+CredentialsStrategy = __decorate([
+    Injectable(),
+    __param(0, Inject(USER_SERVICE)),
+    __metadata("design:paramtypes", [Object, PasswordService,
+        JwtService])
+], CredentialsStrategy);
+export { CredentialsStrategy };
+//# sourceMappingURL=credentials.strategy.js.map

package/dist/auth/strategies/credentials/credentials.strategy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.strategy.js","sourceRoot":"","sources":["../../../../packages/auth/strategies/credentials/credentials.strategy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAEhE,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AAErD;;;;;GAKG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,YAAY;IAMhC;IAEA;IAPV,IAAI,GAAG,UAAU,CAAC,WAAW,CAAC;IAC9B,IAAI,GAAG,aAAa,CAAC;IAE9B,YAEmB,WAAyB,EAC1C,gBAAiC,EAChB,UAAsB;QAEvC,KAAK,EAAE,CAAC;QAJS,gBAAW,GAAX,WAAW,CAAc;QAEzB,eAAU,GAAV,UAAU,CAAY;IAGzC,CAAC;IAEQ,KAAK,CAAC,YAAY,CACzB,OAAgC,EAChC,QAA2B;QAE3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAA2B,CAAC;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAA8B,CAAC;QACxD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAkB,CAAC;QAE5C,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,CAAC;QAED,MAAM,IAAI,GAAG,KAAK;YAChB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC,KAAK,CAAC;YAC3C,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,QAAQ,CAAC;gBACjD,CAAC,CAAC,IAAI,CAAC;QAEX,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC,WAAW,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAEtD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;CACF,CAAA;AA/CY,mBAAmB;IAD/B,UAAU,EAAE;IAMR,WAAA,MAAM,CAAC,YAAY,CAAC,CAAA;6CAEH,eAAe;QACJ,UAAU;GAR9B,mBAAmB,CA+C/B"}

package/dist/auth/strategies/index.d.ts

@@ -0,0 +1,12 @@
+export { BaseStrategy } from './base/base.strategy';
+export { CredentialsStrategy } from './credentials/credentials.strategy';
+export { OAuthProviderRegistry } from './oauth/oauth-provider-registry';
+export { OAuthStrategy } from './oauth/oauth.strategy';
+export { TotpStrategy } from './totp/totp.strategy';
+export { AnonymousStrategy } from './anonymous/anonymous.strategy';
+export { MagicLinkStrategy } from './magic-link/magic-link.strategy';
+export { OtpStrategy } from './otp/otp.strategy';
+export { PasskeyStrategy } from './passkey/passkey.strategy';
+export { OneTapStrategy } from './onetap/onetap.strategy';
+export { SsoStrategy } from './sso/sso.strategy';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/strategies/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../packages/auth/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}

package/dist/auth/strategies/index.js

@@ -0,0 +1,12 @@
+export { BaseStrategy } from './base/base.strategy';
+export { CredentialsStrategy } from './credentials/credentials.strategy';
+export { OAuthProviderRegistry } from './oauth/oauth-provider-registry';
+export { OAuthStrategy } from './oauth/oauth.strategy';
+export { TotpStrategy } from './totp/totp.strategy';
+export { AnonymousStrategy } from './anonymous/anonymous.strategy';
+export { MagicLinkStrategy } from './magic-link/magic-link.strategy';
+export { OtpStrategy } from './otp/otp.strategy';
+export { PasskeyStrategy } from './passkey/passkey.strategy';
+export { OneTapStrategy } from './onetap/onetap.strategy';
+export { SsoStrategy } from './sso/sso.strategy';
+//# sourceMappingURL=index.js.map

package/dist/auth/strategies/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../packages/auth/strategies/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,MAAM,iCAAiC,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AACvD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,MAAM,0BAA0B,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC"}