@pattern-stack/codegen 0.6.3 → 0.6.5

package/CHANGELOG.md

@@ -4,6 +4,28 @@ All notable changes to this project will be documented in this file.
 
 ## [Unreleased]
 
+## [0.6.5] — 2026-04-27
+
+Auth subsystem reaches consumers. `runtime/subsystems/auth/`, the `auth-integrations` starter, and the `cdp subsystem install auth` + `auth-integrations` templates were all merged on `main` (PRs #289, #290, #292, #293, #294, #295) but the published artifact was still pinned at `0.6.4`. This release ships them.
+
+### Added
+
+- **`feat(auth)` #289** — provider-agnostic `AuthController` mounting `GET /auth/:provider/connect` and `GET /auth/:provider/callback`, plus the `IUserContext` / `IOAuthStateStore` / `IIntegrationGrantSink` ports and memory + drizzle state-store backends. `OAuth2RefreshStrategy` extracted as a template-method base class. See `runtime/subsystems/auth/`.
+- **`feat(examples)` #290** — `examples/auth-integrations/` starter: canonical `integration.yaml` entity + adapters that satisfy the three `AUTH_INTEGRATION_*` ports + `IntegrationsService` facade.
+- **`feat(cdp)` #293** — `cdp subsystem install auth` and `cdp subsystem install auth-integrations` templates. The auth template emits `auth_oauth_state` drizzle schema, appends `TOKEN_ENCRYPTION_KEY` + `AUTH_REDIRECT_URI_BASE` to `.env.config`, and drops a TODO into `app.module.ts`. `auth-integrations` vendors the starter under `apps/api/src/shared/integrations/`.
+
+## [0.6.4] — 2026-04-27
+
+Two consumer-DX fixes surfaced by a fresh `cdp project init` run.
+
+### Fixed
+
+- **`fix(init)` #277** — typed the empty `GENERATED_MODULES` barrel emitted by `cdp project init`. The scaffold previously emitted `export const GENERATED_MODULES: unknown[] = []`, which fails `tsc --noEmit` against the scaffolded `app.module.ts` (`...GENERATED_MODULES` spread doesn't satisfy NestJS's `imports:` type) on day one of any new consumer project. Now typed as `Array<Type | DynamicModule | Promise<DynamicModule> | ForwardReference>`. Entity-populated barrels remain unaffected — class refs already satisfy `Type`.
+
+### Changed
+
+- **`fix(bin)` #277** — added `codegen` as the primary bin name in `package.json`. The previous bin name `cdp` collides with an unrelated published npm package, so `bunx cdp ...` (without a local install) silently fetches and runs the wrong package. The CLI banner, README, and downstream docs all already refer to the binary as `codegen`. `cdp` is preserved as an alias for backwards compatibility.
+
 ## [0.6.3] — 2026-04-26
 
 ### Fixed

package/README.md

@@ -97,6 +97,8 @@ codegen subsystem install storage    # file storage (local filesystem)
 codegen subsystem install sync       # external-system sync engine (IChangeSource + orchestrator + audit log)
 codegen subsystem install bridge     # event-to-job bridge (durable async fanout via @JobHandler.triggers)
 codegen subsystem install openapi-config  # OpenAPI/Swagger — Zod DTOs as /docs-json + Swagger UI. See docs/CONSUMER-SETUP.md §OpenAPI
+codegen subsystem install auth       # OAuth integration auth (AuthModule + ports + state store + AuthController)
+codegen subsystem install auth-integrations  # vendored integrations entity + adapters (consumes auth subsystem)
 codegen subsystem list               # show installed + available
 
 codegen events consumers <type>      # list all Tier 1/2/3 consumers of an event type

package/dist/runtime/subsystems/auth/auth-oauth-state.schema.d.ts

@@ -0,0 +1,81 @@
+import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
+import { InferSelectModel } from 'drizzle-orm';
+
+declare const authOAuthState: drizzle_orm_pg_core.PgTableWithColumns<{
+    name: "auth_oauth_state";
+    schema: undefined;
+    columns: {
+        state: drizzle_orm_pg_core.PgColumn<{
+            name: "state";
+            tableName: "auth_oauth_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        userId: drizzle_orm_pg_core.PgColumn<{
+            name: "user_id";
+            tableName: "auth_oauth_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        redirect: drizzle_orm_pg_core.PgColumn<{
+            name: "redirect";
+            tableName: "auth_oauth_state";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: drizzle_orm_pg_core.PgColumn<{
+            name: "expires_at";
+            tableName: "auth_oauth_state";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
+type AuthOAuthState = InferSelectModel<typeof authOAuthState>;
+
+export { type AuthOAuthState, authOAuthState };

package/dist/runtime/subsystems/auth/auth-oauth-state.schema.js

@@ -0,0 +1,12 @@
+// runtime/subsystems/auth/auth-oauth-state.schema.ts
+import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+var authOAuthState = pgTable("auth_oauth_state", {
+  state: text("state").primaryKey(),
+  userId: text("user_id").notNull(),
+  redirect: text("redirect"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+});
+export {
+  authOAuthState
+};
+//# sourceMappingURL=auth-oauth-state.schema.js.map

package/dist/runtime/subsystems/auth/auth-oauth-state.schema.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../runtime/subsystems/auth/auth-oauth-state.schema.ts"],"sourcesContent":["/**\n * Drizzle schema for the `auth_oauth_state` table — backs the\n * `DrizzleOAuthStateStore` (`state-store.drizzle-backend.ts`).\n *\n * One row per outstanding /connect → /callback dance. Single-use; rows are\n * deleted on consume. A periodic sweep (or a `WHERE expires_at < now()`\n * filter on read) clears abandoned rows.\n *\n * Columns:\n *   - `state`       — opaque random token, primary key.\n *   - `user_id`     — text (matches the consumer-defined user-id shape;\n *                     the auth subsystem doesn't constrain this to UUID\n *                     because some apps key users by external id).\n *   - `redirect`    — optional post-callback redirect path.\n *   - `expires_at`  — TTL boundary; entries past this are treated as absent.\n *\n * Convention: schema files live at the root of the subsystem dir\n * (mirrors `cache.schema.ts`, `sync-audit.schema.ts`, `domain-events.schema.ts`).\n */\nimport { pgTable, text, timestamp } from 'drizzle-orm/pg-core';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nexport const authOAuthState = pgTable('auth_oauth_state', {\n  state: text('state').primaryKey(),\n  userId: text('user_id').notNull(),\n  redirect: text('redirect'),\n  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),\n});\n\nexport type AuthOAuthState = InferSelectModel<typeof authOAuthState>;\n"],"mappings":";AAmBA,SAAS,SAAS,MAAM,iBAAiB;AAGlC,IAAM,iBAAiB,QAAQ,oBAAoB;AAAA,EACxD,OAAO,KAAK,OAAO,EAAE,WAAW;AAAA,EAChC,QAAQ,KAAK,SAAS,EAAE,QAAQ;AAAA,EAChC,UAAU,KAAK,UAAU;AAAA,EACzB,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ;AACrE,CAAC;","names":[]}

package/dist/runtime/subsystems/auth/auth.module.d.ts

@@ -3,48 +3,63 @@ import { Provider, DynamicModule } from '@nestjs/common';
 /**
  * AuthModule — DynamicModule factory for the auth subsystem.
  *
- * Wires the two pluggable backends the subsystem ships with:
- *   - `ENCRYPTION_KEY`       → `EnvEncryptionKey` (AES-256-GCM from env)
- *   - `OAUTH_STATE_STORE`    → `InMemoryOAuthStateStore` (dev) / custom Redis impl (prod)
+ * Wires the pluggable backends the subsystem ships with:
+ *   - `ENCRYPTION_KEY`      → `EnvEncryptionKey` (AES-256-GCM from env)
+ *   - `OAUTH_STATE_STORE`   → `MemoryOAuthStateStore` (dev/tests) or
+ *                             `DrizzleOAuthStateStore` (prod, requires
+ *                             DRIZZLE provider).
+ *   - `AUTH_OPTIONS`        → resolved options bag (used by AuthController
+ *                             for `redirectUriBase`).
  *
- * The two integration-store ports (`AUTH_INTEGRATION_READER`,
- * `AUTH_INTEGRATION_TOKEN_WRITER`) are deliberately **not** wired by this
- * module — they are always consumer-specific (adapters over the app's own
- * integrations entity/service). Consumers provide them in the module that
- * owns the integrations domain, not here.
+ * The integration-store ports (`AUTH_INTEGRATION_READER`,
+ * `AUTH_INTEGRATION_TOKEN_WRITER`, `AUTH_INTEGRATION_GRANT_SINK`),
+ * `AUTH_USER_CONTEXT`, and `STRATEGY_REGISTRY` are deliberately **not**
+ * wired here — they are always consumer-specific:
+ *   - integration-store ports adapt the consumer's `integrations` storage;
+ *   - `IUserContext` adapts the app's session/JWT scheme;
+ *   - `STRATEGY_REGISTRY` is populated from the per-provider strategy
+ *     classes the consumer maintains.
  *
- * `IAuthStrategy` implementations are also per-provider and live in the
- * integration module that uses them (`SalesforceModule`, `HubSpotModule`, …).
- * The subsystem provides the abstract base class
- * (`OAuth2RefreshStrategy`) — binding concrete strategies is an app concern.
+ * Consumers provide them in their app module (or by importing the
+ * `auth-integrations` starter, which binds the three integration-store
+ * ports off a single canonical entity).
  *
  * Usage in AppModule:
  * ```typescript
  * AuthModule.forRoot({
  *   encryptionKey: 'env',
- *   oauthStateStore: 'in-memory',
- * });
- * ```
- *
- * Or inject custom providers directly:
- * ```typescript
- * AuthModule.forRoot({
- *   encryptionKey: { useClass: MyKmsEncryptionKey },
- *   oauthStateStore: { useClass: RedisOAuthStateStore },
+ *   oauthStateStore: 'memory',          // or 'drizzle'
+ *   enableController: true,
+ *   redirectUriBase: 'http://localhost:3000',
  * });
  * ```
  *
  * `global: true` means other modules don't need to re-import AuthModule to
- * inject `ENCRYPTION_KEY` / `OAUTH_STATE_STORE`.
+ * inject the auth tokens.
  */
 
 type EncryptionKeyChoice = 'env' | Omit<Provider, 'provide'>;
-type OAuthStateStoreChoice = 'in-memory' | Omit<Provider, 'provide'>;
+type OAuthStateStoreChoice = 'memory' | 'drizzle' | Omit<Provider, 'provide'>;
 interface AuthModuleOptions {
     /** `'env'` (default) or a full provider definition (e.g. `{ useClass: MyKmsEncryptionKey }`). */
     encryptionKey?: EncryptionKeyChoice;
-    /** `'in-memory'` (default) or a full provider definition for a Redis/DB impl. */
+    /**
+     * `'memory'` (default — tests/dev) or `'drizzle'` (prod, requires DRIZZLE
+     * provider) or a full provider definition for a custom impl.
+     */
     oauthStateStore?: OAuthStateStoreChoice;
+    /**
+     * Mount `AuthController` (`/auth/:provider/connect` + `/callback`).
+     * Default `false` — apps that hand-roll connect/callback (rare) or that
+     * use the subsystem only for the refresh path can opt out.
+     */
+    enableController?: boolean;
+    /**
+     * Public base URL of the API server. Used to construct per-provider
+     * callback URIs as `${redirectUriBase}/auth/:provider/callback`.
+     * Required when `enableController: true`.
+     */
+    redirectUriBase?: string;
 }
 declare class AuthModule {
     static forRoot(options?: AuthModuleOptions): DynamicModule;

package/dist/runtime/subsystems/auth/auth.module.js

@@ -8,6 +8,7 @@ var __decorateClass = (decorators, target, key, kind) => {
   if (kind && result) __defProp(target, key, result);
   return result;
 };
+var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
 
 // runtime/subsystems/auth/auth.module.ts
 import { Module } from "@nestjs/common";
@@ -15,6 +16,10 @@ import { Module } from "@nestjs/common";
 // runtime/subsystems/auth/auth.tokens.ts
 var ENCRYPTION_KEY = /* @__PURE__ */ Symbol("ENCRYPTION_KEY");
 var OAUTH_STATE_STORE = /* @__PURE__ */ Symbol("OAUTH_STATE_STORE");
+var AUTH_INTEGRATION_GRANT_SINK = /* @__PURE__ */ Symbol("AUTH_INTEGRATION_GRANT_SINK");
+var AUTH_USER_CONTEXT = /* @__PURE__ */ Symbol("AUTH_USER_CONTEXT");
+var STRATEGY_REGISTRY = /* @__PURE__ */ Symbol("STRATEGY_REGISTRY");
+var AUTH_OPTIONS = /* @__PURE__ */ Symbol("AUTH_OPTIONS");
 
 // runtime/subsystems/auth/backends/encryption-key/env.ts
 import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
@@ -66,26 +71,224 @@ var EnvEncryptionKey = class {
   }
 };
 
-// runtime/subsystems/auth/backends/oauth-state-store/in-memory.ts
-var InMemoryOAuthStateStore = class {
+// runtime/subsystems/auth/backends/state-store.memory-backend.ts
+import { randomBytes as randomBytes2 } from "crypto";
+
+// runtime/subsystems/auth/protocols/oauth-state-store.ts
+var OAuthStateError = class extends Error {
+  constructor(message, reason) {
+    super(message);
+    this.reason = reason;
+    this.name = "OAuthStateError";
+  }
+  reason;
+};
+
+// runtime/subsystems/auth/backends/state-store.memory-backend.ts
+var MemoryOAuthStateStore = class {
   store = /* @__PURE__ */ new Map();
   ttlMs;
   now;
+  generateToken;
   constructor(opts = {}) {
     this.ttlMs = opts.ttlMs ?? 10 * 60 * 1e3;
     this.now = opts.now ?? (() => Date.now());
+    this.generateToken = opts.generateToken ?? (() => randomBytes2(32).toString("base64url"));
   }
-  async put(state, entry) {
-    this.store.set(state, { entry, expiresAt: this.now() + this.ttlMs });
+  async generate(record) {
+    const state = this.generateToken();
+    this.store.set(state, {
+      record: { ...record },
+      expiresAt: this.now() + this.ttlMs
+    });
+    return state;
   }
   async consume(state) {
     const slot = this.store.get(state);
-    if (!slot) return null;
+    if (!slot) {
+      throw new OAuthStateError(
+        `OAuth state token unknown or already consumed`,
+        "missing"
+      );
+    }
     this.store.delete(state);
-    if (slot.expiresAt <= this.now()) return null;
-    return slot.entry;
+    if (slot.expiresAt <= this.now()) {
+      throw new OAuthStateError(`OAuth state token expired`, "expired");
+    }
+    return slot.record;
+  }
+};
+
+// runtime/subsystems/auth/backends/state-store.drizzle-backend.ts
+import { randomBytes as randomBytes3 } from "crypto";
+import { eq } from "drizzle-orm";
+
+// runtime/subsystems/auth/auth-oauth-state.schema.ts
+import { pgTable, text, timestamp } from "drizzle-orm/pg-core";
+var authOAuthState = pgTable("auth_oauth_state", {
+  state: text("state").primaryKey(),
+  userId: text("user_id").notNull(),
+  redirect: text("redirect"),
+  expiresAt: timestamp("expires_at", { withTimezone: true }).notNull()
+});
+
+// runtime/subsystems/auth/backends/state-store.drizzle-backend.ts
+var DrizzleOAuthStateStore = class {
+  constructor(db, opts = {}) {
+    this.db = db;
+    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1e3;
+    this.now = opts.now ?? (() => Date.now());
+    this.generateToken = opts.generateToken ?? (() => randomBytes3(32).toString("base64url"));
+  }
+  db;
+  ttlMs;
+  now;
+  generateToken;
+  async generate(record) {
+    const state = this.generateToken();
+    const expiresAt = new Date(this.now() + this.ttlMs);
+    await this.db.insert(authOAuthState).values({
+      state,
+      userId: record.userId,
+      redirect: record.redirect ?? null,
+      expiresAt
+    });
+    return state;
+  }
+  async consume(state) {
+    const rows = await this.db.delete(authOAuthState).where(eq(authOAuthState.state, state)).returning();
+    const row = rows[0];
+    if (!row) {
+      throw new OAuthStateError(
+        `OAuth state token unknown or already consumed`,
+        "missing"
+      );
+    }
+    if (row.expiresAt.getTime() <= this.now()) {
+      throw new OAuthStateError(`OAuth state token expired`, "expired");
+    }
+    return {
+      userId: row.userId,
+      redirect: row.redirect ?? void 0
+    };
+  }
+};
+
+// runtime/subsystems/auth/controllers/auth.controller.ts
+import {
+  Controller,
+  Get,
+  Inject,
+  Param,
+  Query,
+  Req,
+  Res,
+  HttpException,
+  HttpStatus
+} from "@nestjs/common";
+var AuthController = class {
+  constructor(registry, userContext, stateStore, grantSink, options) {
+    this.registry = registry;
+    this.userContext = userContext;
+    this.stateStore = stateStore;
+    this.grantSink = grantSink;
+    this.options = options;
+  }
+  registry;
+  userContext;
+  stateStore;
+  grantSink;
+  options;
+  async connect(slug, redirect, req, res) {
+    const strategy = this.requireStrategy(slug);
+    const userId = await this.userContext.getCurrentUserId(req);
+    const state = await this.stateStore.generate({ userId, redirect });
+    const url = strategy.buildAuthorizeUrl({
+      state,
+      redirectUri: this.redirectUriFor(slug)
+    });
+    return res.redirect(HttpStatus.FOUND, url);
+  }
+  async callback(slug, code, state, res) {
+    const strategy = this.requireStrategy(slug);
+    if (!code) {
+      throw new HttpException(
+        `Missing 'code' query param`,
+        HttpStatus.BAD_REQUEST
+      );
+    }
+    if (!state) {
+      throw new HttpException(
+        `Missing 'state' query param`,
+        HttpStatus.BAD_REQUEST
+      );
+    }
+    const { userId, redirect } = await this.stateStore.consume(state);
+    const tokens = await strategy.exchangeCodeForTokens({
+      code,
+      redirectUri: this.redirectUriFor(slug)
+    });
+    await this.grantSink.createOrUpdateFromOAuthGrant({
+      userId,
+      provider: slug,
+      accessToken: tokens.accessToken,
+      refreshToken: tokens.refreshToken,
+      expiresAt: tokens.expiresAt,
+      scope: tokens.scope,
+      externalAccountId: tokens.externalAccountId,
+      providerMetadata: tokens.providerMetadata
+    });
+    return res.redirect(
+      HttpStatus.FOUND,
+      redirect ?? `/settings/integrations?connected=${encodeURIComponent(slug)}`
+    );
+  }
+  requireStrategy(slug) {
+    const strategy = this.registry.get(slug);
+    if (!strategy) {
+      throw new HttpException(
+        `Unknown provider '${slug}'`,
+        HttpStatus.NOT_FOUND
+      );
+    }
+    return strategy;
+  }
+  redirectUriFor(slug) {
+    const base = this.options.redirectUriBase;
+    if (!base) {
+      throw new Error(
+        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`
+      );
+    }
+    const trimmed = base.replace(/\/+$/, "");
+    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;
   }
 };
+__decorateClass([
+  Get(":provider/connect"),
+  __decorateParam(0, Param("provider")),
+  __decorateParam(1, Query("redirect")),
+  __decorateParam(2, Req()),
+  __decorateParam(3, Res())
+], AuthController.prototype, "connect", 1);
+__decorateClass([
+  Get(":provider/callback"),
+  __decorateParam(0, Param("provider")),
+  __decorateParam(1, Query("code")),
+  __decorateParam(2, Query("state")),
+  __decorateParam(3, Res())
+], AuthController.prototype, "callback", 1);
+AuthController = __decorateClass([
+  Controller("auth"),
+  __decorateParam(0, Inject(STRATEGY_REGISTRY)),
+  __decorateParam(1, Inject(AUTH_USER_CONTEXT)),
+  __decorateParam(2, Inject(OAUTH_STATE_STORE)),
+  __decorateParam(3, Inject(AUTH_INTEGRATION_GRANT_SINK)),
+  __decorateParam(4, Inject(AUTH_OPTIONS))
+], AuthController);
+
+// runtime/constants/tokens.ts
+var DRIZZLE = "DRIZZLE";
 
 // runtime/subsystems/auth/auth.module.ts
 function resolveEncryptionKeyProvider(choice) {
@@ -95,24 +298,54 @@ function resolveEncryptionKeyProvider(choice) {
   return { provide: ENCRYPTION_KEY, ...choice };
 }
 function resolveOAuthStateStoreProvider(choice) {
-  if (choice === "in-memory") {
-    return { provide: OAUTH_STATE_STORE, useClass: InMemoryOAuthStateStore };
+  if (choice === "memory") {
+    return { provide: OAUTH_STATE_STORE, useClass: MemoryOAuthStateStore };
+  }
+  if (choice === "drizzle") {
+    return {
+      provide: OAUTH_STATE_STORE,
+      useFactory: (db) => {
+        if (!db) {
+          throw new Error(
+            "AuthModule.forRoot: oauthStateStore: 'drizzle' selected but DRIZZLE provider is not available. Ensure DatabaseModule (or another provider exposing DRIZZLE) is imported before AuthModule.forRoot."
+          );
+        }
+        return new DrizzleOAuthStateStore(db);
+      },
+      inject: [{ token: DRIZZLE, optional: true }]
+    };
   }
   return { provide: OAUTH_STATE_STORE, ...choice };
 }
 var AuthModule = class {
   static forRoot(options = {}) {
+    const resolved = {
+      encryptionKey: options.encryptionKey ?? "env",
+      oauthStateStore: options.oauthStateStore ?? "memory",
+      enableController: options.enableController ?? false,
+      redirectUriBase: options.redirectUriBase
+    };
+    if (resolved.enableController && !resolved.redirectUriBase) {
+      throw new Error(
+        "AuthModule.forRoot: redirectUriBase is required when enableController: true"
+      );
+    }
     const encryptionKeyProvider = resolveEncryptionKeyProvider(
-      options.encryptionKey ?? "env"
+      resolved.encryptionKey
     );
     const oauthStateStoreProvider = resolveOAuthStateStoreProvider(
-      options.oauthStateStore ?? "in-memory"
+      resolved.oauthStateStore
     );
+    const optionsProvider = {
+      provide: AUTH_OPTIONS,
+      useValue: resolved
+    };
     return {
       module: AuthModule,
       global: true,
-      providers: [encryptionKeyProvider, oauthStateStoreProvider],
-      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE]
+      providers: [encryptionKeyProvider, oauthStateStoreProvider, optionsProvider],
+      controllers: resolved.enableController ? [AuthController] : [],
+      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE, AUTH_OPTIONS]
     };
   }
 };

package/dist/runtime/subsystems/auth/auth.module.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../runtime/subsystems/auth/auth.module.ts","../../../../runtime/subsystems/auth/auth.tokens.ts","../../../../runtime/subsystems/auth/backends/encryption-key/env.ts","../../../../runtime/subsystems/auth/backends/oauth-state-store/in-memory.ts"],"sourcesContent":["/**\n * AuthModule — DynamicModule factory for the auth subsystem.\n *\n * Wires the two pluggable backends the subsystem ships with:\n *   - `ENCRYPTION_KEY`       → `EnvEncryptionKey` (AES-256-GCM from env)\n *   - `OAUTH_STATE_STORE`    → `InMemoryOAuthStateStore` (dev) / custom Redis impl (prod)\n *\n * The two integration-store ports (`AUTH_INTEGRATION_READER`,\n * `AUTH_INTEGRATION_TOKEN_WRITER`) are deliberately **not** wired by this\n * module — they are always consumer-specific (adapters over the app's own\n * integrations entity/service). Consumers provide them in the module that\n * owns the integrations domain, not here.\n *\n * `IAuthStrategy` implementations are also per-provider and live in the\n * integration module that uses them (`SalesforceModule`, `HubSpotModule`, …).\n * The subsystem provides the abstract base class\n * (`OAuth2RefreshStrategy`) — binding concrete strategies is an app concern.\n *\n * Usage in AppModule:\n * ```typescript\n * AuthModule.forRoot({\n *   encryptionKey: 'env',\n *   oauthStateStore: 'in-memory',\n * });\n * ```\n *\n * Or inject custom providers directly:\n * ```typescript\n * AuthModule.forRoot({\n *   encryptionKey: { useClass: MyKmsEncryptionKey },\n *   oauthStateStore: { useClass: RedisOAuthStateStore },\n * });\n * ```\n *\n * `global: true` means other modules don't need to re-import AuthModule to\n * inject `ENCRYPTION_KEY` / `OAUTH_STATE_STORE`.\n */\nimport { Module, type DynamicModule, type Provider } from '@nestjs/common';\nimport { ENCRYPTION_KEY, OAUTH_STATE_STORE } from './auth.tokens';\nimport { EnvEncryptionKey } from './backends/encryption-key/env';\nimport { InMemoryOAuthStateStore } from './backends/oauth-state-store/in-memory';\n\ntype EncryptionKeyChoice =\n  | 'env'\n  | Omit<Provider, 'provide'>;\n\ntype OAuthStateStoreChoice =\n  | 'in-memory'\n  | Omit<Provider, 'provide'>;\n\nexport interface AuthModuleOptions {\n  /** `'env'` (default) or a full provider definition (e.g. `{ useClass: MyKmsEncryptionKey }`). */\n  encryptionKey?: EncryptionKeyChoice;\n  /** `'in-memory'` (default) or a full provider definition for a Redis/DB impl. */\n  oauthStateStore?: OAuthStateStoreChoice;\n}\n\nfunction resolveEncryptionKeyProvider(choice: EncryptionKeyChoice): Provider {\n  if (choice === 'env') {\n    return { provide: ENCRYPTION_KEY, useClass: EnvEncryptionKey };\n  }\n  return { provide: ENCRYPTION_KEY, ...choice } as Provider;\n}\n\nfunction resolveOAuthStateStoreProvider(\n  choice: OAuthStateStoreChoice,\n): Provider {\n  if (choice === 'in-memory') {\n    return { provide: OAUTH_STATE_STORE, useClass: InMemoryOAuthStateStore };\n  }\n  return { provide: OAUTH_STATE_STORE, ...choice } as Provider;\n}\n\n@Module({})\nexport class AuthModule {\n  static forRoot(options: AuthModuleOptions = {}): DynamicModule {\n    const encryptionKeyProvider = resolveEncryptionKeyProvider(\n      options.encryptionKey ?? 'env',\n    );\n    const oauthStateStoreProvider = resolveOAuthStateStoreProvider(\n      options.oauthStateStore ?? 'in-memory',\n    );\n\n    return {\n      module: AuthModule,\n      global: true,\n      providers: [encryptionKeyProvider, oauthStateStoreProvider],\n      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE],\n    };\n  }\n}\n","/**\n * Auth subsystem — injection tokens.\n *\n * Following ADR-008 guidance: `Symbol()` tokens for type safety and collision\n * avoidance. Consumers inject these via `@Inject(...)` against the matching\n * protocol interface.\n *\n * Usage:\n * ```typescript\n * constructor(\n *   @Inject(ENCRYPTION_KEY) private readonly key: IEncryptionKey,\n *   @Inject(OAUTH_STATE_STORE) private readonly states: IOAuthStateStore,\n *   @Inject(AUTH_INTEGRATION_READER) private readonly reader: IIntegrationReader,\n *   @Inject(AUTH_INTEGRATION_TOKEN_WRITER) private readonly writer: IIntegrationTokenWriter,\n * ) {}\n * ```\n *\n * `IAuthStrategy` implementations are provider-specific and registered under\n * provider-specific tokens (e.g. `SALESFORCE_AUTH_STRATEGY`,\n * `HUBSPOT_AUTH_STRATEGY`) by each integration module — this subsystem does\n * not mandate a single `AUTH_STRATEGY` token because an app typically has\n * many concurrent strategies, one per provider.\n */\nexport const ENCRYPTION_KEY = Symbol('ENCRYPTION_KEY');\nexport const OAUTH_STATE_STORE = Symbol('OAUTH_STATE_STORE');\nexport const AUTH_INTEGRATION_READER = Symbol('AUTH_INTEGRATION_READER');\nexport const AUTH_INTEGRATION_TOKEN_WRITER = Symbol('AUTH_INTEGRATION_TOKEN_WRITER');\n","/**\n * Env-backed AES-256-GCM encryption.\n *\n * Framing: `base64( nonce(12B) || ciphertext || authTag(16B) )`. Random nonce\n * per call means two encryptions of the same plaintext produce different\n * ciphertexts — prevents replay-style inference. Auth tag enforces integrity;\n * any tampering throws on decrypt.\n *\n * Key source: `TOKEN_ENCRYPTION_KEY` env var, 32 bytes base64-encoded.\n * Generate via `openssl rand -base64 32`.\n *\n * Future backend: `kms.ts` (AWS/GCP KMS) for production deployments that\n * need key rotation + audit trails.\n */\nimport { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { IEncryptionKey } from '../../protocols/encryption-key';\n\nexport interface EnvEncryptionKeyOptions {\n  /** Defaults to `process.env`. Tests inject a fixture. */\n  env?: NodeJS.ProcessEnv;\n  /** Defaults to `'TOKEN_ENCRYPTION_KEY'`. */\n  envVar?: string;\n}\n\nconst ALGO = 'aes-256-gcm';\nconst NONCE_BYTES = 12;\nconst TAG_BYTES = 16;\nconst KEY_BYTES = 32;\n\nexport class EnvEncryptionKey implements IEncryptionKey {\n  private readonly key: Buffer;\n\n  constructor(opts: EnvEncryptionKeyOptions = {}) {\n    const env = opts.env ?? process.env;\n    const envVar = opts.envVar ?? 'TOKEN_ENCRYPTION_KEY';\n    const raw = env[envVar];\n    if (!raw) {\n      throw new Error(\n        `EnvEncryptionKey: ${envVar} is not set. Generate with: openssl rand -base64 32`,\n      );\n    }\n    const decoded = Buffer.from(raw, 'base64');\n    if (decoded.length !== KEY_BYTES) {\n      throw new Error(\n        `EnvEncryptionKey: ${envVar} must decode to ${KEY_BYTES} bytes (got ${decoded.length}). Use: openssl rand -base64 32`,\n      );\n    }\n    this.key = decoded;\n  }\n\n  async encrypt(plaintext: string): Promise<string> {\n    const nonce = randomBytes(NONCE_BYTES);\n    const cipher = createCipheriv(ALGO, this.key, nonce);\n    const ciphertext = Buffer.concat([\n      cipher.update(plaintext, 'utf8'),\n      cipher.final(),\n    ]);\n    const authTag = cipher.getAuthTag();\n    return Buffer.concat([nonce, ciphertext, authTag]).toString('base64');\n  }\n\n  async decrypt(ciphertext: string): Promise<string> {\n    const buf = Buffer.from(ciphertext, 'base64');\n    if (buf.length < NONCE_BYTES + TAG_BYTES) {\n      throw new Error('EnvEncryptionKey: ciphertext too short');\n    }\n    const nonce = buf.subarray(0, NONCE_BYTES);\n    const authTag = buf.subarray(buf.length - TAG_BYTES);\n    const body = buf.subarray(NONCE_BYTES, buf.length - TAG_BYTES);\n\n    const decipher = createDecipheriv(ALGO, this.key, nonce);\n    decipher.setAuthTag(authTag);\n    const plain = Buffer.concat([decipher.update(body), decipher.final()]);\n    return plain.toString('utf8');\n  }\n}\n","/**\n * In-memory OAuth state store.\n *\n * Single-process dev store. Production deployments need a Redis-backed impl\n * (follow-up) so state survives restarts + is shared across workers.\n */\nimport type {\n  IOAuthStateStore,\n  OAuthStateEntry,\n} from '../../protocols/oauth-state-store';\n\nexport interface InMemoryOAuthStateStoreOptions {\n  /** TTL in ms. Entries older than this are treated as absent. Default 10min. */\n  ttlMs?: number;\n  now?: () => number;\n}\n\nexport class InMemoryOAuthStateStore implements IOAuthStateStore {\n  private readonly store = new Map<\n    string,\n    { entry: OAuthStateEntry; expiresAt: number }\n  >();\n  private readonly ttlMs: number;\n  private readonly now: () => number;\n\n  constructor(opts: InMemoryOAuthStateStoreOptions = {}) {\n    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1000;\n    this.now = opts.now ?? (() => Date.now());\n  }\n\n  async put(state: string, entry: OAuthStateEntry): Promise<void> {\n    this.store.set(state, { entry, expiresAt: this.now() + this.ttlMs });\n  }\n\n  async consume(state: string): Promise<OAuthStateEntry | null> {\n    const slot = this.store.get(state);\n    if (!slot) return null;\n    this.store.delete(state);\n    if (slot.expiresAt <= this.now()) return null;\n    return slot.entry;\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAqCA,SAAS,cAAiD;;;ACdnD,IAAM,iBAAiB,uBAAO,gBAAgB;AAC9C,IAAM,oBAAoB,uBAAO,mBAAmB;;;ACV3D,SAAS,gBAAgB,kBAAkB,mBAAmB;AAU9D,IAAM,OAAO;AACb,IAAM,cAAc;AACpB,IAAM,YAAY;AAClB,IAAM,YAAY;AAEX,IAAM,mBAAN,MAAiD;AAAA,EACrC;AAAA,EAEjB,YAAY,OAAgC,CAAC,GAAG;AAC9C,UAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,MAAM,IAAI,MAAM;AACtB,QAAI,CAAC,KAAK;AACR,YAAM,IAAI;AAAA,QACR,qBAAqB,MAAM;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,UAAU,OAAO,KAAK,KAAK,QAAQ;AACzC,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,MAAM,mBAAmB,SAAS,eAAe,QAAQ,MAAM;AAAA,MACtF;AAAA,IACF;AACA,SAAK,MAAM;AAAA,EACb;AAAA,EAEA,MAAM,QAAQ,WAAoC;AAChD,UAAM,QAAQ,YAAY,WAAW;AACrC,UAAM,SAAS,eAAe,MAAM,KAAK,KAAK,KAAK;AACnD,UAAM,aAAa,OAAO,OAAO;AAAA,MAC/B,OAAO,OAAO,WAAW,MAAM;AAAA,MAC/B,OAAO,MAAM;AAAA,IACf,CAAC;AACD,UAAM,UAAU,OAAO,WAAW;AAClC,WAAO,OAAO,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,EAAE,SAAS,QAAQ;AAAA,EACtE;AAAA,EAEA,MAAM,QAAQ,YAAqC;AACjD,UAAM,MAAM,OAAO,KAAK,YAAY,QAAQ;AAC5C,QAAI,IAAI,SAAS,cAAc,WAAW;AACxC,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,UAAM,QAAQ,IAAI,SAAS,GAAG,WAAW;AACzC,UAAM,UAAU,IAAI,SAAS,IAAI,SAAS,SAAS;AACnD,UAAM,OAAO,IAAI,SAAS,aAAa,IAAI,SAAS,SAAS;AAE7D,UAAM,WAAW,iBAAiB,MAAM,KAAK,KAAK,KAAK;AACvD,aAAS,WAAW,OAAO;AAC3B,UAAM,QAAQ,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,GAAG,SAAS,MAAM,CAAC,CAAC;AACrE,WAAO,MAAM,SAAS,MAAM;AAAA,EAC9B;AACF;;;AC1DO,IAAM,0BAAN,MAA0D;AAAA,EAC9C,QAAQ,oBAAI,IAG3B;AAAA,EACe;AAAA,EACA;AAAA,EAEjB,YAAY,OAAuC,CAAC,GAAG;AACrD,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AAAA,EACzC;AAAA,EAEA,MAAM,IAAI,OAAe,OAAuC;AAC9D,SAAK,MAAM,IAAI,OAAO,EAAE,OAAO,WAAW,KAAK,IAAI,IAAI,KAAK,MAAM,CAAC;AAAA,EACrE;AAAA,EAEA,MAAM,QAAQ,OAAgD;AAC5D,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,aAAa,KAAK,IAAI,EAAG,QAAO;AACzC,WAAO,KAAK;AAAA,EACd;AACF;;;AHgBA,SAAS,6BAA6B,QAAuC;AAC3E,MAAI,WAAW,OAAO;AACpB,WAAO,EAAE,SAAS,gBAAgB,UAAU,iBAAiB;AAAA,EAC/D;AACA,SAAO,EAAE,SAAS,gBAAgB,GAAG,OAAO;AAC9C;AAEA,SAAS,+BACP,QACU;AACV,MAAI,WAAW,aAAa;AAC1B,WAAO,EAAE,SAAS,mBAAmB,UAAU,wBAAwB;AAAA,EACzE;AACA,SAAO,EAAE,SAAS,mBAAmB,GAAG,OAAO;AACjD;AAGO,IAAM,aAAN,MAAiB;AAAA,EACtB,OAAO,QAAQ,UAA6B,CAAC,GAAkB;AAC7D,UAAM,wBAAwB;AAAA,MAC5B,QAAQ,iBAAiB;AAAA,IAC3B;AACA,UAAM,0BAA0B;AAAA,MAC9B,QAAQ,mBAAmB;AAAA,IAC7B;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,WAAW,CAAC,uBAAuB,uBAAuB;AAAA,MAC1D,SAAS,CAAC,gBAAgB,iBAAiB;AAAA,IAC7C;AAAA,EACF;AACF;AAhBa,aAAN;AAAA,EADN,OAAO,CAAC,CAAC;AAAA,GACG;","names":[]}
+{"version":3,"sources":["../../../../runtime/subsystems/auth/auth.module.ts","../../../../runtime/subsystems/auth/auth.tokens.ts","../../../../runtime/subsystems/auth/backends/encryption-key/env.ts","../../../../runtime/subsystems/auth/backends/state-store.memory-backend.ts","../../../../runtime/subsystems/auth/protocols/oauth-state-store.ts","../../../../runtime/subsystems/auth/backends/state-store.drizzle-backend.ts","../../../../runtime/subsystems/auth/auth-oauth-state.schema.ts","../../../../runtime/subsystems/auth/controllers/auth.controller.ts","../../../../runtime/constants/tokens.ts"],"sourcesContent":["/**\n * AuthModule — DynamicModule factory for the auth subsystem.\n *\n * Wires the pluggable backends the subsystem ships with:\n *   - `ENCRYPTION_KEY`      → `EnvEncryptionKey` (AES-256-GCM from env)\n *   - `OAUTH_STATE_STORE`   → `MemoryOAuthStateStore` (dev/tests) or\n *                             `DrizzleOAuthStateStore` (prod, requires\n *                             DRIZZLE provider).\n *   - `AUTH_OPTIONS`        → resolved options bag (used by AuthController\n *                             for `redirectUriBase`).\n *\n * The integration-store ports (`AUTH_INTEGRATION_READER`,\n * `AUTH_INTEGRATION_TOKEN_WRITER`, `AUTH_INTEGRATION_GRANT_SINK`),\n * `AUTH_USER_CONTEXT`, and `STRATEGY_REGISTRY` are deliberately **not**\n * wired here — they are always consumer-specific:\n *   - integration-store ports adapt the consumer's `integrations` storage;\n *   - `IUserContext` adapts the app's session/JWT scheme;\n *   - `STRATEGY_REGISTRY` is populated from the per-provider strategy\n *     classes the consumer maintains.\n *\n * Consumers provide them in their app module (or by importing the\n * `auth-integrations` starter, which binds the three integration-store\n * ports off a single canonical entity).\n *\n * Usage in AppModule:\n * ```typescript\n * AuthModule.forRoot({\n *   encryptionKey: 'env',\n *   oauthStateStore: 'memory',          // or 'drizzle'\n *   enableController: true,\n *   redirectUriBase: 'http://localhost:3000',\n * });\n * ```\n *\n * `global: true` means other modules don't need to re-import AuthModule to\n * inject the auth tokens.\n */\nimport { Module, type DynamicModule, type Provider } from '@nestjs/common';\nimport {\n  AUTH_OPTIONS,\n  ENCRYPTION_KEY,\n  OAUTH_STATE_STORE,\n} from './auth.tokens';\nimport { EnvEncryptionKey } from './backends/encryption-key/env';\nimport { MemoryOAuthStateStore } from './backends/state-store.memory-backend';\nimport { DrizzleOAuthStateStore } from './backends/state-store.drizzle-backend';\nimport { AuthController } from './controllers/auth.controller';\nimport { DRIZZLE } from '../../constants/tokens';\nimport type { DrizzleClient } from '../../types/drizzle';\n\ntype EncryptionKeyChoice =\n  | 'env'\n  | Omit<Provider, 'provide'>;\n\ntype OAuthStateStoreChoice =\n  | 'memory'\n  | 'drizzle'\n  | Omit<Provider, 'provide'>;\n\nexport interface AuthModuleOptions {\n  /** `'env'` (default) or a full provider definition (e.g. `{ useClass: MyKmsEncryptionKey }`). */\n  encryptionKey?: EncryptionKeyChoice;\n  /**\n   * `'memory'` (default — tests/dev) or `'drizzle'` (prod, requires DRIZZLE\n   * provider) or a full provider definition for a custom impl.\n   */\n  oauthStateStore?: OAuthStateStoreChoice;\n  /**\n   * Mount `AuthController` (`/auth/:provider/connect` + `/callback`).\n   * Default `false` — apps that hand-roll connect/callback (rare) or that\n   * use the subsystem only for the refresh path can opt out.\n   */\n  enableController?: boolean;\n  /**\n   * Public base URL of the API server. Used to construct per-provider\n   * callback URIs as `${redirectUriBase}/auth/:provider/callback`.\n   * Required when `enableController: true`.\n   */\n  redirectUriBase?: string;\n}\n\nfunction resolveEncryptionKeyProvider(choice: EncryptionKeyChoice): Provider {\n  if (choice === 'env') {\n    return { provide: ENCRYPTION_KEY, useClass: EnvEncryptionKey };\n  }\n  return { provide: ENCRYPTION_KEY, ...choice } as Provider;\n}\n\nfunction resolveOAuthStateStoreProvider(\n  choice: OAuthStateStoreChoice,\n): Provider {\n  if (choice === 'memory') {\n    return { provide: OAUTH_STATE_STORE, useClass: MemoryOAuthStateStore };\n  }\n  if (choice === 'drizzle') {\n    return {\n      provide: OAUTH_STATE_STORE,\n      useFactory: (db: DrizzleClient | null) => {\n        if (!db) {\n          throw new Error(\n            \"AuthModule.forRoot: oauthStateStore: 'drizzle' selected but DRIZZLE provider is not available. \" +\n              'Ensure DatabaseModule (or another provider exposing DRIZZLE) is imported before AuthModule.forRoot.',\n          );\n        }\n        return new DrizzleOAuthStateStore(db);\n      },\n      inject: [{ token: DRIZZLE, optional: true }],\n    };\n  }\n  return { provide: OAUTH_STATE_STORE, ...choice } as Provider;\n}\n\n@Module({})\nexport class AuthModule {\n  static forRoot(options: AuthModuleOptions = {}): DynamicModule {\n    const resolved: AuthModuleOptions = {\n      encryptionKey: options.encryptionKey ?? 'env',\n      oauthStateStore: options.oauthStateStore ?? 'memory',\n      enableController: options.enableController ?? false,\n      redirectUriBase: options.redirectUriBase,\n    };\n\n    if (resolved.enableController && !resolved.redirectUriBase) {\n      throw new Error(\n        'AuthModule.forRoot: redirectUriBase is required when enableController: true',\n      );\n    }\n\n    const encryptionKeyProvider = resolveEncryptionKeyProvider(\n      resolved.encryptionKey!,\n    );\n    const oauthStateStoreProvider = resolveOAuthStateStoreProvider(\n      resolved.oauthStateStore!,\n    );\n    const optionsProvider: Provider = {\n      provide: AUTH_OPTIONS,\n      useValue: resolved,\n    };\n\n    return {\n      module: AuthModule,\n      global: true,\n      providers: [encryptionKeyProvider, oauthStateStoreProvider, optionsProvider],\n      controllers: resolved.enableController ? [AuthController] : [],\n      exports: [ENCRYPTION_KEY, OAUTH_STATE_STORE, AUTH_OPTIONS],\n    };\n  }\n}\n","/**\n * Auth subsystem — injection tokens.\n *\n * Following ADR-008 guidance: `Symbol()` tokens for type safety and collision\n * avoidance. Consumers inject these via `@Inject(...)` against the matching\n * protocol interface.\n *\n * Usage:\n * ```typescript\n * constructor(\n *   @Inject(ENCRYPTION_KEY) private readonly key: IEncryptionKey,\n *   @Inject(OAUTH_STATE_STORE) private readonly states: IOAuthStateStore,\n *   @Inject(AUTH_INTEGRATION_READER) private readonly reader: IIntegrationReader,\n *   @Inject(AUTH_INTEGRATION_TOKEN_WRITER) private readonly writer: IIntegrationTokenWriter,\n *   @Inject(AUTH_INTEGRATION_GRANT_SINK) private readonly grants: IIntegrationGrantSink,\n *   @Inject(AUTH_USER_CONTEXT) private readonly userCtx: IUserContext,\n *   @Inject(STRATEGY_REGISTRY) private readonly registry: ProviderStrategyRegistry,\n * ) {}\n * ```\n *\n * `IAuthStrategy` implementations are provider-specific and registered under\n * provider-specific tokens (e.g. `SALESFORCE_AUTH_STRATEGY`,\n * `HUBSPOT_AUTH_STRATEGY`) by each integration module — this subsystem does\n * not mandate a single `AUTH_STRATEGY` token because an app typically has\n * many concurrent strategies, one per provider. They are dispatched through\n * `STRATEGY_REGISTRY` (a `ReadonlyMap<slug, ProviderStrategy>`), populated\n * by per-provider modules via a `useFactory` provider.\n */\nexport const ENCRYPTION_KEY = Symbol('ENCRYPTION_KEY');\nexport const OAUTH_STATE_STORE = Symbol('OAUTH_STATE_STORE');\nexport const AUTH_INTEGRATION_READER = Symbol('AUTH_INTEGRATION_READER');\nexport const AUTH_INTEGRATION_TOKEN_WRITER = Symbol('AUTH_INTEGRATION_TOKEN_WRITER');\nexport const AUTH_INTEGRATION_GRANT_SINK = Symbol('AUTH_INTEGRATION_GRANT_SINK');\nexport const AUTH_USER_CONTEXT = Symbol('AUTH_USER_CONTEXT');\nexport const STRATEGY_REGISTRY = Symbol('STRATEGY_REGISTRY');\n/**\n * Holds the resolved `AuthModuleOptions` (used by `AuthController` to read\n * `redirectUriBase` for building per-provider callback URIs).\n */\nexport const AUTH_OPTIONS = Symbol('AUTH_OPTIONS');\n","/**\n * Env-backed AES-256-GCM encryption.\n *\n * Framing: `base64( nonce(12B) || ciphertext || authTag(16B) )`. Random nonce\n * per call means two encryptions of the same plaintext produce different\n * ciphertexts — prevents replay-style inference. Auth tag enforces integrity;\n * any tampering throws on decrypt.\n *\n * Key source: `TOKEN_ENCRYPTION_KEY` env var, 32 bytes base64-encoded.\n * Generate via `openssl rand -base64 32`.\n *\n * Future backend: `kms.ts` (AWS/GCP KMS) for production deployments that\n * need key rotation + audit trails.\n */\nimport { createCipheriv, createDecipheriv, randomBytes } from 'node:crypto';\nimport type { IEncryptionKey } from '../../protocols/encryption-key';\n\nexport interface EnvEncryptionKeyOptions {\n  /** Defaults to `process.env`. Tests inject a fixture. */\n  env?: NodeJS.ProcessEnv;\n  /** Defaults to `'TOKEN_ENCRYPTION_KEY'`. */\n  envVar?: string;\n}\n\nconst ALGO = 'aes-256-gcm';\nconst NONCE_BYTES = 12;\nconst TAG_BYTES = 16;\nconst KEY_BYTES = 32;\n\nexport class EnvEncryptionKey implements IEncryptionKey {\n  private readonly key: Buffer;\n\n  constructor(opts: EnvEncryptionKeyOptions = {}) {\n    const env = opts.env ?? process.env;\n    const envVar = opts.envVar ?? 'TOKEN_ENCRYPTION_KEY';\n    const raw = env[envVar];\n    if (!raw) {\n      throw new Error(\n        `EnvEncryptionKey: ${envVar} is not set. Generate with: openssl rand -base64 32`,\n      );\n    }\n    const decoded = Buffer.from(raw, 'base64');\n    if (decoded.length !== KEY_BYTES) {\n      throw new Error(\n        `EnvEncryptionKey: ${envVar} must decode to ${KEY_BYTES} bytes (got ${decoded.length}). Use: openssl rand -base64 32`,\n      );\n    }\n    this.key = decoded;\n  }\n\n  async encrypt(plaintext: string): Promise<string> {\n    const nonce = randomBytes(NONCE_BYTES);\n    const cipher = createCipheriv(ALGO, this.key, nonce);\n    const ciphertext = Buffer.concat([\n      cipher.update(plaintext, 'utf8'),\n      cipher.final(),\n    ]);\n    const authTag = cipher.getAuthTag();\n    return Buffer.concat([nonce, ciphertext, authTag]).toString('base64');\n  }\n\n  async decrypt(ciphertext: string): Promise<string> {\n    const buf = Buffer.from(ciphertext, 'base64');\n    if (buf.length < NONCE_BYTES + TAG_BYTES) {\n      throw new Error('EnvEncryptionKey: ciphertext too short');\n    }\n    const nonce = buf.subarray(0, NONCE_BYTES);\n    const authTag = buf.subarray(buf.length - TAG_BYTES);\n    const body = buf.subarray(NONCE_BYTES, buf.length - TAG_BYTES);\n\n    const decipher = createDecipheriv(ALGO, this.key, nonce);\n    decipher.setAuthTag(authTag);\n    const plain = Buffer.concat([decipher.update(body), decipher.final()]);\n    return plain.toString('utf8');\n  }\n}\n","/**\n * In-memory `IOAuthStateStore` backend.\n *\n * Single-process store — Map<state, { record, expiresAt }>. Suitable for\n * tests and single-worker dev. Production deployments select the drizzle\n * backend so state survives restarts and is shared across workers.\n *\n * Single-use semantics:\n *   - `generate(record)` mints a 256-bit random token (base64url, opaque).\n *   - `consume(state)` deletes the entry on read. A second call with the\n *     same state throws `OAuthStateError('replay')`.\n *   - Expired entries also throw (`'expired'`); the entry is deleted as a\n *     side effect so a later replay still surfaces correctly.\n *\n * TTL defaults to 10 minutes — long enough for a user to complete the\n * provider's consent screen, short enough that abandoned states age out.\n */\nimport { randomBytes } from 'node:crypto';\nimport {\n  type IOAuthStateStore,\n  type OAuthStateRecord,\n  OAuthStateError,\n} from '../protocols/oauth-state-store';\n\nexport interface MemoryOAuthStateStoreOptions {\n  /** TTL in ms. Default 10 minutes. */\n  ttlMs?: number;\n  /** Injectable clock for tests. Default `Date.now`. */\n  now?: () => number;\n  /** Injectable token generator for tests. Default 32-byte base64url. */\n  generateToken?: () => string;\n}\n\ninterface Slot {\n  record: OAuthStateRecord;\n  expiresAt: number;\n}\n\nexport class MemoryOAuthStateStore implements IOAuthStateStore {\n  private readonly store = new Map<string, Slot>();\n  private readonly ttlMs: number;\n  private readonly now: () => number;\n  private readonly generateToken: () => string;\n\n  constructor(opts: MemoryOAuthStateStoreOptions = {}) {\n    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1000;\n    this.now = opts.now ?? (() => Date.now());\n    this.generateToken =\n      opts.generateToken ?? (() => randomBytes(32).toString('base64url'));\n  }\n\n  async generate(record: OAuthStateRecord): Promise<string> {\n    const state = this.generateToken();\n    this.store.set(state, {\n      record: { ...record },\n      expiresAt: this.now() + this.ttlMs,\n    });\n    return state;\n  }\n\n  async consume(state: string): Promise<OAuthStateRecord> {\n    const slot = this.store.get(state);\n    if (!slot) {\n      throw new OAuthStateError(\n        `OAuth state token unknown or already consumed`,\n        'missing',\n      );\n    }\n    // Delete first so a concurrent consume can't replay.\n    this.store.delete(state);\n    if (slot.expiresAt <= this.now()) {\n      throw new OAuthStateError(`OAuth state token expired`, 'expired');\n    }\n    return slot.record;\n  }\n}\n","/**\n * Auth subsystem — `IOAuthStateStore` port.\n *\n * CSRF protection for the OAuth2 authorize-code callback. Generic across\n * providers. The store mints opaque state tokens at /connect time and\n * single-use consumes them at /callback time, returning the original\n * record (userId + optional post-callback redirect path).\n *\n * Concrete backends live under `../backends/`:\n *   - `state-store.memory-backend.ts` — in-process Map (tests/dev).\n *   - `state-store.drizzle-backend.ts` — Postgres (prod).\n *\n * Semantics:\n *   - `generate(record)` → returns an opaque state token; record is stored\n *     under that token until consumed or until TTL expires.\n *   - `consume(state)`   → atomically deletes the entry and returns the\n *     record. Throws on missing, expired, or replayed state. Never returns\n *     null — a missing/expired state is a CSRF signal.\n */\nexport interface OAuthStateRecord {\n  userId: string;\n  /** Optional post-callback redirect path (relative URL). */\n  redirect?: string;\n}\n\nexport interface IOAuthStateStore {\n  /** Mint an opaque state token bound to `record`. Single-use. */\n  generate(record: OAuthStateRecord): Promise<string>;\n  /**\n   * Atomically consume `state`, returning the bound record. Throws on\n   * missing / expired / replayed state.\n   */\n  consume(state: string): Promise<OAuthStateRecord>;\n}\n\n/**\n * Thrown by `IOAuthStateStore.consume` when the state token is unknown,\n * expired, or has already been consumed (replay attempt).\n */\nexport class OAuthStateError extends Error {\n  constructor(\n    message: string,\n    public readonly reason: 'missing' | 'expired',\n  ) {\n    super(message);\n    this.name = 'OAuthStateError';\n  }\n}\n","/**\n * Drizzle-backed `IOAuthStateStore`.\n *\n * Uses the `auth_oauth_state` table (see `auth-oauth-state.schema.ts`).\n * Single-use semantics enforced via `DELETE ... RETURNING`: the consume\n * path atomically deletes and returns the row, so a concurrent /callback\n * with the same state cannot replay.\n *\n * Behaviour:\n *   - `generate(record)` mints a 256-bit base64url token, INSERTs the row\n *     with `expires_at = now() + ttlMs`.\n *   - `consume(state)` runs `DELETE ... WHERE state = $1 RETURNING ...`\n *     once. Throws `OAuthStateError('missing')` if no row was deleted\n *     (unknown or already consumed) and `OAuthStateError('expired')` if\n *     the deleted row was past its `expires_at`.\n */\nimport { randomBytes } from 'node:crypto';\nimport { eq } from 'drizzle-orm';\nimport type { DrizzleClient } from '../../../types/drizzle';\nimport { authOAuthState } from '../auth-oauth-state.schema';\nimport {\n  type IOAuthStateStore,\n  type OAuthStateRecord,\n  OAuthStateError,\n} from '../protocols/oauth-state-store';\n\nexport interface DrizzleOAuthStateStoreOptions {\n  /** TTL in ms. Default 10 minutes. */\n  ttlMs?: number;\n  /** Injectable clock for tests. Default `Date.now`. */\n  now?: () => number;\n  /** Injectable token generator for tests. Default 32-byte base64url. */\n  generateToken?: () => string;\n}\n\nexport class DrizzleOAuthStateStore implements IOAuthStateStore {\n  private readonly ttlMs: number;\n  private readonly now: () => number;\n  private readonly generateToken: () => string;\n\n  constructor(\n    private readonly db: DrizzleClient,\n    opts: DrizzleOAuthStateStoreOptions = {},\n  ) {\n    this.ttlMs = opts.ttlMs ?? 10 * 60 * 1000;\n    this.now = opts.now ?? (() => Date.now());\n    this.generateToken =\n      opts.generateToken ?? (() => randomBytes(32).toString('base64url'));\n  }\n\n  async generate(record: OAuthStateRecord): Promise<string> {\n    const state = this.generateToken();\n    const expiresAt = new Date(this.now() + this.ttlMs);\n    await this.db.insert(authOAuthState).values({\n      state,\n      userId: record.userId,\n      redirect: record.redirect ?? null,\n      expiresAt,\n    });\n    return state;\n  }\n\n  async consume(state: string): Promise<OAuthStateRecord> {\n    const rows = await this.db\n      .delete(authOAuthState)\n      .where(eq(authOAuthState.state, state))\n      .returning();\n    const row = rows[0];\n    if (!row) {\n      throw new OAuthStateError(\n        `OAuth state token unknown or already consumed`,\n        'missing',\n      );\n    }\n    if (row.expiresAt.getTime() <= this.now()) {\n      throw new OAuthStateError(`OAuth state token expired`, 'expired');\n    }\n    return {\n      userId: row.userId,\n      redirect: row.redirect ?? undefined,\n    };\n  }\n}\n","/**\n * Drizzle schema for the `auth_oauth_state` table — backs the\n * `DrizzleOAuthStateStore` (`state-store.drizzle-backend.ts`).\n *\n * One row per outstanding /connect → /callback dance. Single-use; rows are\n * deleted on consume. A periodic sweep (or a `WHERE expires_at < now()`\n * filter on read) clears abandoned rows.\n *\n * Columns:\n *   - `state`       — opaque random token, primary key.\n *   - `user_id`     — text (matches the consumer-defined user-id shape;\n *                     the auth subsystem doesn't constrain this to UUID\n *                     because some apps key users by external id).\n *   - `redirect`    — optional post-callback redirect path.\n *   - `expires_at`  — TTL boundary; entries past this are treated as absent.\n *\n * Convention: schema files live at the root of the subsystem dir\n * (mirrors `cache.schema.ts`, `sync-audit.schema.ts`, `domain-events.schema.ts`).\n */\nimport { pgTable, text, timestamp } from 'drizzle-orm/pg-core';\nimport type { InferSelectModel } from 'drizzle-orm';\n\nexport const authOAuthState = pgTable('auth_oauth_state', {\n  state: text('state').primaryKey(),\n  userId: text('user_id').notNull(),\n  redirect: text('redirect'),\n  expiresAt: timestamp('expires_at', { withTimezone: true }).notNull(),\n});\n\nexport type AuthOAuthState = InferSelectModel<typeof authOAuthState>;\n","/**\n * AuthController — provider-agnostic OAuth2 connect/callback dance.\n *\n * Mounts two routes:\n *   - `GET /auth/:provider/connect?redirect=...` — generates state, builds\n *     the provider's authorize-url, 302-redirects the browser there.\n *   - `GET /auth/:provider/callback?code=...&state=...` — consumes state,\n *     exchanges the code for tokens, hands them to the grant sink, then\n *     302-redirects to the post-connect path.\n *\n * Hexagonal seams:\n *   - `STRATEGY_REGISTRY` (ReadonlyMap<slug, ProviderStrategy>) — dispatch.\n *     Concrete per-provider strategies live consumer-side and contribute\n *     entries via a `useFactory` in the consumer's app module.\n *   - `AUTH_USER_CONTEXT` (IUserContext) — resolves \"who is this request\"\n *     from the consumer's session/JWT/etc.\n *   - `OAUTH_STATE_STORE` (IOAuthStateStore) — CSRF state minting/consume.\n *   - `AUTH_INTEGRATION_GRANT_SINK` (IIntegrationGrantSink) — persists the\n *     freshly-minted grant. Adapter lives consumer-side (e.g. the\n *     auth-integrations starter from #285).\n *\n * The controller never imports `IntegrationsService` or any other concrete\n * consumer type — it goes through ports only.\n */\nimport {\n  Controller,\n  Get,\n  Inject,\n  Param,\n  Query,\n  Req,\n  Res,\n  HttpException,\n  HttpStatus,\n} from '@nestjs/common';\nimport {\n  AUTH_INTEGRATION_GRANT_SINK,\n  AUTH_OPTIONS,\n  AUTH_USER_CONTEXT,\n  OAUTH_STATE_STORE,\n  STRATEGY_REGISTRY,\n} from '../auth.tokens';\nimport type { AuthModuleOptions } from '../auth.module';\nimport type { IOAuthStateStore } from '../protocols/oauth-state-store';\nimport type { IUserContext } from '../protocols/user-context';\nimport type {\n  ProviderStrategy,\n  ProviderStrategyRegistry,\n} from '../protocols/provider-strategy';\nimport type { IIntegrationGrantSink } from '../protocols/integration-store';\n\n/**\n * Minimal response surface used by the controller — typed loosely so we\n * don't pull a hard dep on `express` or `fastify`. Both popular HTTP\n * adapters expose `redirect(status, url)`.\n */\ninterface RedirectingResponse {\n  redirect(statusCode: number, url: string): unknown;\n}\n\n@Controller('auth')\nexport class AuthController {\n  constructor(\n    @Inject(STRATEGY_REGISTRY)\n    private readonly registry: ProviderStrategyRegistry,\n    @Inject(AUTH_USER_CONTEXT)\n    private readonly userContext: IUserContext,\n    @Inject(OAUTH_STATE_STORE)\n    private readonly stateStore: IOAuthStateStore,\n    @Inject(AUTH_INTEGRATION_GRANT_SINK)\n    private readonly grantSink: IIntegrationGrantSink,\n    @Inject(AUTH_OPTIONS)\n    private readonly options: AuthModuleOptions,\n  ) {}\n\n  @Get(':provider/connect')\n  async connect(\n    @Param('provider') slug: string,\n    @Query('redirect') redirect: string | undefined,\n    @Req() req: unknown,\n    @Res() res: RedirectingResponse,\n  ): Promise<unknown> {\n    const strategy = this.requireStrategy(slug);\n    const userId = await this.userContext.getCurrentUserId(req);\n    const state = await this.stateStore.generate({ userId, redirect });\n    const url = strategy.buildAuthorizeUrl({\n      state,\n      redirectUri: this.redirectUriFor(slug),\n    });\n    return res.redirect(HttpStatus.FOUND, url);\n  }\n\n  @Get(':provider/callback')\n  async callback(\n    @Param('provider') slug: string,\n    @Query('code') code: string | undefined,\n    @Query('state') state: string | undefined,\n    @Res() res: RedirectingResponse,\n  ): Promise<unknown> {\n    const strategy = this.requireStrategy(slug);\n    if (!code) {\n      throw new HttpException(\n        `Missing 'code' query param`,\n        HttpStatus.BAD_REQUEST,\n      );\n    }\n    if (!state) {\n      throw new HttpException(\n        `Missing 'state' query param`,\n        HttpStatus.BAD_REQUEST,\n      );\n    }\n    const { userId, redirect } = await this.stateStore.consume(state);\n    const tokens = await strategy.exchangeCodeForTokens({\n      code,\n      redirectUri: this.redirectUriFor(slug),\n    });\n    await this.grantSink.createOrUpdateFromOAuthGrant({\n      userId,\n      provider: slug,\n      accessToken: tokens.accessToken,\n      refreshToken: tokens.refreshToken,\n      expiresAt: tokens.expiresAt,\n      scope: tokens.scope,\n      externalAccountId: tokens.externalAccountId,\n      providerMetadata: tokens.providerMetadata,\n    });\n    return res.redirect(\n      HttpStatus.FOUND,\n      redirect ?? `/settings/integrations?connected=${encodeURIComponent(slug)}`,\n    );\n  }\n\n  private requireStrategy(slug: string): ProviderStrategy {\n    const strategy = this.registry.get(slug);\n    if (!strategy) {\n      throw new HttpException(\n        `Unknown provider '${slug}'`,\n        HttpStatus.NOT_FOUND,\n      );\n    }\n    return strategy;\n  }\n\n  private redirectUriFor(slug: string): string {\n    const base = this.options.redirectUriBase;\n    if (!base) {\n      throw new Error(\n        `AuthModule.forRoot: redirectUriBase is required when AuthController is enabled`,\n      );\n    }\n    const trimmed = base.replace(/\\/+$/, '');\n    return `${trimmed}/auth/${encodeURIComponent(slug)}/callback`;\n  }\n}\n","/**\n * NestJS injection tokens\n *\n * Used with @Inject() decorator in concrete repository constructors.\n */\n\n/**\n * Injection token for the Drizzle ORM database client.\n *\n * Usage in concrete repositories:\n * ```typescript\n * constructor(@Inject(DRIZZLE) db: DrizzleClient) { super(db); }\n * ```\n */\nexport const DRIZZLE = 'DRIZZLE' as const;\n\n/**\n * Injection token for the event bus (IEventBus).\n *\n * Optional — only resolved when EventsModule.forRoot() is registered.\n * BaseService uses this with @Optional() to emit lifecycle events\n * without requiring the events subsystem to be installed.\n *\n * Usage in services/use cases:\n * ```typescript\n * @Optional() @Inject(EVENT_BUS) eventBus?: IEventBus\n * ```\n */\nexport const EVENT_BUS = 'EVENT_BUS' as const;\n"],"mappings":";;;;;;;;;;;;;AAqCA,SAAS,cAAiD;;;ACTnD,IAAM,iBAAiB,uBAAO,gBAAgB;AAC9C,IAAM,oBAAoB,uBAAO,mBAAmB;AAGpD,IAAM,8BAA8B,uBAAO,6BAA6B;AACxE,IAAM,oBAAoB,uBAAO,mBAAmB;AACpD,IAAM,oBAAoB,uBAAO,mBAAmB;AAKpD,IAAM,eAAe,uBAAO,cAAc;;;ACzBjD,SAAS,gBAAgB,kBAAkB,mBAAmB;AAU9D,IAAM,OAAO;AACb,IAAM,cAAc;AACpB,IAAM,YAAY;AAClB,IAAM,YAAY;AAEX,IAAM,mBAAN,MAAiD;AAAA,EACrC;AAAA,EAEjB,YAAY,OAAgC,CAAC,GAAG;AAC9C,UAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,UAAM,SAAS,KAAK,UAAU;AAC9B,UAAM,MAAM,IAAI,MAAM;AACtB,QAAI,CAAC,KAAK;AACR,YAAM,IAAI;AAAA,QACR,qBAAqB,MAAM;AAAA,MAC7B;AAAA,IACF;AACA,UAAM,UAAU,OAAO,KAAK,KAAK,QAAQ;AACzC,QAAI,QAAQ,WAAW,WAAW;AAChC,YAAM,IAAI;AAAA,QACR,qBAAqB,MAAM,mBAAmB,SAAS,eAAe,QAAQ,MAAM;AAAA,MACtF;AAAA,IACF;AACA,SAAK,MAAM;AAAA,EACb;AAAA,EAEA,MAAM,QAAQ,WAAoC;AAChD,UAAM,QAAQ,YAAY,WAAW;AACrC,UAAM,SAAS,eAAe,MAAM,KAAK,KAAK,KAAK;AACnD,UAAM,aAAa,OAAO,OAAO;AAAA,MAC/B,OAAO,OAAO,WAAW,MAAM;AAAA,MAC/B,OAAO,MAAM;AAAA,IACf,CAAC;AACD,UAAM,UAAU,OAAO,WAAW;AAClC,WAAO,OAAO,OAAO,CAAC,OAAO,YAAY,OAAO,CAAC,EAAE,SAAS,QAAQ;AAAA,EACtE;AAAA,EAEA,MAAM,QAAQ,YAAqC;AACjD,UAAM,MAAM,OAAO,KAAK,YAAY,QAAQ;AAC5C,QAAI,IAAI,SAAS,cAAc,WAAW;AACxC,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,UAAM,QAAQ,IAAI,SAAS,GAAG,WAAW;AACzC,UAAM,UAAU,IAAI,SAAS,IAAI,SAAS,SAAS;AACnD,UAAM,OAAO,IAAI,SAAS,aAAa,IAAI,SAAS,SAAS;AAE7D,UAAM,WAAW,iBAAiB,MAAM,KAAK,KAAK,KAAK;AACvD,aAAS,WAAW,OAAO;AAC3B,UAAM,QAAQ,OAAO,OAAO,CAAC,SAAS,OAAO,IAAI,GAAG,SAAS,MAAM,CAAC,CAAC;AACrE,WAAO,MAAM,SAAS,MAAM;AAAA,EAC9B;AACF;;;AC1DA,SAAS,eAAAA,oBAAmB;;;ACsBrB,IAAM,kBAAN,cAA8B,MAAM;AAAA,EACzC,YACE,SACgB,QAChB;AACA,UAAM,OAAO;AAFG;AAGhB,SAAK,OAAO;AAAA,EACd;AAAA,EAJkB;AAKpB;;;ADTO,IAAM,wBAAN,MAAwD;AAAA,EAC5C,QAAQ,oBAAI,IAAkB;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EAEjB,YAAY,OAAqC,CAAC,GAAG;AACnD,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACvC,SAAK,gBACH,KAAK,kBAAkB,MAAMC,aAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EACrE;AAAA,EAEA,MAAM,SAAS,QAA2C;AACxD,UAAM,QAAQ,KAAK,cAAc;AACjC,SAAK,MAAM,IAAI,OAAO;AAAA,MACpB,QAAQ,EAAE,GAAG,OAAO;AAAA,MACpB,WAAW,KAAK,IAAI,IAAI,KAAK;AAAA,IAC/B,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,OAA0C;AACtD,UAAM,OAAO,KAAK,MAAM,IAAI,KAAK;AACjC,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,MAAM,OAAO,KAAK;AACvB,QAAI,KAAK,aAAa,KAAK,IAAI,GAAG;AAChC,YAAM,IAAI,gBAAgB,6BAA6B,SAAS;AAAA,IAClE;AACA,WAAO,KAAK;AAAA,EACd;AACF;;;AE3DA,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,UAAU;;;ACEnB,SAAS,SAAS,MAAM,iBAAiB;AAGlC,IAAM,iBAAiB,QAAQ,oBAAoB;AAAA,EACxD,OAAO,KAAK,OAAO,EAAE,WAAW;AAAA,EAChC,QAAQ,KAAK,SAAS,EAAE,QAAQ;AAAA,EAChC,UAAU,KAAK,UAAU;AAAA,EACzB,WAAW,UAAU,cAAc,EAAE,cAAc,KAAK,CAAC,EAAE,QAAQ;AACrE,CAAC;;;ADQM,IAAM,yBAAN,MAAyD;AAAA,EAK9D,YACmB,IACjB,OAAsC,CAAC,GACvC;AAFiB;AAGjB,SAAK,QAAQ,KAAK,SAAS,KAAK,KAAK;AACrC,SAAK,MAAM,KAAK,QAAQ,MAAM,KAAK,IAAI;AACvC,SAAK,gBACH,KAAK,kBAAkB,MAAMC,aAAY,EAAE,EAAE,SAAS,WAAW;AAAA,EACrE;AAAA,EAPmB;AAAA,EALF;AAAA,EACA;AAAA,EACA;AAAA,EAYjB,MAAM,SAAS,QAA2C;AACxD,UAAM,QAAQ,KAAK,cAAc;AACjC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK;AAClD,UAAM,KAAK,GAAG,OAAO,cAAc,EAAE,OAAO;AAAA,MAC1C;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO,YAAY;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,QAAQ,OAA0C;AACtD,UAAM,OAAO,MAAM,KAAK,GACrB,OAAO,cAAc,EACrB,MAAM,GAAG,eAAe,OAAO,KAAK,CAAC,EACrC,UAAU;AACb,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,KAAK;AACR,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,QAAI,IAAI,UAAU,QAAQ,KAAK,KAAK,IAAI,GAAG;AACzC,YAAM,IAAI,gBAAgB,6BAA6B,SAAS;AAAA,IAClE;AACA,WAAO;AAAA,MACL,QAAQ,IAAI;AAAA,MACZ,UAAU,IAAI,YAAY;AAAA,IAC5B;AAAA,EACF;AACF;;;AE1DA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA2BA,IAAM,iBAAN,MAAqB;AAAA,EAC1B,YAEmB,UAEA,aAEA,YAEA,WAEA,SACjB;AATiB;AAEA;AAEA;AAEA;AAEA;AAAA,EAChB;AAAA,EATgB;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAEA;AAAA,EAInB,MAAM,QACe,MACA,UACZ,KACA,KACW;AAClB,UAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,UAAM,SAAS,MAAM,KAAK,YAAY,iBAAiB,GAAG;AAC1D,UAAM,QAAQ,MAAM,KAAK,WAAW,SAAS,EAAE,QAAQ,SAAS,CAAC;AACjE,UAAM,MAAM,SAAS,kBAAkB;AAAA,MACrC;AAAA,MACA,aAAa,KAAK,eAAe,IAAI;AAAA,IACvC,CAAC;AACD,WAAO,IAAI,SAAS,WAAW,OAAO,GAAG;AAAA,EAC3C;AAAA,EAGA,MAAM,SACe,MACJ,MACC,OACT,KACW;AAClB,UAAM,WAAW,KAAK,gBAAgB,IAAI;AAC1C,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AACA,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR;AAAA,QACA,WAAW;AAAA,MACb;AAAA,IACF;AACA,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,KAAK,WAAW,QAAQ,KAAK;AAChE,UAAM,SAAS,MAAM,SAAS,sBAAsB;AAAA,MAClD;AAAA,MACA,aAAa,KAAK,eAAe,IAAI;AAAA,IACvC,CAAC;AACD,UAAM,KAAK,UAAU,6BAA6B;AAAA,MAChD;AAAA,MACA,UAAU;AAAA,MACV,aAAa,OAAO;AAAA,MACpB,cAAc,OAAO;AAAA,MACrB,WAAW,OAAO;AAAA,MAClB,OAAO,OAAO;AAAA,MACd,mBAAmB,OAAO;AAAA,MAC1B,kBAAkB,OAAO;AAAA,IAC3B,CAAC;AACD,WAAO,IAAI;AAAA,MACT,WAAW;AAAA,MACX,YAAY,oCAAoC,mBAAmB,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAAA,EAEQ,gBAAgB,MAAgC;AACtD,UAAM,WAAW,KAAK,SAAS,IAAI,IAAI;AACvC,QAAI,CAAC,UAAU;AACb,YAAM,IAAI;AAAA,QACR,qBAAqB,IAAI;AAAA,QACzB,WAAW;AAAA,MACb;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,eAAe,MAAsB;AAC3C,UAAM,OAAO,KAAK,QAAQ;AAC1B,QAAI,CAAC,MAAM;AACT,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,UAAM,UAAU,KAAK,QAAQ,QAAQ,EAAE;AACvC,WAAO,GAAG,OAAO,SAAS,mBAAmB,IAAI,CAAC;AAAA,EACpD;AACF;AA9EQ;AAAA,EADL,IAAI,mBAAmB;AAAA,EAErB,yBAAM,UAAU;AAAA,EAChB,yBAAM,UAAU;AAAA,EAChB,uBAAI;AAAA,EACJ,uBAAI;AAAA,GAnBI,eAeL;AAiBA;AAAA,EADL,IAAI,oBAAoB;AAAA,EAEtB,yBAAM,UAAU;AAAA,EAChB,yBAAM,MAAM;AAAA,EACZ,yBAAM,OAAO;AAAA,EACb,uBAAI;AAAA,GApCI,eAgCL;AAhCK,iBAAN;AAAA,EADN,WAAW,MAAM;AAAA,EAGb,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,iBAAiB;AAAA,EAExB,0BAAO,2BAA2B;AAAA,EAElC,0BAAO,YAAY;AAAA,GAVX;;;AC/CN,IAAM,UAAU;;;ARmEvB,SAAS,6BAA6B,QAAuC;AAC3E,MAAI,WAAW,OAAO;AACpB,WAAO,EAAE,SAAS,gBAAgB,UAAU,iBAAiB;AAAA,EAC/D;AACA,SAAO,EAAE,SAAS,gBAAgB,GAAG,OAAO;AAC9C;AAEA,SAAS,+BACP,QACU;AACV,MAAI,WAAW,UAAU;AACvB,WAAO,EAAE,SAAS,mBAAmB,UAAU,sBAAsB;AAAA,EACvE;AACA,MAAI,WAAW,WAAW;AACxB,WAAO;AAAA,MACL,SAAS;AAAA,MACT,YAAY,CAAC,OAA6B;AACxC,YAAI,CAAC,IAAI;AACP,gBAAM,IAAI;AAAA,YACR;AAAA,UAEF;AAAA,QACF;AACA,eAAO,IAAI,uBAAuB,EAAE;AAAA,MACtC;AAAA,MACA,QAAQ,CAAC,EAAE,OAAO,SAAS,UAAU,KAAK,CAAC;AAAA,IAC7C;AAAA,EACF;AACA,SAAO,EAAE,SAAS,mBAAmB,GAAG,OAAO;AACjD;AAGO,IAAM,aAAN,MAAiB;AAAA,EACtB,OAAO,QAAQ,UAA6B,CAAC,GAAkB;AAC7D,UAAM,WAA8B;AAAA,MAClC,eAAe,QAAQ,iBAAiB;AAAA,MACxC,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,iBAAiB,QAAQ;AAAA,IAC3B;AAEA,QAAI,SAAS,oBAAoB,CAAC,SAAS,iBAAiB;AAC1D,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,UAAM,wBAAwB;AAAA,MAC5B,SAAS;AAAA,IACX;AACA,UAAM,0BAA0B;AAAA,MAC9B,SAAS;AAAA,IACX;AACA,UAAM,kBAA4B;AAAA,MAChC,SAAS;AAAA,MACT,UAAU;AAAA,IACZ;AAEA,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,QAAQ;AAAA,MACR,WAAW,CAAC,uBAAuB,yBAAyB,eAAe;AAAA,MAC3E,aAAa,SAAS,mBAAmB,CAAC,cAAc,IAAI,CAAC;AAAA,MAC7D,SAAS,CAAC,gBAAgB,mBAAmB,YAAY;AAAA,IAC3D;AAAA,EACF;AACF;AAlCa,aAAN;AAAA,EADN,OAAO,CAAC,CAAC;AAAA,GACG;","names":["randomBytes","randomBytes","randomBytes","randomBytes"]}