@prenta/core 0.118.0

package/dist/auth/providers/github.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.js","sourceRoot":"","sources":["../../../src/auth/providers/github.ts"],"names":[],"mappings":"AAQA,oDAAoD;AACpD,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAA;AACH,CAAC"}

package/dist/auth/providers/google.d.ts

@@ -0,0 +1,9 @@
+import type { AuthProviderConfig } from '../../config/types.js';
+export interface GoogleProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    allowedDomains?: string[];
+}
+/** Create a Google OAuth provider configuration. */
+export declare function googleProvider(options: GoogleProviderOptions): AuthProviderConfig;
+//# sourceMappingURL=google.d.ts.map

package/dist/auth/providers/google.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/google.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE/D,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,oDAAoD;AACpD,wBAAgB,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,kBAAkB,CAOjF"}

package/dist/auth/providers/google.js

@@ -0,0 +1,10 @@
+/** Create a Google OAuth provider configuration. */
+export function googleProvider(options) {
+    return {
+        id: 'google',
+        type: 'google',
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+    };
+}
+//# sourceMappingURL=google.js.map

package/dist/auth/providers/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../src/auth/providers/google.ts"],"names":[],"mappings":"AAQA,oDAAoD;AACpD,MAAM,UAAU,cAAc,CAAC,OAA8B;IAC3D,OAAO;QACL,EAAE,EAAE,QAAQ;QACZ,IAAI,EAAE,QAAQ;QACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;KACnC,CAAA;AACH,CAAC"}

package/dist/auth/providers/microsoft.d.ts

@@ -0,0 +1,9 @@
+import type { AuthProviderConfig } from '../../config/types.js';
+export interface MicrosoftProviderOptions {
+    clientId: string;
+    clientSecret: string;
+    tenantId?: string;
+}
+/** Create a Microsoft Entra ID (Azure AD) OAuth provider configuration. */
+export declare function microsoftProvider(options: MicrosoftProviderOptions): AuthProviderConfig;
+//# sourceMappingURL=microsoft.d.ts.map

package/dist/auth/providers/microsoft.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.d.ts","sourceRoot":"","sources":["../../../src/auth/providers/microsoft.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAA;AAE/D,MAAM,WAAW,wBAAwB;IACvC,QAAQ,EAAE,MAAM,CAAA;IAChB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,wBAAwB,GAAG,kBAAkB,CAQvF"}

package/dist/auth/providers/microsoft.js

@@ -0,0 +1,11 @@
+/** Create a Microsoft Entra ID (Azure AD) OAuth provider configuration. */
+export function microsoftProvider(options) {
+    return {
+        id: 'microsoft',
+        type: 'microsoft',
+        clientId: options.clientId,
+        clientSecret: options.clientSecret,
+        tenantId: options.tenantId,
+    };
+}
+//# sourceMappingURL=microsoft.js.map

package/dist/auth/providers/microsoft.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.js","sourceRoot":"","sources":["../../../src/auth/providers/microsoft.ts"],"names":[],"mappings":"AAQA,2EAA2E;AAC3E,MAAM,UAAU,iBAAiB,CAAC,OAAiC;IACjE,OAAO;QACL,EAAE,EAAE,WAAW;QACf,IAAI,EAAE,WAAW;QACjB,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,QAAQ,EAAE,OAAO,CAAC,QAAQ;KAC3B,CAAA;AACH,CAAC"}

package/dist/auth/reset-email.d.ts

@@ -0,0 +1,10 @@
+/** Generates a password reset email with a one-click reset link. */
+export declare function passwordResetTemplate(args: {
+    resetUrl: string;
+    userName: string;
+}): {
+    subject: string;
+    html: string;
+    text: string;
+};
+//# sourceMappingURL=reset-email.d.ts.map

package/dist/auth/reset-email.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-email.d.ts","sourceRoot":"","sources":["../../src/auth/reset-email.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,GAAG;IACnF,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;CACb,CA2BA"}

package/dist/auth/reset-email.js

@@ -0,0 +1,30 @@
+/** Generates a password reset email with a one-click reset link. */
+export function passwordResetTemplate(args) {
+    return {
+        subject: 'Reset your password',
+        html: `<!DOCTYPE html>
+<html>
+<head><meta charset="utf-8"></head>
+<body style="margin:0;padding:0;font-family:-apple-system,BlinkMacSystemFont,'Segoe UI',Roboto,sans-serif;background:#f9fafb;">
+  <table width="100%" cellpadding="0" cellspacing="0" style="max-width:560px;margin:40px auto;background:#fff;border-radius:8px;border:1px solid #e5e7eb;">
+    <tr>
+      <td style="padding:32px;">
+        <h1 style="margin:0 0 16px;font-size:20px;color:#111827;">Reset your password</h1>
+        <p style="margin:0 0 24px;font-size:15px;line-height:1.6;color:#374151;">
+          Hi ${args.userName}, we received a request to reset your password. Click the button below to choose a new one.
+        </p>
+        <a href="${args.resetUrl}" style="display:inline-block;padding:12px 24px;background:#3b82f6;color:#fff;text-decoration:none;border-radius:6px;font-weight:600;font-size:14px;">
+          Reset Password
+        </a>
+        <p style="margin:24px 0 0;font-size:13px;color:#9ca3af;">
+          If you didn't request this, you can safely ignore this email. This link expires in 1 hour.
+        </p>
+      </td>
+    </tr>
+  </table>
+</body>
+</html>`,
+        text: `Hi ${args.userName},\n\nWe received a request to reset your password. Visit the link below to choose a new one:\n\n${args.resetUrl}\n\nIf you didn't request this, you can safely ignore this email. This link expires in 1 hour.`,
+    };
+}
+//# sourceMappingURL=reset-email.js.map

package/dist/auth/reset-email.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset-email.js","sourceRoot":"","sources":["../../src/auth/reset-email.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,MAAM,UAAU,qBAAqB,CAAC,IAA4C;IAKhF,OAAO;QACL,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE;;;;;;;;;eASK,IAAI,CAAC,QAAQ;;mBAET,IAAI,CAAC,QAAQ;;;;;;;;;;QAUxB;QACJ,IAAI,EAAE,MAAM,IAAI,CAAC,QAAQ,mGAAmG,IAAI,CAAC,QAAQ,gGAAgG;KAC1O,CAAA;AACH,CAAC"}

package/dist/auth/reset.d.ts

@@ -0,0 +1,42 @@
+import type { PrentaDB } from '../db/client-types.js';
+export interface ResetToken {
+    raw: string;
+    hash: string;
+}
+/** Generate a cryptographically random reset token and its SHA-256 hash. */
+export declare function generateResetToken(): ResetToken;
+/** Hash a raw token for lookup (same algorithm used during generation). */
+export declare function hashToken(raw: string): string;
+/**
+ * Create a password reset request. Generates a token, stores the hash,
+ * and sends the reset email. Always succeeds from the caller's perspective
+ * to prevent user enumeration.
+ */
+export declare function createPasswordReset(db: PrentaDB, email: string, config: {
+    siteUrl: string;
+    /**
+     * Admin mount path (e.g. `/admin`, `/securelogin`). The reset link points at
+     * `<siteUrl><adminPath>/reset-password`, so this must match where the admin
+     * is actually served or the link 404s. Defaults to `/admin`.
+     */
+    adminPath?: string;
+    platform?: {
+        email?: {
+            send: (opts: {
+                to: string;
+                subject: string;
+                html: string;
+                text?: string;
+            }) => Promise<void>;
+        };
+    };
+}): Promise<void>;
+/**
+ * Execute a password reset: validate the token, update the password,
+ * mark the token as used, and revoke all existing sessions.
+ */
+export declare function executePasswordReset(db: PrentaDB, rawToken: string, newPassword: string): Promise<{
+    success: boolean;
+    error?: string;
+}>;
+//# sourceMappingURL=reset.d.ts.map

package/dist/auth/reset.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset.d.ts","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;CACb;AAID,4EAA4E;AAC5E,wBAAgB,kBAAkB,IAAI,UAAU,CAI/C;AAED,2EAA2E;AAC3E,wBAAgB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE7C;AAED;;;;GAIG;AACH,wBAAsB,mBAAmB,CACvC,EAAE,EAAE,QAAQ,EACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE;IACN,OAAO,EAAE,MAAM,CAAA;IACf;;;;OAIG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE;QACT,KAAK,CAAC,EAAE;YACN,IAAI,EAAE,CAAC,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAC;gBAAC,OAAO,EAAE,MAAM,CAAC;gBAAC,IAAI,EAAE,MAAM,CAAC;gBAAC,IAAI,CAAC,EAAE,MAAM,CAAA;aAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;SAC5F,CAAA;KACF,CAAA;CACF,GACA,OAAO,CAAC,IAAI,CAAC,CA4Cf;AAED;;;GAGG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,QAAQ,EACZ,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAoF/C"}

package/dist/auth/reset.js

@@ -0,0 +1,142 @@
+import { randomBytes, createHash } from 'node:crypto';
+import { hashPassword, validatePasswordPolicy } from './password.js';
+import { getPrentaConfig } from '../config/runtime.js';
+import { resolveEmailSenderAsync } from '../email/resolve.js';
+const TOKEN_EXPIRY_MS = 60 * 60 * 1000; // 1 hour
+/** Generate a cryptographically random reset token and its SHA-256 hash. */
+export function generateResetToken() {
+    const raw = randomBytes(32).toString('hex');
+    const hash = createHash('sha256').update(raw).digest('hex');
+    return { raw, hash };
+}
+/** Hash a raw token for lookup (same algorithm used during generation). */
+export function hashToken(raw) {
+    return createHash('sha256').update(raw).digest('hex');
+}
+/**
+ * Create a password reset request. Generates a token, stores the hash,
+ * and sends the reset email. Always succeeds from the caller's perspective
+ * to prevent user enumeration.
+ */
+export async function createPasswordReset(db, email, config) {
+    // Normalise the email so signup and reset agree on the same canonical form.
+    // Without this a user who signed up with "Brad@Example.com " can lose access
+    // simply because the lookup uses a slightly different string.
+    const normalized = email.toLowerCase().trim();
+    if (!normalized)
+        return;
+    const user = await db.user.findFirst({
+        where: { email: { equals: normalized, mode: 'insensitive' } },
+    });
+    if (!user || !user.isActive)
+        return;
+    await db.passwordResetToken.updateMany({
+        where: { userId: user.id, usedAt: null },
+        data: { usedAt: new Date() },
+    });
+    const { raw, hash } = generateResetToken();
+    await db.passwordResetToken.create({
+        data: {
+            userId: user.id,
+            tokenHash: hash,
+            expiresAt: new Date(Date.now() + TOKEN_EXPIRY_MS),
+        },
+    });
+    // Prefer an explicit platform adapter passed by the caller, otherwise fall
+    // back to a sender registered by the email plugin. Without this fallback,
+    // apps that configure email purely through `emailPlugin()` (the common case)
+    // would silently never send reset mail.
+    const sender = config.platform?.email ?? (await resolveEmailSenderAsync(db));
+    if (sender) {
+        const base = config.siteUrl.replace(/\/$/, '');
+        const adminPath = (config.adminPath ?? '/admin').replace(/\/$/, '');
+        const resetUrl = `${base}${adminPath}/reset-password?token=${raw}`;
+        const { passwordResetTemplate } = await import('./reset-email.js');
+        const tpl = passwordResetTemplate({ resetUrl, userName: user.name });
+        await sender.send({
+            to: user.email,
+            subject: tpl.subject,
+            html: tpl.html,
+            text: tpl.text,
+        });
+    }
+}
+/**
+ * Execute a password reset: validate the token, update the password,
+ * mark the token as used, and revoke all existing sessions.
+ */
+export async function executePasswordReset(db, rawToken, newPassword) {
+    const tokenHash = hashToken(rawToken);
+    const resetToken = await db.passwordResetToken.findFirst({
+        where: { tokenHash, usedAt: null },
+        include: { user: true },
+    });
+    if (!resetToken) {
+        return { success: false, error: 'Invalid or expired reset link.' };
+    }
+    if (resetToken.expiresAt < new Date()) {
+        return { success: false, error: 'This reset link has expired. Please request a new one.' };
+    }
+    // `user` is always present (included above); the guard keeps the typed
+    // optional relation honest and fails closed if the row is ever orphaned.
+    const tokenUser = resetToken.user;
+    if (!tokenUser || !tokenUser.isActive) {
+        return { success: false, error: 'This account has been deactivated.' };
+    }
+    // Enforce the same password policy that the rest of the app uses. Without
+    // this, the reset endpoint becomes a back-door for weak passwords. We use
+    // a sensible default; integrators that want stricter rules should call
+    // this through their own wrapper.
+    const cmsConfig = getPrentaConfig();
+    const passwordPolicy = cmsConfig?.auth?.passwordPolicy ?? {
+        minLength: 12,
+        requireUppercase: true,
+        requireLowercase: true,
+        requireNumbers: true,
+        requireSpecialChars: false,
+    };
+    const policy = validatePasswordPolicy(newPassword, passwordPolicy);
+    if (!policy.valid) {
+        return { success: false, error: policy.errors[0] ?? 'Password does not meet requirements.' };
+    }
+    const passwordHash = await hashPassword(newPassword);
+    // If this account has a pending invite, completing the reset *is* the
+    // acceptance: mark the invite ACCEPTED and stamp the user as accepted +
+    // approved. Done in the same transaction so password + acceptance commit
+    // atomically. A normal (non-invite) reset matches no invite and is unaffected.
+    let pendingInvite = null;
+    try {
+        pendingInvite =
+            (await db.invite?.findFirst?.({
+                where: { email: { equals: tokenUser.email, mode: 'insensitive' }, status: 'PENDING' },
+            })) ?? null;
+    }
+    catch {
+        pendingInvite = null;
+    }
+    const userData = { passwordHash };
+    const ops = [];
+    if (pendingInvite) {
+        userData.acceptedInviteAt = new Date();
+        userData.isApproved = true;
+        userData.emailVerified = true;
+        ops.push(db.invite.update({
+            where: { id: pendingInvite.id },
+            data: { status: 'ACCEPTED', acceptedAt: new Date(), acceptedUserId: resetToken.userId },
+        }));
+    }
+    await db.$transaction([
+        db.user.update({ where: { id: resetToken.userId }, data: userData }),
+        db.passwordResetToken.update({
+            where: { id: resetToken.id },
+            data: { usedAt: new Date() },
+        }),
+        db.session.updateMany({
+            where: { userId: resetToken.userId, revokedAt: null },
+            data: { revokedAt: new Date() },
+        }),
+        ...ops,
+    ]);
+    return { success: true };
+}
+//# sourceMappingURL=reset.js.map

package/dist/auth/reset.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reset.js","sourceRoot":"","sources":["../../src/auth/reset.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AACrD,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAA;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AACtD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAA;AAQ7D,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAA,CAAC,SAAS;AAEhD,4EAA4E;AAC5E,MAAM,UAAU,kBAAkB;IAChC,MAAM,GAAG,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAA;IAC3C,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3D,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAA;AACtB,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,SAAS,CAAC,GAAW;IACnC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;AACvD,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,EAAY,EACZ,KAAa,EACb,MAaC;IAED,4EAA4E;IAC5E,6EAA6E;IAC7E,8DAA8D;IAC9D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAA;IAC7C,IAAI,CAAC,UAAU;QAAE,OAAM;IAEvB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC;QACnC,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE;KAC9D,CAAC,CAAA;IACF,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAM;IAEnC,MAAM,EAAE,CAAC,kBAAkB,CAAC,UAAU,CAAC;QACrC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE;QACxC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;KAC7B,CAAC,CAAA;IAEF,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,kBAAkB,EAAE,CAAA;IAC1C,MAAM,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;QACjC,IAAI,EAAE;YACJ,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,SAAS,EAAE,IAAI;YACf,SAAS,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,eAAe,CAAC;SAClD;KACF,CAAC,CAAA;IAEF,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,wCAAwC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,uBAAuB,CAAC,EAAE,CAAC,CAAC,CAAA;IAC5E,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAC9C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QACnE,MAAM,QAAQ,GAAG,GAAG,IAAI,GAAG,SAAS,yBAAyB,GAAG,EAAE,CAAA;QAClE,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAA;QAClE,MAAM,GAAG,GAAG,qBAAqB,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAA;QACpE,MAAM,MAAM,CAAC,IAAI,CAAC;YAChB,EAAE,EAAE,IAAI,CAAC,KAAK;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,IAAI,EAAE,GAAG,CAAC,IAAI;SACf,CAAC,CAAA;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,EAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,MAAM,SAAS,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAA;IAErC,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC;QACvD,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;QAClC,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;KACxB,CAAC,CAAA;IAEF,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAA;IACpE,CAAC;IAED,IAAI,UAAU,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,wDAAwD,EAAE,CAAA;IAC5F,CAAC;IAED,uEAAuE;IACvE,yEAAyE;IACzE,MAAM,SAAS,GAAG,UAAU,CAAC,IAAI,CAAA;IACjC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAA;IACxE,CAAC;IAED,0EAA0E;IAC1E,0EAA0E;IAC1E,uEAAuE;IACvE,kCAAkC;IAClC,MAAM,SAAS,GAAG,eAAe,EAAE,CAAA;IACnC,MAAM,cAAc,GAAG,SAAS,EAAE,IAAI,EAAE,cAAc,IAAI;QACxD,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,IAAI;QACtB,gBAAgB,EAAE,IAAI;QACtB,cAAc,EAAE,IAAI;QACpB,mBAAmB,EAAE,KAAK;KAC3B,CAAA;IACD,MAAM,MAAM,GAAG,sBAAsB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAA;IAClE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,sCAAsC,EAAE,CAAA;IAC9F,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,CAAA;IAEpD,sEAAsE;IACtE,wEAAwE;IACxE,yEAAyE;IACzE,+EAA+E;IAC/E,IAAI,aAAa,GAA0B,IAAI,CAAA;IAC/C,IAAI,CAAC;QACH,aAAa;YACX,CAAC,MAAM,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;gBAC5B,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,aAAa,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE;aACtF,CAAC,CAAC,IAAI,IAAI,CAAA;IACf,CAAC;IAAC,MAAM,CAAC;QACP,aAAa,GAAG,IAAI,CAAA;IACtB,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,YAAY,EAAE,CAAA;IAC1D,MAAM,GAAG,GAAc,EAAE,CAAA;IACzB,IAAI,aAAa,EAAE,CAAC;QAClB,QAAQ,CAAC,gBAAgB,GAAG,IAAI,IAAI,EAAE,CAAA;QACtC,QAAQ,CAAC,UAAU,GAAG,IAAI,CAAA;QAC1B,QAAQ,CAAC,aAAa,GAAG,IAAI,CAAA;QAC7B,GAAG,CAAC,IAAI,CACN,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;YACf,KAAK,EAAE,EAAE,EAAE,EAAE,aAAa,CAAC,EAAE,EAAE;YAC/B,IAAI,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,cAAc,EAAE,UAAU,CAAC,MAAM,EAAE;SACxF,CAAC,CACH,CAAA;IACH,CAAC;IAED,MAAM,EAAE,CAAC,YAAY,CAAC;QACpB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpE,EAAE,CAAC,kBAAkB,CAAC,MAAM,CAAC;YAC3B,KAAK,EAAE,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE;YAC5B,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,IAAI,EAAE,EAAE;SAC7B,CAAC;QACF,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;YACpB,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE;YACrD,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,IAAI,EAAE,EAAE;SAChC,CAAC;QACF,GAAG,GAAG;KACP,CAAC,CAAA;IAEF,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;AAC1B,CAAC"}

package/dist/auth/roles.d.ts

@@ -0,0 +1,51 @@
+/**
+ * Role model for the Users / access-control subsystem.
+ *
+ * The database enum (`UserRole`) carries six values for backward compatibility:
+ * the four product-facing roles `OWNER`, `ADMIN`, `EDITOR`, `VIEWER` plus the
+ * two legacy values `AUTHOR` and `CLIENT` that predate this subsystem. The admin
+ * UI only ever speaks in the four product roles, so this module is the single
+ * source of truth for:
+ *
+ *   - mapping any stored role to a product-facing display label,
+ *   - mapping a display-label filter back to the enum values it covers,
+ *   - which roles may be *assigned* to new/updated users,
+ *   - a privilege rank used by protection checks (last-owner, self-demotion),
+ *   - the permission groups each role grants.
+ *
+ * Everything here is pure and dependency-free so it can be unit-tested in
+ * isolation and imported from the lightweight `@prenta/core/roles`
+ * subpath without pulling the full barrel.
+ */
+export type UserRoleEnum = 'OWNER' | 'ADMIN' | 'EDITOR' | 'AUTHOR' | 'CLIENT' | 'VIEWER';
+export type DisplayRole = 'Owner' | 'Admin' | 'Editor' | 'Viewer';
+/** Roles offered in the invite modal and role dropdowns, in privilege order. */
+export declare const ASSIGNABLE_ROLES: readonly UserRoleEnum[];
+/** All product-facing display roles, used for the filter pills. */
+export declare const DISPLAY_ROLES: readonly DisplayRole[];
+/**
+ * Privilege rank — higher is more privileged. Used to enforce "you cannot act on
+ * someone more privileged than you" and last-owner / self-demotion protections.
+ * Legacy roles rank with their display equivalent.
+ */
+export declare const ROLE_RANK: Record<UserRoleEnum, number>;
+/** Map any stored role (incl. legacy) to its product-facing display label. */
+export declare function toDisplayRole(role: string | null | undefined): DisplayRole;
+/** Validate + normalize a role coming from the UI for assignment. */
+export declare function normalizeAssignableRole(role: string | null | undefined): UserRoleEnum | null;
+/**
+ * The enum values a display-role filter covers. Returns `null` for "all" or an
+ * unrecognized label so callers can skip filtering.
+ */
+export declare function enumRolesForDisplay(display: string | null | undefined): UserRoleEnum[] | null;
+export declare function isOwnerRole(role: string | null | undefined): boolean;
+/** Rank of a role (0 for unknown). */
+export declare function roleRank(role: string | null | undefined): number;
+/** Every permission scope recognised by the system. */
+export declare const ALL_PERMISSIONS: readonly ["dashboard.view", "content.view", "content.create", "content.update", "content.publish", "content.delete", "pages.manage", "posts.manage", "media.manage", "forms.manage", "seo.manage", "redirects.manage", "scripts.manage", "users.view", "users.invite", "users.update", "users.update_role", "users.remove", "users.suspend", "users.reset_password", "users.reset_mfa", "sessions.view", "sessions.revoke", "api_keys.manage", "settings.manage", "security.manage", "audit.view", "billing.manage", "workspace.delete", "workspace.owner_actions"];
+export type Permission = (typeof ALL_PERMISSIONS)[number];
+/** Effective permissions granted by a role. */
+export declare function permissionsForRole(role: string | null | undefined): Permission[];
+/** Whether a role grants a specific permission. */
+export declare function roleHasPermission(role: string | null | undefined, permission: Permission): boolean;
+//# sourceMappingURL=roles.d.ts.map

package/dist/auth/roles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.d.ts","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAA;AACxF,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,OAAO,GAAG,QAAQ,GAAG,QAAQ,CAAA;AAEjE,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EAA2C,CAAA;AAE/F,mEAAmE;AACnE,eAAO,MAAM,aAAa,EAAE,SAAS,WAAW,EAA2C,CAAA;AAkB3F;;;;GAIG;AACH,eAAO,MAAM,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAOlD,CAAA;AAQD,8EAA8E;AAC9E,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,WAAW,CAG1E;AAED,qEAAqE;AACrE,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,GAAG,IAAI,CAG5F;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,EAAE,GAAG,IAAI,CAM7F;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAEpE;AAED,sCAAsC;AACtC,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAGhE;AAMD,uDAAuD;AACvD,eAAO,MAAM,eAAe,qiBA+BlB,CAAA;AAEV,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAA;AAqBzD,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,UAAU,EAAE,CAehF;AAED,mDAAmD;AACnD,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,UAAU,EAAE,UAAU,GACrB,OAAO,CAET"}

package/dist/auth/roles.js

@@ -0,0 +1,159 @@
+/**
+ * Role model for the Users / access-control subsystem.
+ *
+ * The database enum (`UserRole`) carries six values for backward compatibility:
+ * the four product-facing roles `OWNER`, `ADMIN`, `EDITOR`, `VIEWER` plus the
+ * two legacy values `AUTHOR` and `CLIENT` that predate this subsystem. The admin
+ * UI only ever speaks in the four product roles, so this module is the single
+ * source of truth for:
+ *
+ *   - mapping any stored role to a product-facing display label,
+ *   - mapping a display-label filter back to the enum values it covers,
+ *   - which roles may be *assigned* to new/updated users,
+ *   - a privilege rank used by protection checks (last-owner, self-demotion),
+ *   - the permission groups each role grants.
+ *
+ * Everything here is pure and dependency-free so it can be unit-tested in
+ * isolation and imported from the lightweight `@prenta/core/roles`
+ * subpath without pulling the full barrel.
+ */
+/** Roles offered in the invite modal and role dropdowns, in privilege order. */
+export const ASSIGNABLE_ROLES = ['OWNER', 'ADMIN', 'EDITOR', 'VIEWER'];
+/** All product-facing display roles, used for the filter pills. */
+export const DISPLAY_ROLES = ['Owner', 'Admin', 'Editor', 'Viewer'];
+const ENUM_TO_DISPLAY = {
+    OWNER: 'Owner',
+    ADMIN: 'Admin',
+    EDITOR: 'Editor',
+    AUTHOR: 'Editor',
+    CLIENT: 'Viewer',
+    VIEWER: 'Viewer',
+};
+const DISPLAY_TO_ENUMS = {
+    Owner: ['OWNER'],
+    Admin: ['ADMIN'],
+    Editor: ['EDITOR', 'AUTHOR'],
+    Viewer: ['VIEWER', 'CLIENT'],
+};
+/**
+ * Privilege rank — higher is more privileged. Used to enforce "you cannot act on
+ * someone more privileged than you" and last-owner / self-demotion protections.
+ * Legacy roles rank with their display equivalent.
+ */
+export const ROLE_RANK = {
+    OWNER: 100,
+    ADMIN: 80,
+    EDITOR: 40,
+    AUTHOR: 40,
+    VIEWER: 10,
+    CLIENT: 10,
+};
+function normalizeEnum(role) {
+    if (!role)
+        return null;
+    const upper = role.trim().toUpperCase();
+    return upper in ENUM_TO_DISPLAY ? upper : null;
+}
+/** Map any stored role (incl. legacy) to its product-facing display label. */
+export function toDisplayRole(role) {
+    const e = normalizeEnum(role);
+    return e ? ENUM_TO_DISPLAY[e] : 'Viewer';
+}
+/** Validate + normalize a role coming from the UI for assignment. */
+export function normalizeAssignableRole(role) {
+    const e = normalizeEnum(role);
+    return e && ASSIGNABLE_ROLES.includes(e) ? e : null;
+}
+/**
+ * The enum values a display-role filter covers. Returns `null` for "all" or an
+ * unrecognized label so callers can skip filtering.
+ */
+export function enumRolesForDisplay(display) {
+    if (!display || display.toLowerCase() === 'all')
+        return null;
+    const key = DISPLAY_ROLES.find((r) => r.toLowerCase() === display.trim().toLowerCase());
+    return key ? DISPLAY_TO_ENUMS[key] : null;
+}
+export function isOwnerRole(role) {
+    return normalizeEnum(role) === 'OWNER';
+}
+/** Rank of a role (0 for unknown). */
+export function roleRank(role) {
+    const e = normalizeEnum(role);
+    return e ? ROLE_RANK[e] : 0;
+}
+// ---------------------------------------------------------------------------
+// Permission groups
+// ---------------------------------------------------------------------------
+/** Every permission scope recognised by the system. */
+export const ALL_PERMISSIONS = [
+    'dashboard.view',
+    'content.view',
+    'content.create',
+    'content.update',
+    'content.publish',
+    'content.delete',
+    'pages.manage',
+    'posts.manage',
+    'media.manage',
+    'forms.manage',
+    'seo.manage',
+    'redirects.manage',
+    'scripts.manage',
+    'users.view',
+    'users.invite',
+    'users.update',
+    'users.update_role',
+    'users.remove',
+    'users.suspend',
+    'users.reset_password',
+    'users.reset_mfa',
+    'sessions.view',
+    'sessions.revoke',
+    'api_keys.manage',
+    'settings.manage',
+    'security.manage',
+    'audit.view',
+    'billing.manage',
+    'workspace.delete',
+    'workspace.owner_actions',
+];
+const CONTENT_PERMISSIONS = [
+    'dashboard.view',
+    'content.view',
+    'content.create',
+    'content.update',
+    'content.publish',
+    'content.delete',
+    'pages.manage',
+    'posts.manage',
+    'media.manage',
+    'forms.manage',
+    'seo.manage',
+    'redirects.manage',
+];
+// Admin gets everything except the Owner-only billing/workspace/owner actions.
+const OWNER_ONLY = ['billing.manage', 'workspace.delete', 'workspace.owner_actions'];
+const ADMIN_PERMISSIONS = ALL_PERMISSIONS.filter((p) => !OWNER_ONLY.includes(p));
+/** Effective permissions granted by a role. */
+export function permissionsForRole(role) {
+    switch (normalizeEnum(role)) {
+        case 'OWNER':
+            return [...ALL_PERMISSIONS];
+        case 'ADMIN':
+            return ADMIN_PERMISSIONS;
+        case 'EDITOR':
+        case 'AUTHOR':
+            return [...CONTENT_PERMISSIONS];
+        case 'VIEWER':
+        case 'CLIENT':
+            return ['dashboard.view', 'content.view'];
+        default:
+            return [];
+    }
+}
+/** Whether a role grants a specific permission. */
+export function roleHasPermission(role, permission) {
+    return permissionsForRole(role).includes(permission);
+}
+//# sourceMappingURL=roles.js.map

package/dist/auth/roles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"roles.js","sourceRoot":"","sources":["../../src/auth/roles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAKH,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE/F,mEAAmE;AACnE,MAAM,CAAC,MAAM,aAAa,GAA2B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAA;AAE3F,MAAM,eAAe,GAAsC;IACzD,KAAK,EAAE,OAAO;IACd,KAAK,EAAE,OAAO;IACd,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;IAChB,MAAM,EAAE,QAAQ;CACjB,CAAA;AAED,MAAM,gBAAgB,GAAwC;IAC5D,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,KAAK,EAAE,CAAC,OAAO,CAAC;IAChB,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;CAC7B,CAAA;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,SAAS,GAAiC;IACrD,KAAK,EAAE,GAAG;IACV,KAAK,EAAE,EAAE;IACT,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;IACV,MAAM,EAAE,EAAE;CACX,CAAA;AAED,SAAS,aAAa,CAAC,IAA+B;IACpD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAA;IACtB,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAA;IACvC,OAAO,KAAK,IAAI,eAAe,CAAC,CAAC,CAAE,KAAsB,CAAC,CAAC,CAAC,IAAI,CAAA;AAClE,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAA+B;IAC3D,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAA;AAC1C,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,uBAAuB,CAAC,IAA+B;IACrE,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,IAAK,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAkC;IACpE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,WAAW,EAAE,KAAK,KAAK;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,GAAG,GAAI,aAAmC,CAAC,IAAI,CACnD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAC7B,CAAA;IAC5B,OAAO,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;AAC3C,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAA+B;IACzD,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,OAAO,CAAA;AACxC,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,QAAQ,CAAC,IAA+B;IACtD,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAC7B,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC7B,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,eAAe,GAAG;IAC7B,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,YAAY;IACZ,kBAAkB;IAClB,gBAAgB;IAChB,YAAY;IACZ,cAAc;IACd,cAAc;IACd,mBAAmB;IACnB,cAAc;IACd,eAAe;IACf,sBAAsB;IACtB,iBAAiB;IACjB,eAAe;IACf,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,iBAAiB;IACjB,YAAY;IACZ,gBAAgB;IAChB,kBAAkB;IAClB,yBAAyB;CACjB,CAAA;AAIV,MAAM,mBAAmB,GAAiB;IACxC,gBAAgB;IAChB,cAAc;IACd,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,gBAAgB;IAChB,cAAc;IACd,cAAc;IACd,cAAc;IACd,cAAc;IACd,YAAY;IACZ,kBAAkB;CACnB,CAAA;AAED,+EAA+E;AAC/E,MAAM,UAAU,GAAiB,CAAC,gBAAgB,EAAE,kBAAkB,EAAE,yBAAyB,CAAC,CAAA;AAClG,MAAM,iBAAiB,GAAiB,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAE9F,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB,CAAC,IAA+B;IAChE,QAAQ,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5B,KAAK,OAAO;YACV,OAAO,CAAC,GAAG,eAAe,CAAC,CAAA;QAC7B,KAAK,OAAO;YACV,OAAO,iBAAiB,CAAA;QAC1B,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,CAAC,GAAG,mBAAmB,CAAC,CAAA;QACjC,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,OAAO,CAAC,gBAAgB,EAAE,cAAc,CAAC,CAAA;QAC3C;YACE,OAAO,EAAE,CAAA;IACb,CAAC;AACH,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,iBAAiB,CAC/B,IAA+B,EAC/B,UAAsB;IAEtB,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAA;AACtD,CAAC"}

package/dist/auth/session.d.ts

@@ -0,0 +1,38 @@
+import type { PrentaDB } from '../db/client-types.js';
+export interface SessionPayload {
+    userId: string;
+    role: string;
+    sessionId: string;
+    fingerprint?: string;
+}
+/**
+ * Thrown when a JWT verifies cryptographically but its decoded payload
+ * doesn't match the expected `SessionPayload` shape. We map this to a 401
+ * (not 500) because it represents a forged-but-correctly-signed-by-the-CMS
+ * token rather than a server bug.
+ */
+export declare class InvalidSessionPayloadError extends Error {
+    constructor(reason: string);
+}
+export interface SessionOptions {
+    secret: string;
+    maxAge?: number;
+    issuer?: string;
+    audience?: string;
+}
+/** Create a signed JWT session token. */
+export declare function createSession(payload: SessionPayload, options: SessionOptions): Promise<string>;
+/** Verify and decode a JWT session token. */
+export declare function verifySession(token: string, options: SessionOptions): Promise<SessionPayload>;
+/** Revoke a session by marking it in the database. */
+export declare function revokeSession(sessionId: string, db: PrentaDB): Promise<void>;
+/**
+ * Refresh a session token, issuing a new JWT with an extended expiry.
+ *
+ * When `db` is supplied, the existing `Session` row is verified to be active
+ * and its `expiresAt` is extended in lockstep with the new JWT. Without that
+ * check, a revoked session that was still in a user's cookie could be
+ * "un-revoked" simply by refreshing it.
+ */
+export declare function refreshSession(token: string, options: SessionOptions, db?: PrentaDB): Promise<string>;
+//# sourceMappingURL=session.d.ts.map

package/dist/auth/session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/auth/session.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAA;AAErD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED;;;;;GAKG;AACH,qBAAa,0BAA2B,SAAQ,KAAK;gBACvC,MAAM,EAAE,MAAM;CAI3B;AAgCD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAID,yCAAyC;AACzC,wBAAsB,aAAa,CACjC,OAAO,EAAE,cAAc,EACvB,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,MAAM,CAAC,CASjB;AAED,6CAA6C;AAC7C,wBAAsB,aAAa,CACjC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,cAAc,CAAC,CAkBzB;AAED,sDAAsD;AACtD,wBAAsB,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAKlF;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,MAAM,EACb,OAAO,EAAE,cAAc,EACvB,EAAE,CAAC,EAAE,QAAQ,GACZ,OAAO,CAAC,MAAM,CAAC,CAgBjB"}