@spinajs/rbac-http-token 2.0.507

package/lib/mjs/events/AccessTokenDeleted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenDeleted.js","sourceRoot":"","sources":["../../../src/events/AccessTokenDeleted.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGlD,IAAM,kBAAkB,GAAxB,MAAM,kBAAmB,SAAQ,gBAAgB;CAAG,CAAA;AAA9C,kBAAkB;IAD9B,KAAK,EAAE;GACK,kBAAkB,CAA4B"}

package/lib/mjs/events/AccessTokenEvent.d.ts

@@ -0,0 +1,10 @@
+import { QueueEvent } from '@spinajs/queue';
+import { AccessToken } from '../models/AccessToken.js';
+export declare class AccessTokenEvent extends QueueEvent {
+    /**
+     * Public token identifier. Never the token material.
+     */
+    TokenUuid: string;
+    constructor(token: AccessToken);
+}
+//# sourceMappingURL=AccessTokenEvent.d.ts.map

package/lib/mjs/events/AccessTokenEvent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenEvent.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenEvent.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAS,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAEvD,qBACa,gBAAiB,SAAQ,UAAU;IAC9C;;OAEG;IACI,SAAS,EAAE,MAAM,CAAC;IAEzB,YAAY,KAAK,EAAE,WAAW,EAG7B;CACF"}

package/lib/mjs/events/AccessTokenEvent.js

@@ -0,0 +1,23 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { QueueEvent, Event } from '@spinajs/queue';
+import { AccessToken } from '../models/AccessToken.js';
+let AccessTokenEvent = class AccessTokenEvent extends QueueEvent {
+    constructor(token) {
+        super();
+        this.TokenUuid = token.Uuid;
+    }
+};
+AccessTokenEvent = __decorate([
+    Event(),
+    __metadata("design:paramtypes", [AccessToken])
+], AccessTokenEvent);
+export { AccessTokenEvent };
+//# sourceMappingURL=AccessTokenEvent.js.map

package/lib/mjs/events/AccessTokenEvent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenEvent.js","sourceRoot":"","sources":["../../../src/events/AccessTokenEvent.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAGhD,IAAM,gBAAgB,GAAtB,MAAM,gBAAiB,SAAQ,UAAU;IAM9C,YAAY,KAAkB;QAC5B,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,IAAI,CAAC;IAC9B,CAAC;CACF,CAAA;AAVY,gBAAgB;IAD5B,KAAK,EAAE;qCAOa,WAAW;GANnB,gBAAgB,CAU5B"}

package/lib/mjs/events/AccessTokenRoleGranted.d.ts

@@ -0,0 +1,7 @@
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenRoleGranted extends AccessTokenEvent {
+    Role: string;
+    constructor(token: AccessToken, Role: string);
+}
+//# sourceMappingURL=AccessTokenRoleGranted.d.ts.map

package/lib/mjs/events/AccessTokenRoleGranted.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleGranted.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleGranted.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,sBAAuB,SAAQ,gBAAgB;IACnB,IAAI,EAAE,MAAM;IAAnD,YAAY,KAAK,EAAE,WAAW,EAAS,IAAI,EAAE,MAAM,EAElD;CACF"}

package/lib/mjs/events/AccessTokenRoleGranted.js

@@ -0,0 +1,24 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Event } from '@spinajs/queue';
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+let AccessTokenRoleGranted = class AccessTokenRoleGranted extends AccessTokenEvent {
+    constructor(token, Role) {
+        super(token);
+        this.Role = Role;
+    }
+};
+AccessTokenRoleGranted = __decorate([
+    Event(),
+    __metadata("design:paramtypes", [AccessToken, String])
+], AccessTokenRoleGranted);
+export { AccessTokenRoleGranted };
+//# sourceMappingURL=AccessTokenRoleGranted.js.map

package/lib/mjs/events/AccessTokenRoleGranted.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleGranted.js","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleGranted.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGlD,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IAC1D,YAAY,KAAkB,EAAS,IAAY;QACjD,KAAK,CAAC,KAAK,CAAC,CAAC;oBADwB,IAAI;IAE3C,CAAC;CACF,CAAA;AAJY,sBAAsB;IADlC,KAAK,EAAE;qCAEa,WAAW;GADnB,sBAAsB,CAIlC"}

package/lib/mjs/events/AccessTokenRoleRevoked.d.ts

@@ -0,0 +1,7 @@
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+export declare class AccessTokenRoleRevoked extends AccessTokenEvent {
+    Role: string;
+    constructor(token: AccessToken, Role: string);
+}
+//# sourceMappingURL=AccessTokenRoleRevoked.d.ts.map

package/lib/mjs/events/AccessTokenRoleRevoked.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleRevoked.d.ts","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleRevoked.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAEzD,qBACa,sBAAuB,SAAQ,gBAAgB;IACnB,IAAI,EAAE,MAAM;IAAnD,YAAY,KAAK,EAAE,WAAW,EAAS,IAAI,EAAE,MAAM,EAElD;CACF"}

package/lib/mjs/events/AccessTokenRoleRevoked.js

@@ -0,0 +1,24 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Event } from '@spinajs/queue';
+import { AccessToken } from '../models/AccessToken.js';
+import { AccessTokenEvent } from './AccessTokenEvent.js';
+let AccessTokenRoleRevoked = class AccessTokenRoleRevoked extends AccessTokenEvent {
+    constructor(token, Role) {
+        super(token);
+        this.Role = Role;
+    }
+};
+AccessTokenRoleRevoked = __decorate([
+    Event(),
+    __metadata("design:paramtypes", [AccessToken, String])
+], AccessTokenRoleRevoked);
+export { AccessTokenRoleRevoked };
+//# sourceMappingURL=AccessTokenRoleRevoked.js.map

package/lib/mjs/events/AccessTokenRoleRevoked.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccessTokenRoleRevoked.js","sourceRoot":"","sources":["../../../src/events/AccessTokenRoleRevoked.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAGlD,IAAM,sBAAsB,GAA5B,MAAM,sBAAuB,SAAQ,gBAAgB;IAC1D,YAAY,KAAkB,EAAS,IAAY;QACjD,KAAK,CAAC,KAAK,CAAC,CAAC;oBADwB,IAAI;IAE3C,CAAC;CACF,CAAA;AAJY,sBAAsB;IADlC,KAAK,EAAE;qCAEa,WAAW;GADnB,sBAAsB,CAIlC"}

package/lib/mjs/events/index.d.ts

@@ -0,0 +1,6 @@
+export * from './AccessTokenEvent.js';
+export * from './AccessTokenCreated.js';
+export * from './AccessTokenDeleted.js';
+export * from './AccessTokenRoleGranted.js';
+export * from './AccessTokenRoleRevoked.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/events/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/events/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC"}

package/lib/mjs/events/index.js

@@ -0,0 +1,6 @@
+export * from './AccessTokenEvent.js';
+export * from './AccessTokenCreated.js';
+export * from './AccessTokenDeleted.js';
+export * from './AccessTokenRoleGranted.js';
+export * from './AccessTokenRoleRevoked.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/events/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/events/index.ts"],"names":[],"mappings":"AAAA,cAAc,uBAAuB,CAAC;AACtC,cAAc,yBAAyB,CAAC;AACxC,cAAc,yBAAyB,CAAC;AACxC,cAAc,6BAA6B,CAAC;AAC5C,cAAc,6BAA6B,CAAC"}

package/lib/mjs/generator.d.ts

@@ -0,0 +1,12 @@
+import { AccessTokenGenerationProvider, IGeneratedToken } from './interfaces.js';
+/**
+ * Default token algorithm: `<prefix>` + N crypto-random bytes base64url encoded.
+ * The stable prefix makes leaked tokens findable by secret scanners.
+ */
+export declare class SecureRandomTokenProvider extends AccessTokenGenerationProvider {
+    protected Prefix: string;
+    protected Length: number;
+    generate(): Promise<IGeneratedToken>;
+    hash(plaintext: string): string;
+}
+//# sourceMappingURL=generator.d.ts.map

package/lib/mjs/generator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.d.ts","sourceRoot":"","sources":["../../src/generator.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,6BAA6B,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;GAGG;AACH,qBACa,yBAA0B,SAAQ,6BAA6B;IAE1E,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAGzB,SAAS,CAAC,MAAM,EAAE,MAAM,CAAC;IAEZ,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAGhD;IAEM,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAErC;CACF"}

package/lib/mjs/generator.js

@@ -0,0 +1,39 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { randomBytes, createHash } from 'crypto';
+import { Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { AccessTokenGenerationProvider } from './interfaces.js';
+/**
+ * Default token algorithm: `<prefix>` + N crypto-random bytes base64url encoded.
+ * The stable prefix makes leaked tokens findable by secret scanners.
+ */
+let SecureRandomTokenProvider = class SecureRandomTokenProvider extends AccessTokenGenerationProvider {
+    async generate() {
+        const plaintext = `${this.Prefix}${randomBytes(this.Length).toString('base64url')}`;
+        return { Plaintext: plaintext, Hash: this.hash(plaintext) };
+    }
+    hash(plaintext) {
+        return createHash('sha256').update(plaintext).digest('hex');
+    }
+};
+__decorate([
+    Config('rbac.token.prefix', { defaultValue: 'spt_' }),
+    __metadata("design:type", String)
+], SecureRandomTokenProvider.prototype, "Prefix", void 0);
+__decorate([
+    Config('rbac.token.length', { defaultValue: 32 }),
+    __metadata("design:type", Number)
+], SecureRandomTokenProvider.prototype, "Length", void 0);
+SecureRandomTokenProvider = __decorate([
+    Injectable(AccessTokenGenerationProvider)
+], SecureRandomTokenProvider);
+export { SecureRandomTokenProvider };
+//# sourceMappingURL=generator.js.map

package/lib/mjs/generator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"generator.js","sourceRoot":"","sources":["../../src/generator.ts"],"names":[],"mappings":";;;;;;;;;AAAA,OAAO,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,6BAA6B,EAAmB,MAAM,iBAAiB,CAAC;AAEjF;;;GAGG;AAEI,IAAM,yBAAyB,GAA/B,MAAM,yBAA0B,SAAQ,6BAA6B;IAOnE,KAAK,CAAC,QAAQ;QACnB,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACpF,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC;IAC9D,CAAC;IAEM,IAAI,CAAC,SAAiB;QAC3B,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AAbW;IADT,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;;yDAC7B;AAGf;IADT,MAAM,CAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;yDACzB;AALd,yBAAyB;IADrC,UAAU,CAAC,6BAA6B,CAAC;GAC7B,yBAAyB,CAerC"}

package/lib/mjs/index.d.ts

@@ -0,0 +1,20 @@
+import './generator.js';
+import './middlewares.js';
+export * from './interfaces.js';
+export * from './models/AccessToken.js';
+export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './generator.js';
+export * from './events/index.js';
+export * from './actions.js';
+export * from './middlewares.js';
+export * from './policies/TokenPolicy.js';
+export * from './policies/NoTokenAuthPolicy.js';
+export * from './policies/NoImpersonationPolicy.js';
+export * from './controllers/AccessTokenController.js';
+export * from './dto/create-token-dto.js';
+export * from './cli/CreateToken.js';
+export * from './cli/DeleteToken.js';
+export * from './cli/GrantTokenRole.js';
+export * from './cli/RevokeTokenRole.js';
+export * from './cli/DeleteExpiredTokens.js';
+//# sourceMappingURL=index.d.ts.map

package/lib/mjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAGA,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/index.js

@@ -0,0 +1,23 @@
+// Side effect imports - these modules register Injectables ( the token
+// generator and the token authorization middleware ) the moment they are
+// loaded, so they must run even if a consumer imports nothing from them.
+import './generator.js';
+import './middlewares.js';
+export * from './interfaces.js';
+export * from './models/AccessToken.js';
+export * from './migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.js';
+export * from './generator.js';
+export * from './events/index.js';
+export * from './actions.js';
+export * from './middlewares.js';
+export * from './policies/TokenPolicy.js';
+export * from './policies/NoTokenAuthPolicy.js';
+export * from './policies/NoImpersonationPolicy.js';
+export * from './controllers/AccessTokenController.js';
+export * from './dto/create-token-dto.js';
+export * from './cli/CreateToken.js';
+export * from './cli/DeleteToken.js';
+export * from './cli/GrantTokenRole.js';
+export * from './cli/RevokeTokenRole.js';
+export * from './cli/DeleteExpiredTokens.js';
+//# sourceMappingURL=index.js.map

package/lib/mjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,uEAAuE;AACvE,yEAAyE;AACzE,yEAAyE;AACzE,OAAO,gBAAgB,CAAC;AACxB,OAAO,kBAAkB,CAAC;AAE1B,cAAc,iBAAiB,CAAC;AAChC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0DAA0D,CAAC;AACzE,cAAc,gBAAgB,CAAC;AAC/B,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,kBAAkB,CAAC;AACjC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,wCAAwC,CAAC;AACvD,cAAc,2BAA2B,CAAC;AAC1C,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,0BAA0B,CAAC;AACzC,cAAc,8BAA8B,CAAC"}

package/lib/mjs/interfaces.d.ts

@@ -0,0 +1,57 @@
+export interface IGeneratedToken {
+    /**
+     * Full token as handed to the user, e.g. `spt_<base64url>`. Shown exactly once.
+     */
+    Plaintext: string;
+    /**
+     * SHA-256 hex digest of the plaintext - the only thing that is persisted.
+     */
+    Hash: string;
+}
+/**
+ * Token generation algorithm. Replaceable via config
+ * `rbac.token.generation.service` - same pattern as `rbac.password.service`.
+ */
+export declare abstract class AccessTokenGenerationProvider {
+    /**
+     * Generates a fresh token. Plaintext leaves the server once; only the hash is stored.
+     */
+    abstract generate(): Promise<IGeneratedToken>;
+    /**
+     * Deterministic hash of a presented plaintext, used for DB lookup.
+     */
+    abstract hash(plaintext: string): string;
+}
+/**
+ * Marker stored on request async storage when a request was authenticated
+ * with an access token instead of a session.
+ */
+export interface ITokenAuthInfo {
+    /**
+     * Uuid of the AccessToken row - safe to log; never the token itself.
+     */
+    Uuid: string;
+}
+declare module '@spinajs/rbac' {
+    interface IRbacAsyncStorage {
+        /**
+         * Set by TokenAuthMiddleware when the request carries a valid access token.
+         */
+        TokenAuth?: ITokenAuthInfo;
+    }
+}
+/**
+ * The http request-local storage is a SEPARATE interface from rbac's
+ * `IRbacAsyncStorage` ( `@spinajs/rbac-http` augments it the same way with
+ * User / Session / ActiveRole ), so the marker has to be declared on both -
+ * the one above for rbac's execution context, this one for `req.storage`.
+ */
+declare module '@spinajs/http' {
+    interface IActionLocalStoregeContext {
+        /**
+         * Set by TokenAuthMiddleware when the request carries a valid access token.
+         */
+        TokenAuth?: ITokenAuthInfo;
+    }
+}
+//# sourceMappingURL=interfaces.d.ts.map

package/lib/mjs/interfaces.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.d.ts","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,eAAe;IAC9B;;OAEG;IACH,SAAS,EAAE,MAAM,CAAC;IAElB;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,8BAAsB,6BAA6B;IACjD;;OAEG;IACH,SAAgB,QAAQ,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAErD;;OAEG;IACH,SAAgB,IAAI,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAAC;CACjD;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B;;OAEG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,iBAAiB;QACzB;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF;AAED;;;;;GAKG;AACH,OAAO,QAAQ,eAAe,CAAC;IAC7B,UAAU,0BAA0B;QAClC;;WAEG;QACH,SAAS,CAAC,EAAE,cAAc,CAAC;KAC5B;CACF"}

package/lib/mjs/interfaces.js

@@ -0,0 +1,7 @@
+/**
+ * Token generation algorithm. Replaceable via config
+ * `rbac.token.generation.service` - same pattern as `rbac.password.service`.
+ */
+export class AccessTokenGenerationProvider {
+}
+//# sourceMappingURL=interfaces.js.map

package/lib/mjs/interfaces.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interfaces.js","sourceRoot":"","sources":["../../src/interfaces.ts"],"names":[],"mappings":"AAsBA;;;GAGG;AACH,MAAM,OAAgB,6BAA6B;CAUlD"}

package/lib/mjs/middlewares.d.ts

@@ -0,0 +1,76 @@
+import * as express from 'express';
+import { Log } from '@spinajs/log';
+import { Request as sRequest, ServerMiddleware } from '@spinajs/http';
+import { User } from '@spinajs/rbac';
+import './interfaces.js';
+/**
+ * Authenticates requests carrying an access token in `Authorization: Bearer`
+ * or the configured fallback header. Runs AFTER RbacMiddleware ( Order 0 )
+ * so a session, when present, always wins - a request cannot mix both.
+ *
+ * On success `req.storage.User` carries the owner with Role narrowed to the
+ * token's effective roles, so every downstream permission check ( RbacPolicy
+ * helpers, orm rbac query middleware, ownership ) works unchanged.
+ *
+ * `req.storage.ActiveRole` is deliberately CLEARED, and that is load bearing.
+ * Both consumers of the field resolve the roles to authorize with as
+ * `ActiveRole ? [ActiveRole] : User.Role` ( `checkRoutePermission` in
+ * `rbac-http/src/policies/RbacPolicy.ts`, and the orm rbac query middleware in
+ * `rbac/src/middleware.ts` ), so whatever single role sits there collapses the
+ * request down to that one role.
+ *
+ * A session can afford that collapse because it can switch its active role at
+ * runtime ( `POST /auth/active-role` ), so the narrowing is both deliberate and
+ * reversible. A token carries no session and has no way to switch, so picking
+ * one of its roles - the first, arbitrarily - would permanently authorize the
+ * token with a strict subset of what it was issued for: a token holding
+ * `[ 'user', 'admin' ]` would never satisfy an admin-only grant.
+ *
+ * Leaving it undefined makes both consumers fall back to `User.Role`, which the
+ * narrowing above has ALREADY reduced to exactly the effective role set - the
+ * intersection of what the token carries and its owner still holds. That is the
+ * correct authorization scope for a token, and nothing wider.
+ *
+ * The field has to be assigned `undefined` rather than skipped: `RbacMiddleware`
+ * runs first and, on a session-less request, stamps the GUEST account's first
+ * role into it, which would otherwise survive into the token's own request.
+ *
+ * Never throws: an invalid token leaves the request as guest and lets the
+ * route's policy produce the rejection.
+ */
+export declare class TokenAuthMiddleware extends ServerMiddleware {
+    protected Log: Log;
+    protected HeaderName: string;
+    protected LastUsedUpdateInterval: number;
+    constructor();
+    before(): (req: sRequest, res: express.Response, next: express.NextFunction) => void;
+    after(): null;
+    /**
+     * Narrows the loaded owner to the token's effective roles WITHOUT letting the
+     * narrowing reach the database.
+     *
+     * `Role` is a real `@Set()` column, and this very instance is what controllers
+     * receive through the `@User()` route argument. `update()` writes whatever
+     * differs from the model's snapshot, so a controller doing an unrelated edit
+     * ( "change my login" ) and calling `.update()` would silently persist the
+     * narrowed list - permanently stripping every role the token did not carry.
+     *
+     * Re-taking the snapshot right after the narrowing makes it invisible to that
+     * diff: the instance then behaves exactly like a freshly loaded row whose roles
+     * happen to be the effective ones, and a later `.update()` writes only what the
+     * controller itself changed. The full instance is kept rather than copied so
+     * that `Id`, `Password`, the `Metadata` relation and the prototype accessors
+     * ( `IsBanned`, `can()` ) all survive - `dehydrate()` drops the `@Hidden()`
+     * columns, so a dehydrate/rehydrate copy would arrive without `Id`.
+     *
+     * `takeSnapshot()` also discards the relation baselines, which the orm's
+     * subject builder needs to tell an already-persisted related row from a new
+     * one, so they are recorded again immediately.
+     */
+    protected narrowRoles(user: User, roles: string[]): User;
+    /**
+     * Bearer scheme first, configured fallback header second.
+     */
+    protected extract(req: sRequest): string | null;
+}
+//# sourceMappingURL=middlewares.d.ts.map

package/lib/mjs/middlewares.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.d.ts","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,OAAO,IAAI,QAAQ,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,iBAAiB,CAAC;AAQzB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,UAAU,EAAE,MAAM,CAAC;IAG7B,SAAS,CAAC,sBAAsB,EAAE,MAAM,CAAC;IAEzC,cAIC;IAEM,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI,CAkD1F;IAEM,KAAK,IAAI,IAAI,CAEnB;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,SAAS,CAAC,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CASvD;IAED;;OAEG;IACH,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,GAAG,IAAI,CAgB9C;CACF"}

package/lib/mjs/middlewares.js

@@ -0,0 +1,178 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+import { Injectable } from '@spinajs/di';
+import { Config } from '@spinajs/configuration';
+import { Log, Logger } from '@spinajs/log';
+import { ServerMiddleware } from '@spinajs/http';
+import { ErrorCode } from '@spinajs/exceptions';
+import { validateToken, touchToken } from './actions.js';
+import './interfaces.js';
+/**
+ * `Authorization: Bearer <token>`. RFC 7235 makes the scheme name
+ * case-insensitive, and clients do send `bearer`.
+ */
+const BEARER_SCHEME = /^bearer\s+/i;
+/**
+ * Authenticates requests carrying an access token in `Authorization: Bearer`
+ * or the configured fallback header. Runs AFTER RbacMiddleware ( Order 0 )
+ * so a session, when present, always wins - a request cannot mix both.
+ *
+ * On success `req.storage.User` carries the owner with Role narrowed to the
+ * token's effective roles, so every downstream permission check ( RbacPolicy
+ * helpers, orm rbac query middleware, ownership ) works unchanged.
+ *
+ * `req.storage.ActiveRole` is deliberately CLEARED, and that is load bearing.
+ * Both consumers of the field resolve the roles to authorize with as
+ * `ActiveRole ? [ActiveRole] : User.Role` ( `checkRoutePermission` in
+ * `rbac-http/src/policies/RbacPolicy.ts`, and the orm rbac query middleware in
+ * `rbac/src/middleware.ts` ), so whatever single role sits there collapses the
+ * request down to that one role.
+ *
+ * A session can afford that collapse because it can switch its active role at
+ * runtime ( `POST /auth/active-role` ), so the narrowing is both deliberate and
+ * reversible. A token carries no session and has no way to switch, so picking
+ * one of its roles - the first, arbitrarily - would permanently authorize the
+ * token with a strict subset of what it was issued for: a token holding
+ * `[ 'user', 'admin' ]` would never satisfy an admin-only grant.
+ *
+ * Leaving it undefined makes both consumers fall back to `User.Role`, which the
+ * narrowing above has ALREADY reduced to exactly the effective role set - the
+ * intersection of what the token carries and its owner still holds. That is the
+ * correct authorization scope for a token, and nothing wider.
+ *
+ * The field has to be assigned `undefined` rather than skipped: `RbacMiddleware`
+ * runs first and, on a session-less request, stamps the GUEST account's first
+ * role into it, which would otherwise survive into the token's own request.
+ *
+ * Never throws: an invalid token leaves the request as guest and lets the
+ * route's policy produce the rejection.
+ */
+let TokenAuthMiddleware = class TokenAuthMiddleware extends ServerMiddleware {
+    constructor() {
+        super();
+        // After RbacMiddleware ( Order 0 ): session auth takes precedence.
+        this.Order = 1;
+    }
+    before() {
+        return async (req, res, next) => {
+            try {
+                // Session user already authenticated - tokens do not apply.
+                if (req.storage?.Session) {
+                    return next();
+                }
+                const plaintext = this.extract(req);
+                if (!plaintext) {
+                    return next();
+                }
+                let result;
+                try {
+                    result = await validateToken(plaintext);
+                }
+                catch (err) {
+                    // Deliberately vague towards the client; specific in the log. The uuid
+                    // is what makes a rejection actionable ( "which key broke" ) and is
+                    // safe to write down - `validateToken` attaches it as `data.token` on
+                    // every failure past the lookup. The presented plaintext is NEVER
+                    // logged, here or anywhere else.
+                    const data = err instanceof ErrorCode ? err.data : undefined;
+                    this.Log.warn(`Access token rejected: ${err.message}`, { Ip: req.ip, Token: data?.token });
+                    return next();
+                }
+                req.storage.User = this.narrowRoles(result.User, result.EffectiveRoles);
+                req.storage.TokenAuth = { Uuid: result.Token.Uuid };
+                // CLEARED, not merely left alone - see the class docblock for why a
+                // token must carry no active role at all. `RbacMiddleware` has already
+                // run by now and, finding no session, wrote the GUEST user's first role
+                // here ( `rbac-http/src/middlewares.ts`, the `else` branch ). Leaving
+                // that in place would authorize every token request as `guest`.
+                req.storage.ActiveRole = undefined;
+                // Token-authenticated responses must never land in a shared cache.
+                res.setHeader('Cache-Control', 'no-store');
+                // Fire-and-forget throttled usage stamp. A non-Error rejection has no
+                // `.message`; reading one off it would throw inside the handler and
+                // surface as an unhandled rejection.
+                void touchToken(result.Token, this.LastUsedUpdateInterval).catch((err) => this.Log.warn(`Failed to update token LastUsedAt: ${err instanceof Error ? err.message : String(err)}`, { Token: result.Token.Uuid }));
+                next();
+            }
+            catch (err) {
+                next(err);
+            }
+        };
+    }
+    after() {
+        return null;
+    }
+    /**
+     * Narrows the loaded owner to the token's effective roles WITHOUT letting the
+     * narrowing reach the database.
+     *
+     * `Role` is a real `@Set()` column, and this very instance is what controllers
+     * receive through the `@User()` route argument. `update()` writes whatever
+     * differs from the model's snapshot, so a controller doing an unrelated edit
+     * ( "change my login" ) and calling `.update()` would silently persist the
+     * narrowed list - permanently stripping every role the token did not carry.
+     *
+     * Re-taking the snapshot right after the narrowing makes it invisible to that
+     * diff: the instance then behaves exactly like a freshly loaded row whose roles
+     * happen to be the effective ones, and a later `.update()` writes only what the
+     * controller itself changed. The full instance is kept rather than copied so
+     * that `Id`, `Password`, the `Metadata` relation and the prototype accessors
+     * ( `IsBanned`, `can()` ) all survive - `dehydrate()` drops the `@Hidden()`
+     * columns, so a dehydrate/rehydrate copy would arrive without `Id`.
+     *
+     * `takeSnapshot()` also discards the relation baselines, which the orm's
+     * subject builder needs to tell an already-persisted related row from a new
+     * one, so they are recorded again immediately.
+     */
+    narrowRoles(user, roles) {
+        user.Role = roles;
+        user.takeSnapshot();
+        for (const [name] of user.ModelDescriptor?.Relations ?? []) {
+            user.snapshotRelation(name);
+        }
+        return user;
+    }
+    /**
+     * Bearer scheme first, configured fallback header second.
+     */
+    extract(req) {
+        // A header sent twice arrives as an array. Anything that is not a single
+        // string is malformed and has to read as "no token presented" - calling
+        // `.startsWith` / `.trim` on it would throw, and this middleware is
+        // contractually not allowed to turn a bad request into a 500.
+        const header = (name) => {
+            const value = req.headers?.[name];
+            return typeof value === 'string' ? value : null;
+        };
+        const auth = header('authorization');
+        if (auth && BEARER_SCHEME.test(auth)) {
+            return auth.replace(BEARER_SCHEME, '').trim() || null;
+        }
+        return header(this.HeaderName.toLowerCase())?.trim() || null;
+    }
+};
+__decorate([
+    Logger('rbac-http-token'),
+    __metadata("design:type", Log)
+], TokenAuthMiddleware.prototype, "Log", void 0);
+__decorate([
+    Config('rbac.token.headerName', { defaultValue: 'x-api-key' }),
+    __metadata("design:type", String)
+], TokenAuthMiddleware.prototype, "HeaderName", void 0);
+__decorate([
+    Config('rbac.token.lastUsedUpdateInterval', { defaultValue: 60 }),
+    __metadata("design:type", Number)
+], TokenAuthMiddleware.prototype, "LastUsedUpdateInterval", void 0);
+TokenAuthMiddleware = __decorate([
+    Injectable(ServerMiddleware),
+    __metadata("design:paramtypes", [])
+], TokenAuthMiddleware);
+export { TokenAuthMiddleware };
+//# sourceMappingURL=middlewares.js.map

package/lib/mjs/middlewares.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middlewares.js","sourceRoot":"","sources":["../../src/middlewares.ts"],"names":[],"mappings":";;;;;;;;;AACA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAuB,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAGhD,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACzD,OAAO,iBAAiB,CAAC;AAEzB;;;GAGG;AACH,MAAM,aAAa,GAAG,aAAa,CAAC;AAEpC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,gBAAgB;IAUvD;QACE,KAAK,EAAE,CAAC;QACR,mEAAmE;QACnE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAEM,MAAM;QACX,OAAO,KAAK,EAAE,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAChF,IAAI,CAAC;gBACH,4DAA4D;gBAC5D,IAAI,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;oBACzB,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;gBACpC,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,IAAI,MAAM,CAAC;gBACX,IAAI,CAAC;oBACH,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;gBAC1C,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,uEAAuE;oBACvE,oEAAoE;oBACpE,sEAAsE;oBACtE,kEAAkE;oBAClE,iCAAiC;oBACjC,MAAM,IAAI,GAAG,GAAG,YAAY,SAAS,CAAC,CAAC,CAAE,GAAG,CAAC,IAAuC,CAAC,CAAC,CAAC,SAAS,CAAC;oBACjG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA2B,GAAa,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;oBACtG,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;gBAED,GAAG,CAAC,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,cAAc,CAAC,CAAC;gBACxE,GAAG,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;gBAEpD,oEAAoE;gBACpE,uEAAuE;gBACvE,wEAAwE;gBACxE,sEAAsE;gBACtE,gEAAgE;gBAChE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;gBAEnC,mEAAmE;gBACnE,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;gBAE3C,sEAAsE;gBACtE,oEAAoE;gBACpE,qCAAqC;gBACrC,KAAK,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,CAAC,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sCAAsC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAE1N,IAAI,EAAE,CAAC;YACT,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,CAAC,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;IACJ,CAAC;IAEM,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;;;;;OAqBG;IACO,WAAW,CAAC,IAAU,EAAE,KAAe;QAC/C,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAClB,IAAI,CAAC,YAAY,EAAE,CAAC;QAEpB,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe,EAAE,SAAS,IAAI,EAAE,EAAE,CAAC;YAC3D,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACO,OAAO,CAAC,GAAa;QAC7B,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,8DAA8D;QAC9D,MAAM,MAAM,GAAG,CAAC,IAAY,EAAiB,EAAE;YAC7C,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QAClD,CAAC,CAAC;QAEF,MAAM,IAAI,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC;QACrC,IAAI,IAAI,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;QACxD,CAAC;QAED,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;IAC/D,CAAC;CACF,CAAA;AA3HW;IADT,MAAM,CAAC,iBAAiB,CAAC;8BACX,GAAG;gDAAC;AAGT;IADT,MAAM,CAAC,uBAAuB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC;;uDAClC;AAGnB;IADT,MAAM,CAAC,mCAAmC,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;;mEACzB;AAR9B,mBAAmB;IAD/B,UAAU,CAAC,gBAAgB,CAAC;;GAChB,mBAAmB,CA6H/B"}

package/lib/mjs/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.d.ts

@@ -0,0 +1,6 @@
+import { OrmMigration, OrmDriver } from '@spinajs/orm';
+export declare class RbacHttpTokenInitial_2026_08_11_01_00_00 extends OrmMigration {
+    up(connection: OrmDriver): Promise<void>;
+    down(_connection: OrmDriver): Promise<void>;
+}
+//# sourceMappingURL=RbacHttpTokenInitial_2026_08_11_01_00_00.d.ts.map

package/lib/mjs/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"RbacHttpTokenInitial_2026_08_11_01_00_00.d.ts","sourceRoot":"","sources":["../../../src/migrations/RbacHttpTokenInitial_2026_08_11_01_00_00.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,YAAY,EAAE,SAAS,EAAa,MAAM,cAAc,CAAC;AAElE,qBACa,wCAAyC,SAAQ,YAAY;IAC3D,EAAE,CAAC,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAkBpD;IAGY,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAG;CAC5D"}