@starklabs/forge 1.3.25-cors.0 → 2.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Musa Stark
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/MIGRATION.md

@@ -0,0 +1,89 @@
+# Migrating from Forge 1.x to 2.0
+
+Most apps need three changes: the entry point, three renamed/changed options, and any code relying on the behaviours below.
+
+## 1. Entry point
+
+```diff
+- import { StarkForge, startServer } from "@starklabs/forge";
+- new StarkForge({ ...options });
+- startServer();
++ import { Forge } from "@starklabs/forge";
++ const forge = new Forge({ ...options });
++ await forge.start();
+```
+
+`StarkForge` and `startServer()` still work (deprecated). The old module-level `app` export is gone: use `forge.app` (an Express instance) before calling `start()`, or `forge.build()` for tests.
+
+The framework no longer calls `process.exit()`. Bad configuration throws a `ConfigurationError` listing **all** problems.
+
+**Removed exports**
+
+| 1.x | 2.0 |
+| --- | --- |
+| `app` | `forge.app` (the Express app of your `Forge` instance) |
+| `getModel({ model, ... })` | `forge.services.data.nativeModel?.("Product")` for the Mongoose model (it returns `unknown`, so cast it), or `forge.services.data.repository("Product")` for the database-agnostic repository. Models exist once the app is built, so call `forge.build()` (or `await forge.start()`) first. Inside an action, use `ctx.Model` or `ctx.repository`. |
+| `getItem({ model, _id, ... })` | `await forge.services.data.repository("Product").findById(id)` (or `.find({})`). Inside an action, `ctx.repository.findById(id)`. |
+
+## 2. Options
+
+| 1.x | 2.0 |
+| --- | --- |
+| `maxReqLimit: 999999…` | default `100` per window; add `authMaxReqLimit` (default 20) for credential endpoints |
+| `"0s"` duration meant 1 second | means 0 |
+| `jwtSecret` any length | at least 32 characters (`generateJWTSecret()`) |
+| `masterKey` any string | base64 32-byte key (`generateMasterKey()`, which now **returns** the key) |
+| `frontendURL(s)` accepted but **unused** | now configure CORS (with credentials) and the CSRF origin check; `corsConfig` still overrides |
+| password ≥ 6 | password 8–128 (existing users with shorter passwords can still log in) |
+| `domain` (cookie domain, required and applied only in production) | `builtinConfig.auth.cookie.domain`. The old `domain` option still works in production and logs a deprecation warning; outside production it is ignored, as before. Host-only cookies (no `domain`) are now the default and the safest choice. |
+
+New: `adminRoles`, `protectedFields`, `trustProxy`, `bodyLimit`, `defaultPageSize`/`maxPageSize`, `uploadMaxFileSize`/`uploadMaxFiles`, `rateLimitStore`, `exposeErrorDetails`, `auth.otp.*`, `auth.refreshReuseGracePeriod`, `auth.cookie.*`.
+
+## 3. Behaviour changes
+
+**API surface**
+- `POST /auth/verify-otp` and `reset-password` are public. The 1.x built-in routes declared them `authenticated`, although the caller has no session yet at that point.
+- The `GET` variants of `/auth/logout` and `/auth/refresh-token` are removed (the `POST` ones stay). State-changing GETs are CSRF-able. Logout no longer needs a valid access token.
+- `POST /auth/reset-password` takes `{ email, resetToken, password }`. `resetToken` is returned by `verify-otp` for `purpose: "password_reset"`.
+- `POST /auth/forgot-password` always answers 200.
+- `GET` list routes return `{ data, meta }` and **paginate** (`page`, `limit`, `sort`). An empty collection is `200 []`, not 404.
+- Validation failures are **422** (1.x used 409); malformed ids and JSON are 400; duplicate keys are 409; server misconfiguration is 500 (1.x used 404/409).
+- Every error carries a `code`; see the README table.
+- Updating a profile password requires `currentPassword`, and closes all sessions.
+
+**Data**
+- `populate` returns only `_id` by default; set `config.populateSelect: "_id name"` to return more.
+- Password fields use `select: false`; query them explicitly with `{ withSecrets: ["password"] }`.
+- OTP codes and pending sign-ups live in a `ForgeOtpRequest` collection (TTL-indexed), and refresh tokens in `ForgeRefreshToken` (SHA-256 hashed). Old 1.x token/OTP collections are not read; users must sign in again once.
+- Stored password hashes keep working and are upgraded on next login. Encrypted fields keep the same stored format.
+
+**Actions**
+- Hooks are `{ customAction }` / `{ emailAction }`. The context gained `operation`, `item`, `result`, `repository`.
+- `after` hooks no longer fail the request; failures are logged. All hooks are awaited.
+- E-mail template values are HTML-escaped. If you relied on passing HTML in a template field, use `type: "raw"` with `rawBody`.
+
+**Access control**
+- `admin-or-owner` list routes return only the caller's documents (1.x returned everything when the first item matched).
+- `role` (and any `protectedFields`) can only be set by administrators, including at signup.
+- `removeAll` is rejected at startup unless the route is `admin`/`admin-or-owner`.
+- Admin checks use `adminRoles` instead of the literal `"admin"`.
+
+**The role check (`checkAdmin`) is renamed and fixed**
+- 1.x: `checkAdmin` at `GET /admin/check`, admins only, returned `{ role }`. The name was wrong (it reported *any* role) and the admin-only route meant non-admins could never ask for theirs.
+- 2.0: `checkRole` at `GET /account/role`, **any signed-in user, any role**, returns `{ role, isAdmin }`; `404 ROLE_NOT_FOUND` if the account has no role.
+- Still working, but deprecated (a warning is logged at startup): `builtinConfig.admin` (`GET /admin/check`, now also returns `{ role, isAdmin }`), `type: "admin"` collections, and the handler name `checkAdmin`. Rename `checkAdmin` to `checkRole`, and move it to a `type: "account"` collection.
+- The `AuthRole` type is now `AccessLevel`; `AuthRole` remains as a deprecated alias.
+- New: `roles: [...]` on any route restricts it to specific roles (see the README).
+- New startup check: routes that need a role (`roles`, `auth: "admin"`, `"admin-or-owner"`) are refused when `auth.verifyAccessUser` is `false`, which in 1.x silently locked every admin out.
+
+## 4. New: social sign-in
+
+Optional and additive: add `auth.oauth` (see the README) to enable "Sign in with Google / GitHub" and your own providers. It adds three `GET` routes and a `ForgeOAuthIdentity` collection; nothing changes for apps that do not configure it.
+
+## 5. New: magic link and two-factor
+
+Also optional and additive (`auth.magicLink`, `auth.mfa`; see the README). Enabling `mfa` requires a `masterKey`. Existing sign-in flows behave exactly as before for users who have not turned two-factor on.
+
+## 6. Testing
+
+`@starklabs/forge/testing` replaces the need for a database in tests. See the README.

package/README.md

@@ -0,0 +1,353 @@
+# Forge 2
+
+An object-oriented, TypeScript-first Express framework: declare your data and routes, get a secure, tested API.
+
+```ts
+import { Forge, collection, fields } from "@starklabs/forge";
+import { z } from "zod";
+
+const forge = new Forge({
+  jwtSecret: process.env.JWT_SECRET,
+  mongoDBURI: process.env.MONGODB_URI,
+  isOffline: false,
+  collections: [
+    collection({
+      type: "crud", route: "notes", model: "Note",
+      schema: { title: fields.requiredString, owner: fields.userRef },
+      validations: { create: { title: z.string().min(1) } },
+      routes: [
+        { method: "get",  path: "/", handler: "readAll", auth: "admin-or-owner" },
+        { method: "post", path: "/", handler: "create",  auth: "authenticated", validation: "create" },
+      ],
+    }),
+  ],
+});
+
+await forge.start();            // connects, listens, handles SIGINT/SIGTERM gracefully
+```
+
+See [`examples/server.ts`](examples/server.ts) for a fuller app, and [`MIGRATION.md`](MIGRATION.md) if you are coming from 1.x.
+
+Requires Node 20+, Express 5, Mongoose 9, Zod 4.
+
+## Architecture
+
+Everything is a class with explicit dependencies. There are no module-level singletons, and the framework never calls `process.exit`.
+
+```
+src/
+├─ core/       Forge (lifecycle) · ServiceFactory (wiring) · FeatureModule (base class for features)
+│              AccessPolicy · ActionRunner · FieldTransformer · Pagination · ResponseSanitizer
+├─ config/     ForgeConfig (validated, immutable) · Duration
+├─ errors/     AppError hierarchy · ErrorCode · ErrorTranslator
+├─ security/   PasswordHasher (Argon2id) · CryptoVault (field encryption) · TokenService (JWT) · Totp (RFC 6238)
+├─ data/       Repository / DataSource interfaces · Mongoose implementation · SchemaCompiler
+├─ http/       Authenticator · ErrorHandler · RateLimiters · OriginGuard · InputSanitizer
+├─ auth/       AuthService · SessionService · OtpService · MagicLinkService · MfaService · LoginCompleter
+│              AccountLinkPolicy · UserProvisioner · AuthServices (lazy wiring) · controllers · AuthModule
+├─ oauth/      OAuthProvider (base) · GoogleProvider · GitHubProvider · OAuthProviderRegistry · OAuthService
+├─ crud/       CrudController · FileController · CrudModule        account/ (profile + role check) admin/ (deprecated) health/
+├─ email/      EmailService · TemplateRenderer (45 templates) · providers
+├─ upload/     UploadService · StorageProvider · CloudinaryStorage · FileTypeSniffer
+└─ testing/    InMemoryDataSource · FakeEmailProvider · FakeStorage · createTestForge · TestClient
+```
+
+A request flows: `request-id → helmet → CORS → compression → rate limit → body parsers → cookies → input sanitiser → origin guard → [collection: strict limiter → authenticator → upload parser → handler] → 404 → error handler`.
+
+### Extension points
+
+| To change…             | Implement / subclass                          | Pass it                                  |
+| ---------------------- | --------------------------------------------- | ---------------------------------------- |
+| Database               | `DataSource` + `Repository`                   | `new Forge(opts, { dataSource })`        |
+| E-mail delivery        | `EmailProvider`                               | `new Forge(opts, { emailProvider })`     |
+| File storage           | `StorageProvider` (e.g. S3)                   | `new Forge(opts, { storageProviders })`  |
+| Logging                | `LogSink` with `new Logger(level, sink)`      | `new Forge(opts, { logger })`            |
+| A login provider       | extend `OAuthProvider` (~20 lines)            | `auth.oauth.providers: [new MyProvider(…)]` |
+| A whole new feature    | extend `FeatureModule`                        | `forge.use(new MyModule(forge.services))`|
+| Rate-limit storage     | an `express-rate-limit` `Store` (e.g. Redis)  | `rateLimitStore` option                  |
+
+```ts
+class ReportsModule extends FeatureModule {
+  readonly type = "reports";
+  protected handlers() {
+    return { summary: async (req, res, ctx) => this.services.responses.success(res, { message: "ok", data: {} }) };
+  }
+}
+forge.use(new ReportsModule(forge.services));      // then: collection({ type: "reports", route: "reports", routes: [...] })
+```
+
+## Collections and routes
+
+| `type`    | Handlers                                                                                                   | Default `auth`  |
+| --------- | ---------------------------------------------------------------------------------------------------------- | --------------- |
+| `crud`    | `read` `readAll` `create` `createBulk` `update` `remove` `removeMultiple` `removeAll` `addFile` `updateFile` `deleteFile` | `authenticated` |
+| `auth`    | `signup` `login` `verifyOTP` `resendOTP` `forgotPassword` `resetPassword` `refresh` `logout` `authMethods` `magicLinkRequest` `magicLinkVerify` `oauthProviders` `oauthStart` `oauthCallback` `mfaStatus` `mfaSetup` `mfaEnable` `mfaVerify` `mfaDisable` `mfaRecoveryCodes` | `public`        |
+| `account` | `getMe` `updateMe` `deleteMe` `checkRole`                                                                  | `authenticated` |
+| `admin` *(deprecated)* | `checkRole` (`checkAdmin` is the old name)                                                    | `admin`         |
+| `health`  | `healthGet` `healthPost` `healthPut` `healthPatch` `healthDelete`                                          | `public`        |
+
+`auth` levels (who may call it): `public` · `authenticated` · `admin` · `admin-or-owner` (admins, or the owner of the document).
+`roles` (which kind of user may call it): `roles: ["editor", "admin"]`. See [Roles](#roles).
+
+Route options: `roles`, `validation` (name of a group in `validations`, or `false`), `config` (`populate`, `populateSelect`, `hiddenFields`, `targetField`, `maxBulkSize`), `files`, `encryptedFields`, `decryptedFields`, `hashedFields` (suffix `?` = optional), `actions` (`before` / `after`), `ownership`, `mode`.
+
+Everything is validated **at startup**: unknown handlers, unknown validation names, bad action shapes, `removeAll` on a non-admin route and more are reported together in one `ConfigurationError`.
+
+### Actions
+
+```ts
+actions: {
+  before: [{ customAction: (ctx) => { if (!ctx.user) throw new ForbiddenError({ message: "no" }); } }],   // may abort
+  after:  [
+    { customAction: (ctx) => ({ ...ctx.item, extra: true }) },        // a returned value replaces the response data
+    { emailAction: { from: "system-email-sender", to: "ops@acme.dev", type: "raw", rawBody: "<p>Hi</p>", subject: "New item" } },
+  ],
+}
+```
+
+`after` actions run once the data is saved, so a failure is logged and does not turn a successful write into an error response.
+
+### Pagination
+
+`GET /notes?page=2&limit=20&sort=-createdAt,title` → `{ data: [...], meta: { page, limit, total, pages } }`. Page size is capped by `maxPageSize` (100); `sort` accepts only schema fields.
+
+## Sign-in methods
+
+Every way of signing in is optional, can be combined, and ends in the same place, so the same account rules and second-factor check apply to all of them.
+
+| Method | Enable with | Notes |
+| --- | --- | --- |
+| Password | `auth.signupMode` / `loginMode: "credentials"` | Argon2id, lockout-free but rate limited |
+| Password + e-mailed code | `signupMode` / `loginMode: "otp"` | Code is checked after the password |
+| **Magic link** | `auth.magicLink` | Passwordless, below |
+| Social (Google, GitHub, your own) | `auth.oauth` | See "Social sign-in" |
+| **Authenticator app (2FA)** | `auth.mfa` | A second step after the password / e-mailed code / magic link; below |
+
+`GET /auth/methods` tells the front-end what is enabled: `{ password, magicLink, oauth: [...], mfa }`.
+
+### Magic link
+
+```ts
+auth: {
+  /* … */
+  magicLink: {
+    url: "https://app.example.com/auth/magic",   // front-end page that receives ?token=…  (must be on frontendURL(s))
+    expiresIn: "15m", resendCooldown: "60s",
+    allowSignup: true,                            // unknown e-mail creates an account on first use
+    sameDevice: true,                             // link only works in the browser that asked for it
+  },
+},
+frontendURL: "https://app.example.com",
+```
+
+1. `POST /auth/magic-link` `{ email, name? }`: always answers `200`, whether or not the address has an account.
+2. The user gets an e-mail with `https://app.example.com/auth/magic?token=…`.
+3. Your page reads the token and calls `POST /auth/magic-link/verify` `{ token }`: it answers like a login (`201` for a new account, `200` otherwise, session cookies set). If the user has two-factor on, it answers `{ mfaRequired: true, mfaToken }` instead.
+
+Why it works this way:
+
+- **The link must not sign anyone in by itself.** Mail scanners "click" links with `GET`; if that redeemed or burned the token, the feature would break (or be abused). Redemption is a `POST` from your page, and there is no `GET` route.
+- **No account enumeration.** Same response and same cookie for every address; mail-provider failures are logged, not reported.
+- **Login-CSRF protection** (`sameDevice`): the link is bound to the browser that requested it by an HttpOnly cookie, so an attacker cannot mail *their own* link to a victim and sign them in to the attacker's account. Another browser gets `400 MAGIC_LINK_DEVICE_MISMATCH` *without* burning the link. Turn it off for mobile apps or cross-device use.
+- **256-bit token, stored hashed, single use, 15 minutes.** Redeeming deletes it first, so of two simultaneous attempts exactly one wins. Expired, used and invented links are indistinguishable.
+- **Existing accounts** follow `accountLinking` (`"auto" | "always" | "never"`, same rule as social sign-in): by default a link only signs in to an account whose e-mail was verified at sign-up, because of account pre-hijacking.
+
+### Two-factor authentication (authenticator apps)
+
+```ts
+auth: { /* … */ mfa: { issuer: "Acme" } },
+masterKey: process.env.MASTER_KEY,     // required: authenticator secrets are encrypted at rest
+```
+
+| Step | Route (auth) | |
+| --- | --- | --- |
+| Start | `POST /auth/mfa/totp/setup` (signed in) | returns `{ secret, otpauthUrl }`: render `otpauthUrl` as a QR code |
+| Activate | `POST /auth/mfa/totp/enable` `{ code }` | returns **10 recovery codes, once** |
+| Sign in | any first factor returns `{ mfaRequired: true, mfaToken }`, then `POST /auth/mfa/verify` `{ mfaToken, code }` or `{ mfaToken, recoveryCode }` | session starts here |
+| Status | `GET /auth/mfa` | `{ enabled, recoveryCodesRemaining }` |
+| Disable | `POST /auth/mfa/disable` `{ code }` or `{ recoveryCode }` | needs proof |
+| New recovery codes | `POST /auth/mfa/recovery-codes` `{ code }` or `{ recoveryCode }` | old set stops working |
+
+- Applies to password, e-mailed-code and magic-link sign-ins. No session, cookie or token exists until the second step succeeds.
+- Codes are RFC 6238 (6 digits, 30 s, ±1 step): works with Google Authenticator, Authy, 1Password, etc.
+- **A code works once** (the accepted time step is stored). Wrong codes are counted per account; after `maxAttempts` (5) the factor locks for `lockoutDuration` (5 min) with `429 MFA_LOCKED`, which per-IP limits alone cannot give you against a distributed guess.
+- State changes are compare-and-set, so two simultaneous requests cannot both spend the same code or recovery code.
+- Secrets are encrypted with the master key, recovery codes are stored as hashes, and deleting the account removes them.
+- **Not covered:** social sign-in is not gated by Forge's second factor (the provider's own protections apply). Passkeys/WebAuthn and SMS codes are not included.
+
+### Adding another sign-in method
+
+A method is a service plus one lazy getter. Prove who the user is, then **end in `LoginCompleter.complete(user, req)`**: it decides whether a session starts now or a second factor comes first, so the new method cannot forget it.
+
+```ts
+// 1. src/auth/MyMethodService.ts: verify the credential, find or create the user (UserProvisioner, AccountLinkPolicy)
+return this.completer.complete(user, req, { created });
+// 2. src/auth/AuthServices.ts: add a lazy getter
+// 3. a controller + handler names, and (optionally) built-in routes in BuiltinCollections
+```
+
+## Roles
+
+A user's role is a string on their record (`role: fields.role` gives you `guest · user · moderator · editor · author · support · manager · admin · super_admin · owner`, or use your own). Two things use it.
+
+**1. Restrict a route to specific roles** with `roles`. It is checked after `auth`, so both must pass, and the role is read from the database on every request: promoting or demoting someone takes effect immediately.
+
+```ts
+{ method: "post",   path: "/",              handler: "create", auth: "authenticated", roles: ["editor", "admin"], validation: "create" },
+{ method: "delete", path: "/delete/:id",    handler: "remove", auth: "authenticated", roles: ["moderator"] },
+{ method: "patch",  path: "/update/:id",    handler: "update", auth: "admin-or-owner", roles: ["editor", "admin"] },   // must be an editor/admin AND the owner (or an admin)
+```
+
+- Matching is **exact and case-sensitive**, and admins are **not** implicitly included: list `"admin"` yourself where admins may call the route. (Use `auth: "admin"` for "administrators only"; it means the roles in `adminRoles`, default `["admin"]`.)
+- Anonymous callers get `401`; a signed-in user with the wrong role gets `403 ROLE_NOT_ALLOWED` (the hint listing allowed roles is shown outside production only).
+- Checked **at startup**: `roles` on a `public` route, combined with `auth: "admin"`, empty or malformed, or used with `verifyAccessUser: false` (no role would ever be loaded) is refused with a clear message.
+
+**2. Ask "what is my role?"** with `GET /account/role` (any signed-in user, any role), for example to decide which screens a front-end shows. The server still enforces access on every route; this is information, not authorisation.
+
+```json
+{ "success": true, "message": "Role found successfully.", "data": { "role": "editor", "isAdmin": false } }
+```
+
+`isAdmin` is true when the role is in `adminRoles`. An account with no role gets `404 ROLE_NOT_FOUND` (add `role: fields.role` to the user schema). Inside your own actions the same information is `ctx.user.role`.
+
+> **Renamed in 2.0.** The role check used to be called `checkAdmin` (`GET /admin/check`, admins only) although it returned whatever role the caller had; 2.0 first dropped the role from the response. It is now `checkRole` at `GET /account/role`, open to every role, and returns `{ role, isAdmin }`. The old names (`type: "admin"`, `builtinConfig.admin`, `checkAdmin`) keep working and log a deprecation warning. The `AuthRole` type is now `AccessLevel` (it describes *who may call a route*, not a user's role); the old name is a deprecated alias.
+
+## Social sign-in (Google, GitHub, …)
+
+```ts
+builtinConfig: {
+  auth: {
+    mode: "builtin",
+    /* …mongooseConfig, signupMode… */
+    oauth: {
+      providers: [
+        { provider: "google", clientId: process.env.GOOGLE_ID!, clientSecret: process.env.GOOGLE_SECRET! },
+        { provider: "github", clientId: process.env.GITHUB_ID!, clientSecret: process.env.GITHUB_SECRET! },
+      ],
+      successRedirect: "https://app.example.com/welcome",   // optional: omit to get the session as JSON
+      failureRedirect: "https://app.example.com/login",     // optional: gets ?error=<CODE>
+    },
+  },
+},
+frontendURL: "https://app.example.com",   // redirect targets must be on a configured front-end
+backendURL: "https://api.example.com/api/v1",
+```
+
+Three routes are added to the auth collection automatically:
+
+| Route | Purpose |
+| --- | --- |
+| `GET /auth/oauth/providers` | `[{ name, displayName, url }]`: render your buttons from this |
+| `GET /auth/oauth/:provider[?returnTo=/path]` | link the button to this; it redirects to the provider |
+| `GET /auth/oauth/:provider/callback` | register `<backendURL>/auth/oauth/<provider>/callback` as the redirect/callback URL at the provider |
+
+The callback sets the same session cookies as a password login, then redirects (or returns JSON when no `successRedirect` is set).
+
+**How an account is chosen.** A returning user is recognised by the provider's stable user id. For a first sign-in with an e-mail that already has a local account, `accountLinking` decides:
+
+| `accountLinking` | Behaviour |
+| --- | --- |
+| `"auto"` (default) | Link only if every local e-mail was verified at sign-up (`signupMode: "otp"`). Otherwise `409 ACCOUNT_LINK_BLOCKED`. |
+| `"always"` | Link whenever the provider says the e-mail is verified. |
+| `"never"` | Never link. |
+
+The `auto` default exists because of *account pre-hijacking*: with password sign-up that doesn't verify e-mails, an attacker can register `victim@x.com` first and share the account once the victim signs in with Google. Provider e-mails that are not **verified** are always refused (`403 OAUTH_EMAIL_UNVERIFIED`).
+
+New users get a random, never-disclosed password (they can set one through "forgot password"). If your schema requires more than `name` and `email`, add `userFromProfile: (profile) => ({ username: … })`.
+
+**Security.** Random `state` bound to the browser by a signed, short-lived, HttpOnly `SameSite=Lax` cookie (login-CSRF protection); PKCE (S256) on every provider that supports it; single-use state; only same-site `returnTo` paths and allow-listed redirect origins (no open redirect); provider errors reduced to a short code (no upstream bodies or secrets); no redirects followed while credentials are attached; the endpoints share the strict per-IP limiter.
+
+### Adding another provider
+
+Subclass `OAuthProvider`. The base class does the authorization URL, PKCE, code exchange, timeouts and error mapping; you supply the endpoints and how to read the profile.
+
+```ts
+import { OAuthProvider, type OAuthProfile, type TokenSet } from "@starklabs/forge";
+
+class DiscordProvider extends OAuthProvider {
+  readonly name = "discord";                    // URL segment: /auth/oauth/discord
+  readonly displayName = "Discord";
+  protected readonly authorizationEndpoint = "https://discord.com/oauth2/authorize";
+  protected readonly tokenEndpoint = "https://discord.com/api/oauth2/token";
+  protected readonly defaultScopes = ["identify", "email"] as const;
+
+  async fetchProfile(tokens: TokenSet): Promise<OAuthProfile> {
+    const res = await this.getJson("https://discord.com/api/users/@me", tokens);
+    const me = this.asRecord(res.body);
+    if (!res.ok || typeof me.id !== "string") throw this.failure("profile request", res.status);
+    return { providerUserId: me.id, email: me.email as string, emailVerified: me.verified === true, name: me.username as string };
+  }
+}
+
+oauth: { providers: [google, new DiscordProvider({ clientId, clientSecret })] }
+```
+
+Override `usesPkce = false` for providers that reject PKCE parameters, or `scopeSeparator` / `defaultAuthorizationParams` for provider quirks. Everything else (state, e-mail verification, linking rules, sessions, rate limits) applies to your provider automatically.
+
+## Errors
+
+Every failure has the same shape and a stable, machine-readable `code`:
+
+```json
+{ "success": false, "message": "title: Too small", "code": "VALIDATION_FAILED",
+  "issues": [{ "path": "title", "message": "Too small", "code": "too_small" }], "requestId": "…" }
+```
+
+`hint` and `details` are included outside production (`exposeErrorDetails`). Unexpected errors are logged with their stack and returned as a generic `500`.
+
+| Status | Codes |
+| ------ | ----- |
+| 400 | `BAD_REQUEST` `INVALID_JSON` `INVALID_OBJECT_ID` `INVALID_QUERY` `OTP_INVALID` `OTP_EXPIRED` `RESET_TOKEN_INVALID` `UPLOAD_REQUIRED` `UPLOAD_TOO_MANY_FILES` `UPLOAD_FIELD_NOT_FOUND` `UPLOAD_FAILED` `MAGIC_LINK_INVALID` `MAGIC_LINK_DEVICE_MISMATCH` `MFA_SETUP_REQUIRED` `OAUTH_STATE_INVALID` `OAUTH_CODE_INVALID` `OAUTH_EMAIL_MISSING` `INVALID_EMAIL_SENDER` `INVALID_EMAIL_RECIPIENT` `EMAIL_ACTION_INVALID` |
+| 401 | `ACCESS_TOKEN_MISSING` `ACCESS_TOKEN_INVALID` `ACCESS_TOKEN_EXPIRED` `ACCESS_USER_NOT_FOUND` `REFRESH_TOKEN_MISSING` `REFRESH_TOKEN_INVALID` `REFRESH_TOKEN_EXPIRED` `REFRESH_TOKEN_REVOKED` `REFRESH_TOKEN_REUSED` `REFRESH_TOKEN_ROTATED` `REFRESH_TOKEN_NOT_FOUND` `REFRESH_USER_NOT_FOUND` `INVALID_CREDENTIALS` `MFA_CHALLENGE_INVALID` `MFA_CODE_INVALID` `OAUTH_ACCESS_DENIED` |
+| 403 | `FORBIDDEN` `ADMIN_REQUIRED` `OWNER_REQUIRED` `ROLE_NOT_ALLOWED` `CSRF_ORIGIN_REJECTED` `OAUTH_EMAIL_UNVERIFIED` |
+| 404 | `ROUTE_NOT_FOUND` `RESOURCE_NOT_FOUND` `FILE_NOT_FOUND` `OTP_NOT_FOUND` `USER_NOT_FOUND` `ROLE_NOT_FOUND` `OAUTH_PROVIDER_NOT_FOUND` |
+| 409 | `DUPLICATE_KEY` `USER_ALREADY_EXISTS` `CONFLICT` `ACCOUNT_LINK_BLOCKED` `MFA_ALREADY_ENABLED` `MFA_NOT_ENABLED` |
+| 413 | `PAYLOAD_TOO_LARGE` `UPLOAD_TOO_LARGE` |
+| 415 | `UNSUPPORTED_MEDIA_TYPE` `UPLOAD_INVALID_TYPE` |
+| 422 | `VALIDATION_FAILED` `FIELD_MISSING` |
+| 429 | `MFA_LOCKED` `RATE_LIMITED` `OTP_RESEND_COOLDOWN` `OTP_RESEND_LIMIT` `OTP_ATTEMPTS_EXCEEDED` |
+| 502 | `OAUTH_PROVIDER_ERROR` |
+| 500 / 503 | `INTERNAL_ERROR` `CONFIGURATION_ERROR` `ENCRYPTION_FAILED` `DECRYPTION_FAILED` `EMAIL_TEMPLATE_ERROR` · `DATABASE_UNAVAILABLE` `SERVICE_UNAVAILABLE` `EMAIL_SEND_FAILED` |
+
+Throw the classes (`NotFoundError`, `ForbiddenError`, `ConflictError`…) from your own actions: the status and response shape come for free.
+
+## Security model
+
+- **Passwords**: Argon2id (libsodium). 1.x hashes still verify and are upgraded transparently on the next login. Passwords are 8–128 characters.
+- **Login** answers identically for "no such user" and "wrong password", and burns the same CPU time for unknown accounts.
+- **Tokens**: HS256 pinned, issuer checked, `typ` claim separates access from refresh tokens. The access token is read from `Authorization: Bearer` or its cookie, never from the body.
+- **Sessions**: refresh tokens are stored as SHA-256 hashes and **rotated** on use. Replaying a rotated token (outside a short grace period for racing tabs) revokes the whole session family. Logout and password change/reset revoke sessions.
+- **One-time codes**: CSPRNG, stored as keyed hashes, expire on their own (TTL), limited attempts, resend cooldown and cap. Password reset swaps the code for a separate single-use token.
+- **Authorisation**: `auth` levels plus per-route `roles` (exact match, role read from the database on every request, validated at startup). `admin-or-owner` lists are filtered in the database; single documents are checked individually. `protectedFields` (default `role`) can only be written by admins. The document owner always comes from the session.
+- **Responses**: passwords, hashes, tokens and sealed values are removed everywhere; populated references return `_id` only unless `populateSelect` says otherwise.
+- **Input**: `$operator` / dotted / `__proto__` keys are stripped; every body is parsed through Zod (unknown keys dropped); ids must be 24-hex; sort fields are whitelisted; body size is limited.
+- **Browser**: Helmet, strict CORS (nothing allowed unless you configure origins), CSRF origin check for cookie sessions, HttpOnly cookies, SameSite/Secure defaults by environment, no state-changing GET routes.
+- **Rate limiting**: a global limit plus a stricter, *shared* per-IP limit for sign-up, login, OTP and password-reset.
+- **Magic links & two-factor**: single-use hashed tokens bound to the requesting browser, no enumeration, no GET redemption; TOTP with replay protection, per-account lockout, encrypted secrets, hashed recovery codes (see above).
+- **Social sign-in**: state + PKCE, verified e-mails only, safe account linking, no open redirects (see above).
+- **Uploads**: size/count limits, MIME allow-list, **content sniffing** (a script renamed `.png` is rejected), cleanup of orphaned files on failure.
+- **E-mail**: every template value is HTML-escaped and links are limited to `http(s)`/`mailto`; headers can't be injected; the IP shown in security e-mails comes from `req.ip` (set `trustProxy` behind a load balancer).
+- **Startup**: weak/missing secrets, offline mode in production and `SameSite=None` without `Secure` fail fast.
+
+## Testing your app
+
+```ts
+import { createTestForge } from "@starklabs/forge/testing";
+
+const t = await createTestForge({ collections: [notes] });   // random port, in-memory DB, fake mailer & storage
+const res = await t.client.post("/notes", { title: "hi" });  // cookie-aware fetch client
+t.email.lastCode("a@b.co");                                  // read the OTP the app "sent"
+t.email.lastMagicToken("a@b.co");                            // …or the magic-link token
+new Totp().codeAt(secret);                                   // the code an authenticator app would show
+t.oauth.approve(location, { id: "1", email: "a@b.co" });     // fake Google/GitHub: returns the callback path for a sign-in
+await t.close();
+```
+
+## Development
+
+```bash
+npm test                 # 765 tests
+npm run test:coverage
+npm run typecheck
+npm run build
+```

package/dist/account/AccountController.d.ts

@@ -0,0 +1,18 @@
+import type { Request, Response } from "express";
+import type { RouteContext } from "../core/RouteContext.js";
+import type { Services } from "../core/Services.js";
+/** The signed-in user's own profile: read, update and delete. */
+export declare class AccountController {
+    private readonly services;
+    constructor(services: Services);
+    private get users();
+    private get model();
+    private currentUser;
+    getMe: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    updateMe: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    deleteMe: (req: Request, res: Response, ctx: RouteContext) => Promise<void>;
+    /** Removes everything that could still sign in as, or unlock, the deleted account. */
+    private purgeCredentials;
+    private present;
+}
+//# sourceMappingURL=AccountController.d.ts.map

package/dist/account/AccountController.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountController.d.ts","sourceRoot":"","sources":["../../src/account/AccountController.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEjD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAIpD,iEAAiE;AACjE,qBAAa,iBAAiB;IAChB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAArC,YAA6B,QAAQ,EAAE,QAAQ,EAAI;IAEnD,OAAO,KAAK,KAAK,GAEhB;IAED,OAAO,KAAK,KAAK,GAGhB;YAEa,WAAW;IAQzB,KAAK,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAM3E;IAEF,QAAQ,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAyC9E;IAEF,QAAQ,QAAe,OAAO,OAAO,QAAQ,OAAO,YAAY,KAAG,OAAO,CAAC,IAAI,CAAC,CAe9E;IAEF,sFAAsF;YACxE,gBAAgB;YAQhB,OAAO;CAItB"}

package/dist/account/AccountController.js

@@ -0,0 +1,93 @@
+import { ErrorCode, NotFoundError, UnauthorizedError } from "../errors/index.js";
+import { MAGIC_LINK_MODEL, MFA_FACTOR_MODEL, OAUTH_IDENTITY_MODEL } from "../data/internalModels.js";
+/** The signed-in user's own profile: read, update and delete. */
+export class AccountController {
+    services;
+    constructor(services) {
+        this.services = services;
+    }
+    get users() {
+        return this.services.data.repository(this.model);
+    }
+    get model() {
+        if (!this.services.userModel)
+            throw new Error("The account module needs a user model.");
+        return this.services.userModel;
+    }
+    async currentUser(req, withPassword = false) {
+        const user = await this.users.findById(req.user?._id ?? "", {
+            withSecrets: withPassword ? [this.services.config.auth.fields.password] : undefined,
+        });
+        if (!user)
+            throw new NotFoundError({ message: "Account not found.", code: ErrorCode.USER_NOT_FOUND });
+        return user;
+    }
+    getMe = async (req, res, ctx) => {
+        const user = await this.currentUser(req);
+        this.services.responses.success(res, {
+            message: "Profile fetched successfully.",
+            data: await this.present(ctx, user),
+        });
+    };
+    updateMe = async (req, res, ctx) => {
+        await this.services.actions.runBefore(ctx.route.actions?.before, ctx.actionContext(req, "update"));
+        const passwordField = this.services.config.auth.fields.password;
+        const current = await this.currentUser(req, true);
+        let body = this.services.access.writableBody(ctx.parseBody(req.body), req.user);
+        const changingPassword = typeof body[passwordField] === "string";
+        if (changingPassword) {
+            // A stolen session must not be enough to take over the account.
+            const proof = req.body?.currentPassword;
+            const stored = current[passwordField];
+            if (typeof proof !== "string" || !(await this.services.hasher.verify(proof, stored))) {
+                throw new UnauthorizedError({
+                    message: "Your current password is required to set a new one.",
+                    code: ErrorCode.INVALID_CREDENTIALS,
+                });
+            }
+            body = { ...body, [passwordField]: await this.services.hasher.hash(body[passwordField]) };
+        }
+        body = await this.services.transformer.encrypt(body, ctx.route.encryptedFields);
+        body = await this.services.transformer.hash(body, ctx.route.hashedFields?.filter((f) => f.replace(/\?$/, "") !== passwordField));
+        const updated = await this.users.updateById(current._id, body);
+        if (!updated)
+            throw new NotFoundError({ message: "Account not found.", code: ErrorCode.USER_NOT_FOUND });
+        if (changingPassword) {
+            await this.services.sessions.revokeAll(current._id);
+            this.services.cookies.clear(res);
+        }
+        const item = await this.present(ctx, updated);
+        const replaced = await this.services.actions.runAfter(ctx.route.actions?.after, { ...ctx.actionContext(req, "update", { body }), item, result: item });
+        this.services.responses.success(res, {
+            message: changingPassword ? "Profile updated. Please log in again with your new password." : "Profile updated successfully.",
+            data: replaced ?? item,
+        });
+    };
+    deleteMe = async (req, res, ctx) => {
+        await this.services.actions.runBefore(ctx.route.actions?.before, ctx.actionContext(req, "remove"));
+        const user = await this.currentUser(req);
+        await this.users.deleteById(user._id);
+        await this.services.sessions.revokeAll(user._id);
+        await this.purgeCredentials(user);
+        this.services.cookies.clear(res);
+        const item = await this.present(ctx, user);
+        const replaced = await this.services.actions.runAfter(ctx.route.actions?.after, { ...ctx.actionContext(req, "remove"), item, result: item });
+        this.services.responses.success(res, { message: "Account deleted successfully.", data: replaced ?? item });
+    };
+    /** Removes everything that could still sign in as, or unlock, the deleted account. */
+    async purgeCredentials(user) {
+        const { data } = this.services;
+        if (data.has(MFA_FACTOR_MODEL))
+            await data.repository(MFA_FACTOR_MODEL).deleteMany({ owner: user._id });
+        if (data.has(OAUTH_IDENTITY_MODEL))
+            await data.repository(OAUTH_IDENTITY_MODEL).deleteMany({ owner: user._id });
+        const email = user[this.services.config.auth.fields.email];
+        if (data.has(MAGIC_LINK_MODEL) && typeof email === "string")
+            await data.repository(MAGIC_LINK_MODEL).deleteMany({ email });
+    }
+    async present(ctx, doc) {
+        const plain = await this.services.transformer.decrypt(doc, ctx.route.decryptedFields);
+        return { ...this.services.sanitizer.one(doc, { hiddenFields: ctx.route.config?.hiddenFields }), ...plain };
+    }
+}
+//# sourceMappingURL=AccountController.js.map

package/dist/account/AccountController.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountController.js","sourceRoot":"","sources":["../../src/account/AccountController.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAGjF,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAGrG,iEAAiE;AACjE,MAAM,OAAO,iBAAiB;IACC,QAAQ;IAArC,YAA6B,QAAkB;wBAAlB,QAAQ;IAAa,CAAC;IAEnD,IAAY,KAAK;QACf,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC;IAED,IAAY,KAAK;QACf,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QACxF,OAAO,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;IACjC,CAAC;IAEO,KAAK,CAAC,WAAW,CAAC,GAAY,EAAE,YAAY,GAAG,KAAK;QAC1D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE;YAC1D,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS;SACpF,CAAC,CAAC;QACH,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;QACtG,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QAC9E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,+BAA+B;YACxC,IAAI,EAAE,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;SACpC,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACjF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEnG,MAAM,aAAa,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC;QAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClD,IAAI,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,IAAI,CAA4B,CAAC;QAC3G,MAAM,gBAAgB,GAAG,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,QAAQ,CAAC;QAEjE,IAAI,gBAAgB,EAAE,CAAC;YACrB,gEAAgE;YAChE,MAAM,KAAK,GAAI,GAAG,CAAC,IAA4C,EAAE,eAAe,CAAC;YACjF,MAAM,MAAM,GAAG,OAAO,CAAC,aAAa,CAAuB,CAAC;YAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC;gBACrF,MAAM,IAAI,iBAAiB,CAAC;oBAC1B,OAAO,EAAE,qDAAqD;oBAC9D,IAAI,EAAE,SAAS,CAAC,mBAAmB;iBACpC,CAAC,CAAC;YACL,CAAC;YACD,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC,aAAa,CAAC,EAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAW,CAAC,EAAE,CAAC;QACtG,CAAC;QAED,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAChF,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,aAAa,CAAC,CAAC,CAAC;QAEjI,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,aAAa,CAAC,EAAE,OAAO,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,CAAC,CAAC;QAEzG,IAAI,gBAAgB,EAAE,CAAC;YACrB,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YACpD,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CACnD,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EACxB,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CACtE,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE;YACnC,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,8DAA8D,CAAC,CAAC,CAAC,+BAA+B;YAC5H,IAAI,EAAE,QAAQ,IAAI,IAAI;SACvB,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,QAAQ,GAAG,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,GAAiB,EAAiB,EAAE;QACjF,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QAEnG,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjD,MAAM,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAEjC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CACnD,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,EACxB,EAAE,GAAG,GAAG,CAAC,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAC5D,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC,CAAC;IAC7G,CAAC,CAAC;IAEF,sFAAsF;IAC9E,KAAK,CAAC,gBAAgB,CAAC,IAAS;QACtC,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC;QAC/B,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QACxG,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,oBAAoB,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC,UAAU,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7H,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAiB,EAAE,GAAQ;QAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QACtF,OAAO,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC;IAC7G,CAAC;CACF"}

package/dist/account/AccountModule.d.ts

@@ -0,0 +1,13 @@
+import { FeatureModule, type HandlerFn } from "../core/FeatureModule.js";
+import type { Services } from "../core/Services.js";
+import type { Collection } from "../types/Collection.js";
+/** `type: "account"` collections: the signed-in user's own profile (`/me`) and role (`/role`). */
+export declare class AccountModule extends FeatureModule {
+    readonly type = "account";
+    private readonly controller;
+    private readonly roles;
+    constructor(services: Services);
+    protected handlers(): Readonly<Record<string, HandlerFn>>;
+    prepare(collection: Collection): void;
+}
+//# sourceMappingURL=AccountModule.d.ts.map

package/dist/account/AccountModule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"AccountModule.d.ts","sourceRoot":"","sources":["../../src/account/AccountModule.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,KAAK,SAAS,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAIzD,kGAAkG;AAClG,qBAAa,aAAc,SAAQ,aAAa;IAC9C,QAAQ,CAAC,IAAI,aAAa;IAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAoB;IAC/C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiB;IAEvC,YAAY,QAAQ,EAAE,QAAQ,EAI7B;IAED,SAAS,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAOxD;IAEQ,OAAO,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAU7C;CACF"}