@stratal/framework 0.0.1

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Stratal Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,88 @@
+# @stratal/framework
+
+Authentication, database ORM, RBAC, guards, and test factories for [Stratal](https://github.com/strataljs/stratal) applications.
+
+[![npm version](https://img.shields.io/npm/v/@stratal/framework)](https://www.npmjs.com/package/@stratal/framework)
+[![CI](https://github.com/strataljs/stratal/actions/workflows/ci.yml/badge.svg)](https://github.com/strataljs/stratal/actions/workflows/ci.yml)
+[![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](https://opensource.org/licenses/MIT)
+[![OpenSSF Scorecard](https://api.securityscorecards.dev/projects/github.com/strataljs/stratal/badge)](https://securityscorecards.dev/viewer/?uri=github.com/strataljs/stratal)
+[![Known Vulnerabilities](https://snyk.io/test/github/strataljs/stratal/badge.svg)](https://snyk.io/test/github/strataljs/stratal)
+[![npm downloads](https://img.shields.io/npm/dm/@stratal/framework)](https://www.npmjs.com/package/@stratal/framework)
+[![TypeScript](https://img.shields.io/badge/TypeScript-5-blue?logo=typescript&logoColor=white)](https://www.typescriptlang.org/)
+[![Bundle size](https://img.shields.io/bundlephobia/minzip/@stratal/framework)](https://bundlephobia.com/package/@stratal/framework)
+[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](https://github.com/strataljs/stratal/pulls)
+[![GitHub stars](https://img.shields.io/github/stars/strataljs/stratal?style=social)](https://github.com/strataljs/stratal)
+
+## Modules
+
+- **AuthModule** — Better Auth integration with session management and middleware
+- **DatabaseModule** — ZenStack ORM with support for multiple named connections
+- **RbacModule** — Casbin-based role-based access control with ZenStack policy adapter
+- **AuthGuard** — Authentication and scoped authorization guard for route protection
+- **AuthContext** — Request-scoped user context for accessing the authenticated user
+- **Factory** — Test data factories with sequenced attributes powered by Faker.js
+
+## Installation
+
+```bash
+npm install @stratal/framework
+# or
+yarn add @stratal/framework
+```
+
+### Peer dependencies
+
+| Package | Required |
+|---|---|
+| `stratal` | Yes |
+| `@zenstackhq/orm` | Yes |
+| `pg` | Yes |
+| `better-auth` | No — needed for `AuthModule` |
+| `@better-auth/core` | No — needed for `AuthModule` |
+| `@zenstackhq/better-auth` | No — needed for `AuthModule` |
+| `casbin` | No — needed for `RbacModule` |
+| `@faker-js/faker` | No — needed for `Factory` |
+
+### AI Agent Skills
+
+Stratal provides [Agent Skills](https://agentskills.io) for AI coding assistants like Claude Code and Cursor. Install to give your AI agent knowledge of Stratal patterns, conventions, and APIs:
+
+```bash
+npx skills add strataljs/stratal
+```
+
+## Quick Start
+
+```typescript
+import { Module } from 'stratal/module'
+import { StratalWorker } from 'stratal/worker'
+import { type ApplicationConfig } from 'stratal'
+import { AuthModule } from '@stratal/framework/auth'
+import { DatabaseModule } from '@stratal/framework/database'
+import { RbacModule } from '@stratal/framework/rbac'
+
+@Module({
+  imports: [
+    DatabaseModule.forRoot({
+      connections: [{ name: 'default', connectionString: 'DATABASE_URL' }],
+    }),
+    AuthModule.forRoot(),
+    RbacModule.forRoot({ model: MODEL }),
+  ],
+})
+class AppModule {}
+
+export default class Backend extends StratalWorker {
+  protected configure(): ApplicationConfig {
+    return { module: AppModule }
+  }
+}
+```
+
+## Documentation
+
+Full guides and examples are available at **[stratal.dev](https://stratal.dev)**.
+
+## License
+
+MIT

package/dist/auth/auth.module.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Auth Module
+ *
+ * Provides configurable authentication using Better Auth.
+ * Use `withRootAsync` to configure Better Auth options from the application layer.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   imports: [
+ *     AuthModule.withRootAsync({
+ *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],
+ *       useFactory: (db, config) => createAuthOptions(db, config)
+ *     })
+ *   ]
+ * })
+ * export class AppModule {}
+ * ```
+ */
+import type { BetterAuthOptions } from 'better-auth';
+import type { MiddlewareConfigurable, MiddlewareConsumer } from 'stratal/middleware';
+import type { AsyncModuleOptions, DynamicModule } from 'stratal/module';
+export declare class AuthModule implements MiddlewareConfigurable {
+    /**
+     * Configure auth middleware.
+     *
+     * Registers middlewares in order:
+     * 1. AuthContextMiddleware - Creates and registers AuthContext in request container
+     * 2. SessionVerificationMiddleware - Verifies session and populates AuthContext with userId
+     */
+    configure(consumer: MiddlewareConsumer): void;
+    /**
+     * Configure AuthModule with async options factory
+     */
+    static withRootAsync<TOptions extends BetterAuthOptions>(options: AsyncModuleOptions<TOptions>): DynamicModule;
+}
+//# sourceMappingURL=auth.module.d.ts.map

package/dist/auth/auth.module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.d.ts","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAA;AAEpF,OAAO,KAAK,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAMvE,qBAGa,UAAW,YAAW,sBAAsB;IACvD;;;;;;OAMG;IACH,SAAS,CAAC,QAAQ,EAAE,kBAAkB,GAAG,IAAI;IAU7C;;OAEG;IACH,MAAM,CAAC,aAAa,CAAC,QAAQ,SAAS,iBAAiB,EACrD,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,GACpC,aAAa;CAgBjB"}

package/dist/auth/auth.module.js

@@ -0,0 +1,74 @@
+/**
+ * Auth Module
+ *
+ * Provides configurable authentication using Better Auth.
+ * Use `withRootAsync` to configure Better Auth options from the application layer.
+ *
+ * @example
+ * ```typescript
+ * @Module({
+ *   imports: [
+ *     AuthModule.withRootAsync({
+ *       inject: [DI_TOKENS.Database, CONFIG_TOKENS.ConfigService],
+ *       useFactory: (db, config) => createAuthOptions(db, config)
+ *     })
+ *   ]
+ * })
+ * export class AppModule {}
+ * ```
+ */
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var AuthModule_1;
+import { Module } from 'stratal/module';
+import { AUTH_OPTIONS, AUTH_SERVICE } from './auth.tokens';
+import { AuthContextMiddleware } from './middleware/auth-context.middleware';
+import { SessionVerificationMiddleware } from './middleware/session-verification.middleware';
+import { AuthService } from './services/auth.service';
+let AuthModule = AuthModule_1 = class AuthModule {
+    /**
+     * Configure auth middleware.
+     *
+     * Registers middlewares in order:
+     * 1. AuthContextMiddleware - Creates and registers AuthContext in request container
+     * 2. SessionVerificationMiddleware - Verifies session and populates AuthContext with userId
+     */
+    configure(consumer) {
+        consumer
+            .apply(AuthContextMiddleware)
+            .forRoutes('*');
+        consumer
+            .apply(SessionVerificationMiddleware)
+            .forRoutes('*');
+    }
+    /**
+     * Configure AuthModule with async options factory
+     */
+    static withRootAsync(options) {
+        return {
+            module: AuthModule_1,
+            providers: [
+                {
+                    provide: AUTH_OPTIONS,
+                    useFactory: options.useFactory,
+                    inject: options.inject
+                },
+                {
+                    provide: AUTH_SERVICE,
+                    useClass: AuthService
+                }
+            ]
+        };
+    }
+};
+AuthModule = AuthModule_1 = __decorate([
+    Module({
+        providers: []
+    })
+], AuthModule);
+export { AuthModule };
+//# sourceMappingURL=auth.module.js.map

package/dist/auth/auth.module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.module.js","sourceRoot":"","sources":["../../src/auth/auth.module.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;;;;;;AAIH,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAA;AAEvC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAE,qBAAqB,EAAE,MAAM,sCAAsC,CAAA;AAC5E,OAAO,EAAE,6BAA6B,EAAE,MAAM,8CAA8C,CAAA;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAA;AAK9C,IAAM,UAAU,kBAAhB,MAAM,UAAU;IACrB;;;;;;OAMG;IACH,SAAS,CAAC,QAA4B;QACpC,QAAQ;aACL,KAAK,CAAC,qBAAqB,CAAC;aAC5B,SAAS,CAAC,GAAG,CAAC,CAAA;QAEjB,QAAQ;aACL,KAAK,CAAC,6BAA6B,CAAC;aACpC,SAAS,CAAC,GAAG,CAAC,CAAA;IACnB,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,aAAa,CAClB,OAAqC;QAErC,OAAO;YACL,MAAM,EAAE,YAAU;YAClB,SAAS,EAAE;gBACT;oBACE,OAAO,EAAE,YAAY;oBACrB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;iBACvB;gBACD;oBACE,OAAO,EAAE,YAAY;oBACrB,QAAQ,EAAE,WAAW;iBACtB;aACF;SACF,CAAA;IACH,CAAC;CACF,CAAA;AAvCY,UAAU;IAHtB,MAAM,CAAC;QACN,SAAS,EAAE,EAAE;KACd,CAAC;GACW,UAAU,CAuCtB"}

package/dist/auth/auth.tokens.d.ts

@@ -0,0 +1,5 @@
+/** Token for AuthService - core authentication service */
+export declare const AUTH_SERVICE: unique symbol;
+/** Token for Better Auth options configuration */
+export declare const AUTH_OPTIONS: unique symbol;
+//# sourceMappingURL=auth.tokens.d.ts.map

package/dist/auth/auth.tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.tokens.d.ts","sourceRoot":"","sources":["../../src/auth/auth.tokens.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,eAAO,MAAM,YAAY,eAAiC,CAAA;AAE1D,kDAAkD;AAClD,eAAO,MAAM,YAAY,eAAiC,CAAA"}

package/dist/auth/auth.tokens.js

@@ -0,0 +1,5 @@
+/** Token for AuthService - core authentication service */
+export const AUTH_SERVICE = Symbol.for('Core.AuthService');
+/** Token for Better Auth options configuration */
+export const AUTH_OPTIONS = Symbol.for('Core.AuthOptions');
+//# sourceMappingURL=auth.tokens.js.map

package/dist/auth/auth.tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.tokens.js","sourceRoot":"","sources":["../../src/auth/auth.tokens.ts"],"names":[],"mappings":"AAAA,0DAA0D;AAC1D,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA;AAE1D,kDAAkD;AAClD,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAA"}

package/dist/auth/errors/auth-errors.d.ts

@@ -0,0 +1,74 @@
+import { ApplicationError } from 'stratal/errors';
+export declare class UserNotFoundError extends ApplicationError {
+    constructor(email?: string);
+}
+export declare class InvalidCredentialsError extends ApplicationError {
+    constructor();
+}
+export declare class InvalidPasswordError extends ApplicationError {
+    constructor();
+}
+export declare class InvalidEmailError extends ApplicationError {
+    constructor(email?: string);
+}
+export declare class SessionExpiredError extends ApplicationError {
+    constructor();
+}
+export declare class EmailNotVerifiedError extends ApplicationError {
+    constructor(email?: string);
+}
+export declare class PasswordTooShortError extends ApplicationError {
+    constructor(minLength: number);
+}
+export declare class PasswordTooLongError extends ApplicationError {
+    constructor(maxLength: number);
+}
+export declare class AccountAlreadyExistsError extends ApplicationError {
+    constructor(email?: string);
+}
+export declare class FailedToCreateUserError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class FailedToCreateSessionError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class FailedToUpdateUserError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class SocialAccountLinkedError extends ApplicationError {
+    constructor(provider?: string);
+}
+export declare class CannotUnlinkLastAccountError extends ApplicationError {
+    constructor();
+}
+export declare class ProviderNotFoundError extends ApplicationError {
+    constructor(provider?: string);
+}
+export declare class UserEmailNotFoundError extends ApplicationError {
+    constructor();
+}
+export declare class AccountNotFoundError extends ApplicationError {
+    constructor();
+}
+export declare class CredentialAccountNotFoundError extends ApplicationError {
+    constructor();
+}
+export declare class UserAlreadyHasPasswordError extends ApplicationError {
+    constructor();
+}
+export declare class EmailCannotBeUpdatedError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class FailedToGetSessionError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class FailedToGetUserInfoError extends ApplicationError {
+    constructor(reason?: string);
+}
+export declare class IdTokenNotSupportedError extends ApplicationError {
+    constructor();
+}
+export declare class TokenExpiredError extends ApplicationError {
+    constructor();
+}
+//# sourceMappingURL=auth-errors.d.ts.map

package/dist/auth/errors/auth-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.d.ts","sourceRoot":"","sources":["../../../src/auth/errors/auth-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAA;AAE9D,qBAAa,iBAAkB,SAAQ,gBAAgB;gBACzC,KAAK,CAAC,EAAE,MAAM;CAG3B;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;;CAI5D;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;;CAIzD;AAED,qBAAa,iBAAkB,SAAQ,gBAAgB;gBACzC,KAAK,CAAC,EAAE,MAAM;CAG3B;AAED,qBAAa,mBAAoB,SAAQ,gBAAgB;;CAIxD;AAED,qBAAa,qBAAsB,SAAQ,gBAAgB;gBAC7C,KAAK,CAAC,EAAE,MAAM;CAG3B;AAED,qBAAa,qBAAsB,SAAQ,gBAAgB;gBAC7C,SAAS,EAAE,MAAM;CAG9B;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;gBAC5C,SAAS,EAAE,MAAM;CAG9B;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;gBACjD,KAAK,CAAC,EAAE,MAAM;CAG3B;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;gBAC/C,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,0BAA2B,SAAQ,gBAAgB;gBAClD,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;gBAC/C,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,wBAAyB,SAAQ,gBAAgB;gBAChD,QAAQ,CAAC,EAAE,MAAM;CAG9B;AAED,qBAAa,4BAA6B,SAAQ,gBAAgB;;CAIjE;AAED,qBAAa,qBAAsB,SAAQ,gBAAgB;gBAC7C,QAAQ,CAAC,EAAE,MAAM;CAG9B;AAED,qBAAa,sBAAuB,SAAQ,gBAAgB;;CAI3D;AAED,qBAAa,oBAAqB,SAAQ,gBAAgB;;CAIzD;AAED,qBAAa,8BAA+B,SAAQ,gBAAgB;;CAInE;AAED,qBAAa,2BAA4B,SAAQ,gBAAgB;;CAIhE;AAED,qBAAa,yBAA0B,SAAQ,gBAAgB;gBACjD,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,uBAAwB,SAAQ,gBAAgB;gBAC/C,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,wBAAyB,SAAQ,gBAAgB;gBAChD,MAAM,CAAC,EAAE,MAAM;CAG5B;AAED,qBAAa,wBAAyB,SAAQ,gBAAgB;;CAI7D;AAED,qBAAa,iBAAkB,SAAQ,gBAAgB;;CAItD"}

package/dist/auth/errors/auth-errors.js

@@ -0,0 +1,122 @@
+import { ApplicationError, ERROR_CODES } from 'stratal/errors';
+export class UserNotFoundError extends ApplicationError {
+    constructor(email) {
+        super('errors.auth.userNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, email ? { email } : undefined);
+    }
+}
+export class InvalidCredentialsError extends ApplicationError {
+    constructor() {
+        super('errors.auth.invalidCredentials', ERROR_CODES.AUTH.INVALID_CREDENTIALS);
+    }
+}
+export class InvalidPasswordError extends ApplicationError {
+    constructor() {
+        super('errors.auth.invalidPassword', ERROR_CODES.AUTH.INVALID_CREDENTIALS);
+    }
+}
+export class InvalidEmailError extends ApplicationError {
+    constructor(email) {
+        super('errors.auth.invalidEmail', ERROR_CODES.VALIDATION.INVALID_FORMAT, email ? { email } : undefined);
+    }
+}
+export class SessionExpiredError extends ApplicationError {
+    constructor() {
+        super('errors.auth.sessionExpired', ERROR_CODES.AUTH.SESSION_EXPIRED);
+    }
+}
+export class EmailNotVerifiedError extends ApplicationError {
+    constructor(email) {
+        super('errors.auth.emailNotVerified', ERROR_CODES.AUTH.EMAIL_NOT_VERIFIED, email ? { email } : undefined);
+    }
+}
+export class PasswordTooShortError extends ApplicationError {
+    constructor(minLength) {
+        super('errors.auth.passwordTooShort', ERROR_CODES.AUTH.PASSWORD_TOO_SHORT, { minLength });
+    }
+}
+export class PasswordTooLongError extends ApplicationError {
+    constructor(maxLength) {
+        super('errors.auth.passwordTooLong', ERROR_CODES.AUTH.PASSWORD_TOO_LONG, { maxLength });
+    }
+}
+export class AccountAlreadyExistsError extends ApplicationError {
+    constructor(email) {
+        super('errors.auth.accountAlreadyExists', ERROR_CODES.AUTH.ACCOUNT_ALREADY_EXISTS, email ? { email } : undefined);
+    }
+}
+export class FailedToCreateUserError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.failedToCreateUser', ERROR_CODES.AUTH.FAILED_TO_CREATE_USER, reason ? { reason } : undefined);
+    }
+}
+export class FailedToCreateSessionError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.failedToCreateSession', ERROR_CODES.AUTH.FAILED_TO_CREATE_SESSION, reason ? { reason } : undefined);
+    }
+}
+export class FailedToUpdateUserError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.failedToUpdateUser', ERROR_CODES.AUTH.FAILED_TO_UPDATE_USER, reason ? { reason } : undefined);
+    }
+}
+export class SocialAccountLinkedError extends ApplicationError {
+    constructor(provider) {
+        super('errors.auth.socialAccountLinked', ERROR_CODES.AUTH.SOCIAL_ACCOUNT_LINKED, provider ? { provider } : undefined);
+    }
+}
+export class CannotUnlinkLastAccountError extends ApplicationError {
+    constructor() {
+        super('errors.auth.cannotUnlinkLastAccount', ERROR_CODES.AUTH.CANNOT_UNLINK_LAST_ACCOUNT);
+    }
+}
+export class ProviderNotFoundError extends ApplicationError {
+    constructor(provider) {
+        super('errors.auth.providerNotFound', ERROR_CODES.RESOURCE.NOT_FOUND, provider ? { provider } : undefined);
+    }
+}
+export class UserEmailNotFoundError extends ApplicationError {
+    constructor() {
+        super('errors.auth.userEmailNotFound', ERROR_CODES.RESOURCE.NOT_FOUND);
+    }
+}
+export class AccountNotFoundError extends ApplicationError {
+    constructor() {
+        super('errors.auth.accountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND);
+    }
+}
+export class CredentialAccountNotFoundError extends ApplicationError {
+    constructor() {
+        super('errors.auth.credentialAccountNotFound', ERROR_CODES.RESOURCE.NOT_FOUND);
+    }
+}
+export class UserAlreadyHasPasswordError extends ApplicationError {
+    constructor() {
+        super('errors.auth.userAlreadyHasPassword', ERROR_CODES.RESOURCE.CONFLICT);
+    }
+}
+export class EmailCannotBeUpdatedError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.emailCannotBeUpdated', ERROR_CODES.VALIDATION.GENERIC, reason ? { reason } : undefined);
+    }
+}
+export class FailedToGetSessionError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.failedToGetSession', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined);
+    }
+}
+export class FailedToGetUserInfoError extends ApplicationError {
+    constructor(reason) {
+        super('errors.auth.failedToGetUserInfo', ERROR_CODES.SYSTEM.INTERNAL_ERROR, reason ? { reason } : undefined);
+    }
+}
+export class IdTokenNotSupportedError extends ApplicationError {
+    constructor() {
+        super('errors.auth.invalidToken', ERROR_CODES.VALIDATION.GENERIC);
+    }
+}
+export class TokenExpiredError extends ApplicationError {
+    constructor() {
+        super('errors.auth.tokenExpired', ERROR_CODES.VALIDATION.GENERIC);
+    }
+}
+//# sourceMappingURL=auth-errors.js.map

package/dist/auth/errors/auth-errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-errors.js","sourceRoot":"","sources":["../../../src/auth/errors/auth-errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE9D,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IACrD,YAAY,KAAc;QACxB,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClG,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D;QACE,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/E,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,gBAAgB;IACxD;QACE,KAAK,CAAC,6BAA6B,EAAE,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC5E,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IACrD,YAAY,KAAc;QACxB,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACzG,CAAC;CACF;AAED,MAAM,OAAO,mBAAoB,SAAQ,gBAAgB;IACvD;QACE,KAAK,CAAC,4BAA4B,EAAE,WAAW,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;IACvE,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,gBAAgB;IACzD,YAAY,KAAc;QACxB,KAAK,CAAC,8BAA8B,EAAE,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC3G,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,gBAAgB;IACzD,YAAY,SAAiB;QAC3B,KAAK,CAAC,8BAA8B,EAAE,WAAW,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IAC3F,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,gBAAgB;IACxD,YAAY,SAAiB;QAC3B,KAAK,CAAC,6BAA6B,EAAE,WAAW,CAAC,IAAI,CAAC,iBAAiB,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;IACzF,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,KAAc;QACxB,KAAK,CAAC,kCAAkC,EAAE,WAAW,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACnH,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,MAAe;QACzB,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClH,CAAC;CACF;AAED,MAAM,OAAO,0BAA2B,SAAQ,gBAAgB;IAC9D,YAAY,MAAe;QACzB,KAAK,CAAC,mCAAmC,EAAE,WAAW,CAAC,IAAI,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxH,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,MAAe;QACzB,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAClH,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,gBAAgB;IAC5D,YAAY,QAAiB;QAC3B,KAAK,CAAC,iCAAiC,EAAE,WAAW,CAAC,IAAI,CAAC,qBAAqB,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACvH,CAAC;CACF;AAED,MAAM,OAAO,4BAA6B,SAAQ,gBAAgB;IAChE;QACE,KAAK,CAAC,qCAAqC,EAAE,WAAW,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAA;IAC3F,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,gBAAgB;IACzD,YAAY,QAAiB;QAC3B,KAAK,CAAC,8BAA8B,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC5G,CAAC;CACF;AAED,MAAM,OAAO,sBAAuB,SAAQ,gBAAgB;IAC1D;QACE,KAAK,CAAC,+BAA+B,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACxE,CAAC;CACF;AAED,MAAM,OAAO,oBAAqB,SAAQ,gBAAgB;IACxD;QACE,KAAK,CAAC,6BAA6B,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IACtE,CAAC;CACF;AAED,MAAM,OAAO,8BAA+B,SAAQ,gBAAgB;IAClE;QACE,KAAK,CAAC,uCAAuC,EAAE,WAAW,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAA;IAChF,CAAC;CACF;AAED,MAAM,OAAO,2BAA4B,SAAQ,gBAAgB;IAC/D;QACE,KAAK,CAAC,oCAAoC,EAAE,WAAW,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;IAC5E,CAAC;CACF;AAED,MAAM,OAAO,yBAA0B,SAAQ,gBAAgB;IAC7D,YAAY,MAAe;QACzB,KAAK,CAAC,kCAAkC,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC5G,CAAC;CACF;AAED,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D,YAAY,MAAe;QACzB,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC7G,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,gBAAgB;IAC5D,YAAY,MAAe;QACzB,KAAK,CAAC,iCAAiC,EAAE,WAAW,CAAC,MAAM,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IAC9G,CAAC;CACF;AAED,MAAM,OAAO,wBAAyB,SAAQ,gBAAgB;IAC5D;QACE,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACnE,CAAC;CACF;AAED,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IACrD;QACE,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,CAAC,CAAA;IACnE,CAAC;CACF"}

package/dist/auth/errors/index.d.ts

@@ -0,0 +1,5 @@
+export * from './auth-errors';
+export { InvalidTokenError } from './invalid-token.error';
+export { TokenRequiredError } from './token-required.error';
+export { VerificationFailedError } from './verification-failed.error';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/errors/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/auth/errors/index.js

@@ -0,0 +1,5 @@
+export * from './auth-errors';
+export { InvalidTokenError } from './invalid-token.error';
+export { TokenRequiredError } from './token-required.error';
+export { VerificationFailedError } from './verification-failed.error';
+//# sourceMappingURL=index.js.map

package/dist/auth/errors/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/errors/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAA;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAA;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAA"}

package/dist/auth/errors/invalid-token.error.d.ts

@@ -0,0 +1,5 @@
+import { ApplicationError } from 'stratal/errors';
+export declare class InvalidTokenError extends ApplicationError {
+    constructor();
+}
+//# sourceMappingURL=invalid-token.error.d.ts.map

package/dist/auth/errors/invalid-token.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-token.error.d.ts","sourceRoot":"","sources":["../../../src/auth/errors/invalid-token.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAA;AAE9D,qBAAa,iBAAkB,SAAQ,gBAAgB;;CAItD"}

package/dist/auth/errors/invalid-token.error.js

@@ -0,0 +1,7 @@
+import { ApplicationError, ERROR_CODES } from 'stratal/errors';
+export class InvalidTokenError extends ApplicationError {
+    constructor() {
+        super('errors.auth.invalidToken', ERROR_CODES.AUTH.INVALID_TOKEN);
+    }
+}
+//# sourceMappingURL=invalid-token.error.js.map

package/dist/auth/errors/invalid-token.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invalid-token.error.js","sourceRoot":"","sources":["../../../src/auth/errors/invalid-token.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE9D,MAAM,OAAO,iBAAkB,SAAQ,gBAAgB;IACrD;QACE,KAAK,CAAC,0BAA0B,EAAE,WAAW,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACnE,CAAC;CACF"}

package/dist/auth/errors/token-required.error.d.ts

@@ -0,0 +1,5 @@
+import { ApplicationError } from 'stratal/errors';
+export declare class TokenRequiredError extends ApplicationError {
+    constructor();
+}
+//# sourceMappingURL=token-required.error.d.ts.map

package/dist/auth/errors/token-required.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-required.error.d.ts","sourceRoot":"","sources":["../../../src/auth/errors/token-required.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAA;AAE9D,qBAAa,kBAAmB,SAAQ,gBAAgB;;CAIvD"}

package/dist/auth/errors/token-required.error.js

@@ -0,0 +1,7 @@
+import { ApplicationError, ERROR_CODES } from 'stratal/errors';
+export class TokenRequiredError extends ApplicationError {
+    constructor() {
+        super('errors.auth.tokenRequired', ERROR_CODES.VALIDATION.REQUIRED_FIELD, { field: 'token' });
+    }
+}
+//# sourceMappingURL=token-required.error.js.map

package/dist/auth/errors/token-required.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-required.error.js","sourceRoot":"","sources":["../../../src/auth/errors/token-required.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE9D,MAAM,OAAO,kBAAmB,SAAQ,gBAAgB;IACtD;QACE,KAAK,CAAC,2BAA2B,EAAE,WAAW,CAAC,UAAU,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAA;IAC/F,CAAC;CACF"}

package/dist/auth/errors/verification-failed.error.d.ts

@@ -0,0 +1,5 @@
+import { ApplicationError } from 'stratal/errors';
+export declare class VerificationFailedError extends ApplicationError {
+    constructor();
+}
+//# sourceMappingURL=verification-failed.error.d.ts.map

package/dist/auth/errors/verification-failed.error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failed.error.d.ts","sourceRoot":"","sources":["../../../src/auth/errors/verification-failed.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAe,MAAM,gBAAgB,CAAA;AAE9D,qBAAa,uBAAwB,SAAQ,gBAAgB;;CAI5D"}

package/dist/auth/errors/verification-failed.error.js

@@ -0,0 +1,7 @@
+import { ApplicationError, ERROR_CODES } from 'stratal/errors';
+export class VerificationFailedError extends ApplicationError {
+    constructor() {
+        super('errors.auth.verificationFailed', ERROR_CODES.AUTH.INVALID_CREDENTIALS);
+    }
+}
+//# sourceMappingURL=verification-failed.error.js.map

package/dist/auth/errors/verification-failed.error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verification-failed.error.js","sourceRoot":"","sources":["../../../src/auth/errors/verification-failed.error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAE9D,MAAM,OAAO,uBAAwB,SAAQ,gBAAgB;IAC3D;QACE,KAAK,CAAC,gCAAgC,EAAE,WAAW,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAA;IAC/E,CAAC;CACF"}

package/dist/auth/index.d.ts

@@ -0,0 +1,7 @@
+export * from './auth.module';
+export * from './auth.tokens';
+export * from './errors';
+export * from './middleware';
+export * from './services';
+export * from './utils';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,SAAS,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,7 @@
+export * from './auth.module';
+export * from './auth.tokens';
+export * from './errors';
+export * from './middleware';
+export * from './services';
+export * from './utils';
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAA;AAC7B,cAAc,eAAe,CAAA;AAC7B,cAAc,UAAU,CAAA;AACxB,cAAc,cAAc,CAAA;AAC5B,cAAc,YAAY,CAAA;AAC1B,cAAc,SAAS,CAAA"}

package/dist/auth/middleware/auth-context.middleware.d.ts

@@ -0,0 +1,12 @@
+import type { Middleware, RouterContext } from 'stratal/router';
+/**
+ * Auth Context Middleware
+ *
+ * Registers AuthContext in the request container at the start of each request.
+ * This MUST run before SessionVerificationMiddleware and any other middleware
+ * that depends on AuthContext.
+ */
+export declare class AuthContextMiddleware implements Middleware {
+    handle(ctx: RouterContext, next: () => Promise<void>): Promise<void>;
+}
+//# sourceMappingURL=auth-context.middleware.d.ts.map

package/dist/auth/middleware/auth-context.middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.middleware.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/auth-context.middleware.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAA;AAG/D;;;;;;GAMG;AACH,qBACa,qBAAsB,YAAW,UAAU;IAChD,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC;CAQ3E"}

package/dist/auth/middleware/auth-context.middleware.js

@@ -0,0 +1,28 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Transient, DI_TOKENS } from 'stratal/di';
+import { AuthContext } from '../../context/auth-context';
+/**
+ * Auth Context Middleware
+ *
+ * Registers AuthContext in the request container at the start of each request.
+ * This MUST run before SessionVerificationMiddleware and any other middleware
+ * that depends on AuthContext.
+ */
+let AuthContextMiddleware = class AuthContextMiddleware {
+    async handle(ctx, next) {
+        const requestContainer = ctx.getContainer();
+        const authContext = new AuthContext();
+        requestContainer.registerValue(DI_TOKENS.AuthContext, authContext);
+        await next();
+    }
+};
+AuthContextMiddleware = __decorate([
+    Transient()
+], AuthContextMiddleware);
+export { AuthContextMiddleware };
+//# sourceMappingURL=auth-context.middleware.js.map

package/dist/auth/middleware/auth-context.middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-context.middleware.js","sourceRoot":"","sources":["../../../src/auth/middleware/auth-context.middleware.ts"],"names":[],"mappings":";;;;;;AAAA,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAEjD,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAA;AAExD;;;;;;GAMG;AAEI,IAAM,qBAAqB,GAA3B,MAAM,qBAAqB;IAChC,KAAK,CAAC,MAAM,CAAC,GAAkB,EAAE,IAAyB;QACxD,MAAM,gBAAgB,GAAG,GAAG,CAAC,YAAY,EAAE,CAAA;QAE3C,MAAM,WAAW,GAAG,IAAI,WAAW,EAAE,CAAA;QACrC,gBAAgB,CAAC,aAAa,CAAC,SAAS,CAAC,WAAW,EAAE,WAAW,CAAC,CAAA;QAElE,MAAM,IAAI,EAAE,CAAA;IACd,CAAC;CACF,CAAA;AATY,qBAAqB;IADjC,SAAS,EAAE;GACC,qBAAqB,CASjC"}

package/dist/auth/middleware/index.d.ts

@@ -0,0 +1,3 @@
+export * from './auth-context.middleware';
+export * from './session-verification.middleware';
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,2BAA2B,CAAA;AACzC,cAAc,mCAAmC,CAAA"}