@tinyrack/issuary-server 0.20.0

package/dist/lib/config/scheduler.d.ts

@@ -0,0 +1,52 @@
+import z from 'zod';
+import type { MikroService } from '../../services/mikro.service.ts';
+import type { Logger } from '../logger.ts';
+export type JobPayload = null | boolean | number | string | readonly JobPayload[] | {
+    readonly [key: string]: JobPayload;
+};
+export interface JobRunContext {
+    logger?: Logger | undefined;
+    signal?: AbortSignal | undefined;
+}
+export interface CronJobSchedule {
+    type: 'cron';
+    expression: string;
+}
+export interface ScheduledJobConfig {
+    id: string;
+    name: string;
+    schedule: CronJobSchedule;
+    handler: (context: JobRunContext) => Promise<void>;
+}
+export interface BackgroundJobConfig<TPayload extends JobPayload = JobPayload> {
+    id: string;
+    name: string;
+    handler: (payload: TPayload, context: JobRunContext) => Promise<void>;
+}
+export interface EnqueueBackgroundJobOptions<TPayload extends JobPayload = JobPayload> {
+    jobId: string;
+    payload: TPayload;
+    runAt?: Date | undefined;
+}
+export interface SchedulerStartOptions {
+    scheduledJobs: readonly ScheduledJobConfig[];
+    backgroundJobs: readonly BackgroundJobConfig[];
+    logger?: Logger;
+}
+export interface SchedulerHandle {
+    stop: () => void | Promise<void>;
+    getNextRunAt?: () => Date | null;
+    enqueue?: <TPayload extends JobPayload>(options: EnqueueBackgroundJobOptions<TPayload>) => Promise<string>;
+}
+export interface SchedulerConfig {
+    cleanupCron?: string | undefined;
+    start: (options: SchedulerStartOptions) => SchedulerHandle | Promise<SchedulerHandle>;
+}
+export interface SchedulerRuntimeContext {
+    mikro: MikroService;
+}
+export type SchedulerConfigResolver = (context: SchedulerRuntimeContext) => SchedulerConfig;
+export type SchedulerRuntimeConfig = SchedulerConfig | SchedulerConfigResolver;
+export declare function isSchedulerConfigResolver(value: SchedulerRuntimeConfig): value is SchedulerConfigResolver;
+export declare const SchedulerConfigSchema: z.ZodOptional<z.ZodCustom<SchedulerRuntimeConfig, SchedulerRuntimeConfig>>;
+//# sourceMappingURL=scheduler.d.ts.map

package/dist/lib/config/scheduler.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.d.ts","sourceRoot":"","sources":["../../../src/lib/config/scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iCAAiC,CAAC;AACpE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,MAAM,MAAM,UAAU,GAClB,IAAI,GACJ,OAAO,GACP,MAAM,GACN,MAAM,GACN,SAAS,UAAU,EAAE,GACrB;IAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,UAAU,CAAA;CAAE,CAAC;AAE3C,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,eAAe,CAAC;IAC1B,OAAO,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,mBAAmB,CAAC,QAAQ,SAAS,UAAU,GAAG,UAAU;IAC3E,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvE;AAED,MAAM,WAAW,2BAA2B,CAC1C,QAAQ,SAAS,UAAU,GAAG,UAAU;IAExC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,QAAQ,CAAC;IAClB,KAAK,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;CAC1B;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,SAAS,kBAAkB,EAAE,CAAC;IAC7C,cAAc,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAC/C,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IACjC,OAAO,CAAC,EAAE,CAAC,QAAQ,SAAS,UAAU,EACpC,OAAO,EAAE,2BAA2B,CAAC,QAAQ,CAAC,KAC3C,OAAO,CAAC,MAAM,CAAC,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,KAAK,EAAE,CACL,OAAO,EAAE,qBAAqB,KAC3B,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;CACjD;AAED,MAAM,WAAW,uBAAuB;IACtC,KAAK,EAAE,YAAY,CAAC;CACrB;AAED,MAAM,MAAM,uBAAuB,GAAG,CACpC,OAAO,EAAE,uBAAuB,KAC7B,eAAe,CAAC;AAErB,MAAM,MAAM,sBAAsB,GAAG,eAAe,GAAG,uBAAuB,CAAC;AAU/E,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,sBAAsB,GAC5B,KAAK,IAAI,uBAAuB,CAElC;AAQD,eAAO,MAAM,qBAAqB,4EAKD,CAAC"}

package/dist/lib/config/scheduler.js

@@ -0,0 +1,20 @@
+import z from 'zod';
+function isSchedulerConfig(value) {
+    if (typeof value !== 'object' || value === null) {
+        return false;
+    }
+    return 'start' in value && typeof value.start === 'function';
+}
+export function isSchedulerConfigResolver(value) {
+    return typeof value === 'function';
+}
+function isSchedulerRuntimeConfig(value) {
+    return isSchedulerConfig(value) || typeof value === 'function';
+}
+export const SchedulerConfigSchema = z
+    .custom(isSchedulerRuntimeConfig, {
+    message: 'Invalid SchedulerConfig: must have a start function or resolver',
+})
+    .optional()
+    .describe('Scheduler adapter.');
+//# sourceMappingURL=scheduler.js.map

package/dist/lib/config/scheduler.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scheduler.js","sourceRoot":"","sources":["../../../src/lib/config/scheduler.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AA0EpB,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,OAAO,IAAI,KAAK,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,KAA6B;IAE7B,OAAO,OAAO,KAAK,KAAK,UAAU,CAAC;AACrC,CAAC;AAED,SAAS,wBAAwB,CAC/B,KAAc;IAEd,OAAO,iBAAiB,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,UAAU,CAAC;AACjE,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAyB,wBAAwB,EAAE;IACxD,OAAO,EAAE,iEAAiE;CAC3E,CAAC;KACD,QAAQ,EAAE;KACV,QAAQ,CAAC,oBAAoB,CAAC,CAAC"}

package/dist/lib/config/security.d.ts

@@ -0,0 +1,11 @@
+import z from 'zod';
+export declare const SECURITY_CONFIG_DEFAULT: {
+    pbkdf2_iterations: number;
+};
+export declare const SecurityConfigSchema: z.ZodObject<{
+    session_secret: z.ZodString;
+    hash_secret: z.ZodString;
+    pbkdf2_iterations: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>>;
+}, z.z.core.$strict>;
+export type SecurityConfig = z.infer<typeof SecurityConfigSchema>;
+//# sourceMappingURL=security.d.ts.map

package/dist/lib/config/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,uBAAuB;;CAEnC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;oBA4D4C,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/lib/config/security.js

@@ -0,0 +1,65 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+import { fromBase64Url } from "../base64url.js";
+export const SECURITY_CONFIG_DEFAULT = {
+    pbkdf2_iterations: 600000,
+};
+export const SecurityConfigSchema = z
+    .object({
+    session_secret: z
+        .string()
+        .min(1)
+        .describe('Hex-encoded secret key for encrypting session cookies (AES-GCM). Must decode to 16, 24, or 32 bytes (32, 48, or 64 hex characters) for AES-128/192/256.')
+        .superRefine((value, ctx) => {
+        if (!/^[0-9a-fA-F]+$/.test(value)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'session_secret must be a valid hex string (only 0-9, a-f, A-F characters)',
+            });
+            return;
+        }
+        if (value.length % 2 !== 0) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'session_secret must have an even number of hex characters',
+            });
+            return;
+        }
+        const byteLength = value.length / 2;
+        if (![16, 24, 32].includes(byteLength)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: `session_secret must decode to 16, 24, or 32 bytes for AES-128/192/256, got ${byteLength} bytes (${value.length} hex characters)`,
+            });
+        }
+    }),
+    hash_secret: z
+        .string()
+        .min(1)
+        .describe('Base64url-encoded 32-byte secret used for HMAC hashing.')
+        .superRefine((value, ctx) => {
+        try {
+            const decoded = fromBase64Url(value);
+            if (decoded.length !== 32) {
+                ctx.addIssue({
+                    code: 'custom',
+                    message: 'hash_secret must be a base64url-encoded 32-byte secret',
+                });
+            }
+        }
+        catch {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'hash_secret must be a valid base64url-encoded secret',
+            });
+        }
+    }),
+    pbkdf2_iterations: z
+        .union([z.string(), z.number()])
+        .pipe(zz.coerceInt().pipe(z.number().int().min(1)))
+        .default(SECURITY_CONFIG_DEFAULT.pbkdf2_iterations)
+        .describe('Number of PBKDF2 iterations for password hashing.'),
+})
+    .strict()
+    .describe('Security configuration for secrets and cryptographic settings.');
+//# sourceMappingURL=security.js.map

package/dist/lib/config/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yJAAyJ,CAC1J;SACA,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2EAA2E;aAC9E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2DAA2D;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8EAA8E,UAAU,WAAW,KAAK,CAAC,MAAM,kBAAkB;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yDAAyD,CAAC;SACnE,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClD,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC"}

package/dist/lib/config/server.d.ts

@@ -0,0 +1,13 @@
+import z from 'zod';
+export declare const SERVER_CONFIG_DEFAULT: {
+    readonly public_origin: "http://localhost:8080";
+    readonly listen_port: 8080;
+    readonly trust_proxy: false;
+};
+export declare const ServerConfigSchema: z.ZodDefault<z.ZodObject<{
+    public_origin: z.ZodDefault<z.ZodURL>;
+    listen_port: z.ZodDefault<z.ZodPipe<z.ZodUnion<[z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>>;
+    trust_proxy: z.ZodPipe<z.ZodDefault<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString, z.ZodArray<z.ZodString>, z.ZodNumber]>>, z.ZodTransform<string | number | boolean | string[], string | number | boolean | string[]>>;
+}, z.z.core.$strict>>;
+export type ServerConfig = z.infer<typeof ServerConfigSchema>;
+//# sourceMappingURL=server.d.ts.map

package/dist/lib/config/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../../src/lib/config/server.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAC;AAuCX,eAAO,MAAM,kBAAkB;;;;qBAkBE,CAAC;AAElC,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/lib/config/server.js

@@ -0,0 +1,57 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+import { isHttpsOrLocalHttpUrl } from "./url-policy.js";
+export const SERVER_CONFIG_DEFAULT = {
+    public_origin: 'http://localhost:8080',
+    listen_port: 8080,
+    trust_proxy: false,
+};
+function isOriginUrl(value) {
+    try {
+        return new URL(value).origin === value && isHttpsOrLocalHttpUrl(value);
+    }
+    catch {
+        return false;
+    }
+}
+const TrustProxySchema = z
+    .union([
+    z.boolean(),
+    z.string(),
+    z.array(z.string()),
+    z.number().int().min(0),
+])
+    .default(SERVER_CONFIG_DEFAULT.trust_proxy)
+    .transform((value) => {
+    if (typeof value === 'string') {
+        if (value === 'true') {
+            return true;
+        }
+        if (value === 'false') {
+            return false;
+        }
+        const num = Number(value);
+        if (!Number.isNaN(num) && String(num) === value) {
+            return num;
+        }
+    }
+    return value;
+})
+    .describe('Trust proxy configuration for X-Forwarded-* headers. ' +
+    'Can be true (trust all), false (trust none), ' +
+    'IP/CIDR string, array of IPs, or number (nth hop)');
+export const ServerConfigSchema = z
+    .object({
+    public_origin: z
+        .url()
+        .refine(isOriginUrl, {
+        message: 'public_origin must be an HTTPS or local HTTP origin URL without credentials, path, query, fragment, or trailing slash',
+    })
+        .default(SERVER_CONFIG_DEFAULT.public_origin)
+        .describe('Public origin for the auth service, used for redirects, emails, and CORS.'),
+    listen_port: zz.PORT.default(SERVER_CONFIG_DEFAULT.listen_port).describe('TCP port to listen on.'),
+    trust_proxy: TrustProxySchema,
+})
+    .strict()
+    .default(SERVER_CONFIG_DEFAULT);
+//# sourceMappingURL=server.js.map

package/dist/lib/config/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../../../src/lib/config/server.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AAExD,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,aAAa,EAAE,uBAAuB;IACtC,WAAW,EAAE,IAAI;IACjB,WAAW,EAAE,KAAK;CACV,CAAC;AAEX,SAAS,WAAW,CAAC,KAAa;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,gBAAgB,GAAG,CAAC;KACvB,KAAK,CAAC;IACL,CAAC,CAAC,OAAO,EAAE;IACX,CAAC,CAAC,MAAM,EAAE;IACV,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IACnB,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CACxB,CAAC;KACD,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC;KAC1C,SAAS,CAAC,CAAC,KAAK,EAAE,EAAE;IACnB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YACrB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;YACtB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,KAAK,EAAE,CAAC;YAChD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC,CAAC;KACD,QAAQ,CACP,uDAAuD;IACrD,+CAA+C;IAC/C,mDAAmD,CACtD,CAAC;AAEJ,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,aAAa,EAAE,CAAC;SACb,GAAG,EAAE;SACL,MAAM,CAAC,WAAW,EAAE;QACnB,OAAO,EACL,uHAAuH;KAC1H,CAAC;SACD,OAAO,CAAC,qBAAqB,CAAC,aAAa,CAAC;SAC5C,QAAQ,CACP,2EAA2E,CAC5E;IACH,WAAW,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,qBAAqB,CAAC,WAAW,CAAC,CAAC,QAAQ,CACtE,wBAAwB,CACzB;IACD,WAAW,EAAE,gBAAgB;CAC9B,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,qBAAqB,CAAC,CAAC"}

package/dist/lib/config/terms.d.ts

@@ -0,0 +1,47 @@
+import z from 'zod';
+/**
+ * Individual term item configuration.
+ */
+export declare const TermsItemSchema: z.ZodObject<{
+    id: z.ZodString;
+    required: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>>;
+    consent_mode: z.ZodDefault<z.ZodEnum<{
+        explicit: "explicit";
+        implicit: "implicit";
+    }>>;
+    version: z.ZodString;
+    content: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"link">;
+        content: z.ZodURL;
+    }, z.z.core.$strict>, z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"text">;
+        content: z.ZodString;
+    }, z.z.core.$strict>]>>>;
+}, z.z.core.$strict>;
+export type TermsItem = z.infer<typeof TermsItemSchema>;
+export declare const TERMS_CONFIG_DEFAULT: TermsItem[];
+/**
+ * Terms configuration schema.
+ */
+export declare const TermsConfigSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    id: z.ZodString;
+    required: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>>;
+    consent_mode: z.ZodDefault<z.ZodEnum<{
+        explicit: "explicit";
+        implicit: "implicit";
+    }>>;
+    version: z.ZodString;
+    content: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"link">;
+        content: z.ZodURL;
+    }, z.z.core.$strict>, z.ZodObject<{
+        title: z.ZodString;
+        type: z.ZodLiteral<"text">;
+        content: z.ZodString;
+    }, z.z.core.$strict>]>>>;
+}, z.z.core.$strict>>>;
+export type TermsConfig = z.infer<typeof TermsConfigSchema>;
+//# sourceMappingURL=terms.d.ts.map

package/dist/lib/config/terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.d.ts","sourceRoot":"","sources":["../../../src/lib/config/terms.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAsCpB;;GAEG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;oBAiCgB,CAAC;AAE7C,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAC;AAExD,eAAO,MAAM,oBAAoB,EAAE,SAAS,EAAO,CAAC;AAEpD;;GAEG;AACH,eAAO,MAAM,iBAAiB;;;;;;;;;;;;;;;;;sBAGe,CAAC;AAE9C,MAAM,MAAM,WAAW,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,iBAAiB,CAAC,CAAC"}

package/dist/lib/config/terms.js

@@ -0,0 +1,71 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+/**
+ * Localized content for a term item.
+ * Each language code maps to a title, type, and content.
+ * Type determines how the content should be interpreted.
+ */
+const TermsLocalizedContentLinkSchema = z
+    .object({
+    title: z.string().min(1).describe('Display title for the term'),
+    type: z.literal('link').describe('Content type: link to external document'),
+    content: z.url().describe('URL to the full terms document'),
+})
+    .strict();
+const TermsLocalizedContentTextSchema = z
+    .object({
+    title: z.string().min(1).describe('Display title for the term'),
+    type: z.literal('text').describe('Content type: inline text'),
+    content: z.string().min(1).describe('Inline text content'),
+})
+    .strict();
+const TermsLocalizedContentSchema = z
+    .union([TermsLocalizedContentLinkSchema, TermsLocalizedContentTextSchema])
+    .describe('Localized content for a term');
+const TERMS_ITEM_CONFIG_DEFAULT = {
+    required: true,
+    consent_mode: 'explicit',
+    content: {},
+};
+/**
+ * Individual term item configuration.
+ */
+export const TermsItemSchema = z
+    .object({
+    id: z
+        .string()
+        .min(1)
+        .regex(/^[a-z0-9-_]+$/, 'ID must be lowercase alphanumeric with - or _')
+        .describe('Unique identifier for the term'),
+    required: z
+        .union([z.boolean(), z.string()])
+        .pipe(zz.COERCE_BOOLEAN)
+        .default(TERMS_ITEM_CONFIG_DEFAULT.required)
+        .describe('Whether agreement to this term is mandatory'),
+    consent_mode: z
+        .enum(['explicit', 'implicit'])
+        .default(TERMS_ITEM_CONFIG_DEFAULT.consent_mode)
+        .describe('Consent mode for this term: ' +
+        '"explicit" shows checkbox requiring user action, ' +
+        '"implicit" means signup implies agreement'),
+    version: z
+        .string()
+        .min(1)
+        .describe('Version string for tracking changes (e.g., "1.0.0")'),
+    content: z
+        .record(z.string(), TermsLocalizedContentSchema)
+        .default(TERMS_ITEM_CONFIG_DEFAULT.content)
+        .describe('Localized content keyed by language code (e.g., "en", "ko"). ' +
+        'Can be omitted for implicit consent terms where content is not displayed.'),
+})
+    .strict()
+    .describe('Individual term configuration');
+export const TERMS_CONFIG_DEFAULT = [];
+/**
+ * Terms configuration schema.
+ */
+export const TermsConfigSchema = z
+    .array(TermsItemSchema)
+    .default(TERMS_CONFIG_DEFAULT)
+    .describe('Terms of service configuration');
+//# sourceMappingURL=terms.js.map

package/dist/lib/config/terms.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"terms.js","sourceRoot":"","sources":["../../../src/lib/config/terms.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAE/C;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,yCAAyC,CAAC;IAC3E,OAAO,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,gCAAgC,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,+BAA+B,GAAG,CAAC;KACtC,MAAM,CAAC;IACN,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,4BAA4B,CAAC;IAC/D,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,2BAA2B,CAAC;IAC7D,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,qBAAqB,CAAC;CAC3D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,MAAM,2BAA2B,GAAG,CAAC;KAClC,KAAK,CAAC,CAAC,+BAA+B,EAAE,+BAA+B,CAAC,CAAC;KACzE,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AAE5C,MAAM,yBAAyB,GAI3B;IACF,QAAQ,EAAE,IAAI;IACd,YAAY,EAAE,UAAU;IACxB,OAAO,EAAE,EAAE;CACZ,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,KAAK,CAAC,eAAe,EAAE,+CAA+C,CAAC;SACvE,QAAQ,CAAC,gCAAgC,CAAC;IAC7C,QAAQ,EAAE,CAAC;SACR,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAChC,IAAI,CAAC,EAAE,CAAC,cAAc,CAAC;SACvB,OAAO,CAAC,yBAAyB,CAAC,QAAQ,CAAC;SAC3C,QAAQ,CAAC,6CAA6C,CAAC;IAC1D,YAAY,EAAE,CAAC;SACZ,IAAI,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;SAC9B,OAAO,CAAC,yBAAyB,CAAC,YAAY,CAAC;SAC/C,QAAQ,CACP,8BAA8B;QAC5B,mDAAmD;QACnD,2CAA2C,CAC9C;IACH,OAAO,EAAE,CAAC;SACP,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,qDAAqD,CAAC;IAClE,OAAO,EAAE,CAAC;SACP,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,2BAA2B,CAAC;SAC/C,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC;SAC1C,QAAQ,CACP,+DAA+D;QAC7D,2EAA2E,CAC9E;CACJ,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,+BAA+B,CAAC,CAAC;AAI7C,MAAM,CAAC,MAAM,oBAAoB,GAAgB,EAAE,CAAC;AAEpD;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,eAAe,CAAC;KACtB,OAAO,CAAC,oBAAoB,CAAC;KAC7B,QAAQ,CAAC,gCAAgC,CAAC,CAAC"}

package/dist/lib/config/tokens.d.ts

@@ -0,0 +1,32 @@
+import z from 'zod';
+export declare const TOKEN_ROTATION_CONFIG_DEFAULT: {
+    readonly enabled: true;
+    readonly interval_days: 30;
+    readonly overlap_days: 7;
+};
+export declare const TOKENS_CONFIG_DEFAULT: {
+    readonly access_token_ttl: 3600;
+    readonly refresh_token_ttl: 2592000;
+    readonly key_rotation: {
+        readonly enabled: true;
+        readonly interval_days: 30;
+        readonly overlap_days: 7;
+    };
+};
+export declare const TokenKeyRotationConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>;
+    interval_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    overlap_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+}, z.z.core.$strict>>;
+export type TokenKeyRotationConfig = z.infer<typeof TokenKeyRotationConfigSchema>;
+export declare const TokensConfigSchema: z.ZodDefault<z.ZodObject<{
+    access_token_ttl: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    refresh_token_ttl: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    key_rotation: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodPipe<z.ZodUnion<readonly [z.ZodBoolean, z.ZodString]>, z.ZodTransform<boolean, string | boolean>>>;
+        interval_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+        overlap_days: z.ZodDefault<z.ZodPipe<z.ZodPipe<z.ZodUnion<readonly [z.ZodString, z.ZodNumber]>, z.ZodTransform<number, string | number>>, z.ZodNumber>>;
+    }, z.z.core.$strict>>;
+}, z.z.core.$strict>>;
+export type TokensConfig = z.infer<typeof TokensConfigSchema>;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/lib/config/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../../src/lib/config/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAGpB,eAAO,MAAM,6BAA6B;;;;CAIhC,CAAC;AAEX,eAAO,MAAM,qBAAqB;;;;;;;;CAIxB,CAAC;AAEX,eAAO,MAAM,4BAA4B;;;;qBAoBS,CAAC;AAEnD,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAC1C,OAAO,4BAA4B,CACpC,CAAC;AAEF,eAAO,MAAM,kBAAkB;;;;;;;;qBAgB6B,CAAC;AAE7D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC"}

package/dist/lib/config/tokens.js

@@ -0,0 +1,47 @@
+import z from 'zod';
+import { zz } from "../../schemas/provider.js";
+export const TOKEN_ROTATION_CONFIG_DEFAULT = {
+    enabled: true,
+    interval_days: 30,
+    overlap_days: 7,
+};
+export const TOKENS_CONFIG_DEFAULT = {
+    access_token_ttl: 3600,
+    refresh_token_ttl: 2592000,
+    key_rotation: TOKEN_ROTATION_CONFIG_DEFAULT,
+};
+export const TokenKeyRotationConfigSchema = z
+    .object({
+    enabled: zz.COERCE_BOOLEAN.default(TOKEN_ROTATION_CONFIG_DEFAULT.enabled).describe('Whether automatic signing key rotation is enabled.'),
+    interval_days: zz
+        .coerceInt()
+        .pipe(z.number().int().min(1))
+        .default(TOKEN_ROTATION_CONFIG_DEFAULT.interval_days)
+        .describe('Number of days between signing key rotations.'),
+    overlap_days: zz
+        .coerceInt()
+        .pipe(z.number().int().min(1))
+        .default(TOKEN_ROTATION_CONFIG_DEFAULT.overlap_days)
+        .describe('Number of days the old key remains valid after rotation for graceful transition.'),
+})
+    .strict()
+    .default(TOKEN_ROTATION_CONFIG_DEFAULT)
+    .describe('Signing key rotation configuration.');
+export const TokensConfigSchema = z
+    .object({
+    access_token_ttl: zz
+        .coerceInt()
+        .pipe(z.number().int().min(60))
+        .default(TOKENS_CONFIG_DEFAULT.access_token_ttl)
+        .describe('Access token time-to-live in seconds.'),
+    refresh_token_ttl: zz
+        .coerceInt()
+        .pipe(z.number().int().min(3600))
+        .default(TOKENS_CONFIG_DEFAULT.refresh_token_ttl)
+        .describe('Refresh token time-to-live in seconds.'),
+    key_rotation: TokenKeyRotationConfigSchema,
+})
+    .strict()
+    .default(TOKENS_CONFIG_DEFAULT)
+    .describe('Token issuance and signing key configuration.');
+//# sourceMappingURL=tokens.js.map

package/dist/lib/config/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../../src/lib/config/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAE/C,MAAM,CAAC,MAAM,6BAA6B,GAAG;IAC3C,OAAO,EAAE,IAAI;IACb,aAAa,EAAE,EAAE;IACjB,YAAY,EAAE,CAAC;CACP,CAAC;AAEX,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACnC,gBAAgB,EAAE,IAAI;IACtB,iBAAiB,EAAE,OAAO;IAC1B,YAAY,EAAE,6BAA6B;CACnC,CAAC;AAEX,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC1C,MAAM,CAAC;IACN,OAAO,EAAE,EAAE,CAAC,cAAc,CAAC,OAAO,CAChC,6BAA6B,CAAC,OAAO,CACtC,CAAC,QAAQ,CAAC,oDAAoD,CAAC;IAChE,aAAa,EAAE,EAAE;SACd,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,OAAO,CAAC,6BAA6B,CAAC,aAAa,CAAC;SACpD,QAAQ,CAAC,+CAA+C,CAAC;IAC5D,YAAY,EAAE,EAAE;SACb,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7B,OAAO,CAAC,6BAA6B,CAAC,YAAY,CAAC;SACnD,QAAQ,CACP,kFAAkF,CACnF;CACJ,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,6BAA6B,CAAC;KACtC,QAAQ,CAAC,qCAAqC,CAAC,CAAC;AAMnD,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,gBAAgB,EAAE,EAAE;SACjB,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;SAC9B,OAAO,CAAC,qBAAqB,CAAC,gBAAgB,CAAC;SAC/C,QAAQ,CAAC,uCAAuC,CAAC;IACpD,iBAAiB,EAAE,EAAE;SAClB,SAAS,EAAE;SACX,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;SAChC,OAAO,CAAC,qBAAqB,CAAC,iBAAiB,CAAC;SAChD,QAAQ,CAAC,wCAAwC,CAAC;IACrD,YAAY,EAAE,4BAA4B;CAC3C,CAAC;KACD,MAAM,EAAE;KACR,OAAO,CAAC,qBAAqB,CAAC;KAC9B,QAAQ,CAAC,+CAA+C,CAAC,CAAC"}

package/dist/lib/config/url-policy.d.ts

@@ -0,0 +1,4 @@
+export declare function isLocalHttpHostname(hostname: string): boolean;
+export declare function isHttpsOrLocalHttpUrl(value: string): boolean;
+export declare function isSecureRedirectUri(value: string): boolean;
+//# sourceMappingURL=url-policy.d.ts.map

package/dist/lib/config/url-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.d.ts","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAeA,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAQ7D;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAY5D;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAU1D"}

package/dist/lib/config/url-policy.js

@@ -0,0 +1,38 @@
+import { parseIPv4 } from '../ip-utils.js';
+function parseUrl(value) {
+    try {
+        return new URL(value);
+    }
+    catch {
+        return null;
+    }
+}
+function isIPv4Loopback(hostname) {
+    const ipv4 = parseIPv4(hostname);
+    return ipv4 !== null && (ipv4 & 0xff000000) === 0x7f000000;
+}
+export function isLocalHttpHostname(hostname) {
+    return (hostname === 'localhost' ||
+        hostname.endsWith('.localhost') ||
+        isIPv4Loopback(hostname) ||
+        hostname === '[::1]' ||
+        hostname === '::1');
+}
+export function isHttpsOrLocalHttpUrl(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    if (url.protocol === 'https:') {
+        return true;
+    }
+    return url.protocol === 'http:' && isLocalHttpHostname(url.hostname);
+}
+export function isSecureRedirectUri(value) {
+    const url = parseUrl(value);
+    if (!url) {
+        return false;
+    }
+    return (!value.includes('*') && url.hash === '' && isHttpsOrLocalHttpUrl(value));
+}
+//# sourceMappingURL=url-policy.js.map

package/dist/lib/config/url-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url-policy.js","sourceRoot":"","sources":["../../../src/lib/config/url-policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAE3C,SAAS,QAAQ,CAAC,KAAa;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,QAAgB;IACtC,MAAM,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,KAAK,UAAU,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,CACL,QAAQ,KAAK,WAAW;QACxB,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;QAC/B,cAAc,CAAC,QAAQ,CAAC;QACxB,QAAQ,KAAK,OAAO;QACpB,QAAQ,KAAK,KAAK,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE5B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,CACL,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,qBAAqB,CAAC,KAAK,CAAC,CACxE,CAAC;AACJ,CAAC"}

package/dist/lib/config/user.d.ts

@@ -0,0 +1,22 @@
+import z from 'zod';
+export declare const UserConfigSchema: z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+    role: z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>;
+}, z.z.core.$strict>;
+export type UserConfig = z.infer<typeof UserConfigSchema>;
+export declare const USER_CONFIGS_DEFAULT: UserConfig[];
+export declare const UserConfigsSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
+    sub: z.ZodString;
+    email: z.ZodString;
+    password: z.ZodString;
+    role: z.ZodEnum<{
+        user: "user";
+        admin: "admin";
+    }>;
+}, z.z.core.$strict>>>;
+//# sourceMappingURL=user.d.ts.map

package/dist/lib/config/user.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.d.ts","sourceRoot":"","sources":["../../../src/lib/config/user.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,eAAO,MAAM,gBAAgB;;;;;;;;oBAc6B,CAAC;AAE3D,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAC;AAE1D,eAAO,MAAM,oBAAoB,EAAE,UAAU,EAAO,CAAC;AAErD,eAAO,MAAM,iBAAiB;;;;;;;;sBAGuB,CAAC"}

package/dist/lib/config/user.js

@@ -0,0 +1,22 @@
+import z from 'zod';
+export const UserConfigSchema = z
+    .object({
+    sub: z
+        .string()
+        .min(1)
+        .max(255)
+        .describe('Unique subject identifier for the user.'),
+    email: z.string().describe('Email address for the user account.'),
+    password: z.string().describe('Plain-text password (hashed at startup).'),
+    role: z
+        .enum(['user', 'admin'])
+        .describe('User role. "admin" grants access to the admin panel.'),
+})
+    .strict()
+    .describe('Pre-provisioned user account configuration.');
+export const USER_CONFIGS_DEFAULT = [];
+export const UserConfigsSchema = z
+    .array(UserConfigSchema)
+    .default(USER_CONFIGS_DEFAULT)
+    .describe('List of pre-provisioned user accounts.');
+//# sourceMappingURL=user.js.map

package/dist/lib/config/user.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user.js","sourceRoot":"","sources":["../../../src/lib/config/user.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,GAAG,EAAE,CAAC;SACH,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,yCAAyC,CAAC;IACtD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,qCAAqC,CAAC;IACjE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,0CAA0C,CAAC;IACzE,IAAI,EAAE,CAAC;SACJ,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACvB,QAAQ,CAAC,sDAAsD,CAAC;CACpE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,6CAA6C,CAAC,CAAC;AAI3D,MAAM,CAAC,MAAM,oBAAoB,GAAiB,EAAE,CAAC;AAErD,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC;KAC/B,KAAK,CAAC,gBAAgB,CAAC;KACvB,OAAO,CAAC,oBAAoB,CAAC;KAC7B,QAAQ,CAAC,wCAAwC,CAAC,CAAC"}