npm - @tinyrack/tinyauth-server - Versions diffs - 0.4.0 → 0.5.0 - Mend

@tinyrack/tinyauth-server 0.4.0 → 0.5.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (176) hide show

package/dist/lib/config/client.d.ts CHANGED Viewed

@@ -10,6 +10,8 @@ export declare const ClientConfigSchema: z.ZodObject<{
     client_id: z.ZodString;
     client_secret: z.ZodOptional<z.ZodString>;
     redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    web_origins: z.ZodDefault<z.ZodArray<z.ZodString>>;
     response_types: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
         code: "code";
         id_token: "id_token";
@@ -18,6 +20,8 @@ export declare const ClientConfigSchema: z.ZodObject<{
         refresh_token: "refresh_token";
         implicit: "implicit";
         authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
     }>>>;
     scope: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
 }, z.z.core.$strict>;
@@ -30,6 +34,8 @@ export declare const ClientConfigsSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
     client_id: z.ZodString;
     client_secret: z.ZodOptional<z.ZodString>;
     redirect_uris: z.ZodArray<z.ZodString>;
+    post_logout_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    web_origins: z.ZodDefault<z.ZodArray<z.ZodString>>;
     response_types: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
         code: "code";
         id_token: "id_token";
@@ -38,6 +44,8 @@ export declare const ClientConfigsSchema: z.ZodDefault<z.ZodArray<z.ZodObject<{
         refresh_token: "refresh_token";
         implicit: "implicit";
         authorization_code: "authorization_code";
+        client_credentials: "client_credentials";
+        "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
     }>>>;
     scope: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
 }, z.z.core.$strict>>>;

package/dist/lib/config/client.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;~~AAwCpB~~;;;GAGG;AACH,eAAO,MAAM,kBAAkB~~;;;;;;;;;;;;;;;;;oBAiG4B~~,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB~~;;;;;;;;;;;;;;;;;sBAGiC~~,CAAC"}
1	+ {"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AA+DpB;;;GAGG;AACH,eAAO,MAAM,kBAAkB;;;;;;;;;;;;;;;;;;;;;oBAkH4B,CAAC;AAE5D,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AAE9D,eAAO,MAAM,sBAAsB,EAAE,YAAY,EAAO,CAAC;AAEzD,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;sBA+BiC,CAAC"}

package/dist/lib/config/client.js CHANGED Viewed

@@ -3,10 +3,27 @@ import { isSecureRedirectUri } from './url-policy.js';
 const RedirectUriSchema = z.string().refine(isSecureRedirectUri, {
     message: 'Redirect URI must use HTTPS or local HTTP and must not contain fragments or wildcards.',
 });
+const WebOriginSchema = z.string().refine((value) => {
+    try {
+        const url = new URL(value);
+        return url.origin === value && isSecureRedirectUri(value);
+    }
+    catch {
+        return false;
+    }
+}, {
+    message: 'Web origin must be an exact URL origin such as https://app.example or http://localhost:3000, with no path, query, fragment, or trailing slash.',
+});
 const OAuthResponseTypeSchema = z.string().pipe(z.enum(['code', 'id_token']));
 const OAuthGrantTypeSchema = z
     .string()
-    .pipe(z.enum(['authorization_code', 'implicit', 'refresh_token']));
+    .pipe(z.enum([
+    'authorization_code',
+    'implicit',
+    'refresh_token',
+    'client_credentials',
+    'urn:ietf:params:oauth:grant-type:device_code',
+]));
 function normalizeScopeList(scope) {
     const trimmed = scope.trim();
     if (/[\t\n\r\f\v]/.test(trimmed)) {
@@ -50,13 +67,21 @@ export const ClientConfigSchema = z
         .describe('OAuth client_id used in authorization requests.'),
     client_secret: z
         .string()
-        .min(1)
+        .min(16)
         .optional()
         .describe('OAuth client_secret for confidential clients. Omit for public clients.'),
     redirect_uris: z
         .array(RedirectUriSchema)
         .nonempty()
         .describe('Allowed redirect URIs after authorization.'),
+    post_logout_redirect_uris: z
+        .array(RedirectUriSchema)
+        .default([])
+        .describe('Allowed redirect URIs after RP-initiated logout.'),
+    web_origins: z
+        .array(WebOriginSchema)
+        .default([])
+        .describe('Allowed browser origins for OAuth CORS requests.'),
     response_types: z
         .array(OAuthResponseTypeSchema)
         .nonempty()
@@ -107,11 +132,46 @@ export const ClientConfigSchema = z
             message: 'Clients that allow grant_type "refresh_token" must also allow "authorization_code".',
         });
     }
+    if (grantTypes.has('client_credentials') && !client.client_secret) {
+        ctx.addIssue({
+            code: 'custom',
+            path: ['client_secret'],
+            message: 'Clients that allow grant_type "client_credentials" must be confidential and define client_secret.',
+        });
+    }
 })
     .describe('OAuth/OIDC client application configuration.');
 export const CLIENT_CONFIGS_DEFAULT = [];
 export const ClientConfigsSchema = z
     .array(ClientConfigSchema)
+    .superRefine((clients, ctx) => {
+    const seenIds = new Map();
+    const seenClientIds = new Map();
+    clients.forEach((client, index) => {
+        const firstIdIndex = seenIds.get(client.id);
+        if (firstIdIndex !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [index, 'id'],
+                message: `OAuth client id must be unique. Duplicate value also appears at clients.${firstIdIndex}.id.`,
+            });
+        }
+        else {
+            seenIds.set(client.id, index);
+        }
+        const firstClientIdIndex = seenClientIds.get(client.client_id);
+        if (firstClientIdIndex !== undefined) {
+            ctx.addIssue({
+                code: 'custom',
+                path: [index, 'client_id'],
+                message: `OAuth client client_id must be unique. Duplicate value also appears at clients.${firstClientIdIndex}.client_id.`,
+            });
+        }
+        else {
+            seenClientIds.set(client.client_id, index);
+        }
+    });
+})
     .default(CLIENT_CONFIGS_DEFAULT)
     .describe('List of registered OAuth/OIDC client applications.');
 //# sourceMappingURL=client.js.map

package/dist/lib/config/client.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;IAC/D,OAAO,EACL,wFAAwF;CAC3F,CAAC,CAAC;AAEH,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9E,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,IAAI,~~CAAC~~,CAAC,CAAC,IAAI,CAAC,~~CAAC,~~oBAAoB,~~EAAE,~~UAAU,~~EAAE,~~eAAe,~~CAAC~~,~~CAAC~~,CAAC,CAAC;~~AAErE~~,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,SAAS,CAAC,kBAAkB,CAAC;KAC7B,IAAI,CACH,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,KAAK,CAAC,GAAG,CAAC;KACV,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAChE;IACE,OAAO,EACL,yEAAyE;CAC5E,CACF,CACJ,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,~~CAAC~~,CAAC;~~SACN~~,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,uBAAuB,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,4DAA4D,CAAC;IACzE,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,sFAAsF,CACvF;IACH,KAAK,EAAE,WAAW,CAAC,QAAQ,CACzB,2EAA2E,CAC5E;CACF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,iFAAiF;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EACL,iFAAiF;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACrC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}
1	+ {"version":3,"file":"client.js","sourceRoot":"","sources":["../../../src/lib/config/client.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAEtD,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,mBAAmB,EAAE;IAC/D,OAAO,EACL,wFAAwF;CAC3F,CAAC,CAAC;AAEH,MAAM,eAAe,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,MAAM,CACvC,CAAC,KAAK,EAAE,EAAE;IACR,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC3B,OAAO,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC,EACD;IACE,OAAO,EACL,gJAAgJ;CACnJ,CACF,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC;AAC9E,MAAM,oBAAoB,GAAG,CAAC;KAC3B,MAAM,EAAE;KACR,IAAI,CACH,CAAC,CAAC,IAAI,CAAC;IACL,oBAAoB;IACpB,UAAU;IACV,eAAe;IACf,oBAAoB;IACpB,8CAA8C;CAC/C,CAAC,CACH,CAAC;AAEJ,SAAS,kBAAkB,CAAC,KAAa;IACvC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACvC,CAAC;AAED,MAAM,WAAW,GAAG,CAAC;KAClB,MAAM,EAAE;KACR,SAAS,CAAC,kBAAkB,CAAC;KAC7B,IAAI,CACH,CAAC;KACE,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,KAAK;KACF,KAAK,CAAC,GAAG,CAAC;KACV,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAChE;IACE,OAAO,EACL,yEAAyE;CAC5E,CACF,CACJ,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,CAAC;IACN,EAAE,EAAE,CAAC;SACF,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,GAAG,CAAC;SACR,QAAQ,CAAC,qCAAqC,CAAC;IAClD,IAAI,EAAE,CAAC;SACJ,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,QAAQ,EAAE,CAAC;SACR,MAAM,EAAE;SACR,QAAQ,EAAE;SACV,QAAQ,CAAC,qCAAqC,CAAC;IAClD,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,iDAAiD,CAAC;IAC9D,aAAa,EAAE,CAAC;SACb,MAAM,EAAE;SACR,GAAG,CAAC,EAAE,CAAC;SACP,QAAQ,EAAE;SACV,QAAQ,CACP,wEAAwE,CACzE;IACH,aAAa,EAAE,CAAC;SACb,KAAK,CAAC,iBAAiB,CAAC;SACxB,QAAQ,EAAE;SACV,QAAQ,CAAC,4CAA4C,CAAC;IACzD,yBAAyB,EAAE,CAAC;SACzB,KAAK,CAAC,iBAAiB,CAAC;SACxB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,eAAe,CAAC;SACtB,OAAO,CAAC,EAAE,CAAC;SACX,QAAQ,CAAC,kDAAkD,CAAC;IAC/D,cAAc,EAAE,CAAC;SACd,KAAK,CAAC,uBAAuB,CAAC;SAC9B,QAAQ,EAAE;SACV,QAAQ,CAAC,4DAA4D,CAAC;IACzE,WAAW,EAAE,CAAC;SACX,KAAK,CAAC,oBAAoB,CAAC;SAC3B,QAAQ,EAAE;SACV,QAAQ,CACP,sFAAsF,CACvF;IACH,KAAK,EAAE,WAAW,CAAC,QAAQ,CACzB,2EAA2E,CAC5E;CACF,CAAC;KACD,MAAM,EAAE;KACR,WAAW,CAAC,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE;IAC3B,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAE/C,IAAI,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EACL,uFAAuF;SAC1F,CAAC,CAAC;IACL,CAAC;IAED,IAAI,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,iFAAiF;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,gBAAgB,CAAC;YACxB,OAAO,EACL,iFAAiF;SACpF,CAAC,CAAC;IACL,CAAC;IAED,IACE,UAAU,CAAC,GAAG,CAAC,eAAe,CAAC;QAC/B,CAAC,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,EACrC,CAAC;QACD,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,aAAa,CAAC;YACrB,OAAO,EACL,qFAAqF;SACxF,CAAC,CAAC;IACL,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,CAAC;QAClE,GAAG,CAAC,QAAQ,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,eAAe,CAAC;YACvB,OAAO,EACL,mGAAmG;SACtG,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC;KACD,QAAQ,CAAC,8CAA8C,CAAC,CAAC;AAI5D,MAAM,CAAC,MAAM,sBAAsB,GAAmB,EAAE,CAAC;AAEzD,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC;KACjC,KAAK,CAAC,kBAAkB,CAAC;KACzB,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,EAAE;IAC5B,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAEhD,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE;QAChC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5C,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC;gBACnB,OAAO,EAAE,2EAA2E,YAAY,MAAM;aACvG,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,MAAM,kBAAkB,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,kBAAkB,KAAK,SAAS,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,KAAK,EAAE,WAAW,CAAC;gBAC1B,OAAO,EAAE,kFAAkF,kBAAkB,aAAa;aAC3H,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC;KACD,OAAO,CAAC,sBAAsB,CAAC;KAC/B,QAAQ,CAAC,oDAAoD,CAAC,CAAC"}

package/dist/lib/config/resolved.d.ts CHANGED Viewed

@@ -221,6 +221,8 @@ export declare const TinyAuthRuntimeConfigSchema: z.ZodObject<{
         client_id: z.ZodString;
         client_secret: z.ZodOptional<z.ZodString>;
         redirect_uris: z.ZodArray<z.ZodString>;
+        post_logout_redirect_uris: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        web_origins: z.ZodDefault<z.ZodArray<z.ZodString>>;
         response_types: z.ZodArray<z.ZodPipe<z.ZodString, z.ZodEnum<{
             code: "code";
             id_token: "id_token";
@@ -229,6 +231,8 @@ export declare const TinyAuthRuntimeConfigSchema: z.ZodObject<{
             refresh_token: "refresh_token";
             implicit: "implicit";
             authorization_code: "authorization_code";
+            client_credentials: "client_credentials";
+            "urn:ietf:params:oauth:grant-type:device_code": "urn:ietf:params:oauth:grant-type:device_code";
         }>>>;
         scope: z.ZodPipe<z.ZodPipe<z.ZodString, z.ZodTransform<string, string>>, z.ZodString>;
     }, z.z.core.$strict>>>;

package/dist/lib/config/resolved.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAqBpB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAyCM,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAC1C,OAAO,2BAA2B,CACnC,CAAC"}
1	+ {"version":3,"file":"resolved.d.ts","sourceRoot":"","sources":["../../../src/lib/config/resolved.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAqBpB,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;oBAyCM,CAAC;AAE/C,MAAM,MAAM,0BAA0B,GAAG,CAAC,CAAC,KAAK,CAC9C,OAAO,2BAA2B,CACnC,CAAC;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAC1C,OAAO,2BAA2B,CACnC,CAAC"}

package/dist/lib/config/security.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,uBAAuB;;CAEnC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;~~oBAmC4C~~,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}
1	+ {"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AAIpB,eAAO,MAAM,uBAAuB;;CAEnC,CAAC;AAEF,eAAO,MAAM,oBAAoB;;;;oBA4D4C,CAAC;AAE9E,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC"}

package/dist/lib/config/security.js CHANGED Viewed

@@ -8,8 +8,31 @@ export const SecurityConfigSchema = z
     .object({
     session_secret: z
         .string()
-        .min(16)
-        .describe('Secret key for signing session cookies. Must be at least 16 characters.'),
+        .min(1)
+        .describe('Hex-encoded secret key for encrypting session cookies (AES-GCM). Must decode to 16, 24, or 32 bytes (32, 48, or 64 hex characters) for AES-128/192/256.')
+        .superRefine((value, ctx) => {
+        if (!/^[0-9a-fA-F]+$/.test(value)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'session_secret must be a valid hex string (only 0-9, a-f, A-F characters)',
+            });
+            return;
+        }
+        if (value.length % 2 !== 0) {
+            ctx.addIssue({
+                code: 'custom',
+                message: 'session_secret must have an even number of hex characters',
+            });
+            return;
+        }
+        const byteLength = value.length / 2;
+        if (![16, 24, 32].includes(byteLength)) {
+            ctx.addIssue({
+                code: 'custom',
+                message: `session_secret must decode to 16, 24, or 32 bytes for AES-128/192/256, got ${byteLength} bytes (${value.length} hex characters)`,
+            });
+        }
+    }),
     hash_secret: z
         .string()
         .min(1)

package/dist/lib/config/security.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,~~EAAE~~,CAAC;~~SACP~~,QAAQ,CACP,~~yEAAyE~~,~~CAC1E~~;IACH,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yDAAyD,CAAC;SACnE,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClD,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC"}
1	+ {"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/lib/config/security.ts"],"names":[],"mappings":"AAAA,OAAO,CAAC,MAAM,KAAK,CAAC;AACpB,OAAO,EAAE,EAAE,EAAE,MAAM,2BAA2B,CAAC;AAC/C,OAAO,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhD,MAAM,CAAC,MAAM,uBAAuB,GAAG;IACrC,iBAAiB,EAAE,MAAM;CAC1B,CAAC;AAEF,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,cAAc,EAAE,CAAC;SACd,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CACP,yJAAyJ,CAC1J;SACA,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2EAA2E;aAC9E,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EACL,2DAA2D;aAC9D,CAAC,CAAC;YACH,OAAO;QACT,CAAC;QACD,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,8EAA8E,UAAU,WAAW,KAAK,CAAC,MAAM,kBAAkB;aAC3I,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,WAAW,EAAE,CAAC;SACX,MAAM,EAAE;SACR,GAAG,CAAC,CAAC,CAAC;SACN,QAAQ,CAAC,yDAAyD,CAAC;SACnE,WAAW,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE;QAC1B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;gBAC1B,GAAG,CAAC,QAAQ,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,wDAAwD;iBAClE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,QAAQ,CAAC;gBACX,IAAI,EAAE,QAAQ;gBACd,OAAO,EAAE,sDAAsD;aAChE,CAAC,CAAC;QACL,CAAC;IACH,CAAC,CAAC;IACJ,iBAAiB,EAAE,CAAC;SACjB,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;SAC/B,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;SAClD,OAAO,CAAC,uBAAuB,CAAC,iBAAiB,CAAC;SAClD,QAAQ,CAAC,mDAAmD,CAAC;CACjE,CAAC;KACD,MAAM,EAAE;KACR,QAAQ,CAAC,gEAAgE,CAAC,CAAC"}

package/dist/lib/crypto.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;~~AAuBhD~~,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B3E;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BxB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,GAChB,OAAO,CAkBT;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,GAEvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GACD,SAAS,CAqCZ;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAMT;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,UAAU,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAmBrB"}
1	+ {"version":3,"file":"crypto.d.ts","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAqChD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8B3E;AAED,wBAAsB,OAAO,CAC3B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BxB;AAMD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,UAAU,EAChB,KAAK,EAAE,UAAU,GAChB,OAAO,CAkBT;AAqCD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAC7B,IAAI,EAAE,MAAM,EACZ,iBAAiB,EAAE,MAAM,GAEvB;IACE,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GACD,SAAS,CAqCZ;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAQT;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,UAAU,CAAC;CACpB,GAAG,MAAM,CAMT;AAED;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAE1D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CACzC,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,UAAU,EACxB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,EAChB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,UAAU,EAChB,UAAU,EAAE,MAAM,EAClB,eAAe,EAAE,MAAM,GACtB,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,UAAU,EACtB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAmBrB"}

package/dist/lib/crypto.js CHANGED Viewed

@@ -6,9 +6,19 @@ const AUTH_TAG_LENGTH = 16;
 /**
  * Import a hex-encoded key for AES-GCM operations
  * using the Web Crypto API.
+ *
+ * @throws {Error} if the key is not valid hex or decodes to an
+ *   unsupported AES key length (must be 16, 24, or 32 bytes).
  */
 async function importAesKey(keyHex, usage) {
-    return crypto.subtle.importKey('raw', toArrayBuffer(hexToBytes(keyHex)), { name: ALGORITHM }, false, [usage]);
+    if (!/^[0-9a-fA-F]*$/.test(keyHex) || keyHex.length % 2 !== 0) {
+        throw new Error('session_secret must be a valid hex string with an even number of characters');
+    }
+    const keyBytes = hexToBytes(keyHex);
+    if (![16, 24, 32].includes(keyBytes.byteLength)) {
+        throw new Error(`session_secret must decode to 16, 24, or 32 bytes for AES-128/192/256, got ${keyBytes.byteLength} bytes (${keyHex.length} hex characters)`);
+    }
+    return crypto.subtle.importKey('raw', toArrayBuffer(keyBytes), { name: ALGORITHM }, false, [usage]);
 }
 export async function encrypt(data, keyHex) {
     const key = await importAesKey(keyHex, 'encrypt');

package/dist/lib/crypto.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B~~;;;GAGG~~;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,KAA4B;IAE5B,~~OAAO~~,MAAM,CAAC,MAAM,CAAC,~~SAAS~~,~~CAC5B~~,KAAK,~~EACL~~,~~aAAa~~,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,~~EACjC~~,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEtC,4DAA4D;IAC5D,MAAM,aAAa,GAAG,IAAI,UAAU,CAClC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACrB,SAAS,EAAE,eAAe,GAAG,CAAC;KAC/B,EACD,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,CACzB,CACF,CAAC;IAEF,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CACnC,CAAC,EACD,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CACjC,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAe,EACf,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,UAAU,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAE9D,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,eAAe,GAAG,CAAC;SAC/B,EACD,GAAG,EACH,aAAa,CAAC,aAAa,CAAC,CAC7B,CACF,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAgB,EAChB,KAAiB;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAW;IACtD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,iBAAyB;IASzB,MAAM,CACJ,SAAS,GAAG,EAAE,EACd,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,IAAI,GAAG,EAAE,EACT,MAAM,GAAG,EAAE,EACZ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,aAAa,KAAK,SAAS;QAC3B,gBAAgB,KAAK,SAAS;QAC9B,UAAU,KAAK,SAAS;QACxB,YAAY,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;YAC/B,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/B,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAIhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,eAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,YAAY,CAAC,EAC3B,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;KAC7C,EACD,OAAO,EACP,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,UAAsB,EACtB,MAAc,EACd,IAAgB,EAChB,UAAkB,EAClB,eAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,EAC/D,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,UAAU;QACV,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;KAC1B,EACD,WAAW,EACX,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAsB,EACtB,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,UAAU,CAAC,EACzB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;KAChB,EACD,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,OAAO,EACP,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}
1	+ {"version":3,"file":"crypto.js","sourceRoot":"","sources":["../../src/lib/crypto.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,WAAW,EACX,aAAa,EACb,cAAc,EACd,UAAU,EACV,aAAa,EACb,aAAa,EACb,WAAW,GACZ,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEhD,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,SAAS,GAAG,EAAE,CAAC;AACrB,MAAM,eAAe,GAAG,EAAE,CAAC;AAE3B;;;;;;GAMG;AACH,KAAK,UAAU,YAAY,CACzB,MAAc,EACd,KAA4B;IAE5B,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,6EAA6E,CAC9E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CACb,8EAA8E,QAAQ,CAAC,UAAU,WAAW,MAAM,CAAC,MAAM,kBAAkB,CAC5I,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,aAAa,CAAC,QAAQ,CAAC,EACvB,EAAE,IAAI,EAAE,SAAS,EAAE,EACnB,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,MAAc;IACxD,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAClD,MAAM,EAAE,GAAG,cAAc,CAAC,SAAS,CAAC,CAAC;IACrC,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IAEtC,4DAA4D;IAC5D,MAAM,aAAa,GAAG,IAAI,UAAU,CAClC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;QACE,IAAI,EAAE,SAAS;QACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;QACrB,SAAS,EAAE,eAAe,GAAG,CAAC;KAC/B,EACD,GAAG,EACH,aAAa,CAAC,SAAS,CAAC,CACzB,CACF,CAAC;IAEF,mEAAmE;IACnE,sCAAsC;IACtC,MAAM,SAAS,GAAG,aAAa,CAAC,KAAK,CACnC,CAAC,EACD,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAAC,KAAK,CACjC,aAAa,CAAC,UAAU,GAAG,eAAe,CAC3C,CAAC;IAEF,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACrD,OAAO,WAAW,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,OAAe,EACf,MAAc;IAEd,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,YAAY,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAClD,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,QAAQ,CAAC,UAAU,GAAG,SAAS,GAAG,eAAe,EAAE,CAAC;YACtD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,EAAE,SAAS,GAAG,eAAe,CAAC,CAAC;QACvE,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,SAAS,GAAG,eAAe,CAAC,CAAC;QAE9D,uDAAuD;QACvD,MAAM,aAAa,GAAG,WAAW,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QAEtD,MAAM,SAAS,GAAG,IAAI,UAAU,CAC9B,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CACzB;YACE,IAAI,EAAE,SAAS;YACf,EAAE,EAAE,aAAa,CAAC,EAAE,CAAC;YACrB,SAAS,EAAE,eAAe,GAAG,CAAC;SAC/B,EACD,GAAG,EACH,aAAa,CAAC,aAAa,CAAC,CAC7B,CACF,CAAC;QACF,OAAO,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAgB,EAChB,KAAiB;IAEjB,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QAE/B,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,IAAI,QAAQ,GAAG,SAAS,CAAC;IAC/B,CAAC;IAED,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E;;;;GAIG;AACH,SAAS,mBAAmB,CAAC,OAAe,EAAE,GAAW;IACvD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe,EAAE,GAAW;IACtD,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC;QACnC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,iBAAyB;IASzB,MAAM,CACJ,SAAS,GAAG,EAAE,EACd,OAAO,GAAG,EAAE,EACZ,UAAU,GAAG,EAAE,EACf,IAAI,GAAG,EAAE,EACT,MAAM,GAAG,EAAE,EACZ,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEpB,IAAI,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACpC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,aAAa,GAAG,mBAAmB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAErD,IACE,aAAa,KAAK,SAAS;QAC3B,gBAAgB,KAAK,SAAS;QAC9B,UAAU,KAAK,SAAS;QACxB,YAAY,KAAK,SAAS,EAC1B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACH,OAAO;YACL,OAAO,EAAE,aAAa;YACtB,UAAU,EAAE,gBAAgB;YAC5B,IAAI,EAAE,aAAa,CAAC,UAAU,CAAC;YAC/B,MAAM,EAAE,aAAa,CAAC,YAAY,CAAC;SACpC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAMhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QAC/B,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAIhC;IACC,OAAO;QACL,MAAM,CAAC,SAAS;QAChB,KAAK,MAAM,CAAC,OAAO,EAAE;QACrB,KAAK,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE;KAClC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,MAAc;IAC5C,OAAO,aAAa,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,YAAwB,EACxB,QAAgB,EAChB,QAAgB,EAChB,eAAuB;IAEvB,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,YAAY,CAAC,EAC3B,MAAM,EACN,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CACzC;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;QACf,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC5C,IAAI,EAAE,aAAa,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;KAC7C,EACD,OAAO,EACP,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAc,EACd,UAAsB,EACtB,MAAc,EACd,IAAgB,EAChB,UAAkB,EAClB,eAAuB;IAEvB,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC/C,KAAK,EACL,aAAa,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC,EAC/D,QAAQ,EACR,KAAK,EACL,CAAC,YAAY,CAAC,CACf,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAC5C;QACE,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,SAAS;QACf,UAAU;QACV,IAAI,EAAE,aAAa,CAAC,IAAI,CAAC;KAC1B,EACD,WAAW,EACX,eAAe,GAAG,CAAC,CACpB,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAc,EACd,UAAsB,EACtB,KAAa;IAEb,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAC3C,KAAK,EACL,aAAa,CAAC,UAAU,CAAC,EACzB;QACE,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,SAAS;KAChB,EACD,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IAEF,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CACxC,MAAM,EACN,OAAO,EACP,aAAa,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CACtC,CAAC;IAEF,OAAO,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC;AACnC,CAAC"}

package/dist/lib/database/entities.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;~~AAqBlD~~,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;~~AA0BD~~,wBAAgB,mBAAmB,IAAI,SAAS,UAAU,EAAE,CAE3D;AAED,wBAAgB,+BAA+B,IAAI,SAAS,qBAAqB,EAAE,CAElF"}
1	+ {"version":3,"file":"entities.d.ts","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAsBlD,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE;QACJ,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;CACH;AA2BD,wBAAgB,mBAAmB,IAAI,SAAS,UAAU,EAAE,CAE3D;AAED,wBAAgB,+BAA+B,IAAI,SAAS,qBAAqB,EAAE,CAElF"}

package/dist/lib/database/entities.js CHANGED Viewed

@@ -4,6 +4,7 @@ import { EmailVerificationEntitySchema } from "../../entities/email-verification
 import { JwtKeyEntitySchema } from "../../entities/jwt-key.entity.js";
 import { OAuthClientEntitySchema } from "../../entities/oauth-client.entity.js";
 import { OAuthCodeEntitySchema } from "../../entities/oauth-code.entity.js";
+import { OAuthDeviceCodeEntitySchema } from "../../entities/oauth-device-code.entity.js";
 import { PasswordResetEntitySchema } from "../../entities/password-reset.entity.js";
 import { PendingOAuthRegistrationEntitySchema } from "../../entities/pending-oauth-registration.entity.js";
 import { RevokedTokenEntitySchema } from "../../entities/revoked-token.entity.js";
@@ -22,6 +23,7 @@ function createDatabaseEntities() {
         UserEntitySchema,
         OAuthClientEntitySchema,
         OAuthCodeEntitySchema,
+        OAuthDeviceCodeEntitySchema,
         JwtKeyEntitySchema,
         EmailVerificationEntitySchema,
         PasswordResetEntitySchema,

package/dist/lib/database/entities.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"entities.js","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AASpG,SAAS,sBAAsB;IAC7B,OAAO;QACL,gBAAgB;QAChB,uBAAuB;QACvB,qBAAqB;QACrB,kBAAkB;QAClB,6BAA6B;QAC7B,yBAAyB;QACzB,oCAAoC;QACpC,wBAAwB;QACxB,yBAAyB;QACzB,wBAAwB;QACxB,iBAAiB;QACjB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;QAChC,oBAAoB;QACpB,0BAA0B;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC"}
1	+ {"version":3,"file":"entities.js","sourceRoot":"","sources":["../../../src/lib/database/entities.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,0BAA0B,EAAE,MAAM,0CAA0C,CAAC;AACtF,OAAO,EAAE,6BAA6B,EAAE,MAAM,6CAA6C,CAAC;AAC5F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AACtE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,yBAAyB,EAAE,MAAM,yCAAyC,CAAC;AACpF,OAAO,EAAE,oCAAoC,EAAE,MAAM,qDAAqD,CAAC;AAC3G,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,iBAAiB,EAAE,MAAM,gCAAgC,CAAC;AACnE,OAAO,EAAE,wBAAwB,EAAE,MAAM,wCAAwC,CAAC;AAClF,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,qBAAqB,EAAE,MAAM,qCAAqC,CAAC;AAC5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,uCAAuC,CAAC;AAChF,OAAO,EAAE,4BAA4B,EAAE,MAAM,6CAA6C,CAAC;AAC3F,OAAO,EAAE,oBAAoB,EAAE,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,gCAAgC,EAAE,MAAM,kDAAkD,CAAC;AASpG,SAAS,sBAAsB;IAC7B,OAAO;QACL,gBAAgB;QAChB,uBAAuB;QACvB,qBAAqB;QACrB,2BAA2B;QAC3B,kBAAkB;QAClB,6BAA6B;QAC7B,yBAAyB;QACzB,oCAAoC;QACpC,wBAAwB;QACxB,yBAAyB;QACzB,wBAAwB;QACxB,iBAAiB;QACjB,wBAAwB;QACxB,uBAAuB;QACvB,qBAAqB;QACrB,uBAAuB;QACvB,4BAA4B;QAC5B,gCAAgC;QAChC,oBAAoB;QACpB,0BAA0B;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,+BAA+B;IAC7C,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC"}

package/dist/lib/escape-html.d.ts ADDED Viewed

@@ -0,0 +1,7 @@
+/**
+ * Minimal HTML-escape for content placed inside attribute values and text nodes.
+ * Does not cover every HTML context but is sufficient for form-post and
+ * device-verification replies where only simple attribute values appear.
+ */
+export declare function escapeHtml(value: string): string;
+//# sourceMappingURL=escape-html.d.ts.map

package/dist/lib/escape-html.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"escape-html.d.ts","sourceRoot":"","sources":["../../src/lib/escape-html.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD"}

package/dist/lib/escape-html.js ADDED Viewed

@@ -0,0 +1,14 @@
+/**
+ * Minimal HTML-escape for content placed inside attribute values and text nodes.
+ * Does not cover every HTML context but is sufficient for form-post and
+ * device-verification replies where only simple attribute values appear.
+ */
+export function escapeHtml(value) {
+    return value
+        .replaceAll('&', '&amp;')
+        .replaceAll('"', '&quot;')
+        .replaceAll("'", '&#39;')
+        .replaceAll('<', '&lt;')
+        .replaceAll('>', '&gt;');
+}
+//# sourceMappingURL=escape-html.js.map

package/dist/lib/escape-html.js.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"escape-html.js","sourceRoot":"","sources":["../../src/lib/escape-html.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC;SACxB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC;SACvB,UAAU,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;AAC7B,CAAC"}

package/dist/migrations/postgres/Migration20260619075007.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260619075007 extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260619075007.d.ts.map

package/dist/migrations/postgres/Migration20260619075007.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"Migration20260619075007.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260619075007.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,uBAAwB,SAAQ,SAAS;IAC3C,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAsJ1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CA0CtC"}

package/dist/migrations/postgres/Migration20260619075007.js ADDED Viewed

@@ -0,0 +1,86 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260619075007 extends Migration {
+    up() {
+        this.addSql(`create table "oauth_device_code" ("id" uuid not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "device_code_hash" varchar(255) not null, "user_code_hash" varchar(255) not null, "client_id" varchar(255) not null, "scope" jsonb not null default '[]', "expires_at" timestamptz not null, "authorized_user_sub" varchar(255) null, "authorized_at" timestamptz null, "consumed_at" timestamptz null, primary key ("id"));`);
+        this.addSql(`comment on table "oauth_device_code" is 'Issued OAuth device authorization grants';`);
+        this.addSql(`comment on column "oauth_device_code"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "oauth_device_code"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "oauth_device_code"."device_code_hash" is 'Hash of the issued device_code';`);
+        this.addSql(`comment on column "oauth_device_code"."user_code_hash" is 'Hash of the user-facing verification code';`);
+        this.addSql(`comment on column "oauth_device_code"."client_id" is 'Reference to the OAuth client that requested the device code';`);
+        this.addSql(`comment on column "oauth_device_code"."scope" is 'Scopes requested by the device authorization request';`);
+        this.addSql(`comment on column "oauth_device_code"."expires_at" is 'Absolute expiry timestamp for the code';`);
+        this.addSql(`comment on column "oauth_device_code"."authorized_user_sub" is 'User that approved the device authorization request';`);
+        this.addSql(`comment on column "oauth_device_code"."authorized_at" is 'Timestamp when the user approved the request';`);
+        this.addSql(`comment on column "oauth_device_code"."consumed_at" is 'Timestamp when the device code was exchanged';`);
+        this.addSql(`alter table "oauth_device_code" add constraint "oauth_device_code_device_code_hash_unique" unique ("device_code_hash");`);
+        this.addSql(`alter table "oauth_device_code" add constraint "oauth_device_code_user_code_hash_unique" unique ("user_code_hash");`);
+        this.addSql(`create index "oauth_device_code_device_hash_idx" on "oauth_device_code" ("device_code_hash");`);
+        this.addSql(`create index "oauth_device_code_user_hash_idx" on "oauth_device_code" ("user_code_hash");`);
+        this.addSql(`create index "oauth_device_code_expired_at_idx" on "oauth_device_code" ("expires_at");`);
+        this.addSql(`alter table "oauth_device_code" add constraint "oauth_device_code_client_id_foreign" foreign key ("client_id") references "oauth_client" ("id");`);
+        this.addSql(`alter table "oauth_device_code" add constraint "oauth_device_code_authorized_user_sub_foreign" foreign key ("authorized_user_sub") references "user" ("sub") on delete set null;`);
+        this.addSql(`comment on column "background_jobs"."id" is 'Stable background job execution id';`);
+        this.addSql(`comment on column "background_jobs"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "background_jobs"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "background_jobs"."job_id" is 'Registered background job identifier';`);
+        this.addSql(`comment on column "background_jobs"."payload" is 'Serialized JSON job payload';`);
+        this.addSql(`comment on column "background_jobs"."available_at" is 'Earliest time this job can run';`);
+        this.addSql(`comment on column "background_jobs"."locked_by" is 'Scheduler instance holding the lease';`);
+        this.addSql(`comment on column "background_jobs"."locked_until" is 'Lease expiration timestamp';`);
+        this.addSql(`comment on column "background_jobs"."attempt_count" is 'Total run attempts';`);
+        this.addSql(`comment on column "background_jobs"."max_attempts" is 'Maximum run attempts';`);
+        this.addSql(`comment on column "background_jobs"."last_error" is 'Last failure message';`);
+        this.addSql(`comment on column "background_jobs"."completed_at" is 'Completion timestamp';`);
+        this.addSql(`alter table "oauth_client" add "post_logout_redirect_uris" jsonb not null default '[]', add "web_origins" jsonb not null default '[]';`);
+        this.addSql(`comment on column "scheduled_jobs"."id" is 'Stable scheduler job identifier';`);
+        this.addSql(`comment on column "scheduled_jobs"."created_at" is 'Timestamp when the entity was created';`);
+        this.addSql(`comment on column "scheduled_jobs"."updated_at" is 'Timestamp when the entity was last updated';`);
+        this.addSql(`comment on column "scheduled_jobs"."name" is 'Human-readable scheduler job name';`);
+        this.addSql(`comment on column "scheduled_jobs"."enabled" is 'Whether the scheduler job is enabled';`);
+        this.addSql(`comment on column "scheduled_jobs"."cron" is 'Cron expression for the job schedule';`);
+        this.addSql(`comment on column "scheduled_jobs"."next_run_at" is 'Next scheduled run timestamp';`);
+        this.addSql(`comment on column "scheduled_jobs"."last_run_at" is 'Last run start timestamp';`);
+        this.addSql(`comment on column "scheduled_jobs"."last_success_at" is 'Last successful completion timestamp';`);
+        this.addSql(`comment on column "scheduled_jobs"."last_error_at" is 'Last failed completion timestamp';`);
+        this.addSql(`comment on column "scheduled_jobs"."last_error" is 'Last failure message';`);
+        this.addSql(`comment on column "scheduled_jobs"."locked_by" is 'Scheduler instance holding the lease';`);
+        this.addSql(`comment on column "scheduled_jobs"."locked_until" is 'Lease expiration timestamp';`);
+        this.addSql(`comment on column "scheduled_jobs"."run_count" is 'Total run attempts';`);
+        this.addSql(`comment on column "scheduled_jobs"."failure_count" is 'Total failed run attempts';`);
+        this.addSql(`comment on table "user_oauth" is '';`);
+    }
+    down() {
+        this.addSql(`drop table if exists "oauth_device_code" cascade;`);
+        this.addSql(`comment on column "background_jobs"."id" is null;`);
+        this.addSql(`comment on column "background_jobs"."created_at" is null;`);
+        this.addSql(`comment on column "background_jobs"."updated_at" is null;`);
+        this.addSql(`comment on column "background_jobs"."job_id" is null;`);
+        this.addSql(`comment on column "background_jobs"."payload" is null;`);
+        this.addSql(`comment on column "background_jobs"."available_at" is null;`);
+        this.addSql(`comment on column "background_jobs"."locked_by" is null;`);
+        this.addSql(`comment on column "background_jobs"."locked_until" is null;`);
+        this.addSql(`comment on column "background_jobs"."attempt_count" is null;`);
+        this.addSql(`comment on column "background_jobs"."max_attempts" is null;`);
+        this.addSql(`comment on column "background_jobs"."last_error" is null;`);
+        this.addSql(`comment on column "background_jobs"."completed_at" is null;`);
+        this.addSql(`alter table "oauth_client" drop column "post_logout_redirect_uris", drop column "web_origins";`);
+        this.addSql(`comment on column "scheduled_jobs"."id" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."created_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."updated_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."name" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."enabled" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."cron" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."next_run_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."last_run_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."last_success_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."last_error_at" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."last_error" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."locked_by" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."locked_until" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."run_count" is null;`);
+        this.addSql(`comment on column "scheduled_jobs"."failure_count" is null;`);
+        this.addSql(`comment on table "user_oauth" is 'OAuth accounts linked to users';`);
+    }
+}
+//# sourceMappingURL=Migration20260619075007.js.map

package/dist/migrations/postgres/Migration20260619075007.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"Migration20260619075007.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260619075007.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IAC3C,EAAE;QACT,IAAI,CAAC,MAAM,CACT,0bAA0b,CAC3b,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qGAAqG,CACtG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+FAA+F,CAChG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sHAAsH,CACvH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,uHAAuH,CACxH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,0GAA0G,CAC3G,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wGAAwG,CACzG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yHAAyH,CAC1H,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qHAAqH,CACtH,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+FAA+F,CAChG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,wFAAwF,CACzF,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,kJAAkJ,CACnJ,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kLAAkL,CACnL,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8FAA8F,CAC/F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mGAAmG,CACpG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4FAA4F,CAC7F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,8EAA8E,CAC/E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6EAA6E,CAC9E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,wIAAwI,CACzI,CAAC;QAEF,IAAI,CAAC,MAAM,CACT,+EAA+E,CAChF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,6FAA6F,CAC9F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,kGAAkG,CACnG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,mFAAmF,CACpF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yFAAyF,CAC1F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,qFAAqF,CACtF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iFAAiF,CAClF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,iGAAiG,CAClG,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,4EAA4E,CAC7E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,2FAA2F,CAC5F,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QACF,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;QACF,IAAI,CAAC,MAAM,CACT,oFAAoF,CACrF,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;IACtD,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QAEjE,IAAI,CAAC,MAAM,CAAC,mDAAmD,CAAC,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,wDAAwD,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,8DAA8D,CAAC,CAAC;QAC5E,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,CACT,gGAAgG,CACjG,CAAC;QAEF,IAAI,CAAC,MAAM,CAAC,kDAAkD,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,uDAAuD,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM,CAAC,oDAAoD,CAAC,CAAC;QAClE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CAAC,2DAA2D,CAAC,CAAC;QACzE,IAAI,CAAC,MAAM,CACT,+DAA+D,CAChE,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAC3E,IAAI,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,4DAA4D,CAAC,CAAC;QAC1E,IAAI,CAAC,MAAM,CAAC,yDAAyD,CAAC,CAAC;QACvE,IAAI,CAAC,MAAM,CAAC,6DAA6D,CAAC,CAAC;QAE3E,IAAI,CAAC,MAAM,CACT,oEAAoE,CACrE,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260619191600_unique_oauth_client_client_id extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260619191600_unique_oauth_client_client_id.d.ts.map

package/dist/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"Migration20260619191600_unique_oauth_client_client_id.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,qDAAsD,SAAQ,SAAS;IACzE,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IAO1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAMtC"}

package/dist/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.js ADDED Viewed

@@ -0,0 +1,12 @@
+import { Migration } from '@mikro-orm/migrations';
+export class Migration20260619191600_unique_oauth_client_client_id extends Migration {
+    up() {
+        this.addSql(`drop index if exists "client_client_id_unique";`);
+        this.addSql(`create unique index "client_client_id_unique" on "oauth_client" ("client_id");`);
+    }
+    down() {
+        this.addSql(`drop index if exists "client_client_id_unique";`);
+        this.addSql(`create index "client_client_id_unique" on "oauth_client" ("client_id");`);
+    }
+}
+//# sourceMappingURL=Migration20260619191600_unique_oauth_client_client_id.js.map

package/dist/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"Migration20260619191600_unique_oauth_client_client_id.js","sourceRoot":"","sources":["../../../src/migrations/postgres/Migration20260619191600_unique_oauth_client_client_id.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,MAAM,OAAO,qDAAsD,SAAQ,SAAS;IACzE,EAAE;QACT,IAAI,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CACT,gFAAgF,CACjF,CAAC;IACJ,CAAC;IAEQ,IAAI;QACX,IAAI,CAAC,MAAM,CAAC,iDAAiD,CAAC,CAAC;QAC/D,IAAI,CAAC,MAAM,CACT,yEAAyE,CAC1E,CAAC;IACJ,CAAC;CACF"}

package/dist/migrations/postgres/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;~~AAGvF~~,eAAO,MAAM,mBAAmB,~~4CAG~~/B,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AAKvF,eAAO,MAAM,mBAAmB,4CAK/B,CAAC"}

package/dist/migrations/postgres/index.js CHANGED Viewed

@@ -1,7 +1,11 @@
 import { Migration20260509171036_initial } from './Migration20260509171036_initial.js';
 import { Migration20260512120000_add_scheduler_jobs } from './Migration20260512120000_add_scheduler_jobs.js';
+import { Migration20260619075007 } from './Migration20260619075007.js';
+import { Migration20260619191600_unique_oauth_client_client_id } from './Migration20260619191600_unique_oauth_client_client_id.js';
 export const POSTGRES_MIGRATIONS = [
     Migration20260509171036_initial,
     Migration20260512120000_add_scheduler_jobs,
+    Migration20260619075007,
+    Migration20260619191600_unique_oauth_client_client_id,
 ];
 //# sourceMappingURL=index.js.map

package/dist/migrations/postgres/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;~~AAE7G~~,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;~~CAC3C~~,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/migrations/postgres/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,+BAA+B,EAAE,MAAM,sCAAsC,CAAC;AACvF,OAAO,EAAE,0CAA0C,EAAE,MAAM,iDAAiD,CAAC;AAC7G,OAAO,EAAE,uBAAuB,EAAE,MAAM,8BAA8B,CAAC;AACvE,OAAO,EAAE,qDAAqD,EAAE,MAAM,4DAA4D,CAAC;AAEnI,MAAM,CAAC,MAAM,mBAAmB,GAAG;IACjC,+BAA+B;IAC/B,0CAA0C;IAC1C,uBAAuB;IACvB,qDAAqD;CACtD,CAAC"}

package/dist/migrations/sqlite/Migration20260619075330.d.ts ADDED Viewed

@@ -0,0 +1,6 @@
+import { Migration } from '@mikro-orm/migrations';
+export declare class Migration20260619075330 extends Migration {
+    up(): void | Promise<void>;
+    down(): void | Promise<void>;
+}
+//# sourceMappingURL=Migration20260619075330.d.ts.map

package/dist/migrations/sqlite/Migration20260619075330.d.ts.map ADDED Viewed

	@@ -0,0 +1 @@
1	+ {"version":3,"file":"Migration20260619075330.d.ts","sourceRoot":"","sources":["../../../src/migrations/sqlite/Migration20260619075330.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAElD,qBAAa,uBAAwB,SAAQ,SAAS;IAC3C,EAAE,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;IA8E1B,IAAI,IAAI,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;CAoDtC"}