@tstdl/base 0.93.86 → 0.93.89

package/ai/genkit/helpers.d.ts

@@ -1,10 +1,12 @@
 import type { GenerateOptions, z } from 'genkit';
+import { type SchemaConversionOptions } from '../../schema/converters/zod-v3-converter.js';
 import type { SchemaTestable } from '../../schema/index.js';
 import type { TypedOmit } from '../../types/types.js';
 export type TstdlGenkitGenerationOptions<T, O extends z.ZodTypeAny> = TypedOmit<GenerateOptions<z.ZodType<NoInfer<T>>, O>, 'output'> & {
     output?: TypedOmit<NonNullable<GenerateOptions['output']>, 'schema'> & {
         schema?: SchemaTestable<T>;
+        schemaOptions?: SchemaConversionOptions;
     };
 };
-export declare function convertToGenkitSchema<T>(schema: SchemaTestable<T>): z.ZodType<T>;
+export declare function convertToGenkitSchema<T>(schema: SchemaTestable<T>, options?: SchemaConversionOptions): z.ZodType<T>;
 export declare function genkitGenerationOptions<T, O extends z.ZodTypeAny>(options: TstdlGenkitGenerationOptions<T, O>): GenerateOptions<z.ZodType<T>, z.ZodType<O>>;

package/ai/genkit/helpers.js

@@ -1,14 +1,14 @@
 import { convertToZodV3Schema } from '../../schema/converters/zod-v3-converter.js';
 import { isDefined } from '../../utils/type-guards.js';
-export function convertToGenkitSchema(schema) {
-    return convertToZodV3Schema(schema); // eslint-disable-line @typescript-eslint/no-unsafe-return
+export function convertToGenkitSchema(schema, options) {
+    return convertToZodV3Schema(schema, options); // eslint-disable-line @typescript-eslint/no-unsafe-return
 }
 export function genkitGenerationOptions(options) {
     return {
         ...options,
         output: {
             ...options.output,
-            schema: isDefined(options.output?.schema) ? convertToGenkitSchema(options.output.schema) : undefined,
+            schema: isDefined(options.output?.schema) ? convertToGenkitSchema(options.output.schema, options.output.schemaOptions) : undefined,
         },
     };
 }

package/api/server/gateway.d.ts

@@ -6,6 +6,7 @@ import type { Type } from '../../types/index.js';
 import { type AsyncMiddleware, type AsyncMiddlewareNext } from '../../utils/middleware.js';
 import { type ApiController, type ApiDefinition, type ApiEndpointDefinition, type ApiEndpointMethod, type ApiEndpointServerImplementation } from '../types.js';
 import type { CorsMiddlewareOptions } from './middlewares/cors.middleware.js';
+import { type CsrfMiddlewareOptions } from './middlewares/index.js';
 export type ApiGatewayMiddlewareContext = {
     readonly api: ApiItem;
     /** can be undefined if used before allowedMethods middleware */
@@ -28,6 +29,8 @@ export declare abstract class ApiGatewayOptions {
     supressedErrors?: Type<Error>[];
     /** Cors middleware options */
     cors?: CorsMiddlewareOptions;
+    /** Csrf middleware options */
+    csrf?: CsrfMiddlewareOptions;
     /**
      * Maximum size of request body. Useful to prevent harmful requests.
      * @default 10 MB

package/api/server/gateway.js

@@ -35,7 +35,7 @@ import { normalizedApiDefinitionEndpointsEntries } from '../types.js';
 import { getFullApiEndpointResource } from '../utils.js';
 import { ApiRequestTokenProvider } from './api-request-token.provider.js';
 import { handleApiError } from './error-handler.js';
-import { allowedMethodsMiddleware, contentTypeMiddleware, corsMiddleware, getCatchErrorMiddleware, responseTimeMiddleware } from './middlewares/index.js';
+import { allowedMethodsMiddleware, contentTypeMiddleware, corsMiddleware, csrfMiddleware, getCatchErrorMiddleware, responseTimeMiddleware } from './middlewares/index.js';
 import { API_MODULE_OPTIONS } from './tokens.js';
 const defaultMaxBytes = 10 * mebibyte;
 export class ApiGatewayOptions {
@@ -50,6 +50,8 @@ export class ApiGatewayOptions {
     supressedErrors;
     /** Cors middleware options */
     cors;
+    /** Csrf middleware options */
+    csrf;
     /**
      * Maximum size of request body. Useful to prevent harmful requests.
      * @default 10 MB
@@ -162,7 +164,16 @@ let ApiGateway = ApiGateway_1 = class ApiGateway {
         throw new NotFoundError(`Resource ${resource.pathname} not available.`);
     }
     updateMiddleware() {
-        const middlewares = [responseTimeMiddleware, contentTypeMiddleware, this.#catchErrorMiddleware, corsMiddleware(this.#options.cors), allowedMethodsMiddleware, ...this.#middlewares, async (context, next) => await this.endpointMiddleware(context, next)];
+        const middlewares = [
+            responseTimeMiddleware,
+            contentTypeMiddleware,
+            this.#catchErrorMiddleware,
+            corsMiddleware(this.#options.cors),
+            csrfMiddleware(this.#options.csrf),
+            allowedMethodsMiddleware,
+            ...this.#middlewares,
+            async (context, next) => await this.endpointMiddleware(context, next)
+        ];
         this.#composedMiddleware = composeAsyncMiddleware(middlewares);
     }
     async endpointMiddleware(context, next) {
@@ -198,9 +209,9 @@ let ApiGateway = ApiGateway_1 = class ApiGateway {
                 return auditor.fork(context.api.resource)
                     .withCorrelation()
                     .with({
-                    actorType: isNotNull(token) ? ActorType.User : ActorType.Anonymous,
+                    actorType: isNotNull(token) ? ActorType.Subject : ActorType.Anonymous,
                     actor: token?.payload.subject ?? NIL_UUID,
-                    impersonatorType: isNotNullOrUndefined(token?.payload.impersonator) ? ActorType.User : null,
+                    impersonatorType: isNotNullOrUndefined(token?.payload.impersonator) ? ActorType.Subject : null,
                     impersonator: token?.payload.impersonator ?? null,
                     network: {
                         path: context.request.url.pathname,

package/api/server/middlewares/catch-error.middleware.js

@@ -1,13 +1,11 @@
 import { handleApiError } from '../error-handler.js';
 export function getCatchErrorMiddleware(supressedErrors, logger) {
-    // eslint-disable-next-line @typescript-eslint/no-shadow
-    async function catchErrorMiddleware(context, next) {
+    return async function catchErrorMiddleware(context, next) {
         try {
             await next();
         }
         catch (error) {
             handleApiError(error, context.response, supressedErrors, logger);
         }
-    }
-    return catchErrorMiddleware;
+    };
 }

package/api/server/middlewares/cors.middleware.js

@@ -2,7 +2,7 @@ import { resolveApiEndpointDataProvider } from '../../../api/types.js';
 import { toArray } from '../../../utils/array/array.js';
 import { isDefined } from '../../../utils/type-guards.js';
 export function corsMiddleware(options = {}) {
-    async function corsMiddleware(context, next) {
+    return async function corsMiddleware(context, next) {
         try {
             await next();
         }
@@ -49,6 +49,5 @@ export function corsMiddleware(options = {}) {
                 }
             }
         }
-    }
-    return corsMiddleware;
+    };
 }

package/api/server/middlewares/csrf.middleware.d.ts

@@ -0,0 +1,41 @@
+import type { ApiGatewayMiddleware } from '../gateway.js';
+export interface CsrfMiddlewareOptions {
+    /**
+     * List of additional hostnames to trust (e.g. 'api.example.com').
+     */
+    trustedHosts?: string[];
+    /**
+     * Whether to allow `Sec-Fetch-Site: same-site`.
+     * If false, only `same-origin` is accepted via Fetch Metadata.
+     * Disable this if you host untrusted content on subdomains.
+     * @default true
+     */
+    allowFetchSiteSameSite?: boolean;
+    /**
+     * Whether to allow requests with `Sec-Fetch-Site: none`.
+     * Useful for user-initiated actions like clicking a link or bookmark opening an app.
+     * @default false
+     */
+    allowFetchSiteNone?: boolean;
+    /**
+     * Whether to trust the `X-Forwarded-Host` header.
+     * Enable this when running behind a reverse proxy (e.g., Nginx, AWS ALB).
+     * @default false
+     */
+    trustProxy?: boolean;
+}
+/**
+ * Creates a middleware for Stateless CSRF Protection using Fetch Metadata and Origin headers.
+ *
+ * This middleware verifies that mutating requests (POST, PUT, DELETE, PATCH) originate from a trusted source.
+ * It uses the following strategy:
+ * 1. Allows "safe" HTTP methods (GET, HEAD, OPTIONS, TRACE).
+ * 2. Validates the `Sec-Fetch-Site` header if present.
+ * 3. Falls back to validating the `Origin` header against the resolved Host.
+ * 4. Falls back to validating the `Referer` header against the resolved Host.
+ * 5. Allows requests that lack all standard headers (assumed non-browser clients).
+ *
+ * @param options CSRF middleware options.
+ * @returns An API middleware function.
+ */
+export declare function csrfMiddleware(options?: CsrfMiddlewareOptions): ApiGatewayMiddleware;

package/api/server/middlewares/csrf.middleware.js

@@ -0,0 +1,108 @@
+import { ForbiddenError } from '../../../errors/forbidden.error.js';
+import { isNotNullOrUndefined, isNull, isNullOrUndefined, isString } from '../../../utils/type-guards.js';
+const safeMethods = new Set(['GET', 'HEAD', 'OPTIONS', 'TRACE']);
+/**
+ * Creates a middleware for Stateless CSRF Protection using Fetch Metadata and Origin headers.
+ *
+ * This middleware verifies that mutating requests (POST, PUT, DELETE, PATCH) originate from a trusted source.
+ * It uses the following strategy:
+ * 1. Allows "safe" HTTP methods (GET, HEAD, OPTIONS, TRACE).
+ * 2. Validates the `Sec-Fetch-Site` header if present.
+ * 3. Falls back to validating the `Origin` header against the resolved Host.
+ * 4. Falls back to validating the `Referer` header against the resolved Host.
+ * 5. Allows requests that lack all standard headers (assumed non-browser clients).
+ *
+ * @param options CSRF middleware options.
+ * @returns An API middleware function.
+ */
+export function csrfMiddleware(options) {
+    const trustedHosts = new Set((options?.trustedHosts ?? [])
+        .map((h) => normalizeHost(h))
+        .filter(isNotNullOrUndefined));
+    const allowFetchSiteNone = options?.allowFetchSiteNone ?? false;
+    const allowFetchSiteSameSite = options?.allowFetchSiteSameSite ?? true;
+    const trustProxy = options?.trustProxy ?? false;
+    return async function csrfMiddleware(context, next) {
+        // 1. Skip safe methods
+        if (safeMethods.has(context.request.method)) {
+            return await next();
+        }
+        // 2. Set Vary headers to prevent cache poisoning on these crucial headers
+        context.response.headers.append('Vary', 'Sec-Fetch-Site, Origin, Referer');
+        const secFetchSite = context.request.headers.tryGet('Sec-Fetch-Site');
+        const origin = context.request.headers.tryGet('Origin');
+        const referer = context.request.headers.tryGet('Referer');
+        // Resolve current host
+        let rawHost = context.request.headers.tryGetSingle('Host');
+        if (trustProxy) {
+            const forwardedHost = context.request.headers.tryGetSingle('X-Forwarded-Host');
+            if (isString(forwardedHost)) {
+                // CAUTION: Ensure your proxy overwrites this header, or verify behavior
+                rawHost = forwardedHost.split(',')[0].trim();
+            }
+        }
+        const currentHost = normalizeHost(rawHost);
+        // 3. Primary Check: Fetch Metadata
+        if (isNotNullOrUndefined(secFetchSite)) {
+            if ((secFetchSite == 'same-origin')
+                || (allowFetchSiteSameSite && (secFetchSite == 'same-site'))
+                || (allowFetchSiteNone && (secFetchSite == 'none'))) {
+                return await next();
+            }
+            throw new ForbiddenError('Cross-site request blocked.');
+        }
+        // Helper to validate a URL against current host or trusted hosts
+        const isUrlTrusted = (url) => {
+            try {
+                const normalizedUrlHost = normalizeHost(url);
+                if (isNull(normalizedUrlHost)) {
+                    return false;
+                }
+                // 1. Check Explicit Trust List (Safest)
+                if (trustedHosts.has(normalizedUrlHost)) {
+                    return true;
+                }
+                // 2. Check Host Header (Fallback - Vulnerable to Host Injection)
+                if (currentHost && (normalizedUrlHost == currentHost)) {
+                    return true;
+                }
+                return false;
+            }
+            catch {
+                return false;
+            }
+        };
+        // 4. Secondary Check: Origin Header
+        if (isNotNullOrUndefined(origin)) {
+            if (isUrlTrusted(origin)) {
+                return await next();
+            }
+            throw new ForbiddenError('Cross-site request blocked.');
+        }
+        // 5. Tertiary Check: Referer Header
+        if (isNotNullOrUndefined(referer)) {
+            if (isUrlTrusted(referer)) {
+                return await next();
+            }
+            throw new ForbiddenError('Cross-site request blocked.');
+        }
+        // 6. Final Fallback: Allow requests with NO headers (Non-browser clients)
+        // Note: This relies on the assumption that browsers will always send at least
+        // one of the headers checked above for mutating requests.
+        await next();
+    };
+}
+function normalizeHost(host) {
+    if (isNullOrUndefined(host) || (host == 'null')) {
+        return null;
+    }
+    try {
+        const url = host.startsWith('http://') || host.startsWith('https://')
+            ? new URL(host)
+            : new URL(`http://${host}`);
+        return url.hostname;
+    }
+    catch {
+        return null;
+    }
+}

package/api/server/middlewares/index.d.ts

@@ -2,4 +2,5 @@ export * from './allowed-methods.middleware.js';
 export * from './catch-error.middleware.js';
 export * from './content-type.middleware.js';
 export * from './cors.middleware.js';
+export * from './csrf.middleware.js';
 export * from './response-time.middleware.js';

package/api/server/middlewares/index.js

@@ -2,4 +2,5 @@ export * from './allowed-methods.middleware.js';
 export * from './catch-error.middleware.js';
 export * from './content-type.middleware.js';
 export * from './cors.middleware.js';
+export * from './csrf.middleware.js';
 export * from './response-time.middleware.js';

package/api/server/module.d.ts

@@ -1,3 +1,4 @@
+import { Injector } from '../../injector/injector.js';
 import type { Type } from '../../types/index.js';
 import { ApiRequestTokenProvider } from './api-request-token.provider.js';
 import type { ApiGatewayOptions } from './gateway.js';
@@ -6,5 +7,10 @@ export type ApiModuleOptions = {
     requestTokenProvider?: Type<ApiRequestTokenProvider>;
     gatewayOptions?: ApiGatewayOptions;
 };
-export declare const apiModuleOptions: ApiModuleOptions;
-export declare function configureApiServer(options: Partial<ApiModuleOptions>): void;
+/**
+ * configure api server module
+ * @param options module configuration
+ */
+export declare function configureApiServer({ injector, ...options }?: Partial<ApiModuleOptions> & {
+    injector?: Injector;
+}): void;

package/api/server/module.js

@@ -3,19 +3,25 @@ import { isDefined } from '../../utils/type-guards.js';
 import { ensureApiController } from './api-controller.js';
 import { ApiRequestTokenProvider } from './api-request-token.provider.js';
 import { API_CONTROLLER, API_MODULE_OPTIONS } from './tokens.js';
-export const apiModuleOptions = {
-    controllers: [],
-};
-export function configureApiServer(options) {
+/**
+ * configure api server module
+ * @param options module configuration
+ */
+export function configureApiServer({ injector, ...options } = {}) {
+    const targetInjector = injector ?? Injector;
     if (isDefined(options.controllers)) {
         for (const controller of options.controllers) {
             ensureApiController(controller);
-            Injector.register(API_CONTROLLER, { useToken: controller }, { multi: true });
+            targetInjector.register(API_CONTROLLER, { useToken: controller }, { multi: true });
         }
     }
     if (isDefined(options.requestTokenProvider)) {
-        Injector.register(ApiRequestTokenProvider, { useToken: options.requestTokenProvider });
+        targetInjector.register(ApiRequestTokenProvider, { useToken: options.requestTokenProvider });
     }
-    apiModuleOptions.gatewayOptions = options.gatewayOptions ?? apiModuleOptions.gatewayOptions;
-    Injector.register(API_MODULE_OPTIONS, { useValue: apiModuleOptions });
+    const moduleOptions = {
+        controllers: options.controllers ?? [],
+        gatewayOptions: options.gatewayOptions,
+        requestTokenProvider: options.requestTokenProvider,
+    };
+    targetInjector.register(API_MODULE_OPTIONS, { useValue: moduleOptions });
 }

package/api/server/tests/csrf.middleware.test.js

@@ -0,0 +1,91 @@
+import { ForbiddenError } from '../../../errors/index.js';
+import { HttpHeaders } from '../../../http/http-headers.js';
+import { HttpServerResponse } from '../../../http/server/index.js';
+import { toArray } from '../../../utils/array/array.js';
+import { describe, expect, it, vi } from 'vitest';
+import { csrfMiddleware } from '../middlewares/csrf.middleware.js';
+describe('csrfMiddleware', () => {
+    const middleware = csrfMiddleware();
+    it('should allow safe methods (GET, HEAD, OPTIONS, TRACE)', async () => {
+        const safeMethods = ['GET', 'HEAD', 'OPTIONS', 'TRACE'];
+        for (const method of safeMethods) {
+            const context = {
+                request: { method, headers: new HttpHeaders() },
+                response: new HttpServerResponse(),
+            };
+            const next = vi.fn();
+            await middleware(context, next);
+            expect(next).toHaveBeenCalled();
+        }
+    });
+    it('should allow mutating methods (POST, PUT, DELETE, PATCH) without headers (non-browser client)', async () => {
+        const mutatingMethods = ['POST', 'PUT', 'DELETE', 'PATCH'];
+        for (const method of mutatingMethods) {
+            const context = {
+                request: { method, headers: new HttpHeaders() },
+                response: new HttpServerResponse(),
+            };
+            const next = vi.fn();
+            await middleware(context, next);
+            expect(next).toHaveBeenCalled();
+        }
+    });
+    it('should allow same-origin requests via Sec-Fetch-Site', async () => {
+        const headers = new HttpHeaders();
+        headers.set('Sec-Fetch-Site', 'same-origin');
+        const context = {
+            request: { method: 'POST', headers },
+            response: new HttpServerResponse(),
+        };
+        const next = vi.fn();
+        await middleware(context, next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('should allow user-initiated requests via Sec-Fetch-Site (none) when enabled', async () => {
+        const middlewareWithNone = csrfMiddleware({ allowFetchSiteNone: true });
+        const headers = new HttpHeaders();
+        headers.set('Sec-Fetch-Site', 'none');
+        const context = {
+            request: { method: 'POST', headers },
+            response: new HttpServerResponse(),
+        };
+        const next = vi.fn();
+        await middlewareWithNone(context, next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('should reject cross-site requests via Sec-Fetch-Site', async () => {
+        const headers = new HttpHeaders();
+        headers.set('Sec-Fetch-Site', 'cross-site');
+        const context = {
+            request: { method: 'POST', headers },
+            response: new HttpServerResponse(),
+        };
+        const next = vi.fn();
+        await expect(middleware(context, next)).rejects.toThrow(ForbiddenError);
+        expect(next).not.toHaveBeenCalled();
+    });
+    it('should allow same-origin requests via Origin fallback', async () => {
+        const headers = new HttpHeaders();
+        headers.set('Origin', 'http://localhost:8080');
+        headers.set('Host', 'localhost:8080');
+        const context = {
+            request: { method: 'POST', headers },
+            response: new HttpServerResponse(),
+        };
+        const next = vi.fn();
+        await middleware(context, next);
+        expect(next).toHaveBeenCalled();
+    });
+    it('should include Vary: Sec-Fetch-Site, Origin for mutating methods', async () => {
+        const context = {
+            request: { method: 'POST', headers: new HttpHeaders() },
+            response: new HttpServerResponse(),
+        };
+        const next = vi.fn();
+        await middleware(context, next);
+        const vary = context.response.headers.tryGet('Vary');
+        const varyArray = toArray(vary).flatMap((v) => v.split(',').map((s) => s.trim()));
+        expect(varyArray).toContain('Sec-Fetch-Site');
+        expect(varyArray).toContain('Origin');
+    });
+});

package/audit/drizzle/{0000_bored_stick.sql → 0000_lumpy_thunderball.sql}

@@ -1,4 +1,4 @@
-CREATE TYPE "audit"."actor_type" AS ENUM('anonymous', 'system', 'api-key', 'user');--> statement-breakpoint
+CREATE TYPE "audit"."actor_type" AS ENUM('anonymous', 'system', 'api-key', 'subject');--> statement-breakpoint
 CREATE TYPE "audit"."audit_outcome" AS ENUM('pending', 'success', 'cancelled', 'failure', 'denied');--> statement-breakpoint
 CREATE TYPE "audit"."audit_severity" AS ENUM('info', 'warn', 'error', 'critical');--> statement-breakpoint
 CREATE TABLE "audit"."event" (
@@ -11,12 +11,12 @@ CREATE TABLE "audit"."event" (
 	"outcome" "audit"."audit_outcome" NOT NULL,
 	"severity" "audit"."audit_severity" NOT NULL,
 	"actor_type" "audit"."actor_type" NOT NULL,
-	"actor" text NOT NULL,
+	"actor" text,
 	"impersonator_type" "audit"."actor_type",
 	"impersonator" text,
 	"target_type" text NOT NULL,
 	"target_id" uuid NOT NULL,
-	"network_path" text NOT NULL,
+	"network_path" text,
 	"network_ip_address" text,
 	"network_user_agent" text,
 	"network_session_id" uuid,

package/audit/drizzle/meta/0000_snapshot.json

@@ -1,5 +1,5 @@
 {
-  "id": "8f6c87f8-1692-49bd-9bd4-09dc9d0bdcd4",
+  "id": "e6910cc2-1674-462e-be27-f94e3372393f",
   "prevId": "00000000-0000-0000-0000-000000000000",
   "version": "7",
   "dialect": "postgresql",
@@ -70,7 +70,7 @@
           "name": "actor",
           "type": "text",
           "primaryKey": false,
-          "notNull": true
+          "notNull": false
         },
         "impersonator_type": {
           "name": "impersonator_type",
@@ -101,7 +101,7 @@
           "name": "network_path",
           "type": "text",
           "primaryKey": false,
-          "notNull": true
+          "notNull": false
         },
         "network_ip_address": {
           "name": "network_ip_address",
@@ -157,7 +157,7 @@
         "anonymous",
         "system",
         "api-key",
-        "user"
+        "subject"
       ]
     },
     "audit.audit_outcome": {

package/audit/drizzle/meta/_journal.json

@@ -5,15 +5,8 @@
     {
       "idx": 0,
       "version": "7",
-      "when": 1758041172363,
-      "tag": "0000_bored_stick",
-      "breakpoints": true
-    },
-    {
-      "idx": 1,
-      "version": "7",
-      "when": 1762968766536,
-      "tag": "0001_previous_network",
+      "when": 1768666123825,
+      "tag": "0000_lumpy_thunderball",
       "breakpoints": true
     }
   ]

package/audit/module.d.ts

@@ -1,3 +1,4 @@
+import { Injector } from '../injector/index.js';
 import { type DatabaseConfig } from '../orm/server/index.js';
 /**
  * Configuration for {@link configureAudit}.
@@ -13,7 +14,9 @@ export declare class AuditModuleConfig {
  * Configures audit server services.
  * @param config Configuration.
  */
-export declare function configureAudit(config: AuditModuleConfig): void;
+export declare function configureAudit({ injector, ...config }?: AuditModuleConfig & {
+    injector?: Injector;
+}): void;
 /**
  * Migrates the audit database schema to the latest version.
  * It uses the database connection provided with {@link configureAudit},

package/audit/module.js

@@ -14,8 +14,9 @@ export class AuditModuleConfig {
  * Configures audit server services.
  * @param config Configuration.
  */
-export function configureAudit(config) {
-    Injector.register(AuditModuleConfig, { useValue: config });
+export function configureAudit({ injector, ...config } = {}) {
+    const targetInjector = injector ?? Injector;
+    targetInjector.register(AuditModuleConfig, { useValue: config });
 }
 /**
  * Migrates the audit database schema to the latest version.

package/audit/schemas.d.ts

@@ -17,6 +17,6 @@ export declare const actorType: import("../orm/enums.js").PgEnumFromEnumeration<
     readonly Anonymous: "anonymous";
     readonly System: "system";
     readonly ApiKey: "api-key";
-    readonly User: "user";
+    readonly Subject: "subject";
 }>;
 export declare const auditEvent: import("../orm/server/types.js").PgTableFromType<typeof AuditEvent, "audit">;

package/audit/types.d.ts

@@ -18,6 +18,6 @@ export declare const ActorType: {
     readonly Anonymous: "anonymous";
     readonly System: "system";
     readonly ApiKey: "api-key";
-    readonly User: "user";
+    readonly Subject: "subject";
 };
 export type ActorType = EnumType<typeof ActorType>;

package/audit/types.js

@@ -16,5 +16,5 @@ export const ActorType = defineEnum('ActorType', {
     Anonymous: 'anonymous',
     System: 'system',
     ApiKey: 'api-key',
-    User: 'user',
+    Subject: 'subject',
 });

package/authentication/client/authentication.service.d.ts

@@ -27,6 +27,7 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
     private readonly logger;
     private readonly disposeToken;
     private clockOffset;
+    private refreshLoopPromise;
     /**
      * Observable for authentication errors.
      * Emits when a refresh fails.
@@ -34,6 +35,12 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
     readonly error$: import("rxjs").Observable<Error>;
     /** Current token */
     readonly token: import("../../signals/api.js").WritableSignal<TokenPayload<AdditionalTokenPayload> | undefined>;
+    /** Current raw token */
+    readonly rawToken: import("../../signals/api.js").WritableSignal<string | undefined>;
+    /** Current raw refresh token */
+    readonly rawRefreshToken: import("../../signals/api.js").WritableSignal<string | undefined>;
+    /** Current raw impersonator refresh token */
+    readonly rawImpersonatorRefreshToken: import("../../signals/api.js").WritableSignal<string | undefined>;
     /** Whether the user is logged in */
     readonly isLoggedIn: import("../../signals/api.js").Signal<boolean>;
     /** Current session id */
@@ -170,9 +177,15 @@ export declare class AuthenticationClientService<AdditionalTokenPayload extends
      * @returns The result of the check
      */
     checkSecret(secret: string): Promise<SecretCheckResult>;
+    /**
+     * Update raw tokens.
+     * @param token Raw token
+     * @param refreshToken Raw refresh token
+     * @param impersonatorRefreshToken Raw impersonator refresh token
+     */
+    updateRawTokens(token?: string, refreshToken?: string, impersonatorRefreshToken?: string): void;
     private setNewToken;
     private refreshLoop;
-    private refreshLoopIteration;
     private handleRefreshError;
     private estimatedServerTimestampSeconds;
     private syncClock;