@venturekit/auth 0.0.0-dev.20260701100017 → 0.0.0-dev.20260704225856

package/dist/index.d.ts

@@ -6,7 +6,8 @@
 export * from './types/index.js';
 export { createCognitoConfig, DEFAULT_COGNITO_CONFIG, buildUserPoolConfig, } from './cognito/index.js';
 export type { UserPoolOutputs, UserPoolInfraConfig } from './cognito/user-pool.js';
-export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, } from './roles/index.js';
+export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './roles/index.js';
+export type { Querier, RoleScopeRow, RoleScopesLookup, RoleScopesResolver, RoleScopesResolverOptions, } from './roles/index.js';
 export { decodeTokenUnsafe, decodeToken, // deprecated alias of decodeTokenUnsafe
 verifyAndDecode, extractUserFromToken, isTokenExpired, getTokenExpiry, } from './session/index.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAGnF,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,EAInB,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/dist/index.js

@@ -8,7 +8,11 @@ export * from './types/index.js';
 // Cognito
 export { createCognitoConfig, DEFAULT_COGNITO_CONFIG, buildUserPoolConfig, } from './cognito/index.js';
 // Roles
-export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, } from './roles/index.js';
+export { hasScope, hasAnyScope, hasAllScopes, getScopesForRoles, validateRolesConfig, 
+// DB-backed role → scopes mapping (vk_role_scopes: structure ships
+// with this package's migrations, rows owned by the app; cached
+// resolver for scope-granting middleware + CRUD for management UIs)
+listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './roles/index.js';
 // Session
 export { decodeTokenUnsafe, decodeToken, // deprecated alias of decodeTokenUnsafe
 verifyAndDecode, extractUserFromToken, isTokenExpired, getTokenExpiry, } from './session/index.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,QAAQ;AACR,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB,GACpB,MAAM,kBAAkB,CAAC;AAE1B,UAAU;AACV,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,QAAQ;AACR,cAAc,kBAAkB,CAAC;AAEjC,UAAU;AACV,OAAO,EACL,mBAAmB,EACnB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAG5B,QAAQ;AACR,OAAO,EACL,QAAQ,EACR,WAAW,EACX,YAAY,EACZ,iBAAiB,EACjB,mBAAmB;AACnB,mEAAmE;AACnE,gEAAgE;AAChE,oEAAoE;AACpE,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAS1B,UAAU;AACV,OAAO,EACL,iBAAiB,EACjB,WAAW,EAAE,wCAAwC;AACrD,eAAe,EACf,oBAAoB,EACpB,cAAc,EACd,cAAc,GACf,MAAM,oBAAoB,CAAC"}

package/{migrations → dist/migrations}/vk_auth_001_verification_codes.sql

@@ -1,7 +1,10 @@
 -- vk_auth_001_verification_codes.sql
 --
--- Owned by `@venturekit/auth`. Backs `VerificationCodeStore` (used by
--- the OTP gating on self-service sign-up + sign-in / passwordless).
+-- Owned by `@venturekit/auth`. Creates the `vk_verification_codes`
+-- table backing `VerificationCodeStore` (used by the OTP gating on
+-- self-service sign-up + sign-in / passwordless). The table is
+-- `vk_`-prefixed per VentureKit's "package-owned tables are prefixed"
+-- convention; consumer-side stores must query `vk_verification_codes`.
 --
 -- Rows are pre-Cognito state — created BEFORE a user exists in either
 -- Cognito or any consumer-side `users` mirror. The `identifier` is the
@@ -31,7 +34,7 @@
 -- expectation is that those projects will then leave their old
 -- migration file in place but stop hand-maintaining the schema here.
 
-CREATE TABLE IF NOT EXISTS verification_codes (
+CREATE TABLE IF NOT EXISTS vk_verification_codes (
   channel       TEXT        NOT NULL,
   identifier    TEXT        NOT NULL,
   code_hash     TEXT        NOT NULL,
@@ -49,4 +52,4 @@ CREATE TABLE IF NOT EXISTS verification_codes (
 );
 
 CREATE INDEX IF NOT EXISTS idx_verification_codes_expires_at
-  ON verification_codes (expires_at);
+  ON vk_verification_codes (expires_at);

package/dist/migrations/vk_auth_003_role_scopes.sql

@@ -0,0 +1,43 @@
+-- @venturekit/auth — role → scopes mapping.
+--
+-- The DB is the SOURCE OF TRUTH for which scopes each role grants.
+-- VentureKit ships the STRUCTURE (this migration, applied automatically
+-- with every other package migration); the consuming app ships DATA
+-- migrations to seed its own taxonomy, e.g.:
+--
+--   INSERT INTO vk_role_scopes (role, scope) VALUES
+--     ('member',    'member.verified'),
+--     ('moderator', 'member.verified'),
+--     ('moderator', 'moderation.reports.read')
+--   ON CONFLICT DO NOTHING;
+--
+-- Lives in @venturekit/auth — NOT in a pro package — because a role →
+-- scopes matrix is baseline authorization for ANY app: single-tenant
+-- apps key it by their global user role; multi-tenant apps feed it to
+-- `@venturekit-pro/tenancy`'s scopes middleware
+-- (`createTenantUserScopesMiddleware({ scopesByRole: resolver.lookup })`).
+--
+-- At runtime the mapping is read through `createRoleScopesResolver()`
+-- (cached, TTL-refreshed). Mutations go through `setRoleScopes` /
+-- `grantScopeToRole` / `revokeScopeFromRole`, so apps can build
+-- management UIs on top — changes propagate to warm instances within
+-- the resolver's TTL.
+--
+-- Deliberately GLOBAL (no tenant column): the mapping is the app's
+-- authorization POLICY, not tenant data. Per-tenant overrides, if ever
+-- needed, belong in a separate overlay table so the hot path stays a
+-- single cached full-table read.
+
+CREATE TABLE IF NOT EXISTS vk_role_scopes (
+  role        text        NOT NULL,
+  scope       text        NOT NULL,
+  created_at  timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (role, scope)
+);
+
+COMMENT ON TABLE vk_role_scopes IS
+  'Role → scope grants. Structure owned by @venturekit/auth; rows owned by the consuming app (seed via app migrations, manage via the role-scopes helpers).';
+
+-- Scope grants are read by role on every request that misses the
+-- resolver cache; the PK already serves (role, scope) lookups and
+-- role-prefix scans.

package/dist/roles/index.d.ts

@@ -1,8 +1,12 @@
 /**
  * Roles
  *
- * Utilities for managing roles and scopes.
+ * Utilities for managing roles and scopes — the static config helpers
+ * below, plus the DB-backed `vk_role_scopes` mapping (CRUD + cached
+ * resolver) in ./role-scopes.ts.
  */
+export { listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './role-scopes.js';
+export type { Querier, RoleScopeRow, RoleScopesLookup, RoleScopesResolver, RoleScopesResolverOptions, } from './role-scopes.js';
 import type { RolesConfig } from '../types/index.js';
 /**
  * Check if user roles grant a specific scope

package/dist/roles/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAQT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,WAAW,GAClB,MAAM,EAAE,CAWV;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAejE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAC1B,YAAY,EACV,OAAO,EACP,YAAY,EACZ,gBAAgB,EAChB,kBAAkB,EAClB,yBAAyB,GAC1B,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAQ,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAE3D;;GAEG;AACH,wBAAgB,QAAQ,CACtB,SAAS,EAAE,MAAM,EAAE,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,WAAW,GAClB,OAAO,CAQT;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,YAAY,CAC1B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,MAAM,EAAE,EAChB,MAAM,EAAE,WAAW,GAClB,OAAO,CAET;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,SAAS,EAAE,MAAM,EAAE,EACnB,MAAM,EAAE,WAAW,GAClB,MAAM,EAAE,CAWV;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,WAAW,GAAG,MAAM,EAAE,CAejE"}

package/dist/roles/index.js

@@ -1,8 +1,11 @@
 /**
  * Roles
  *
- * Utilities for managing roles and scopes.
+ * Utilities for managing roles and scopes — the static config helpers
+ * below, plus the DB-backed `vk_role_scopes` mapping (CRUD + cached
+ * resolver) in ./role-scopes.ts.
  */
+export { listRoleScopes, getRoleScopes, setRoleScopes, grantScopeToRole, revokeScopeFromRole, createRoleScopesResolver, } from './role-scopes.js';
 /**
  * Check if user roles grant a specific scope
  */

package/dist/roles/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAIH;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAmB,EACnB,KAAa,EACb,MAAmB;IAEnB,6BAA6B;IAC7B,IAAI,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAmB,EACnB,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,cAAc,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/roles/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,cAAc,EACd,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,kBAAkB,CAAC;AAW1B;;GAEG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAmB,EACnB,KAAa,EACb,MAAmB;IAEnB,6BAA6B;IAC7B,IAAI,MAAM,CAAC,cAAc,IAAI,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,iBAAiB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACxD,OAAO,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AACpC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAC1B,SAAmB,EACnB,MAAgB,EAChB,MAAmB;IAEnB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,SAAmB,EACnB,MAAmB;IAEnB,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IAEjC,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACjE,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAmB;IACrD,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAO,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEjE,4BAA4B;IAC5B,IAAI,MAAM,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7D,MAAM,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,WAAW,kBAAkB,CAAC,CAAC;IACrE,CAAC;IAED,gCAAgC;IAChC,IAAI,MAAM,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QACnE,MAAM,CAAC,IAAI,CAAC,qBAAqB,MAAM,CAAC,cAAc,kBAAkB,CAAC,CAAC;IAC5E,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/roles/role-scopes.d.ts

@@ -0,0 +1,92 @@
+/**
+ * DB-backed role → scopes mapping over `vk_role_scopes`.
+ *
+ * The table structure ships with this package
+ * (`migrations/vk_auth_003_role_scopes.sql`); the ROWS are the
+ * consuming app's authorization policy — seeded by an app data
+ * migration and mutable at runtime through the helpers here, so apps
+ * can put a management UI on top without redeploying to change what a
+ * role may do.
+ *
+ * Sits in `@venturekit/auth` (not a pro package) because a role →
+ * scopes matrix is baseline authorization for ANY app:
+ *   - single-tenant apps resolve their global user role through
+ *     {@link createRoleScopesResolver} and grant the result;
+ *   - multi-tenant apps pass `resolver.lookup` straight to
+ *     `@venturekit-pro/tenancy`'s
+ *     `createTenantUserScopesMiddleware({ scopesByRole })`.
+ *
+ * Reading on the hot path goes through the resolver: one full-table
+ * read, cached per process with a TTL (default 30s).
+ *
+ * **Consistency model.** Mutations are visible to the mutating
+ * instance immediately when it calls `resolver.invalidate()`, and to
+ * every other warm instance within one TTL — scope-mapping changes
+ * are rare and tolerate seconds of convergence.
+ *
+ * All helpers take a caller-supplied {@link Querier} — no hard
+ * dependency on `@venturekit/data`.
+ */
+/**
+ * Minimal query interface — same shape as `@venturekit/data`'s `query`
+ * and the Queriers used across the workspace. Declared locally so this
+ * package carries no data-layer dependency.
+ */
+export type Querier = <T = Record<string, unknown>[]>(sql: string, params?: unknown[]) => Promise<T>;
+/** One `vk_role_scopes` row. */
+export interface RoleScopeRow {
+    role: string;
+    scope: string;
+}
+/**
+ * Lookup signature scope-granting middleware consumes. Returning `[]`
+ * (unknown role) grants nothing — fail-closed.
+ */
+export type RoleScopesLookup = (role: string) => Promise<readonly string[]> | readonly string[];
+/** The full mapping, `{ role: [scope, …] }`, scopes sorted. */
+export declare function listRoleScopes(querier: Querier): Promise<Record<string, string[]>>;
+/** Scopes granted by one role (empty array when the role is unknown). */
+export declare function getRoleScopes(querier: Querier, role: string): Promise<string[]>;
+/**
+ * Replace a role's scope set atomically (single statement — a request
+ * racing the change sees either the old or the new complete set,
+ * never a partial one). An empty `scopes` array removes the role.
+ */
+export declare function setRoleScopes(querier: Querier, role: string, scopes: readonly string[]): Promise<void>;
+/** Add one grant. Idempotent. */
+export declare function grantScopeToRole(querier: Querier, role: string, scope: string): Promise<void>;
+/** Remove one grant. Idempotent. */
+export declare function revokeScopeFromRole(querier: Querier, role: string, scope: string): Promise<void>;
+export interface RoleScopesResolverOptions {
+    /** How the resolver reaches the DB. */
+    querier: Querier;
+    /**
+     * Cache lifetime, ms. Default 30 000. Governs how fast a mapping
+     * change propagates to OTHER warm instances (the mutating instance
+     * calls `invalidate()` and sees it immediately).
+     */
+    ttlMs?: number;
+}
+export interface RoleScopesResolver {
+    /**
+     * `(role) => scopes`. Pass as `scopesByRole` to tenancy's
+     * `createTenantUserScopesMiddleware`, or call directly from custom
+     * scope-granting middleware.
+     */
+    lookup: RoleScopesLookup;
+    /** Drop the cache — the next lookup reloads from the DB. */
+    invalidate(): void;
+}
+/**
+ * Build the cached mapping resolver.
+ *
+ * Failure semantics:
+ *   - load fails and a previous snapshot exists → serve the stale
+ *     snapshot (authorization availability beats freshness; the next
+ *     lookup retries the load);
+ *   - load fails with NO snapshot (cold start during a DB outage) →
+ *     the error propagates, failing the request loudly rather than
+ *     silently granting nothing to everyone.
+ */
+export declare function createRoleScopesResolver(options: RoleScopesResolverOptions): RoleScopesResolver;
+//# sourceMappingURL=role-scopes.d.ts.map

package/dist/roles/role-scopes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-scopes.d.ts","sourceRoot":"","sources":["../../src/roles/role-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH;;;;GAIG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,EAClD,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,OAAO,EAAE,KACf,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhB,gCAAgC;AAChC,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,KACT,OAAO,CAAC,SAAS,MAAM,EAAE,CAAC,GAAG,SAAS,MAAM,EAAE,CAAC;AAIpD,+DAA+D;AAC/D,wBAAsB,cAAc,CAClC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CASnC;AAED,yEAAyE;AACzE,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,MAAM,EAAE,CAAC,CAMnB;AAED;;;;GAIG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,SAAS,MAAM,EAAE,GACxB,OAAO,CAAC,IAAI,CAAC,CAUf;AAED,iCAAiC;AACjC,wBAAsB,gBAAgB,CACpC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAOf;AAED,oCAAoC;AACpC,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAKf;AAID,MAAM,WAAW,yBAAyB;IACxC,uCAAuC;IACvC,OAAO,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,kBAAkB;IACjC;;;;OAIG;IACH,MAAM,EAAE,gBAAgB,CAAC;IACzB,4DAA4D;IAC5D,UAAU,IAAI,IAAI,CAAC;CACpB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,yBAAyB,GACjC,kBAAkB,CAyCpB"}

package/dist/roles/role-scopes.js

@@ -0,0 +1,122 @@
+/**
+ * DB-backed role → scopes mapping over `vk_role_scopes`.
+ *
+ * The table structure ships with this package
+ * (`migrations/vk_auth_003_role_scopes.sql`); the ROWS are the
+ * consuming app's authorization policy — seeded by an app data
+ * migration and mutable at runtime through the helpers here, so apps
+ * can put a management UI on top without redeploying to change what a
+ * role may do.
+ *
+ * Sits in `@venturekit/auth` (not a pro package) because a role →
+ * scopes matrix is baseline authorization for ANY app:
+ *   - single-tenant apps resolve their global user role through
+ *     {@link createRoleScopesResolver} and grant the result;
+ *   - multi-tenant apps pass `resolver.lookup` straight to
+ *     `@venturekit-pro/tenancy`'s
+ *     `createTenantUserScopesMiddleware({ scopesByRole })`.
+ *
+ * Reading on the hot path goes through the resolver: one full-table
+ * read, cached per process with a TTL (default 30s).
+ *
+ * **Consistency model.** Mutations are visible to the mutating
+ * instance immediately when it calls `resolver.invalidate()`, and to
+ * every other warm instance within one TTL — scope-mapping changes
+ * are rare and tolerate seconds of convergence.
+ *
+ * All helpers take a caller-supplied {@link Querier} — no hard
+ * dependency on `@venturekit/data`.
+ */
+/* ─── CRUD ──────────────────────────────────────────────────────── */
+/** The full mapping, `{ role: [scope, …] }`, scopes sorted. */
+export async function listRoleScopes(querier) {
+    const rows = await querier(`SELECT role, scope FROM vk_role_scopes ORDER BY role, scope`);
+    const out = {};
+    for (const { role, scope } of rows) {
+        (out[role] ??= []).push(scope);
+    }
+    return out;
+}
+/** Scopes granted by one role (empty array when the role is unknown). */
+export async function getRoleScopes(querier, role) {
+    const rows = await querier(`SELECT scope FROM vk_role_scopes WHERE role = $1 ORDER BY scope`, [role]);
+    return rows.map((r) => r.scope);
+}
+/**
+ * Replace a role's scope set atomically (single statement — a request
+ * racing the change sees either the old or the new complete set,
+ * never a partial one). An empty `scopes` array removes the role.
+ */
+export async function setRoleScopes(querier, role, scopes) {
+    await querier(`WITH removed AS (
+       DELETE FROM vk_role_scopes WHERE role = $1
+     )
+     INSERT INTO vk_role_scopes (role, scope)
+     SELECT $1, s FROM unnest($2::text[]) AS s
+     ON CONFLICT DO NOTHING`, [role, [...scopes]]);
+}
+/** Add one grant. Idempotent. */
+export async function grantScopeToRole(querier, role, scope) {
+    await querier(`INSERT INTO vk_role_scopes (role, scope)
+     VALUES ($1, $2)
+     ON CONFLICT DO NOTHING`, [role, scope]);
+}
+/** Remove one grant. Idempotent. */
+export async function revokeScopeFromRole(querier, role, scope) {
+    await querier(`DELETE FROM vk_role_scopes WHERE role = $1 AND scope = $2`, [
+        role,
+        scope,
+    ]);
+}
+/**
+ * Build the cached mapping resolver.
+ *
+ * Failure semantics:
+ *   - load fails and a previous snapshot exists → serve the stale
+ *     snapshot (authorization availability beats freshness; the next
+ *     lookup retries the load);
+ *   - load fails with NO snapshot (cold start during a DB outage) →
+ *     the error propagates, failing the request loudly rather than
+ *     silently granting nothing to everyone.
+ */
+export function createRoleScopesResolver(options) {
+    const ttlMs = options.ttlMs ?? 30_000;
+    let snapshot = null;
+    let loadedAt = 0;
+    let inflight = null;
+    const load = () => {
+        inflight ??= listRoleScopes(options.querier)
+            .then((mapping) => {
+            snapshot = mapping;
+            loadedAt = Date.now();
+            return mapping;
+        })
+            .finally(() => {
+            inflight = null;
+        });
+        return inflight;
+    };
+    const lookup = async (role) => {
+        if (!snapshot || Date.now() - loadedAt >= ttlMs) {
+            try {
+                await load();
+            }
+            catch (err) {
+                if (!snapshot)
+                    throw err;
+                // Stale-but-present beats down: keep serving the last good
+                // snapshot; a later lookup retries.
+                loadedAt = Date.now();
+            }
+        }
+        return snapshot?.[role] ?? [];
+    };
+    return {
+        lookup,
+        invalidate() {
+            snapshot = null;
+            loadedAt = 0;
+        },
+    };
+}
+//# sourceMappingURL=role-scopes.js.map

package/dist/roles/role-scopes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-scopes.js","sourceRoot":"","sources":["../../src/roles/role-scopes.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AA0BH,uEAAuE;AAEvE,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAgB;IAEhB,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,6DAA6D,CAC9D,CAAC;IACF,MAAM,GAAG,GAA6B,EAAE,CAAC;IACzC,KAAK,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,IAAI,EAAE,CAAC;QACnC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,IAAY;IAEZ,MAAM,IAAI,GAAG,MAAM,OAAO,CACxB,iEAAiE,EACjE,CAAC,IAAI,CAAC,CACP,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAClC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,IAAY,EACZ,MAAyB;IAEzB,MAAM,OAAO,CACX;;;;;4BAKwB,EACxB,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CACpB,CAAC;AACJ,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,OAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,CACX;;4BAEwB,EACxB,CAAC,IAAI,EAAE,KAAK,CAAC,CACd,CAAC;AACJ,CAAC;AAED,oCAAoC;AACpC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,CAAC,2DAA2D,EAAE;QACzE,IAAI;QACJ,KAAK;KACN,CAAC,CAAC;AACL,CAAC;AA0BD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,wBAAwB,CACtC,OAAkC;IAElC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,CAAC;IAEtC,IAAI,QAAQ,GAAoC,IAAI,CAAC;IACrD,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,QAAQ,GAA6C,IAAI,CAAC;IAE9D,MAAM,IAAI,GAAG,GAAsC,EAAE;QACnD,QAAQ,KAAK,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC;aACzC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;YAChB,QAAQ,GAAG,OAAO,CAAC;YACnB,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACtB,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;IAEF,MAAM,MAAM,GAAqB,KAAK,EAAE,IAAI,EAAE,EAAE;QAC9C,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,KAAK,EAAE,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,IAAI,EAAE,CAAC;YACf,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,QAAQ;oBAAE,MAAM,GAAG,CAAC;gBACzB,2DAA2D;gBAC3D,oCAAoC;gBACpC,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACxB,CAAC;QACH,CAAC;QACD,OAAO,QAAQ,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IAChC,CAAC,CAAC;IAEF,OAAO;QACL,MAAM;QACN,UAAU;YACR,QAAQ,GAAG,IAAI,CAAC;YAChB,QAAQ,GAAG,CAAC,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/cookies.d.ts

@@ -6,20 +6,25 @@
  *   - `HttpOnly` — JS in the browser cannot read these. The browser
  *     attaches them automatically when fetching with
  *     `credentials: 'include'`.
- *   - `Secure` — set when {@link CookieOptions.secure} is true (default:
- *     `process.env.NODE_ENV === 'production'`). Omitted in dev so cookies
- *     work over plain HTTP localhost.
+ *   - `Secure` — set when {@link CookieOptions.secure} is true. Defaults to
+ *     ON everywhere except explicit local dev (`VENTURE_LOCAL === 'true'`,
+ *     set by `vk dev`), so production cookies are always `Secure` while
+ *     localhost over plain HTTP keeps working.
  *   - `SameSite=Lax` for the id/access cookies, `SameSite=Strict` for
  *     the refresh cookie. The refresh cookie is only ever sent to the
  *     paths under {@link CookieOptions.refreshPath} (default `/auth`)
  *     so it never leaks to non-auth handlers.
  *   - `Path=/` for the id/access tokens, `Path=/auth` for refresh.
  *
- * The cookies are **host-only** (no `Domain` attribute) so they're
- * scoped to the host the response came from. The browser sends them on
- * every request to that host, including cross-origin XHR from a sibling
- * subdomain when `credentials: 'include'` is used and both hosts share
- * the same registrable domain.
+ * The cookies are **host-only** (no `Domain` attribute) by default, so
+ * they're scoped to the host the response came from. The browser sends
+ * them on every request to that host, including cross-origin XHR from a
+ * sibling subdomain when `credentials: 'include'` is used and both hosts
+ * share the same registrable domain. Apps that need the session to
+ * survive host changes — `www.` ↔ apex on a white-label domain, or
+ * cross-subdomain navigation in dev — pass {@link CookieOptions.domain}
+ * (usually computed per request with {@link resolveCookieDomain}) and
+ * every cookie gains a `Domain=` attribute.
  */
 export declare const ID_TOKEN_COOKIE = "vk_id_token";
 export declare const ACCESS_TOKEN_COOKIE = "vk_access_token";
@@ -34,20 +39,53 @@ export interface SessionTokens {
 }
 export interface CookieOptions {
     /**
-     * Emit the `Secure` flag. Defaults to
-     * `process.env.NODE_ENV === 'production'`.
+     * Emit the `Secure` flag. Defaults to ON unless `VENTURE_LOCAL === 'true'`
+     * (local dev, set by `vk dev`).
      */
     secure?: boolean;
     /**
      * Path scope for the refresh cookie. Defaults to `/auth`. The refresh
      * token is never sent on requests outside this prefix.
+     *
+     * Set this to the auth prefix **as the browser sees it**: an SPA that
+     * reaches the API through a same-origin `/api` proxy must use
+     * `/api/auth`, otherwise the browser never attaches the refresh
+     * cookie to `/api/auth/refresh` and the session dies when the id
+     * token expires.
      */
     refreshPath?: string;
     /**
      * Lifetime of the refresh cookie in seconds. Defaults to 30 days.
      */
     refreshMaxAgeSeconds?: number;
+    /**
+     * Emit a `Domain=` attribute on every cookie. Omit (default) for
+     * host-only cookies.
+     *
+     * Needed whenever the session must survive a host change: pinning to
+     * the apex so `www.example.com` and `example.com` share the session,
+     * or cross-subdomain navigation on a multi-tenant platform. Compute
+     * it per request with {@link resolveCookieDomain}.
+     *
+     * Clears MUST use the same domain as the set: a browser only deletes
+     * a cookie when the clear's Domain + Path match the original, so pass
+     * the same options to {@link buildClearSessionCookies}.
+     */
+    domain?: string;
 }
+/**
+ * Default value for the cookie `Secure` flag.
+ *
+ * Secure is ON everywhere EXCEPT explicit local development, detected via
+ * `VENTURE_LOCAL === 'true'` (set by `vk dev`). A deployed Lambda never sets
+ * `VENTURE_LOCAL`, so production cookies always get `Secure`.
+ *
+ * This deliberately does NOT key off `NODE_ENV`: the AWS Lambda runtime does
+ * not set `NODE_ENV=production`, and the infra layer historically did not
+ * inject it, so the old `NODE_ENV === 'production'` default silently shipped
+ * session cookies WITHOUT `Secure` in production.
+ */
+export declare function defaultSecure(): boolean;
 /**
  * Build the `Set-Cookie` header values to attach to a sign-in / refresh
  * response. Returns an array — API Gateway v2 supports multi-valued
@@ -75,8 +113,8 @@ export declare function buildClearSessionCookies(options?: CookieOptions): strin
 export declare function oauthStateCookieName(provider: string): string;
 export interface OAuthStateCookieOptions {
     /**
-     * Emit the `Secure` flag. Defaults to
-     * `process.env.NODE_ENV === 'production'`.
+     * Emit the `Secure` flag. Defaults to ON unless `VENTURE_LOCAL === 'true'`
+     * (local dev, set by `vk dev`).
      */
     secure?: boolean;
     /**
@@ -91,6 +129,14 @@ export interface OAuthStateCookieOptions {
      * sub-second TTLs.
      */
     maxAgeSeconds?: number;
+    /**
+     * Emit a `Domain=` attribute. Omit (default) for a host-only cookie —
+     * the start and callback requests normally hit the same browser
+     * origin, so host-only is almost always right. Accepted so callers
+     * threading one {@link CookieOptions} bag through a whole auth flow
+     * don't need a special case.
+     */
+    domain?: string;
 }
 /**
  * Build the `Set-Cookie` header value pinning the OAuth CSRF `state`
@@ -122,7 +168,46 @@ export declare function buildOAuthStateCookie(provider: string, value: string, o
  * by {@link buildOAuthStateCookie}. Emit at the end of the callback
  * flow so a stale `state` can't be replayed.
  */
-export declare function clearOAuthStateCookie(provider: string, options?: Pick<OAuthStateCookieOptions, 'secure' | 'path'>): string;
+export declare function clearOAuthStateCookie(provider: string, options?: Pick<OAuthStateCookieOptions, 'secure' | 'path' | 'domain'>): string;
+export interface CookieDomainOptions {
+    /**
+     * The platform's own registrable domain (e.g. `example.com` for a
+     * platform serving tenants on `<slug>.example.com`). Hosts equal to
+     * it or ending in `.<platformApex>` are treated as platform hosts;
+     * anything else is a white-label custom domain.
+     */
+    platformApex: string;
+    /**
+     * What to do for platform hosts:
+     *   - `false` (default) — return `undefined`, i.e. host-only cookies.
+     *     Right for prod multi-tenant platforms where each tenant
+     *     subdomain is its own session boundary.
+     *   - `true` — return the platform apex so the session is shared
+     *     across every platform subdomain. Typical for dev, where the
+     *     login page and the tenant SPA live on different subdomains of
+     *     the same wildcard /etc/hosts entry.
+     * Custom domains are always pinned to their own apex regardless.
+     */
+    pinPlatform?: boolean;
+}
+/**
+ * Compute the {@link CookieOptions.domain} value for a request host on
+ * a white-label multi-tenant platform.
+ *
+ * Decision table (`platformApex: 'example.com'`):
+ *   - `app.example.com` → `undefined` (host-only) — or `example.com`
+ *     with `pinPlatform: true`.
+ *   - `www.acme.io` / `acme.io` (custom domain) → `acme.io`, so the
+ *     `www.` and bare hosts share the session.
+ *   - `''` → `undefined`.
+ *
+ * Ports are stripped (`app.example.com:3000` → platform host), and
+ * matching is case-insensitive. Pass the BROWSER-facing host — behind
+ * a same-origin SPA proxy that's the `origin`/`referer` host, not the
+ * Lambda's `host` header (see `getRequestHost` in
+ * `@venturekit/runtime`).
+ */
+export declare function resolveCookieDomain(requestHost: string, options: CookieDomainOptions): string | undefined;
 /**
  * Read a single cookie out of a `Cookie:` header value. Returns `null`
  * when the cookie is absent. Permissive: duplicates take the last

package/dist/server/cookies.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAIvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;OAGG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AA0CD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,aAAa,GACtB,MAAM,EAAE,CAqBV;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAY1E;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAWR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,MAAM,CAAC,GACzD,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAef"}
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/server/cookies.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,eAAe,gBAAgB,CAAC;AAC7C,eAAO,MAAM,mBAAmB,oBAAoB,CAAC;AACrD,eAAO,MAAM,oBAAoB,qBAAqB,CAAC;AAIvD,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,oEAAoE;IACpE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;;;;;;OASG;IACH,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;OAEG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;;;;;OAYG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AASD;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAwCD;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,aAAa,EACrB,OAAO,CAAC,EAAE,aAAa,GACtB,MAAM,EAAE,CA0BV;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,MAAM,EAAE,CAY1E;AAUD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE7D;AAED,MAAM,WAAW,uBAAuB;IACtC;;;OAGG;IACH,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;;OAMG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,uBAAuB,GAChC,MAAM,CAYR;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,CAAC,GACpE,MAAM,CAYR;AAED,MAAM,WAAW,mBAAmB;IAClC;;;;;OAKG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;;;;;OAUG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,mBAAmB,GAC3B,MAAM,GAAG,SAAS,CAUpB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAClC,eAAe,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,EAC1C,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,IAAI,CAef"}