@warlock.js/auth 5.28.0 → 5.30.0

package/esm/providers/x-provider.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"x-provider.mjs","names":[],"sources":["../../../../../../../auth/src/providers/x-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n  XProviderConfig,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://twitter.com/i/oauth2/authorize\";\nconst TOKEN_ENDPOINT = \"https://api.twitter.com/2/oauth2/token\";\nconst USER_ENDPOINT = \"https://api.twitter.com/2/users/me\";\nconst DEFAULT_SCOPES = [\"tweet.read\", \"users.read\"];\n\ntype XUser = {\n  id: string;\n  name?: string;\n  username?: string;\n  profile_image_url?: string;\n};\n\n/**\n * X (Twitter) sign-in: OAuth 2.0 authorization code flow with PKCE (S256). X\n * is not OpenID Connect — there is no `id_token`. X's confidential clients\n * authenticate the token request with HTTP Basic auth (`client_id:client_secret`),\n * on top of PKCE — both are required together, per X's developer docs (this\n * package has no X test app, so the exchange itself is unverified against a\n * live endpoint). The access token is then redeemed once against\n * `GET /2/users/me`.\n *\n * X does not return an email address from this API at all — there is no\n * \"email\" scope to request it with — so `email` is always left `undefined`\n * rather than invented, and `resolveProviderUser` rejects it the same way it\n * rejects any other missing email.\n */\nexport class XProvider implements AuthProvider {\n  public readonly name = \"x\";\n\n  public constructor(private readonly settings: XProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      // X does not hand back an email address from this API.\n      email: undefined,\n      emailVerified: false,\n      name: user.name ?? user.username,\n      avatar: user.profile_image_url,\n      raw: user,\n    };\n  }\n\n  /** Basic-auth credential for the confidential-client token request. */\n  private basicAuth(): string {\n    return Buffer.from(`${this.settings.clientId}:${this.settings.clientSecret}`).toString(\n      \"base64\",\n    );\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown; error?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          authorization: `Basic ${this.basicAuth()}`,\n        },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`X token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown; error?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (body.error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", body.error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<XUser> {\n    try {\n      const url = new URL(USER_ENDPOINT);\n\n      url.searchParams.set(\"user.fields\", \"profile_image_url\");\n\n      const response = await fetch(url.toString(), {\n        headers: { authorization: `Bearer ${accessToken}` },\n      });\n\n      if (!response.ok) {\n        throw new Error(`X /2/users/me endpoint answered ${response.status}`);\n      }\n\n      const body = (await response.json()) as { data?: XUser };\n\n      return body.data ?? ({} as XUser);\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,cAAc,YAAY;;;;;;;;;;;;;;;AAuBlD,IAAa,YAAb,MAA+C;CAG7C,AAAO,YAAY,AAAiB,UAA2B;EAA3B;cAFb;CAEyC;CAEhE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GAErB,OAAO;GACP,eAAe;GACf,MAAM,KAAK,QAAQ,KAAK;GACxB,QAAQ,KAAK;GACb,KAAK;EACP;CACF;;CAGA,AAAQ,YAAoB;EAC1B,OAAO,OAAO,KAAK,GAAG,KAAK,SAAS,SAAS,GAAG,KAAK,SAAS,cAAc,CAAC,CAAC,SAC5E,QACF;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,eAAe,SAAS,KAAK,UAAU;IACzC;IACA,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,6BAA6B,SAAS,QAAQ;GAGhE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,KAAK,OACP,MAAM,IAAI,6BAA6B,wBAAwB,KAAK,KAAK;EAG3E,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAAqC;EAC3D,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,aAAa;GAEjC,IAAI,aAAa,IAAI,eAAe,mBAAmB;GAEvD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAC3C,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;GAKtE,QAAO,MAFa,SAAS,KAAK,EAEvB,CAAC,QAAS,CAAC;EACxB,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}
+{"version":3,"file":"x-provider.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/providers/x-provider.ts"],"sourcesContent":["import type {\n  AuthProvider,\n  ProviderAuthorizationState,\n  ProviderCallbackParams,\n  ProviderProfile,\n  XProviderConfig,\n} from \"../contracts/providers\";\nimport { InvalidProviderCallbackError } from \"../errors/invalid-provider-callback.error\";\nimport { pkceChallenge } from \"./google-provider\";\n\nconst AUTHORIZATION_ENDPOINT = \"https://twitter.com/i/oauth2/authorize\";\nconst TOKEN_ENDPOINT = \"https://api.twitter.com/2/oauth2/token\";\nconst USER_ENDPOINT = \"https://api.twitter.com/2/users/me\";\nconst DEFAULT_SCOPES = [\"tweet.read\", \"users.read\"];\n\ntype XUser = {\n  id: string;\n  name?: string;\n  username?: string;\n  profile_image_url?: string;\n};\n\n/**\n * X (Twitter) sign-in: OAuth 2.0 authorization code flow with PKCE (S256). X\n * is not OpenID Connect — there is no `id_token`. X's confidential clients\n * authenticate the token request with HTTP Basic auth (`client_id:client_secret`),\n * on top of PKCE — both are required together, per X's developer docs (this\n * package has no X test app, so the exchange itself is unverified against a\n * live endpoint). The access token is then redeemed once against\n * `GET /2/users/me`.\n *\n * X does not return an email address from this API at all — there is no\n * \"email\" scope to request it with — so `email` is always left `undefined`\n * rather than invented, and `resolveProviderUser` rejects it the same way it\n * rejects any other missing email.\n */\nexport class XProvider implements AuthProvider {\n  public readonly name = \"x\";\n\n  public constructor(private readonly settings: XProviderConfig) {}\n\n  public authorizationUrl(state: ProviderAuthorizationState): string {\n    const url = new URL(AUTHORIZATION_ENDPOINT);\n\n    url.searchParams.set(\"client_id\", this.settings.clientId);\n    url.searchParams.set(\"redirect_uri\", this.settings.redirectUri);\n    url.searchParams.set(\"response_type\", \"code\");\n    url.searchParams.set(\"scope\", (this.settings.scopes ?? DEFAULT_SCOPES).join(\" \"));\n    url.searchParams.set(\"state\", state.state);\n    url.searchParams.set(\"code_challenge\", pkceChallenge(state.codeVerifier));\n    url.searchParams.set(\"code_challenge_method\", \"S256\");\n\n    return url.toString();\n  }\n\n  public async handleCallback({\n    query,\n    expected,\n  }: ProviderCallbackParams): Promise<ProviderProfile> {\n    const code = query.code;\n\n    if (typeof code !== \"string\" || code.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-code\");\n    }\n\n    const accessToken = await this.exchangeCode(code, expected.codeVerifier);\n    const user = await this.fetchUser(accessToken);\n\n    if (typeof user.id !== \"string\" || user.id.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-subject\");\n    }\n\n    return {\n      provider: this.name,\n      providerUserId: user.id,\n      // X does not hand back an email address from this API.\n      email: undefined,\n      emailVerified: false,\n      name: user.name ?? user.username,\n      avatar: user.profile_image_url,\n      raw: user,\n    };\n  }\n\n  /** Basic-auth credential for the confidential-client token request. */\n  private basicAuth(): string {\n    return Buffer.from(`${this.settings.clientId}:${this.settings.clientSecret}`).toString(\n      \"base64\",\n    );\n  }\n\n  /** Redeem the authorization code (with the PKCE verifier) for an access token. */\n  private async exchangeCode(code: string, codeVerifier: string): Promise<string> {\n    let body: { access_token?: unknown; error?: unknown };\n\n    try {\n      const response = await fetch(TOKEN_ENDPOINT, {\n        method: \"POST\",\n        headers: {\n          \"content-type\": \"application/x-www-form-urlencoded\",\n          authorization: `Basic ${this.basicAuth()}`,\n        },\n        body: new URLSearchParams({\n          code,\n          client_id: this.settings.clientId,\n          redirect_uri: this.settings.redirectUri,\n          grant_type: \"authorization_code\",\n          code_verifier: codeVerifier,\n        }),\n      });\n\n      if (!response.ok) {\n        throw new Error(`X token endpoint answered ${response.status}`);\n      }\n\n      body = (await response.json()) as { access_token?: unknown; error?: unknown };\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", error);\n    }\n\n    if (body.error) {\n      throw new InvalidProviderCallbackError(\"code-exchange-failed\", body.error);\n    }\n\n    if (typeof body.access_token !== \"string\" || body.access_token.length === 0) {\n      throw new InvalidProviderCallbackError(\"missing-access-token\");\n    }\n\n    return body.access_token;\n  }\n\n  private async fetchUser(accessToken: string): Promise<XUser> {\n    try {\n      const url = new URL(USER_ENDPOINT);\n\n      url.searchParams.set(\"user.fields\", \"profile_image_url\");\n\n      const response = await fetch(url.toString(), {\n        headers: { authorization: `Bearer ${accessToken}` },\n      });\n\n      if (!response.ok) {\n        throw new Error(`X /2/users/me endpoint answered ${response.status}`);\n      }\n\n      const body = (await response.json()) as { data?: XUser };\n\n      return body.data ?? ({} as XUser);\n    } catch (error) {\n      throw new InvalidProviderCallbackError(\"profile-fetch-failed\", error);\n    }\n  }\n}\n"],"mappings":";;;;AAUA,MAAM,yBAAyB;AAC/B,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AACtB,MAAM,iBAAiB,CAAC,cAAc,YAAY;;;;;;;;;;;;;;;AAuBlD,IAAa,YAAb,MAA+C;CAG7C,AAAO,YAAY,AAAiB,UAA2B;EAA3B;cAFb;CAEyC;CAEhE,AAAO,iBAAiB,OAA2C;EACjE,MAAM,MAAM,IAAI,IAAI,sBAAsB;EAE1C,IAAI,aAAa,IAAI,aAAa,KAAK,SAAS,QAAQ;EACxD,IAAI,aAAa,IAAI,gBAAgB,KAAK,SAAS,WAAW;EAC9D,IAAI,aAAa,IAAI,iBAAiB,MAAM;EAC5C,IAAI,aAAa,IAAI,UAAU,KAAK,SAAS,UAAU,eAAc,CAAE,KAAK,GAAG,CAAC;EAChF,IAAI,aAAa,IAAI,SAAS,MAAM,KAAK;EACzC,IAAI,aAAa,IAAI,kBAAkB,cAAc,MAAM,YAAY,CAAC;EACxE,IAAI,aAAa,IAAI,yBAAyB,MAAM;EAEpD,OAAO,IAAI,SAAS;CACtB;CAEA,MAAa,eAAe,EAC1B,OACA,YACmD;EACnD,MAAM,OAAO,MAAM;EAEnB,IAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAC9C,MAAM,IAAI,6BAA6B,cAAc;EAGvD,MAAM,cAAc,MAAM,KAAK,aAAa,MAAM,SAAS,YAAY;EACvE,MAAM,OAAO,MAAM,KAAK,UAAU,WAAW;EAE7C,IAAI,OAAO,KAAK,OAAO,YAAY,KAAK,GAAG,WAAW,GACpD,MAAM,IAAI,6BAA6B,iBAAiB;EAG1D,OAAO;GACL,UAAU,KAAK;GACf,gBAAgB,KAAK;GAErB,OAAO;GACP,eAAe;GACf,MAAM,KAAK,QAAQ,KAAK;GACxB,QAAQ,KAAK;GACb,KAAK;EACP;CACF;;CAGA,AAAQ,YAAoB;EAC1B,OAAO,OAAO,KAAK,GAAG,KAAK,SAAS,SAAS,GAAG,KAAK,SAAS,cAAc,CAAC,CAAC,SAC5E,QACF;CACF;;CAGA,MAAc,aAAa,MAAc,cAAuC;EAC9E,IAAI;EAEJ,IAAI;GACF,MAAM,WAAW,MAAM,MAAM,gBAAgB;IAC3C,QAAQ;IACR,SAAS;KACP,gBAAgB;KAChB,eAAe,SAAS,KAAK,UAAU;IACzC;IACA,MAAM,IAAI,gBAAgB;KACxB;KACA,WAAW,KAAK,SAAS;KACzB,cAAc,KAAK,SAAS;KAC5B,YAAY;KACZ,eAAe;IACjB,CAAC;GACH,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,6BAA6B,SAAS,QAAQ;GAGhE,OAAQ,MAAM,SAAS,KAAK;EAC9B,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;EAEA,IAAI,KAAK,OACP,MAAM,IAAI,6BAA6B,wBAAwB,KAAK,KAAK;EAG3E,IAAI,OAAO,KAAK,iBAAiB,YAAY,KAAK,aAAa,WAAW,GACxE,MAAM,IAAI,6BAA6B,sBAAsB;EAG/D,OAAO,KAAK;CACd;CAEA,MAAc,UAAU,aAAqC;EAC3D,IAAI;GACF,MAAM,MAAM,IAAI,IAAI,aAAa;GAEjC,IAAI,aAAa,IAAI,eAAe,mBAAmB;GAEvD,MAAM,WAAW,MAAM,MAAM,IAAI,SAAS,GAAG,EAC3C,SAAS,EAAE,eAAe,UAAU,cAAc,EACpD,CAAC;GAED,IAAI,CAAC,SAAS,IACZ,MAAM,IAAI,MAAM,mCAAmC,SAAS,QAAQ;GAKtE,QAAO,MAFa,SAAS,KAAK,EAEvB,CAAC,QAAS,CAAC;EACxB,SAAS,OAAO;GACd,MAAM,IAAI,6BAA6B,wBAAwB,KAAK;EACtE;CACF;AACF"}

package/esm/services/auth-config.mjs

@@ -2,7 +2,7 @@ import { config } from "@warlock.js/core";
 import { log } from "@warlock.js/logger";
 import ms from "ms";
 
-//#region ../auth/src/services/auth-config.ts
+//#region ../../packages/auth/src/services/auth-config.ts
 const warnedLegacyKeys = /* @__PURE__ */ new Set();
 const permitAuthentication = () => true;
 /**

package/esm/services/auth-config.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\nimport type { CookieDomainResolver } from \"../contracts/types\";\nimport { log } from \"@warlock.js/logger\";\nimport { type Algorithm } from \"fast-jwt\";\nimport ms from \"ms\";\nimport type {\n  AuthNotification,\n  CanAuthenticate,\n  LogoutWithoutTokenBehavior,\n  OneTimeTokenUrlBuilder,\n  PasswordSetter,\n} from \"../contracts/types\";\nimport type {\n  AppleProviderConfig,\n  AuthProvider,\n  DiscordProviderConfig,\n  FacebookProviderConfig,\n  GitHubProviderConfig,\n  GoogleProviderConfig,\n  LinkedInProviderConfig,\n  OtpSender,\n  PasskeysConfig,\n  ProviderUserCreator,\n  XProviderConfig,\n} from \"../contracts/providers\";\nimport type { Auth } from \"../models/auth.model\";\n\nconst warnedLegacyKeys = new Set<string>();\n\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\n\n/**\n * `ms` accepts anything at runtime and answers `undefined` for a string it\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\n * `(value: ms.StringValue) => number`, which is exactly what let an\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\n * here, so every caller is forced to deal with the `undefined`.\n */\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\n\n/**\n * Turn a configured lifetime into a positive number of milliseconds, or throw\n * naming the key.\n *\n * A token lifetime is a security boundary, so an unusable value is a hard error\n * rather than a silent fallback: substituting a default would trade one\n * unintended lifetime for another, just as quietly — and quiet is the whole\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\n *\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\n *   claim** and an `Invalid Date` written to the token row.\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\n *   emits with **no `exp` claim** — it survives any guard that only rejects\n *   `undefined`. `\"-1h\"` signs an already-expired token.\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\n */\nfunction parseDuration(key: string, raw: unknown): number {\n  let parsed: number | string | undefined;\n\n  try {\n    parsed = parseMs(raw);\n  } catch {\n    // ms throws (rather than returning undefined) for \"\" and non-strings\n    parsed = undefined;\n  }\n\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\n    );\n  }\n\n  return parsed;\n}\n\n/** Email-verification token lifetime used when nothing is configured. */\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\n\n/** Password-reset token lifetime used when nothing is configured. */\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\n\n/** Passkey challenge lifetime used when nothing is configured. */\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\n\n/** OTP lifetime used when nothing is configured. */\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\n\n/** Access-token lifetime used when nothing is configured. */\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\n\n/**\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\n *\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\n * keep working after the config split.\n */\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\n  const fromNew = config.key(`auth.${newKey}`);\n\n  if (fromNew !== undefined && fromNew !== null) {\n    return fromNew as T;\n  }\n\n  const fromLegacy = config.key(`auth.${legacyKey}`);\n\n  if (fromLegacy !== undefined && fromLegacy !== null) {\n    if (!warnedLegacyKeys.has(legacyKey)) {\n      warnedLegacyKeys.add(legacyKey);\n      log.warn(\n        \"auth\",\n        \"config-deprecation\",\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\n      );\n    }\n\n    return fromLegacy as T;\n  }\n\n  return fallback as T;\n}\n\n/**\n * Typed, backward-compatible access to auth configuration. The service and the\n * jwt signer read configuration exclusively through here, so the new split\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\n */\nexport const authConfig = {\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\n    const canAuthenticate = config.key<CanAuthenticate>(\n      \"auth.canAuthenticate\",\n      permitAuthentication,\n    );\n\n    return canAuthenticate(user);\n  },\n  accessToken: {\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\n    secret: (): string => {\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\n\n      if (!secret) {\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\n      }\n\n      return secret;\n    },\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\n     * to 1 hour when unset; throws naming the key when the configured value is\n     * not a positive `ms` duration. See {@link parseDuration}.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"accessToken.expiresIn\",\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\n      ),\n  },\n  pageAuth: {\n    /**\n     * Login path a guarded PAGE route redirects a logged-out browser to.\n     *\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\n     * navigating to a guarded page lands on the login screen instead of reading\n     * a raw JSON error blob. Finding b9ab9804.\n     */\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\n    /**\n     * Query parameter the redirect carries the originally-requested path in, so\n     * the login flow can send the user back where they were headed. Defaults to\n     * `\"returnUrl\"`.\n     */\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\n  },\n  cookie: {\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\n    /** Refresh-token cookie name the session cookie helpers use. @default \"refresh_token\" */\n    refreshName: (): string => config.key(\"auth.cookie.refreshName\", \"refresh_token\"),\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\n    /** Select the request-scoped cookie Domain; undefined keeps it host-only. */\n    cookieDomain: (): CookieDomainResolver | undefined => config.key(\"auth.cookie.cookieDomain\"),\n  },\n  csrf: {\n    /**\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\n     * beyond the request's own origin. @default []\n     */\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\n  },\n  verification: {\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"verification.expiresIn\",\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\n      ),\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\n    /** App notification replacing the default verification email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\n  },\n  passwordReset: {\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"passwordReset.expiresIn\",\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\n      ),\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\n    /** App notification replacing the default reset email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\n    /** App-owned password writer replacing the default. */\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\n  },\n  providers: {\n    /** `auth.providers.google`, when configured. */\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\n    /** `auth.providers.github`, when configured. */\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\n    /** `auth.providers.discord`, when configured. */\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\n    /** `auth.providers.linkedin`, when configured. */\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\n    /** `auth.providers.apple`, when configured. */\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\n    /** `auth.providers.facebook`, when configured. */\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\n    /** `auth.providers.x`, when configured. */\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\n    custom: (name: string): AuthProvider | undefined => {\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\n\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\n    },\n    /** User attribute a verified provider email is matched against. @default \"email\" */\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\n    /** App-owned user creation for a first provider login. */\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\n  },\n  passkeys: {\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\n    settings: (): PasskeysConfig => {\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\n\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\n        throw new Error(\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\n        );\n      }\n\n      return settings;\n    },\n    /** Allowed ceremony origins, as a list. */\n    origins: (): string[] => {\n      const { origin } = authConfig.passkeys.settings();\n\n      return Array.isArray(origin) ? origin : [origin];\n    },\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    challengeExpiresInMs: (): number =>\n      parseDuration(\n        \"passkeys.challengeExpiresIn\",\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\n      ),\n  },\n  otp: {\n    /** Notifications channel the code is sent through. @default \"sms\" */\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\n    /** User attribute holding the phone number. @default \"phone\" */\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    expiresInMs: (): number =>\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\n    /** Verify attempts before the code is invalidated. @default 5 */\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\n    /** The message text for a code. */\n    message: (code: string): string => {\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\n\n      return build ? build(code) : `Your verification code is ${code}`;\n    },\n    /** App-owned delivery replacing the notifications channel send. */\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\n  },\n  refreshToken: {\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\n     * naming the key when the configured value is not a positive `ms` duration.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\n  },\n};\n"],"mappings":";;;;;AA2BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,mBAA2B,OAAO,IAAI,2BAA2B,eAAe;;EAEhF,YAAoB,OAAO,IAAI,oBAAoB,GAAG;;EAEtD,oBAAsD,OAAO,IAAI,0BAA0B;CAC7F;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}
+{"version":3,"file":"auth-config.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth-config.ts"],"sourcesContent":["import { config } from \"@warlock.js/core\";\nimport type { CookieDomainResolver } from \"../contracts/types\";\nimport { log } from \"@warlock.js/logger\";\nimport { type Algorithm } from \"fast-jwt\";\nimport ms from \"ms\";\nimport type {\n  AuthNotification,\n  CanAuthenticate,\n  LogoutWithoutTokenBehavior,\n  OneTimeTokenUrlBuilder,\n  PasswordSetter,\n} from \"../contracts/types\";\nimport type {\n  AppleProviderConfig,\n  AuthProvider,\n  DiscordProviderConfig,\n  FacebookProviderConfig,\n  GitHubProviderConfig,\n  GoogleProviderConfig,\n  LinkedInProviderConfig,\n  OtpSender,\n  PasskeysConfig,\n  ProviderUserCreator,\n  XProviderConfig,\n} from \"../contracts/providers\";\nimport type { Auth } from \"../models/auth.model\";\n\nconst warnedLegacyKeys = new Set<string>();\n\nconst permitAuthentication: CanAuthenticate = (): boolean => true;\n\n/**\n * `ms` accepts anything at runtime and answers `undefined` for a string it\n * cannot parse (`\"30dayz\"`), a *formatted string* for a number (`2592000` ⇒\n * `\"43m\"`), and throws for `\"\"`. Its published types claim the far narrower\n * `(value: ms.StringValue) => number`, which is exactly what let an\n * `as ms.StringValue` cast smuggle arbitrary config text past the compiler and\n * hand `undefined` to the JWT signer. Declare the honest runtime signature once,\n * here, so every caller is forced to deal with the `undefined`.\n */\nconst parseMs = ms as unknown as (value: unknown) => number | string | undefined;\n\n/**\n * Turn a configured lifetime into a positive number of milliseconds, or throw\n * naming the key.\n *\n * A token lifetime is a security boundary, so an unusable value is a hard error\n * rather than a silent fallback: substituting a default would trade one\n * unintended lifetime for another, just as quietly — and quiet is the whole\n * problem. Every non-positive, non-finite or non-numeric parse is rejected:\n *\n * - `\"30dayz\"` / `\"thirty days\"` ⇒ `undefined` ⇒ a JWT signed with **no `exp`\n *   claim** and an `Invalid Date` written to the token row.\n * - `\"0d\"` ⇒ parses cleanly to `0`, which `fast-jwt` treats as falsy and also\n *   emits with **no `exp` claim** — it survives any guard that only rejects\n *   `undefined`. `\"-1h\"` signs an already-expired token.\n * - `2592000` (a bare number) ⇒ `ms` *formats* it as `\"43m\"`, a string, which\n *   then turns `Date.now() + expiresIn` into an `Invalid Date`.\n */\nfunction parseDuration(key: string, raw: unknown): number {\n  let parsed: number | string | undefined;\n\n  try {\n    parsed = parseMs(raw);\n  } catch {\n    // ms throws (rather than returning undefined) for \"\" and non-strings\n    parsed = undefined;\n  }\n\n  if (typeof parsed !== \"number\" || !Number.isFinite(parsed) || parsed <= 0) {\n    throw new Error(\n      `auth.${key}: ${JSON.stringify(raw)} is not a valid ms duration — ` +\n        `use a positive duration string such as \"1h\", \"7d\", or NO_EXPIRATION.`,\n    );\n  }\n\n  return parsed;\n}\n\n/** Email-verification token lifetime used when nothing is configured. */\nconst DEFAULT_VERIFICATION_EXPIRES_IN = \"24h\";\n\n/** Password-reset token lifetime used when nothing is configured. */\nconst DEFAULT_PASSWORD_RESET_EXPIRES_IN = \"60m\";\n\n/** Passkey challenge lifetime used when nothing is configured. */\nconst DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN = \"5m\";\n\n/** OTP lifetime used when nothing is configured. */\nconst DEFAULT_OTP_EXPIRES_IN = \"5m\";\n\n/** Access-token lifetime used when nothing is configured. */\nconst DEFAULT_ACCESS_TOKEN_EXPIRES_IN = \"1h\";\n\n/**\n * Resolve an auth setting, preferring the new `auth.accessToken.*` /\n * `auth.refreshToken.*` key and falling back to the deprecated `auth.jwt.*`\n * shape — warning once per legacy key. Returns `fallback` when neither is set.\n *\n * This is the backward-compatible shim that lets existing `auth.jwt.*` configs\n * keep working after the config split.\n */\nfunction resolve<T>(newKey: string, legacyKey: string, fallback?: T): T {\n  const fromNew = config.key(`auth.${newKey}`);\n\n  if (fromNew !== undefined && fromNew !== null) {\n    return fromNew as T;\n  }\n\n  const fromLegacy = config.key(`auth.${legacyKey}`);\n\n  if (fromLegacy !== undefined && fromLegacy !== null) {\n    if (!warnedLegacyKeys.has(legacyKey)) {\n      warnedLegacyKeys.add(legacyKey);\n      log.warn(\n        \"auth\",\n        \"config-deprecation\",\n        `auth.${legacyKey} is deprecated — use auth.${newKey}`,\n      );\n    }\n\n    return fromLegacy as T;\n  }\n\n  return fallback as T;\n}\n\n/**\n * Typed, backward-compatible access to auth configuration. The service and the\n * jwt signer read configuration exclusively through here, so the new split\n * config and the legacy `auth.jwt.*` shape both resolve the same way.\n */\nexport const authConfig = {\n  canAuthenticate: async (user: Auth): Promise<boolean> => {\n    const canAuthenticate = config.key<CanAuthenticate>(\n      \"auth.canAuthenticate\",\n      permitAuthentication,\n    );\n\n    return canAuthenticate(user);\n  },\n  accessToken: {\n    /** Signing secret (legacy: `auth.jwt.secret`). Throws if neither is set. */\n    secret: (): string => {\n      const secret = resolve<string | undefined>(\"accessToken.secret\", \"jwt.secret\");\n\n      if (!secret) {\n        throw new Error(\"auth: no JWT secret configured — set `auth.accessToken.secret`.\");\n      }\n\n      return secret;\n    },\n    /** Signing algorithm (legacy: `auth.jwt.algorithm`). */\n    algorithm: (): Algorithm => resolve(\"accessToken.algorithm\", \"jwt.algorithm\", \"HS256\"),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.expiresIn`). */\n    expiresIn: (): string | undefined => resolve(\"accessToken.expiresIn\", \"jwt.expiresIn\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Defaults\n     * to 1 hour when unset; throws naming the key when the configured value is\n     * not a positive `ms` duration. See {@link parseDuration}.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"accessToken.expiresIn\",\n        authConfig.accessToken.expiresIn() ?? DEFAULT_ACCESS_TOKEN_EXPIRES_IN,\n      ),\n  },\n  pageAuth: {\n    /**\n     * Login path a guarded PAGE route redirects a logged-out browser to.\n     *\n     * Unset (the default) ⇒ page-route auth failures keep the JSON 401 API\n     * contract, so existing apps see NO behavior change. Set it (e.g. \"/login\")\n     * to opt a browser-facing app into login-redirect UX: a logged-out human\n     * navigating to a guarded page lands on the login screen instead of reading\n     * a raw JSON error blob. Finding b9ab9804.\n     */\n    loginPath: (): string | undefined => config.key(\"auth.pageAuth.loginPath\"),\n    /**\n     * Query parameter the redirect carries the originally-requested path in, so\n     * the login flow can send the user back where they were headed. Defaults to\n     * `\"returnUrl\"`.\n     */\n    returnUrlParam: (): string => config.key(\"auth.pageAuth.returnUrlParam\", \"returnUrl\"),\n  },\n  cookie: {\n    /** Cookie name `setAuthCookie`/`clearAuthCookie` use. @default \"access_token\" */\n    name: (): string => config.key(\"auth.cookie.name\", \"access_token\"),\n    /** Refresh-token cookie name the session cookie helpers use. @default \"refresh_token\" */\n    refreshName: (): string => config.key(\"auth.cookie.refreshName\", \"refresh_token\"),\n    /** Cookie `Path` attribute `setAuthCookie`/`clearAuthCookie` use. @default \"/\" */\n    path: (): string => config.key(\"auth.cookie.path\", \"/\"),\n    /** Select the request-scoped cookie Domain; undefined keeps it host-only. */\n    cookieDomain: (): CookieDomainResolver | undefined => config.key(\"auth.cookie.cookieDomain\"),\n  },\n  csrf: {\n    /**\n     * Extra origins allowed on a cookie-authenticated unsafe-method request,\n     * beyond the request's own origin. @default []\n     */\n    allowedOrigins: (): string[] => config.key(\"auth.csrf.allowedOrigins\", []),\n  },\n  verification: {\n    /** Lifetime in ms of an email-verification token; throws naming the key when unusable. @default \"24h\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"verification.expiresIn\",\n        config.key(\"auth.verification.expiresIn\", DEFAULT_VERIFICATION_EXPIRES_IN),\n      ),\n    /** User attribute stamped with the verification date. @default \"emailVerifiedAt\" */\n    field: (): string => config.key(\"auth.verification.field\", \"emailVerifiedAt\"),\n    /** App notification replacing the default verification email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.verification.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.verification.url\"),\n  },\n  passwordReset: {\n    /** Lifetime in ms of a password-reset token; throws naming the key when unusable. @default \"60m\" */\n    expiresInMs: (): number =>\n      parseDuration(\n        \"passwordReset.expiresIn\",\n        config.key(\"auth.passwordReset.expiresIn\", DEFAULT_PASSWORD_RESET_EXPIRES_IN),\n      ),\n    /** User attribute `requestPasswordReset` looks the account up by. @default \"email\" */\n    identifierField: (): string => config.key(\"auth.passwordReset.identifierField\", \"email\"),\n    /** App notification replacing the default reset email. */\n    notification: (): AuthNotification | undefined => config.key(\"auth.passwordReset.notification\"),\n    /** Link builder whose result is handed to the notification as `url`. */\n    url: (): OneTimeTokenUrlBuilder | undefined => config.key(\"auth.passwordReset.url\"),\n    /** App-owned password writer replacing the default. */\n    setPassword: (): PasswordSetter | undefined => config.key(\"auth.passwordReset.setPassword\"),\n  },\n  providers: {\n    /** `auth.providers.google`, when configured. */\n    google: (): GoogleProviderConfig | undefined => config.key(\"auth.providers.google\"),\n    /** `auth.providers.github`, when configured. */\n    github: (): GitHubProviderConfig | undefined => config.key(\"auth.providers.github\"),\n    /** `auth.providers.discord`, when configured. */\n    discord: (): DiscordProviderConfig | undefined => config.key(\"auth.providers.discord\"),\n    /** `auth.providers.linkedin`, when configured. */\n    linkedin: (): LinkedInProviderConfig | undefined => config.key(\"auth.providers.linkedin\"),\n    /** `auth.providers.apple`, when configured. */\n    apple: (): AppleProviderConfig | undefined => config.key(\"auth.providers.apple\"),\n    /** `auth.providers.facebook`, when configured. */\n    facebook: (): FacebookProviderConfig | undefined => config.key(\"auth.providers.facebook\"),\n    /** `auth.providers.x`, when configured. */\n    x: (): XProviderConfig | undefined => config.key(\"auth.providers.x\"),\n    /** An app-registered provider under `auth.providers.custom.<name>`. */\n    custom: (name: string): AuthProvider | undefined => {\n      const providers = config.key<Record<string, AuthProvider>>(\"auth.providers.custom\", {});\n\n      // Own keys only: `name` arrives from a URL, and \"constructor\" must not resolve to Object.\n      return Object.hasOwn(providers, name) ? providers[name] : undefined;\n    },\n    /** User attribute a verified provider email is matched against. @default \"email\" */\n    emailField: (): string => config.key(\"auth.providers.emailField\", \"email\"),\n    /** App-owned user creation for a first provider login. */\n    createUser: (): ProviderUserCreator | undefined => config.key(\"auth.providers.createUser\"),\n  },\n  passkeys: {\n    /** `auth.passkeys`; throws naming the keys when `rpID`, `rpName` or `origin` is missing. */\n    settings: (): PasskeysConfig => {\n      const settings = config.key<PasskeysConfig | undefined>(\"auth.passkeys\");\n\n      if (!settings?.rpID || !settings.rpName || !settings.origin) {\n        throw new Error(\n          \"@warlock.js/auth: passkeys need `auth.passkeys.rpID`, `auth.passkeys.rpName` and `auth.passkeys.origin`.\",\n        );\n      }\n\n      return settings;\n    },\n    /** Allowed ceremony origins, as a list. */\n    origins: (): string[] => {\n      const { origin } = authConfig.passkeys.settings();\n\n      return Array.isArray(origin) ? origin : [origin];\n    },\n    /** Challenge lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    challengeExpiresInMs: (): number =>\n      parseDuration(\n        \"passkeys.challengeExpiresIn\",\n        config.key(\"auth.passkeys.challengeExpiresIn\", DEFAULT_PASSKEY_CHALLENGE_EXPIRES_IN),\n      ),\n  },\n  otp: {\n    /** Notifications channel the code is sent through. @default \"sms\" */\n    channel: (): string => config.key(\"auth.otp.channel\", \"sms\"),\n    /** User attribute holding the phone number. @default \"phone\" */\n    phoneField: (): string => config.key(\"auth.otp.phoneField\", \"phone\"),\n    /** Code lifetime in ms; throws naming the key when unusable. @default \"5m\" */\n    expiresInMs: (): number =>\n      parseDuration(\"otp.expiresIn\", config.key(\"auth.otp.expiresIn\", DEFAULT_OTP_EXPIRES_IN)),\n    /** Verify attempts before the code is invalidated. @default 5 */\n    maxAttempts: (): number => config.key(\"auth.otp.maxAttempts\", 5),\n    /** The message text for a code. */\n    message: (code: string): string => {\n      const build = config.key<((code: string) => string) | undefined>(\"auth.otp.message\");\n\n      return build ? build(code) : `Your verification code is ${code}`;\n    },\n    /** App-owned delivery replacing the notifications channel send. */\n    send: (): OtpSender | undefined => config.key(\"auth.otp.send\"),\n  },\n  refreshToken: {\n    /** Separate refresh secret (legacy: `auth.jwt.refresh.secret`); empty ⇒ fall back to the access secret. */\n    secret: (): string | undefined => resolve(\"refreshToken.secret\", \"jwt.refresh.secret\"),\n    /** Whether refresh tokens are enabled (legacy: `auth.jwt.refresh.enabled`). */\n    enabled: (): boolean => resolve(\"refreshToken.enabled\", \"jwt.refresh.enabled\", true),\n    /** Lifetime as an `ms`-string (legacy: `auth.jwt.refresh.expiresIn`). */\n    expiresIn: (): string => resolve(\"refreshToken.expiresIn\", \"jwt.refresh.expiresIn\", \"7d\"),\n    /**\n     * Lifetime in milliseconds — the only form a token issuer may use. Throws\n     * naming the key when the configured value is not a positive `ms` duration.\n     */\n    expiresInMs: (): number =>\n      parseDuration(\"refreshToken.expiresIn\", authConfig.refreshToken.expiresIn()),\n    /** Rotate-on-use (legacy: `auth.jwt.refresh.rotation`). */\n    rotation: (): boolean => resolve(\"refreshToken.rotation\", \"jwt.refresh.rotation\", true),\n    /** Max active tokens per user (legacy: `auth.jwt.refresh.maxPerUser`). */\n    maxPerUser: (): number => resolve(\"refreshToken.maxPerUser\", \"jwt.refresh.maxPerUser\", 5),\n    /** Logout-without-token behavior (legacy: `auth.jwt.refresh.logoutWithoutToken`). */\n    logoutWithoutToken: (): LogoutWithoutTokenBehavior =>\n      resolve(\"refreshToken.logoutWithoutToken\", \"jwt.refresh.logoutWithoutToken\", \"revoke-all\"),\n  },\n};\n"],"mappings":";;;;;AA2BA,MAAM,mCAAmB,IAAI,IAAY;AAEzC,MAAM,6BAAuD;;;;;;;;;;AAW7D,MAAM,UAAU;;;;;;;;;;;;;;;;;;AAmBhB,SAAS,cAAc,KAAa,KAAsB;CACxD,IAAI;CAEJ,IAAI;EACF,SAAS,QAAQ,GAAG;CACtB,QAAQ;EAEN,SAAS;CACX;CAEA,IAAI,OAAO,WAAW,YAAY,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,GACtE,MAAM,IAAI,MACR,QAAQ,IAAI,IAAI,KAAK,UAAU,GAAG,EAAE,mGAEtC;CAGF,OAAO;AACT;;AAGA,MAAM,kCAAkC;;AAGxC,MAAM,oCAAoC;;AAG1C,MAAM,uCAAuC;;AAG7C,MAAM,yBAAyB;;AAG/B,MAAM,kCAAkC;;;;;;;;;AAUxC,SAAS,QAAW,QAAgB,WAAmB,UAAiB;CACtE,MAAM,UAAU,OAAO,IAAI,QAAQ,QAAQ;CAE3C,IAAI,YAAY,UAAa,YAAY,MACvC,OAAO;CAGT,MAAM,aAAa,OAAO,IAAI,QAAQ,WAAW;CAEjD,IAAI,eAAe,UAAa,eAAe,MAAM;EACnD,IAAI,CAAC,iBAAiB,IAAI,SAAS,GAAG;GACpC,iBAAiB,IAAI,SAAS;GAC9B,IAAI,KACF,QACA,sBACA,QAAQ,UAAU,4BAA4B,QAChD;EACF;EAEA,OAAO;CACT;CAEA,OAAO;AACT;;;;;;AAOA,MAAa,aAAa;CACxB,iBAAiB,OAAO,SAAiC;EAMvD,OALwB,OAAO,IAC7B,wBACA,oBAGmB,CAAC,CAAC,IAAI;CAC7B;CACA,aAAa;;EAEX,cAAsB;GACpB,MAAM,SAAS,QAA4B,sBAAsB,YAAY;GAE7E,IAAI,CAAC,QACH,MAAM,IAAI,MAAM,iEAAiE;GAGnF,OAAO;EACT;;EAEA,iBAA4B,QAAQ,yBAAyB,iBAAiB,OAAO;;EAErF,iBAAqC,QAAQ,yBAAyB,eAAe;;;;;;EAMrF,mBACE,cACE,yBACA,WAAW,YAAY,UAAU,KAAK,+BACxC;CACJ;CACA,UAAU;;;;;;;;;;EAUR,iBAAqC,OAAO,IAAI,yBAAyB;;;;;;EAMzE,sBAA8B,OAAO,IAAI,gCAAgC,WAAW;CACtF;CACA,QAAQ;;EAEN,YAAoB,OAAO,IAAI,oBAAoB,cAAc;;EAEjE,mBAA2B,OAAO,IAAI,2BAA2B,eAAe;;EAEhF,YAAoB,OAAO,IAAI,oBAAoB,GAAG;;EAEtD,oBAAsD,OAAO,IAAI,0BAA0B;CAC7F;CACA,MAAM;;;;;AAKJ,sBAAgC,OAAO,IAAI,4BAA4B,CAAC,CAAC,EAC3E;CACA,cAAc;;EAEZ,mBACE,cACE,0BACA,OAAO,IAAI,+BAA+B,+BAA+B,CAC3E;;EAEF,aAAqB,OAAO,IAAI,2BAA2B,iBAAiB;;EAE5E,oBAAkD,OAAO,IAAI,gCAAgC;;EAE7F,WAA+C,OAAO,IAAI,uBAAuB;CACnF;CACA,eAAe;;EAEb,mBACE,cACE,2BACA,OAAO,IAAI,gCAAgC,iCAAiC,CAC9E;;EAEF,uBAA+B,OAAO,IAAI,sCAAsC,OAAO;;EAEvF,oBAAkD,OAAO,IAAI,iCAAiC;;EAE9F,WAA+C,OAAO,IAAI,wBAAwB;;EAElF,mBAA+C,OAAO,IAAI,gCAAgC;CAC5F;CACA,WAAW;;EAET,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,cAAgD,OAAO,IAAI,uBAAuB;;EAElF,eAAkD,OAAO,IAAI,wBAAwB;;EAErF,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,aAA8C,OAAO,IAAI,sBAAsB;;EAE/E,gBAAoD,OAAO,IAAI,yBAAyB;;EAExF,SAAsC,OAAO,IAAI,kBAAkB;;EAEnE,SAAS,SAA2C;GAClD,MAAM,YAAY,OAAO,IAAkC,yBAAyB,CAAC,CAAC;GAGtF,OAAO,OAAO,OAAO,WAAW,IAAI,IAAI,UAAU,QAAQ;EAC5D;;EAEA,kBAA0B,OAAO,IAAI,6BAA6B,OAAO;;EAEzE,kBAAmD,OAAO,IAAI,2BAA2B;CAC3F;CACA,UAAU;;EAER,gBAAgC;GAC9B,MAAM,WAAW,OAAO,IAAgC,eAAe;GAEvE,IAAI,CAAC,UAAU,QAAQ,CAAC,SAAS,UAAU,CAAC,SAAS,QACnD,MAAM,IAAI,MACR,0GACF;GAGF,OAAO;EACT;;EAEA,eAAyB;GACvB,MAAM,EAAE,WAAW,WAAW,SAAS,SAAS;GAEhD,OAAO,MAAM,QAAQ,MAAM,IAAI,SAAS,CAAC,MAAM;EACjD;;EAEA,4BACE,cACE,+BACA,OAAO,IAAI,oCAAoC,oCAAoC,CACrF;CACJ;CACA,KAAK;;EAEH,eAAuB,OAAO,IAAI,oBAAoB,KAAK;;EAE3D,kBAA0B,OAAO,IAAI,uBAAuB,OAAO;;EAEnE,mBACE,cAAc,iBAAiB,OAAO,IAAI,sBAAsB,sBAAsB,CAAC;;EAEzF,mBAA2B,OAAO,IAAI,wBAAwB,CAAC;;EAE/D,UAAU,SAAyB;GACjC,MAAM,QAAQ,OAAO,IAA4C,kBAAkB;GAEnF,OAAO,QAAQ,MAAM,IAAI,IAAI,6BAA6B;EAC5D;;EAEA,YAAmC,OAAO,IAAI,eAAe;CAC/D;CACA,cAAc;;EAEZ,cAAkC,QAAQ,uBAAuB,oBAAoB;;EAErF,eAAwB,QAAQ,wBAAwB,uBAAuB,IAAI;;EAEnF,iBAAyB,QAAQ,0BAA0B,yBAAyB,IAAI;;;;;EAKxF,mBACE,cAAc,0BAA0B,WAAW,aAAa,UAAU,CAAC;;EAE7E,gBAAyB,QAAQ,yBAAyB,wBAAwB,IAAI;;EAEtF,kBAA0B,QAAQ,2BAA2B,0BAA0B,CAAC;;EAExF,0BACE,QAAQ,mCAAmC,kCAAkC,YAAY;CAC7F;AACF"}

package/esm/services/auth-events.d.mts

@@ -3,7 +3,7 @@ import { DeviceInfo, TokenPair } from "../contracts/types.mjs";
 import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { EventSubscription } from "@mongez/events";
 
-//#region ../auth/src/services/auth-events.d.ts
+//#region ../../packages/auth/src/services/auth-events.d.ts
 /**
  * Auth event payload types
  */

package/esm/services/auth-events.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;KASY,iBAAA;EAEV,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,UAAA,GAAa,UAAA;EACjE,cAAA,GAAiB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA,GAAqB,MAAA;EACrE,eAAA,GAAkB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA;EAGjD,MAAA,GAAS,IAAA,EAAM,IAAA;EACf,YAAA,GAAe,IAAA,EAAM,IAAA;EACrB,iBAAA,GAAoB,IAAA,EAAM,IAAA;EAG1B,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA;EACzC,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,SAAA,EAAW,eAAA,EAAiB,YAAA;EAC1E,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,YAAA;EACrC,eAAA,GAAkB,KAAA,EAAO,YAAA;EACzB,qBAAA,GAAwB,QAAA,UAAkB,MAAA,EAAQ,YAAA;EAGlD,kBAAA,GAAqB,IAAA,EAAM,IAAA;EAC3B,yBAAA,GAA4B,IAAA,EAAM,IAAA,EAAM,UAAA;EACxC,gBAAA,GAAmB,IAAA,EAAM,IAAA;EAGzB,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA,EAAc,UAAA,GAAa,UAAA;EACzE,mBAAA,GAAsB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA;EAGhD,mBAAA,GAAsB,YAAA;AAAA;;;;KAMZ,aAAA,SAAsB,iBAAiB;;;;KAKvC,iBAAA,WAA4B,aAAA,QACnC,IAAA,EAAM,iBAAA,CAAkB,CAAA,aACjB,OAAA;;;;;;;;;;;;;;;;;;;cAyBC,UAAA;EAzDe;;;eA6Db,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EA1DzC;;;sBAiEV,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EAhEpD;;;iBAuEX,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAvEO;;;oBAuFxD,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAtFxC;;;;EACL;;;cAmGb,aAAA;AAAA"}
+{"version":3,"file":"auth-events.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth-events.ts"],"mappings":";;;;;;;;;KASY,iBAAA;EAEV,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA,EAAW,UAAA,GAAa,UAAA;EACjE,cAAA,GAAiB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA,GAAqB,MAAA;EACrE,eAAA,GAAkB,WAAA;IAAe,KAAA;IAAgB,QAAA;EAAA;EAGjD,MAAA,GAAS,IAAA,EAAM,IAAA;EACf,YAAA,GAAe,IAAA,EAAM,IAAA;EACrB,iBAAA,GAAoB,IAAA,EAAM,IAAA;EAG1B,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,SAAA;EACzC,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,SAAA,EAAW,eAAA,EAAiB,YAAA;EAC1E,eAAA,GAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,EAAO,YAAA;EACrC,eAAA,GAAkB,KAAA,EAAO,YAAA;EACzB,qBAAA,GAAwB,QAAA,UAAkB,MAAA,EAAQ,YAAA;EAGlD,kBAAA,GAAqB,IAAA,EAAM,IAAA;EAC3B,yBAAA,GAA4B,IAAA,EAAM,IAAA,EAAM,UAAA;EACxC,gBAAA,GAAmB,IAAA,EAAM,IAAA;EAGzB,iBAAA,GAAoB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA,EAAc,UAAA,GAAa,UAAA;EACzE,mBAAA,GAAsB,IAAA,EAAM,IAAA,EAAM,YAAA,EAAc,YAAA;EAGhD,mBAAA,GAAsB,YAAA;AAAA;;;;KAMZ,aAAA,SAAsB,iBAAiB;;;;KAKvC,iBAAA,WAA4B,aAAA,QACnC,IAAA,EAAM,iBAAA,CAAkB,CAAA,aACjB,OAAA;;;;;;;;;;;;;;;;;;;cAyBC,UAAA;EAzDe;;;eA6Db,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EA1DzC;;;sBAiEV,aAAA,EAAa,KAAA,EAAS,CAAA,EAAC,QAAA,EAAY,iBAAA,CAAkB,CAAA,IAAK,iBAAA;EAhEpD;;;iBAuEX,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAvEO;;;oBAuFxD,aAAA,EAAa,KAAA,EAAS,CAAA,KAAC,IAAA,EAAW,iBAAA,CAAkB,CAAA;EAtFxC;;;;EACL;;;cAmGb,aAAA;AAAA"}

package/esm/services/auth-events.mjs

@@ -1,7 +1,7 @@
 import { log } from "@warlock.js/logger";
 import events from "@mongez/events";
 
-//#region ../auth/src/services/auth-events.ts
+//#region ../../packages/auth/src/services/auth-events.ts
 /**
 * Event namespace prefix for auth events
 */

package/esm/services/auth-events.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth-events.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth-events.ts"],"sourcesContent":["import events, { type EventSubscription } from \"@mongez/events\";\nimport { log } from \"@warlock.js/logger\";\nimport type { DeviceInfo, TokenPair } from \"../contracts/types\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Auth event payload types\n */\nexport type AuthEventPayloads = {\n  // Login events\n  \"login.success\": [user: Auth, tokenPair: TokenPair, deviceInfo?: DeviceInfo];\n  \"login.failed\": [credentials: { email?: string; username?: string }, reason: string];\n  \"login.attempt\": [credentials: { email?: string; username?: string }];\n\n  // Logout events\n  logout: [user: Auth];\n  \"logout.all\": [user: Auth];\n  \"logout.failsafe\": [user: Auth];\n\n  // Token events\n  \"token.created\": [user: Auth, tokenPair: TokenPair];\n  \"token.refreshed\": [user: Auth, newTokenPair: TokenPair, oldRefreshToken: RefreshToken];\n  \"token.revoked\": [user: Auth, token: RefreshToken];\n  \"token.expired\": [token: RefreshToken];\n  \"token.familyRevoked\": [familyId: string, tokens: RefreshToken[]];\n\n  // Password events\n  \"password.changed\": [user: Auth];\n  \"password.resetRequested\": [user: Auth, resetToken: string];\n  \"password.reset\": [user: Auth];\n\n  // Session events\n  \"session.created\": [user: Auth, refreshToken: RefreshToken, deviceInfo?: DeviceInfo];\n  \"session.destroyed\": [user: Auth, refreshToken: RefreshToken];\n\n  // Cleanup events\n  \"cleanup.completed\": [expiredCount: number];\n};\n\n/**\n * Auth event names\n */\nexport type AuthEventName = keyof AuthEventPayloads;\n\n/**\n * Callback type for a specific event\n */\nexport type AuthEventCallback<T extends AuthEventName> = (\n  ...args: AuthEventPayloads[T]\n) => void | Promise<void>;\n\n/**\n * Event namespace prefix for auth events\n */\nconst AUTH_EVENT_PREFIX = \"auth.\";\n\n/**\n * Type-safe auth events manager\n *\n * @example\n * ```typescript\n * // Subscribe to events with full autocomplete\n * authEvents.on(\"login.success\", (user, tokenPair, deviceInfo) => {\n *   console.log(`User ${user.id} logged in`);\n * });\n *\n * authEvents.on(\"token.refreshed\", (user, newPair, oldToken) => {\n *   console.log(`Token refreshed for user ${user.id}`);\n * });\n *\n * // Trigger events\n * authEvents.emit(\"login.success\", user, tokenPair, deviceInfo);\n * ```\n */\nexport const authEvents = {\n  /**\n   * Subscribe to an auth event\n   */\n  on<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return events.subscribe(AUTH_EVENT_PREFIX + event, callback as Function);\n  },\n\n  /**\n   * Subscribe to an auth event (alias for `on`)\n   */\n  subscribe<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return this.on(event, callback);\n  },\n\n  /**\n   * Emit an auth event\n   */\n  emit<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    try {\n      events.trigger(AUTH_EVENT_PREFIX + event, ...args);\n    } catch (error) {\n      // Auth events are fire-and-forget notifications: a throwing listener must\n      // never break the flow that emitted it (e.g. turn a completed login into a\n      // 500). Log and swallow. NOTE: this guards synchronous listener throws;\n      // async listener rejections and \"later listeners still run\" need a fix in\n      // @mongez/events (tracked separately).\n      log.error(\"auth\", \"event\", error);\n    }\n  },\n\n  /**\n   * Emit an auth event (alias for `emit`)\n   */\n  trigger<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    this.emit(event, ...args);\n  },\n\n  /**\n   * Unsubscribe from all auth events\n   */\n  unsubscribeAll(): void {\n    events.unsubscribeNamespace(AUTH_EVENT_PREFIX.slice(0, -1));\n  },\n\n  /**\n   * Unsubscribe from a specific auth event\n   */\n  off(event?: AuthEventName): void {\n    if (event) {\n      events.unsubscribe(AUTH_EVENT_PREFIX + event);\n    } else {\n      this.unsubscribeAll();\n    }\n  },\n};\n"],"mappings":";;;;;;;AAuDA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;AAoB1B,MAAa,aAAa;;;;CAIxB,GAA4B,OAAU,UAAmD;EACvF,OAAO,OAAO,UAAU,oBAAoB,OAAO,QAAoB;CACzE;;;;CAKA,UAAmC,OAAU,UAAmD;EAC9F,OAAO,KAAK,GAAG,OAAO,QAAQ;CAChC;;;;CAKA,KAA8B,OAAU,GAAG,MAAkC;EAC3E,IAAI;GACF,OAAO,QAAQ,oBAAoB,OAAO,GAAG,IAAI;EACnD,SAAS,OAAO;GAMd,IAAI,MAAM,QAAQ,SAAS,KAAK;EAClC;CACF;;;;CAKA,QAAiC,OAAU,GAAG,MAAkC;EAC9E,KAAK,KAAK,OAAO,GAAG,IAAI;CAC1B;;;;CAKA,iBAAuB;EACrB,OAAO,qBAAqB,kBAAkB,MAAM,GAAG,EAAE,CAAC;CAC5D;;;;CAKA,IAAI,OAA6B;EAC/B,IAAI,OACF,OAAO,YAAY,oBAAoB,KAAK;OAE5C,KAAK,eAAe;CAExB;AACF"}
+{"version":3,"file":"auth-events.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth-events.ts"],"sourcesContent":["import events, { type EventSubscription } from \"@mongez/events\";\nimport { log } from \"@warlock.js/logger\";\nimport type { DeviceInfo, TokenPair } from \"../contracts/types\";\nimport type { Auth } from \"../models/auth.model\";\nimport type { RefreshToken } from \"../models/refresh-token\";\n\n/**\n * Auth event payload types\n */\nexport type AuthEventPayloads = {\n  // Login events\n  \"login.success\": [user: Auth, tokenPair: TokenPair, deviceInfo?: DeviceInfo];\n  \"login.failed\": [credentials: { email?: string; username?: string }, reason: string];\n  \"login.attempt\": [credentials: { email?: string; username?: string }];\n\n  // Logout events\n  logout: [user: Auth];\n  \"logout.all\": [user: Auth];\n  \"logout.failsafe\": [user: Auth];\n\n  // Token events\n  \"token.created\": [user: Auth, tokenPair: TokenPair];\n  \"token.refreshed\": [user: Auth, newTokenPair: TokenPair, oldRefreshToken: RefreshToken];\n  \"token.revoked\": [user: Auth, token: RefreshToken];\n  \"token.expired\": [token: RefreshToken];\n  \"token.familyRevoked\": [familyId: string, tokens: RefreshToken[]];\n\n  // Password events\n  \"password.changed\": [user: Auth];\n  \"password.resetRequested\": [user: Auth, resetToken: string];\n  \"password.reset\": [user: Auth];\n\n  // Session events\n  \"session.created\": [user: Auth, refreshToken: RefreshToken, deviceInfo?: DeviceInfo];\n  \"session.destroyed\": [user: Auth, refreshToken: RefreshToken];\n\n  // Cleanup events\n  \"cleanup.completed\": [expiredCount: number];\n};\n\n/**\n * Auth event names\n */\nexport type AuthEventName = keyof AuthEventPayloads;\n\n/**\n * Callback type for a specific event\n */\nexport type AuthEventCallback<T extends AuthEventName> = (\n  ...args: AuthEventPayloads[T]\n) => void | Promise<void>;\n\n/**\n * Event namespace prefix for auth events\n */\nconst AUTH_EVENT_PREFIX = \"auth.\";\n\n/**\n * Type-safe auth events manager\n *\n * @example\n * ```typescript\n * // Subscribe to events with full autocomplete\n * authEvents.on(\"login.success\", (user, tokenPair, deviceInfo) => {\n *   console.log(`User ${user.id} logged in`);\n * });\n *\n * authEvents.on(\"token.refreshed\", (user, newPair, oldToken) => {\n *   console.log(`Token refreshed for user ${user.id}`);\n * });\n *\n * // Trigger events\n * authEvents.emit(\"login.success\", user, tokenPair, deviceInfo);\n * ```\n */\nexport const authEvents = {\n  /**\n   * Subscribe to an auth event\n   */\n  on<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return events.subscribe(AUTH_EVENT_PREFIX + event, callback as Function);\n  },\n\n  /**\n   * Subscribe to an auth event (alias for `on`)\n   */\n  subscribe<T extends AuthEventName>(event: T, callback: AuthEventCallback<T>): EventSubscription {\n    return this.on(event, callback);\n  },\n\n  /**\n   * Emit an auth event\n   */\n  emit<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    try {\n      events.trigger(AUTH_EVENT_PREFIX + event, ...args);\n    } catch (error) {\n      // Auth events are fire-and-forget notifications: a throwing listener must\n      // never break the flow that emitted it (e.g. turn a completed login into a\n      // 500). Log and swallow. NOTE: this guards synchronous listener throws;\n      // async listener rejections and \"later listeners still run\" need a fix in\n      // @mongez/events (tracked separately).\n      log.error(\"auth\", \"event\", error);\n    }\n  },\n\n  /**\n   * Emit an auth event (alias for `emit`)\n   */\n  trigger<T extends AuthEventName>(event: T, ...args: AuthEventPayloads[T]): void {\n    this.emit(event, ...args);\n  },\n\n  /**\n   * Unsubscribe from all auth events\n   */\n  unsubscribeAll(): void {\n    events.unsubscribeNamespace(AUTH_EVENT_PREFIX.slice(0, -1));\n  },\n\n  /**\n   * Unsubscribe from a specific auth event\n   */\n  off(event?: AuthEventName): void {\n    if (event) {\n      events.unsubscribe(AUTH_EVENT_PREFIX + event);\n    } else {\n      this.unsubscribeAll();\n    }\n  },\n};\n"],"mappings":";;;;;;;AAuDA,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;AAoB1B,MAAa,aAAa;;;;CAIxB,GAA4B,OAAU,UAAmD;EACvF,OAAO,OAAO,UAAU,oBAAoB,OAAO,QAAoB;CACzE;;;;CAKA,UAAmC,OAAU,UAAmD;EAC9F,OAAO,KAAK,GAAG,OAAO,QAAQ;CAChC;;;;CAKA,KAA8B,OAAU,GAAG,MAAkC;EAC3E,IAAI;GACF,OAAO,QAAQ,oBAAoB,OAAO,GAAG,IAAI;EACnD,SAAS,OAAO;GAMd,IAAI,MAAM,QAAQ,SAAS,KAAK;EAClC;CACF;;;;CAKA,QAAiC,OAAU,GAAG,MAAkC;EAC9E,KAAK,KAAK,OAAO,GAAG,IAAI;CAC1B;;;;CAKA,iBAAuB;EACrB,OAAO,qBAAqB,kBAAkB,MAAM,GAAG,EAAE,CAAC;CAC5D;;;;CAKA,IAAI,OAA6B;EAC/B,IAAI,OACF,OAAO,YAAY,oBAAoB,KAAK;OAE5C,KAAK,eAAe;CAExB;AACF"}

package/esm/services/auth.service.d.mts

@@ -5,7 +5,7 @@ import { RefreshToken } from "../models/refresh-token/refresh-token.model.mjs";
 import { Request, Response } from "@warlock.js/core";
 import { ChildModel } from "@warlock.js/cascade";
 
-//#region ../auth/src/services/auth.service.d.ts
+//#region ../../packages/auth/src/services/auth.service.d.ts
 /** Thrown when a request-scoped cookie Domain cannot be resolved safely. */
 declare class CookieDomainRequestRequiredError extends Error {
   constructor(method: string);

package/esm/services/auth.service.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"mappings":";;;;;;;;;cAoCa,gCAAA,SAAyC,KAAK;cACtC,MAAA;AAAA;AAAA,cAQf,WAAA;EATwC;;;;;;EAAA,YAgBhC,gBAAA;EAfqB;AAMlC;;EANkC,YAsBrB,iBAAA;EAcyB;;;EAAA,YAPzB,iBAAA;EAqDJ;;;EA9CD,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EAiIpC;EAxHK,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EAmLqB;;;;;EAzJtB,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EAiQgC;;;;;;EAAA,QAvNhC,qBAAA;EA6aL;;;;EA7YI,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAcG,cAAA;EA+ZL;;;EA1WI,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA6WhE;;;;;EA5VE,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA+WA;;;;;EArRE,qBAAA,CACX,kBAAA,UACA,gBAAA,UACA,OAAA;IAAW,SAAA;IAAoB,UAAA,GAAa,UAAA;IAAY,QAAA;EAAA,IACvD,OAAA,CAAQ,SAAA;EAmSI;;;;;EAAA,QApLD,mBAAA;EAAA,QAsBN,kBAAA;EAAA,QAMA,sBAAA;EAAA,QAWA,YAAA;EAAA,QAMA,sBAAA;EAAA,QAOM,sBAAA;EAiO8C;;;EA/L/C,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAgTvC;;;EAzSxB,YAAA,CAAa,QAAA,WAAmB,OAAA;EAoVJ;;;;EA5U5B,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAoZkE;;;;EApXhE,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA4YsD;;;;;;;;;EAzXhE,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA8a6C;;;;;;;EAjavD,uBAAA,WAAkC,IAAA,EAC7C,OAAA,EAAS,OAAA,EACT,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA5lBc;EAAA,QAsnBvB,aAAA;EAtnB8B;;;;;;;;;;EAipB/B,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAlmB5E;;;EA+nBW,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA9kB7C;;;EAqlBD,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EAnjBjC;;;EA0jBF,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA3iB9C;;;;;EAojBD,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EA/fyB;;;EA8hBtD,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA3gBnC;;;;;;EAolBF,oBAAA,IAAwB,OAAA;EAtfxB;;;;;;;;;;EA+gBA,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EA3UW;;;;;;;;EA2Vf,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EA5UM;;;EA8VK,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA7TvC;;;;;EAAA,QAsUL,qBAAA;EAAA,QAUA,eAAA;EA9UN;;;;;;;;;;;;;;;;;;;;;EAiXK,aAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EA7UyD;;;;;;;;;;EAsW7D,eAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAS,sBAAA,EACT,OAAA,GAAU,OAAA;EA3UE;;;;;;;;;;;EAmWP,iBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,MAAA;IAAU,WAAA,EAAa,iBAAA;IAAmB,YAAA,EAAc,iBAAA;EAAA,GACxD,OAAA,GAAU,OAAA;EAhS0B;;;;EA0T/B,mBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAU,OAAA;AAAA;AAAA,cAcD,WAAA,EAAW,WAAoB"}
+{"version":3,"file":"auth.service.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth.service.ts"],"mappings":";;;;;;;;;cAoCa,gCAAA,SAAyC,KAAK;cACtC,MAAA;AAAA;AAAA,cAQf,WAAA;EATwC;;;;;;EAAA,YAgBhC,gBAAA;EAfqB;AAMlC;;EANkC,YAsBrB,iBAAA;EAcyB;;;EAAA,YAPzB,iBAAA;EAqDJ;;;EA9CD,uBAAA,CAAwB,IAAA,EAAM,IAAA,GAAO,MAAA;EAiIpC;EAxHK,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EAAA,QAI5B,qBAAA;EAAA,QAMA,gBAAA;EAmLqB;;;;;EAzJtB,mBAAA,CACX,IAAA,EAAM,IAAA,EACN,OAAA,GAAU,MAAA,oBACT,OAAA,CAAQ,iBAAA;EAAA,QAMG,iBAAA;EAiQgC;;;;;;EAAA,QAvNhC,qBAAA;EA6aL;;;;EA7YI,kBAAA,CACX,IAAA,EAAM,IAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,YAAA;EAAA,QAcG,cAAA;EA+ZL;;;EA1WI,eAAA,CAAgB,IAAA,EAAM,IAAA,EAAM,UAAA,GAAa,UAAA,GAAa,OAAA,CAAQ,SAAA;EA6WhE;;;;;EA5VE,aAAA,CACX,kBAAA,UACA,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,SAAA;EA+WA;;;;;EArRE,qBAAA,CACX,kBAAA,UACA,gBAAA,UACA,OAAA;IAAW,SAAA;IAAoB,UAAA,GAAa,UAAA;IAAY,QAAA;EAAA,IACvD,OAAA,CAAQ,SAAA;EAmSI;;;;;EAAA,QApLD,mBAAA;EAAA,QAsBN,kBAAA;EAAA,QAMA,sBAAA;EAAA,QAWA,YAAA;EAAA,QAMA,sBAAA;EAAA,QAOM,sBAAA;EAiO8C;;;EA/L/C,cAAA,CAAe,aAAA,UAAuB,cAAA,WAAyB,OAAA;EAgTvC;;;EAzSxB,YAAA,CAAa,QAAA,WAAmB,OAAA;EAoVJ;;;;EA5U5B,YAAA,WAAuB,IAAA,EAClC,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,IAAA,EAAM,eAAA,GACL,OAAA,CAAQ,CAAA;EAoZkE;;;;EApXhE,KAAA,WAAgB,IAAA,EAC3B,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA4YsD;;;;;;;;;EAzXhE,aAAA,WAAwB,IAAA,EACnC,IAAA,EAAM,CAAA,EACN,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA8a6C;;;;;;;EAjavD,uBAAA,WAAkC,IAAA,EAC7C,OAAA,EAAS,OAAA,EACT,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,EAAO,UAAA,CAAW,CAAA,GAClB,WAAA,EAAa,eAAA,EACb,UAAA,GAAa,UAAA,GACZ,OAAA,CAAQ,WAAA,CAAY,CAAA;EA5lBc;EAAA,QAsnBvB,aAAA;EAtnB8B;;;;;;;;;;EAipB/B,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,WAAA,WAAsB,YAAA,YAAwB,OAAA;EAlmB5E;;;EA+nBW,iBAAA,CAAkB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA9kB7C;;;EAqlBD,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAA;EAnjBjC;;;EA0jBF,kBAAA,CAAmB,IAAA,EAAM,IAAA,EAAM,KAAA,WAAgB,OAAA;EA3iB9C;;;;;EAojBD,eAAA,CAAgB,IAAA,EAAM,IAAA,GAAO,OAAA;EA/fyB;;;EA8hBtD,iBAAA,CAAkB,QAAA,WAAmB,OAAA;EA3gBnC;;;;;;EAolBF,oBAAA,IAAwB,OAAA;EAtfxB;;;;;;;;;;EA+gBA,uBAAA,IAA2B,OAAA;IACtC,YAAA,EAAc,WAAA;IACd,aAAA,EAAe,YAAA;EAAA;EA3UW;;;;;;;;EA2Vf,wBAAA,IAA4B,OAAA;IACvC,YAAA;IACA,aAAA;EAAA;EA5UM;;;EA8VK,iBAAA,CAAkB,IAAA,EAAM,IAAA,GAAO,OAAA,CAAQ,YAAA;EA7TvC;;;;;EAAA,QAsUL,qBAAA;EAAA,QAUA,eAAA;EA9UN;;;;;;;;;;;;;;;;;;;;;EAiXK,aAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,KAAA,WAAgB,iBAAA,EAChB,OAAA,GAAS,oBAAA;EA7UyD;;;;;;;;;;EAsW7D,eAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAS,sBAAA,EACT,OAAA,GAAU,OAAA;EA3UE;;;;;;;;;;;EAmWP,iBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,MAAA;IAAU,WAAA,EAAa,iBAAA;IAAmB,YAAA,EAAc,iBAAA;EAAA,GACxD,OAAA,GAAU,OAAA;EAhS0B;;;;EA0T/B,mBAAA,CACL,QAAA,yCAAiD,IAAA,EAAM,UAAA,CAAW,QAAA,CAAS,CAAA,kBAC3E,OAAA,GAAU,OAAA;AAAA;AAAA,cAcD,WAAA,EAAW,WAAoB"}

package/esm/services/auth.service.mjs

@@ -15,7 +15,7 @@ import { Random } from "@mongez/reinforcements";
 import { ForbiddenError, config, hashPassword, verifyPassword } from "@warlock.js/core";
 import { randomUUID } from "node:crypto";
 
-//#region ../auth/src/services/auth.service.ts
+//#region ../../packages/auth/src/services/auth.service.ts
 /** Thrown when a request-scoped cookie Domain cannot be resolved safely. */
 var CookieDomainRequestRequiredError = class extends Error {
 	constructor(method) {

package/esm/services/auth.service.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport { randomUUID } from \"node:crypto\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Request,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { assertCsrfOriginAllowed } from \"../middleware/csrf-origin-check\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\nimport { OneTimeToken } from \"../models/one-time-token\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\nimport {\n  afterTokenFamilyOperation,\n  runTokenFamilyOperation,\n  TokenFamilyUnavailableError,\n} from \"./token-family-operation\";\n\n/** Thrown when a request-scoped cookie Domain cannot be resolved safely. */\nexport class CookieDomainRequestRequiredError extends Error {\n  public constructor(method: string) {\n    super(\n      `${method} requires the request when auth.cookie.cookieDomain is configured because the cookie Domain must be resolved for that request.`,\n    );\n    this.name = \"CookieDomainRequestRequiredError\";\n  }\n}\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Resolve the active one-time-token model (default or registered override).\n   */\n  private get oneTimeTokenModel(): typeof OneTimeToken {\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n    familyId?: string,\n  ): Promise<AccessTokenOutput> {\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    if (familyId) {\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\n    } else {\n      await this.accessTokenModel.issue(user, token, expiresAt);\n    }\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId));\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n      jti: randomUUID(),\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Keep issuance into an explicitly reused family in the same durable\n   * transition boundary as rotation and revocation. A new, caller-unspecified\n   * family has no concurrent session to protect and retains the lightweight\n   * issuance path.\n   */\n  private async issueInSuppliedFamily<T>(\n    user: Auth,\n    familyId: string,\n    issue: (family: AuthTokenFamily) => Promise<T>,\n  ): Promise<T> {\n    // Preserve the established error for a family that was already revoked\n    // before issuance started. The coordinator covers a revoke that races\n    // after this observation.\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    try {\n      return await runTokenFamilyOperation(familyId, issue);\n    } catch (error) {\n      // Do not expose a timing-dependent error shape to callers: a family\n      // revoked between ensure() and the transaction is the same unusable\n      // family condition as one found above.\n      if (error instanceof TokenFamilyUnavailableError) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    if (deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueRefreshToken(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<TokenPair> {\n    const refreshEnabled = authConfig.refreshToken.enabled();\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = refreshEnabled\n      ? (ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId)))\n      : undefined;\n\n    if (family) {\n      if (family.isRevoked) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n    }\n\n    const accessToken = await this.issueAccessToken(\n      user,\n      deviceInfo?.payload,\n      refreshEnabled ? familyId : undefined,\n    );\n    const refreshToken = await this.issueRefreshToken(\n      user,\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\n      family,\n    );\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\n\n    if (refreshToken) {\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\n      );\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueTokenPair(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded: {\n      userId: number;\n      userType: string;\n      familyId: string;\n    } | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // Each serializable attempt must read the current row in its own snapshot.\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\n      if (!refreshToken.isValid) {\n        // An already-invalid token may be a replay of a rotated credential.\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.familyId);\n        }\n\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n      if (!UserModel) {\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\n      }\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n      if (!user) return null;\n\n      if (!(await this.canAuthenticate(user))) return null;\n\n      const rotationEnabled = authConfig.refreshToken.rotation();\n\n      if (rotationEnabled) {\n        const won = await refreshToken.revokeIfActive();\n\n        if (!won) {\n          // A concurrent request already rotated this token.\n          await this.revokeTokenFamily(refreshToken.familyId);\n\n          return null;\n        }\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      const newTokenPair = await this.issueTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.familyId,\n      });\n\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\n      );\n\n      return newTokenPair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\n   * a short duplicate presentation to receive the exact committed successor\n   * pair. It is deliberately not used by the legacy/public refresh API.\n   */\n  public async renewAutomaticSession(\n    refreshTokenString: string,\n    expectedUserType: string,\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo; maxAgeMs?: number } = {},\n  ): Promise<TokenPair | null> {\n    let decoded: { userId: number; userType: string; familyId: string } | null;\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n      throw error;\n    }\n\n    if (!decoded || decoded.userType !== expectedUserType) return null;\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // A retry can follow another process's committed rotation. Never reuse\n      // a model captured before the transaction or before a failed attempt.\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\n      if (!oldToken.isValid) {\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\n          this.hasSuccessor(oldToken)\n        ) {\n          return null;\n        }\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      // Rotation never extends a family past `maxAgeMs` from its first issue.\n      if (\n        options.maxAgeMs !== undefined &&\n        (await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs))\n      ) {\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n      if (!user || !(await this.canAuthenticate(user))) return null;\n\n      if (!(await oldToken.revokeIfActive())) {\n        // A newer successor is never substituted here. A stale automatic\n        // response must fail quietly rather than revoke a legitimate family.\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n        if (!currentToken) return null;\n        const successor = await this.readAutomaticSuccessor(\n          currentToken,\n          decoded,\n          options.overlapMs,\n        );\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\n          this.hasSuccessor(currentToken)\n        )\n          return null;\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const pair = await this.issueTokenPair(user, {\n        ...options.deviceInfo,\n        familyId: oldToken.familyId,\n      });\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\n      const successorRefresh = pair.refreshToken\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\n        : null;\n      if (!successorAccess || !successorRefresh) {\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\n      }\n\n      // `revokeIfActive()` updates the database, not this hydrated instance.\n      // Saving that stale instance would write its old `revoked_at: null` back\n      // and reopen the predecessor. Update only the successor columns instead.\n      const linked = await this.refreshTokenModel.atomic(\n        { id: oldToken.id },\n        {\n          $set: {\n            successor_access_token_id: successorAccess.id,\n            successor_refresh_token_id: successorRefresh.id,\n          },\n        },\n      );\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\n      return pair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Whether the family's first issue is older than `maxAgeMs`. The start is the\n   * family row's `created_at`, falling back to its oldest refresh token when\n   * the row carries none (an upserted legacy family).\n   */\n  private async familyExceedsMaxAge(familyId: string, maxAgeMs: number): Promise<boolean> {\n    const family = await AuthTokenFamily.findByFamilyId(familyId);\n    let started: unknown = family?.get(\"created_at\");\n\n    if (!started) {\n      const oldest = await this.refreshTokenModel\n        .query()\n        .where({ family_id: familyId })\n        .orderBy(\"created_at\", \"asc\")\n        .first();\n\n      started = oldest?.get(\"created_at\");\n    }\n\n    const startedAt = started ? new Date(started as string | number | Date).getTime() : NaN;\n\n    // Unknown start: nothing to measure against, so the cap cannot apply.\n    if (!Number.isFinite(startedAt)) return false;\n\n    return Date.now() - startedAt > maxAgeMs;\n  }\n\n  private automaticOverlapMs(overlapMs: number | undefined): number {\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\n      ? Math.max(0, Math.min(10_000, overlapMs))\n      : 5000;\n  }\n\n  private refreshIdentityMatches(\n    token: RefreshToken,\n    decoded: { userId: string | number; userType: string; familyId: string },\n  ): boolean {\n    return (\n      token.familyId === decoded.familyId &&\n      token.get(\"user_id\") === decoded.userId &&\n      token.get(\"user_type\") === decoded.userType\n    );\n  }\n\n  private hasSuccessor(oldToken: RefreshToken): boolean {\n    return Boolean(\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\n    );\n  }\n\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\n    const window = this.automaticOverlapMs(overlapMs);\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\n    return window > 0 && elapsed >= 0 && elapsed <= window;\n  }\n\n  private async readAutomaticSuccessor(\n    oldToken: RefreshToken,\n    decoded: { userId: number; userType: string; familyId: string },\n    overlapMs: number | undefined,\n  ): Promise<TokenPair | null> {\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\n    if (!accessId || !refreshId) return null;\n    const [access, refresh] = await Promise.all([\n      this.accessTokenModel.find(accessId),\n      this.refreshTokenModel.find(refreshId),\n    ]);\n    if (!access || access.isExpired || !refresh?.isValid) return null;\n    if (\n      access.get(\"family_id\") !== decoded.familyId ||\n      refresh.get(\"family_id\") !== decoded.familyId ||\n      access.get(\"user_id\") !== decoded.userId ||\n      refresh.get(\"user_id\") !== decoded.userId ||\n      access.get(\"user_type\") !== decoded.userType ||\n      refresh.get(\"user_type\") !== decoded.userType\n    )\n      return null;\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\n    return {\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\n    };\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Log in a user some OTHER method already authenticated — a provider\n   * callback, a passkey assertion, a one-time code. Applies the\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\n   * what {@link login} produces: the same tokens, rows and events. Pair with\n   * {@link setAuthCookie} for a cookie session, as with password login.\n   *\n   * Never call this for a user you have not authenticated.\n   */\n  public async completeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    await this.assertCanAuthenticate(user);\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Cookie login for a browser: same-origin check, credential login, then both\n   * session cookies. Unlike the default CSRF guard, the Origin/Referer check\n   * runs even when the request carries no cookies (login CSRF): a missing or\n   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any\n   * credential is looked at. Returns `null` on bad credentials.\n   */\n  public async loginWithSessionCookies<T extends Auth>(\n    request: Request,\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    assertCsrfOriginAllowed(request);\n\n    const result = await this.login(Model, credentials, deviceInfo);\n\n    if (!result) return null;\n\n    if (result.tokens.refreshToken) {\n      this.setSessionCookies(\n        response,\n        {\n          accessToken: result.tokens.accessToken,\n          refreshToken: result.tokens.refreshToken,\n        },\n        request,\n      );\n    } else {\n      this.setAuthCookie(response, result.tokens.accessToken, {\n        domain: this.cookieDomainFor(\"loginWithSessionCookies\", request),\n      });\n    }\n\n    return result;\n  }\n\n  /** The one token-issuing tail every login method shares. */\n  private async finalizeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await this.revokeTokenFamily(token.familyId);\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    // Upgrade existing installations lazily before the family scan. Include\n    // revoked rows: a rotation may have revoked its predecessor while its\n    // durable family still needs logout's marker.\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\n\n    for (const token of existingRows) {\n      await AuthTokenFamily.ensure(user, token.familyId);\n    }\n\n    const families = await AuthTokenFamily.activeFor(user);\n\n    for (const family of families) {\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\n    }\n\n    // A deployment can still have rows created before the additive migration\n    // ran; retain the old bulk cleanup as a final conservative backstop.\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of legacyTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\n\n    if (!family) {\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\n\n      if (!legacyToken) return;\n\n      family = await AuthTokenFamily.ensure(\n        {\n          id: legacyToken.get(\"user_id\"),\n          userType: legacyToken.get<string>(\"user_type\"),\n        } as Auth,\n        familyId,\n      );\n    }\n\n    const user = {\n      id: family.get(\"user_id\"),\n      userType: family.get<string>(\"user_type\"),\n    } as Auth;\n\n    if (family.isRevoked) {\n      // Logout and replay containment are idempotent. Re-run cleanup because a\n      // request that lost the original race may have observed stale rows.\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n      );\n\n      return;\n    }\n\n    let revokedTokens: RefreshToken[];\n    try {\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\n        const familyUser = {\n          id: currentFamily.get(\"user_id\"),\n          userType: currentFamily.get<string>(\"user_type\"),\n        } as Auth;\n        const revision = currentFamily.get<number>(\"revision\");\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\n\n        if (revoked !== 1) {\n          throw new Error(\"Token family revoke lost its revision transition\");\n        }\n\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\n\n        return familyTokens;\n      });\n    } catch (error) {\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\n\n      // Another request committed the revoke between the read above and its\n      // CAS. A second logout is successful after idempotent cleanup.\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n    }\n\n    afterTokenFamilyOperation(() =>\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n    );\n  }\n\n  /**\n   * Delete expired tokens (refresh + access) and spent one-time tokens\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n    await this.oneTimeTokenModel.purgeSpent();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  private cookieDomainFor(method: string, request?: Request): string | undefined {\n    const resolver = authConfig.cookie.cookieDomain();\n\n    if (!resolver) {\n      return undefined;\n    }\n\n    if (!request) {\n      throw new CookieDomainRequestRequiredError(method);\n    }\n\n    return resolver(request);\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(options.domain !== undefined ? { domain: options.domain } : {}),\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    options: ClearAuthCookieOptions = {},\n    request?: Request,\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const domain = this.cookieDomainFor(\"clearAuthCookie\", request);\n\n    if (domain !== undefined) {\n      response.clearCookie(name, { path, domain });\n    }\n\n    response.clearCookie(name, { path });\n  }\n\n  /**\n   * Write the access and refresh cookies of a browser session. Both are\n   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every\n   * page) and `Secure` outside development, named by `auth.cookie.name` and\n   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's\n   * `expiresAt`, so the cookie lives exactly as long as the token.\n   *\n   * @example\n   * const { tokens } = await authService.login(User, credentials);\n   * authService.setSessionCookies(response, tokens);\n   */\n  public setSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    tokens: { accessToken: AccessTokenOutput; refreshToken: AccessTokenOutput },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"setSessionCookies\", request);\n    const cookies = [\n      [authConfig.cookie.name(), tokens.accessToken],\n      [authConfig.cookie.refreshName(), tokens.refreshToken],\n    ] as const;\n\n    for (const [name, token] of cookies) {\n      const maxAge = this.cookieMaxAgeFromToken(token);\n\n      response.cookie(name, token.token, {\n        raw: true,\n        httpOnly: true,\n        sameSite: \"lax\",\n        path: \"/\",\n        ...(domain !== undefined ? { domain } : {}),\n        ...(maxAge !== undefined ? { maxAge } : {}),\n      });\n    }\n  }\n\n  /**\n   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.\n   * Pair it with {@link logout} after the token rows are revoked.\n   */\n  public clearSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"clearSessionCookies\", request);\n\n    for (const name of [authConfig.cookie.name(), authConfig.cookie.refreshName()]) {\n      if (domain !== undefined) {\n        response.clearCookie(name, { path: \"/\", domain });\n      }\n\n      response.clearCookie(name, { path: \"/\" });\n    }\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoCA,IAAa,mCAAb,cAAsD,MAAM;CAC1D,AAAO,YAAY,QAAgB;EACjC,MACE,GAAG,OAAO,+HACZ;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACA,eACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAFe,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,EAElE,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,KAAK;EACtD,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,kBAAkB,MAAM,YAAY,MAAM,CACjD;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eACZ,MACA,YACA,eACoB;EACpB,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,SAAS,iBACV,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,IAC9D;EAEJ,IAAI,QACF;OAAI,OAAO,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,YAC/C,MACF;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,eAAe,MAAM,YAAY,MAAM,CAC9C;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA8E,CAAC,GACpD;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAGA,IACE,QAAQ,aAAa,UACpB,MAAM,KAAK,oBAAoB,SAAS,UAAU,QAAQ,QAAQ,GACnE;IACA,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAc,oBAAoB,UAAkB,UAAoC;EAEtF,IAAI,WAAmB,MADF,gBAAgB,eAAe,QAAQ,EAC/B,EAAE,IAAI,YAAY;EAE/C,IAAI,CAAC,SAOH,WAAU,MANW,KAAK,kBACvB,MAAM,CAAC,CACP,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,CAC9B,QAAQ,cAAc,KAAK,CAAC,CAC5B,MAAM,EAEO,EAAE,IAAI,YAAY;EAGpC,MAAM,YAAY,UAAU,IAAI,KAAK,OAAiC,CAAC,CAAC,QAAQ,IAAI;EAGpF,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;EAExC,OAAO,KAAK,IAAI,IAAI,YAAY;CAClC;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;CASA,MAAa,wBACX,SACA,UACA,OACA,aACA,YACgC;EAChC,wBAAwB,OAAO;EAE/B,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,aAAa,UAAU;EAE9D,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,OAAO,OAAO,cAChB,KAAK,kBACH,UACA;GACE,aAAa,OAAO,OAAO;GAC3B,cAAc,OAAO,OAAO;EAC9B,GACA,OACF;OAEA,KAAK,cAAc,UAAU,OAAO,OAAO,aAAa,EACtD,QAAQ,KAAK,gBAAgB,2BAA2B,OAAO,EACjE,CAAC;EAGH,OAAO;CACT;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;CAEA,AAAQ,gBAAgB,QAAgB,SAAuC;EAC7E,MAAM,WAAW,WAAW,OAAO,aAAa;EAEhD,IAAI,CAAC,UACH;EAGF,IAAI,CAAC,SACH,MAAM,IAAI,iCAAiC,MAAM;EAGnD,OAAO,SAAS,OAAO;CACzB;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBACL,UACA,UAAkC,CAAC,GACnC,SACM;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,SAAS,KAAK,gBAAgB,mBAAmB,OAAO;EAE9D,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;GAAE;GAAM;EAAO,CAAC;EAG7C,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;;;;;;;;;;;;CAaA,AAAO,kBACL,UACA,QACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,qBAAqB,OAAO;EAChE,MAAM,UAAU,CACd,CAAC,WAAW,OAAO,KAAK,GAAG,OAAO,WAAW,GAC7C,CAAC,WAAW,OAAO,YAAY,GAAG,OAAO,YAAY,CACvD;EAEA,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;GACnC,MAAM,SAAS,KAAK,sBAAsB,KAAK;GAE/C,SAAS,OAAO,MAAM,MAAM,OAAO;IACjC,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;IACzC,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH;CACF;;;;;CAMA,AAAO,oBACL,UACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,uBAAuB,OAAO;EAElE,KAAK,MAAM,QAAQ,CAAC,WAAW,OAAO,KAAK,GAAG,WAAW,OAAO,YAAY,CAAC,GAAG;GAC9E,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;IAAE,MAAM;IAAK;GAAO,CAAC;GAGlD,SAAS,YAAY,MAAM,EAAE,MAAM,IAAI,CAAC;EAC1C;CACF;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}
+{"version":3,"file":"auth.service.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/auth.service.ts"],"sourcesContent":["import { Random } from \"@mongez/reinforcements\";\nimport { randomUUID } from \"node:crypto\";\nimport type { ChildModel } from \"@warlock.js/cascade\";\nimport {\n  config,\n  ForbiddenError,\n  hashPassword,\n  type Request,\n  type Response,\n  verifyPassword,\n} from \"@warlock.js/core\";\nimport type {\n  AccessTokenOutput,\n  AuthCredentials,\n  ClearAuthCookieOptions,\n  DeviceInfo,\n  LoginResult,\n  SetAuthCookieOptions,\n  TokenPair,\n} from \"../contracts/types\";\nimport { assertCsrfOriginAllowed } from \"../middleware/csrf-origin-check\";\nimport { AccessToken } from \"../models/access-token\";\nimport type { Auth } from \"../models/auth.model\";\nimport { AuthTokenFamily } from \"../models/auth-token-family\";\nimport { OneTimeToken } from \"../models/one-time-token\";\nimport { RefreshToken } from \"../models/refresh-token\";\nimport { authConfig } from \"./auth-config\";\nimport { authEvents } from \"./auth-events\";\nimport { isInvalidCredentialError, jwt } from \"./jwt\";\nimport {\n  afterTokenFamilyOperation,\n  runTokenFamilyOperation,\n  TokenFamilyUnavailableError,\n} from \"./token-family-operation\";\n\n/** Thrown when a request-scoped cookie Domain cannot be resolved safely. */\nexport class CookieDomainRequestRequiredError extends Error {\n  public constructor(method: string) {\n    super(\n      `${method} requires the request when auth.cookie.cookieDomain is configured because the cookie Domain must be resolved for that request.`,\n    );\n    this.name = \"CookieDomainRequestRequiredError\";\n  }\n}\n\nclass AuthService {\n  /**\n   * Resolve the active access-token model — the package default, or a subclass\n   * an app registered under `config.auth.accessToken.model` (e.g. to add a\n   * tenant column). The service never references the concrete class directly so\n   * an override is a pure config change.\n   */\n  private get accessTokenModel(): typeof AccessToken {\n    return config.key(\"auth.accessToken.model\", AccessToken);\n  }\n\n  /**\n   * Resolve the active refresh-token model (default or registered override).\n   */\n  private get refreshTokenModel(): typeof RefreshToken {\n    return config.key(\"auth.refreshToken.model\", RefreshToken);\n  }\n\n  /**\n   * Resolve the active one-time-token model (default or registered override).\n   */\n  private get oneTimeTokenModel(): typeof OneTimeToken {\n    return config.key(\"auth.oneTimeToken.model\", OneTimeToken);\n  }\n\n  /**\n   * Build the default access-token JWT payload from a user.\n   */\n  public buildAccessTokenPayload(user: Auth): Record<string, unknown> {\n    return {\n      id: user.id,\n      userType: user.userType,\n      created_at: Date.now(),\n    };\n  }\n\n  /** One policy seam keeps account-state checks identical across all auth paths. */\n  public async canAuthenticate(user: Auth): Promise<boolean> {\n    return authConfig.canAuthenticate(user);\n  }\n\n  private async assertCanAuthenticate(user: Auth): Promise<void> {\n    if (!(await this.canAuthenticate(user))) {\n      throw new ForbiddenError(\"This user cannot authenticate.\");\n    }\n  }\n\n  private async issueAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n    familyId?: string,\n  ): Promise<AccessTokenOutput> {\n    const data = { ...(payload || this.buildAccessTokenPayload(user)), jti: randomUUID() };\n    // Validate before signing so an unusable lifetime cannot mint an immortal token.\n    const expiresIn = authConfig.accessToken.expiresInMs();\n\n    const token = await jwt.generate(data, { expiresIn });\n    const expiresAt = new Date(Date.now() + expiresIn);\n\n    if (familyId) {\n      await this.accessTokenModel.issue(user, token, expiresAt, familyId);\n    } else {\n      await this.accessTokenModel.issue(user, token, expiresAt);\n    }\n\n    return { token, expiresAt: expiresAt.toISOString() };\n  }\n\n  /**\n   * Sign + persist an access token for the user and return the token with its\n   * expiry. The expiry is computed locally from `expiresIn` rather than by\n   * re-verifying the token we just signed.\n   */\n  public async generateAccessToken(\n    user: Auth,\n    payload?: Record<string, unknown>,\n  ): Promise<AccessTokenOutput> {\n    await this.assertCanAuthenticate(user);\n\n    return this.issueAccessToken(user, payload);\n  }\n\n  private async issueRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    // Validate the lifetime first — before the per-user cap is enforced, before\n    // anything is signed — so a bad value can never revoke a user's oldest\n    // session on its way to failing.\n    const expiresIn = authConfig.refreshToken.expiresInMs();\n\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId));\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    const payload = {\n      userId: user.id,\n      userType: user.userType,\n      familyId,\n      jti: randomUUID(),\n    };\n\n    const expiresAt = new Date(Date.now() + expiresIn).toISOString();\n\n    await this.refreshTokenModel.enforceMax(user, authConfig.refreshToken.maxPerUser());\n\n    const token = await jwt.generateRefreshToken(payload, { expiresIn });\n\n    return this.refreshTokenModel.issue(user, token, { familyId, expiresAt, deviceInfo });\n  }\n\n  /**\n   * Keep issuance into an explicitly reused family in the same durable\n   * transition boundary as rotation and revocation. A new, caller-unspecified\n   * family has no concurrent session to protect and retains the lightweight\n   * issuance path.\n   */\n  private async issueInSuppliedFamily<T>(\n    user: Auth,\n    familyId: string,\n    issue: (family: AuthTokenFamily) => Promise<T>,\n  ): Promise<T> {\n    // Preserve the established error for a family that was already revoked\n    // before issuance started. The coordinator covers a revoke that races\n    // after this observation.\n    const family = await AuthTokenFamily.ensure(user, familyId);\n\n    if (family.isRevoked) {\n      throw new Error(\"Cannot issue tokens for a revoked token family\");\n    }\n\n    try {\n      return await runTokenFamilyOperation(familyId, issue);\n    } catch (error) {\n      // Do not expose a timing-dependent error shape to callers: a family\n      // revoked between ensure() and the transaction is the same unusable\n      // family condition as one found above.\n      if (error instanceof TokenFamilyUnavailableError) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n\n      throw error;\n    }\n  }\n\n  /**\n   * Sign + persist a refresh token for the user (enforcing the per-user cap\n   * first). Resolves to `undefined` when refresh tokens are disabled in config.\n   */\n  public async createRefreshToken(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n  ): Promise<RefreshToken | undefined> {\n    if (!authConfig.refreshToken.enabled()) return;\n\n    await this.assertCanAuthenticate(user);\n\n    if (deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueRefreshToken(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueRefreshToken(user, deviceInfo);\n  }\n\n  private async issueTokenPair(\n    user: Auth,\n    deviceInfo?: DeviceInfo,\n    ensuredFamily?: AuthTokenFamily,\n  ): Promise<TokenPair> {\n    const refreshEnabled = authConfig.refreshToken.enabled();\n    const familyId = deviceInfo?.familyId || Random.string(32);\n\n    const family = refreshEnabled\n      ? (ensuredFamily ?? (await AuthTokenFamily.ensure(user, familyId)))\n      : undefined;\n\n    if (family) {\n      if (family.isRevoked) {\n        throw new Error(\"Cannot issue tokens for a revoked token family\");\n      }\n    }\n\n    const accessToken = await this.issueAccessToken(\n      user,\n      deviceInfo?.payload,\n      refreshEnabled ? familyId : undefined,\n    );\n    const refreshToken = await this.issueRefreshToken(\n      user,\n      refreshEnabled ? { ...deviceInfo, familyId } : deviceInfo,\n      family,\n    );\n\n    const tokenPair: TokenPair = {\n      accessToken,\n      refreshToken: refreshToken\n        ? {\n            token: refreshToken.get(\"token\"),\n            expiresAt: refreshToken.get(\"expires_at\"),\n          }\n        : undefined,\n    };\n\n    afterTokenFamilyOperation(() => authEvents.emit(\"token.created\", user, tokenPair));\n\n    if (refreshToken) {\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"session.created\", user, refreshToken, deviceInfo),\n      );\n    }\n\n    return tokenPair;\n  }\n\n  /**\n   * Issue both an access and a refresh token, emitting the creation events.\n   */\n  public async createTokenPair(user: Auth, deviceInfo?: DeviceInfo): Promise<TokenPair> {\n    await this.assertCanAuthenticate(user);\n\n    if (authConfig.refreshToken.enabled() && deviceInfo?.familyId) {\n      return this.issueInSuppliedFamily(user, deviceInfo.familyId, (family) =>\n        this.issueTokenPair(user, deviceInfo, family),\n      );\n    }\n\n    return this.issueTokenPair(user, deviceInfo);\n  }\n\n  /**\n   * Exchange a refresh token for a new token pair, with rotation + replay\n   * detection. A concurrent reuse of the same token loses the atomic revoke and\n   * is treated as a breach — the whole family is revoked and the request fails.\n   */\n  public async refreshTokens(\n    refreshTokenString: string,\n    deviceInfo?: DeviceInfo,\n  ): Promise<TokenPair | null> {\n    let decoded: {\n      userId: number;\n      userType: string;\n      familyId: string;\n    } | null;\n\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n\n      throw error;\n    }\n\n    if (!decoded) return null;\n\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // Each serializable attempt must read the current row in its own snapshot.\n      const refreshToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!refreshToken || !this.refreshIdentityMatches(refreshToken, decoded)) return null;\n      if (!refreshToken.isValid) {\n        // An already-invalid token may be a replay of a rotated credential.\n        if (refreshToken) {\n          await this.revokeTokenFamily(refreshToken.familyId);\n        }\n\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n\n      if (!UserModel) {\n        throw new Error(`User type ${decoded.userType} is unknown type.`);\n      }\n\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n\n      if (!user) return null;\n\n      if (!(await this.canAuthenticate(user))) return null;\n\n      const rotationEnabled = authConfig.refreshToken.rotation();\n\n      if (rotationEnabled) {\n        const won = await refreshToken.revokeIfActive();\n\n        if (!won) {\n          // A concurrent request already rotated this token.\n          await this.revokeTokenFamily(refreshToken.familyId);\n\n          return null;\n        }\n      } else {\n        await refreshToken.markAsUsed();\n      }\n\n      const newTokenPair = await this.issueTokenPair(user, {\n        ...deviceInfo,\n        familyId: refreshToken.familyId,\n      });\n\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.refreshed\", user, newTokenPair, refreshToken),\n      );\n\n      return newTokenPair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Opt-in browser-session renewal. Unlike {@link refreshTokens}, this permits\n   * a short duplicate presentation to receive the exact committed successor\n   * pair. It is deliberately not used by the legacy/public refresh API.\n   */\n  public async renewAutomaticSession(\n    refreshTokenString: string,\n    expectedUserType: string,\n    options: { overlapMs?: number; deviceInfo?: DeviceInfo; maxAgeMs?: number } = {},\n  ): Promise<TokenPair | null> {\n    let decoded: { userId: number; userType: string; familyId: string } | null;\n    try {\n      decoded = await jwt.verifyRefreshToken<{\n        userId: number;\n        userType: string;\n        familyId: string;\n      }>(refreshTokenString);\n    } catch (error) {\n      if (isInvalidCredentialError(error)) return null;\n      throw error;\n    }\n\n    if (!decoded || decoded.userType !== expectedUserType) return null;\n    const presentedToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n    if (!presentedToken || !this.refreshIdentityMatches(presentedToken, decoded)) return null;\n\n    await AuthTokenFamily.ensure(\n      { id: decoded.userId, userType: decoded.userType } as Auth,\n      presentedToken.familyId,\n    );\n    return runTokenFamilyOperation(presentedToken.familyId, async () => {\n      // A retry can follow another process's committed rotation. Never reuse\n      // a model captured before the transaction or before a failed attempt.\n      const oldToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n      if (!oldToken || !this.refreshIdentityMatches(oldToken, decoded)) return null;\n      if (!oldToken.isValid) {\n        const successor = await this.readAutomaticSuccessor(oldToken, decoded, options.overlapMs);\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(oldToken, options.overlapMs) &&\n          this.hasSuccessor(oldToken)\n        ) {\n          return null;\n        }\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      // Rotation never extends a family past `maxAgeMs` from its first issue.\n      if (\n        options.maxAgeMs !== undefined &&\n        (await this.familyExceedsMaxAge(oldToken.familyId, options.maxAgeMs))\n      ) {\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const UserModel = config.key(`auth.userType.${decoded.userType}`);\n      if (!UserModel) throw new Error(`User type ${decoded.userType} is unknown type.`);\n      const user = (await UserModel.find(decoded.userId)) as Auth | null;\n      if (!user || !(await this.canAuthenticate(user))) return null;\n\n      if (!(await oldToken.revokeIfActive())) {\n        // A newer successor is never substituted here. A stale automatic\n        // response must fail quietly rather than revoke a legitimate family.\n        const currentToken = await this.refreshTokenModel.findByToken(refreshTokenString);\n        if (!currentToken) return null;\n        const successor = await this.readAutomaticSuccessor(\n          currentToken,\n          decoded,\n          options.overlapMs,\n        );\n        if (successor) return successor;\n        if (\n          this.isAutomaticOverlapOpen(currentToken, options.overlapMs) &&\n          this.hasSuccessor(currentToken)\n        )\n          return null;\n        await this.revokeTokenFamily(oldToken.familyId);\n        return null;\n      }\n\n      const pair = await this.issueTokenPair(user, {\n        ...options.deviceInfo,\n        familyId: oldToken.familyId,\n      });\n      const successorAccess = await this.accessTokenModel.findByToken(pair.accessToken.token);\n      const successorRefresh = pair.refreshToken\n        ? await this.refreshTokenModel.findByToken(pair.refreshToken.token)\n        : null;\n      if (!successorAccess || !successorRefresh) {\n        throw new Error(\"Automatic renewal did not persist a complete successor pair\");\n      }\n\n      // `revokeIfActive()` updates the database, not this hydrated instance.\n      // Saving that stale instance would write its old `revoked_at: null` back\n      // and reopen the predecessor. Update only the successor columns instead.\n      const linked = await this.refreshTokenModel.atomic(\n        { id: oldToken.id },\n        {\n          $set: {\n            successor_access_token_id: successorAccess.id,\n            successor_refresh_token_id: successorRefresh.id,\n          },\n        },\n      );\n      if (linked !== 1) throw new Error(\"Automatic renewal could not link its successor pair\");\n      afterTokenFamilyOperation(() => authEvents.emit(\"token.refreshed\", user, pair, oldToken));\n      return pair;\n    }).catch((error) => {\n      if (error instanceof TokenFamilyUnavailableError) return null;\n      throw error;\n    });\n  }\n\n  /**\n   * Whether the family's first issue is older than `maxAgeMs`. The start is the\n   * family row's `created_at`, falling back to its oldest refresh token when\n   * the row carries none (an upserted legacy family).\n   */\n  private async familyExceedsMaxAge(familyId: string, maxAgeMs: number): Promise<boolean> {\n    const family = await AuthTokenFamily.findByFamilyId(familyId);\n    let started: unknown = family?.get(\"created_at\");\n\n    if (!started) {\n      const oldest = await this.refreshTokenModel\n        .query()\n        .where({ family_id: familyId })\n        .orderBy(\"created_at\", \"asc\")\n        .first();\n\n      started = oldest?.get(\"created_at\");\n    }\n\n    const startedAt = started ? new Date(started as string | number | Date).getTime() : NaN;\n\n    // Unknown start: nothing to measure against, so the cap cannot apply.\n    if (!Number.isFinite(startedAt)) return false;\n\n    return Date.now() - startedAt > maxAgeMs;\n  }\n\n  private automaticOverlapMs(overlapMs: number | undefined): number {\n    return typeof overlapMs === \"number\" && Number.isFinite(overlapMs)\n      ? Math.max(0, Math.min(10_000, overlapMs))\n      : 5000;\n  }\n\n  private refreshIdentityMatches(\n    token: RefreshToken,\n    decoded: { userId: string | number; userType: string; familyId: string },\n  ): boolean {\n    return (\n      token.familyId === decoded.familyId &&\n      token.get(\"user_id\") === decoded.userId &&\n      token.get(\"user_type\") === decoded.userType\n    );\n  }\n\n  private hasSuccessor(oldToken: RefreshToken): boolean {\n    return Boolean(\n      oldToken.get(\"successor_access_token_id\") && oldToken.get(\"successor_refresh_token_id\"),\n    );\n  }\n\n  private isAutomaticOverlapOpen(oldToken: RefreshToken, overlapMs: number | undefined): boolean {\n    const revokedAt = oldToken.get<Date | undefined>(\"revoked_at\");\n    const window = this.automaticOverlapMs(overlapMs);\n    const elapsed = revokedAt ? Date.now() - new Date(revokedAt).getTime() : NaN;\n    return window > 0 && elapsed >= 0 && elapsed <= window;\n  }\n\n  private async readAutomaticSuccessor(\n    oldToken: RefreshToken,\n    decoded: { userId: number; userType: string; familyId: string },\n    overlapMs: number | undefined,\n  ): Promise<TokenPair | null> {\n    if (!this.isAutomaticOverlapOpen(oldToken, overlapMs)) return null;\n    const accessId = oldToken.get<string | undefined>(\"successor_access_token_id\");\n    const refreshId = oldToken.get<string | undefined>(\"successor_refresh_token_id\");\n    if (!accessId || !refreshId) return null;\n    const [access, refresh] = await Promise.all([\n      this.accessTokenModel.find(accessId),\n      this.refreshTokenModel.find(refreshId),\n    ]);\n    if (!access || access.isExpired || !refresh?.isValid) return null;\n    if (\n      access.get(\"family_id\") !== decoded.familyId ||\n      refresh.get(\"family_id\") !== decoded.familyId ||\n      access.get(\"user_id\") !== decoded.userId ||\n      refresh.get(\"user_id\") !== decoded.userId ||\n      access.get(\"user_type\") !== decoded.userType ||\n      refresh.get(\"user_type\") !== decoded.userType\n    )\n      return null;\n    const accessExpiry = new Date(access.get(\"expires_at\")).getTime();\n    if (!Number.isFinite(accessExpiry) || accessExpiry <= Date.now()) return null;\n    return {\n      accessToken: { token: access.get(\"token\"), expiresAt: access.get(\"expires_at\") },\n      refreshToken: { token: refresh.get(\"token\"), expiresAt: refresh.get(\"expires_at\") },\n    };\n  }\n\n  /**\n   * Verify a plaintext password against a stored hash.\n   */\n  public async verifyPassword(plainPassword: string, hashedPassword: string): Promise<boolean> {\n    return verifyPassword(plainPassword, hashedPassword);\n  }\n\n  /**\n   * Hash a plaintext password.\n   */\n  public async hashPassword(password: string): Promise<string> {\n    return hashPassword(password);\n  }\n\n  /**\n   * Resolve a user by credentials, verifying the password. Returns `null` on a\n   * missing user or a wrong password, emitting `login.failed` either way.\n   */\n  public async attemptLogin<T extends Auth>(\n    Model: ChildModel<T>,\n    data: AuthCredentials,\n  ): Promise<T | null> {\n    const { password, ...otherData } = data;\n\n    authEvents.emit(\"login.attempt\", otherData);\n\n    const user = (await Model.first(otherData)) as T | null;\n\n    if (!user) {\n      authEvents.emit(\"login.failed\", otherData, \"User not found\");\n\n      return null;\n    }\n\n    if (!(await this.verifyPassword(password, user.string(\"password\")!))) {\n      authEvents.emit(\"login.failed\", otherData, \"Invalid password\");\n\n      return null;\n    }\n\n    if (!(await this.canAuthenticate(user))) {\n      authEvents.emit(\"login.failed\", otherData, \"Authentication not allowed\");\n\n      return null;\n    }\n\n    return user;\n  }\n\n  /**\n   * Full login flow: validate credentials, issue tokens, emit events. Returns\n   * the user + token pair on success, `null` on failure.\n   */\n  public async login<T extends Auth>(\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    const user = await this.attemptLogin(Model, credentials);\n\n    if (!user) {\n      return null;\n    }\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Log in a user some OTHER method already authenticated — a provider\n   * callback, a passkey assertion, a one-time code. Applies the\n   * `auth.canAuthenticate` policy (403 on refusal), then produces exactly\n   * what {@link login} produces: the same tokens, rows and events. Pair with\n   * {@link setAuthCookie} for a cookie session, as with password login.\n   *\n   * Never call this for a user you have not authenticated.\n   */\n  public async completeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    await this.assertCanAuthenticate(user);\n\n    return this.finalizeLogin(user, deviceInfo);\n  }\n\n  /**\n   * Cookie login for a browser: same-origin check, credential login, then both\n   * session cookies. Unlike the default CSRF guard, the Origin/Referer check\n   * runs even when the request carries no cookies (login CSRF): a missing or\n   * cross-site Origin/Referer throws `CsrfOriginMismatchError` before any\n   * credential is looked at. Returns `null` on bad credentials.\n   */\n  public async loginWithSessionCookies<T extends Auth>(\n    request: Request,\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    Model: ChildModel<T>,\n    credentials: AuthCredentials,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T> | null> {\n    assertCsrfOriginAllowed(request);\n\n    const result = await this.login(Model, credentials, deviceInfo);\n\n    if (!result) return null;\n\n    if (result.tokens.refreshToken) {\n      this.setSessionCookies(\n        response,\n        {\n          accessToken: result.tokens.accessToken,\n          refreshToken: result.tokens.refreshToken,\n        },\n        request,\n      );\n    } else {\n      this.setAuthCookie(response, result.tokens.accessToken, {\n        domain: this.cookieDomainFor(\"loginWithSessionCookies\", request),\n      });\n    }\n\n    return result;\n  }\n\n  /** The one token-issuing tail every login method shares. */\n  private async finalizeLogin<T extends Auth>(\n    user: T,\n    deviceInfo?: DeviceInfo,\n  ): Promise<LoginResult<T>> {\n    if (!authConfig.refreshToken.enabled()) {\n      const accessToken = await this.issueAccessToken(user, deviceInfo?.payload);\n\n      return { user, tokens: { accessToken } };\n    }\n\n    const tokens = await this.issueTokenPair(user, deviceInfo);\n\n    authEvents.emit(\"login.success\", user, tokens, deviceInfo);\n\n    return { user, tokens };\n  }\n\n  /**\n   * Log a user out.\n   *\n   * @param accessToken - access token string to revoke (optional)\n   * @param refreshToken - refresh token string to revoke (optional)\n   *\n   * When no refresh token is supplied, `config.auth.refreshToken.logoutWithoutToken`\n   * decides the behavior: `\"revoke-all\"` (default, fail-safe) revokes every\n   * refresh token; `\"error\"` requires the caller to pass one.\n   */\n  public async logout(user: Auth, accessToken?: string, refreshToken?: string): Promise<void> {\n    if (accessToken) {\n      await this.removeAccessToken(user, accessToken);\n    }\n\n    if (refreshToken) {\n      const token = await this.refreshTokenModel.findForUser(user, refreshToken);\n\n      if (token) {\n        await this.revokeTokenFamily(token.familyId);\n        authEvents.emit(\"session.destroyed\", user, token);\n      }\n    } else {\n      const behavior = authConfig.refreshToken.logoutWithoutToken();\n\n      if (behavior === \"error\") {\n        throw new Error(\"Refresh token required for logout\");\n      }\n\n      await this.revokeAllTokens(user);\n      authEvents.emit(\"logout.failsafe\", user);\n    }\n\n    authEvents.emit(\"logout\", user);\n  }\n\n  /**\n   * Remove a specific access token belonging to the user.\n   */\n  public async removeAccessToken(user: Auth, token: string): Promise<void> {\n    await this.accessTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Remove every access token belonging to the user.\n   */\n  public async removeAllAccessTokens(user: Auth): Promise<void> {\n    await this.accessTokenModel.deleteAllForUser(user);\n  }\n\n  /**\n   * Remove a specific refresh token belonging to the user.\n   */\n  public async removeRefreshToken(user: Auth, token: string): Promise<void> {\n    await this.refreshTokenModel.deleteForUser(user, token);\n  }\n\n  /**\n   * Revoke every active refresh token for the user and delete their access\n   * tokens — \"log out of all devices\". Each durable family is first marked through its revision coordinator; an\n   * event fires per revoked token.\n   */\n  public async revokeAllTokens(user: Auth): Promise<void> {\n    // Upgrade existing installations lazily before the family scan. Include\n    // revoked rows: a rotation may have revoked its predecessor while its\n    // durable family still needs logout's marker.\n    const existingRows = await this.refreshTokenModel.familiesForUser(user);\n\n    for (const token of existingRows) {\n      await AuthTokenFamily.ensure(user, token.familyId);\n    }\n\n    const families = await AuthTokenFamily.activeFor(user);\n\n    for (const family of families) {\n      await this.revokeTokenFamily(family.get<string>(\"family_id\"));\n    }\n\n    // A deployment can still have rows created before the additive migration\n    // ran; retain the old bulk cleanup as a final conservative backstop.\n    const legacyTokens = await this.refreshTokenModel.revokeAllFor(user);\n\n    for (const token of legacyTokens) {\n      authEvents.emit(\"token.revoked\", user, token);\n    }\n    await this.removeAllAccessTokens(user);\n\n    authEvents.emit(\"logout.all\", user);\n  }\n\n  /**\n   * Revoke an entire token family — rotation breach containment.\n   */\n  public async revokeTokenFamily(familyId: string): Promise<void> {\n    let family = await AuthTokenFamily.findByFamilyId(familyId);\n\n    if (!family) {\n      const legacyToken = await this.refreshTokenModel.findInFamily(familyId);\n\n      if (!legacyToken) return;\n\n      family = await AuthTokenFamily.ensure(\n        {\n          id: legacyToken.get(\"user_id\"),\n          userType: legacyToken.get<string>(\"user_type\"),\n        } as Auth,\n        familyId,\n      );\n    }\n\n    const user = {\n      id: family.get(\"user_id\"),\n      userType: family.get<string>(\"user_type\"),\n    } as Auth;\n\n    if (family.isRevoked) {\n      // Logout and replay containment are idempotent. Re-run cleanup because a\n      // request that lost the original race may have observed stale rows.\n      const revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n      afterTokenFamilyOperation(() =>\n        authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n      );\n\n      return;\n    }\n\n    let revokedTokens: RefreshToken[];\n    try {\n      revokedTokens = await runTokenFamilyOperation(familyId, async (currentFamily) => {\n        const familyUser = {\n          id: currentFamily.get(\"user_id\"),\n          userType: currentFamily.get<string>(\"user_type\"),\n        } as Auth;\n        const revision = currentFamily.get<number>(\"revision\");\n        const revoked = await AuthTokenFamily.revoke(familyId, revision);\n\n        if (revoked !== 1) {\n          throw new Error(\"Token family revoke lost its revision transition\");\n        }\n\n        const familyTokens = await this.refreshTokenModel.revokeFamily(familyId);\n        await this.accessTokenModel.deleteFamilyAndLegacyForUser(familyUser, familyId);\n\n        return familyTokens;\n      });\n    } catch (error) {\n      if (!(error instanceof TokenFamilyUnavailableError)) throw error;\n\n      // Another request committed the revoke between the read above and its\n      // CAS. A second logout is successful after idempotent cleanup.\n      revokedTokens = await this.refreshTokenModel.revokeFamily(familyId);\n      await this.accessTokenModel.deleteFamilyAndLegacyForUser(user, familyId);\n    }\n\n    afterTokenFamilyOperation(() =>\n      authEvents.emit(\"token.familyRevoked\", familyId, revokedTokens),\n    );\n  }\n\n  /**\n   * Delete expired tokens (refresh + access) and spent one-time tokens\n   * (expired or consumed verification/reset/OTP/passkey rows). Emits `token.expired` per refresh\n   * token and `cleanup.completed` with the refresh count. Drives the\n   * `auth.cleanup` CLI command.\n   */\n  public async cleanupExpiredTokens(): Promise<number> {\n    const expiredTokens = await this.refreshTokenModel.purgeExpired();\n\n    for (const token of expiredTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    await this.accessTokenModel.purgeExpired();\n    await this.oneTimeTokenModel.purgeSpent();\n\n    authEvents.emit(\"cleanup.completed\", expiredTokens.length);\n\n    return expiredTokens.length;\n  }\n\n  /**\n   * Find every persisted token — access and refresh — that can never retire\n   * itself: an unusable `expires_at`, or a token carrying no `exp` claim.\n   *\n   * This is the remediation read for the pre-4.12.0 `expiresIn` defect (#25).\n   * Nothing else surfaces these rows: `auth.cleanup` selects `expires_at < now`,\n   * which an `Invalid Date` never satisfies, and a row whose date column is\n   * perfectly fine can still hold a token with no deadline in it. Read-only —\n   * pair with {@link purgeNeverExpiringTokens} to act on the answer.\n   */\n  public async findNeverExpiringTokens(): Promise<{\n    accessTokens: AccessToken[];\n    refreshTokens: RefreshToken[];\n  }> {\n    return {\n      accessTokens: await this.accessTokenModel.findNeverExpiring(),\n      refreshTokens: await this.refreshTokenModel.findNeverExpiring(),\n    };\n  }\n\n  /**\n   * Revoke every never-expiring token by deleting its row, emitting\n   * `token.revoked` per refresh token. Drives `warlock auth.purge-never-expiring`.\n   *\n   * Access tokens first: deleting one is immediate revocation, while a refresh\n   * token left in place for a moment can only mint an access token through a\n   * verifier that now rejects it for the missing `exp`.\n   */\n  public async purgeNeverExpiringTokens(): Promise<{\n    accessTokens: number;\n    refreshTokens: number;\n  }> {\n    const accessTokens = await this.accessTokenModel.purgeNeverExpiring();\n    const refreshTokens = await this.refreshTokenModel.purgeNeverExpiring();\n\n    // `token.expired` (the event `auth.cleanup` already emits for a removed\n    // refresh token) rather than `token.revoked`, which carries a loaded `Auth`\n    // this batch path has no reason to fetch a user row for.\n    for (const token of refreshTokens) {\n      authEvents.emit(\"token.expired\", token);\n    }\n\n    return { accessTokens: accessTokens.length, refreshTokens: refreshTokens.length };\n  }\n\n  /**\n   * Active, unexpired sessions for the user, newest first.\n   */\n  public async getActiveSessions(user: Auth): Promise<RefreshToken[]> {\n    return this.refreshTokenModel.activeFor(user);\n  }\n\n  /**\n   * `Max-Age` (seconds) `setAuthCookie` should apply, derived from an\n   * `AccessTokenOutput`'s `expiresAt` — or `undefined` for a bare token\n   * string (a session cookie) or an unparseable `expiresAt`.\n   */\n  private cookieMaxAgeFromToken(token: string | AccessTokenOutput): number | undefined {\n    if (typeof token === \"string\") return undefined;\n\n    const expiresAt = new Date(token.expiresAt).getTime();\n\n    if (Number.isNaN(expiresAt)) return undefined;\n\n    return Math.max(0, Math.round((expiresAt - Date.now()) / 1000));\n  }\n\n  private cookieDomainFor(method: string, request?: Request): string | undefined {\n    const resolver = authConfig.cookie.cookieDomain();\n\n    if (!resolver) {\n      return undefined;\n    }\n\n    if (!request) {\n      throw new CookieDomainRequestRequiredError(method);\n    }\n\n    return resolver(request);\n  }\n\n  /**\n   * Write the auth cookie on `response` — the write side of the `cookie:<name>`\n   * token source `authMiddleware([], \"cookie:<name>\")` already reads. An explicit\n   * app-controller call, never a side effect of {@link login}, so an existing\n   * bearer-only app never starts emitting `Set-Cookie` just by upgrading.\n   *\n   * Attribute flags (`HttpOnly`, `SameSite=Lax`, `Secure` outside dev) come\n   * from `response.cookie()`'s own `secureCookieDefaults()` floor — this\n   * method never overrides them, only `name`/`path`/`maxAge`. `raw: true`\n   * writes the token unquoted, so the same string a `cookie:<name>` source\n   * reads back is exactly what was issued, not a JSON-wrapped copy.\n   *\n   * @param token - the token string, or an `AccessTokenOutput` (e.g. from\n   *   {@link login}) whose `expiresAt` sets `Max-Age` automatically when\n   *   `options.maxAge` is not given. A bare string with no `options.maxAge`\n   *   produces a session cookie.\n   *\n   * @example\n   * const { user, tokens } = await authService.login(User, credentials);\n   * authService.setAuthCookie(response, tokens.accessToken);\n   */\n  public setAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    token: string | AccessTokenOutput,\n    options: SetAuthCookieOptions = {},\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const tokenValue = typeof token === \"string\" ? token : token.token;\n    const maxAge = options.maxAge ?? this.cookieMaxAgeFromToken(token);\n\n    response.cookie(name, tokenValue, {\n      raw: true,\n      path,\n      ...(options.domain !== undefined ? { domain: options.domain } : {}),\n      ...(maxAge !== undefined ? { maxAge } : {}),\n    });\n  }\n\n  /**\n   * Clear the auth cookie {@link setAuthCookie} wrote. An explicit\n   * app-controller call — pair it with {@link logout} after the token row is\n   * revoked. `path` must match what the cookie was set with, or the browser\n   * silently ignores the clear (see `response.clearCookie`'s own doc comment).\n   *\n   * @example\n   * await authService.logout(user, accessToken, refreshToken);\n   * authService.clearAuthCookie(response);\n   */\n  public clearAuthCookie(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    options: ClearAuthCookieOptions = {},\n    request?: Request,\n  ): void {\n    const name = options.name ?? authConfig.cookie.name();\n    const path = options.path ?? authConfig.cookie.path();\n    const domain = this.cookieDomainFor(\"clearAuthCookie\", request);\n\n    if (domain !== undefined) {\n      response.clearCookie(name, { path, domain });\n    }\n\n    response.clearCookie(name, { path });\n  }\n\n  /**\n   * Write the access and refresh cookies of a browser session. Both are\n   * `HttpOnly`, `SameSite=Lax`, `Path=/` (the refresh cookie must reach every\n   * page) and `Secure` outside development, named by `auth.cookie.name` and\n   * `auth.cookie.refreshName`. Each `Max-Age` is derived from its token's\n   * `expiresAt`, so the cookie lives exactly as long as the token.\n   *\n   * @example\n   * const { tokens } = await authService.login(User, credentials);\n   * authService.setSessionCookies(response, tokens);\n   */\n  public setSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    tokens: { accessToken: AccessTokenOutput; refreshToken: AccessTokenOutput },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"setSessionCookies\", request);\n    const cookies = [\n      [authConfig.cookie.name(), tokens.accessToken],\n      [authConfig.cookie.refreshName(), tokens.refreshToken],\n    ] as const;\n\n    for (const [name, token] of cookies) {\n      const maxAge = this.cookieMaxAgeFromToken(token);\n\n      response.cookie(name, token.token, {\n        raw: true,\n        httpOnly: true,\n        sameSite: \"lax\",\n        path: \"/\",\n        ...(domain !== undefined ? { domain } : {}),\n        ...(maxAge !== undefined ? { maxAge } : {}),\n      });\n    }\n  }\n\n  /**\n   * Clear both session cookies {@link setSessionCookies} wrote, on `Path=/`.\n   * Pair it with {@link logout} after the token rows are revoked.\n   */\n  public clearSessionCookies(\n    response: { [K in \"cookie\" | \"clearCookie\"]: (...args: Parameters<Response[K]>) => unknown },\n    request?: Request,\n  ): void {\n    const domain = this.cookieDomainFor(\"clearSessionCookies\", request);\n\n    for (const name of [authConfig.cookie.name(), authConfig.cookie.refreshName()]) {\n      if (domain !== undefined) {\n        response.clearCookie(name, { path: \"/\", domain });\n      }\n\n      response.clearCookie(name, { path: \"/\" });\n    }\n  }\n}\n\nexport const authService = new AuthService();\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAoCA,IAAa,mCAAb,cAAsD,MAAM;CAC1D,AAAO,YAAY,QAAgB;EACjC,MACE,GAAG,OAAO,+HACZ;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAM,cAAN,MAAkB;;;;;;;CAOhB,IAAY,mBAAuC;EACjD,OAAO,OAAO,IAAI,0BAA0B,WAAW;CACzD;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,IAAY,oBAAyC;EACnD,OAAO,OAAO,IAAI,2BAA2B,YAAY;CAC3D;;;;CAKA,AAAO,wBAAwB,MAAqC;EAClE,OAAO;GACL,IAAI,KAAK;GACT,UAAU,KAAK;GACf,YAAY,KAAK,IAAI;EACvB;CACF;;CAGA,MAAa,gBAAgB,MAA8B;EACzD,OAAO,WAAW,gBAAgB,IAAI;CACxC;CAEA,MAAc,sBAAsB,MAA2B;EAC7D,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GACnC,MAAM,IAAI,eAAe,gCAAgC;CAE7D;CAEA,MAAc,iBACZ,MACA,SACA,UAC4B;EAC5B,MAAM,OAAO;GAAE,GAAI,WAAW,KAAK,wBAAwB,IAAI;GAAI,KAAK,WAAW;EAAE;EAErF,MAAM,YAAY,WAAW,YAAY,YAAY;EAErD,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM,EAAE,UAAU,CAAC;EACpD,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS;EAEjD,IAAI,UACF,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,WAAW,QAAQ;OAElE,MAAM,KAAK,iBAAiB,MAAM,MAAM,OAAO,SAAS;EAG1D,OAAO;GAAE;GAAO,WAAW,UAAU,YAAY;EAAE;CACrD;;;;;;CAOA,MAAa,oBACX,MACA,SAC4B;EAC5B,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,iBAAiB,MAAM,OAAO;CAC5C;CAEA,MAAc,kBACZ,MACA,YACA,eACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAKxC,MAAM,YAAY,WAAW,aAAa,YAAY;EAEtD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAIzD,KAFe,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,EAElE,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,MAAM,UAAU;GACd,QAAQ,KAAK;GACb,UAAU,KAAK;GACf;GACA,KAAK,WAAW;EAClB;EAEA,MAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,SAAS,CAAC,CAAC,YAAY;EAE/D,MAAM,KAAK,kBAAkB,WAAW,MAAM,WAAW,aAAa,WAAW,CAAC;EAElF,MAAM,QAAQ,MAAM,IAAI,qBAAqB,SAAS,EAAE,UAAU,CAAC;EAEnE,OAAO,KAAK,kBAAkB,MAAM,MAAM,OAAO;GAAE;GAAU;GAAW;EAAW,CAAC;CACtF;;;;;;;CAQA,MAAc,sBACZ,MACA,UACA,OACY;EAMZ,KAAI,MAFiB,gBAAgB,OAAO,MAAM,QAAQ,EAEhD,CAAC,WACT,MAAM,IAAI,MAAM,gDAAgD;EAGlE,IAAI;GACF,OAAO,MAAM,wBAAwB,UAAU,KAAK;EACtD,SAAS,OAAO;GAId,IAAI,iBAAiB,6BACnB,MAAM,IAAI,MAAM,gDAAgD;GAGlE,MAAM;EACR;CACF;;;;;CAMA,MAAa,mBACX,MACA,YACmC;EACnC,IAAI,CAAC,WAAW,aAAa,QAAQ,GAAG;EAExC,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,YAAY,UACd,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,kBAAkB,MAAM,YAAY,MAAM,CACjD;EAGF,OAAO,KAAK,kBAAkB,MAAM,UAAU;CAChD;CAEA,MAAc,eACZ,MACA,YACA,eACoB;EACpB,MAAM,iBAAiB,WAAW,aAAa,QAAQ;EACvD,MAAM,WAAW,YAAY,YAAY,OAAO,OAAO,EAAE;EAEzD,MAAM,SAAS,iBACV,iBAAkB,MAAM,gBAAgB,OAAO,MAAM,QAAQ,IAC9D;EAEJ,IAAI,QACF;OAAI,OAAO,WACT,MAAM,IAAI,MAAM,gDAAgD;EAClE;EAGF,MAAM,cAAc,MAAM,KAAK,iBAC7B,MACA,YAAY,SACZ,iBAAiB,WAAW,MAC9B;EACA,MAAM,eAAe,MAAM,KAAK,kBAC9B,MACA,iBAAiB;GAAE,GAAG;GAAY;EAAS,IAAI,YAC/C,MACF;EAEA,MAAM,YAAuB;GAC3B;GACA,cAAc,eACV;IACE,OAAO,aAAa,IAAI,OAAO;IAC/B,WAAW,aAAa,IAAI,YAAY;GAC1C,IACA;EACN;EAEA,gCAAgC,WAAW,KAAK,iBAAiB,MAAM,SAAS,CAAC;EAEjF,IAAI,cACF,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,UAAU,CACnE;EAGF,OAAO;CACT;;;;CAKA,MAAa,gBAAgB,MAAY,YAA6C;EACpF,MAAM,KAAK,sBAAsB,IAAI;EAErC,IAAI,WAAW,aAAa,QAAQ,KAAK,YAAY,UACnD,OAAO,KAAK,sBAAsB,MAAM,WAAW,WAAW,WAC5D,KAAK,eAAe,MAAM,YAAY,MAAM,CAC9C;EAGF,OAAO,KAAK,eAAe,MAAM,UAAU;CAC7C;;;;;;CAOA,MAAa,cACX,oBACA,YAC2B;EAC3B,IAAI;EAMJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAE5C,MAAM;EACR;EAEA,IAAI,CAAC,SAAS,OAAO;EAErB,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAElF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAElE,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAChF,IAAI,CAAC,gBAAgB,CAAC,KAAK,uBAAuB,cAAc,OAAO,GAAG,OAAO;GACjF,IAAI,CAAC,aAAa,SAAS;IAEzB,IAAI,cACF,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IAGpD,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAEhE,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAGlE,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GAEjD,IAAI,CAAC,MAAM,OAAO;GAElB,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAIhD,IAFwB,WAAW,aAAa,SAE9B,GAGhB;QAAI,CAAC,MAFa,aAAa,eAAe,GAEpC;KAER,MAAM,KAAK,kBAAkB,aAAa,QAAQ;KAElD,OAAO;IACT;UAEA,MAAM,aAAa,WAAW;GAGhC,MAAM,eAAe,MAAM,KAAK,eAAe,MAAM;IACnD,GAAG;IACH,UAAU,aAAa;GACzB,CAAC;GAED,gCACE,WAAW,KAAK,mBAAmB,MAAM,cAAc,YAAY,CACrE;GAEA,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAa,sBACX,oBACA,kBACA,UAA8E,CAAC,GACpD;EAC3B,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,IAAI,mBAIjB,kBAAkB;EACvB,SAAS,OAAO;GACd,IAAI,yBAAyB,KAAK,GAAG,OAAO;GAC5C,MAAM;EACR;EAEA,IAAI,CAAC,WAAW,QAAQ,aAAa,kBAAkB,OAAO;EAC9D,MAAM,iBAAiB,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;EAClF,IAAI,CAAC,kBAAkB,CAAC,KAAK,uBAAuB,gBAAgB,OAAO,GAAG,OAAO;EAErF,MAAM,gBAAgB,OACpB;GAAE,IAAI,QAAQ;GAAQ,UAAU,QAAQ;EAAS,GACjD,eAAe,QACjB;EACA,OAAO,wBAAwB,eAAe,UAAU,YAAY;GAGlE,MAAM,WAAW,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;GAC5E,IAAI,CAAC,YAAY,CAAC,KAAK,uBAAuB,UAAU,OAAO,GAAG,OAAO;GACzE,IAAI,CAAC,SAAS,SAAS;IACrB,MAAM,YAAY,MAAM,KAAK,uBAAuB,UAAU,SAAS,QAAQ,SAAS;IACxF,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,UAAU,QAAQ,SAAS,KACvD,KAAK,aAAa,QAAQ,GAE1B,OAAO;IAET,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAGA,IACE,QAAQ,aAAa,UACpB,MAAM,KAAK,oBAAoB,SAAS,UAAU,QAAQ,QAAQ,GACnE;IACA,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,YAAY,OAAO,IAAI,iBAAiB,QAAQ,UAAU;GAChE,IAAI,CAAC,WAAW,MAAM,IAAI,MAAM,aAAa,QAAQ,SAAS,kBAAkB;GAChF,MAAM,OAAQ,MAAM,UAAU,KAAK,QAAQ,MAAM;GACjD,IAAI,CAAC,QAAQ,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI,OAAO;GAEzD,IAAI,CAAE,MAAM,SAAS,eAAe,GAAI;IAGtC,MAAM,eAAe,MAAM,KAAK,kBAAkB,YAAY,kBAAkB;IAChF,IAAI,CAAC,cAAc,OAAO;IAC1B,MAAM,YAAY,MAAM,KAAK,uBAC3B,cACA,SACA,QAAQ,SACV;IACA,IAAI,WAAW,OAAO;IACtB,IACE,KAAK,uBAAuB,cAAc,QAAQ,SAAS,KAC3D,KAAK,aAAa,YAAY,GAE9B,OAAO;IACT,MAAM,KAAK,kBAAkB,SAAS,QAAQ;IAC9C,OAAO;GACT;GAEA,MAAM,OAAO,MAAM,KAAK,eAAe,MAAM;IAC3C,GAAG,QAAQ;IACX,UAAU,SAAS;GACrB,CAAC;GACD,MAAM,kBAAkB,MAAM,KAAK,iBAAiB,YAAY,KAAK,YAAY,KAAK;GACtF,MAAM,mBAAmB,KAAK,eAC1B,MAAM,KAAK,kBAAkB,YAAY,KAAK,aAAa,KAAK,IAChE;GACJ,IAAI,CAAC,mBAAmB,CAAC,kBACvB,MAAM,IAAI,MAAM,6DAA6D;GAe/E,IAAI,MATiB,KAAK,kBAAkB,OAC1C,EAAE,IAAI,SAAS,GAAG,GAClB,EACE,MAAM;IACJ,2BAA2B,gBAAgB;IAC3C,4BAA4B,iBAAiB;GAC/C,EACF,CACF,MACe,GAAG,MAAM,IAAI,MAAM,qDAAqD;GACvF,gCAAgC,WAAW,KAAK,mBAAmB,MAAM,MAAM,QAAQ,CAAC;GACxF,OAAO;EACT,CAAC,CAAC,CAAC,OAAO,UAAU;GAClB,IAAI,iBAAiB,6BAA6B,OAAO;GACzD,MAAM;EACR,CAAC;CACH;;;;;;CAOA,MAAc,oBAAoB,UAAkB,UAAoC;EAEtF,IAAI,WAAmB,MADF,gBAAgB,eAAe,QAAQ,EAC/B,EAAE,IAAI,YAAY;EAE/C,IAAI,CAAC,SAOH,WAAU,MANW,KAAK,kBACvB,MAAM,CAAC,CACP,MAAM,EAAE,WAAW,SAAS,CAAC,CAAC,CAC9B,QAAQ,cAAc,KAAK,CAAC,CAC5B,MAAM,EAEO,EAAE,IAAI,YAAY;EAGpC,MAAM,YAAY,UAAU,IAAI,KAAK,OAAiC,CAAC,CAAC,QAAQ,IAAI;EAGpF,IAAI,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;EAExC,OAAO,KAAK,IAAI,IAAI,YAAY;CAClC;CAEA,AAAQ,mBAAmB,WAAuC;EAChE,OAAO,OAAO,cAAc,YAAY,OAAO,SAAS,SAAS,IAC7D,KAAK,IAAI,GAAG,KAAK,IAAI,KAAQ,SAAS,CAAC,IACvC;CACN;CAEA,AAAQ,uBACN,OACA,SACS;EACT,OACE,MAAM,aAAa,QAAQ,YAC3B,MAAM,IAAI,SAAS,MAAM,QAAQ,UACjC,MAAM,IAAI,WAAW,MAAM,QAAQ;CAEvC;CAEA,AAAQ,aAAa,UAAiC;EACpD,OAAO,QACL,SAAS,IAAI,2BAA2B,KAAK,SAAS,IAAI,4BAA4B,CACxF;CACF;CAEA,AAAQ,uBAAuB,UAAwB,WAAwC;EAC7F,MAAM,YAAY,SAAS,IAAsB,YAAY;EAC7D,MAAM,SAAS,KAAK,mBAAmB,SAAS;EAChD,MAAM,UAAU,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI;EACzE,OAAO,SAAS,KAAK,WAAW,KAAK,WAAW;CAClD;CAEA,MAAc,uBACZ,UACA,SACA,WAC2B;EAC3B,IAAI,CAAC,KAAK,uBAAuB,UAAU,SAAS,GAAG,OAAO;EAC9D,MAAM,WAAW,SAAS,IAAwB,2BAA2B;EAC7E,MAAM,YAAY,SAAS,IAAwB,4BAA4B;EAC/E,IAAI,CAAC,YAAY,CAAC,WAAW,OAAO;EACpC,MAAM,CAAC,QAAQ,WAAW,MAAM,QAAQ,IAAI,CAC1C,KAAK,iBAAiB,KAAK,QAAQ,GACnC,KAAK,kBAAkB,KAAK,SAAS,CACvC,CAAC;EACD,IAAI,CAAC,UAAU,OAAO,aAAa,CAAC,SAAS,SAAS,OAAO;EAC7D,IACE,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,YACrC,OAAO,IAAI,SAAS,MAAM,QAAQ,UAClC,QAAQ,IAAI,SAAS,MAAM,QAAQ,UACnC,OAAO,IAAI,WAAW,MAAM,QAAQ,YACpC,QAAQ,IAAI,WAAW,MAAM,QAAQ,UAErC,OAAO;EACT,MAAM,eAAe,IAAI,KAAK,OAAO,IAAI,YAAY,CAAC,CAAC,CAAC,QAAQ;EAChE,IAAI,CAAC,OAAO,SAAS,YAAY,KAAK,gBAAgB,KAAK,IAAI,GAAG,OAAO;EACzE,OAAO;GACL,aAAa;IAAE,OAAO,OAAO,IAAI,OAAO;IAAG,WAAW,OAAO,IAAI,YAAY;GAAE;GAC/E,cAAc;IAAE,OAAO,QAAQ,IAAI,OAAO;IAAG,WAAW,QAAQ,IAAI,YAAY;GAAE;EACpF;CACF;;;;CAKA,MAAa,eAAe,eAAuB,gBAA0C;EAC3F,OAAO,eAAe,eAAe,cAAc;CACrD;;;;CAKA,MAAa,aAAa,UAAmC;EAC3D,OAAO,aAAa,QAAQ;CAC9B;;;;;CAMA,MAAa,aACX,OACA,MACmB;EACnB,MAAM,EAAE,UAAU,GAAG,cAAc;EAEnC,WAAW,KAAK,iBAAiB,SAAS;EAE1C,MAAM,OAAQ,MAAM,MAAM,MAAM,SAAS;EAEzC,IAAI,CAAC,MAAM;GACT,WAAW,KAAK,gBAAgB,WAAW,gBAAgB;GAE3D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,eAAe,UAAU,KAAK,OAAO,UAAU,CAAE,GAAI;GACpE,WAAW,KAAK,gBAAgB,WAAW,kBAAkB;GAE7D,OAAO;EACT;EAEA,IAAI,CAAE,MAAM,KAAK,gBAAgB,IAAI,GAAI;GACvC,WAAW,KAAK,gBAAgB,WAAW,4BAA4B;GAEvE,OAAO;EACT;EAEA,OAAO;CACT;;;;;CAMA,MAAa,MACX,OACA,aACA,YACgC;EAChC,MAAM,OAAO,MAAM,KAAK,aAAa,OAAO,WAAW;EAEvD,IAAI,CAAC,MACH,OAAO;EAGT,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;;;CAWA,MAAa,cACX,MACA,YACyB;EACzB,MAAM,KAAK,sBAAsB,IAAI;EAErC,OAAO,KAAK,cAAc,MAAM,UAAU;CAC5C;;;;;;;;CASA,MAAa,wBACX,SACA,UACA,OACA,aACA,YACgC;EAChC,wBAAwB,OAAO;EAE/B,MAAM,SAAS,MAAM,KAAK,MAAM,OAAO,aAAa,UAAU;EAE9D,IAAI,CAAC,QAAQ,OAAO;EAEpB,IAAI,OAAO,OAAO,cAChB,KAAK,kBACH,UACA;GACE,aAAa,OAAO,OAAO;GAC3B,cAAc,OAAO,OAAO;EAC9B,GACA,OACF;OAEA,KAAK,cAAc,UAAU,OAAO,OAAO,aAAa,EACtD,QAAQ,KAAK,gBAAgB,2BAA2B,OAAO,EACjE,CAAC;EAGH,OAAO;CACT;;CAGA,MAAc,cACZ,MACA,YACyB;EACzB,IAAI,CAAC,WAAW,aAAa,QAAQ,GAGnC,OAAO;GAAE;GAAM,QAAQ,EAAE,mBAFC,KAAK,iBAAiB,MAAM,YAAY,OAAO,EAEpC;EAAE;EAGzC,MAAM,SAAS,MAAM,KAAK,eAAe,MAAM,UAAU;EAEzD,WAAW,KAAK,iBAAiB,MAAM,QAAQ,UAAU;EAEzD,OAAO;GAAE;GAAM;EAAO;CACxB;;;;;;;;;;;CAYA,MAAa,OAAO,MAAY,aAAsB,cAAsC;EAC1F,IAAI,aACF,MAAM,KAAK,kBAAkB,MAAM,WAAW;EAGhD,IAAI,cAAc;GAChB,MAAM,QAAQ,MAAM,KAAK,kBAAkB,YAAY,MAAM,YAAY;GAEzE,IAAI,OAAO;IACT,MAAM,KAAK,kBAAkB,MAAM,QAAQ;IAC3C,WAAW,KAAK,qBAAqB,MAAM,KAAK;GAClD;EACF,OAAO;GAGL,IAFiB,WAAW,aAAa,mBAE9B,MAAM,SACf,MAAM,IAAI,MAAM,mCAAmC;GAGrD,MAAM,KAAK,gBAAgB,IAAI;GAC/B,WAAW,KAAK,mBAAmB,IAAI;EACzC;EAEA,WAAW,KAAK,UAAU,IAAI;CAChC;;;;CAKA,MAAa,kBAAkB,MAAY,OAA8B;EACvE,MAAM,KAAK,iBAAiB,cAAc,MAAM,KAAK;CACvD;;;;CAKA,MAAa,sBAAsB,MAA2B;EAC5D,MAAM,KAAK,iBAAiB,iBAAiB,IAAI;CACnD;;;;CAKA,MAAa,mBAAmB,MAAY,OAA8B;EACxE,MAAM,KAAK,kBAAkB,cAAc,MAAM,KAAK;CACxD;;;;;;CAOA,MAAa,gBAAgB,MAA2B;EAItD,MAAM,eAAe,MAAM,KAAK,kBAAkB,gBAAgB,IAAI;EAEtE,KAAK,MAAM,SAAS,cAClB,MAAM,gBAAgB,OAAO,MAAM,MAAM,QAAQ;EAGnD,MAAM,WAAW,MAAM,gBAAgB,UAAU,IAAI;EAErD,KAAK,MAAM,UAAU,UACnB,MAAM,KAAK,kBAAkB,OAAO,IAAY,WAAW,CAAC;EAK9D,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,IAAI;EAEnE,KAAK,MAAM,SAAS,cAClB,WAAW,KAAK,iBAAiB,MAAM,KAAK;EAE9C,MAAM,KAAK,sBAAsB,IAAI;EAErC,WAAW,KAAK,cAAc,IAAI;CACpC;;;;CAKA,MAAa,kBAAkB,UAAiC;EAC9D,IAAI,SAAS,MAAM,gBAAgB,eAAe,QAAQ;EAE1D,IAAI,CAAC,QAAQ;GACX,MAAM,cAAc,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAEtE,IAAI,CAAC,aAAa;GAElB,SAAS,MAAM,gBAAgB,OAC7B;IACE,IAAI,YAAY,IAAI,SAAS;IAC7B,UAAU,YAAY,IAAY,WAAW;GAC/C,GACA,QACF;EACF;EAEA,MAAM,OAAO;GACX,IAAI,OAAO,IAAI,SAAS;GACxB,UAAU,OAAO,IAAY,WAAW;EAC1C;EAEA,IAAI,OAAO,WAAW;GAGpB,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GACxE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;GACvE,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;GAEA;EACF;EAEA,IAAI;EACJ,IAAI;GACF,gBAAgB,MAAM,wBAAwB,UAAU,OAAO,kBAAkB;IAC/E,MAAM,aAAa;KACjB,IAAI,cAAc,IAAI,SAAS;KAC/B,UAAU,cAAc,IAAY,WAAW;IACjD;IACA,MAAM,WAAW,cAAc,IAAY,UAAU;IAGrD,IAAI,MAFkB,gBAAgB,OAAO,UAAU,QAAQ,MAE/C,GACd,MAAM,IAAI,MAAM,kDAAkD;IAGpE,MAAM,eAAe,MAAM,KAAK,kBAAkB,aAAa,QAAQ;IACvE,MAAM,KAAK,iBAAiB,6BAA6B,YAAY,QAAQ;IAE7E,OAAO;GACT,CAAC;EACH,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,8BAA8B,MAAM;GAI3D,gBAAgB,MAAM,KAAK,kBAAkB,aAAa,QAAQ;GAClE,MAAM,KAAK,iBAAiB,6BAA6B,MAAM,QAAQ;EACzE;EAEA,gCACE,WAAW,KAAK,uBAAuB,UAAU,aAAa,CAChE;CACF;;;;;;;CAQA,MAAa,uBAAwC;EACnD,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,aAAa;EAEhE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,MAAM,KAAK,iBAAiB,aAAa;EACzC,MAAM,KAAK,kBAAkB,WAAW;EAExC,WAAW,KAAK,qBAAqB,cAAc,MAAM;EAEzD,OAAO,cAAc;CACvB;;;;;;;;;;;CAYA,MAAa,0BAGV;EACD,OAAO;GACL,cAAc,MAAM,KAAK,iBAAiB,kBAAkB;GAC5D,eAAe,MAAM,KAAK,kBAAkB,kBAAkB;EAChE;CACF;;;;;;;;;CAUA,MAAa,2BAGV;EACD,MAAM,eAAe,MAAM,KAAK,iBAAiB,mBAAmB;EACpE,MAAM,gBAAgB,MAAM,KAAK,kBAAkB,mBAAmB;EAKtE,KAAK,MAAM,SAAS,eAClB,WAAW,KAAK,iBAAiB,KAAK;EAGxC,OAAO;GAAE,cAAc,aAAa;GAAQ,eAAe,cAAc;EAAO;CAClF;;;;CAKA,MAAa,kBAAkB,MAAqC;EAClE,OAAO,KAAK,kBAAkB,UAAU,IAAI;CAC9C;;;;;;CAOA,AAAQ,sBAAsB,OAAuD;EACnF,IAAI,OAAO,UAAU,UAAU,OAAO;EAEtC,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;EAEpD,IAAI,OAAO,MAAM,SAAS,GAAG,OAAO;EAEpC,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,YAAY,KAAK,IAAI,KAAK,GAAI,CAAC;CAChE;CAEA,AAAQ,gBAAgB,QAAgB,SAAuC;EAC7E,MAAM,WAAW,WAAW,OAAO,aAAa;EAEhD,IAAI,CAAC,UACH;EAGF,IAAI,CAAC,SACH,MAAM,IAAI,iCAAiC,MAAM;EAGnD,OAAO,SAAS,OAAO;CACzB;;;;;;;;;;;;;;;;;;;;;;CAuBA,AAAO,cACL,UACA,OACA,UAAgC,CAAC,GAC3B;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,aAAa,OAAO,UAAU,WAAW,QAAQ,MAAM;EAC7D,MAAM,SAAS,QAAQ,UAAU,KAAK,sBAAsB,KAAK;EAEjE,SAAS,OAAO,MAAM,YAAY;GAChC,KAAK;GACL;GACA,GAAI,QAAQ,WAAW,SAAY,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;GACjE,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;EAC3C,CAAC;CACH;;;;;;;;;;;CAYA,AAAO,gBACL,UACA,UAAkC,CAAC,GACnC,SACM;EACN,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,OAAO,QAAQ,QAAQ,WAAW,OAAO,KAAK;EACpD,MAAM,SAAS,KAAK,gBAAgB,mBAAmB,OAAO;EAE9D,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;GAAE;GAAM;EAAO,CAAC;EAG7C,SAAS,YAAY,MAAM,EAAE,KAAK,CAAC;CACrC;;;;;;;;;;;;CAaA,AAAO,kBACL,UACA,QACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,qBAAqB,OAAO;EAChE,MAAM,UAAU,CACd,CAAC,WAAW,OAAO,KAAK,GAAG,OAAO,WAAW,GAC7C,CAAC,WAAW,OAAO,YAAY,GAAG,OAAO,YAAY,CACvD;EAEA,KAAK,MAAM,CAAC,MAAM,UAAU,SAAS;GACnC,MAAM,SAAS,KAAK,sBAAsB,KAAK;GAE/C,SAAS,OAAO,MAAM,MAAM,OAAO;IACjC,KAAK;IACL,UAAU;IACV,UAAU;IACV,MAAM;IACN,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;IACzC,GAAI,WAAW,SAAY,EAAE,OAAO,IAAI,CAAC;GAC3C,CAAC;EACH;CACF;;;;;CAMA,AAAO,oBACL,UACA,SACM;EACN,MAAM,SAAS,KAAK,gBAAgB,uBAAuB,OAAO;EAElE,KAAK,MAAM,QAAQ,CAAC,WAAW,OAAO,KAAK,GAAG,WAAW,OAAO,YAAY,CAAC,GAAG;GAC9E,IAAI,WAAW,QACb,SAAS,YAAY,MAAM;IAAE,MAAM;IAAK;GAAO,CAAC;GAGlD,SAAS,YAAY,MAAM,EAAE,MAAM,IAAI,CAAC;EAC1C;CACF;AACF;AAEA,MAAa,cAAc,IAAI,YAAY"}

package/esm/services/current-user.d.mts

@@ -1,6 +1,6 @@
 import { Auth } from "../models/auth.model.mjs";
 
-//#region ../auth/src/services/current-user.d.ts
+//#region ../../packages/auth/src/services/current-user.d.ts
 /**
  * Typed accessor over the request-scoped current user, for callers that want
  * `Auth`-derived typing without repeating core's `unknown` → `UserType`

package/esm/services/current-user.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"current-user.d.mts","names":[],"sources":["../../../../../../../auth/src/services/current-user.ts"],"mappings":";;;;;AAiBA;;;;;;;;;;;;iBAAgB,WAAA,kBAA6B,IAAA,GAAO,IAAA,KAAS,QAAA"}
+{"version":3,"file":"current-user.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/current-user.ts"],"mappings":";;;;;AAiBA;;;;;;;;;;;;iBAAgB,WAAA,kBAA6B,IAAA,GAAO,IAAA,KAAS,QAAA"}

package/esm/services/current-user.mjs

@@ -1,6 +1,6 @@
 import { useCurrentUser } from "@warlock.js/core";
 
-//#region ../auth/src/services/current-user.ts
+//#region ../../packages/auth/src/services/current-user.ts
 /**
 * Typed accessor over the request-scoped current user, for callers that want
 * `Auth`-derived typing without repeating core's `unknown` → `UserType`

package/esm/services/current-user.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"current-user.mjs","names":[],"sources":["../../../../../../../auth/src/services/current-user.ts"],"sourcesContent":["import { useCurrentUser } from \"@warlock.js/core\";\nimport type { Auth } from \"../models/auth.model\";\n\n/**\n * Typed accessor over the request-scoped current user, for callers that want\n * `Auth`-derived typing without repeating core's `unknown` → `UserType`\n * assertion at every call site.\n *\n * Core's own `useCurrentUser()` returns `unknown` cast to the caller's\n * generic (it cannot know about `RequestUser`/`Auth` — see\n * `core/src/http/context/request-context.ts`). This wrapper narrows that\n * generic to `Auth`, matching what `@warlock.js/auth`'s middleware actually\n * writes to `request.locals.user`.\n *\n * @example\n * const user = currentUser<AdminUser>();\n */\nexport function currentUser<UserType extends Auth = Auth>(): UserType | undefined {\n  return useCurrentUser<UserType>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,cAAkE;CAChF,OAAO,eAAyB;AAClC"}
+{"version":3,"file":"current-user.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/current-user.ts"],"sourcesContent":["import { useCurrentUser } from \"@warlock.js/core\";\nimport type { Auth } from \"../models/auth.model\";\n\n/**\n * Typed accessor over the request-scoped current user, for callers that want\n * `Auth`-derived typing without repeating core's `unknown` → `UserType`\n * assertion at every call site.\n *\n * Core's own `useCurrentUser()` returns `unknown` cast to the caller's\n * generic (it cannot know about `RequestUser`/`Auth` — see\n * `core/src/http/context/request-context.ts`). This wrapper narrows that\n * generic to `Auth`, matching what `@warlock.js/auth`'s middleware actually\n * writes to `request.locals.user`.\n *\n * @example\n * const user = currentUser<AdminUser>();\n */\nexport function currentUser<UserType extends Auth = Auth>(): UserType | undefined {\n  return useCurrentUser<UserType>();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,SAAgB,cAAkE;CAChF,OAAO,eAAyB;AAClC"}

package/esm/services/email-verification.d.mts

@@ -1,6 +1,6 @@
 import { Auth } from "../models/auth.model.mjs";
 
-//#region ../auth/src/services/email-verification.d.ts
+//#region ../../packages/auth/src/services/email-verification.d.ts
 /**
  * Whether the user has verified their email — the configured
  * `auth.verification.field` (default `emailVerifiedAt`) holds a value.

package/esm/services/email-verification.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.d.mts","names":[],"sources":["../../../../../../../auth/src/services/email-verification.ts"],"mappings":";;;;;AASA;;iBAAgB,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,IAAA;;;;;;AAAY;AAiBvD;;;;;;;iBAAsB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAO;AAAA;AAuBhE;;;;;;;;AAvBgE,iBAuB1C,WAAA,CAAY,KAAA,WAAgB,OAAO,CAAC,IAAA"}
+{"version":3,"file":"email-verification.d.mts","names":[],"sources":["../../../../../../../../packages/auth/src/services/email-verification.ts"],"mappings":";;;;;AASA;;iBAAgB,eAAA,CAAgB,IAAA,EAAM,IAAI,CAAC,IAAA;;;;;;AAAY;AAiBvD;;;;;;;iBAAsB,qBAAA,CAAsB,IAAA,EAAM,IAAA,GAAO,OAAO;AAAA;AAuBhE;;;;;;;;AAvBgE,iBAuB1C,WAAA,CAAY,KAAA,WAAgB,OAAO,CAAC,IAAA"}

package/esm/services/email-verification.mjs

@@ -2,7 +2,7 @@ import { authConfig } from "./auth-config.mjs";
 import { consumeOneTimeToken, issueOneTimeToken } from "./one-time-tokens.mjs";
 import { resolveTokenNotification } from "./token-notifications.mjs";
 
-//#region ../auth/src/services/email-verification.ts
+//#region ../../packages/auth/src/services/email-verification.ts
 /**
 * Whether the user has verified their email — the configured
 * `auth.verification.field` (default `emailVerifiedAt`) holds a value.

package/esm/services/email-verification.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"email-verification.mjs","names":[],"sources":["../../../../../../../auth/src/services/email-verification.ts"],"sourcesContent":["import type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"./auth-config\";\nimport { consumeOneTimeToken, issueOneTimeToken } from \"./one-time-tokens\";\nimport { resolveTokenNotification } from \"./token-notifications\";\n\n/**\n * Whether the user has verified their email — the configured\n * `auth.verification.field` (default `emailVerifiedAt`) holds a value.\n */\nexport function isEmailVerified(user: Pick<Auth, \"get\">): boolean {\n  return !!user.get(authConfig.verification.field());\n}\n\n/**\n * Issue an email-verification token for the user and send it through the\n * verification notification (`auth.verification.notification`, else auth's\n * default mail). Earlier verification links keep working until they expire or\n * one of them is used.\n *\n * @throws NotificationsUnavailableError before any token is issued when\n *   `@warlock.js/notifications` is not installed or not configured.\n *\n * @example\n * const user = await User.create(data);\n * await sendEmailVerification(user);\n */\nexport async function sendEmailVerification(user: Auth): Promise<void> {\n  const notification = await resolveTokenNotification(\"email-verification\");\n\n  const { token, expiresAt } = await issueOneTimeToken(\n    user,\n    \"email-verification\",\n    authConfig.verification.expiresInMs(),\n  );\n\n  const url = authConfig.verification.url()?.(token, user);\n\n  await notification.send(user, { token, expiresAt, ...(url ? { url } : {}) });\n}\n\n/**\n * Consume a verification token and stamp the user's verified field with the\n * current date. Resolves to the verified user.\n *\n * @throws InvalidOneTimeTokenError for an unknown, reset-purpose, expired or\n *   already-used token.\n * @throws Error when the save did not keep the field — the user schema must\n *   declare it (e.g. `emailVerifiedAt: v.date().optional()`).\n */\nexport async function verifyEmail(token: string): Promise<Auth> {\n  const user = await consumeOneTimeToken(token, \"email-verification\");\n  const field = authConfig.verification.field();\n\n  await user.merge({ [field]: new Date() } as never).save();\n\n  if (!isEmailVerified(user)) {\n    throw new Error(\n      `@warlock.js/auth: verifyEmail could not persist \"${field}\" on the user — ` +\n        `declare it in the user schema (e.g. \\`${field}: v.date().optional()\\`) ` +\n        \"or set `auth.verification.field` to an existing attribute.\",\n    );\n  }\n\n  return user;\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,gBAAgB,MAAkC;CAChE,OAAO,CAAC,CAAC,KAAK,IAAI,WAAW,aAAa,MAAM,CAAC;AACnD;;;;;;;;;;;;;;AAeA,eAAsB,sBAAsB,MAA2B;CACrE,MAAM,eAAe,MAAM,yBAAyB,oBAAoB;CAExE,MAAM,EAAE,OAAO,cAAc,MAAM,kBACjC,MACA,sBACA,WAAW,aAAa,YAAY,CACtC;CAEA,MAAM,MAAM,WAAW,aAAa,IAAI,CAAC,GAAG,OAAO,IAAI;CAEvD,MAAM,aAAa,KAAK,MAAM;EAAE;EAAO;EAAW,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CAAG,CAAC;AAC7E;;;;;;;;;;AAWA,eAAsB,YAAY,OAA8B;CAC9D,MAAM,OAAO,MAAM,oBAAoB,OAAO,oBAAoB;CAClE,MAAM,QAAQ,WAAW,aAAa,MAAM;CAE5C,MAAM,KAAK,MAAM,GAAG,wBAAQ,IAAI,KAAK,EAAE,CAAU,CAAC,CAAC,KAAK;CAExD,IAAI,CAAC,gBAAgB,IAAI,GACvB,MAAM,IAAI,MACR,oDAAoD,MAAM,wDACf,MAAM,sFAEnD;CAGF,OAAO;AACT"}
+{"version":3,"file":"email-verification.mjs","names":[],"sources":["../../../../../../../../packages/auth/src/services/email-verification.ts"],"sourcesContent":["import type { Auth } from \"../models/auth.model\";\nimport { authConfig } from \"./auth-config\";\nimport { consumeOneTimeToken, issueOneTimeToken } from \"./one-time-tokens\";\nimport { resolveTokenNotification } from \"./token-notifications\";\n\n/**\n * Whether the user has verified their email — the configured\n * `auth.verification.field` (default `emailVerifiedAt`) holds a value.\n */\nexport function isEmailVerified(user: Pick<Auth, \"get\">): boolean {\n  return !!user.get(authConfig.verification.field());\n}\n\n/**\n * Issue an email-verification token for the user and send it through the\n * verification notification (`auth.verification.notification`, else auth's\n * default mail). Earlier verification links keep working until they expire or\n * one of them is used.\n *\n * @throws NotificationsUnavailableError before any token is issued when\n *   `@warlock.js/notifications` is not installed or not configured.\n *\n * @example\n * const user = await User.create(data);\n * await sendEmailVerification(user);\n */\nexport async function sendEmailVerification(user: Auth): Promise<void> {\n  const notification = await resolveTokenNotification(\"email-verification\");\n\n  const { token, expiresAt } = await issueOneTimeToken(\n    user,\n    \"email-verification\",\n    authConfig.verification.expiresInMs(),\n  );\n\n  const url = authConfig.verification.url()?.(token, user);\n\n  await notification.send(user, { token, expiresAt, ...(url ? { url } : {}) });\n}\n\n/**\n * Consume a verification token and stamp the user's verified field with the\n * current date. Resolves to the verified user.\n *\n * @throws InvalidOneTimeTokenError for an unknown, reset-purpose, expired or\n *   already-used token.\n * @throws Error when the save did not keep the field — the user schema must\n *   declare it (e.g. `emailVerifiedAt: v.date().optional()`).\n */\nexport async function verifyEmail(token: string): Promise<Auth> {\n  const user = await consumeOneTimeToken(token, \"email-verification\");\n  const field = authConfig.verification.field();\n\n  await user.merge({ [field]: new Date() } as never).save();\n\n  if (!isEmailVerified(user)) {\n    throw new Error(\n      `@warlock.js/auth: verifyEmail could not persist \"${field}\" on the user — ` +\n        `declare it in the user schema (e.g. \\`${field}: v.date().optional()\\`) ` +\n        \"or set `auth.verification.field` to an existing attribute.\",\n    );\n  }\n\n  return user;\n}\n"],"mappings":";;;;;;;;;AASA,SAAgB,gBAAgB,MAAkC;CAChE,OAAO,CAAC,CAAC,KAAK,IAAI,WAAW,aAAa,MAAM,CAAC;AACnD;;;;;;;;;;;;;;AAeA,eAAsB,sBAAsB,MAA2B;CACrE,MAAM,eAAe,MAAM,yBAAyB,oBAAoB;CAExE,MAAM,EAAE,OAAO,cAAc,MAAM,kBACjC,MACA,sBACA,WAAW,aAAa,YAAY,CACtC;CAEA,MAAM,MAAM,WAAW,aAAa,IAAI,CAAC,GAAG,OAAO,IAAI;CAEvD,MAAM,aAAa,KAAK,MAAM;EAAE;EAAO;EAAW,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;CAAG,CAAC;AAC7E;;;;;;;;;;AAWA,eAAsB,YAAY,OAA8B;CAC9D,MAAM,OAAO,MAAM,oBAAoB,OAAO,oBAAoB;CAClE,MAAM,QAAQ,WAAW,aAAa,MAAM;CAE5C,MAAM,KAAK,MAAM,GAAG,wBAAQ,IAAI,KAAK,EAAE,CAAU,CAAC,CAAC,KAAK;CAExD,IAAI,CAAC,gBAAgB,IAAI,GACvB,MAAM,IAAI,MACR,oDAAoD,MAAM,wDACf,MAAM,sFAEnD;CAGF,OAAO;AACT"}

package/esm/services/generate-jwt-secret.d.mts

@@ -1,4 +1,4 @@
-//#region ../auth/src/services/generate-jwt-secret.d.ts
+//#region ../../packages/auth/src/services/generate-jwt-secret.d.ts
 declare function generateJWTSecret(): Promise<void>;
 //#endregion
 export { generateJWTSecret };