@zudojs/auth 0.1.0 → 0.1.1

package/dist/authPassword/authPassword.core.d.ts

@@ -11,19 +11,23 @@
  *
  * @param password - Plain-text password
  * @param saltLength - Salt length in bytes (default: 32)
- * @returns Hashed password string in format "scrypt$salt$hash"
+ * @returns Hashed password string in format "scrypt$N$r$p$salt$hash"
  */
 export declare function hashPassword(password: string, saltLength?: number): Promise<string>;
 /**
  * Verify a plain-text password against a hash.
  *
+ * Accepts the current "scrypt$N$r$p$salt$hash" format as well as the
+ * legacy "scrypt<salt>$<hash>" format produced by versions ≤ 0.1.1.
+ *
  * @param password - Plain-text password to verify
  * @param hashedPassword - Previously hashed password
  * @returns Whether the password matches
  */
 export declare function verifyPassword(password: string, hashedPassword: string): Promise<boolean>;
 /**
- * Check if a password hash needs rehashing (e.g. after salt length change).
+ * Check if a password hash needs rehashing (legacy format, changed
+ * scrypt parameters, or changed salt length).
  *
  * @param hashedPassword - The stored hash
  * @returns Whether the hash should be regenerated

package/dist/authPassword/authPassword.core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authPassword.core.d.ts","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAeH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAIjB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAclB;AAED;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAQ3D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAE/D"}
+{"version":3,"file":"authPassword.core.d.ts","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AA6BH;;;;;;GAMG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,UAAU,GAAE,MAAoB,GAC/B,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED;;;;;;;;;GASG;AACH,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,cAAc,EAAE,MAAM,GACrB,OAAO,CAAC,OAAO,CAAC,CAiBlB;AAED;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,cAAc,EAAE,MAAM,GAAG,OAAO,CAW3D;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,GAAE,MAAW,GAAG,MAAM,CAE/D"}

package/dist/authPassword/authPassword.core.js

@@ -20,29 +20,40 @@ const SCRYPT_P = 1;
  *
  * @param password - Plain-text password
  * @param saltLength - Salt length in bytes (default: 32)
- * @returns Hashed password string in format "scrypt$salt$hash"
+ * @returns Hashed password string in format "scrypt$N$r$p$salt$hash"
  */
 export async function hashPassword(password, saltLength = SALT_LENGTH) {
     const salt = randomBytes(saltLength).toString("hex");
-    const derivedKey = await deriveKey(password, salt);
-    return `scrypt${salt}$${derivedKey}`;
+    const derivedKey = await deriveKey(password, salt, {
+        N: SCRYPT_N,
+        r: SCRYPT_R,
+        p: SCRYPT_P,
+    });
+    return `scrypt$${SCRYPT_N}$${SCRYPT_R}$${SCRYPT_P}$${salt}$${derivedKey}`;
 }
 /**
  * Verify a plain-text password against a hash.
  *
+ * Accepts the current "scrypt$N$r$p$salt$hash" format as well as the
+ * legacy "scrypt<salt>$<hash>" format produced by versions ≤ 0.1.1.
+ *
  * @param password - Plain-text password to verify
  * @param hashedPassword - Previously hashed password
  * @returns Whether the password matches
  */
 export async function verifyPassword(password, hashedPassword) {
-    const parts = hashedPassword.split("$");
-    if (parts.length !== 2 || !parts[0].startsWith("scrypt")) {
+    const parsed = parseHash(hashedPassword);
+    if (!parsed)
         return false;
+    let derivedKey;
+    try {
+        derivedKey = await deriveKey(password, parsed.salt, parsed.params);
     }
-    const salt = parts[0].slice(6);
-    const storedHash = parts[1];
-    const derivedKey = await deriveKey(password, salt);
-    const storedBuffer = Buffer.from(storedHash, "hex");
+    catch {
+        // scrypt rejects params it cannot satisfy (e.g. over maxmem)
+        return false;
+    }
+    const storedBuffer = Buffer.from(parsed.hash, "hex");
     const derivedBuffer = Buffer.from(derivedKey, "hex");
     if (storedBuffer.length !== derivedBuffer.length) {
         return false;
@@ -50,19 +61,21 @@ export async function verifyPassword(password, hashedPassword) {
     return timingSafeEqual(storedBuffer, derivedBuffer);
 }
 /**
- * Check if a password hash needs rehashing (e.g. after salt length change).
+ * Check if a password hash needs rehashing (legacy format, changed
+ * scrypt parameters, or changed salt length).
  *
  * @param hashedPassword - The stored hash
  * @returns Whether the hash should be regenerated
  */
 export function needsRehash(hashedPassword) {
-    const parts = hashedPassword.split("$");
-    if (parts.length !== 2 || !parts[0].startsWith("scrypt")) {
+    const parsed = parseHash(hashedPassword);
+    if (!parsed || parsed.legacy)
         return true;
-    }
-    const salt = parts[0].slice(6);
-    const saltBytes = salt.length / 2;
-    return saltBytes !== SALT_LENGTH;
+    const saltBytes = parsed.salt.length / 2;
+    return (saltBytes !== SALT_LENGTH ||
+        parsed.params.N !== SCRYPT_N ||
+        parsed.params.r !== SCRYPT_R ||
+        parsed.params.p !== SCRYPT_P);
 }
 /**
  * Generate a random token string (for password reset, etc.).
@@ -73,9 +86,47 @@ export function needsRehash(hashedPassword) {
 export function generateRandomToken(length = 32) {
     return randomBytes(length).toString("hex");
 }
-function deriveKey(password, salt) {
+function parseHash(hashedPassword) {
+    const parts = hashedPassword.split("$");
+    if (parts.length === 6 && parts[0] === "scrypt") {
+        const N = Number(parts[1]);
+        const r = Number(parts[2]);
+        const p = Number(parts[3]);
+        // Bounds also cap the memory/CPU a corrupted hash string can request.
+        if (!Number.isInteger(N) ||
+            !Number.isInteger(r) ||
+            !Number.isInteger(p) ||
+            N < 2 ||
+            (N & (N - 1)) !== 0 ||
+            N > 1 << 20 ||
+            r < 1 ||
+            r > 64 ||
+            p < 1 ||
+            p > 16) {
+            return null;
+        }
+        return {
+            params: { N, r, p },
+            salt: parts[4],
+            hash: parts[5],
+            legacy: false,
+        };
+    }
+    // Legacy format from ≤ 0.1.1: "scrypt<salt>$<hash>" (no separator
+    // between the prefix and the salt, params not stored).
+    if (parts.length === 2 && parts[0].startsWith("scrypt")) {
+        return {
+            params: { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P },
+            salt: parts[0].slice(6),
+            hash: parts[1],
+            legacy: true,
+        };
+    }
+    return null;
+}
+function deriveKey(password, salt, params) {
     return new Promise((resolve, reject) => {
-        scrypt(password, salt, KEY_LENGTH, { N: SCRYPT_N, r: SCRYPT_R, p: SCRYPT_P }, (err, derivedKey) => {
+        scrypt(password, salt, KEY_LENGTH, { N: params.N, r: params.r, p: params.p }, (err, derivedKey) => {
             if (err)
                 reject(err);
             else

package/dist/authPassword/authPassword.core.js.map

@@ -1 +1 @@
-{"version":3,"file":"authPassword.core.js","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE,oCAAoC;AACpC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,qCAAqC;AACrC,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,mCAAmC;AACnC,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAEnB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAAU,GAAW,WAAW;IAEhC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,OAAO,SAAS,IAAI,IAAI,UAAU,EAAE,CAAC;AACvC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,cAAsB;IAEtB,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,cAAsB;IAChD,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAChC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IAClC,OAAO,SAAS,KAAK,WAAW,CAAC;AACnC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAW,EAAE;IACrD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,QAAgB,EAAE,IAAY;IAC/C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,EACzC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAClB,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"authPassword.core.js","sourceRoot":"","sources":["../../src/authPassword/authPassword.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnE,oCAAoC;AACpC,MAAM,WAAW,GAAG,EAAE,CAAC;AAEvB,qCAAqC;AACrC,MAAM,UAAU,GAAG,EAAE,CAAC;AAEtB,mCAAmC;AACnC,MAAM,QAAQ,GAAG,KAAK,CAAC;AACvB,MAAM,QAAQ,GAAG,CAAC,CAAC;AACnB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAgBnB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,UAAU,GAAW,WAAW;IAEhC,MAAM,IAAI,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjD,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;QACX,CAAC,EAAE,QAAQ;KACZ,CAAC,CAAC;IACH,OAAO,UAAU,QAAQ,IAAI,QAAQ,IAAI,QAAQ,IAAI,IAAI,IAAI,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,cAAsB;IAEtB,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAE1B,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACrD,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACrD,IAAI,YAAY,CAAC,MAAM,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,cAAsB;IAChD,MAAM,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAE1C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACzC,OAAO,CACL,SAAS,KAAK,WAAW;QACzB,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ;QAC5B,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,QAAQ,CAC7B,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAM,GAAW,EAAE;IACrD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,SAAS,CAAC,cAAsB;IACvC,MAAM,KAAK,GAAG,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAExC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3B,sEAAsE;QACtE,IACE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACpB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACpB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;YACpB,CAAC,GAAG,CAAC;YACL,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC;YACnB,CAAC,GAAG,CAAC,IAAI,EAAE;YACX,CAAC,GAAG,CAAC;YACL,CAAC,GAAG,EAAE;YACN,CAAC,GAAG,CAAC;YACL,CAAC,GAAG,EAAE,EACN,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;YACnB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;YACf,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;YACf,MAAM,EAAE,KAAK;SACd,CAAC;IACJ,CAAC;IAED,kEAAkE;IAClE,uDAAuD;IACvD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzD,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,QAAQ,EAAE;YACjD,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAC;YACxB,IAAI,EAAE,KAAK,CAAC,CAAC,CAAE;YACf,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,SAAS,CAChB,QAAgB,EAChB,IAAY,EACZ,MAAoB;IAEpB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,CACJ,QAAQ,EACR,IAAI,EACJ,UAAU,EACV,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,EACzC,CAAC,GAAG,EAAE,UAAU,EAAE,EAAE;YAClB,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/authProvider/authProvider.core.d.ts

@@ -4,7 +4,7 @@
  * @module authProvider/authProvider
  */
 import type { AuthUser, UserCredentials, UserId } from "../authTypes/authUser.type.js";
-import type { TokenPair, TokenConfig } from "../authTypes/authToken.type.js";
+import type { TokenPair, TokenConfig, TokenRevocationStore } from "../authTypes/authToken.type.js";
 import type { SessionStore, SessionId } from "../authTypes/authSession.type.js";
 import type { GuardResult } from "../authTypes/authRbac.type.js";
 import type { PermissionEngine } from "@zudojs/permissions";
@@ -28,6 +28,11 @@ export interface AuthServiceConfig {
     readonly sessionTtlSeconds: number;
     /** Optional permission engine */
     readonly permissions?: PermissionEngine;
+    /**
+     * Optional revocation store. When provided, `refresh()` rotates refresh
+     * tokens: the used token's `jti` is revoked so it cannot be replayed.
+     */
+    readonly revocationStore?: TokenRevocationStore;
 }
 /**
  * Auth service interface.

package/dist/authProvider/authProvider.core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authProvider.core.d.ts","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,MAAM,EACP,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,KAAK,EACV,YAAY,EAEZ,SAAS,EACV,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAgB5D,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAC1E,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,oBAAoB;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,6BAA6B;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iCAAiC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;CACzC;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CACH,WAAW,EAAE,eAAe,EAC5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iBAAiB;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iBAAiB;IACjB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CAqHxE"}
+{"version":3,"file":"authProvider.core.d.ts","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,eAAe,EACf,MAAM,EACP,MAAM,+BAA+B,CAAC;AACvC,OAAO,KAAK,EACV,SAAS,EACT,WAAW,EACX,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AACxC,OAAO,KAAK,EACV,YAAY,EAEZ,SAAS,EACV,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,+BAA+B,CAAC;AACjE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAkB5D,qDAAqD;AACrD,MAAM,MAAM,UAAU,GAAG,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;AAC1E,2DAA2D;AAC3D,MAAM,MAAM,gBAAgB,GAAG,CAC7B,MAAM,EAAE,MAAM,EACd,QAAQ,EAAE,MAAM,KACb,OAAO,CAAC,OAAO,CAAC,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,8BAA8B;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC;IAC5B,oBAAoB;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,2BAA2B;IAC3B,QAAQ,CAAC,QAAQ,EAAE,UAAU,CAAC;IAC9B,iCAAiC;IACjC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC;IAC1C,6BAA6B;IAC7B,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,iCAAiC;IACjC,QAAQ,CAAC,WAAW,CAAC,EAAE,gBAAgB,CAAC;IACxC;;;OAGG;IACH,QAAQ,CAAC,eAAe,CAAC,EAAE,oBAAoB,CAAC;CACjD;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,CACH,WAAW,EAAE,eAAe,EAC5B,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9D,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpD,OAAO,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5C,WAAW,CACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,SAAS,MAAM,EAAE,EAC5B,UAAU,EAAE,MAAM,EAClB,eAAe,CAAC,EAAE,MAAM,GACvB,OAAO,CAAC,WAAW,CAAC,CAAC;IACxB,YAAY,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChD,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;CACtE;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,yBAAyB;IACzB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,iBAAiB;IACjB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iBAAiB;IACjB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;CAC/B;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,iBAAiB,GAAG,WAAW,CA4IxE"}

package/dist/authProvider/authProvider.core.js

@@ -4,13 +4,13 @@
  * @module authProvider/authProvider
  */
 import { hashPassword, verifyPassword, } from "../authPassword/authPassword.core.js";
-import { createTokenPair, verifyAccessToken, refreshAccessToken, } from "../authToken/authToken.core.js";
-import { InvalidCredentialsError, TokenExpiredError, AccountDeactivatedError, } from "../authErrors/authError.base.js";
+import { createTokenPair, verifyAccessToken, verifyRefreshToken, } from "../authToken/authToken.core.js";
+import { InvalidCredentialsError, TokenExpiredError, TokenInvalidError, TokenRevokedError, AccountDeactivatedError, } from "../authErrors/authError.base.js";
 /**
  * Create an auth service.
  */
 export function createAuthService(config) {
-    const { token: tokenConfig, sessionStore, findUser, verifyPassword: verifyPwd, sessionTtlSeconds, permissions, } = config;
+    const { token: tokenConfig, sessionStore, findUser, verifyPassword: verifyPwd, sessionTtlSeconds, permissions, revocationStore, } = config;
     return {
         /**
          * Authenticate a user with credentials and return tokens + session.
@@ -44,19 +44,36 @@ export function createAuthService(config) {
         verifyToken(token) {
             const result = verifyAccessToken(token, tokenConfig);
             if (!result.valid) {
-                throw new TokenExpiredError(result.error ?? "Token verification failed");
+                if (result.error === "Token expired") {
+                    throw new TokenExpiredError(result.error);
+                }
+                throw new TokenInvalidError(result.error ?? "Token verification failed");
             }
             return result.payload;
         },
         /**
          * Refresh an access token using a refresh token.
+         *
+         * When a revocation store is configured, the used refresh token is
+         * revoked (rotation) so it cannot be replayed.
          */
         async refresh(refreshToken) {
-            const result = refreshAccessToken(refreshToken, tokenConfig);
-            if (!result) {
-                throw new TokenExpiredError("Refresh token is invalid or expired");
+            const result = verifyRefreshToken(refreshToken, tokenConfig);
+            if (!result.valid || !result.payload) {
+                if (result.error === "Token expired") {
+                    throw new TokenExpiredError("Refresh token has expired");
+                }
+                throw new TokenInvalidError("Refresh token is invalid");
             }
-            return result;
+            const { sub, jti, exp, roles } = result.payload;
+            if (revocationStore && (await revocationStore.isRevoked(jti))) {
+                throw new TokenRevokedError("Refresh token has been revoked");
+            }
+            const tokens = createTokenPair(sub, tokenConfig, { roles });
+            if (revocationStore) {
+                await revocationStore.revoke(jti, exp);
+            }
+            return tokens;
         },
         /**
          * Logout — destroy the session.
@@ -101,19 +118,16 @@ export function createAuthService(config) {
 }
 /**
  * Simple fallback guard when no permissions engine is configured.
- * Performs basic wildcard matching without full ABAC support.
+ * Grants access to resource owners and to the "admin" role only —
+ * configure @zudojs/permissions for real role/permission matching.
  */
 function simpleGuard(userRoles, permission, userId, resourceOwnerId) {
     // Ownership check
     if (resourceOwnerId && resourceOwnerId === userId) {
         return { allowed: true, userRoles: [...userRoles] };
     }
-    const [requiredResource, requiredAction] = permission.split(":");
-    for (const role of userRoles) {
-        // Role-based — simplified check
-        if (role === "admin") {
-            return { allowed: true, userRoles: [...userRoles] };
-        }
+    if (userRoles.includes("admin")) {
+        return { allowed: true, userRoles: [...userRoles] };
     }
     return {
         allowed: false,

package/dist/authProvider/authProvider.core.js.map

@@ -1 +1 @@
-{"version":3,"file":"authProvider.core.js","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAeH,OAAO,EACL,YAAY,EACZ,cAAc,GACf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AA6DzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,EACJ,KAAK,EAAE,WAAW,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EAAE,SAAS,EACzB,iBAAiB,EACjB,WAAW,GACZ,GAAG,MAAM,CAAC;IAEX,OAAO;QACL;;WAEG;QACH,KAAK,CAAC,KAAK,CACT,WAA4B,EAC5B,OAA+D;YAE/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,UAAU,EAAE,iBAAiB;aAC9B,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QAED;;WAEG;QACH,WAAW,CAAC,KAAa;YACvB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,KAAK,IAAI,2BAA2B,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAQ,CAAC;QACzB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,OAAO,CAAC,YAAoB;YAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,iBAAiB,CAAC,qCAAqC,CAAC,CAAC;YACrE,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,MAAM,CAAC,SAAoB;YAC/B,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,SAA4B,EAC5B,UAAkB,EAClB,eAAwB;YAExB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,eAAe;oBAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,kBAAkB,EAAE,UAAU;oBAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;iBAC1B,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,OAAO,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED;;WAEG;QACH,YAAY,CAAC,QAAgB;YAC3B,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED;;WAEG;QACH,kBAAkB,CAAC,QAAgB,EAAE,IAAY;YAC/C,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAS,WAAW,CAClB,SAA4B,EAC5B,UAAkB,EAClB,MAAc,EACd,eAAwB;IAExB,kBAAkB;IAClB,IAAI,eAAe,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,MAAM,CAAC,gBAAgB,EAAE,cAAc,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAEjE,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,gCAAgC;QAChC,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,mCAAmC,UAAU,EAAE;QACvD,kBAAkB,EAAE,UAAU;QAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authProvider.core.js","sourceRoot":"","sources":["../../src/authProvider/authProvider.core.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAmBH,OAAO,EACL,YAAY,EACZ,cAAc,GACf,MAAM,sCAAsC,CAAC;AAC9C,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,kBAAkB,GACnB,MAAM,gCAAgC,CAAC;AACxC,OAAO,EACL,uBAAuB,EACvB,iBAAiB,EACjB,iBAAiB,EACjB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,iCAAiC,CAAC;AAkEzC;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAyB;IACzD,MAAM,EACJ,KAAK,EAAE,WAAW,EAClB,YAAY,EACZ,QAAQ,EACR,cAAc,EAAE,SAAS,EACzB,iBAAiB,EACjB,WAAW,EACX,eAAe,GAChB,GAAG,MAAM,CAAC;IAEX,OAAO;QACL;;WAEG;QACH,KAAK,CAAC,KAAK,CACT,WAA4B,EAC5B,OAA+D;YAE/D,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;YACpD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;gBACjB,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;YAC7D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,uBAAuB,EAAE,CAAC;YACtC,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,EAAE,EAAE,WAAW,EAAE;gBACnD,KAAK,EAAE,IAAI,CAAC,KAAK;aAClB,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC;gBACxC,MAAM,EAAE,IAAI,CAAC,EAAE;gBACf,SAAS,EAAE,OAAO,EAAE,SAAS;gBAC7B,EAAE,EAAE,OAAO,EAAE,EAAE;gBACf,UAAU,EAAE,iBAAiB;aAC9B,CAAC,CAAC;YAEH,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QACjD,CAAC;QAED;;WAEG;QACH,WAAW,CAAC,KAAa;YACvB,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBAClB,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,iBAAiB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAC5C,CAAC;gBACD,MAAM,IAAI,iBAAiB,CACzB,MAAM,CAAC,KAAK,IAAI,2BAA2B,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,MAAM,CAAC,OAAQ,CAAC;QACzB,CAAC;QAED;;;;;WAKG;QACH,KAAK,CAAC,OAAO,CAAC,YAAoB;YAChC,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;YAC7D,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACrC,IAAI,MAAM,CAAC,KAAK,KAAK,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,iBAAiB,CAAC,2BAA2B,CAAC,CAAC;gBAC3D,CAAC;gBACD,MAAM,IAAI,iBAAiB,CAAC,0BAA0B,CAAC,CAAC;YAC1D,CAAC;YAED,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC;YAEhD,IAAI,eAAe,IAAI,CAAC,MAAM,eAAe,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC9D,MAAM,IAAI,iBAAiB,CAAC,gCAAgC,CAAC,CAAC;YAChE,CAAC;YAED,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;YAE5D,IAAI,eAAe,EAAE,CAAC;gBACpB,MAAM,eAAe,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;YACzC,CAAC;YAED,OAAO,MAAM,CAAC;QAChB,CAAC;QAED;;WAEG;QACH,KAAK,CAAC,MAAM,CAAC,SAAoB;YAC/B,MAAM,YAAY,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,CAAC;QAED;;;WAGG;QACH,KAAK,CAAC,WAAW,CACf,MAAc,EACd,SAA4B,EAC5B,UAAkB,EAClB,eAAwB;YAExB,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,KAAK,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;gBACpD,MAAM,QAAQ,GAAG,eAAe;oBAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE;oBAC9B,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;gBACtE,OAAO;oBACL,OAAO,EAAE,QAAQ,CAAC,OAAO;oBACzB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,kBAAkB,EAAE,UAAU;oBAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;iBAC1B,CAAC;YACJ,CAAC;YAED,4DAA4D;YAC5D,OAAO,WAAW,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED;;WAEG;QACH,YAAY,CAAC,QAAgB;YAC3B,OAAO,YAAY,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAED;;WAEG;QACH,kBAAkB,CAAC,QAAgB,EAAE,IAAY;YAC/C,OAAO,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW,CAClB,SAA4B,EAC5B,UAAkB,EAClB,MAAc,EACd,eAAwB;IAExB,kBAAkB;IAClB,IAAI,eAAe,IAAI,eAAe,KAAK,MAAM,EAAE,CAAC;QAClD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC,EAAE,CAAC;IACtD,CAAC;IAED,OAAO;QACL,OAAO,EAAE,KAAK;QACd,MAAM,EAAE,mCAAmC,UAAU,EAAE;QACvD,kBAAkB,EAAE,UAAU;QAC9B,SAAS,EAAE,CAAC,GAAG,SAAS,CAAC;KAC1B,CAAC;AACJ,CAAC"}

package/dist/authSession/authSession.core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authSession.core.d.ts","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,kCAAkC,CAAC;AAM1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,YAAY,CA0DvD"}
+{"version":3,"file":"authSession.core.d.ts","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAIV,YAAY,EACb,MAAM,kCAAkC,CAAC;AAM1C;;;;;GAKG;AACH,wBAAgB,wBAAwB,IAAI,YAAY,CA8EvD"}

package/dist/authSession/authSession.core.js

@@ -15,8 +15,19 @@ const DEFAULT_TTL_SECONDS = 86400; // 24 hours
  */
 export function createMemorySessionStore() {
     const sessions = new Map();
+    const ttls = new Map();
+    function purgeExpired() {
+        const now = new Date();
+        for (const [id, session] of sessions) {
+            if (now > session.expiresAt) {
+                sessions.delete(id);
+                ttls.delete(id);
+            }
+        }
+    }
     return {
         async create(options) {
+            purgeExpired();
             const id = generateSessionId();
             const now = new Date();
             const ttlMs = (options.ttlSeconds ?? DEFAULT_TTL_SECONDS) * 1000;
@@ -32,6 +43,7 @@ export function createMemorySessionStore() {
                 metadata: options.metadata,
             };
             sessions.set(id, session);
+            ttls.set(id, ttlMs);
             return session;
         },
         async get(sessionId) {
@@ -42,26 +54,33 @@ export function createMemorySessionStore() {
                 return null;
             if (new Date() > session.expiresAt) {
                 sessions.delete(sessionId);
+                ttls.delete(sessionId);
                 return null;
             }
             return session;
         },
         async touch(sessionId) {
             const session = sessions.get(sessionId);
-            if (session && session.active) {
+            if (session && session.active && new Date() <= session.expiresAt) {
+                const now = new Date();
+                const ttlMs = ttls.get(sessionId) ?? DEFAULT_TTL_SECONDS * 1000;
                 sessions.set(sessionId, {
                     ...session,
-                    lastActivityAt: new Date(),
+                    lastActivityAt: now,
+                    // Sliding expiration: activity extends the session by its TTL
+                    expiresAt: new Date(now.getTime() + ttlMs),
                 });
             }
         },
         async destroy(sessionId) {
             sessions.delete(sessionId);
+            ttls.delete(sessionId);
         },
         async destroyAllForUser(userId) {
             for (const [id, session] of sessions) {
                 if (session.userId === userId) {
                     sessions.delete(id);
+                    ttls.delete(id);
                 }
             }
         },

package/dist/authSession/authSession.core.js.map

@@ -1 +1 @@
-{"version":3,"file":"authSession.core.js","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,WAAW;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IAEnD,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAA6B;YACxC,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;YAEjE,MAAM,OAAO,GAAgB;gBAC3B,EAAE;gBACF,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,GAAG;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YAEF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAoB;YAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3B,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAoB;YAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC9B,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;oBACtB,GAAG,OAAO;oBACV,cAAc,EAAE,IAAI,IAAI,EAAE;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAoB;YAChC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7B,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;YACpC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAc,CAAC;AACtD,CAAC"}
+{"version":3,"file":"authSession.core.js","sourceRoot":"","sources":["../../src/authSession/authSession.core.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AASH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,MAAM,mBAAmB,GAAG,KAAK,CAAC,CAAC,WAAW;AAE9C;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB;IACtC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAA0B,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAqB,CAAC;IAE1C,SAAS,YAAY;QACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;YACrC,IAAI,GAAG,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBAC5B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBACpB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAA6B;YACxC,YAAY,EAAE,CAAC;YACf,MAAM,EAAE,GAAG,iBAAiB,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC,GAAG,IAAI,CAAC;YAEjE,MAAM,OAAO,GAAgB;gBAC3B,EAAE;gBACF,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,SAAS,EAAE,OAAO,CAAC,SAAS;gBAC5B,EAAE,EAAE,OAAO,CAAC,EAAE;gBACd,SAAS,EAAE,GAAG;gBACd,cAAc,EAAE,GAAG;gBACnB,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;gBAC1C,MAAM,EAAE,IAAI;gBACZ,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC3B,CAAC;YAEF,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAC1B,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,SAAoB;YAC5B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,IAAI,CAAC,OAAO,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACjC,IAAI,IAAI,IAAI,EAAE,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;gBACnC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;gBACvB,OAAO,IAAI,CAAC;YACd,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,SAAoB;YAC9B,MAAM,OAAO,GAAG,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YACxC,IAAI,OAAO,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,IAAI,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;gBACjE,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,mBAAmB,GAAG,IAAI,CAAC;gBAChE,QAAQ,CAAC,GAAG,CAAC,SAAS,EAAE;oBACtB,GAAG,OAAO;oBACV,cAAc,EAAE,GAAG;oBACnB,8DAA8D;oBAC9D,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC;iBAC3C,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,SAAoB;YAChC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC3B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzB,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,MAAc;YACpC,KAAK,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACrC,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;oBAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACpB,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAClB,CAAC;YACH,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB;IACxB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAc,CAAC;AACtD,CAAC"}

package/dist/authToken/authToken.core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authToken.core.d.ts","sourceRoot":"","sources":["../../src/authToken/authToken.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EACV,QAAQ,EACR,SAAS,EACT,WAAW,EACX,uBAAuB,EACxB,MAAM,gCAAgC,CAAC;AAUxC;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/C,SAAS,CAsCX;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,WAAW,GAClB,uBAAuB,CAEzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,WAAW,GAClB,uBAAuB,CAEzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,QAAQ,EACtB,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/C,SAAS,GAAG,IAAI,CAOlB"}
+{"version":3,"file":"authToken.core.d.ts","sourceRoot":"","sources":["../../src/authToken/authToken.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EACV,QAAQ,EACR,SAAS,EACT,WAAW,EACX,uBAAuB,EACxB,MAAM,gCAAgC,CAAC;AAWxC;;GAEG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,MAAM,EACd,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/C,SAAS,CAuCX;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,WAAW,GAClB,uBAAuB,CAEzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,WAAW,GAClB,uBAAuB,CAEzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAChC,YAAY,EAAE,QAAQ,EACtB,MAAM,EAAE,WAAW,EACnB,OAAO,CAAC,EAAE;IAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,GAC/C,SAAS,GAAG,IAAI,CAOlB"}

package/dist/authToken/authToken.core.js

@@ -6,10 +6,10 @@
  * Pure Node.js implementation (no jsonwebtoken dependency).
  * Uses HMAC SHA-256 for signing.
  */
-import { TimeMs } from "@zudojs/constants";
 import { signToken, verifyToken, generateTokenId, } from "./authToken.signing.js";
-const DEFAULT_ACCESS_TTL = TimeMs.SECOND * 15; // 15 minutes
-const DEFAULT_REFRESH_TTL = TimeMs.SECOND * 60 * 60 * 24 * 7; // 7 days
+// TTLs are in seconds — they are added to Unix-second `iat`/`exp` claims.
+const DEFAULT_ACCESS_TTL = 900; // 15 minutes
+const DEFAULT_REFRESH_TTL = 604_800; // 7 days
 /**
  * Create a new token pair (access + refresh).
  */
@@ -33,6 +33,7 @@ export function createTokenPair(userId, config, options) {
         exp: now + refreshTtl,
         typ: "refresh",
         jti: generateTokenId(),
+        roles: options?.roles,
         ...(config.issuer ? { iss: config.issuer } : {}),
         ...(config.audience ? { aud: config.audience } : {}),
     }, config.refreshSecret);

package/dist/authToken/authToken.core.js.map

@@ -1 +1 @@
-{"version":3,"file":"authToken.core.js","sourceRoot":"","sources":["../../src/authToken/authToken.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAQ3C,OAAO,EACL,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,MAAM,kBAAkB,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,aAAa;AAC5D,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS;AAEvE;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,MAAmB,EACnB,OAAgD;IAEhD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,SAAS,CAC3B;QACE,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,SAAS;QACpB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,eAAe,EAAE;QACtB,KAAK,EAAE,OAAO,EAAE,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,EACD,MAAM,CAAC,YAAY,CACpB,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAC5B;QACE,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,UAAU;QACrB,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,eAAe,EAAE;QACtB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAe,EACf,MAAmB;IAEnB,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAe,EACf,MAAmB;IAEnB,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAsB,EACtB,MAAmB,EACnB,OAAgD;IAEhD,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE;QACjD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK;KAC9C,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"authToken.core.js","sourceRoot":"","sources":["../../src/authToken/authToken.core.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AASH,OAAO,EACL,SAAS,EACT,WAAW,EACX,eAAe,GAChB,MAAM,wBAAwB,CAAC;AAEhC,0EAA0E;AAC1E,MAAM,kBAAkB,GAAG,GAAG,CAAC,CAAC,aAAa;AAC7C,MAAM,mBAAmB,GAAG,OAAO,CAAC,CAAC,SAAS;AAE9C;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAc,EACd,MAAmB,EACnB,OAAgD;IAEhD,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACzD,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,MAAM,WAAW,GAAG,SAAS,CAC3B;QACE,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,SAAS;QACpB,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,eAAe,EAAE;QACtB,KAAK,EAAE,OAAO,EAAE,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,EACD,MAAM,CAAC,YAAY,CACpB,CAAC;IAEF,MAAM,YAAY,GAAG,SAAS,CAC5B;QACE,GAAG,EAAE,MAAM;QACX,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,UAAU;QACrB,GAAG,EAAE,SAAS;QACd,GAAG,EAAE,eAAe,EAAE;QACtB,KAAK,EAAE,OAAO,EAAE,KAAK;QACrB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACrD,EACD,MAAM,CAAC,aAAa,CACrB,CAAC;IAEF,OAAO;QACL,WAAW;QACX,YAAY;QACZ,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,QAAQ;KACpB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAe,EACf,MAAmB;IAEnB,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;AACnE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAe,EACf,MAAmB;IAEnB,OAAO,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAChC,YAAsB,EACtB,MAAmB,EACnB,OAAgD;IAEhD,MAAM,MAAM,GAAG,kBAAkB,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAElD,OAAO,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE;QACjD,KAAK,EAAE,OAAO,EAAE,KAAK,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK;KAC9C,CAAC,CAAC;AACL,CAAC"}

package/dist/authToken/authToken.revocation.d.ts

@@ -0,0 +1,17 @@
+/**
+ * In-memory token revocation store.
+ *
+ * @module authToken/authToken.revocation
+ *
+ * Good for development and single-process deployments. For production,
+ * implement TokenRevocationStore with Redis or a database so revocations
+ * are shared across instances.
+ */
+import type { TokenRevocationStore } from "../authTypes/authToken.type.js";
+/**
+ * Create an in-memory token revocation store.
+ *
+ * Entries are purged lazily once their token would have expired anyway.
+ */
+export declare function createMemoryTokenRevocationStore(): TokenRevocationStore;
+//# sourceMappingURL=authToken.revocation.d.ts.map

package/dist/authToken/authToken.revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authToken.revocation.d.ts","sourceRoot":"","sources":["../../src/authToken/authToken.revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAEV,oBAAoB,EACrB,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,wBAAgB,gCAAgC,IAAI,oBAAoB,CAuBvE"}

package/dist/authToken/authToken.revocation.js

@@ -0,0 +1,36 @@
+/**
+ * In-memory token revocation store.
+ *
+ * @module authToken/authToken.revocation
+ *
+ * Good for development and single-process deployments. For production,
+ * implement TokenRevocationStore with Redis or a database so revocations
+ * are shared across instances.
+ */
+/**
+ * Create an in-memory token revocation store.
+ *
+ * Entries are purged lazily once their token would have expired anyway.
+ */
+export function createMemoryTokenRevocationStore() {
+    const revoked = new Map();
+    function purgeExpired() {
+        const now = Math.floor(Date.now() / 1000);
+        for (const [id, expiresAt] of revoked) {
+            if (expiresAt < now) {
+                revoked.delete(id);
+            }
+        }
+    }
+    return {
+        async revoke(tokenId, expiresAt) {
+            purgeExpired();
+            revoked.set(tokenId, expiresAt);
+        },
+        async isRevoked(tokenId) {
+            purgeExpired();
+            return revoked.has(tokenId);
+        },
+    };
+}
+//# sourceMappingURL=authToken.revocation.js.map

package/dist/authToken/authToken.revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authToken.revocation.js","sourceRoot":"","sources":["../../src/authToken/authToken.revocation.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH;;;;GAIG;AACH,MAAM,UAAU,gCAAgC;IAC9C,MAAM,OAAO,GAAG,IAAI,GAAG,EAAmB,CAAC;IAE3C,SAAS,YAAY;QACnB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,KAAK,MAAM,CAAC,EAAE,EAAE,SAAS,CAAC,IAAI,OAAO,EAAE,CAAC;YACtC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YACrB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,MAAM,CAAC,OAAgB,EAAE,SAAiB;YAC9C,YAAY,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAClC,CAAC;QAED,KAAK,CAAC,SAAS,CAAC,OAAgB;YAC9B,YAAY,EAAE,CAAC;YACf,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/authToken/authToken.signing.d.ts

@@ -11,7 +11,8 @@ import type { JwtToken, TokenId, TokenPayload, TokenConfig, TokenVerificationRes
  */
 export declare function signToken(payload: TokenPayload, secret: string): JwtToken;
 /**
- * Verify a JWT token's signature, expiration, and type.
+ * Verify a JWT token's signature, algorithm, expiration, type,
+ * and (when configured) issuer and audience.
  */
 export declare function verifyToken(token: JwtToken, secret: string, expectedType: "access" | "refresh", config: TokenConfig): TokenVerificationResult;
 /**

package/dist/authToken/authToken.signing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authToken.signing.d.ts","sourceRoot":"","sources":["../../src/authToken/authToken.signing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,WAAW,EACX,uBAAuB,EACxB,MAAM,gCAAgC,CAAC;AAKxC;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAQzE;AAED;;GAEG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,QAAQ,GAAG,SAAS,EAClC,MAAM,EAAE,WAAW,GAClB,uBAAuB,CA0CzB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}
+{"version":3,"file":"authToken.signing.d.ts","sourceRoot":"","sources":["../../src/authToken/authToken.signing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,OAAO,KAAK,EACV,QAAQ,EACR,OAAO,EACP,YAAY,EACZ,WAAW,EACX,uBAAuB,EACxB,MAAM,gCAAgC,CAAC;AAKxC;;GAEG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CAQzE;AAED;;;GAGG;AACH,wBAAgB,WAAW,CACzB,KAAK,EAAE,QAAQ,EACf,MAAM,EAAE,MAAM,EACd,YAAY,EAAE,QAAQ,GAAG,SAAS,EAClC,MAAM,EAAE,WAAW,GAClB,uBAAuB,CA6DzB;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAEzC"}

package/dist/authToken/authToken.signing.js

@@ -20,7 +20,8 @@ export function signToken(payload, secret) {
     return `${signatureInput}.${signature}`;
 }
 /**
- * Verify a JWT token's signature, expiration, and type.
+ * Verify a JWT token's signature, algorithm, expiration, type,
+ * and (when configured) issuer and audience.
  */
 export function verifyToken(token, secret, expectedType, config) {
     const parts = token.split(".");
@@ -28,10 +29,20 @@ export function verifyToken(token, secret, expectedType, config) {
         return { valid: false, error: "Invalid token format" };
     }
     const [headerB64, bodyB64, signature] = parts;
+    let header;
+    try {
+        header = JSON.parse(base64UrlDecode(headerB64));
+    }
+    catch {
+        return { valid: false, error: "Invalid header" };
+    }
+    if (header.alg !== ALGORITHM) {
+        return { valid: false, error: "Unsupported algorithm" };
+    }
     const signatureInput = `${headerB64}.${bodyB64}`;
     const expectedSignature = hmacSha256(signatureInput, secret);
-    const sigBuffer = Buffer.from(signature ?? "", "hex");
-    const expectedBuffer = Buffer.from(expectedSignature, "hex");
+    const sigBuffer = Buffer.from(signature ?? "", "base64url");
+    const expectedBuffer = Buffer.from(expectedSignature, "base64url");
     if (sigBuffer.length !== expectedBuffer.length ||
         !timingSafeEqual(sigBuffer, expectedBuffer)) {
         return { valid: false, error: "Invalid signature" };
@@ -44,6 +55,9 @@ export function verifyToken(token, secret, expectedType, config) {
         return { valid: false, error: "Invalid payload" };
     }
     const now = Math.floor(Date.now() / 1000);
+    if (typeof payload.exp !== "number") {
+        return { valid: false, error: "Missing expiration" };
+    }
     if (payload.exp < now) {
         return { valid: false, error: "Token expired" };
     }
@@ -53,6 +67,9 @@ export function verifyToken(token, secret, expectedType, config) {
     if (config.issuer && payload.iss !== config.issuer) {
         return { valid: false, error: "Invalid issuer" };
     }
+    if (config.audience && payload.aud !== config.audience) {
+        return { valid: false, error: "Invalid audience" };
+    }
     return { valid: true, payload };
 }
 /**
@@ -63,25 +80,12 @@ export function generateTokenId() {
 }
 // ─── Internal helpers ─────────────────────────────────────────────────────
 function hmacSha256(data, secret) {
-    return createHmac("sha256", secret).update(data).digest("hex");
+    return createHmac("sha256", secret).update(data).digest("base64url");
 }
 function base64UrlEncode(data) {
-    const encoded = Buffer.from(data).toString("base64");
-    let result = "";
-    for (let i = 0; i < encoded.length; i++) {
-        const char = encoded[i];
-        if (char === "+")
-            result += "-";
-        else if (char === "/")
-            result += "_";
-        else if (char !== "=")
-            result += char;
-    }
-    return result;
+    return Buffer.from(data, "utf-8").toString("base64url");
 }
 function base64UrlDecode(data) {
-    const padded = data.replace(/-/g, "+").replace(/_/g, "/");
-    const padLength = (4 - (padded.length % 4)) % 4;
-    return Buffer.from(padded + "=".repeat(padLength), "base64").toString("utf-8");
+    return Buffer.from(data, "base64url").toString("utf-8");
 }
 //# sourceMappingURL=authToken.signing.js.map

package/dist/authToken/authToken.signing.js.map

@@ -1 +1 @@
-{"version":3,"file":"authToken.signing.js","sourceRoot":"","sources":["../../src/authToken/authToken.signing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,8BAA8B;AAC9B,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,eAAe,CAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAC/C,CAAC;IACF,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CACzB,KAAe,EACf,MAAc,EACd,YAAkC,EAClC,MAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAC9C,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACjD,MAAM,iBAAiB,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,CAAC,CAAC;IAE7D,IACE,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC1C,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAQ,CAAC,CAAiB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAY,CAAC;AACpD,CAAC;AAED,6EAA6E;AAE7E,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QACxB,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,GAAG,CAAC;aAC3B,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,GAAG,CAAC;aAChC,IAAI,IAAI,KAAK,GAAG;YAAE,MAAM,IAAI,IAAI,CAAC;IACxC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1D,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CACnE,OAAO,CACR,CAAC;AACJ,CAAC"}
+{"version":3,"file":"authToken.signing.js","sourceRoot":"","sources":["../../src/authToken/authToken.signing.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAS1C,8BAA8B;AAC9B,MAAM,SAAS,GAAG,OAAO,CAAC;AAE1B;;GAEG;AACH,MAAM,UAAU,SAAS,CAAC,OAAqB,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,eAAe,CAC5B,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAC/C,CAAC;IACF,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,GAAG,MAAM,IAAI,IAAI,EAAE,CAAC;IAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IACrD,OAAO,GAAG,cAAc,IAAI,SAAS,EAAE,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,KAAe,EACf,MAAc,EACd,YAAkC,EAClC,MAAmB;IAEnB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,CAAC,GAAG,KAAK,CAAC;IAE9C,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,SAAU,CAAC,CAAqB,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,uBAAuB,EAAE,CAAC;IAC1D,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,SAAS,IAAI,OAAO,EAAE,CAAC;IACjD,MAAM,iBAAiB,GAAG,UAAU,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC;IAE7D,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,EAAE,WAAW,CAAC,CAAC;IAC5D,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;IAEnE,IACE,SAAS,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC1C,CAAC,eAAe,CAAC,SAAS,EAAE,cAAc,CAAC,EAC3C,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC;IACtD,CAAC;IAED,IAAI,OAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,OAAQ,CAAC,CAAiB,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC;IACpD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAE1C,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oBAAoB,EAAE,CAAC;IACvD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,GAAG,GAAG,EAAE,CAAC;QACtB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,CAAC;IAClD,CAAC;IAED,IAAI,OAAO,CAAC,GAAG,KAAK,YAAY,EAAE,CAAC;QACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,YAAY,QAAQ,EAAE,CAAC;IACnE,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM,EAAE,CAAC;QACnD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC;IACnD,CAAC;IAED,IAAI,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;IACrD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe;IAC7B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAY,CAAC;AACpD,CAAC;AAED,6EAA6E;AAE7E,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC1D,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC1D,CAAC"}