glasswork 1.0.1 → 1.1.0

package/CHANGELOG.md

@@ -9,11 +9,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+- **`glasswork/rls`** — PostgreSQL tenant isolation through Prisma Client Extensions, AsyncLocalStorage, Hono middleware, and a policy generator; includes transaction-scoped context, explicit bypass, and PostgreSQL integration tests.
+
 - **`parseFilterLiteral`**, **`parseFilterValue`**, **`parseWhereFilterValues`** — centralized filter value parsing for query params and Prisma `where` clauses
 - **`filter-value-schemas`** — Valibot operand schemas with transforms for typed Prisma filters
+- **`executePrismaList`** — direct execution of `findMany`, `count`, and optional `groupBy` aggregations on any Prisma model delegate, with optional `map` row-transformation callback
+- **`createPrismaListExecutor` row mapping** — added optional `map: (item: TItem) => TResult` callback to transform raw Prisma records into domain models or DTOs
+- **Virtual filter mapping (`mapFilters`)** — transform virtual/composite API filter fields into real database columns prior to search and scope merging; includes `mapPresenceFilter`, `mapBooleanFilter`, `mapValueFilter`, `renameFilter`, `nestFilter`, and `composeFilterMappers`
+- **Sort mapping (`mapSorts`)** — transform public API sort fields to nested relation paths (`'user.name'`) or custom sort clauses via `nestSort`, `renameSort`, or custom mapper functions in `createListQuery`
+- **`glasswork/audit`** — impersonation-aware auditing subsystem with ambient actor and tenant resolution, pluggable `AuditSink<TTx>` transactional sinks, and dual-logging
 
 ### Changed
 
+- Build and typecheck with stable TypeScript 7.0.2; verify published declarations and route inference with TypeScript 5.9, 6, and 7 in isolated npm consumers.
+- Update development dependencies, including Biome 2.5, AWS SDK clients, Hono, CASL, MJML, and documentation tooling. Keep Prisma on stable 7.10 and Vitest on the latest 4.x release compatible with Better Auth's testing peer range.
+- Add Node.js 26 to the CI test matrix alongside Node.js 20, 22, and 24; check packed-package imports and types on Node.js 20.
+- Make `ListQuerySchema` strict and bounded; malformed pagination, oversized strings, and unknown query parameters now return 422 instead of being clamped or ignored.
+- Reject unknown list-query filter fields, filter operators, and sort fields; validate date operands as existing calendar dates.
 - Typed filter schemas (`dateFilterSchema`, `intFilterSchema`, `numberFilterSchema`, `booleanFilterSchema`) parse string operands to Prisma types via Valibot transforms
 - `parseWhereFilterValues` reuses those schemas with `parse()` instead of custom coercion logic
 - List-query `where` deep copy uses `structuredClone` so parsed `Date` values are preserved

package/README.md

@@ -170,12 +170,44 @@ export default app; // Ready for Lambda or local server
 ## Requirements
 
 - Node.js 20+
-- TypeScript 5+
+- TypeScript 5.9, 6, or 7 (verified against the published declarations)
 
 ## Contributing
 
 Glasswork is in active development. Feedback, issues, and contributions are welcome!
 
+Builds and typechecks use stable TypeScript 7. Vitest stays on the latest 4.x
+release to remain compatible with Better Auth's testing peer range. CI runs the
+full test suite on Node.js 20, 22, 24, and 26, and checks the packed package's
+TypeScript 5.9, 6, and 7 consumer inference on Node.js 20.
+
+The repository can be developed and verified independently with npm:
+
+```sh
+npm ci
+npm run verify
+npm run docs:build
+```
+
+`npm run smoke:pack` installs the tarball in an isolated npm project, checks its
+published types, and imports its public entry points. Set `TYPESCRIPT_VERSION`
+to test another supported compiler, for example
+`TYPESCRIPT_VERSION=5.9.3 npm run smoke:pack` after building. Prisma's development
+tooling requires Node.js 20.19+, 22.12+, or 24+ on the respective supported lines.
+
+The RLS integration suite creates a temporary schema and restricted role in an
+existing PostgreSQL **test database**, then removes them afterwards. Set
+`RLS_TEST_DATABASE_URL` to a test administrator connection allowed to create schemas
+and roles; the actual isolation checks run as the restricted role:
+
+```sh
+RLS_TEST_DATABASE_URL=postgresql://test_admin:password@localhost:5432/test_db npm run verify
+```
+
+Without this variable, the PostgreSQL suite is skipped. CI sets it for both tests
+and coverage. To run coverage locally, use the same variable with
+`npm run test:coverage`.
+
 ## License
 
 MIT
@@ -191,5 +223,5 @@ MIT
 [build-href]: https://github.com/rolandboon/glasswork/actions/workflows/ci.yml
 [license-src]: https://img.shields.io/github/license/rolandboon/glasswork.svg?flat&colorA=1b1b1f&colorB=3e63dd
 [license-href]: https://opensource.org/licenses/MIT
-[type-script-src]: https://img.shields.io/badge/TypeScript-5.0%2B-blue?style=flat&labelColor=1b1b1f&color=3e63dd
+[type-script-src]: https://img.shields.io/badge/TypeScript-5.9%20%7C%206%20%7C%207-blue?style=flat&labelColor=1b1b1f&color=3e63dd
 [type-script-href]: https://www.typescriptlang.org/

package/dist/audit/audit-logger.d.ts

@@ -0,0 +1,22 @@
+import type { Logger } from '../utils/logger.js';
+import type { AuditingLogger, AuditRecordInput, AuditSink } from './types.js';
+export interface CreateAuditLoggerOptions<TTx = unknown> {
+    /** Persistence sink for audit records */
+    sink: AuditSink<TTx>;
+    /** Underlying logger (e.g. Pino logger) */
+    logger: Logger;
+    /** Service name to tag audit events with */
+    service?: string;
+    /** Custom formatter for the structured log payload */
+    formatLogPayload?: (record: AuditRecordInput) => Record<string, unknown>;
+}
+/**
+ * Creates an AuditingLogger that combines structured logging with persistence via an AuditSink.
+ *
+ * Each call to `logger.audit(message, entry, options)`:
+ * 1. Resolves ambient request context (actor, impersonation, tenant, correlation ID).
+ * 2. Emits a structured log (`audit: true` with audit attributes) via the underlying logger.
+ * 3. Persists the resolved audit record atomically using the provided sink.
+ */
+export declare function createAuditLogger<TTx = unknown>(options: CreateAuditLoggerOptions<TTx>): AuditingLogger<TTx>;
+//# sourceMappingURL=audit-logger.d.ts.map

package/dist/audit/audit-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.d.ts","sourceRoot":"","sources":["../../src/audit/audit-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,KAAK,EAAmB,cAAc,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE/F,MAAM,WAAW,wBAAwB,CAAC,GAAG,GAAG,OAAO;IACrD,yCAAyC;IACzC,IAAI,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC;IACrB,2CAA2C;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,CAAC,MAAM,EAAE,gBAAgB,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1E;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,GAAG,OAAO,EAC7C,OAAO,EAAE,wBAAwB,CAAC,GAAG,CAAC,GACrC,cAAc,CAAC,GAAG,CAAC,CA6CrB"}

package/dist/audit/audit-logger.js

@@ -0,0 +1,44 @@
+import { resolveAuditRecord } from './context.js';
+/**
+ * Creates an AuditingLogger that combines structured logging with persistence via an AuditSink.
+ *
+ * Each call to `logger.audit(message, entry, options)`:
+ * 1. Resolves ambient request context (actor, impersonation, tenant, correlation ID).
+ * 2. Emits a structured log (`audit: true` with audit attributes) via the underlying logger.
+ * 3. Persists the resolved audit record atomically using the provided sink.
+ */
+export function createAuditLogger(options) {
+    const { sink, logger, service, formatLogPayload } = options;
+    const audit = async (message, entry, auditOptions) => {
+        const record = resolveAuditRecord({
+            ...entry,
+            message: entry.message ?? message,
+        }, service);
+        const logPayload = formatLogPayload
+            ? formatLogPayload(record)
+            : {
+                audit: true,
+                action: record.action,
+                category: record.category,
+                subjectType: record.subjectType,
+                subjectId: record.subjectId,
+                actorUserId: record.actorUserId,
+                effectiveUserId: record.effectiveUserId,
+                isImpersonating: record.isImpersonating,
+                tenantId: record.tenantId,
+                service: record.service,
+                metadata: record.metadata,
+            };
+        logger.info(message, logPayload);
+        await sink.record(record, auditOptions);
+    };
+    return {
+        debug: logger.debug.bind(logger),
+        info: logger.info.bind(logger),
+        warn: logger.warn.bind(logger),
+        error: logger.error.bind(logger),
+        child: logger.child?.bind(logger),
+        audit,
+    };
+}
+//# sourceMappingURL=audit-logger.js.map

package/dist/audit/audit-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit-logger.js","sourceRoot":"","sources":["../../src/audit/audit-logger.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAclD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsC;IAEtC,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,GAAG,OAAO,CAAC;IAE5D,MAAM,KAAK,GAAG,KAAK,EACjB,OAAe,EACf,KAAsB,EACtB,YAA2B,EACZ,EAAE;QACjB,MAAM,MAAM,GAAG,kBAAkB,CAC/B;YACE,GAAG,KAAK;YACR,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO;SAClC,EACD,OAAO,CACR,CAAC;QAEF,MAAM,UAAU,GAAG,gBAAgB;YACjC,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;YAC1B,CAAC,CAAC;gBACE,KAAK,EAAE,IAAI;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;aAC1B,CAAC;QAEN,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAEjC,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC1C,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC;QAC9B,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC;QAChC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QACjC,KAAK;KACN,CAAC;AACJ,CAAC"}

package/dist/audit/context.d.ts

@@ -0,0 +1,13 @@
+import type { AuditContext, AuditEntryInput, AuditRecordInput } from './types.js';
+/**
+ * Get contextual information about the current actor and request for auditing.
+ * Returns undefined if called outside an authenticated request lifecycle.
+ */
+export declare function getAuditContext(): AuditContext | undefined;
+/**
+ * Resolve an audit entry input with ambient request context to produce a complete AuditRecordInput.
+ *
+ * @throws Error if no actorUserId can be resolved from either the entry or the request context.
+ */
+export declare function resolveAuditRecord(entry: AuditEntryInput, service?: string): AuditRecordInput;
+//# sourceMappingURL=context.d.ts.map

package/dist/audit/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/audit/context.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAElF;;;GAGG;AACH,wBAAgB,eAAe,IAAI,YAAY,GAAG,SAAS,CAU1D;AAyCD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,gBAAgB,CAgB7F"}

package/dist/audit/context.js

@@ -0,0 +1,66 @@
+import { getRequestActor, getRequestId } from '../observability/request-context.js';
+/**
+ * Get contextual information about the current actor and request for auditing.
+ * Returns undefined if called outside an authenticated request lifecycle.
+ */
+export function getAuditContext() {
+    const actor = getRequestActor();
+    if (!actor?.actorUserId)
+        return undefined;
+    return {
+        actorUserId: actor.actorUserId,
+        effectiveUserId: actor.effectiveUserId,
+        isImpersonating: actor.isImpersonating,
+        tenantId: actor.tenantId,
+        requestId: getRequestId(),
+    };
+}
+function resolveActor(entry, ctx) {
+    if (ctx?.isImpersonating) {
+        return {
+            actorUserId: ctx.actorUserId,
+            effectiveUserId: ctx.effectiveUserId ?? null,
+            isImpersonating: Boolean(ctx.effectiveUserId && ctx.effectiveUserId !== ctx.actorUserId),
+            tenantId: ctx.tenantId ?? entry.tenantId ?? null,
+        };
+    }
+    const actorUserId = entry.actorUserId ?? ctx?.actorUserId;
+    if (!actorUserId) {
+        throw new Error(`Audit entry '${entry.action}' requires an actorUserId, but none was provided or available in request context`);
+    }
+    const effectiveUserId = entry.effectiveUserId ?? ctx?.effectiveUserId ?? null;
+    return {
+        actorUserId,
+        effectiveUserId,
+        isImpersonating: Boolean(effectiveUserId && effectiveUserId !== actorUserId),
+        tenantId: entry.tenantId ?? ctx?.tenantId ?? null,
+    };
+}
+function formatAuditMessage(entry) {
+    if (entry.message)
+        return entry.message;
+    const target = entry.subjectId ? ` ${entry.subjectId}` : '';
+    return `Audit: ${entry.action} on ${entry.subjectType}${target}`;
+}
+/**
+ * Resolve an audit entry input with ambient request context to produce a complete AuditRecordInput.
+ *
+ * @throws Error if no actorUserId can be resolved from either the entry or the request context.
+ */
+export function resolveAuditRecord(entry, service) {
+    const ctx = getAuditContext();
+    const actors = resolveActor(entry, ctx);
+    return {
+        ...actors,
+        requestId: ctx?.requestId ?? null,
+        action: entry.action,
+        category: entry.category ?? 'DATA',
+        subjectType: entry.subjectType,
+        subjectId: entry.subjectId ?? null,
+        message: formatAuditMessage(entry),
+        metadata: entry.metadata ?? null,
+        service: service ?? null,
+        createdAt: new Date(),
+    };
+}
+//# sourceMappingURL=context.js.map

package/dist/audit/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../src/audit/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,qCAAqC,CAAC;AAGpF;;;GAGG;AACH,MAAM,UAAU,eAAe;IAC7B,MAAM,KAAK,GAAG,eAAe,EAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,WAAW;QAAE,OAAO,SAAS,CAAC;IAC1C,OAAO;QACL,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,eAAe,EAAE,KAAK,CAAC,eAAe;QACtC,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,YAAY,EAAE;KAC1B,CAAC;AACJ,CAAC;AASD,SAAS,YAAY,CAAC,KAAsB,EAAE,GAAkB;IAC9D,IAAI,GAAG,EAAE,eAAe,EAAE,CAAC;QACzB,OAAO;YACL,WAAW,EAAE,GAAG,CAAC,WAAW;YAC5B,eAAe,EAAE,GAAG,CAAC,eAAe,IAAI,IAAI;YAC5C,eAAe,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,eAAe,KAAK,GAAG,CAAC,WAAW,CAAC;YACxF,QAAQ,EAAE,GAAG,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,IAAI;SACjD,CAAC;IACJ,CAAC;IAED,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,GAAG,EAAE,WAAW,CAAC;IAC1D,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CACb,gBAAgB,KAAK,CAAC,MAAM,kFAAkF,CAC/G,CAAC;IACJ,CAAC;IAED,MAAM,eAAe,GAAG,KAAK,CAAC,eAAe,IAAI,GAAG,EAAE,eAAe,IAAI,IAAI,CAAC;IAC9E,OAAO;QACL,WAAW;QACX,eAAe;QACf,eAAe,EAAE,OAAO,CAAC,eAAe,IAAI,eAAe,KAAK,WAAW,CAAC;QAC5E,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,GAAG,EAAE,QAAQ,IAAI,IAAI;KAClD,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAsB;IAChD,IAAI,KAAK,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACxC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,OAAO,UAAU,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,WAAW,GAAG,MAAM,EAAE,CAAC;AACnE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAsB,EAAE,OAAgB;IACzE,MAAM,GAAG,GAAG,eAAe,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAExC,OAAO;QACL,GAAG,MAAM;QACT,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;QACjC,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,MAAM;QAClC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,OAAO,EAAE,kBAAkB,CAAC,KAAK,CAAC;QAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,OAAO,IAAI,IAAI;QACxB,SAAS,EAAE,IAAI,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC"}

package/dist/audit/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * @module glasswork/audit
+ * Audit logging, impersonation correlation, and audit sink abstraction.
+ */
+export { type CreateAuditLoggerOptions, createAuditLogger, } from './audit-logger.js';
+export { getAuditContext, resolveAuditRecord } from './context.js';
+export type { AuditContext, AuditEntryInput, AuditingLogger, AuditRecordInput, AuditSink, } from './types.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/audit/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,KAAK,wBAAwB,EAC7B,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EACV,YAAY,EACZ,eAAe,EACf,cAAc,EACd,gBAAgB,EAChB,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/audit/index.js

@@ -0,0 +1,7 @@
+/**
+ * @module glasswork/audit
+ * Audit logging, impersonation correlation, and audit sink abstraction.
+ */
+export { createAuditLogger, } from './audit-logger.js';
+export { getAuditContext, resolveAuditRecord } from './context.js';
+//# sourceMappingURL=index.js.map

package/dist/audit/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/audit/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAEL,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC"}

package/dist/audit/types.d.ts

@@ -0,0 +1,74 @@
+import type { Logger } from '../utils/logger.js';
+/**
+ * Contextual information about the actor and request for an audit event.
+ */
+export interface AuditContext {
+    /** Physical authenticated user who initiated the request */
+    actorUserId: string;
+    /** Effective user identity when acting via impersonation */
+    effectiveUserId?: string;
+    /** Whether the request is being executed via impersonation */
+    isImpersonating: boolean;
+    /** Tenant / organization identifier */
+    tenantId?: string;
+    /** Request identifier for distributed correlation */
+    requestId?: string;
+}
+/**
+ * Input for creating an audit event from business logic.
+ */
+export interface AuditEntryInput {
+    /** Unique action identifier (e.g. 'poll.create', 'member.archive') */
+    action: string;
+    /** Audit category (defaults to 'DATA') */
+    category?: string;
+    /** Target entity type (e.g. 'Poll', 'User', 'MedicalGroup') */
+    subjectType: string;
+    /** Target entity ID */
+    subjectId?: string | null;
+    /** Human-readable description of the event */
+    message?: string;
+    /** Additional structured metadata or changed fields */
+    metadata?: Record<string, unknown> | null;
+    /** Explicit actor override (e.g. for background jobs / seeders) */
+    actorUserId?: string | null;
+    /** Explicit effective user override */
+    effectiveUserId?: string | null;
+    /** Explicit tenant override */
+    tenantId?: string | null;
+}
+/**
+ * Fully resolved audit record ready for persistence and structured logging.
+ */
+export interface AuditRecordInput {
+    actorUserId: string;
+    effectiveUserId: string | null;
+    isImpersonating: boolean;
+    tenantId: string | null;
+    requestId: string | null;
+    action: string;
+    category: string;
+    subjectType: string;
+    subjectId: string | null;
+    message: string;
+    metadata: Record<string, unknown> | null;
+    service: string | null;
+    createdAt: Date;
+}
+/**
+ * Pluggable persistence sink for audit records (e.g. Prisma, DynamoDB, CloudWatch).
+ */
+export interface AuditSink<TTx = unknown> {
+    record(entry: AuditRecordInput, options?: {
+        tx?: TTx;
+    }): Promise<void>;
+}
+/**
+ * Logger extended with an `.audit()` method that writes structured logs and persists via a sink.
+ */
+export type AuditingLogger<TTx = unknown> = Logger & {
+    audit(message: string, entry: AuditEntryInput, options?: {
+        tx?: TTx;
+    }): Promise<void>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/audit/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,4DAA4D;IAC5D,WAAW,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8DAA8D;IAC9D,eAAe,EAAE,OAAO,CAAC;IACzB,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qDAAqD;IACrD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;IACf,0CAA0C;IAC1C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,+DAA+D;IAC/D,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB;IACvB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,8CAA8C;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uDAAuD;IACvD,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1C,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,uCAAuC;IACvC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,+BAA+B;IAC/B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IACzC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,SAAS,CAAC,GAAG,GAAG,OAAO;IACtC,MAAM,CAAC,KAAK,EAAE,gBAAgB,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,MAAM,cAAc,CAAC,GAAG,GAAG,OAAO,IAAI,MAAM,GAAG;IACnD,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,OAAO,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE,GAAG,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACvF,CAAC"}

package/dist/audit/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/audit/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/audit/types.ts"],"names":[],"mappings":""}

package/dist/auth/abilities.d.ts

@@ -24,7 +24,7 @@ export type AuthorizedAbility<TActions extends string, TSubjects extends string>
  *
  * const ability = defineAbility(currentUser);
  */
-export declare function createAbilityFactory<TSubjects extends string, TActions extends string = 'create' | 'read' | 'update' | 'delete' | 'manage'>(): (define: (can: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>["can"], cannot: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>["cannot"], user: AuthUser) => void) => (user: AuthUser) => AuthorizedAbility<TActions, TSubjects>;
+export declare function createAbilityFactory<TSubjects extends string, TActions extends string = 'create' | 'read' | 'update' | 'delete' | 'manage'>(): (define: (can: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>['can'], cannot: AbilityBuilder<AuthorizedAbility<TActions, TSubjects>>['cannot'], user: AuthUser) => void) => (user: AuthUser) => AuthorizedAbility<TActions, TSubjects>;
 /**
  * Define abilities using a declarative role-based configuration.
  */

package/dist/auth/abilities.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.d.ts","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,MAAM,EAAE,SAAS,SAAS,MAAM,IAAI,aAAa,CAC9F;IAAC,QAAQ;IAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;CAAC,CACjD,GAAG;IACF,SAAS,EAAE,CACT,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,KACb,IAAI,CAAC;CACX,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,MAK1E,QAAQ,CACN,GAAG,EAAE,cAAc,wCAAY,CAAC,KAAK,CAAC,EACtC,MAAM,EAAE,cAAc,wCAAY,CAAC,QAAQ,CAAC,EAC5C,IAAI,EAAE,QAAQ,KACX,IAAI,MAED,MAAM,QAAQ,4CAOzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,EACvB,MAAM,SAAS,MAAM,EAErB,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,CAAC,GAAG,EAAE;IACJ,GAAG,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,EAAE,cAAc,CACpB,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE,CAAC,QAAQ,CAAC,CAAC;IACZ,IAAI,EAAE,QAAQ,CAAC;CAChB,KAAK,IAAI,CACX;cAKW,QAAQ;IAelB,4DAA4D;kBAC9C,MAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC;EAIhD;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC"}
+{"version":3,"file":"abilities.d.ts","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AACnE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAE3C;;GAEG;AACH,MAAM,MAAM,iBAAiB,CAAC,QAAQ,SAAS,MAAM,EAAE,SAAS,SAAS,MAAM,IAAI,aAAa,CAC9F;IAAC,QAAQ;IAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC;CAAC,CACjD,GAAG;IACF,SAAS,EAAE,CACT,MAAM,EAAE,QAAQ,EAChB,OAAO,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,EAC7C,OAAO,CAAC,EAAE,MAAM,KACb,IAAI,CAAC;CACX,CAAC;AAqBF;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,cAKlE,CACN,GAAG,EAAE,cAAc,wCAAY,CAAC,KAAK,CAAC,EACtC,MAAM,EAAE,cAAc,wCAAY,CAAC,QAAQ,CAAC,EAC5C,IAAI,EAAE,QAAQ,KACX,IAAI,YAEK,QAAQ,4CAOzB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,SAAS,SAAS,MAAM,EACxB,QAAQ,SAAS,MAAM,EACvB,MAAM,SAAS,MAAM,EAErB,MAAM,EAAE,MAAM,CACZ,MAAM,EACN,CAAC,GAAG,EAAE;IACJ,GAAG,EAAE,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC5F,MAAM,EAAE,cAAc,CACpB,aAAa,CAAC,CAAC,QAAQ,EAAE,SAAS,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,CAChE,CAAC,QAAQ,CAAC,CAAC;IACZ,IAAI,EAAE,QAAQ,CAAC;CAChB,KAAK,IAAI,CACX;IAKC,GAAG,OAAO,QAAQ;IAelB,4DAA4D;IAC5D,OAAO,OAAO,MAAM,SAAQ,OAAO,CAAC,QAAQ,CAAC;EAIhD;AAED;;GAEG;AACH,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,KAAK,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC"}

package/dist/auth/abilities.js.map

@@ -1 +1 @@
-{"version":3,"file":"abilities.js","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAgB3D,SAAS,eAAe,CACtB,OAAwE;IAExE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,SAAS,CACP,MAAgB,EAChB,OAA6C,EAC7C,OAAgB;YAEhB,sHAAsH;YACtH,IAAI,CAAE,OAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,OAAO,IAAI,gCAAgC,MAAM,gBAAgB,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAA2C,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB;IAMlC,OAAO,SAAS,aAAa,CAC3B,MAIS;QAET,OAAO,CAAC,IAAc,EAAc,EAAE;YACpC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAAa,mBAAmB,CAAC,CAAC;YACnF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAKjC,MASC;IAID,OAAO;QACL,GAAG,CAAC,IAAc;YAChB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAE/C,mBAAmB,CAAC,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;YAE/C,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAED,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,IAAY,EAAE,OAA0B,EAAE;YAChD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,EAAc,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"abilities.js","sourceRoot":"","sources":["../../src/auth/abilities.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAsB,MAAM,eAAe,CAAC;AAEnE,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAgB3D,SAAS,eAAe,CACtB,OAAwE;IAExE,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE;QAC5B,SAAS,CACP,MAAgB,EAChB,OAA6C,EAC7C,OAAgB;YAEhB,sHAAsH;YACtH,IAAI,CAAE,OAAe,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;gBAC3C,MAAM,IAAI,kBAAkB,CAC1B,OAAO,IAAI,gCAAgC,MAAM,gBAAgB,CAClE,CAAC;YACJ,CAAC;QACH,CAAC;KACF,CAA2C,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB;IAMlC,OAAO,SAAS,aAAa,CAC3B,MAIS;QAET,OAAO,CAAC,IAAc,EAAc,EAAE;YACpC,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAAa,mBAAmB,CAAC,CAAC;YACnF,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC1B,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAKjC,MASC;IAID,OAAO;QACL,GAAG,CAAC,IAAc;YAChB,MAAM,mBAAmB,GAAG,uBAAuB,EAAE,CAAC;YACtD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI,cAAc,CAE/C,mBAAmB,CAAC,CAAC;YAEvB,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,IAAc,CAAC,CAAC;YAE/C,IAAI,UAAU,EAAE,CAAC;gBACf,UAAU,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACpC,CAAC;YAED,OAAO,eAAe,CAAC,KAAK,EAAE,CAAC,CAAC;QAClC,CAAC;QAED,4DAA4D;QAC5D,OAAO,CAAC,IAAY,EAAE,IAAI,GAAsB,EAAE;YAChD,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,IAAI,EAAc,CAAC,CAAC;QAC7D,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/better-auth-provider.d.ts

@@ -31,11 +31,11 @@ export interface BetterAuthClient {
     };
     handler?: (request: Request) => Promise<Response>;
 }
-export interface BetterAuthProviderConfig {
+export interface BetterAuthProviderConfig<TUser extends AuthUser = AuthUser> {
     /** better-auth client instance */
     auth: BetterAuthClient;
     /** Map better-auth user to AuthUser */
-    mapUser?: (user: Record<string, unknown>) => AuthUser;
+    mapUser?: (user: Record<string, unknown>) => TUser;
     /** Cookie name for session token (default: 'session') */
     cookieName?: string;
 }
@@ -51,6 +51,9 @@ interface BetterAuthSession {
 /**
  * Wrap better-auth as a Glasswork AuthProvider.
  */
-export declare function createBetterAuthProvider(config: BetterAuthProviderConfig): AuthProvider;
+export declare function createBetterAuthProvider<TUser extends AuthUser>(config: BetterAuthProviderConfig<TUser> & {
+    mapUser: (user: Record<string, unknown>) => TUser;
+}): AuthProvider<TUser>;
+export declare function createBetterAuthProvider(config: BetterAuthProviderConfig<AuthUser>): AuthProvider<AuthUser>;
 export {};
 //# sourceMappingURL=better-auth-provider.d.ts.map

package/dist/auth/better-auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC;YACrE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;YACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;SACvC,GAAG,IAAI,CAAC,CAAC;QACV,aAAa,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/E,YAAY,CAAC,EACT,CAAC,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAClE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YAClB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;aAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;KACR,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB;IACvC,kCAAkC;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uCAAuC;IACvC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,QAAQ,CAAC;IACtD,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,wBAAwB,GAAG,YAAY,CAgDvF"}
+{"version":3,"file":"better-auth-provider.d.ts","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAe,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,gBAAgB;IAC/B,GAAG,EAAE;QACH,UAAU,EAAE,CAAC,OAAO,EAAE;YAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC;YACrE,OAAO,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;YACnC,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;SACvC,GAAG,IAAI,CAAC,CAAC;QACV,aAAa,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,EAAE,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;QACpE,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC;gBAAC,QAAQ,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC3F,WAAW,CAAC,EAAE,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;QAC/E,YAAY,CAAC,EACT,CAAC,CAAC,OAAO,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,GAClE,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG;YAClB,QAAQ,CAAC,EAAE,CAAC,OAAO,EAAE;gBAAE,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;aAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;SAC9E,CAAC,CAAC;KACR,CAAC;IACF,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,wBAAwB,CAAC,KAAK,SAAS,QAAQ,GAAG,QAAQ;IACzE,kCAAkC;IAClC,IAAI,EAAE,gBAAgB,CAAC;IACvB,uCAAuC;IACvC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;IACnD,yDAAyD;IACzD,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,KAAK,SAAS,QAAQ,EAC7D,MAAM,EAAE,wBAAwB,CAAC,KAAK,CAAC,GAAG;IACxC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,CAAC;CACnD,GACA,YAAY,CAAC,KAAK,CAAC,CAAC;AACvB,wBAAgB,wBAAwB,CACtC,MAAM,EAAE,wBAAwB,CAAC,QAAQ,CAAC,GACzC,YAAY,CAAC,QAAQ,CAAC,CAAC"}

package/dist/auth/better-auth-provider.js

@@ -1,7 +1,4 @@
 const DEFAULT_COOKIE_NAME = 'session';
-/**
- * Wrap better-auth as a Glasswork AuthProvider.
- */
 export function createBetterAuthProvider(config) {
     const { auth, mapUser, cookieName = DEFAULT_COOKIE_NAME } = config;
     const defaultMapUser = (user) => ({
@@ -53,6 +50,7 @@ function mapSession(session) {
         expiresAt: toDate(session.expiresAt),
         createdAt: toDate(session.createdAt),
         lastAccessedAt: session.lastAccessedAt ? toDate(session.lastAccessedAt) : undefined,
+        impersonatedBy: typeof session.impersonatedBy === 'string' ? session.impersonatedBy : undefined,
         metadata: session,
     };
 }

package/dist/auth/better-auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth-provider.js","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAuCA,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAEtC;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAgC;IACvE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEnE,MAAM,cAAc,GAAG,CAAC,IAA6B,EAAY,EAAE,CAAC,CAAC;QACnE,GAAG,IAAI;QACP,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAG,IAAI,CAAC,IAAe,IAAI,MAAM;QACrC,QAAQ,EAAG,IAAI,CAAC,QAA+B,IAAK,IAAI,CAAC,cAAqC;KAC/F,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,aAAa;QAEnB,KAAK,CAAC,eAAe,CAAC,KAAa;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBACnC,IAAI,EAAE,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;YACvC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}
+{"version":3,"file":"better-auth-provider.js","sourceRoot":"","sources":["../../src/auth/better-auth-provider.ts"],"names":[],"mappings":"AAuCA,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAatC,MAAM,UAAU,wBAAwB,CACtC,MAA0C;IAE1C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,UAAU,GAAG,mBAAmB,EAAE,GAAG,MAAM,CAAC;IAEnE,MAAM,cAAc,GAAG,CAAC,IAA6B,EAAY,EAAE,CAAC,CAAC;QACnE,GAAG,IAAI;QACP,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC9D,IAAI,EAAG,IAAI,CAAC,IAAe,IAAI,MAAM;QACrC,QAAQ,EAAG,IAAI,CAAC,QAA+B,IAAK,IAAI,CAAC,cAAqC;KAC/F,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,aAAa;QAEnB,KAAK,CAAC,eAAe,CAAC,KAAa;YACjC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBAEH,IAAI,CAAC,MAAM,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;oBACrC,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,OAAO;oBACL,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC;oBACnC,IAAI,EAAE,CAAC,OAAO,IAAI,cAAc,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC/C,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QAED,KAAK,CAAC,iBAAiB,CAAC,SAAiB;YACvC,MAAM,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,CAAC,CAAC;QAC5D,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,KAAa;YAChC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;oBACvC,OAAO,EAAE,EAAE,MAAM,EAAE,GAAG,UAAU,IAAI,KAAK,EAAE,EAAE;iBAC9C,CAAC,CAAC;gBACH,OAAO,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA0B;IAC5C,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACtB,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;QAC9B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACpC,cAAc,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,SAAS;QACnF,cAAc,EAAE,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS;QAC/F,QAAQ,EAAE,OAAO;KAClB,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAoB;IAClC,OAAO,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC"}

package/dist/auth/index.d.ts

@@ -2,6 +2,6 @@ export { createAbilityFactory, defineRoleAbilities, type InferAbility, } from '.
 export { assertCan, can, subject } from './assert.js';
 export { type BetterAuthClient, type BetterAuthProviderConfig, createBetterAuthProvider, } from './better-auth-provider.js';
 export { type PrismaAbilityFactory, registerAuthCasl } from './casl-bridge.js';
-export { type AuthMiddlewareConfig, createAuthMiddleware, } from './middleware.js';
-export type { AuthContext, AuthProvider, AuthSession, AuthUser } from './types.js';
+export { type AuthAuthorizeConfig, type AuthMiddleware, type AuthMiddlewareConfig, createAuthMiddleware, } from './middleware.js';
+export type { AuthContext, AuthenticatedAuthContext, AuthProvider, AuthSession, AuthUser, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EACL,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,EACnB,KAAK,YAAY,GAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EACL,KAAK,gBAAgB,EACrB,KAAK,wBAAwB,EAC7B,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,KAAK,oBAAoB,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,KAAK,oBAAoB,EACzB,oBAAoB,GACrB,MAAM,iBAAiB,CAAC;AACzB,YAAY,EACV,WAAW,EACX,wBAAwB,EACxB,YAAY,EACZ,WAAW,EACX,QAAQ,GACT,MAAM,YAAY,CAAC"}

package/dist/auth/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAGL,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA6B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAEL,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAGL,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAA6B,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAE/E,OAAO,EAIL,oBAAoB,GACrB,MAAM,iBAAiB,CAAC"}

package/dist/auth/middleware.d.ts

@@ -1,6 +1,6 @@
 import { type AnyAbility } from '@casl/ability';
 import type { Context, MiddlewareHandler } from 'hono';
-import type { AuthProvider, AuthSession, AuthUser } from './types.js';
+import type { AuthContext, AuthProvider, AuthSession, AuthUser } from './types.js';
 export interface AuthMiddlewareConfig<TUser extends AuthUser = AuthUser, TAbility extends AnyAbility = AnyAbility, TSession extends AuthSession = AuthSession> {
     /** Auth provider instance. */
     provider: AuthProvider<TUser, TSession>;
@@ -17,15 +17,17 @@ export interface AuthMiddlewareConfig<TUser extends AuthUser = AuthUser, TAbilit
     /** Called when a session token is invalid. */
     onInvalidSession?: (c: Context) => void | Promise<void>;
 }
-type AuthorizeConfig = {
-    action: string;
-    subject: string | {
-        __caslSubjectType__?: string;
-    };
+export type AuthAuthorizeConfig<TAbility extends AnyAbility = AnyAbility> = {
+    action: Parameters<TAbility['can']>[0];
+    subject: Parameters<TAbility['can']>[1];
 };
+type AuthEnvironment<TUser extends AuthUser, TAbility extends AnyAbility, TSession extends AuthSession> = {
+    Variables: AuthContext<TUser, TSession, TAbility>;
+};
+export type AuthMiddleware<TUser extends AuthUser = AuthUser, TAbility extends AnyAbility = AnyAbility, TSession extends AuthSession = AuthSession> = (authorize?: AuthAuthorizeConfig<TAbility>) => MiddlewareHandler<AuthEnvironment<TUser, TAbility, TSession>>;
 /**
  * Create auth middleware that validates sessions and builds abilities.
  */
-export declare function createAuthMiddleware<TUser extends AuthUser = AuthUser, TAbility extends AnyAbility = AnyAbility, TSession extends AuthSession = AuthSession>(config: AuthMiddlewareConfig<TUser, TAbility, TSession>): (authorize?: AuthorizeConfig) => MiddlewareHandler;
+export declare function createAuthMiddleware<TUser extends AuthUser = AuthUser, TAbility extends AnyAbility = AnyAbility, TSession extends AuthSession = AuthSession>(config: AuthMiddlewareConfig<TUser, TAbility, TSession>): AuthMiddleware<TUser, TAbility, TSession>;
 export {};
 //# sourceMappingURL=middleware.d.ts.map

package/dist/auth/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAG7D,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEtE,MAAM,WAAW,oBAAoB,CACnC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,UAAU,GAAG,UAAU,EACxC,QAAQ,SAAS,WAAW,GAAG,WAAW;IAE1C,8BAA8B;IAC9B,QAAQ,EAAE,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC;IACxC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,QAAQ,CAAC;IAC9B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,KAAK,eAAe,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,GAAG;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD,CAAC;AAEF;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,UAAU,GAAG,UAAU,EACxC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,IAWxB,YAAY,eAAe,KAAG,iBAAiB,CAwB/E"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAW,KAAK,UAAU,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAQ,MAAM,MAAM,CAAC;AAI7D,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAEnF,MAAM,WAAW,oBAAoB,CACnC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,UAAU,GAAG,UAAU,EACxC,QAAQ,SAAS,WAAW,GAAG,WAAW;IAE1C,8BAA8B;IAC9B,QAAQ,EAAE,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACxC,2CAA2C;IAC3C,YAAY,EAAE,CAAC,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC;IACxC,0DAA0D;IAC1D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wDAAwD;IACxD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,qCAAqC;IACrC,YAAY,CAAC,EAAE,MAAM,QAAQ,CAAC;IAC9B,8CAA8C;IAC9C,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,OAAO,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACzD;AAED,MAAM,MAAM,mBAAmB,CAAC,QAAQ,SAAS,UAAU,GAAG,UAAU,IAAI;IAC1E,MAAM,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;CACzC,CAAC;AAEF,KAAK,eAAe,CAClB,KAAK,SAAS,QAAQ,EACtB,QAAQ,SAAS,UAAU,EAC3B,QAAQ,SAAS,WAAW,IAC1B;IACF,SAAS,EAAE,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,cAAc,CACxB,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,UAAU,GAAG,UAAU,EACxC,QAAQ,SAAS,WAAW,GAAG,WAAW,IACxC,CACF,SAAS,CAAC,EAAE,mBAAmB,CAAC,QAAQ,CAAC,KACtC,iBAAiB,CAAC,eAAe,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAEnE;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,UAAU,GAAG,UAAU,EACxC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAE1C,MAAM,EAAE,oBAAoB,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,GACtD,cAAc,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAqC3C"}

package/dist/auth/middleware.js

@@ -1,6 +1,7 @@
 import { Ability } from '@casl/ability';
 import { deleteCookie, getCookie } from 'hono/cookie';
 import { ForbiddenException, UnauthorizedException } from '../http/errors.js';
+import { setRequestAuth } from '../observability/request-context.js';
 /**
  * Create auth middleware that validates sessions and builds abilities.
  */
@@ -62,9 +63,16 @@ async function validateSession(provider, token) {
 }
 function applyAuthContext(c, state) {
     c.set('user', state.user);
-    c.set('session', state.session ?? undefined);
+    c.set('session', state.session);
     c.set('ability', state.ability);
     c.set('isAuthenticated', state.isAuthenticated);
+    if (state.user?.id) {
+        setRequestAuth({
+            userId: state.user.id,
+            tenantId: state.user.tenantId,
+            impersonatedBy: state.session?.impersonatedBy,
+        });
+    }
 }
 function enforceAuthorization(authorize, state, allowGuest) {
     if (!state.user && !allowGuest) {

package/dist/auth/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AA6B9E;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAIlC,MAAuD;IACvD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,UAAU,GAAG,SAAS,EACtB,UAAU,GAAG,eAAe,EAC5B,UAAU,GAAG,IAAI,EACjB,YAAY,EACZ,gBAAgB,GACjB,GAAG,MAAM,CAAC;IAEX,OAAO,SAAS,cAAc,CAAC,SAA2B;QACxD,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;YACtC,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE;gBACtC,UAAU;gBACV,UAAU;gBACV,QAAQ;gBACR,YAAY;gBACZ,YAAY;aACb,CAAC,CAAC;YAEH,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAE3B,IAAI,SAAS,EAAE,CAAC;gBACd,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3C,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,gBAAgB,CAK7B,CAAU,EACV,OAMC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,IAAI,GAAiB,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAoB,IAAI,CAAC;IACpC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,kBAAkB,EAAE,CAAc,CAAC;IAErE,OAAO;QACL,IAAI;QACJ,OAAO;QACP,OAAO;QACP,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAuC,EACvC,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAIvB,CAAU,EAAE,KAA2C;IACvD,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC;IAC7C,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,oBAAoB,CAI3B,SAA0B,EAAE,KAA2C,EAAE,UAAmB;IAC5F,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAgB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,kBAAkB,CAC1B,gCAAgC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,UAAkB;IACxD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/auth/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAmB,MAAM,eAAe,CAAC;AAEzD,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AA6CrE;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAKlC,MAAuD;IAEvD,MAAM,EACJ,QAAQ,EACR,YAAY,EACZ,UAAU,GAAG,SAAS,EACtB,UAAU,GAAG,eAAe,EAC5B,UAAU,GAAG,IAAI,EACjB,YAAY,EACZ,gBAAgB,GACjB,GAAG,MAAM,CAAC;IAEX,OAAO,SAAS,cAAc,CAC5B,SAAyC;QAEzC,OAAO,KAAK,EAAE,CAAsD,EAAE,IAAU,EAAE,EAAE;YAClF,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,CAAC,EAAE;gBACtC,UAAU;gBACV,UAAU;gBACV,QAAQ;gBACR,YAAY;gBACZ,YAAY;aACb,CAAC,CAAC;YAEH,gBAAgB,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAE3B,IAAI,SAAS,EAAE,CAAC;gBACd,oBAAoB,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;YACrD,CAAC;YAED,MAAM,IAAI,EAAE,CAAC;YAEb,IAAI,KAAK,CAAC,iBAAiB,EAAE,CAAC;gBAC5B,YAAY,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC3C,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,CAAC;YAC9B,CAAC;QACH,CAAC,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAUD,KAAK,UAAU,gBAAgB,CAK7B,CAAU,EACV,OAMC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI,kBAAkB,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;IAC5F,IAAI,IAAI,GAAiB,IAAI,CAAC;IAC9B,IAAI,OAAO,GAAoB,IAAI,CAAC;IACpC,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAE9B,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,iBAAiB,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,IAAI;QAClB,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,CAAC;QAC5B,CAAC,CAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,IAAI,kBAAkB,EAAE,CAAc,CAAC;IAErE,OAAO;QACL,IAAI;QACJ,OAAO;QACP,OAAO;QACP,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC;QAC9B,iBAAiB;KAClB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,QAAuC,EACvC,KAAa;IAEb,IAAI,CAAC;QACH,OAAO,MAAM,QAAQ,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAKvB,CAAsD,EACtD,KAA2C;IAE3C,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IAEhD,IAAI,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;QACnB,cAAc,CAAC;YACb,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE;YACrB,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ;YAC7B,cAAc,EAAE,KAAK,CAAC,OAAO,EAAE,cAAc;SAC9C,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAK3B,SAAwC,EACxC,KAA2C,EAC3C,UAAmB;IAEnB,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;QAC/B,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;IAC7D,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,OAAgB,CAAC,EAAE,CAAC;QACrE,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;YAC3B,MAAM,IAAI,qBAAqB,CAAC,yBAAyB,CAAC,CAAC;QAC7D,CAAC;QAED,MAAM,IAAI,kBAAkB,CAC1B,gCAAgC,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,OAAO,EAAE,CACxE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,CAAU,EAAE,UAAkB;IACxD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEzB,IAAI,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB;IACzB,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC,CAAC;AACzB,CAAC"}

package/dist/auth/types.d.ts

@@ -18,6 +18,8 @@ export interface AuthSession {
     expiresAt: Date;
     createdAt: Date;
     lastAccessedAt?: Date;
+    /** Impersonator user ID if the session was created via impersonation */
+    impersonatedBy?: string;
     metadata?: Record<string, unknown>;
 }
 /**
@@ -51,4 +53,9 @@ export interface AuthContext<TUser extends AuthUser = AuthUser, TSession extends
     ability: TAbility;
     isAuthenticated: boolean;
 }
+export type AuthenticatedAuthContext<TUser extends AuthUser = AuthUser, TSession extends AuthSession = AuthSession, TAbility extends AnyAbility = AnyAbility> = Omit<AuthContext<TUser, TSession, TAbility>, 'user' | 'session' | 'isAuthenticated'> & {
+    user: TUser;
+    session: TSession;
+    isAuthenticated: true;
+};
 //# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAC3B,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,WAAW,GAAG,WAAW;IAE1C,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACtC,OAAO,EAAE,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK,CAAC;KACb,GAAG,IAAI,CAAC,CAAC;IAEV;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD;;OAEG;IACH,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW,CAC1B,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,QAAQ,SAAS,UAAU,GAAG,UAAU;IAExC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;CAC1B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEhD;;GAEG;AACH,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;IAChB,SAAS,EAAE,IAAI,CAAC;IAChB,cAAc,CAAC,EAAE,IAAI,CAAC;IACtB,wEAAwE;IACxE,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,YAAY,CAC3B,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,WAAW,GAAG,WAAW;IAE1C,iCAAiC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAEtB;;OAEG;IACH,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QACtC,OAAO,EAAE,QAAQ,CAAC;QAClB,IAAI,EAAE,KAAK,CAAC;KACb,GAAG,IAAI,CAAC,CAAC;IAEV;;OAEG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEpD;;OAEG;IACH,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;CAC1D;AAED;;GAEG;AACH,MAAM,WAAW,WAAW,CAC1B,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,QAAQ,SAAS,UAAU,GAAG,UAAU;IAExC,IAAI,EAAE,KAAK,GAAG,IAAI,CAAC;IACnB,OAAO,EAAE,QAAQ,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,MAAM,wBAAwB,CAClC,KAAK,SAAS,QAAQ,GAAG,QAAQ,EACjC,QAAQ,SAAS,WAAW,GAAG,WAAW,EAC1C,QAAQ,SAAS,UAAU,GAAG,UAAU,IACtC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,iBAAiB,CAAC,GAAG;IACzF,IAAI,EAAE,KAAK,CAAC;IACZ,OAAO,EAAE,QAAQ,CAAC;IAClB,eAAe,EAAE,IAAI,CAAC;CACvB,CAAC"}

package/dist/config/config-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config-service.d.ts","sourceRoot":"","sources":["../../src/config/config-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAsC,MAAM,SAAS,CAAC;AAG9F,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;aAGhC,MAAM,EAAE,OAAO,EAAE;gBADjC,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,OAAO,EAAE;CAKpC;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAsB,YAAY,CAChC,OAAO,SAAS,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAChE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAyC3D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,OAAO,SAAS,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAC7F,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,OAAO,CAAC,CAUjB"}
+{"version":3,"file":"config-service.d.ts","sourceRoot":"","sources":["../../src/config/config-service.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,KAAK,SAAS,EAAE,KAAK,UAAU,EAAsC,MAAM,SAAS,CAAC;AAG9F,OAAO,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAExD;;GAEG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;aAGhC,MAAM,EAAE,OAAO,EAAE;IAFnC,YACE,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,OAAO,EAAE,EAIlC;CACF;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkEG;AACH,wBAAsB,YAAY,CAChC,OAAO,SAAS,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAChE,OAAO,EAAE,aAAa,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAyC3D;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,OAAO,SAAS,UAAU,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,OAAO,CAAC,CAAC,EAC7F,MAAM,EAAE,OAAO,EACf,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,OAAO,CAAC,CAUjB"}