rst-auth 0.0.0-stage → 0.2.0

package/CHANGELOG.md

@@ -0,0 +1,18 @@
+# Changelog
+
+Notable changes to rst-auth are recorded here.
+
+## Unreleased
+
+- Added optional `auth.accounts.register()` and `auth.accounts.login()` helpers that use an app-provided model and lookup callback while keeping database ownership in the app.
+- Bumped package metadata to 0.2.0 for the expanded API; existing low-level password, token, and refresh APIs remain available.
+- Added a standalone HTML/CSS/JavaScript documentation site and GitHub Pages deployment workflow.
+- Added a browser-based auth flow demo to the Express example.
+- Added a TypeScript Express API example that is installed from an npm pack tarball.
+- Added usage, security, migration, contribution, reporting, and first-release documentation.
+- Added Node 22/24 CI checks and example integration tests.
+
+## 0.1.0 - 2026-10-16
+
+- Initial alpha API for password hashing, access tokens, and opaque refresh-token rotation.
+- Added Express 4/5 and Zod subpath adapters plus refresh-store conformance utilities.

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,73 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our community a harassment-free experience for everyone, regardless of age, body size, visible or invisible disability, ethnicity, sex characteristics, gender identity and expression, level of experience, education, socio-economic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming, diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our community include:
+
+- Demonstrating empathy and kindness toward other people.
+- Being respectful of differing opinions, viewpoints, and experiences.
+- Giving and gracefully accepting constructive feedback.
+- Accepting responsibility and apologizing to those affected by our mistakes, and learning from the experience.
+- Focusing on what is best not just for us as individuals, but for the overall community.
+
+Examples of unacceptable behavior include:
+
+- The use of sexualized language or imagery, and sexual attention or advances of any kind.
+- Trolling, insulting or derogatory comments, and personal or political attacks.
+- Public or private harassment.
+- Publishing others' private information, such as a physical or email address, without their explicit permission.
+- Other conduct which could reasonably be considered inappropriate in a professional setting.
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of acceptable behavior and will take appropriate and fair corrective action in response to any behavior that they deem inappropriate, threatening, offensive, or harmful.
+
+Community leaders have the right and responsibility to remove, edit, or reject comments, commits, code, wiki edits, issues, and other contributions that are not aligned to this Code of Conduct, and will communicate reasons for moderation decisions when appropriate.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when an individual is officially representing the community in public spaces. Examples include using an official project email address, posting via an official social media account, or acting as an appointed representative at an online or offline event.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the community leaders responsible for enforcement at the private contact route listed in the repository's `SECURITY.md` or repository moderation settings. All complaints will be reviewed and investigated promptly and fairly.
+
+All community leaders are obligated to respect the privacy and security of the reporter of any incident.
+
+## Enforcement Guidelines
+
+Community leaders will follow these Community Impact Guidelines in determining the consequences for any action they deem in violation of this Code of Conduct:
+
+### 1. Correction
+
+**Community Impact**: Use of inappropriate language or other behavior deemed unprofessional or unwelcome in the community.
+
+**Consequence**: A private, written warning from community leaders, providing clarity around the nature of the violation and an explanation of why the behavior was inappropriate. A public apology may be requested.
+
+### 2. Warning
+
+**Community Impact**: A violation through a single incident or series of actions.
+
+**Consequence**: A warning with consequences for continued behavior. No interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, for a specified period. This includes avoiding interactions in community spaces, as well as external channels like social media. Violating these terms may lead to a temporary or permanent ban.
+
+### 3. Temporary Ban
+
+**Community Impact**: A serious violation of community standards, including sustained inappropriate behavior.
+
+**Consequence**: A temporary ban from any sort of interaction or public communication with the community for a specified period. No public or private interaction with the people involved, including unsolicited interaction with those enforcing the Code of Conduct, is allowed during this period. Violating these terms may lead to a permanent ban.
+
+### 4. Permanent Ban
+
+**Community Impact**: Demonstrating a pattern of violation of community standards, including sustained inappropriate behavior, harassment of an individual, or aggression toward or disparagement of classes of individuals.
+
+**Consequence**: A permanent ban from any sort of public interaction within the community.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant](https://www.contributor-covenant.org), version 2.1, available at https://www.contributor-covenant.org/version/2/1/code_of_conduct.html.

package/CONTRIBUTING.md

@@ -0,0 +1,35 @@
+# Contributing
+
+Thanks for helping improve rst-auth. The project is alpha software and prioritizes clear security boundaries, small APIs, and honest documentation.
+
+## Before opening a change
+
+- Read the relevant design and security documentation in `docs/` before changing behavior.
+- Keep user models, DB queries, routes, controllers, and business rules in the application layer.
+- Do not add real credentials, publish packages, or push directly to the upstream default branch. Use a fork and pull request; do not claim production readiness.
+- Every security or feature claim in README must map to a named test in `docs/claims.md`.
+- Never accept a client-supplied privilege or role during signup.
+
+## Development checks
+
+Use Node 22 or 24 and npm. From the repository root run:
+
+```sh
+npm ci
+npm run build
+npm test
+npm run lint
+npm run typecheck
+npm run format:check
+npm pack --dry-run
+npm run example:install
+npm --prefix examples/express-api run typecheck
+npm --prefix examples/express-api test
+npm --prefix examples/express-api run import-check
+```
+
+The example install command packs this project and installs the generated tarball into the example. Do not change the example to import source files from `src/`.
+
+## Pull requests
+
+Explain the user-visible behavior, security consequences, tests, docs, and compatibility impact. Include focused tests for bug fixes and new claims. Keep PRs small enough to review. Maintainers may request changes or decline work outside the project scope. By contributing, you agree to follow the [Code of Conduct](CODE_OF_CONDUCT.md).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sayed Risat
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,308 @@
-# Temporary Holding Version
+# RST-Auth
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+<p align="center">
+  <a href="https://www.npmjs.com/package/rst-auth"><img alt="npm version" src="https://img.shields.io/npm/v/rst-auth?color=4c8bf5&label=npm"></a>
+  <a href="https://github.com/sayedrisat/rst-auth/actions/workflows/ci.yml"><img alt="CI" src="https://img.shields.io/github/actions/workflow/status/sayedrisat/rst-auth/ci.yml?branch=main&label=CI"></a>
+  <img alt="Node.js 22+" src="https://img.shields.io/badge/Node.js-22%2B-43853d">
+  <a href="LICENSE"><img alt="MIT license" src="https://img.shields.io/badge/license-MIT-blue.svg"></a>
+</p>
+
+<p align="center">
+  <a href="https://sayedrisat.github.io/rst-auth/">Documentation</a> ·
+  <a href="https://github.com/sayedrisat/rst-auth">GitHub</a> ·
+  <a href="https://www.npmjs.com/package/rst-auth">npm</a> ·
+  <a href="examples/express-api/">Runnable Express example</a>
+</p>
+
+> **Complex authentication. Simple methods. Full control. Open source.**
+
+RST-Auth is a small set of authentication building blocks for Node.js. It handles reusable security mechanics; **your app keeps its users, database, routes, business rules, and API responses.**
+
+| Your app owns                                        | RST-Auth provides                                          |
+| ---------------------------------------------------- | ---------------------------------------------------------- |
+| User records, DB queries, signup/login controllers   | Password hashing and verification with `bcryptjs`          |
+| Roles, permissions, and business decisions           | Signed access tokens and optional Express middleware       |
+| API response shapes, frontend, and account lifecycle | Stateful refresh rotation through your `RefreshTokenStore` |
+
+> **Project status:** `0.1.0` alpha. The API may change. This project is not a security audit or a claim of production readiness.
+
+## Authentication flow
+
+This overview shows where the package fits. The application connects its own user repository and persistent refresh-token store; RST-Auth does not query the user database.
+
+```mermaid
+flowchart LR
+  client[Browser or API client]
+  app[Your app<br/>routes, controllers, policy]
+  auth[RST-Auth<br/>bcryptjs · jose · refresh service]
+  users[(Your user database)]
+  store[(Your atomic RefreshTokenStore)]
+
+  client -->|signup / login| app
+  app <-->|lookup user · save password hash| users
+  app -->|hash / verify · sign access token| auth
+  auth -->|opaque token hash · atomic consume| store
+  auth -->|access token + refresh token result| app
+  app -->|Bearer token or HttpOnly cookie| client
+  client -->|protected request| app
+  app -->|verify access token| auth
+```
+
+During refresh, the store atomically consumes the presented token hash. A successful rotation issues a successor in the same family; replay revokes that family. See the [end-to-end flow in the docs](https://sayedrisat.github.io/rst-auth/#flow) for the walkthrough and token-delivery trade-offs.
+
+<details>
+<summary>Contents</summary>
+
+- [Overview and features](#overview)
+- [Install](#install)
+- [Minimal setup](#minimal-setup)
+- [Passwords](#passwords)
+- [Access tokens](#access-tokens)
+- [Refresh tokens](#refresh-tokens)
+- [Express middleware and validation](#express-middleware)
+- [Configuration](#configuration-reference)
+- [Database integration and limitations](#database-integration-model)
+- [Testing and contributing](#testing)
+- [Comparison](#comparison)
+
+</details>
+
+## Overview
+
+`RST-Auth` is an alpha TypeScript toolkit for Node.js 22+ applications. It provides password hashing, access tokens, stateful refresh-token rotation, and optional Express and Zod adapters. Your application owns its users, database, routes, business rules, and responses.
+
+## Problem
+
+Authentication code is easy to get subtly wrong, while full authentication frameworks may own user models, database tables, and application flows. This package focuses on reusable security mechanics and leaves application-specific decisions with the developer.
+
+## Features
+
+- `bcryptjs` password hashing, 72-byte input checks, and dummy verification.
+- `jose` access tokens with configured algorithms, issuer/audience checks, key resolution, and optional revocation lookup.
+- Opaque refresh tokens with atomic store consumption, rotation, family revocation, and reuse detection.
+- Express 4 and 5 authentication, role authorization, validation, and safe error middleware.
+- Zod adapter and a framework-agnostic refresh-store conformance suite.
+- Injected configuration; the library does not read `process.env`.
+
+Feature and security claims are mapped to named tests in [docs/claims.md](docs/claims.md).
+
+## Security philosophy
+
+The library handles reusable primitives and validates configuration. The application decides who a user is, what a role means, where data is stored, how sessions are delivered, and which HTTP response to return. Tokens are secrets: keep them out of logs and URLs. A valid access token does not establish that its subject still exists or remains enabled, and token-carried roles may be stale.
+
+## Install
+
+```sh
+npm install rst-auth
+```
+
+Core password, token, and refresh APIs need no framework peer. For the optional integrations, install the peers you use:
+
+```sh
+npm install express zod
+npm install --save-dev @types/express
+```
+
+See [installation](docs/installation.md) for Node and package details.
+
+## Minimal setup
+
+Configuration belongs in your application's config layer. Never commit a real signing secret.
+
+```ts
+import { createAuth } from "rst-auth";
+
+const secret = process.env.ACCESS_TOKEN_SECRET;
+if (!secret || Buffer.byteLength(secret, "utf8") < 32) {
+  throw new Error("Set ACCESS_TOKEN_SECRET to at least 32 bytes");
+}
+
+const auth = createAuth({
+  accessToken: {
+    key: new TextEncoder().encode(secret),
+    issuer: "my-service",
+    audience: "my-api",
+  },
+});
+```
+
+## Passwords
+
+```ts
+const passwordHash = await auth.password.hash(password);
+const matches = await auth.password.verify(password, passwordHash);
+
+// When no user exists, do a dummy comparison before returning the same login error.
+if (!user) await auth.password.verifyDummy(password);
+```
+
+Passwords above 72 UTF-8 bytes are rejected because bcrypt truncates longer inputs. The default work factor is 12; benchmark it on the deployment hardware because hashing and `createAuth()` startup work increase with the setting. See [passwords](docs/passwords.md).
+
+### Optional register/login helpers
+
+If you want the toolkit to hash and verify passwords inside your normal controller flow, pass your existing model and the email lookup you already use. The toolkit does not pick a database, model, schema, route, or response format for you:
+
+```ts
+const auth = createAuth({
+  accessToken: { key: new TextEncoder().encode(secret), expiresInSeconds: 900 },
+  refreshToken: {
+    store: refreshTokenStore, // Your persistent atomic store in deployed apps.
+    refreshTokenTtl: 7 * 24 * 60 * 60,
+    absoluteLifetime: 30 * 24 * 60 * 60,
+  },
+  accounts: {
+    model: User, // Must provide create(values).
+    findByEmail: (email) => User.findOne({ email }),
+    getSubject: (user) => String(user._id),
+    getAccessClaims: (user) => ({ role: user.role }),
+  },
+});
+
+// In your existing signup/login controllers:
+const session = await auth.accounts.register({
+  email: req.body.email,
+  password: req.body.password,
+  profile: { name: req.body.name }, // Never pass client role/permission fields.
+});
+res.status(201).json({ user: session.user, accessToken: session.accessToken });
+// Deliver session.refreshToken through an HttpOnly cookie or your chosen channel.
+```
+
+`auth.accounts.login({ email, password })` performs the lookup, bcrypt check (including dummy work for an unknown email), previous-session revocation, and token issuance. These helpers require refresh support and a `RefreshTokenStore`; the in-memory store is only for tests/local work. See [account helpers](docs/accounts.md).
+
+## Access tokens
+
+```ts
+const token = await auth.tokens.generateAccessToken({
+  sub: user.id,
+  role: user.role,
+});
+const verifiedClaims = await auth.tokens.verifyAccessToken(token);
+```
+
+The verifier uses the configured algorithm allowlist and validates signature, expiry, issuer/audience when configured, required claims, and token type. See [access tokens](docs/access-tokens.md).
+
+## Refresh tokens
+
+Refresh support requires a store. The built-in `MemoryRefreshTokenStore` is for tests and local demonstrations only; it is not a production persistence option.
+
+```ts
+import { createAuth, MemoryRefreshTokenStore } from "rst-auth";
+
+const auth = createAuth({
+  accessToken: { key: new TextEncoder().encode(secret) },
+  refreshToken: {
+    store: new MemoryRefreshTokenStore(), // Use a shared persistent store in deployed services.
+    refreshTokenTtl: 60 * 60 * 24 * 7,
+    absoluteLifetime: 60 * 60 * 24 * 30,
+  },
+});
+
+const issued = await auth.refresh!.issue({ subject: user.id });
+const next = await auth.refresh!.rotate(issued.refreshToken);
+```
+
+The application creates an access token from the returned subject and its current user/permission data. Rotation consumes a stored hash atomically; presenting a consumed token revokes its family. Read [refresh tokens](docs/refresh-tokens.md) before implementing a store.
+
+## Express middleware
+
+```ts
+import { expressAuth } from "rst-auth/express";
+
+const middleware = expressAuth(auth);
+app.get("/profile", middleware.authenticate(), profileController);
+app.delete(
+  "/admin/users/:id",
+  middleware.authenticate(),
+  middleware.authorize({ roles: ["admin"] }),
+  deleteUserController,
+);
+```
+
+Authentication defaults to strict `Authorization: Bearer` parsing. Optional auth is available with `authenticate({ required: false })`; a present invalid token still fails. See [middleware](docs/middleware.md).
+
+## Validation
+
+```ts
+import { expressAuth } from "rst-auth/express";
+import { zodAdapter } from "rst-auth/zod";
+
+const middleware = expressAuth(auth, { validator: zodAdapter() });
+app.post(
+  "/items",
+  middleware.validate({ body: itemSchema }),
+  createItemController,
+);
+```
+
+Parsed values are placed on `req.validated`; `req.body`, `req.params`, and `req.query` are not silently replaced. See [validation](docs/validation.md).
+
+## Errors
+
+`AuthError` exposes a stable code, developer message, safe public message, status, and optional cause. The Express error handler emits only safe fields by default; an application may provide a formatter. See [error handling](docs/error-handling.md).
+
+## Configuration reference
+
+| Setting                            | Purpose                        | Default / constraint                                                                 |
+| ---------------------------------- | ------------------------------ | ------------------------------------------------------------------------------------ |
+| `mode`                             | Runtime validation profile     | `development`; `production` requires issuer and audience and access expiry <= 1 hour |
+| `password.workFactor`              | bcrypt cost                    | `12`, integer 4–31                                                                   |
+| `accessToken.key`                  | Signing key                    | Required; HMAC keys need at least 32 bytes                                           |
+| `accessToken.algorithm`            | Signing algorithm              | `HS256`; supported JOSE algorithms are explicitly listed in config types             |
+| `accessToken.algorithms`           | Verification allowlist         | Signing algorithm by default; must contain it                                        |
+| `accessToken.issuer`, `audience`   | JWT issuer/audience checks     | Optional outside production                                                          |
+| `accessToken.expiresInSeconds`     | Access-token lifetime          | `900` seconds                                                                        |
+| `accessToken.keyId`, `keyResolver` | Key rotation support           | Optional; resolver requires a `kid`                                                  |
+| `accessToken.requiredClaims`       | Additional required JWT claims | `sub`, `iat`, and `exp` are required automatically                                   |
+| `accessToken.isRevoked`            | Stateful verification check    | Optional; callback latency/availability is part of each verification                 |
+| `refreshToken.store`               | Atomic refresh-token state     | Omit to disable refresh support                                                      |
+| `refreshToken.refreshTokenTtl`     | Idle refresh expiry            | Required when refresh is enabled, in seconds                                         |
+| `refreshToken.absoluteLifetime`    | Family lifetime cap            | Required when refresh is enabled, in seconds                                         |
+
+See [configuration](docs/configuration.md) for validation details and asymmetric-key examples.
+
+## TypeScript
+
+The package ships declarations and strict public types. `req.auth` and `req.validated` are augmented when the Express subpath is imported. For schema-specific parsed values, use the exported `ValidatedRequest<TSchemas>` type. Install `@types/express` when using the Express integration.
+
+## Database integration model
+
+The toolkit does not choose a database or user schema. You can keep your own signup/login code using `auth.password`, or opt into `auth.accounts` and supply your model plus `findByEmail` callback. Refresh support still requires a persistent `RefreshTokenStore` with atomic compare-and-swap; run the `rst-auth/testing` conformance suite against it. See [account helpers](docs/accounts.md) and [refresh tokens](docs/refresh-tokens.md).
+
+## Limitations
+
+This is alpha software, not a security audit or a complete identity system. It does not provide a production refresh store, user/session database, OAuth, MFA, account lockout, password reset, email verification, CORS policy, rate limiting, or CSRF protection. The memory refresh store is process-local. A token's roles can be stale unless the app performs current identity/permission checks. See [security](docs/security.md).
+
+## Testing
+
+```sh
+npm ci
+npm run build
+npm test
+npm run lint
+npm run typecheck
+npm run format:check
+npm pack --dry-run
+npm run example:install
+npm --prefix examples/express-api run typecheck
+npm --prefix examples/express-api test
+npm --prefix examples/express-api run import-check
+```
+
+The example installer creates a package tarball and installs that tarball into the example; it does not import source files from this repository. CI checks Node 22 and 24.
+
+## Contributing
+
+Read [CONTRIBUTING.md](CONTRIBUTING.md), keep every documented security/feature claim connected to a test, and run all quality gates before proposing changes. The project follows the [Code of Conduct](CODE_OF_CONDUCT.md). Report vulnerabilities using [SECURITY.md](SECURITY.md), not a public issue.
+
+## License
+
+MIT; Copyright (c) 2026 Sayed Risat. See [LICENSE](LICENSE).
+
+## Project status
+
+Version `0.1.0` is an alpha under active development. Public API names, policies, and docs may change before a stable release. No production-readiness claim is made.
+
+## Comparison
+
+This is a README-level comparison based on this project's checked-in competitive review, not an independent source audit. The reviewed JWT utility examples generally describe issuing new stateless JWTs on refresh without documented stored-token reuse detection; this package instead requires server-side refresh state and atomic consume for rotation. Broader authentication frameworks may manage schemas and migrations; this package leaves database schema and queries to the application. `express-jwt` focuses on middleware rather than passwords, refresh rotation, or validation. The reviewed analysis did not verify every package in the market, so these points describe only that review's scope and are not universal claims.

package/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+## Supported versions
+
+Security reports are accepted for the current alpha release line. Alpha software may change without a migration path and has not received an independent security audit.
+
+## Reporting a vulnerability privately
+
+Please do not open a public issue or pull request for a suspected vulnerability. If GitHub private vulnerability reporting is enabled for this repository, use **Security → Report a vulnerability** to submit a private advisory. If it is not enabled, contact the maintainers through the repository's private contact channel and ask them to provide a secure reporting route; do not include exploit details in a public issue.
+
+Include the affected version/commit, impact, reproduction steps, and any suggested mitigation. Do not include real user data, tokens, or production secrets. The maintainers will acknowledge receipt and coordinate a fix and disclosure timeline with the reporter.
+
+Before the first public release, maintainers must enable and verify a private reporting route in the repository settings.

package/dist/accounts.d.ts

@@ -0,0 +1,41 @@
+import type { AccessTokenService } from "./tokens.js";
+import type { PasswordService } from "./password.js";
+import type { RefreshTokenService } from "./refresh.js";
+export interface AccountModelLike<User = unknown> {
+    create(values: Record<string, unknown>): PromiseLike<User> | User;
+}
+/**
+ * App-owned database adapter for the optional accounts helper. Pass the model
+ * and the query used to find an account; the package handles hash/verify and
+ * session issuance without taking ownership of the database.
+ */
+export interface AccountAdapter<User = unknown> {
+    model: AccountModelLike<User>;
+    findByEmail(email: string): PromiseLike<User | null> | User | null;
+    getSubject?: (user: User) => string;
+    getAccessClaims?: (user: User) => Record<string, unknown>;
+    passwordHashField?: string;
+    /** Keep the original single-session behavior by revoking old families at login. */
+    revokePreviousSessionsOnLogin?: boolean;
+}
+export interface RegisterAccountInput {
+    email: string;
+    password: string;
+    profile?: Record<string, unknown>;
+}
+export interface LoginAccountInput {
+    email: string;
+    password: string;
+}
+export interface AccountSession {
+    user: unknown;
+    accessToken: string;
+    refreshToken: string;
+}
+export interface AccountService {
+    register(input: RegisterAccountInput): Promise<AccountSession>;
+    login(input: LoginAccountInput): Promise<AccountSession>;
+}
+export declare function validateAccountAdapter(adapter: unknown): asserts adapter is AccountAdapter;
+export declare function createAccountService<User>(adapter: AccountAdapter<User>, password: PasswordService, tokens: AccessTokenService, refresh: RefreshTokenService): AccountService;
+//# sourceMappingURL=accounts.d.ts.map

package/dist/accounts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts.d.ts","sourceRoot":"","sources":["../src/accounts.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AAExD,MAAM,WAAW,gBAAgB,CAAC,IAAI,GAAG,OAAO;IAC9C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CACnE;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc,CAAC,IAAI,GAAG,OAAO;IAC5C,KAAK,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC;IAC9B,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;IACnE,UAAU,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC;IACpC,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1D,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mFAAmF;IACnF,6BAA6B,CAAC,EAAE,OAAO,CAAC;CACzC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/D,KAAK,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC1D;AAgFD,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,OAAO,IAAI,cAAc,CA6CnC;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EACvC,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,EAC7B,QAAQ,EAAE,eAAe,EACzB,MAAM,EAAE,kBAAkB,EAC1B,OAAO,EAAE,mBAAmB,GAC3B,cAAc,CAkGhB"}