@_mustachio/openauth 0.9.2 → 0.11.0

package/dist/esm/util.js

@@ -1,54 +0,0 @@
-// src/util.ts
-function getRelativeUrl(ctx, path) {
-  const result = new URL(path, ctx.req.url);
-  result.host = ctx.req.header("x-forwarded-host") || result.host;
-  result.protocol = ctx.req.header("x-forwarded-proto") || result.protocol;
-  result.port = ctx.req.header("x-forwarded-port") || result.port;
-  return result.toString();
-}
-var twoPartTlds = [
-  "co.uk",
-  "co.jp",
-  "co.kr",
-  "co.nz",
-  "co.za",
-  "co.in",
-  "com.au",
-  "com.br",
-  "com.cn",
-  "com.mx",
-  "com.tw",
-  "net.au",
-  "org.uk",
-  "ne.jp",
-  "ac.uk",
-  "gov.uk",
-  "edu.au",
-  "gov.au"
-];
-function isDomainMatch(a, b) {
-  if (a === b)
-    return true;
-  const partsA = a.split(".");
-  const partsB = b.split(".");
-  const hasTwoPartTld = twoPartTlds.some((tld) => a.endsWith("." + tld) || b.endsWith("." + tld));
-  const numParts = hasTwoPartTld ? -3 : -2;
-  const min = Math.min(partsA.length, partsB.length, numParts);
-  const tailA = partsA.slice(min).join(".");
-  const tailB = partsB.slice(min).join(".");
-  return tailA === tailB;
-}
-function lazy(fn) {
-  let value;
-  return () => {
-    if (value === undefined) {
-      value = fn();
-    }
-    return value;
-  };
-}
-export {
-  lazy,
-  isDomainMatch,
-  getRelativeUrl
-};

package/dist/types/issuer.d.ts

@@ -1,607 +0,0 @@
-/**
- * The `issuer` create an OpentAuth server, a [Hono](https://hono.dev) app that's
- * designed to run anywhere.
- *
- * The `issuer` function requires a few things:
- *
- * ```ts title="issuer.ts"
- * import { issuer } from "@openauthjs/openauth"
- *
- * const app = issuer({
- *   providers: { ... },
- *   storage,
- *   subjects,
- *   success: async (ctx, value) => { ... }
- * })
- * ```
- *
- * #### Add providers
- *
- * You start by specifying the auth providers you are going to use. Let's say you want your users
- * to be able to authenticate with GitHub and with their email and password.
- *
- * ```ts title="issuer.ts"
- * import { GithubProvider } from "@openauthjs/openauth/provider/github"
- * import { PasswordProvider } from "@openauthjs/openauth/provider/password"
- *
- * const app = issuer({
- *   providers: {
- *     github: GithubProvider({
- *       // ...
- *     }),
- *     password: PasswordProvider({
- *       // ...
- *     }),
- *   },
- * })
- * ```
- *
- * #### Handle success
- *
- * The `success` callback receives the payload when a user completes a provider's auth flow.
- *
- * ```ts title="issuer.ts"
- * const app = issuer({
- *   providers: { ... },
- *   subjects,
- *   async success(ctx, value) {
- *     let userID
- *     if (value.provider === "password") {
- *       console.log(value.email)
- *       userID = ... // lookup user or create them
- *     }
- *     if (value.provider === "github") {
- *       console.log(value.tokenset.access)
- *       userID = ... // lookup user or create them
- *     }
- *     return ctx.subject("user", {
- *       userID
- *     })
- *   }
- * })
- * ```
- *
- * Once complete, the `issuer` issues the access tokens that a client can use. The `ctx.subject`
- * call is what is placed in the access token as a JWT.
- *
- * #### Define subjects
- *
- * You define the shape of these in the `subjects` field.
- *
- * ```ts title="subjects.ts"
- * import { object, string } from "valibot"
- * import { createSubjects } from "@openauthjs/openauth/subject"
- *
- * const subjects = createSubjects({
- *   user: object({
- *     userID: string()
- *   })
- * })
- * ```
- *
- * It's good to place this in a separate file since this'll be used in your client apps as well.
- *
- * ```ts title="issuer.ts"
- * import { subjects } from "./subjects.js"
- *
- * const app = issuer({
- *   providers: { ... },
- *   subjects,
- *   // ...
- * })
- * ```
- *
- * #### Multi-tenant routes
- *
- * For environments where subdomains or headers can't identify tenants (e.g., Lambda URLs),
- * use explicit tenant routes: `/tenant/:tenantId/authorize` instead of `/authorize`.
- *
- * ```ts title="issuer.ts"
- * const app = issuer({
- *   providers: async (ctx) => {
- *     const tenantId = ctx.get("tenantId") as string
- *     const config = await db.tenants.findUnique({ where: { id: tenantId } })
- *     return { github: GithubProvider({ clientID: config.githubClientId, ... }) }
- *   },
- *   success: async (ctx, value) => {
- *     return ctx.subject("user", { userID: value.email, tenantId: value.tenantId })
- *   }
- * })
- * ```
- *
- * #### Advanced multi-tenant configuration
- *
- * For complex multi-tenant scenarios, OpenAuth provides three additional configuration options:
- *
- * - **`basePath`** - Dynamic URL prefix for both incoming routing and outgoing URLs when the issuer is mounted at a variable path
- * - **`cookies.path`** - Set to `"/"` so cookies work across all paths
- * - **`context`** - Extract custom data from requests, available in providers and callbacks
- *
- * ```ts title="issuer.ts"
- * const app = issuer({
- *   storage,
- *   subjects,
- *   // Dynamic base path based on request headers
- *   basePath: (req) => `/auth/${req.headers.get("x-org-slug")}`,
- *   // Root-level cookies that work across all paths
- *   cookies: { path: "/" },
- *   // Extract org/app context from each request
- *   context: (req) => ({
- *     orgSlug: req.headers.get("x-org-slug")!,
- *     appSlug: req.headers.get("x-app-slug")!,
- *   }),
- *   providers: async (ctx) => {
- *     const { orgSlug, appSlug } = ctx.get("requestContext") as { orgSlug: string; appSlug: string }
- *     const config = await db.getAppConfig(orgSlug, appSlug)
- *     return {
- *       github: GithubProvider({
- *         clientID: config.githubClientId,
- *         clientSecret: config.githubClientSecret,
- *       })
- *     }
- *   },
- *   success: async (ctx, value) => {
- *     const { orgSlug, appSlug } = value.context
- *     return ctx.subject("user", {
- *       userID: value.email,
- *       orgSlug,
- *       appSlug,
- *     })
- *   },
- * })
- *
- * // Mount the issuer at a dynamic route
- * honoApp.route("/auth/:orgSlug/:appSlug", app)
- * ```
- *
- * #### Deploy
- *
- * Since `issuer` is a Hono app, you can deploy it anywhere Hono supports.
- *
- * <Tabs>
- *   <TabItem label="Node">
- *   ```ts title="issuer.ts"
- *   import { serve } from "@hono/node-server"
- *
- *   serve(app)
- *   ```
- *   </TabItem>
- *   <TabItem label="Lambda">
- *   ```ts title="issuer.ts"
- *   import { handle } from "hono/aws-lambda"
- *
- *   export const handler = handle(app)
- *   ```
- *   </TabItem>
- *   <TabItem label="Bun">
- *   ```ts title="issuer.ts"
- *   export default app
- *   ```
- *   </TabItem>
- *   <TabItem label="Workers">
- *   ```ts title="issuer.ts"
- *   export default app
- *   ```
- *   </TabItem>
- * </Tabs>
- *
- * @packageDocumentation
- */
-import { Provider } from "./provider/provider.js";
-import { SubjectPayload, SubjectSchema } from "./subject.js";
-import { Context } from "hono";
-/**
- * Sets the subject payload in the JWT token and returns the response.
- *
- * ```ts
- * ctx.subject("user", {
- *   userID
- * })
- * ```
- */
-export interface OnSuccessResponder<T extends {
-    type: string;
-    properties: any;
-}> {
-    /**
-     * The `type` is the type of the subject, that was defined in the `subjects` field.
-     *
-     * The `properties` are the properties of the subject. This is the shape of the subject that
-     * you defined in the `subjects` field.
-     */
-    subject<Type extends T["type"]>(type: Type, properties: Extract<T, {
-        type: Type;
-    }>["properties"], opts?: {
-        ttl?: {
-            access?: number;
-            refresh?: number;
-        };
-        subject?: string;
-    }): Promise<Response>;
-}
-export interface AllowCallbackInput {
-    clientID: string;
-    redirectURI: string;
-    audience?: string;
-}
-/**
- * @internal
- */
-export interface AuthorizationState {
-    redirect_uri: string;
-    response_type: string;
-    state: string;
-    client_id: string;
-    audience?: string;
-    pkce?: {
-        challenge: string;
-        method: "S256";
-    };
-    tenantId?: string;
-}
-/**
- * @internal
- */
-export type Prettify<T> = {
-    [K in keyof T]: T[K];
-} & {};
-import { UnknownStateError } from "./error.js";
-import { StorageAdapter } from "./storage/storage.js";
-import { Theme } from "./ui/theme.js";
-/** @internal */
-export declare const aws: <E extends import("hono").Env = import("hono").Env, S extends import("hono").Schema = {}, BasePath extends string = "/">(app: import("hono").Hono<E, S, BasePath>, { isContentTypeBinary }?: {
-    isContentTypeBinary: ((contentType: string) => boolean) | undefined;
-}) => (<L extends import("hono/aws-lambda").LambdaEvent>(event: L, lambdaContext?: import("hono/aws-lambda").LambdaContext) => Promise<import("hono/aws-lambda").APIGatewayProxyResult & (L extends {
-    multiValueHeaders: Record<string, string[]>;
-} ? {
-    headers?: undefined;
-    multiValueHeaders: Record<string, string[]>;
-} : {
-    headers: Record<string, string>;
-    multiValueHeaders?: undefined;
-})>);
-export interface IssuerInput<Providers extends Record<string, Provider<any>>, Subjects extends SubjectSchema, RequestContext = undefined, Result = {
-    [key in keyof Providers]: Prettify<{
-        provider: key;
-        tenantId?: string;
-        context: RequestContext;
-    } & (Providers[key] extends Provider<infer T> ? T : {})>;
-}[keyof Providers]> {
-    /**
-     * The shape of the subjects that you want to return.
-     *
-     * @example
-     *
-     * ```ts title="issuer.ts"
-     * import { object, string } from "valibot"
-     * import { createSubjects } from "@openauthjs/openauth/subject"
-     *
-     * issuer({
-     *   subjects: createSubjects({
-     *     user: object({
-     *       userID: string()
-     *     })
-     *   })
-     *   // ...
-     * })
-     * ```
-     */
-    subjects: Subjects;
-    /**
-     * The storage adapter that you want to use.
-     *
-     * @example
-     * ```ts title="issuer.ts"
-     * import { DynamoStorage } from "@openauthjs/openauth/storage/dynamo"
-     *
-     * issuer({
-     *   storage: DynamoStorage()
-     *   // ...
-     * })
-     * ```
-     */
-    storage?: StorageAdapter;
-    /**
-     * The providers that you want your OpenAuth server to support.
-     *
-     * @example
-     *
-     * ```ts title="issuer.ts"
-     * import { GithubProvider } from "@openauthjs/openauth/provider/github"
-     *
-     * issuer({
-     *   providers: {
-     *     github: GithubProvider()
-     *   }
-     * })
-     * ```
-     *
-     * The key is just a string that you can use to identify the provider. It's passed back to
-     * the `success` callback.
-     *
-     * You can also specify multiple providers.
-     *
-     * ```ts
-     * {
-     *   providers: {
-     *     github: GithubProvider(),
-     *     google: GoogleProvider()
-     *   }
-     * }
-     * ```
-     *
-     * For multi-tenant applications, you can provide a function that returns providers dynamically.
-     * When using tenant routes (`/tenant/:tenantId/authorize`), the tenant ID is available via
-     * `ctx.get("tenantId")`:
-     *
-     * ```ts
-     * {
-     *   providers: async (ctx) => {
-     *     const tenantId = ctx.get("tenantId") as string
-     *     const config = await db.tenants.findUnique({ where: { id: tenantId } })
-     *     return {
-     *       github: GithubProvider({
-     *         clientID: config.githubClientId,
-     *         clientSecret: config.githubClientSecret,
-     *       })
-     *     }
-     *   }
-     * }
-     * ```
-     */
-    providers: Providers | ((ctx: Context) => Promise<Providers>);
-    /**
-     * The theme you want to use for the UI.
-     *
-     * This includes the UI the user sees when selecting a provider. And the `PasswordUI` and
-     * `CodeUI` that are used by the `PasswordProvider` and `CodeProvider`.
-     *
-     * @example
-     * ```ts title="issuer.ts"
-     * import { THEME_SST } from "@openauthjs/openauth/ui/theme"
-     *
-     * issuer({
-     *   theme: THEME_SST
-     *   // ...
-     * })
-     * ```
-     *
-     * Or define your own.
-     *
-     * ```ts title="issuer.ts"
-     * import type { Theme } from "@openauthjs/openauth/ui/theme"
-     *
-     * const MY_THEME: Theme = {
-     *   // ...
-     * }
-     *
-     * issuer({
-     *   theme: MY_THEME
-     *   // ...
-     * })
-     * ```
-     */
-    theme?: Theme;
-    /**
-     * Set the TTL, in seconds, for access and refresh tokens.
-     *
-     * @example
-     * ```ts
-     * {
-     *   ttl: {
-     *     access: 60 * 60 * 24 * 30,
-     *     refresh: 60 * 60 * 24 * 365
-     *   }
-     * }
-     * ```
-     */
-    ttl?: {
-        /**
-         * Interval in seconds where the access token is valid.
-         * @default 30d
-         */
-        access?: number;
-        /**
-         * Interval in seconds where the refresh token is valid.
-         * @default 1y
-         */
-        refresh?: number;
-        /**
-         * Interval in seconds where refresh token reuse is allowed. This helps mitigrate
-         * concurrency issues.
-         * @default 60s
-         */
-        reuse?: number;
-        /**
-         * Interval in seconds to retain refresh tokens for reuse detection.
-         * @default 0s
-         */
-        retention?: number;
-    };
-    /**
-     * Optionally, configure the UI that's displayed when the user visits the root URL of the
-     * of the OpenAuth server.
-     *
-     * ```ts title="issuer.ts"
-     * import { Select } from "@openauthjs/openauth/ui/select"
-     *
-     * issuer({
-     *   select: Select({
-     *     providers: {
-     *       github: { hide: true },
-     *       google: { display: "Google" }
-     *     }
-     *   })
-     *   // ...
-     * })
-     * ```
-     *
-     * @default Select()
-     */
-    select?(providers: Record<string, string>, req: Request): Promise<Response>;
-    /**
-     * @internal
-     */
-    start?(req: Request): Promise<void>;
-    /**
-     * The success callback that's called when the user completes the flow.
-     *
-     * This is called after the user has been redirected back to your app after the OAuth flow.
-     *
-     * The `value` parameter includes `provider` (the provider name) and any provider-specific
-     * data. When using tenant routes (`/tenant/:tenantId/authorize`), it also includes `tenantId`.
-     *
-     * @example
-     * ```ts
-     * {
-     *   success: async (ctx, value) => {
-     *     let userID
-     *     if (value.provider === "password") {
-     *       console.log(value.email)
-     *       userID = ... // lookup user or create them
-     *     }
-     *     if (value.provider === "github") {
-     *       console.log(value.tokenset.access)
-     *       userID = ... // lookup user or create them
-     *     }
-     *     return ctx.subject("user", {
-     *       userID,
-     *       // For multi-tenant, store tenantId in subject for refresh access
-     *       tenantId: value.tenantId,
-     *     })
-     *   },
-     *   // ...
-     * }
-     * ```
-     */
-    success(response: OnSuccessResponder<SubjectPayload<Subjects>>, input: Result, req: Request): Promise<Response>;
-    /**
-     * Optional callback that's called when a refresh token is used to get new access tokens.
-     *
-     * This allows you to update dynamic user attributes (permissions, roles, etc.) during
-     * token refresh without requiring the user to re-authenticate.
-     *
-     * If not provided, the original properties from the initial authentication will be reused.
-     *
-     * @example
-     * ```ts
-     * {
-     *   refresh: async (ctx, value) => {
-     *     // Fetch updated permissions from database
-     *     const permissions = await db.getPermissions(value.properties.userId)
-     *     return ctx.subject("user", {
-     *       ...value.properties,
-     *       permissions // Updated value
-     *     })
-     *   }
-     * }
-     * ```
-     */
-    refresh?(response: OnSuccessResponder<SubjectPayload<Subjects>>, input: {
-        type: string;
-        properties: any;
-        subject: string;
-        clientID: string;
-    }, req: Request): Promise<Response>;
-    /**
-     * @internal
-     */
-    error?(error: UnknownStateError, req: Request): Promise<Response>;
-    /**
-     * Override the logic for whether a client request is allowed to call the issuer.
-     *
-     * By default, it uses the following:
-     *
-     * - Allow if the `redirectURI` is localhost.
-     * - Compare `redirectURI` to the request's hostname or the `x-forwarded-host` header. If they
-     *   share the same apex domain, then allow.
-     *
-     * :::caution[Security Notice]
-     * The default implementation allows ANY `redirect_uri` on the same apex domain with no per-client isolation.
-     * Consider implementing a custom `allow` function with strict per-client validation if your deployment has:
-     * - Untrusted content on subdomains (user-generated content, third-party scripts)
-     * - Potential XSS attack vectors
-     * - Multiple client applications requiring isolation
-     * :::
-     *
-     * @example
-     * Recommended for production (per-client allowlist):
-     * ```ts
-     * {
-     *   allow: async (input, req) => {
-     *     const allowedRedirects = {
-     *       'web-client': ['https://app.example.com/callback'],
-     *       'mobile-client': ['https://admin.example.com/oauth'],
-     *     }
-     *     return allowedRedirects[input.clientID]?.includes(input.redirectURI) ?? false
-     *   }
-     * }
-     * ```
-     */
-    allow?(input: AllowCallbackInput, req: Request): Promise<boolean>;
-    /**
-     * Cookie configuration options.
-     */
-    cookies?: {
-        /**
-         * Path for cookies. Defaults to the current path.
-         * Set to "/" for root-level cookies that work across all paths.
-         */
-        path?: string;
-    };
-    /**
-     * Extract custom context from the request. This context is available
-     * in providers via `ctx.get("requestContext")` and in callbacks via `input.context`.
-     *
-     * @example
-     * ```ts
-     * context: (req) => ({
-     *   orgSlug: req.header("x-org-slug")!,
-     *   appSlug: req.header("x-app-slug")!,
-     * }),
-     * ```
-     */
-    context?: (req: Request) => RequestContext;
-    /**
-     * Base path for all routes. Can be a static string or a function that
-     * receives the request and returns the path.
-     *
-     * When set, OpenAuth will:
-     * 1. **Strip the basePath from incoming requests** for internal routing
-     * 2. **Prepend the basePath to outgoing URLs** (redirects, metadata endpoints)
-     *
-     * This enables clean integration when mounting the issuer at dynamic paths:
-     *
-     * @example
-     * ```ts
-     * const auth = issuer({
-     *   basePath: (req) => `/auth/${req.headers.get("x-org-slug")}`,
-     *   // ...
-     * })
-     *
-     * // Mount at dynamic path - no manual URL rewriting needed
-     * app.all("/auth/:orgSlug/*", (c) => {
-     *   c.req.raw.headers.set("x-org-slug", c.req.param("orgSlug"))
-     *   return auth.fetch(c.req.raw)
-     * })
-     * ```
-     */
-    basePath?: string | ((req: Request) => string);
-}
-/**
- * Create an OpenAuth server, a Hono app.
- */
-export declare function issuer<Providers extends Record<string, Provider<any>>, Subjects extends SubjectSchema, RequestContext = undefined, Result = {
-    [key in keyof Providers]: Prettify<{
-        provider: key;
-        tenantId?: string;
-        context: RequestContext;
-    } & (Providers[key] extends Provider<infer T> ? T : {})>;
-}[keyof Providers]>(input: IssuerInput<Providers, Subjects, RequestContext, Result>): import("hono/hono-base").HonoBase<{
-    Variables: {
-        authorization: AuthorizationState;
-        tenantId: string;
-        requestContext: RequestContext;
-    };
-}, import("hono/types").BlankSchema, "/", "*">;
-//# sourceMappingURL=issuer.d.ts.map

package/dist/types/issuer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../../src/issuer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4LG;AACH,OAAO,EAAE,QAAQ,EAAmB,MAAM,wBAAwB,CAAA;AAClE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,cAAc,CAAA;AAG5D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAA;AAI9B;;;;;;;;GAQG;AACH,MAAM,WAAW,kBAAkB,CACjC,CAAC,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,GAAG,CAAA;CAAE;IAE3C;;;;;OAKG;IACH,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,MAAM,CAAC,EAC5B,IAAI,EAAE,IAAI,EACV,UAAU,EAAE,OAAO,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,IAAI,CAAA;KAAE,CAAC,CAAC,YAAY,CAAC,EACpD,IAAI,CAAC,EAAE;QACL,GAAG,CAAC,EAAE;YACJ,MAAM,CAAC,EAAE,MAAM,CAAA;YACf,OAAO,CAAC,EAAE,MAAM,CAAA;SACjB,CAAA;QACD,OAAO,CAAC,EAAE,MAAM,CAAA;KACjB,GACA,OAAO,CAAC,QAAQ,CAAC,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;IACrB,KAAK,EAAE,MAAM,CAAA;IACb,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,IAAI,CAAC,EAAE;QACL,SAAS,EAAE,MAAM,CAAA;QACjB,MAAM,EAAE,MAAM,CAAA;KACf,CAAA;IACD,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,MAAM,QAAQ,CAAC,CAAC,IAAI;KACvB,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;CACrB,GAAG,EAAE,CAAA;AAEN,OAAO,EAIL,iBAAiB,EAClB,MAAM,YAAY,CAAA;AAEnB,OAAO,EAAW,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAI9D,OAAO,EAAY,KAAK,EAAE,MAAM,eAAe,CAAA;AAc/C,gBAAgB;AAChB,eAAO,MAAM,GAAG;;gFA3Ic,CAAC;;;;;;;;IA2IH,CAAA;AAE5B,MAAM,WAAW,WAAW,CAC1B,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC/C,QAAQ,SAAS,aAAa,EAC9B,cAAc,GAAG,SAAS,EAC1B,MAAM,GAAG;KACN,GAAG,IAAI,MAAM,SAAS,GAAG,QAAQ,CAChC;QACE,QAAQ,EAAE,GAAG,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,cAAc,CAAA;KACxB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CACxD;CACF,CAAC,MAAM,SAAS,CAAC;IAElB;;;;;;;;;;;;;;;;;;OAkBG;IACH,QAAQ,EAAE,QAAQ,CAAA;IAClB;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,EAAE,cAAc,CAAA;IACxB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA+CG;IACH,SAAS,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;IAC7D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,EAAE,KAAK,CAAA;IACb;;;;;;;;;;;;OAYG;IACH,GAAG,CAAC,EAAE;QACJ;;;WAGG;QACH,MAAM,CAAC,EAAE,MAAM,CAAA;QACf;;;WAGG;QACH,OAAO,CAAC,EAAE,MAAM,CAAA;QAChB;;;;WAIG;QACH,KAAK,CAAC,EAAE,MAAM,CAAA;QACd;;;WAGG;QACH,SAAS,CAAC,EAAE,MAAM,CAAA;KACnB,CAAA;IACD;;;;;;;;;;;;;;;;;;;OAmBG;IACH,MAAM,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC3E;;OAEG;IACH,KAAK,CAAC,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACnC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,OAAO,CACL,QAAQ,EAAE,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACtD,KAAK,EAAE,MAAM,EACb,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,OAAO,CAAC,CACN,QAAQ,EAAE,kBAAkB,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,EACtD,KAAK,EAAE;QACL,IAAI,EAAE,MAAM,CAAA;QACZ,UAAU,EAAE,GAAG,CAAA;QACf,OAAO,EAAE,MAAM,CAAA;QACf,QAAQ,EAAE,MAAM,CAAA;KACjB,EACD,GAAG,EAAE,OAAO,GACX,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpB;;OAEG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,iBAAiB,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAA;IACjE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA8BG;IACH,KAAK,CAAC,CAAC,KAAK,EAAE,kBAAkB,EAAE,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IACjE;;OAEG;IACH,OAAO,CAAC,EAAE;QACR;;;WAGG;QACH,IAAI,CAAC,EAAE,MAAM,CAAA;KACd,CAAA;IACD;;;;;;;;;;;OAWG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,cAAc,CAAA;IAC1C;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,QAAQ,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,KAAK,MAAM,CAAC,CAAA;CAC/C;AAED;;GAEG;AACH,wBAAgB,MAAM,CACpB,SAAS,SAAS,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC/C,QAAQ,SAAS,aAAa,EAC9B,cAAc,GAAG,SAAS,EAC1B,MAAM,GAAG;KACN,GAAG,IAAI,MAAM,SAAS,GAAG,QAAQ,CAChC;QACE,QAAQ,EAAE,GAAG,CAAA;QACb,QAAQ,CAAC,EAAE,MAAM,CAAA;QACjB,OAAO,EAAE,cAAc,CAAA;KACxB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,SAAS,QAAQ,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CACxD;CACF,CAAC,MAAM,SAAS,CAAC,EAClB,KAAK,EAAE,WAAW,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,CAAC;eAwSlD;QACT,aAAa,EAAE,kBAAkB,CAAA;QACjC,QAAQ,EAAE,MAAM,CAAA;QAChB,cAAc,EAAE,cAAc,CAAA;KAC/B;+CA0qBJ"}

package/dist/types/jwt.d.ts

@@ -1,6 +0,0 @@
-import { JWTPayload, KeyLike } from "jose";
-export declare namespace jwt {
-    function create(payload: JWTPayload, algorithm: string, privateKey: KeyLike): Promise<string>;
-    function verify<T>(token: string, publicKey: KeyLike): Promise<import("jose").JWTVerifyResult<T>>;
-}
-//# sourceMappingURL=jwt.d.ts.map

package/dist/types/jwt.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"jwt.d.ts","sourceRoot":"","sources":["../../src/jwt.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAa,OAAO,EAAW,MAAM,MAAM,CAAA;AAE9D,yBAAiB,GAAG,CAAC;IACnB,SAAgB,MAAM,CACpB,OAAO,EAAE,UAAU,EACnB,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,OAAO,mBAKpB;IAED,SAAgB,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,8CAE1D;CACF"}

package/dist/types/keys.d.ts

@@ -1,18 +0,0 @@
-import { JWK, KeyLike } from "jose";
-import { StorageAdapter } from "./storage/storage.js";
-export interface KeyPair {
-    id: string;
-    alg: string;
-    public: KeyLike;
-    private: KeyLike;
-    created: Date;
-    expired?: Date;
-    jwk: JWK;
-}
-/**
- * @deprecated use `signingKeys` instead
- */
-export declare function legacySigningKeys(storage: StorageAdapter): Promise<KeyPair[]>;
-export declare function signingKeys(storage: StorageAdapter): Promise<KeyPair[]>;
-export declare function encryptionKeys(storage: StorageAdapter): Promise<KeyPair[]>;
-//# sourceMappingURL=keys.d.ts.map

package/dist/types/keys.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"keys.d.ts","sourceRoot":"","sources":["../../src/keys.ts"],"names":[],"mappings":"AAAA,OAAO,EAOL,GAAG,EACH,OAAO,EACR,MAAM,MAAM,CAAA;AACb,OAAO,EAAW,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAc9D,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,OAAO,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,IAAI,CAAA;IACb,OAAO,CAAC,EAAE,IAAI,CAAA;IACd,GAAG,EAAE,GAAG,CAAA;CACT;AAED;;GAEG;AACH,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CAsBpB;AAED,wBAAsB,WAAW,CAAC,OAAO,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,CAoC7E;AAED,wBAAsB,cAAc,CAClC,OAAO,EAAE,cAAc,GACtB,OAAO,CAAC,OAAO,EAAE,CAAC,CAmCpB"}