@absolutejs/auth 0.30.0-beta.2 → 0.30.0-beta.4

package/dist/federation/tokenStore.d.ts

@@ -0,0 +1,29 @@
+import type { Vault } from '../vault/config';
+export type FederatedTokenSet = {
+    accessToken: string;
+    expiresAt?: number;
+    refreshToken?: string;
+    scopes?: string[];
+    storedAt: number;
+    tokenType?: string;
+};
+export type FederatedTokenStore = {
+    delete: (userId: string, provider: string, revoke?: (tokens: FederatedTokenSet) => Promise<void>) => Promise<void>;
+    get: (userId: string, provider: string) => Promise<FederatedTokenSet | undefined>;
+    list: (userId: string) => Promise<string[]>;
+    save: (userId: string, provider: string, tokens: Omit<FederatedTokenSet, 'storedAt'>) => Promise<void>;
+};
+export declare const createFederatedTokenStore: (vault: Vault) => FederatedTokenStore;
+export type FederatedTokenRefresher = (refreshToken: string) => Promise<{
+    access_token: string;
+    expires_in?: number;
+    refresh_token?: string;
+    token_type?: string;
+}>;
+export declare const getOrRefreshFederatedTokens: ({ now, provider, refresh, store, userId }: {
+    now?: number;
+    provider: string;
+    refresh?: FederatedTokenRefresher;
+    store: FederatedTokenStore;
+    userId: string;
+}) => Promise<FederatedTokenSet | undefined>;

package/dist/fingerprint-client/index.d.ts

@@ -0,0 +1,26 @@
+export type FingerprintSignals = {
+    audio?: number;
+    canvas?: string;
+    deviceMemory?: number;
+    fonts?: string[];
+    hardwareConcurrency?: number;
+    languages?: readonly string[];
+    pixelRatio?: number;
+    platform?: string;
+    screen?: {
+        colorDepth: number;
+        height: number;
+        width: number;
+    };
+    timezone?: string;
+    userAgent?: string;
+    webgl?: {
+        renderer?: string;
+        vendor?: string;
+    };
+};
+export type DeviceFingerprint = {
+    deviceId: string;
+    signals: FingerprintSignals;
+};
+export declare const collectDeviceFingerprint: () => Promise<DeviceFingerprint>;

package/dist/fingerprint-client/index.js

@@ -0,0 +1,183 @@
+// src/fingerprint-client/index.ts
+var CANVAS_TEXT = "absoluteAuth-fp \uD83D\uDD10";
+var CANVAS_WIDTH = 280;
+var CANVAS_HEIGHT = 60;
+var AUDIO_SAMPLES_COUNT = 4500;
+var AUDIO_OSC_FREQ = 1e4;
+var AUDIO_COMPRESSOR_THRESHOLD = -50;
+var AUDIO_COMPRESSOR_KNEE = 40;
+var AUDIO_COMPRESSOR_RATIO = 12;
+var AUDIO_COMPRESSOR_ATTACK = 0;
+var AUDIO_COMPRESSOR_RELEASE = 0.25;
+var AUDIO_SAMPLE_RATE = 44100;
+var FONT_PROBE = "mmmmmmmmmlli";
+var FONT_PROBE_PX = "72px";
+var FONT_PROBE_OFFSCREEN_PX = -9999;
+var FONT_BASE_FAMILIES = ["monospace", "sans-serif", "serif"];
+var POPULAR_FONTS = [
+  "Arial",
+  "Arial Black",
+  "Comic Sans MS",
+  "Courier New",
+  "Georgia",
+  "Helvetica",
+  "Impact",
+  "Lucida Console",
+  "Times New Roman",
+  "Trebuchet MS",
+  "Verdana",
+  "monospace",
+  "sans-serif",
+  "serif"
+];
+var readCanvas = () => {
+  try {
+    const canvas = document.createElement("canvas");
+    canvas.width = CANVAS_WIDTH;
+    canvas.height = CANVAS_HEIGHT;
+    const context = canvas.getContext("2d");
+    if (context === null)
+      return;
+    context.textBaseline = "top";
+    context.font = "14px Arial";
+    context.fillStyle = "#f60";
+    context.fillRect(125, 1, 62, 20);
+    context.fillStyle = "#069";
+    context.fillText(CANVAS_TEXT, 2, 15);
+    context.fillStyle = "rgba(102, 204, 0, 0.7)";
+    context.fillText(CANVAS_TEXT, 4, 17);
+    return canvas.toDataURL();
+  } catch {
+    return;
+  }
+};
+var resolveOfflineAudioContextCtor = () => {
+  if (typeof OfflineAudioContext !== "undefined")
+    return OfflineAudioContext;
+  const legacy = globalThis;
+  return legacy.webkitOfflineAudioContext;
+};
+var sumAbs = (samples) => {
+  let total = 0;
+  for (const sample of samples)
+    total += Math.abs(sample);
+  return total;
+};
+var readAudio = async () => {
+  try {
+    const ContextCtor = resolveOfflineAudioContextCtor();
+    if (ContextCtor === undefined)
+      return;
+    const context = new ContextCtor(1, AUDIO_SAMPLES_COUNT, AUDIO_SAMPLE_RATE);
+    const oscillator = context.createOscillator();
+    oscillator.type = "triangle";
+    oscillator.frequency.value = AUDIO_OSC_FREQ;
+    const compressor = context.createDynamicsCompressor();
+    compressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;
+    compressor.knee.value = AUDIO_COMPRESSOR_KNEE;
+    compressor.ratio.value = AUDIO_COMPRESSOR_RATIO;
+    compressor.attack.value = AUDIO_COMPRESSOR_ATTACK;
+    compressor.release.value = AUDIO_COMPRESSOR_RELEASE;
+    oscillator.connect(compressor);
+    compressor.connect(context.destination);
+    oscillator.start(0);
+    const buffer = await context.startRendering();
+    return sumAbs(buffer.getChannelData(0));
+  } catch {
+    return;
+  }
+};
+var readWebgl = () => {
+  try {
+    const canvas = document.createElement("canvas");
+    const context = canvas.getContext("webgl") ?? canvas.getContext("experimental-webgl");
+    if (context === null || !("getExtension" in context) || !("getParameter" in context)) {
+      return;
+    }
+    const debug = context.getExtension("WEBGL_debug_renderer_info");
+    if (debug === null)
+      return;
+    return {
+      renderer: String(context.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ""),
+      vendor: String(context.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? "")
+    };
+  } catch {
+    return;
+  }
+};
+var measureFamily = (span, family) => {
+  span.style.fontFamily = family;
+  return span.offsetWidth;
+};
+var detectFontPresent = (span, font, baseline) => FONT_BASE_FAMILIES.some((family) => measureFamily(span, `'${font}', ${family}`) !== baseline[family]);
+var readFonts = () => {
+  try {
+    const span = document.createElement("span");
+    span.style.position = "absolute";
+    span.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;
+    span.style.fontSize = FONT_PROBE_PX;
+    span.textContent = FONT_PROBE;
+    document.body.appendChild(span);
+    const baseline = Object.fromEntries(FONT_BASE_FAMILIES.map((family) => [family, measureFamily(span, family)]));
+    const present = POPULAR_FONTS.filter((font) => detectFontPresent(span, font, baseline));
+    document.body.removeChild(span);
+    return present;
+  } catch {
+    return;
+  }
+};
+var readScreen = () => {
+  if (typeof screen === "undefined")
+    return;
+  return {
+    colorDepth: screen.colorDepth,
+    height: screen.height,
+    width: screen.width
+  };
+};
+var readTimezone = () => {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone;
+  } catch {
+    return;
+  }
+};
+var canonical = (signals) => JSON.stringify(signals, (_key, value) => value === null || typeof value !== "object" || Array.isArray(value) ? value : Object.fromEntries(Object.entries(value).sort((left, right) => left[0].localeCompare(right[0]))));
+var sha256Base64Url = async (input) => {
+  const bytes = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(input));
+  const binary = String.fromCharCode(...new Uint8Array(bytes));
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+};
+var collectDeviceFingerprint = async () => {
+  if (typeof window === "undefined" || typeof document === "undefined") {
+    throw new Error("collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead");
+  }
+  const [canvas, audio, webgl, fonts] = await Promise.all([
+    Promise.resolve(readCanvas()),
+    readAudio(),
+    Promise.resolve(readWebgl()),
+    Promise.resolve(readFonts())
+  ]);
+  const deviceMemory = "deviceMemory" in navigator ? Reflect.get(navigator, "deviceMemory") : undefined;
+  const signals = {
+    audio,
+    canvas,
+    deviceMemory: typeof deviceMemory === "number" ? deviceMemory : undefined,
+    fonts,
+    hardwareConcurrency: navigator.hardwareConcurrency,
+    languages: navigator.languages,
+    pixelRatio: window.devicePixelRatio,
+    platform: navigator.platform,
+    screen: readScreen(),
+    timezone: readTimezone(),
+    userAgent: navigator.userAgent,
+    webgl
+  };
+  return { deviceId: await sha256Base64Url(canonical(signals)), signals };
+};
+export {
+  collectDeviceFingerprint
+};
+
+//# debugId=0B8B6C4FD47EEDE764756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/fingerprint-client/index.js.map

@@ -0,0 +1,10 @@
+{
+  "version": 3,
+  "sources": ["../../src/fingerprint-client/index.ts"],
+  "sourcesContent": [
+    "// Browser-side device fingerprint collector.\n//\n// `collectDeviceFingerprint()` reads ~10 signals from the browser (canvas render,\n// AudioContext, WebGL renderer, font enumeration, screen geometry, navigator.languages,\n// timezone, hardware concurrency, device memory, pixel ratio), normalizes them, and\n// hashes the canonical JSON into a stable base64url SHA-256 `deviceId`.\n//\n// Self-hosted equivalent of FingerprintJS's open-source library. Each individual signal\n// is weak on its own — but their combination is highly stable across sessions for the\n// same browser+device, and varies sharply across different browsers/devices. The same\n// algorithms underpin every commercial fingerprinter; only the proprietary data network\n// (cross-customer reputation) is what SaaS vendors charge for, and that's a non-goal here.\n//\n// Imported via `@absolutejs/auth/fingerprint-client` — server bundle does NOT pull this in\n// (browser globals like `window` would explode there). The client SDK + your sign-in form\n// call this, send the result as `x-client-fingerprint`, and the server (riskConfig / adaptive)\n// uses it as the deviceId instead of the weak UA+IP fallback.\n\nconst CANVAS_TEXT = 'absoluteAuth-fp 🔐';\nconst CANVAS_WIDTH = 280;\nconst CANVAS_HEIGHT = 60;\nconst AUDIO_SAMPLES_COUNT = 4500;\nconst AUDIO_OSC_FREQ = 10_000;\nconst AUDIO_COMPRESSOR_THRESHOLD = -50;\nconst AUDIO_COMPRESSOR_KNEE = 40;\nconst AUDIO_COMPRESSOR_RATIO = 12;\nconst AUDIO_COMPRESSOR_ATTACK = 0;\nconst AUDIO_COMPRESSOR_RELEASE = 0.25;\nconst AUDIO_SAMPLE_RATE = 44_100;\nconst FONT_PROBE = 'mmmmmmmmmlli';\nconst FONT_PROBE_PX = '72px';\nconst FONT_PROBE_OFFSCREEN_PX = -9999;\nconst FONT_BASE_FAMILIES = ['monospace', 'sans-serif', 'serif'] as const;\nconst POPULAR_FONTS = [\n\t'Arial',\n\t'Arial Black',\n\t'Comic Sans MS',\n\t'Courier New',\n\t'Georgia',\n\t'Helvetica',\n\t'Impact',\n\t'Lucida Console',\n\t'Times New Roman',\n\t'Trebuchet MS',\n\t'Verdana',\n\t'monospace',\n\t'sans-serif',\n\t'serif'\n];\n\nexport type FingerprintSignals = {\n\taudio?: number;\n\tcanvas?: string;\n\tdeviceMemory?: number;\n\tfonts?: string[];\n\thardwareConcurrency?: number;\n\tlanguages?: readonly string[];\n\tpixelRatio?: number;\n\tplatform?: string;\n\tscreen?: { colorDepth: number; height: number; width: number };\n\ttimezone?: string;\n\tuserAgent?: string;\n\twebgl?: { renderer?: string; vendor?: string };\n};\n\nexport type DeviceFingerprint = {\n\tdeviceId: string;\n\tsignals: FingerprintSignals;\n};\n\n// Canvas hash: render text + a curve + a couple of rectangles + return the data URL\n// (its pixel content hashes differently across GPUs, drivers, browser versions, font\n// renderers). Wrapped in try/catch because privacy-mode browsers throw on getContext.\nconst readCanvas = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tcanvas.width = CANVAS_WIDTH;\n\t\tcanvas.height = CANVAS_HEIGHT;\n\t\tconst context = canvas.getContext('2d');\n\t\tif (context === null) return undefined;\n\t\tcontext.textBaseline = 'top';\n\t\tcontext.font = '14px Arial';\n\t\tcontext.fillStyle = '#f60';\n\t\tcontext.fillRect(125, 1, 62, 20);\n\t\tcontext.fillStyle = '#069';\n\t\tcontext.fillText(CANVAS_TEXT, 2, 15);\n\t\tcontext.fillStyle = 'rgba(102, 204, 0, 0.7)';\n\t\tcontext.fillText(CANVAS_TEXT, 4, 17);\n\n\t\treturn canvas.toDataURL();\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\ntype LegacyOfflineCtxGlobal = {\n\twebkitOfflineAudioContext?: typeof OfflineAudioContext;\n};\n\nconst resolveOfflineAudioContextCtor = () => {\n\tif (typeof OfflineAudioContext !== 'undefined') return OfflineAudioContext;\n\t// eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- vendor-prefixed legacy API; no TS type ships for it\n\tconst legacy = globalThis as LegacyOfflineCtxGlobal;\n\n\treturn legacy.webkitOfflineAudioContext;\n};\n\nconst sumAbs = (samples: Float32Array) => {\n\tlet total = 0;\n\tfor (const sample of samples) total += Math.abs(sample);\n\n\treturn total;\n};\n\n// Audio hash: instantiate an offline audio context, push a brief oscillator + dynamics\n// compressor through it, read back the rendered buffer's sum. Different audio stacks\n// produce subtly different floating-point outputs.\nconst readAudio = async () => {\n\ttry {\n\t\tconst ContextCtor = resolveOfflineAudioContextCtor();\n\t\tif (ContextCtor === undefined) return undefined;\n\t\tconst context = new ContextCtor(1, AUDIO_SAMPLES_COUNT, AUDIO_SAMPLE_RATE);\n\t\tconst oscillator = context.createOscillator();\n\t\toscillator.type = 'triangle';\n\t\toscillator.frequency.value = AUDIO_OSC_FREQ;\n\t\tconst compressor = context.createDynamicsCompressor();\n\t\tcompressor.threshold.value = AUDIO_COMPRESSOR_THRESHOLD;\n\t\tcompressor.knee.value = AUDIO_COMPRESSOR_KNEE;\n\t\tcompressor.ratio.value = AUDIO_COMPRESSOR_RATIO;\n\t\t// `reduction` is read-only on the modern spec (the constant exists for the\n\t\t// outdated browsers that originally exposed it as a writable AudioParam;\n\t\t// we don't bother setting it — the fingerprint is plenty stable without).\n\t\tcompressor.attack.value = AUDIO_COMPRESSOR_ATTACK;\n\t\tcompressor.release.value = AUDIO_COMPRESSOR_RELEASE;\n\t\toscillator.connect(compressor);\n\t\tcompressor.connect(context.destination);\n\t\toscillator.start(0);\n\t\tconst buffer = await context.startRendering();\n\n\t\treturn sumAbs(buffer.getChannelData(0));\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// WebGL hash: the renderer + vendor strings include GPU model + driver — highly stable,\n// highly distinctive. Behind the WEBGL_debug_renderer_info extension on most browsers.\nconst readWebgl = () => {\n\ttry {\n\t\tconst canvas = document.createElement('canvas');\n\t\tconst context =\n\t\t\tcanvas.getContext('webgl') ?? canvas.getContext('experimental-webgl');\n\t\tif (\n\t\t\tcontext === null ||\n\t\t\t!('getExtension' in context) ||\n\t\t\t!('getParameter' in context)\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\t\tconst debug = context.getExtension('WEBGL_debug_renderer_info');\n\t\tif (debug === null) return undefined;\n\n\t\treturn {\n\t\t\trenderer: String(\n\t\t\t\tcontext.getParameter(debug.UNMASKED_RENDERER_WEBGL) ?? ''\n\t\t\t),\n\t\t\tvendor: String(context.getParameter(debug.UNMASKED_VENDOR_WEBGL) ?? '')\n\t\t};\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Width of `probe` rendered in `family` on the given span — used to detect installed\n// fonts (different widths than the fallback ⇒ font is present).\nconst measureFamily = (span: HTMLSpanElement, family: string) => {\n\tspan.style.fontFamily = family;\n\n\treturn span.offsetWidth;\n};\n\nconst detectFontPresent = (\n\tspan: HTMLSpanElement,\n\tfont: string,\n\tbaseline: Record<string, number>\n) =>\n\tFONT_BASE_FAMILIES.some(\n\t\t(family) =>\n\t\t\tmeasureFamily(span, `'${font}', ${family}`) !== baseline[family]\n\t);\n\n// Font enumeration: a font is \"installed\" if the rendered width of a probe string differs\n// from the same string in a known fallback. Compares against monospace + sans-serif +\n// serif and counts a match if any of them produce a different width.\nconst readFonts = () => {\n\ttry {\n\t\tconst span = document.createElement('span');\n\t\tspan.style.position = 'absolute';\n\t\tspan.style.left = `${FONT_PROBE_OFFSCREEN_PX}px`;\n\t\tspan.style.fontSize = FONT_PROBE_PX;\n\t\tspan.textContent = FONT_PROBE;\n\t\tdocument.body.appendChild(span);\n\n\t\tconst baseline: Record<string, number> = Object.fromEntries(\n\t\t\tFONT_BASE_FAMILIES.map((family) => [family, measureFamily(span, family)])\n\t\t);\n\t\tconst present = POPULAR_FONTS.filter((font) =>\n\t\t\tdetectFontPresent(span, font, baseline)\n\t\t);\n\n\t\tdocument.body.removeChild(span);\n\n\t\treturn present;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\nconst readScreen = () => {\n\tif (typeof screen === 'undefined') return undefined;\n\n\treturn {\n\t\tcolorDepth: screen.colorDepth,\n\t\theight: screen.height,\n\t\twidth: screen.width\n\t};\n};\n\nconst readTimezone = () => {\n\ttry {\n\t\treturn Intl.DateTimeFormat().resolvedOptions().timeZone;\n\t} catch {\n\t\treturn undefined;\n\t}\n};\n\n// Canonical JSON identical to the server-side `fingerprintDevice` canonicalizer: keys\n// sorted at every depth so identical signals produce identical hashes regardless of\n// insertion order. Inlined here to keep the client bundle free of server-side imports.\nconst canonical = (signals: FingerprintSignals) =>\n\tJSON.stringify(signals, (_key, value) =>\n\t\tvalue === null || typeof value !== 'object' || Array.isArray(value)\n\t\t\t? value\n\t\t\t: Object.fromEntries(\n\t\t\t\t\tObject.entries(value).sort((left, right) =>\n\t\t\t\t\t\tleft[0].localeCompare(right[0])\n\t\t\t\t\t)\n\t\t\t\t)\n\t);\n\nconst sha256Base64Url = async (input: string) => {\n\tconst bytes = await crypto.subtle.digest(\n\t\t'SHA-256',\n\t\tnew TextEncoder().encode(input)\n\t);\n\tconst binary = String.fromCharCode(...new Uint8Array(bytes));\n\n\treturn btoa(binary)\n\t\t.replace(/\\+/g, '-')\n\t\t.replace(/\\//g, '_')\n\t\t.replace(/=+$/, '');\n};\n\n// Collect every signal we can, hash them, return both so the caller can persist the raw\n// signals (for debugging / drift detection) while sending just the deviceId on the wire.\nexport const collectDeviceFingerprint = async (): Promise<DeviceFingerprint> => {\n\tif (typeof window === 'undefined' || typeof document === 'undefined') {\n\t\tthrow new Error(\n\t\t\t'collectDeviceFingerprint must run in a browser — server-side use the @absolutejs/auth fingerprintDevice helper instead'\n\t\t);\n\t}\n\tconst [canvas, audio, webgl, fonts] = await Promise.all([\n\t\tPromise.resolve(readCanvas()),\n\t\treadAudio(),\n\t\tPromise.resolve(readWebgl()),\n\t\tPromise.resolve(readFonts())\n\t]);\n\n\tconst deviceMemory =\n\t\t'deviceMemory' in navigator\n\t\t\t? Reflect.get(navigator, 'deviceMemory')\n\t\t\t: undefined;\n\tconst signals: FingerprintSignals = {\n\t\taudio,\n\t\tcanvas,\n\t\tdeviceMemory: typeof deviceMemory === 'number' ? deviceMemory : undefined,\n\t\tfonts,\n\t\thardwareConcurrency: navigator.hardwareConcurrency,\n\t\tlanguages: navigator.languages,\n\t\tpixelRatio: window.devicePixelRatio,\n\t\tplatform: navigator.platform,\n\t\tscreen: readScreen(),\n\t\ttimezone: readTimezone(),\n\t\tuserAgent: navigator.userAgent,\n\t\twebgl\n\t};\n\n\treturn { deviceId: await sha256Base64Url(canonical(signals)), signals };\n};\n"
+  ],
+  "mappings": ";AAkBA,IAAM,cAAc;AACpB,IAAM,eAAe;AACrB,IAAM,gBAAgB;AACtB,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AACvB,IAAM,6BAA6B;AACnC,IAAM,wBAAwB;AAC9B,IAAM,yBAAyB;AAC/B,IAAM,0BAA0B;AAChC,IAAM,2BAA2B;AACjC,IAAM,oBAAoB;AAC1B,IAAM,aAAa;AACnB,IAAM,gBAAgB;AACtB,IAAM,0BAA0B;AAChC,IAAM,qBAAqB,CAAC,aAAa,cAAc,OAAO;AAC9D,IAAM,gBAAgB;AAAA,EACrB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACD;AAyBA,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,OAAO,QAAQ;AAAA,IACf,OAAO,SAAS;AAAA,IAChB,MAAM,UAAU,OAAO,WAAW,IAAI;AAAA,IACtC,IAAI,YAAY;AAAA,MAAM;AAAA,IACtB,QAAQ,eAAe;AAAA,IACvB,QAAQ,OAAO;AAAA,IACf,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,KAAK,GAAG,IAAI,EAAE;AAAA,IAC/B,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IACnC,QAAQ,YAAY;AAAA,IACpB,QAAQ,SAAS,aAAa,GAAG,EAAE;AAAA,IAEnC,OAAO,OAAO,UAAU;AAAA,IACvB,MAAM;AAAA,IACP;AAAA;AAAA;AAQF,IAAM,iCAAiC,MAAM;AAAA,EAC5C,IAAI,OAAO,wBAAwB;AAAA,IAAa,OAAO;AAAA,EAEvD,MAAM,SAAS;AAAA,EAEf,OAAO,OAAO;AAAA;AAGf,IAAM,SAAS,CAAC,YAA0B;AAAA,EACzC,IAAI,QAAQ;AAAA,EACZ,WAAW,UAAU;AAAA,IAAS,SAAS,KAAK,IAAI,MAAM;AAAA,EAEtD,OAAO;AAAA;AAMR,IAAM,YAAY,YAAY;AAAA,EAC7B,IAAI;AAAA,IACH,MAAM,cAAc,+BAA+B;AAAA,IACnD,IAAI,gBAAgB;AAAA,MAAW;AAAA,IAC/B,MAAM,UAAU,IAAI,YAAY,GAAG,qBAAqB,iBAAiB;AAAA,IACzE,MAAM,aAAa,QAAQ,iBAAiB;AAAA,IAC5C,WAAW,OAAO;AAAA,IAClB,WAAW,UAAU,QAAQ;AAAA,IAC7B,MAAM,aAAa,QAAQ,yBAAyB;AAAA,IACpD,WAAW,UAAU,QAAQ;AAAA,IAC7B,WAAW,KAAK,QAAQ;AAAA,IACxB,WAAW,MAAM,QAAQ;AAAA,IAIzB,WAAW,OAAO,QAAQ;AAAA,IAC1B,WAAW,QAAQ,QAAQ;AAAA,IAC3B,WAAW,QAAQ,UAAU;AAAA,IAC7B,WAAW,QAAQ,QAAQ,WAAW;AAAA,IACtC,WAAW,MAAM,CAAC;AAAA,IAClB,MAAM,SAAS,MAAM,QAAQ,eAAe;AAAA,IAE5C,OAAO,OAAO,OAAO,eAAe,CAAC,CAAC;AAAA,IACrC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,SAAS,SAAS,cAAc,QAAQ;AAAA,IAC9C,MAAM,UACL,OAAO,WAAW,OAAO,KAAK,OAAO,WAAW,oBAAoB;AAAA,IACrE,IACC,YAAY,QACZ,EAAE,kBAAkB,YACpB,EAAE,kBAAkB,UACnB;AAAA,MACD;AAAA,IACD;AAAA,IACA,MAAM,QAAQ,QAAQ,aAAa,2BAA2B;AAAA,IAC9D,IAAI,UAAU;AAAA,MAAM;AAAA,IAEpB,OAAO;AAAA,MACN,UAAU,OACT,QAAQ,aAAa,MAAM,uBAAuB,KAAK,EACxD;AAAA,MACA,QAAQ,OAAO,QAAQ,aAAa,MAAM,qBAAqB,KAAK,EAAE;AAAA,IACvE;AAAA,IACC,MAAM;AAAA,IACP;AAAA;AAAA;AAMF,IAAM,gBAAgB,CAAC,MAAuB,WAAmB;AAAA,EAChE,KAAK,MAAM,aAAa;AAAA,EAExB,OAAO,KAAK;AAAA;AAGb,IAAM,oBAAoB,CACzB,MACA,MACA,aAEA,mBAAmB,KAClB,CAAC,WACA,cAAc,MAAM,IAAI,UAAU,QAAQ,MAAM,SAAS,OAC3D;AAKD,IAAM,YAAY,MAAM;AAAA,EACvB,IAAI;AAAA,IACH,MAAM,OAAO,SAAS,cAAc,MAAM;AAAA,IAC1C,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,MAAM,OAAO,GAAG;AAAA,IACrB,KAAK,MAAM,WAAW;AAAA,IACtB,KAAK,cAAc;AAAA,IACnB,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,MAAM,WAAmC,OAAO,YAC/C,mBAAmB,IAAI,CAAC,WAAW,CAAC,QAAQ,cAAc,MAAM,MAAM,CAAC,CAAC,CACzE;AAAA,IACA,MAAM,UAAU,cAAc,OAAO,CAAC,SACrC,kBAAkB,MAAM,MAAM,QAAQ,CACvC;AAAA,IAEA,SAAS,KAAK,YAAY,IAAI;AAAA,IAE9B,OAAO;AAAA,IACN,MAAM;AAAA,IACP;AAAA;AAAA;AAIF,IAAM,aAAa,MAAM;AAAA,EACxB,IAAI,OAAO,WAAW;AAAA,IAAa;AAAA,EAEnC,OAAO;AAAA,IACN,YAAY,OAAO;AAAA,IACnB,QAAQ,OAAO;AAAA,IACf,OAAO,OAAO;AAAA,EACf;AAAA;AAGD,IAAM,eAAe,MAAM;AAAA,EAC1B,IAAI;AAAA,IACH,OAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE;AAAA,IAC9C,MAAM;AAAA,IACP;AAAA;AAAA;AAOF,IAAM,YAAY,CAAC,YAClB,KAAK,UAAU,SAAS,CAAC,MAAM,UAC9B,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,IAC/D,QACA,OAAO,YACP,OAAO,QAAQ,KAAK,EAAE,KAAK,CAAC,MAAM,UACjC,KAAK,GAAG,cAAc,MAAM,EAAE,CAC/B,CACD,CACH;AAED,IAAM,kBAAkB,OAAO,UAAkB;AAAA,EAChD,MAAM,QAAQ,MAAM,OAAO,OAAO,OACjC,WACA,IAAI,YAAY,EAAE,OAAO,KAAK,CAC/B;AAAA,EACA,MAAM,SAAS,OAAO,aAAa,GAAG,IAAI,WAAW,KAAK,CAAC;AAAA,EAE3D,OAAO,KAAK,MAAM,EAChB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,GAAG,EAClB,QAAQ,OAAO,EAAE;AAAA;AAKb,IAAM,2BAA2B,YAAwC;AAAA,EAC/E,IAAI,OAAO,WAAW,eAAe,OAAO,aAAa,aAAa;AAAA,IACrE,MAAM,IAAI,MACT,wHACD;AAAA,EACD;AAAA,EACA,OAAO,QAAQ,OAAO,OAAO,SAAS,MAAM,QAAQ,IAAI;AAAA,IACvD,QAAQ,QAAQ,WAAW,CAAC;AAAA,IAC5B,UAAU;AAAA,IACV,QAAQ,QAAQ,UAAU,CAAC;AAAA,IAC3B,QAAQ,QAAQ,UAAU,CAAC;AAAA,EAC5B,CAAC;AAAA,EAED,MAAM,eACL,kBAAkB,YACf,QAAQ,IAAI,WAAW,cAAc,IACrC;AAAA,EACJ,MAAM,UAA8B;AAAA,IACnC;AAAA,IACA;AAAA,IACA,cAAc,OAAO,iBAAiB,WAAW,eAAe;AAAA,IAChE;AAAA,IACA,qBAAqB,UAAU;AAAA,IAC/B,WAAW,UAAU;AAAA,IACrB,YAAY,OAAO;AAAA,IACnB,UAAU,UAAU;AAAA,IACpB,QAAQ,WAAW;AAAA,IACnB,UAAU,aAAa;AAAA,IACvB,WAAW,UAAU;AAAA,IACrB;AAAA,EACD;AAAA,EAEA,OAAO,EAAE,UAAU,MAAM,gBAAgB,UAAU,OAAO,CAAC,GAAG,QAAQ;AAAA;",
+  "debugId": "0B8B6C4FD47EEDE764756E2164756E21",
+  "names": []
+}

package/dist/index.d.ts

@@ -15017,6 +15017,8 @@ export * from './vault/config';
 export * from './vault/types';
 export { createInMemoryVaultStore } from './vault/inMemoryVaultStore';
 export { createNeonVaultStore, createPostgresVaultStore, vaultEntriesTable } from './vault/postgresVaultStore';
+export { createFederatedTokenStore, getOrRefreshFederatedTokens } from './federation/tokenStore';
+export type { FederatedTokenRefresher, FederatedTokenSet, FederatedTokenStore } from './federation/tokenStore';
 export type { AuthSessionStore } from './session/types';
 export { isAuthIntent, isUserSessionId, isValidUser } from './typeGuards';
 export { AuthIdentityConflictError } from './errors';

package/dist/index.js

@@ -19048,6 +19048,69 @@ var createPostgresVaultStore = (db) => ({
     });
   }
 });
+// src/federation/tokenStore.ts
+var VAULT_NAME_PREFIX = "federated:";
+var REFRESH_EARLY_WINDOW_MS = 30000;
+var nameFor = (provider) => `${VAULT_NAME_PREFIX}${provider}`;
+var parse = (raw) => {
+  if (raw === undefined)
+    return;
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed !== "object" || parsed === null)
+      return;
+    return parsed;
+  } catch {
+    return;
+  }
+};
+var createFederatedTokenStore = (vault) => ({
+  delete: async (userId, provider, revoke2) => {
+    const current = revoke2 === undefined ? undefined : parse(await vault.get(userId, nameFor(provider)));
+    if (current !== undefined && revoke2 !== undefined) {
+      await revoke2(current).catch(() => {
+        return;
+      });
+    }
+    await vault.delete(userId, nameFor(provider));
+  },
+  get: async (userId, provider) => parse(await vault.get(userId, nameFor(provider))),
+  list: async (userId) => (await vault.list(userId)).filter((name) => name.startsWith(VAULT_NAME_PREFIX)).map((name) => name.slice(VAULT_NAME_PREFIX.length)),
+  save: async (userId, provider, tokens) => {
+    const record = { ...tokens, storedAt: Date.now() };
+    await vault.put(userId, nameFor(provider), JSON.stringify(record));
+  }
+});
+var isExpired = (tokens, now) => {
+  if (tokens.expiresAt === undefined)
+    return false;
+  return tokens.expiresAt - REFRESH_EARLY_WINDOW_MS <= now;
+};
+var getOrRefreshFederatedTokens = async ({
+  now = Date.now(),
+  provider,
+  refresh: refresh2,
+  store,
+  userId
+}) => {
+  const current = await store.get(userId, provider);
+  if (current === undefined)
+    return;
+  if (!isExpired(current, now) || current.refreshToken === undefined || refresh2 === undefined) {
+    return current;
+  }
+  const refreshed = await refresh2(current.refreshToken);
+  const expiresIn = typeof refreshed.expires_in === "number" ? refreshed.expires_in : undefined;
+  const updated = {
+    accessToken: refreshed.access_token,
+    expiresAt: expiresIn === undefined ? undefined : now + expiresIn * 1000,
+    refreshToken: refreshed.refresh_token ?? current.refreshToken,
+    scopes: current.scopes,
+    tokenType: refreshed.token_type ?? current.tokenType
+  };
+  await store.save(userId, provider, updated);
+  return { ...updated, storedAt: now };
+};
 // src/session/inMemoryStore.ts
 var cloneSessionData = (value) => ({
   ...value
@@ -19207,7 +19270,7 @@ var createNeonAuthSessionStore = (databaseUrl) => {
 // src/session/redisStore.ts
 var SESSION_SEGMENT = "sess:";
 var UNREGISTERED_SEGMENT = "unreg:";
-var parse = (raw) => {
+var parse2 = (raw) => {
   if (raw === null)
     return;
   try {
@@ -19226,8 +19289,8 @@ var createRedisAuthSessionStore = (redis, keyPrefix = "auth:session:") => {
     return keys.map((key) => key.slice(offset)).filter(isUserSessionId);
   };
   return {
-    getSession: async (id) => parse(await redis.get(sessionKey(id))),
-    getUnregisteredSession: async (id) => parse(await redis.get(unregisteredKey(id))),
+    getSession: async (id) => parse2(await redis.get(sessionKey(id))),
+    getUnregisteredSession: async (id) => parse2(await redis.get(unregisteredKey(id))),
     listSessionIds: () => listIds(SESSION_SEGMENT),
     listUnregisteredSessionIds: () => listIds(UNREGISTERED_SEGMENT),
     removeSession: async (id) => {
@@ -20067,8 +20130,8 @@ var validateSession = ({
   if (!userSession) {
     return;
   }
-  const isExpired = userSession.expiresAt < Date.now();
-  if (isExpired) {
+  const isExpired2 = userSession.expiresAt < Date.now();
+  if (isExpired2) {
     delete session[userSessionId];
     user_session_id.remove();
     return;
@@ -23239,6 +23302,7 @@ export {
   getUserSessionId,
   getStatus,
   getRegisteredClient,
+  getOrRefreshFederatedTokens,
   generateTotpSecret,
   generateTotp,
   generateSigningKey,
@@ -23386,6 +23450,7 @@ export {
   createInMemoryApiClientStore,
   createInMemoryAccessTokenStore,
   createFgaEngine,
+  createFederatedTokenStore,
   createAuthHtmxRoutes,
   createAuditRedactor,
   createAuditEmitter,
@@ -23450,5 +23515,5 @@ export {
   AuthIdentityConflictError
 };
 
-//# debugId=658AE7172110F24564756E2164756E21
+//# debugId=2099933871462CB064756E2164756E21
 //# sourceMappingURL=index.js.map