@absolutejs/auth 0.56.2 → 0.56.3

package/dist/agents/types.d.ts

@@ -1,129 +0,0 @@
-export type AgentRegistrationStatus = 'active' | 'revoked';
-export type AgentDelegationStatus = 'active' | 'revoked';
-/** A durable identity for an agent client. This is deliberately protocol-neutral:
- * `clientId` can refer to an OAuth client, while adapters for other protocols can
- * use `agentId` without manufacturing OAuth metadata. */
-export type AgentRegistration = {
-    agentId: string;
-    allowedScopes: string[];
-    clientId?: string;
-    createdAt: number;
-    metadata?: Record<string, unknown>;
-    name: string;
-    status: AgentRegistrationStatus;
-    updatedAt: number;
-};
-export type AgentRegistrationStore = {
-    findByAgentId: (agentId: string) => Promise<AgentRegistration | undefined>;
-    findByClientId: (clientId: string) => Promise<AgentRegistration | undefined>;
-    listRegistrations: () => Promise<AgentRegistration[]>;
-    saveRegistration: (registration: AgentRegistration) => Promise<void>;
-};
-/** A user's explicit grant to an agent. Authorization details use RFC 9396's
- * open object shape so applications can express transaction constraints without
- * forcing them into coarse OAuth scope strings. */
-export type AgentDelegation = {
-    agentId: string;
-    authorizationDetails?: Record<string, unknown>[];
-    createdAt: number;
-    delegationId: string;
-    expiresAt?: number;
-    organizationId?: string;
-    scopes: string[];
-    status: AgentDelegationStatus;
-    updatedAt: number;
-    userId: string;
-};
-export type AgentDelegationStore = {
-    findActiveDelegation: (query: {
-        agentId: string;
-        now?: number;
-        organizationId?: string;
-        userId: string;
-    }) => Promise<AgentDelegation | undefined>;
-    findByDelegationId: (delegationId: string) => Promise<AgentDelegation | undefined>;
-    listDelegations: (agentId?: string) => Promise<AgentDelegation[]>;
-    saveDelegation: (delegation: AgentDelegation) => Promise<void>;
-};
-/** The normalized result produced by a wire-protocol adapter. The core never
- * handles raw provider assertions; it authorizes only this verified shape. */
-export type VerifiedAgentCredential = {
-    agentId: string;
-    claims?: Record<string, unknown>;
-    expiresAt?: number;
-    organizationId?: string;
-    resource?: string;
-    scopes: string[];
-    userId?: string;
-};
-export type AgentCredentialVerifier = (request: Request) => Promise<VerifiedAgentCredential | undefined>;
-export type AgentPrincipal = {
-    agentId: string;
-    authorizationDetails?: Record<string, unknown>[];
-    delegationId?: string;
-    kind: 'agent';
-    name: string;
-    organizationId?: string;
-    scopes: string[];
-    trust: 'delegated' | 'registered';
-    userId?: string;
-};
-export type AgentIdentityRegistrationKind = 'anonymous' | 'identity_assertion' | 'service_auth';
-export type AgentIdentityRegistrationStatus = 'claimed' | 'pending' | 'revoked';
-export type AgentClaimAttempt = {
-    attempts: number;
-    email: string;
-    expiresAt: number;
-    tokenHash: string;
-    userCodeHash: string;
-};
-/** Durable state for the open auth.md registration profile. Secrets are
- * represented only by hashes; plaintext claim and attempt tokens are returned
- * once to the agent and never persisted. `version` is used for compare-and-swap
- * updates so claim completion is safe across multiple application instances. */
-export type AgentIdentityRegistration = {
-    agentId: string;
-    claimAttempt?: AgentClaimAttempt;
-    claimExpiresAt: number;
-    claimTokenHash: string;
-    createdAt: number;
-    expiresAt: number;
-    kind: AgentIdentityRegistrationKind;
-    loginHint?: string;
-    lastPolledAt?: number;
-    registrationId: string;
-    status: AgentIdentityRegistrationStatus;
-    updatedAt: number;
-    upstream?: {
-        clientId: string;
-        issuer: string;
-        subject: string;
-    };
-    userId?: string;
-    version: number;
-};
-export type AgentIdentityRegistrationStore = {
-    create: (registration: AgentIdentityRegistration) => Promise<boolean>;
-    findByClaimTokenHash: (claimTokenHash: string) => Promise<AgentIdentityRegistration | undefined>;
-    findByAgentId: (agentId: string) => Promise<AgentIdentityRegistration | undefined>;
-    findByRegistrationId: (registrationId: string) => Promise<AgentIdentityRegistration | undefined>;
-    findByUpstreamIdentity: (query: {
-        clientId: string;
-        issuer: string;
-        subject: string;
-    }) => Promise<AgentIdentityRegistration | undefined>;
-    findByAttemptTokenHash: (attemptTokenHash: string) => Promise<AgentIdentityRegistration | undefined>;
-    /** Replaces a record only when its current version equals expectedVersion. */
-    replace: (registration: AgentIdentityRegistration, expectedVersion: number) => Promise<boolean>;
-};
-export type VerifiedAgentIdentityAssertion = {
-    authenticatedAt: number;
-    clientId: string;
-    email?: string;
-    emailVerified?: boolean;
-    issuer: string;
-    name?: string;
-    phoneNumber?: string;
-    phoneNumberVerified?: boolean;
-    subject: string;
-};

package/dist/apikeys/config.d.ts

@@ -1,64 +0,0 @@
-import type { RouteString } from '../types';
-import type { AccessTokenStore, ApiClient, ApiClientStore, ApiKey, ApiKeyStore, ApiPrincipal } from './types';
-export declare const DEFAULT_TOKEN_ROUTE: RouteString;
-export type ApiKeysConfig = {
-    /** Where minted access tokens live — required (with `apiClientStore`) for the
-     *  client_credentials grant to be mounted. */
-    accessTokenStore?: AccessTokenStore;
-    /** Lifetime of a minted access token (defaults to one hour). */
-    accessTokenTtlMs?: number;
-    /** Registered M2M clients — required (with `accessTokenStore`) for the
-     *  client_credentials grant. */
-    apiClientStore?: ApiClientStore;
-    /** Static API keys. Used by the exported `verifyApiKey` / `resolveApiPrincipal`
-     *  helpers; the consumer wires its own management + guard routes. */
-    apiKeyStore?: ApiKeyStore;
-    /** Path of the client_credentials token endpoint (defaults to `/oauth2/token`). */
-    tokenRoute?: RouteString;
-};
-export type ClientCredentialsResult = {
-    error: 'invalid_client' | 'invalid_scope';
-    ok: false;
-} | {
-    accessToken: string;
-    expiresIn: number;
-    ok: true;
-    scopes: string[];
-};
-export declare const createApiClient: (apiClientStore: ApiClientStore, options: {
-    name: string;
-    ownerId?: string;
-    scopes?: string[];
-}) => Promise<{
-    clientId: string;
-    clientSecret: string;
-    record: ApiClient;
-}>;
-export declare const createApiKey: (apiKeyStore: ApiKeyStore, options: {
-    expiresAt?: number;
-    name: string;
-    ownerId?: string;
-    scopes?: string[];
-}) => Promise<{
-    key: string;
-    record: ApiKey;
-}>;
-export declare const exchangeClientCredentials: ({ accessTokenStore, apiClientStore, clientId, clientSecret, now, requestedScopes, ttlMs }: {
-    accessTokenStore: AccessTokenStore;
-    apiClientStore: ApiClientStore;
-    clientId: string;
-    clientSecret: string;
-    now?: number;
-    requestedScopes?: string[];
-    ttlMs?: number;
-}) => Promise<ClientCredentialsResult>;
-export declare const hasScopes: (principal: ApiPrincipal | undefined, required: string[]) => boolean;
-export declare const resolveApiPrincipal: ({ accessTokenStore, apiKey, apiKeyStore, authorization, now }: {
-    accessTokenStore?: AccessTokenStore;
-    apiKey?: string;
-    apiKeyStore?: ApiKeyStore;
-    authorization?: string;
-    now?: number;
-}) => Promise<ApiPrincipal | undefined>;
-export declare const verifyAccessToken: (accessTokenStore: AccessTokenStore, presented: string, now?: number) => Promise<import("./types").AccessToken | undefined>;
-export declare const verifyApiKey: (apiKeyStore: ApiKeyStore, presented: string, now?: number) => Promise<ApiKey | undefined>;

package/dist/apikeys/routes.d.ts

@@ -1,83 +0,0 @@
-import { Elysia } from 'elysia';
-import { type ApiKeysConfig } from './config';
-export declare const apiKeysRoutes: ({ accessTokenStore, accessTokenTtlMs, apiClientStore, tokenRoute }: ApiKeysConfig) => Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}> | Elysia<"", {
-    decorator: {};
-    store: {};
-    derive: {};
-    resolve: {};
-}, {
-    typebox: {};
-    error: {};
-}, {
-    schema: {};
-    standaloneSchema: {};
-    macro: {};
-    macroFn: {};
-    parser: {};
-    response: {};
-}, {
-    [x: string]: {
-        post: {
-            body: {
-                client_id?: string | undefined;
-                scope?: string | undefined;
-                grant_type?: string | undefined;
-                client_secret?: string | undefined;
-            };
-            params: {};
-            query: unknown;
-            headers: unknown;
-            response: {
-                200: Response;
-                422: {
-                    type: "validation";
-                    on: string;
-                    summary?: string;
-                    message?: string;
-                    found?: unknown;
-                    property?: string;
-                    expected?: string;
-                };
-            };
-        };
-    };
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}, {
-    derive: {};
-    resolve: {};
-    schema: {};
-    standaloneSchema: {};
-    response: {};
-}>;

package/dist/apikeys/types.d.ts

@@ -1,53 +0,0 @@
-export type ApiKey = {
-    createdAt: number;
-    expiresAt?: number;
-    hashedKey: string;
-    keyId: string;
-    lastUsedAt?: number;
-    name: string;
-    ownerId?: string;
-    prefix: string;
-    scopes: string[];
-};
-export type ApiKeyStore = {
-    deleteKey: (keyId: string) => Promise<void>;
-    findByHashedKey: (hashedKey: string) => Promise<ApiKey | undefined>;
-    listKeys: (ownerId?: string) => Promise<ApiKey[]>;
-    saveKey: (key: ApiKey) => Promise<void>;
-    touchKey: (keyId: string, lastUsedAt: number) => Promise<void>;
-};
-export type ApiClient = {
-    clientId: string;
-    createdAt: number;
-    hashedSecret: string;
-    name: string;
-    ownerId?: string;
-    scopes: string[];
-};
-export type ApiClientStore = {
-    deleteClient: (clientId: string) => Promise<void>;
-    findClient: (clientId: string) => Promise<ApiClient | undefined>;
-    listClients: (ownerId?: string) => Promise<ApiClient[]>;
-    saveClient: (client: ApiClient) => Promise<void>;
-};
-export type AccessToken = {
-    clientId: string;
-    createdAt: number;
-    expiresAt: number;
-    hashedToken: string;
-    ownerId?: string;
-    scopes: string[];
-    tokenId: string;
-};
-export type AccessTokenStore = {
-    deleteExpired: (now: number) => Promise<void>;
-    deleteToken: (tokenId: string) => Promise<void>;
-    findByHashedToken: (hashedToken: string) => Promise<AccessToken | undefined>;
-    saveToken: (token: AccessToken) => Promise<void>;
-};
-export type ApiPrincipal = {
-    id: string;
-    kind: 'access_token' | 'api_key';
-    ownerId?: string;
-    scopes: string[];
-};

package/dist/audit/config.d.ts

@@ -1,9 +0,0 @@
-import type { AuditEvent, AuditSink } from './types';
-export type AuditConfig<UserType> = {
-    auditStore?: AuditSink;
-    getUserId?: (user: UserType) => string;
-    onAuditEvent?: (event: AuditEvent) => void | Promise<void>;
-    redact?: (event: AuditEvent) => AuditEvent | Promise<AuditEvent>;
-};
-export type AuditEmitter = (event: AuditEvent) => Promise<void>;
-export declare const createAuditEmitter: <UserType>({ auditStore, onAuditEvent, redact }: AuditConfig<UserType>) => (event: AuditEvent) => Promise<void>;

package/dist/audit/export.d.ts

@@ -1,2 +0,0 @@
-import type { AuditEvent } from './types';
-export declare const exportAuditCsv: (events: AuditEvent[]) => string;

package/dist/audit/inMemoryAuditStore.d.ts

@@ -1,2 +0,0 @@
-import type { AuditSink } from './types';
-export declare const createInMemoryAuditSink: () => AuditSink;

package/dist/audit/integrity.d.ts

@@ -1,19 +0,0 @@
-import type { AuditEvent, AuditSink } from './types';
-export type AuditIntegrity = {
-    hash: string;
-    previousHash: string;
-    writerId?: string;
-};
-export type AuditChainResult = {
-    brokenAt?: number;
-    ok: boolean;
-};
-export declare const createTamperEvidentSink: ({ loadWriterHead, secret, seedScanLimit, sink, writerId }: {
-    loadWriterHead?: (writerId: string) => Promise<string | undefined> | string | undefined;
-    secret?: string;
-    seedScanLimit?: number;
-    sink: AuditSink;
-    writerId?: string;
-}) => AuditSink;
-export declare const hashAuditEvent: (event: AuditEvent, previousHash: string, secret?: string) => Promise<string>;
-export declare const verifyAuditChain: (events: AuditEvent[], secret?: string) => Promise<AuditChainResult>;

package/dist/audit/postgresAuditStore.d.ts

@@ -1,116 +0,0 @@
-import { type AnyPgDatabase } from '../stores/postgres';
-import type { AuditSink } from './types';
-export declare const auditEventsTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "auth_audit_events";
-    schema: undefined;
-    columns: {
-        at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        ip: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        metadata_json: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").Set$Type<import("drizzle-orm/pg-core").PgJsonbBuilder, Record<string, unknown>>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "object json";
-            data: Record<string, unknown>;
-            driverParam: unknown;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        organization_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        type: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_audit_events", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_audit_events";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-export declare const createNeonAuditSink: (databaseUrl: string) => AuditSink;
-export declare const createPostgresAuditSink: <DB extends AnyPgDatabase>(db: DB) => AuditSink;

package/dist/audit/siem.d.ts

@@ -1,11 +0,0 @@
-import type { AuditSink } from './types';
-export type SiemFormat = 'datadog' | 'generic' | 'splunk';
-export type SiemEndpoint = {
-    format?: SiemFormat;
-    headers?: Record<string, string>;
-    token?: string;
-    url: string;
-};
-export declare const createSiemLogStream: ({ endpoints }: {
-    endpoints: SiemEndpoint[];
-}) => AuditSink;

package/dist/audit/types.d.ts

@@ -1,19 +0,0 @@
-import type { OrganizationId } from '../tenancy';
-export type AuditEventType = 'account_deleted' | 'agent_credential_issued' | 'agent_delegated' | 'agent_registered' | 'agent_revoked' | 'authorization_denied' | 'credentials_login' | 'credentials_login_failed' | 'data_exported' | 'email_verified' | 'identity_conflict' | 'impersonation_ended' | 'impersonation_started' | 'invitation_accepted' | 'invitation_created' | 'logout' | 'membership_removed' | 'mfa_challenge' | 'mfa_challenge_failed' | 'mfa_enrolled' | 'oauth_login' | 'organization_created' | 'password_reset' | 'passwordless_login' | 'register' | 'role_assigned' | 'scim_provision' | 'scim_token_created' | 'session_revoked' | 'setup_session_created' | 'sso_connection_configured' | 'sso_login' | 'token_refreshed' | 'token_revoked' | 'webauthn_authenticated' | 'webauthn_registered';
-export type AuditEvent = {
-    at: number;
-    ip?: string;
-    metadata?: Record<string, unknown>;
-    organizationId?: OrganizationId;
-    type: AuditEventType;
-    userId?: string;
-};
-export type AuditEventFilter = {
-    limit?: number;
-    userId?: string;
-};
-export type AuditSink = {
-    append: (event: AuditEvent) => Promise<void>;
-    list?: (filter?: AuditEventFilter) => Promise<AuditEvent[]>;
-    prune?: (before: number) => Promise<number>;
-};

package/dist/audit/wrap.d.ts

@@ -1,9 +0,0 @@
-import type { CredentialsConfig } from '../credentials/config';
-import type { MfaConfig } from '../mfa/config';
-import type { OnCallbackSuccess, OnRevocationSuccess, OnSignOut } from '../types';
-import type { AuditEmitter } from './config';
-export declare const composeCallbackAudit: <UserType>(onCallbackSuccess: OnCallbackSuccess<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnCallbackSuccess<UserType>>>[0]) => Promise<void | Response | import("..").StatusReturn>;
-export declare const composeCredentialsAudit: <UserType>(credentials: CredentialsConfig<UserType>, emit: AuditEmitter, getUserId?: (user: UserType) => string) => CredentialsConfig<UserType>;
-export declare const composeMfaAudit: <UserType>(mfa: MfaConfig<UserType>, emit: AuditEmitter) => MfaConfig<UserType>;
-export declare const composeRevocationAudit: (onRevocationSuccess: OnRevocationSuccess, emit: AuditEmitter) => (context: Parameters<NonNullable<OnRevocationSuccess>>[0]) => Promise<void | undefined>;
-export declare const composeSignOutAudit: <UserType>(onSignOut: OnSignOut<UserType>, emit: AuditEmitter) => (context: Parameters<NonNullable<OnSignOut<UserType>>>[0]) => Promise<void | undefined>;