@absolutejs/auth 0.69.2 → 0.69.4

package/package.json

@@ -1,5 +1,5 @@
 {
-	"version": "0.69.2",
+	"version": "0.69.4",
 	"name": "@absolutejs/auth",
 	"description": "An authorization library for absolutejs",
 	"repository": {
@@ -39,7 +39,6 @@
 	"types": "./dist/index.d.ts",
 	"peerDependencies": {
 		"@opentelemetry/api": ">=1.9.1 <2",
-		"@simplewebauthn/browser": ">=13.3.0 <14",
 		"@simplewebauthn/server": ">=13.3.2 <14",
 		"elysia": "^2.0.0-beta.6",
 		"react": ">=18 <20",
@@ -53,9 +52,6 @@
 		"@opentelemetry/api": {
 			"optional": true
 		},
-		"@simplewebauthn/browser": {
-			"optional": true
-		},
 		"@simplewebauthn/server": {
 			"optional": true
 		},
@@ -79,6 +75,7 @@
 		"@absolutejs/linked-providers": "0.0.6",
 		"@absolutejs/manifest": "^0.10.0",
 		"@neondatabase/serverless": "1.0.0",
+		"@simplewebauthn/browser": "13.3.0",
 		"citra": "0.29.13",
 		"typebox": "^1.3.16"
 	},
@@ -88,7 +85,6 @@
 		"@node-saml/node-saml": "5.1.0",
 		"@opentelemetry/api": "1.9.1",
 		"@opentelemetry/sdk-trace-base": "^2.7.1",
-		"@simplewebauthn/browser": "13.3.0",
 		"@simplewebauthn/server": "13.3.2",
 		"@stylistic/eslint-plugin": "^5.10.0",
 		"@types/bun": "1.2.9",

package/dist/abuse/captcha.d.ts

@@ -1,11 +0,0 @@
-import type { AbuseContext } from './config';
-export declare const verifyHcaptcha: ({ secret }: {
-    secret: string;
-}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
-export declare const verifyRecaptcha: ({ minScore, secret }: {
-    minScore?: number;
-    secret: string;
-}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;
-export declare const verifyTurnstile: ({ secret }: {
-    secret: string;
-}) => (token: string | undefined, context: AbuseContext) => Promise<boolean>;

package/dist/abuse/config.d.ts

@@ -1,29 +0,0 @@
-export type AbuseAction = 'allow' | 'challenge' | 'deny';
-export type AbuseSignal = 'blocked_ip' | 'bot' | 'captcha_failed' | 'not_allowlisted';
-export type BotClass = 'agent' | 'bot' | 'crawler' | 'human';
-export type AbuseContext = {
-    captchaToken?: string;
-    ip?: string;
-    userAgent?: string;
-};
-export type AbuseReason = {
-    action: AbuseAction;
-    signal: AbuseSignal;
-};
-export type AbuseAssessment = {
-    action: AbuseAction;
-    reasons: AbuseReason[];
-};
-export type AbuseConfig = {
-    botAction?: AbuseAction;
-    captchaAction?: AbuseAction;
-    classifyBot?: (context: AbuseContext) => BotClass | Promise<BotClass>;
-    ipAllow?: string[];
-    ipDeny?: string[];
-    verifyCaptcha?: (token: string | undefined, context: AbuseContext) => boolean | Promise<boolean>;
-};
-export declare const assessAbuse: (config: AbuseConfig, context: AbuseContext) => Promise<AbuseAssessment>;
-export declare const createAbuseGuard: (config: AbuseConfig) => {
-    assess: (context: AbuseContext) => Promise<AbuseAssessment>;
-};
-export declare const defaultBotClassifier: (context: AbuseContext) => "bot" | "crawler" | "human";

package/dist/adaptive/config.d.ts

@@ -1,34 +0,0 @@
-import type { KnownDeviceStore, LoginHistoryStore, RiskAction, RiskAssessment, RiskContext, RiskSignal, RiskThresholds, RiskWeights, WeightedRiskAssessment } from './types';
-export type AdaptiveConfig = {
-    historyLimit?: number;
-    knownDeviceStore: KnownDeviceStore;
-    loginHistoryStore: LoginHistoryStore;
-    maxTravelKmh?: number;
-    offHours?: {
-        end: number;
-        start: number;
-    };
-    rules?: Partial<Record<RiskSignal, RiskAction>>;
-    velocityMaxAttempts?: number;
-    velocityWindowMs?: number;
-};
-export declare const assessRisk: (config: AdaptiveConfig, context: RiskContext) => Promise<RiskAssessment>;
-export declare const createRiskEngine: (config: AdaptiveConfig) => {
-    assessRisk: (context: RiskContext) => Promise<RiskAssessment>;
-    recordAttempt: (context: RiskContext & {
-        outcome: RiskAction;
-    }) => Promise<void>;
-    scoreRisk: (context: RiskContext, options?: {
-        thresholds?: RiskThresholds;
-        weights?: RiskWeights;
-    }) => Promise<WeightedRiskAssessment>;
-    trustDevice: (userId: string, deviceId: string, label?: string) => Promise<void>;
-};
-export declare const recordLoginAttempt: (config: AdaptiveConfig, context: RiskContext & {
-    outcome: RiskAction;
-}) => Promise<void>;
-export declare const scoreRisk: (config: AdaptiveConfig & {
-    thresholds?: RiskThresholds;
-    weights?: RiskWeights;
-}, context: RiskContext) => Promise<WeightedRiskAssessment>;
-export declare const trustDevice: (config: AdaptiveConfig, userId: string, deviceId: string, label?: string) => Promise<void>;

package/dist/adaptive/fingerprint.d.ts

@@ -1,2 +0,0 @@
-export type DeviceSignals = Record<string, unknown>;
-export declare const fingerprintDevice: (signals: DeviceSignals) => Promise<string>;

package/dist/adaptive/inMemoryStores.d.ts

@@ -1,3 +0,0 @@
-import type { KnownDeviceStore, LoginHistoryStore } from './types';
-export declare const createInMemoryKnownDeviceStore: () => KnownDeviceStore;
-export declare const createInMemoryLoginHistoryStore: () => LoginHistoryStore;

package/dist/adaptive/postgresStores.d.ts

@@ -1,245 +0,0 @@
-import { type AnyPgDatabase } from '../stores/postgres';
-import type { KnownDeviceStore, LoginHistoryStore } from './types';
-export declare const knownDevicesTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "auth_known_devices";
-    schema: undefined;
-    columns: {
-        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        first_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        label: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        last_seen_at_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        trusted: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetHasDefault<import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBooleanBuilder>>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "boolean";
-            data: boolean;
-            driverParam: boolean;
-            notNull: true;
-            hasDefault: true;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_known_devices", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_known_devices";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-export declare const loginHistoryTable: import("drizzle-orm/pg-core").PgTableWithColumns<{
-    name: "auth_login_history";
-    schema: undefined;
-    columns: {
-        attempt_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetIsPrimaryKey<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        country: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        device_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        ip_address: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        latitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "number double";
-            data: number;
-            driverParam: string | number;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        longitude: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").PgDoublePrecisionBuilder, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "number double";
-            data: number;
-            driverParam: string | number;
-            notNull: false;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        outcome: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        timestamp_ms: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgBigInt53Builder>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "number int53";
-            data: number;
-            driverParam: string | number;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-        user_id: import("drizzle-orm/pg-core").PgBuildColumn<"auth_login_history", import("drizzle-orm/pg-core").SetNotNull<import("drizzle-orm/pg-core").PgVarcharBuilder<[string, ...string[]]>>, {
-            name: string;
-            tableName: "auth_login_history";
-            dataType: "string";
-            data: string;
-            driverParam: string;
-            notNull: true;
-            hasDefault: false;
-            isPrimaryKey: false;
-            isAutoincrement: false;
-            hasRuntimeDefault: false;
-            enumValues: undefined;
-            identity: undefined;
-            generated: undefined;
-        }>;
-    };
-    dialect: "pg";
-}>;
-export declare const createNeonKnownDeviceStore: (databaseUrl: string) => KnownDeviceStore;
-export declare const createNeonLoginHistoryStore: (databaseUrl: string) => LoginHistoryStore;
-export declare const createPostgresKnownDeviceStore: <DB extends AnyPgDatabase>(db: DB) => KnownDeviceStore;
-export declare const createPostgresLoginHistoryStore: <DB extends AnyPgDatabase>(db: DB) => LoginHistoryStore;

package/dist/adaptive/types.d.ts

@@ -1,62 +0,0 @@
-export type RiskAction = 'allow' | 'deny' | 'step_up';
-export type RiskSignal = 'impossible_travel' | 'new_country' | 'new_device' | 'off_hours' | 'proxy' | 'velocity';
-export type GeoPoint = {
-    country?: string;
-    latitude?: number;
-    longitude?: number;
-};
-export type RiskContext = {
-    deviceId: string;
-    geo?: GeoPoint;
-    ipAddress?: string;
-    isProxy?: boolean;
-    localHour?: number;
-    now?: number;
-    userId: string;
-};
-export type RiskReason = {
-    action: RiskAction;
-    signal: RiskSignal;
-};
-export type RiskAssessment = {
-    action: RiskAction;
-    reasons: RiskReason[];
-};
-export type RiskWeights = Partial<Record<RiskSignal, number>>;
-export type RiskThresholds = {
-    deny: number;
-    stepUp: number;
-};
-export type WeightedRiskAssessment = {
-    action: RiskAction;
-    reasons: RiskReason[];
-    score: number;
-};
-export type KnownDevice = {
-    deviceId: string;
-    firstSeenAt: number;
-    label?: string;
-    lastSeenAt: number;
-    trusted: boolean;
-    userId: string;
-};
-export type KnownDeviceStore = {
-    findDevice: (userId: string, deviceId: string) => Promise<KnownDevice | undefined>;
-    listDevices: (userId: string) => Promise<KnownDevice[]>;
-    saveDevice: (device: KnownDevice) => Promise<void>;
-};
-export type LoginAttempt = {
-    attemptId: string;
-    country?: string;
-    deviceId: string;
-    ipAddress?: string;
-    latitude?: number;
-    longitude?: number;
-    outcome: RiskAction;
-    timestamp: number;
-    userId: string;
-};
-export type LoginHistoryStore = {
-    listRecent: (userId: string, limit: number) => Promise<LoginAttempt[]>;
-    recordAttempt: (attempt: LoginAttempt) => Promise<void>;
-};

package/dist/agents/idJag.d.ts

@@ -1,49 +0,0 @@
-import { type SigningKey } from '../oidc/keys';
-import type { VerifiedAgentIdentityAssertion } from './types';
-export type AgentIdentityAssertionJtiStore = {
-    /** Atomically records an issuer+jti pair. Returns false for a replay. */
-    recordIfFresh: (issuer: string, jti: string, expiresAt: number) => Promise<boolean>;
-};
-export declare const createInMemoryAgentIdentityAssertionJtiStore: () => AgentIdentityAssertionJtiStore;
-export type AgentIdentityAssertionUser = {
-    authenticatedAt: number;
-    email?: string;
-    emailVerified?: boolean;
-    methods?: string[];
-    name?: string;
-    phoneNumber?: string;
-    phoneNumberVerified?: boolean;
-    subject: string;
-};
-/** Native provider-side ID-JAG issuance. The caller owns the user consent UI
- * and must authorize the requested audience before invoking this helper. */
-export declare const issueAgentIdentityAssertion: ({ agentContextId, agentPlatform, audience, clientId, issuer, now, resource, signingKey, ttlMs, user }: {
-    agentContextId?: string;
-    agentPlatform?: string;
-    audience: string;
-    clientId: string;
-    issuer: string;
-    now?: number;
-    resource?: string;
-    signingKey: SigningKey;
-    ttlMs?: number;
-    user: AgentIdentityAssertionUser;
-}) => Promise<{
-    assertion: string;
-    assertionType: "urn:ietf:params:oauth:token-type:id-jag";
-    expiresAt: number;
-}>;
-/** Builds a fail-closed service-side verifier. Issuer resolution is injected so
- * the application can use pinned configuration, CIMD, or an egress-guarded
- * JWKS resolver without this package performing ambient network access. */
-export declare const createAgentIdentityAssertionVerifier: ({ audience, clockSkewMs, jtiStore, maxAssertionLifetimeMs, maxAuthenticationAgeMs, resolveIssuer }: {
-    audience: string;
-    clockSkewMs?: number;
-    jtiStore: AgentIdentityAssertionJtiStore;
-    maxAssertionLifetimeMs?: number;
-    maxAuthenticationAgeMs?: number;
-    resolveIssuer: (issuer: string) => Promise<{
-        allowedClientIds?: string[];
-        publicJwk: JsonWebKey;
-    } | undefined>;
-}) => (assertion: string, now?: number) => Promise<VerifiedAgentIdentityAssertion | undefined>;

package/dist/agents/inMemoryStores.d.ts

@@ -1,4 +0,0 @@
-import type { AgentDelegationStore, AgentIdentityRegistrationStore, AgentRegistrationStore } from './types';
-export declare const createInMemoryAgentDelegationStore: () => AgentDelegationStore;
-export declare const createInMemoryAgentIdentityRegistrationStore: () => AgentIdentityRegistrationStore;
-export declare const createInMemoryAgentRegistrationStore: () => AgentRegistrationStore;

package/dist/agents/index.d.ts

@@ -1,13 +0,0 @@
-export * from './config';
-export * from './types';
-export * from './registration';
-export * from './registrationClient';
-export * from './idJag';
-export * from './oauthGuide';
-export * from '../oidc/clientIdMetadata';
-export { createOidcAgentCredentialVerifier } from './oidcAdapter';
-export { agentHasScopes, resolveAgentPrincipal } from './principal';
-export { agentAuthChallenge, agentAuthContextPlugin } from './context';
-export { agentAuthPlugin } from './routes';
-export { createInMemoryAgentDelegationStore, createInMemoryAgentIdentityRegistrationStore, createInMemoryAgentRegistrationStore } from './inMemoryStores';
-export { agentDelegationsTable, agentDelegationsBunSqlTable, agentIdentityRegistrationsTable, agentIdentityRegistrationsBunSqlTable, agentRegistrationsTable, agentRegistrationsBunSqlTable, createBunSqlDrizzleAgentDelegationStore, createBunSqlDrizzleAgentIdentityRegistrationStore, createBunSqlDrizzleAgentRegistrationStore, createNeonAgentDelegationStore, createNeonAgentIdentityRegistrationStore, createNeonAgentRegistrationStore, createDrizzleAgentDelegationStore, createPostgresAgentDelegationStore, createPostgresAgentIdentityRegistrationStore, createPostgresAgentRegistrationStore } from './postgresStores';

package/dist/agents/oidcAdapter.d.ts

@@ -1,20 +0,0 @@
-import { type SigningKeyIdentity } from '../oidc/keys';
-import type { AgentCredentialVerifier } from './types';
-type OidcAgentCredentialVerifierKeys = {
-    publicJwk: JsonWebKey;
-    publicKeys?: never;
-} | {
-    publicJwk?: never;
-    publicKeys: readonly SigningKeyIdentity[];
-};
-/** Adapter for Absolute Auth's RFC 9068-style JWT access tokens. It validates
- * signature, issuer, audience, expiry, and extracts the OAuth client as the
- * agent identity while retaining `sub` as the authorizing user. */
-export declare const createOidcAgentCredentialVerifier: ({ issuer, isUsedDpopJti, maxDpopAgeMs, publicJwk, publicKeys, requireDpop, resource }: {
-    issuer: string;
-    isUsedDpopJti?: (jti: string) => boolean | Promise<boolean>;
-    maxDpopAgeMs?: number;
-    requireDpop?: boolean;
-    resource: string;
-} & OidcAgentCredentialVerifierKeys) => AgentCredentialVerifier;
-export {};