@adrianhall/cloudflare-toolkit 0.0.1

package/dist/jwt-BvuKtvby.js

@@ -0,0 +1,328 @@
+import { SignJWT, createRemoteJWKSet, errors, jwtVerify } from "jose";
+//#region src/lib/auth-internal/jwks.ts
+/**
+* @file Remote JWKS management for Cloudflare Access JWT verification.
+*
+* Only Web-standard APIs (`jose`, `URL`, `Map`) are used, so this module is both Worker-safe
+* (for `hono/`) and Node-safe (for `vite/`). Kept in its own module so tests can mock
+* `getRemoteJwks` and supply a local key set instead of hitting the real Cloudflare Access certs
+* endpoint.
+*/
+/** Remote JWKS cache keyed by team-domain URL. */
+const jwksCache = /* @__PURE__ */ new Map();
+/**
+* Pattern a Cloudflare Access team-domain hostname must match: a single DNS label followed by
+* the literal `cloudflareaccess.com` suffix (e.g. `"my-team.cloudflareaccess.com"`). Matched
+* against `URL.hostname`, which the WHATWG URL parser always normalizes to ASCII-lowercase and
+* which already resolves away userinfo (`user@host`) and path-based host-spoofing tricks, so
+* this single check is sufficient to reject a `teamDomain` that does not genuinely point at
+* Cloudflare Access's own certs host.
+*/
+const TEAM_DOMAIN_HOST_PATTERN = /^[a-z0-9-]+\.cloudflareaccess\.com$/;
+/** Matches a leading URI scheme (e.g. `"http://"`, `"ftp://"`), case-insensitively. */
+const SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:\/\//i;
+/**
+* Normalize and validate a Cloudflare Access team domain to its canonical `https://` origin.
+*
+* Used both to build the JWKS certs URL in {@link getRemoteJwks} and to compute the expected
+* `iss` (Issuer) claim value for `jwtVerify` in `verifyAccessJwt` (SEC-003) — a single shared
+* implementation keeps the two in permanent agreement instead of risking two independent
+* normalizations drifting apart.
+*
+* @param teamDomain - The Cloudflare Access team domain (e.g. `"my-team.cloudflareaccess.com"`).
+*   A missing `https://` prefix is added automatically, and a trailing slash is stripped, so
+*   `"my-team.cloudflareaccess.com"`, `"my-team.cloudflareaccess.com/"`, and
+*   `"https://my-team.cloudflareaccess.com"` all normalize to the same origin.
+* @returns The canonical origin, e.g. `"https://my-team.cloudflareaccess.com"` — no trailing
+*   slash, no path.
+* @throws {Error} If `teamDomain` has an explicit non-`https://` scheme (see {@link ensureHttps}),
+*   or if the resulting hostname is not a `*.cloudflareaccess.com` team domain — closing off both
+*   the malformed-URL footgun and the SSRF/JWKS-poisoning surface of a dynamically-sourced
+*   `teamDomain` pointing somewhere unexpected.
+*/
+function normalizeTeamDomain(teamDomain) {
+	const url = ensureHttps(teamDomain.replace(/\/+$/, ""));
+	const parsed = new URL(url);
+	if (!TEAM_DOMAIN_HOST_PATTERN.test(parsed.hostname)) throw new Error(`Invalid Cloudflare Access team domain: "${teamDomain}"`);
+	return parsed.origin;
+}
+/**
+* Return (or create-and-cache) a remote JWKS function for the given Cloudflare Access team
+* domain.
+*
+* @param teamDomain - The Cloudflare Access team domain. See {@link normalizeTeamDomain} for the
+*   accepted input forms and normalization rules.
+* @returns The `jose` remote JWK set function for `${teamDomain}/cdn-cgi/access/certs`, cached
+*   across calls for the same normalized domain.
+* @throws {Error} See {@link normalizeTeamDomain}.
+*/
+function getRemoteJwks(teamDomain) {
+	const origin = normalizeTeamDomain(teamDomain);
+	const certsUrl = new URL(`${origin}/cdn-cgi/access/certs`);
+	let jwks = jwksCache.get(certsUrl.href);
+	if (!jwks) {
+		if (jwksCache.size >= 20) for (const oldestKey of jwksCache.keys()) {
+			jwksCache.delete(oldestKey);
+			break;
+		}
+		jwks = createRemoteJWKSet(certsUrl);
+		jwksCache.set(certsUrl.href, jwks);
+	}
+	return jwks;
+}
+/**
+* Ensures the base URL for the JWKS endpoint is HTTPS.
+*
+* @param url - The base URL to check.
+* @returns The URL unchanged if it already starts with `https://`; otherwise `https://` is
+*   prepended, but only when `url` has no scheme of its own.
+* @throws {Error} If `url` already has an explicit scheme other than `https://` (e.g.
+*   `"http://..."`, `"ftp://..."`) — such input previously became a malformed URL
+*   (`"https://http://..."`) rather than being upgraded or rejected. Erroring here surfaces the
+*   misconfiguration instead of silently constructing a broken (and, for a userinfo-style value,
+*   potentially misleading) JWKS URL.
+*/
+function ensureHttps(url) {
+	if (url.startsWith("https://")) return url;
+	if (SCHEME_PATTERN.test(url)) throw new Error(`Expected an https:// URL, got: "${url}"`);
+	return "https://" + url;
+}
+//#endregion
+//#region src/lib/auth-internal/jwt.ts
+/**
+* @file JWT helpers for the Cloudflare Access authentication internals: signing and verifying
+* developer tokens, verifying real Cloudflare Access tokens, and reading/writing the
+* authorization cookie.
+*
+* Uses `jose` v6 for all cryptographic operations and only Web-standard APIs
+* (`crypto.randomUUID`, `TextEncoder`) otherwise, so this module is both Worker-safe (for
+* `hono/cloudflare-access.ts`) and Node-safe (for `vite/plugin.ts`).
+*/
+/**
+* Well-known HMAC secret used by default for signing and verifying developer-generated JWTs.
+*
+* **This is NOT a real secret.** It only protects the local-dev login flow running on
+* `localhost` and must never be relied on for production security.
+*/
+const DEFAULT_DEV_SECRET = "cloudflare-access-dev-secret-do-not-use-in-production";
+/** Algorithm used for developer-signed JWTs. */
+const DEV_ALG = "HS256";
+/**
+* Algorithm Cloudflare Access uses to sign real application tokens (confirmed by Cloudflare's
+* own application-token documentation: the JWT header is always `{"alg":"RS256",...}`, signed
+* with an RSA private key). Pinned explicitly on the JWKS `jwtVerify` call in
+* {@link verifyAccessJwt} (SEC-004/CODE-003) rather than left unconstrained — `jose` already
+* refuses to HMAC-verify against an asymmetric JWK, so this is defense-in-depth, not a fix for a
+* currently-exploitable gap, and it mirrors {@link DEV_ALG} being pinned on the dev-token path.
+* Not exposed as a public override: unlike `audience` (a per-deployment Access Application
+* value), the signing algorithm is a Cloudflare Access platform constant, and widening it would
+* reopen the exact `alg`-confusion class this pin closes.
+*/
+const ACCESS_ALG = "RS256";
+/** Name of the cookie that stores the JWT. */
+const COOKIE_NAME = "CF_Authorization";
+/** Header containing the JWT (set by Cloudflare Access). */
+const JWT_HEADER = "cf-access-jwt-assertion";
+/** Header containing the authenticated user's email. */
+const EMAIL_HEADER = "cf-access-authenticated-user-email";
+/** Encode a string secret into a `CryptoKey`-compatible `Uint8Array`. */
+function secretToBytes(secret) {
+	return new TextEncoder().encode(secret);
+}
+/**
+* Generate a subject identifier for a developer-signed JWT.
+*
+* Returns a random UUID so that the `sub` claim matches the shape of a real Cloudflare Access
+* subject (a UUID) and satisfies strict downstream validators (e.g. `[A-Za-z0-9-]`). Real
+* Access subjects are stable per-user; dev subjects are stable for the life of an issued token
+* (and can be pinned via the `sub` option).
+*/
+function generateDevSub() {
+	return crypto.randomUUID();
+}
+/**
+* Create a signed JWT that mimics a Cloudflare Access token.
+*
+* The `type` claim is set to `"dev"` so that the verification layer can distinguish
+* locally-issued tokens from real Access tokens.
+*
+* @param email - The user's email address (becomes the `email` claim).
+* @param options - Optional overrides.
+* @param options.secret - HMAC signing secret (default {@link DEFAULT_DEV_SECRET}).
+* @param options.lifetime - Token lifetime in seconds (default `86400` / 24 h).
+* @param options.sub - Subject claim. When provided it is used **verbatim**; when omitted a
+*   random UUID is generated (matching the shape of a real Cloudflare Access `sub`) instead of
+*   an email-derived value.
+*/
+async function signDevJwt(email, options = {}) {
+	const secret = options.secret ?? "cloudflare-access-dev-secret-do-not-use-in-production";
+	const lifetime = options.lifetime ?? 86400;
+	const now = Math.floor(Date.now() / 1e3);
+	return new SignJWT({
+		email,
+		sub: options.sub ?? generateDevSub(),
+		type: "dev",
+		iss: "dev-authentication"
+	}).setProtectedHeader({ alg: DEV_ALG }).setIssuedAt(now).setExpirationTime(now + lifetime).sign(secretToBytes(secret));
+}
+/**
+* Attempt to verify a JWT as a developer-signed token.
+*
+* Returns `null` if verification fails (wrong key, expired, missing claims, etc.) — the caller
+* can then fall back to Cloudflare JWKS verification.
+*/
+async function verifyDevJwt(token, secret = DEFAULT_DEV_SECRET) {
+	try {
+		const { payload } = await jwtVerify(token, secretToBytes(secret), { algorithms: [DEV_ALG] });
+		return extractClaims(payload);
+	} catch {
+		return null;
+	}
+}
+/**
+* `jose` error classes that only occur once a JWKS was successfully fetched and a real
+* cryptographic/claims verification attempt against the token was made — i.e. the token itself
+* is what failed, not the JWKS transport.
+*
+* `JWKSNoMatchingKey` is included because `createRemoteJWKSet` already retries a JWKS reload
+* once (subject to a cooldown) before finally throwing it — a final throw means the token's
+* `kid` genuinely doesn't match even after a fresh key fetch, not merely a stale local cache.
+*/
+const TOKEN_VALIDATION_ERRORS = [
+	errors.JWSSignatureVerificationFailed,
+	errors.JWTExpired,
+	errors.JWTClaimValidationFailed,
+	errors.JOSEAlgNotAllowed,
+	errors.JWTInvalid,
+	errors.JWSInvalid,
+	errors.JWKSNoMatchingKey
+];
+/**
+* Classify a caught `verifyAccessJwt` failure as `"invalid"` (the token itself failed
+* cryptographic or claims validation) or `"network"` (a JWKS transport/config/infra problem),
+* for the `cause` field attached to the diagnostic log record.
+*
+* Conservatively biased toward `"network"`: only the specific {@link TOKEN_VALIDATION_ERRORS}
+* classes are treated as `"invalid"`. Everything else — plain fetch/DNS errors (not a
+* `JOSEError` at all, since `getRemoteJwks`'s underlying fetch failures propagate unwrapped),
+* `JWKSTimeout`, and JWKS-structure errors such as `JWKSInvalid`/`JWKSMultipleMatchingKeys` — is
+* classified as `"network"`, because misclassifying a real outage as "just an invalid token" is
+* the exact debuggability gap this diagnostic exists to close.
+*
+* @param err - The value caught from the `jwtVerify`/`getRemoteJwks` call.
+* @returns `"invalid"` when `err` is one of {@link TOKEN_VALIDATION_ERRORS}; `"network"`
+*   otherwise.
+*/
+function classifyVerificationFailure(err) {
+	return TOKEN_VALIDATION_ERRORS.some((ErrorClass) => err instanceof ErrorClass) ? "invalid" : "network";
+}
+/**
+* Verify a JWT against Cloudflare Access's remote JWKS endpoint.
+*
+* Only {@link ACCESS_ALG} (`"RS256"`) is accepted (SEC-004/CODE-003) — this matches what
+* Cloudflare Access actually issues and closes off `alg`-confusion attacks (e.g. a crafted
+* `alg: "HS256"` header) as a matter of explicit policy rather than relying solely on `jose`'s
+* own asymmetric-JWK/HMAC mismatch behavior.
+*
+* The `iss` (Issuer) claim is always verified against the normalized `teamDomain` (e.g.
+* `"https://my-team.cloudflareaccess.com"`, via {@link normalizeTeamDomain}) — SEC-003. This is
+* defense-in-depth: the JWKS itself is already team-scoped (fetched from
+* `teamDomain/cdn-cgi/access/certs`), so a token signed by a different team's key would already
+* fail signature verification, but binding `iss` explicitly matches Cloudflare's own published
+* Worker+Access reference implementation and requires the presence of the `iss` claim, so a
+* token without one is rejected too.
+*
+* When `audience` is provided the `aud` claim is also verified. **When `audience` is omitted,
+* `aud` is not checked at all** — because every Cloudflare Access application in an account
+* shares the same team JWKS, this means a token minted for *any other Access application in the
+* same team* is accepted here too (cross-application token replay). Callers that expose this
+* through a public option (e.g. `hono/cloudflare-access.ts`'s `cloudflareAccess`) should warn
+* loudly when a caller omits `audience` outside of a clearly-local-development configuration.
+*
+* A transient JWKS network/infra failure (bad team domain, DNS blip, certs endpoint down) is
+* otherwise indistinguishable from a genuinely invalid token — both fall through to the same
+* `catch` and the same `null` return, and without a `logger` nothing is recorded. When `logger`
+* is provided, the caught error is recorded at `warn` (matching the generic
+* `"JWT verification failed"` warning callers such as `cloudflareAccess` already emit) together
+* with the raw `err` and a best-effort `cause: "network" | "invalid"` classification (see
+* {@link classifyVerificationFailure}), so operators can distinguish an outage from a rejected
+* token without changing the fail-closed `null` return contract.
+*
+* @param token - The compact JWS to verify.
+* @param teamDomain - The Cloudflare Access team domain used to fetch the public JWKS and to
+*   compute the expected `iss` claim value (see {@link normalizeTeamDomain}).
+* @param audience - Application Audience Tag to verify the `aud` claim against. When omitted,
+*   `aud` is not checked at all — see the security remarks above.
+* @param logger - Optional structured logger. When omitted, verification failures are still
+*   returned as `null` but nothing is logged (unchanged prior behavior).
+*/
+async function verifyAccessJwt(token, teamDomain, audience, logger) {
+	try {
+		const { payload } = await jwtVerify(token, getRemoteJwks(teamDomain), {
+			algorithms: [ACCESS_ALG],
+			audience: audience ?? void 0,
+			issuer: normalizeTeamDomain(teamDomain)
+		});
+		return extractClaims(payload);
+	} catch (err) {
+		logger?.warn("Cloudflare Access JWT verification failed", {
+			err,
+			teamDomain,
+			cause: classifyVerificationFailure(err)
+		});
+		return null;
+	}
+}
+/** Pull the required claims out of a verified payload. */
+function extractClaims(payload) {
+	const email = payload.email;
+	const sub = payload.sub;
+	if (typeof email !== "string" || !email) return null;
+	if (typeof sub !== "string" || !sub) return null;
+	return {
+		email,
+		sub
+	};
+}
+/**
+* Build a `Set-Cookie` header value for the authorisation cookie.
+*
+* Mirrors the attributes used by Cloudflare Access: `HttpOnly; Secure; SameSite=Lax; Path=/`
+*
+* For local dev over plain HTTP the `Secure` flag is omitted when the request was made to
+* `localhost` or `127.0.0.1`.
+*/
+function buildCookieHeader(token, isSecure) {
+	const parts = [
+		`${COOKIE_NAME}=${token}`,
+		"HttpOnly",
+		"SameSite=Lax",
+		"Path=/"
+	];
+	if (isSecure) parts.push("Secure");
+	return parts.join("; ");
+}
+/**
+* Build a `Set-Cookie` header that clears the `CF_Authorization` cookie by setting it to an
+* empty value with `Max-Age=0`.
+*
+* Use this when a stale or invalid cookie needs to be removed so the user can re-authenticate.
+*/
+function clearCookieHeader() {
+	return `${COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;
+}
+/**
+* Parse the value of the `CF_Authorization` cookie from a `Cookie` header string. Returns
+* `undefined` when the cookie is absent.
+*/
+function parseCookie(cookieHeader) {
+	if (!cookieHeader) return void 0;
+	for (const pair of cookieHeader.split(";")) {
+		const [name, ...rest] = pair.split("=");
+		if (name.trim() === "CF_Authorization") return rest.join("=").trim();
+	}
+}
+//#endregion
+export { buildCookieHeader as a, signDevJwt as c, JWT_HEADER as i, verifyAccessJwt as l, DEFAULT_DEV_SECRET as n, clearCookieHeader as o, EMAIL_HEADER as r, parseCookie as s, COOKIE_NAME as t, verifyDevJwt as u };
+
+//# sourceMappingURL=jwt-BvuKtvby.js.map

package/dist/jwt-BvuKtvby.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-BvuKtvby.js","names":["joseErrors"],"sources":["../src/lib/auth-internal/jwks.ts","../src/lib/auth-internal/jwt.ts"],"sourcesContent":["/**\n * @file Remote JWKS management for Cloudflare Access JWT verification.\n *\n * Only Web-standard APIs (`jose`, `URL`, `Map`) are used, so this module is both Worker-safe\n * (for `hono/`) and Node-safe (for `vite/`). Kept in its own module so tests can mock\n * `getRemoteJwks` and supply a local key set instead of hitting the real Cloudflare Access certs\n * endpoint.\n */\nimport { createRemoteJWKSet } from \"jose\";\n\n/** Remote JWKS cache keyed by team-domain URL. */\nconst jwksCache = new Map<string, ReturnType<typeof createRemoteJWKSet>>();\n\n/**\n * Upper bound on {@link jwksCache}'s size. `teamDomain` is normally static per-deployment\n * config (one, or a handful, of distinct values for the lifetime of a Worker), but nothing\n * prevents a caller from passing a dynamically-sourced value; capping the cache avoids unbounded\n * memory growth in that case. Eviction is FIFO (oldest-inserted entry first, via `Map`'s\n * insertion-order iteration) rather than true LRU — proportionate to how rarely this cache is\n * expected to near its limit at all.\n */\nexport const MAX_JWKS_CACHE_ENTRIES = 20;\n\n/**\n * Pattern a Cloudflare Access team-domain hostname must match: a single DNS label followed by\n * the literal `cloudflareaccess.com` suffix (e.g. `\"my-team.cloudflareaccess.com\"`). Matched\n * against `URL.hostname`, which the WHATWG URL parser always normalizes to ASCII-lowercase and\n * which already resolves away userinfo (`user@host`) and path-based host-spoofing tricks, so\n * this single check is sufficient to reject a `teamDomain` that does not genuinely point at\n * Cloudflare Access's own certs host.\n */\nconst TEAM_DOMAIN_HOST_PATTERN = /^[a-z0-9-]+\\.cloudflareaccess\\.com$/;\n\n/** Matches a leading URI scheme (e.g. `\"http://\"`, `\"ftp://\"`), case-insensitively. */\nconst SCHEME_PATTERN = /^[a-z][a-z0-9+.-]*:\\/\\//i;\n\n/**\n * Normalize and validate a Cloudflare Access team domain to its canonical `https://` origin.\n *\n * Used both to build the JWKS certs URL in {@link getRemoteJwks} and to compute the expected\n * `iss` (Issuer) claim value for `jwtVerify` in `verifyAccessJwt` (SEC-003) — a single shared\n * implementation keeps the two in permanent agreement instead of risking two independent\n * normalizations drifting apart.\n *\n * @param teamDomain - The Cloudflare Access team domain (e.g. `\"my-team.cloudflareaccess.com\"`).\n *   A missing `https://` prefix is added automatically, and a trailing slash is stripped, so\n *   `\"my-team.cloudflareaccess.com\"`, `\"my-team.cloudflareaccess.com/\"`, and\n *   `\"https://my-team.cloudflareaccess.com\"` all normalize to the same origin.\n * @returns The canonical origin, e.g. `\"https://my-team.cloudflareaccess.com\"` — no trailing\n *   slash, no path.\n * @throws {Error} If `teamDomain` has an explicit non-`https://` scheme (see {@link ensureHttps}),\n *   or if the resulting hostname is not a `*.cloudflareaccess.com` team domain — closing off both\n *   the malformed-URL footgun and the SSRF/JWKS-poisoning surface of a dynamically-sourced\n *   `teamDomain` pointing somewhere unexpected.\n */\nexport function normalizeTeamDomain(teamDomain: string): string {\n  // Normalise: strip trailing slash, ensure https prefix.\n  const base = teamDomain.replace(/\\/+$/, \"\");\n  const url = ensureHttps(base);\n  const parsed = new URL(url);\n\n  if (!TEAM_DOMAIN_HOST_PATTERN.test(parsed.hostname)) {\n    throw new Error(`Invalid Cloudflare Access team domain: \"${teamDomain}\"`);\n  }\n\n  return parsed.origin;\n}\n\n/**\n * Return (or create-and-cache) a remote JWKS function for the given Cloudflare Access team\n * domain.\n *\n * @param teamDomain - The Cloudflare Access team domain. See {@link normalizeTeamDomain} for the\n *   accepted input forms and normalization rules.\n * @returns The `jose` remote JWK set function for `${teamDomain}/cdn-cgi/access/certs`, cached\n *   across calls for the same normalized domain.\n * @throws {Error} See {@link normalizeTeamDomain}.\n */\nexport function getRemoteJwks(teamDomain: string): ReturnType<typeof createRemoteJWKSet> {\n  const origin = normalizeTeamDomain(teamDomain);\n  const certsUrl = new URL(`${origin}/cdn-cgi/access/certs`);\n\n  let jwks = jwksCache.get(certsUrl.href);\n  if (!jwks) {\n    if (jwksCache.size >= MAX_JWKS_CACHE_ENTRIES) {\n      // `Map` iterates keys in insertion order, so the first key yielded here is the oldest\n      // entry. `size >= MAX_JWKS_CACHE_ENTRIES` (checked above) with `MAX_JWKS_CACHE_ENTRIES`\n      // fixed at a positive constant guarantees the cache is non-empty, so this loop always runs\n      // at least once — no \"keys() was empty\" branch to guard against.\n      for (const oldestKey of jwksCache.keys()) {\n        jwksCache.delete(oldestKey);\n        break;\n      }\n    }\n    jwks = createRemoteJWKSet(certsUrl);\n    jwksCache.set(certsUrl.href, jwks);\n  }\n  return jwks;\n}\n\n/**\n * Ensures the base URL for the JWKS endpoint is HTTPS.\n *\n * @param url - The base URL to check.\n * @returns The URL unchanged if it already starts with `https://`; otherwise `https://` is\n *   prepended, but only when `url` has no scheme of its own.\n * @throws {Error} If `url` already has an explicit scheme other than `https://` (e.g.\n *   `\"http://...\"`, `\"ftp://...\"`) — such input previously became a malformed URL\n *   (`\"https://http://...\"`) rather than being upgraded or rejected. Erroring here surfaces the\n *   misconfiguration instead of silently constructing a broken (and, for a userinfo-style value,\n *   potentially misleading) JWKS URL.\n */\nexport function ensureHttps(url: string): string {\n  if (url.startsWith(\"https://\")) {\n    return url;\n  }\n  if (SCHEME_PATTERN.test(url)) {\n    throw new Error(`Expected an https:// URL, got: \"${url}\"`);\n  }\n  return \"https://\" + url;\n}\n","/**\n * @file JWT helpers for the Cloudflare Access authentication internals: signing and verifying\n * developer tokens, verifying real Cloudflare Access tokens, and reading/writing the\n * authorization cookie.\n *\n * Uses `jose` v6 for all cryptographic operations and only Web-standard APIs\n * (`crypto.randomUUID`, `TextEncoder`) otherwise, so this module is both Worker-safe (for\n * `hono/cloudflare-access.ts`) and Node-safe (for `vite/plugin.ts`).\n */\nimport { SignJWT, jwtVerify, errors as joseErrors } from \"jose\";\nimport type { JWTPayload } from \"jose\";\nimport type { AccessJwtPayload } from \"./types.js\";\nimport { getRemoteJwks, normalizeTeamDomain } from \"./jwks.js\";\nimport type { Logger } from \"../logging/types.js\";\n\n// ---------------------------------------------------------------------------\n// Constants\n// ---------------------------------------------------------------------------\n\n/**\n * Well-known HMAC secret used by default for signing and verifying developer-generated JWTs.\n *\n * **This is NOT a real secret.** It only protects the local-dev login flow running on\n * `localhost` and must never be relied on for production security.\n */\nexport const DEFAULT_DEV_SECRET = \"cloudflare-access-dev-secret-do-not-use-in-production\";\n\n/** Algorithm used for developer-signed JWTs. */\nconst DEV_ALG = \"HS256\";\n\n/**\n * Algorithm Cloudflare Access uses to sign real application tokens (confirmed by Cloudflare's\n * own application-token documentation: the JWT header is always `{\"alg\":\"RS256\",...}`, signed\n * with an RSA private key). Pinned explicitly on the JWKS `jwtVerify` call in\n * {@link verifyAccessJwt} (SEC-004/CODE-003) rather than left unconstrained — `jose` already\n * refuses to HMAC-verify against an asymmetric JWK, so this is defense-in-depth, not a fix for a\n * currently-exploitable gap, and it mirrors {@link DEV_ALG} being pinned on the dev-token path.\n * Not exposed as a public override: unlike `audience` (a per-deployment Access Application\n * value), the signing algorithm is a Cloudflare Access platform constant, and widening it would\n * reopen the exact `alg`-confusion class this pin closes.\n */\nconst ACCESS_ALG = \"RS256\";\n\n/** Name of the cookie that stores the JWT. */\nexport const COOKIE_NAME = \"CF_Authorization\";\n\n/** Header containing the JWT (set by Cloudflare Access). */\nexport const JWT_HEADER = \"cf-access-jwt-assertion\";\n\n/** Header containing the authenticated user's email. */\nexport const EMAIL_HEADER = \"cf-access-authenticated-user-email\";\n\n// ---------------------------------------------------------------------------\n// Key helpers\n// ---------------------------------------------------------------------------\n\n/** Encode a string secret into a `CryptoKey`-compatible `Uint8Array`. */\nfunction secretToBytes(secret: string): Uint8Array {\n  return new TextEncoder().encode(secret);\n}\n\n// ---------------------------------------------------------------------------\n// Sign (developer mode only)\n// ---------------------------------------------------------------------------\n\n/**\n * Generate a subject identifier for a developer-signed JWT.\n *\n * Returns a random UUID so that the `sub` claim matches the shape of a real Cloudflare Access\n * subject (a UUID) and satisfies strict downstream validators (e.g. `[A-Za-z0-9-]`). Real\n * Access subjects are stable per-user; dev subjects are stable for the life of an issued token\n * (and can be pinned via the `sub` option).\n */\nfunction generateDevSub(): string {\n  return crypto.randomUUID();\n}\n\n/**\n * Create a signed JWT that mimics a Cloudflare Access token.\n *\n * The `type` claim is set to `\"dev\"` so that the verification layer can distinguish\n * locally-issued tokens from real Access tokens.\n *\n * @param email - The user's email address (becomes the `email` claim).\n * @param options - Optional overrides.\n * @param options.secret - HMAC signing secret (default {@link DEFAULT_DEV_SECRET}).\n * @param options.lifetime - Token lifetime in seconds (default `86400` / 24 h).\n * @param options.sub - Subject claim. When provided it is used **verbatim**; when omitted a\n *   random UUID is generated (matching the shape of a real Cloudflare Access `sub`) instead of\n *   an email-derived value.\n */\nexport async function signDevJwt(\n  email: string,\n  options: { secret?: string; lifetime?: number; sub?: string } = {}\n): Promise<string> {\n  const secret = options.secret ?? DEFAULT_DEV_SECRET;\n  const lifetime = options.lifetime ?? 86_400; // 24 h\n\n  const now = Math.floor(Date.now() / 1000);\n  const sub = options.sub ?? generateDevSub();\n\n  return new SignJWT({\n    email,\n    sub,\n    type: \"dev\",\n    iss: \"dev-authentication\"\n  } satisfies Omit<AccessJwtPayload, \"iat\" | \"exp\">)\n    .setProtectedHeader({ alg: DEV_ALG })\n    .setIssuedAt(now)\n    .setExpirationTime(now + lifetime)\n    .sign(secretToBytes(secret));\n}\n\n// ---------------------------------------------------------------------------\n// Verify\n// ---------------------------------------------------------------------------\n\n/** Result of a successful JWT verification. */\nexport interface VerifiedToken {\n  /** Authenticated user's email address (from the JWT `email` claim). */\n  email: string;\n  /** Authenticated user's unique identifier (from the JWT `sub` claim). */\n  sub: string;\n}\n\n/**\n * Attempt to verify a JWT as a developer-signed token.\n *\n * Returns `null` if verification fails (wrong key, expired, missing claims, etc.) — the caller\n * can then fall back to Cloudflare JWKS verification.\n */\nexport async function verifyDevJwt(\n  token: string,\n  secret: string = DEFAULT_DEV_SECRET\n): Promise<VerifiedToken | null> {\n  try {\n    const { payload } = await jwtVerify(token, secretToBytes(secret), {\n      algorithms: [DEV_ALG]\n    });\n    return extractClaims(payload);\n  } catch {\n    return null;\n  }\n}\n\n/**\n * `jose` error classes that only occur once a JWKS was successfully fetched and a real\n * cryptographic/claims verification attempt against the token was made — i.e. the token itself\n * is what failed, not the JWKS transport.\n *\n * `JWKSNoMatchingKey` is included because `createRemoteJWKSet` already retries a JWKS reload\n * once (subject to a cooldown) before finally throwing it — a final throw means the token's\n * `kid` genuinely doesn't match even after a fresh key fetch, not merely a stale local cache.\n */\nconst TOKEN_VALIDATION_ERRORS = [\n  joseErrors.JWSSignatureVerificationFailed,\n  joseErrors.JWTExpired,\n  joseErrors.JWTClaimValidationFailed,\n  joseErrors.JOSEAlgNotAllowed,\n  joseErrors.JWTInvalid,\n  joseErrors.JWSInvalid,\n  joseErrors.JWKSNoMatchingKey\n] as const;\n\n/**\n * Classify a caught `verifyAccessJwt` failure as `\"invalid\"` (the token itself failed\n * cryptographic or claims validation) or `\"network\"` (a JWKS transport/config/infra problem),\n * for the `cause` field attached to the diagnostic log record.\n *\n * Conservatively biased toward `\"network\"`: only the specific {@link TOKEN_VALIDATION_ERRORS}\n * classes are treated as `\"invalid\"`. Everything else — plain fetch/DNS errors (not a\n * `JOSEError` at all, since `getRemoteJwks`'s underlying fetch failures propagate unwrapped),\n * `JWKSTimeout`, and JWKS-structure errors such as `JWKSInvalid`/`JWKSMultipleMatchingKeys` — is\n * classified as `\"network\"`, because misclassifying a real outage as \"just an invalid token\" is\n * the exact debuggability gap this diagnostic exists to close.\n *\n * @param err - The value caught from the `jwtVerify`/`getRemoteJwks` call.\n * @returns `\"invalid\"` when `err` is one of {@link TOKEN_VALIDATION_ERRORS}; `\"network\"`\n *   otherwise.\n */\nfunction classifyVerificationFailure(err: unknown): \"network\" | \"invalid\" {\n  const isTokenValidationError = TOKEN_VALIDATION_ERRORS.some(\n    (ErrorClass) => err instanceof ErrorClass\n  );\n  return isTokenValidationError ? \"invalid\" : \"network\";\n}\n\n/**\n * Verify a JWT against Cloudflare Access's remote JWKS endpoint.\n *\n * Only {@link ACCESS_ALG} (`\"RS256\"`) is accepted (SEC-004/CODE-003) — this matches what\n * Cloudflare Access actually issues and closes off `alg`-confusion attacks (e.g. a crafted\n * `alg: \"HS256\"` header) as a matter of explicit policy rather than relying solely on `jose`'s\n * own asymmetric-JWK/HMAC mismatch behavior.\n *\n * The `iss` (Issuer) claim is always verified against the normalized `teamDomain` (e.g.\n * `\"https://my-team.cloudflareaccess.com\"`, via {@link normalizeTeamDomain}) — SEC-003. This is\n * defense-in-depth: the JWKS itself is already team-scoped (fetched from\n * `teamDomain/cdn-cgi/access/certs`), so a token signed by a different team's key would already\n * fail signature verification, but binding `iss` explicitly matches Cloudflare's own published\n * Worker+Access reference implementation and requires the presence of the `iss` claim, so a\n * token without one is rejected too.\n *\n * When `audience` is provided the `aud` claim is also verified. **When `audience` is omitted,\n * `aud` is not checked at all** — because every Cloudflare Access application in an account\n * shares the same team JWKS, this means a token minted for *any other Access application in the\n * same team* is accepted here too (cross-application token replay). Callers that expose this\n * through a public option (e.g. `hono/cloudflare-access.ts`'s `cloudflareAccess`) should warn\n * loudly when a caller omits `audience` outside of a clearly-local-development configuration.\n *\n * A transient JWKS network/infra failure (bad team domain, DNS blip, certs endpoint down) is\n * otherwise indistinguishable from a genuinely invalid token — both fall through to the same\n * `catch` and the same `null` return, and without a `logger` nothing is recorded. When `logger`\n * is provided, the caught error is recorded at `warn` (matching the generic\n * `\"JWT verification failed\"` warning callers such as `cloudflareAccess` already emit) together\n * with the raw `err` and a best-effort `cause: \"network\" | \"invalid\"` classification (see\n * {@link classifyVerificationFailure}), so operators can distinguish an outage from a rejected\n * token without changing the fail-closed `null` return contract.\n *\n * @param token - The compact JWS to verify.\n * @param teamDomain - The Cloudflare Access team domain used to fetch the public JWKS and to\n *   compute the expected `iss` claim value (see {@link normalizeTeamDomain}).\n * @param audience - Application Audience Tag to verify the `aud` claim against. When omitted,\n *   `aud` is not checked at all — see the security remarks above.\n * @param logger - Optional structured logger. When omitted, verification failures are still\n *   returned as `null` but nothing is logged (unchanged prior behavior).\n */\nexport async function verifyAccessJwt(\n  token: string,\n  teamDomain: string,\n  audience?: string,\n  logger?: Logger\n): Promise<VerifiedToken | null> {\n  try {\n    const jwks = getRemoteJwks(teamDomain);\n    const { payload } = await jwtVerify(token, jwks, {\n      algorithms: [ACCESS_ALG],\n      audience: audience ?? undefined,\n      issuer: normalizeTeamDomain(teamDomain)\n    });\n    return extractClaims(payload);\n  } catch (err) {\n    logger?.warn(\"Cloudflare Access JWT verification failed\", {\n      err,\n      teamDomain,\n      cause: classifyVerificationFailure(err)\n    });\n    return null;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Helpers\n// ---------------------------------------------------------------------------\n\n/** Pull the required claims out of a verified payload. */\nexport function extractClaims(payload: JWTPayload): VerifiedToken | null {\n  const email = payload.email;\n  const sub = payload.sub;\n\n  if (typeof email !== \"string\" || !email) {\n    return null;\n  }\n  if (typeof sub !== \"string\" || !sub) {\n    return null;\n  }\n\n  return { email, sub };\n}\n\n// ---------------------------------------------------------------------------\n// Cookie helpers\n// ---------------------------------------------------------------------------\n\n/**\n * Build a `Set-Cookie` header value for the authorisation cookie.\n *\n * Mirrors the attributes used by Cloudflare Access: `HttpOnly; Secure; SameSite=Lax; Path=/`\n *\n * For local dev over plain HTTP the `Secure` flag is omitted when the request was made to\n * `localhost` or `127.0.0.1`.\n */\nexport function buildCookieHeader(token: string, isSecure: boolean): string {\n  const parts = [`${COOKIE_NAME}=${token}`, \"HttpOnly\", \"SameSite=Lax\", \"Path=/\"];\n  if (isSecure) {\n    parts.push(\"Secure\");\n  }\n  return parts.join(\"; \");\n}\n\n/**\n * Build a `Set-Cookie` header that clears the `CF_Authorization` cookie by setting it to an\n * empty value with `Max-Age=0`.\n *\n * Use this when a stale or invalid cookie needs to be removed so the user can re-authenticate.\n */\nexport function clearCookieHeader(): string {\n  return `${COOKIE_NAME}=; HttpOnly; SameSite=Lax; Path=/; Max-Age=0`;\n}\n\n/**\n * Parse the value of the `CF_Authorization` cookie from a `Cookie` header string. Returns\n * `undefined` when the cookie is absent.\n */\nexport function parseCookie(cookieHeader: string | null | undefined): string | undefined {\n  if (!cookieHeader) return undefined;\n\n  for (const pair of cookieHeader.split(\";\")) {\n    const [name, ...rest] = pair.split(\"=\");\n    if (name.trim() === COOKIE_NAME) {\n      return rest.join(\"=\").trim();\n    }\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;;AAWA,MAAM,4BAAY,IAAI,IAAmD;;;;;;;;;AAoBzE,MAAM,2BAA2B;;AAGjC,MAAM,iBAAiB;;;;;;;;;;;;;;;;;;;;AAqBvB,SAAgB,oBAAoB,YAA4B;CAG9D,MAAM,MAAM,YADC,WAAW,QAAQ,QAAQ,EACb,CAAC;CAC5B,MAAM,SAAS,IAAI,IAAI,GAAG;CAE1B,IAAI,CAAC,yBAAyB,KAAK,OAAO,QAAQ,GAChD,MAAM,IAAI,MAAM,2CAA2C,WAAW,EAAE;CAG1E,OAAO,OAAO;AAChB;;;;;;;;;;;AAYA,SAAgB,cAAc,YAA2D;CACvF,MAAM,SAAS,oBAAoB,UAAU;CAC7C,MAAM,WAAW,IAAI,IAAI,GAAG,OAAO,sBAAsB;CAEzD,IAAI,OAAO,UAAU,IAAI,SAAS,IAAI;CACtC,IAAI,CAAC,MAAM;EACT,IAAI,UAAU,QAAA,IAKZ,KAAK,MAAM,aAAa,UAAU,KAAK,GAAG;GACxC,UAAU,OAAO,SAAS;GAC1B;EACF;EAEF,OAAO,mBAAmB,QAAQ;EAClC,UAAU,IAAI,SAAS,MAAM,IAAI;CACnC;CACA,OAAO;AACT;;;;;;;;;;;;;AAcA,SAAgB,YAAY,KAAqB;CAC/C,IAAI,IAAI,WAAW,UAAU,GAC3B,OAAO;CAET,IAAI,eAAe,KAAK,GAAG,GACzB,MAAM,IAAI,MAAM,mCAAmC,IAAI,EAAE;CAE3D,OAAO,aAAa;AACtB;;;;;;;;;;;;;;;;;;AC/FA,MAAa,qBAAqB;;AAGlC,MAAM,UAAU;;;;;;;;;;;;AAahB,MAAM,aAAa;;AAGnB,MAAa,cAAc;;AAG3B,MAAa,aAAa;;AAG1B,MAAa,eAAe;;AAO5B,SAAS,cAAc,QAA4B;CACjD,OAAO,IAAI,YAAY,CAAC,CAAC,OAAO,MAAM;AACxC;;;;;;;;;AAcA,SAAS,iBAAyB;CAChC,OAAO,OAAO,WAAW;AAC3B;;;;;;;;;;;;;;;AAgBA,eAAsB,WACpB,OACA,UAAgE,CAAC,GAChD;CACjB,MAAM,SAAS,QAAQ,UAAA;CACvB,MAAM,WAAW,QAAQ,YAAY;CAErC,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;CAGxC,OAAO,IAAI,QAAQ;EACjB;EACA,KAJU,QAAQ,OAAO,eAAe;EAKxC,MAAM;EACN,KAAK;CACP,CAAiD,CAAC,CAC/C,mBAAmB,EAAE,KAAK,QAAQ,CAAC,CAAC,CACpC,YAAY,GAAG,CAAC,CAChB,kBAAkB,MAAM,QAAQ,CAAC,CACjC,KAAK,cAAc,MAAM,CAAC;AAC/B;;;;;;;AAoBA,eAAsB,aACpB,OACA,SAAiB,oBACc;CAC/B,IAAI;EACF,MAAM,EAAE,YAAY,MAAM,UAAU,OAAO,cAAc,MAAM,GAAG,EAChE,YAAY,CAAC,OAAO,EACtB,CAAC;EACD,OAAO,cAAc,OAAO;CAC9B,QAAQ;EACN,OAAO;CACT;AACF;;;;;;;;;;AAWA,MAAM,0BAA0B;CAC9BA,OAAW;CACXA,OAAW;CACXA,OAAW;CACXA,OAAW;CACXA,OAAW;CACXA,OAAW;CACXA,OAAW;AACb;;;;;;;;;;;;;;;;;AAkBA,SAAS,4BAA4B,KAAqC;CAIxE,OAH+B,wBAAwB,MACpD,eAAe,eAAe,UAEL,IAAI,YAAY;AAC9C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA0CA,eAAsB,gBACpB,OACA,YACA,UACA,QAC+B;CAC/B,IAAI;EAEF,MAAM,EAAE,YAAY,MAAM,UAAU,OADvB,cAAc,UACmB,GAAG;GAC/C,YAAY,CAAC,UAAU;GACvB,UAAU,YAAY,KAAA;GACtB,QAAQ,oBAAoB,UAAU;EACxC,CAAC;EACD,OAAO,cAAc,OAAO;CAC9B,SAAS,KAAK;EACZ,QAAQ,KAAK,6CAA6C;GACxD;GACA;GACA,OAAO,4BAA4B,GAAG;EACxC,CAAC;EACD,OAAO;CACT;AACF;;AAOA,SAAgB,cAAc,SAA2C;CACvE,MAAM,QAAQ,QAAQ;CACtB,MAAM,MAAM,QAAQ;CAEpB,IAAI,OAAO,UAAU,YAAY,CAAC,OAChC,OAAO;CAET,IAAI,OAAO,QAAQ,YAAY,CAAC,KAC9B,OAAO;CAGT,OAAO;EAAE;EAAO;CAAI;AACtB;;;;;;;;;AAcA,SAAgB,kBAAkB,OAAe,UAA2B;CAC1E,MAAM,QAAQ;EAAC,GAAG,YAAY,GAAG;EAAS;EAAY;EAAgB;CAAQ;CAC9E,IAAI,UACF,MAAM,KAAK,QAAQ;CAErB,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;;AAQA,SAAgB,oBAA4B;CAC1C,OAAO,GAAG,YAAY;AACxB;;;;;AAMA,SAAgB,YAAY,cAA6D;CACvF,IAAI,CAAC,cAAc,OAAO,KAAA;CAE1B,KAAK,MAAM,QAAQ,aAAa,MAAM,GAAG,GAAG;EAC1C,MAAM,CAAC,MAAM,GAAG,QAAQ,KAAK,MAAM,GAAG;EACtC,IAAI,KAAK,KAAK,MAAA,oBACZ,OAAO,KAAK,KAAK,GAAG,CAAC,CAAC,KAAK;CAE/B;AAEF"}

package/dist/logging/index.d.ts

@@ -0,0 +1,3 @@
+import { a as Environment, c as LogRecord, d as Runtime, f as StructuredTransportOptions, i as CreateLoggerOptions, l as Logger, m as TransportErrorHandler, n as CaptureTransport, o as LogContext, p as Transport, r as ConsoleTransportOptions, s as LogLevel, t as BrowserTransportOptions, u as ResolvedLoggerConfig } from "../types-DCSMb1cp.js";
+import { a as createCaptureTransport, c as resolveLoggerConfig, i as combineTransports, l as createLogger, n as createSilentTransport, o as createBrowserTransport, r as createConsoleTransport, s as serializeError, t as createStructuredTransport } from "../index-Byl-ZrCy.js";
+export { type BrowserTransportOptions, type CaptureTransport, type ConsoleTransportOptions, type CreateLoggerOptions, type Environment, type LogContext, type LogLevel, type LogRecord, type Logger, type ResolvedLoggerConfig, type Runtime, type StructuredTransportOptions, type Transport, type TransportErrorHandler, combineTransports, createBrowserTransport, createCaptureTransport, createConsoleTransport, createLogger, createSilentTransport, createStructuredTransport, resolveLoggerConfig, serializeError };

package/dist/logging/index.js

@@ -0,0 +1,3 @@
+import { a as createCaptureTransport, c as serializeError, i as createConsoleTransport, n as resolveLoggerConfig, o as createBrowserTransport, r as createStructuredTransport, s as createLogger, t as createSilentTransport } from "../silent-CWpHE65X.js";
+import { t as combineTransports } from "../logging-CGHjOVLM.js";
+export { combineTransports, createBrowserTransport, createCaptureTransport, createConsoleTransport, createLogger, createSilentTransport, createStructuredTransport, resolveLoggerConfig, serializeError };

package/dist/logging-CGHjOVLM.js

@@ -0,0 +1,24 @@
+import "./silent-CWpHE65X.js";
+//#region src/lib/logging/transports/combine.ts
+/**
+* Create a transport that forwards records to each of the supplied transports.
+*
+* @param transports - One or more transports to receive every record.
+* @returns A combined `Transport`.
+*/
+function combineTransports(...transports) {
+	return { log(record) {
+		const errors = [];
+		for (const transport of transports) try {
+			transport.log(record);
+		} catch (error) {
+			errors.push(error);
+		}
+		if (errors.length === 1) throw errors[0];
+		if (errors.length > 1) throw new AggregateError(errors, "Multiple transports failed");
+	} };
+}
+//#endregion
+export { combineTransports as t };
+
+//# sourceMappingURL=logging-CGHjOVLM.js.map

package/dist/logging-CGHjOVLM.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging-CGHjOVLM.js","names":[],"sources":["../src/lib/logging/transports/combine.ts"],"sourcesContent":["/**\n * @file A transport that fans out each record to multiple child transports in declaration order.\n *\n * `combineTransports()` attempts every child even when an earlier one throws, then re-throws the\n * collected failures so the logger-level try/catch can route them through `onTransportError`.\n *\n * Failure semantics:\n *   - One child throws        → that error is re-thrown after all children run.\n *   - Multiple children throw → an `AggregateError` is thrown after all children run.\n *   - No child throws         → returns normally.\n */\nimport type { LogRecord, Transport } from \"../types.js\";\n\n/**\n * Create a transport that forwards records to each of the supplied transports.\n *\n * @param transports - One or more transports to receive every record.\n * @returns A combined `Transport`.\n */\nexport function combineTransports(...transports: readonly Transport[]): Transport {\n  return {\n    log(record: LogRecord): void {\n      const errors: unknown[] = [];\n\n      for (const transport of transports) {\n        try {\n          transport.log(record);\n        } catch (error) {\n          errors.push(error);\n        }\n      }\n\n      if (errors.length === 1) {\n        throw errors[0];\n      }\n      if (errors.length > 1) {\n        throw new AggregateError(errors, \"Multiple transports failed\");\n      }\n    }\n  };\n}\n"],"mappings":";;;;;;;;AAmBA,SAAgB,kBAAkB,GAAG,YAA6C;CAChF,OAAO,EACL,IAAI,QAAyB;EAC3B,MAAM,SAAoB,CAAC;EAE3B,KAAK,MAAM,aAAa,YACtB,IAAI;GACF,UAAU,IAAI,MAAM;EACtB,SAAS,OAAO;GACd,OAAO,KAAK,KAAK;EACnB;EAGF,IAAI,OAAO,WAAW,GACpB,MAAM,OAAO;EAEf,IAAI,OAAO,SAAS,GAClB,MAAM,IAAI,eAAe,QAAQ,4BAA4B;CAEjE,EACF;AACF"}

package/dist/policy-CvS6AvvD.js

@@ -0,0 +1,20 @@
+//#region src/lib/auth-internal/policy.ts
+/**
+* Evaluate a request pathname against an ordered list of policies.
+*
+* Returns a {@link PolicyMatch} for the **first matching** policy, or `undefined` when no
+* policy matches (the caller decides what to do in that case).
+*
+* The `redirect` field defaults to `true` when the matching {@link PathPolicy} does not specify
+* one.
+*/
+function matchPolicy(pathname, policies) {
+	for (const { pattern, authenticate, redirect } of policies) if (pattern.test(pathname)) return {
+		authenticate,
+		redirect: redirect ?? true
+	};
+}
+//#endregion
+export { matchPolicy as t };
+
+//# sourceMappingURL=policy-CvS6AvvD.js.map

package/dist/policy-CvS6AvvD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-CvS6AvvD.js","names":[],"sources":["../src/lib/auth-internal/policy.ts"],"sourcesContent":["/**\n * @file Shared path-policy evaluation for the auth internals. Pure logic with no runtime\n * dependencies, so this module is both Worker-safe (for `hono/`) and Node-safe (for `vite/`).\n */\nimport type { PathPolicy, PolicyMatch } from \"./types.js\";\n\n/**\n * Evaluate a request pathname against an ordered list of policies.\n *\n * Returns a {@link PolicyMatch} for the **first matching** policy, or `undefined` when no\n * policy matches (the caller decides what to do in that case).\n *\n * The `redirect` field defaults to `true` when the matching {@link PathPolicy} does not specify\n * one.\n */\nexport function matchPolicy(pathname: string, policies: PathPolicy[]): PolicyMatch | undefined {\n  for (const { pattern, authenticate, redirect } of policies) {\n    if (pattern.test(pathname)) {\n      return { authenticate, redirect: redirect ?? true };\n    }\n  }\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;AAeA,SAAgB,YAAY,UAAkB,UAAiD;CAC7F,KAAK,MAAM,EAAE,SAAS,cAAc,cAAc,UAChD,IAAI,QAAQ,KAAK,QAAQ,GACvB,OAAO;EAAE;EAAc,UAAU,YAAY;CAAK;AAIxD"}

package/dist/problem-details/index.d.ts

@@ -0,0 +1,4 @@
+import { n as ProblemDetailsInput, t as ProblemDetails } from "../types-Cx6NNILW.js";
+import { t as ProblemDetailsError } from "../error-CLYcAvBM.js";
+import { i as problemDetails, n as statusToSlug, r as createProblemTypeRegistry, t as statusToPhrase } from "../index-DRIhR-Xn.js";
+export { type ProblemDetails, ProblemDetailsError, type ProblemDetailsInput, createProblemTypeRegistry, problemDetails, statusToPhrase, statusToSlug };

package/dist/problem-details/index.js

@@ -0,0 +1,3 @@
+import { a as statusToPhrase, n as ProblemDetailsError, o as statusToSlug, t as problemDetails } from "../factory-BI5gVL_P.js";
+import { t as createProblemTypeRegistry } from "../problem-details-CuRsLy3Q.js";
+export { ProblemDetailsError, createProblemTypeRegistry, problemDetails, statusToPhrase, statusToSlug };

package/dist/problem-details-CuRsLy3Q.js

@@ -0,0 +1,37 @@
+import { n as ProblemDetailsError } from "./factory-BI5gVL_P.js";
+//#region src/lib/problem-details/registry.ts
+/**
+* @file A registry for pre-defined, type-safe RFC 9457 problem types.
+*/
+/**
+* Create a registry of pre-defined problem types.
+* Provides type-safe error creation from registered definitions.
+*
+* @param definitions - A map of problem type keys to their base definition (type, status, title).
+* @returns A {@link ProblemTypeRegistry} for the given definitions.
+* @example
+* ```ts
+* const problems = createProblemTypeRegistry({
+*   ORDER_CONFLICT: {
+*     type: "https://api.example.com/problems/order-conflict",
+*     status: 409,
+*     title: "Order Conflict",
+*   },
+* });
+* throw problems.create("ORDER_CONFLICT", { detail: "Already exists" });
+* ```
+*/
+function createProblemTypeRegistry(definitions) {
+	return {
+		create: (key, options) => new ProblemDetailsError({
+			...definitions[key],
+			...options
+		}),
+		get: (key) => ({ ...definitions[key] }),
+		types: () => Object.keys(definitions)
+	};
+}
+//#endregion
+export { createProblemTypeRegistry as t };
+
+//# sourceMappingURL=problem-details-CuRsLy3Q.js.map

package/dist/problem-details-CuRsLy3Q.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"problem-details-CuRsLy3Q.js","names":[],"sources":["../src/lib/problem-details/registry.ts"],"sourcesContent":["/**\n * @file A registry for pre-defined, type-safe RFC 9457 problem types.\n */\nimport { ProblemDetailsError } from \"./error.js\";\n\ninterface ProblemTypeDefinition {\n  readonly type: string;\n  readonly status: number;\n  readonly title: string;\n}\n\ninterface CreateOptions<T extends Record<string, unknown> = Record<string, unknown>> {\n  detail?: string;\n  instance?: string;\n  extensions?: T;\n}\n\ninterface ProblemTypeRegistry<K extends string> {\n  /** Create a {@link ProblemDetailsError} from a registered problem type key. */\n  create: <T extends Record<string, unknown>>(\n    key: K,\n    options?: CreateOptions<T>\n  ) => ProblemDetailsError;\n  /**\n   * Get the base definition (type, status, title) for a registered key.\n   * Returns a defensive shallow copy on every call, so mutating the result never affects the\n   * registry's internal definitions.\n   */\n  get: (key: K) => Readonly<ProblemTypeDefinition>;\n  /** List all registered problem type keys. */\n  types: () => K[];\n}\n\n/**\n * Create a registry of pre-defined problem types.\n * Provides type-safe error creation from registered definitions.\n *\n * @param definitions - A map of problem type keys to their base definition (type, status, title).\n * @returns A {@link ProblemTypeRegistry} for the given definitions.\n * @example\n * ```ts\n * const problems = createProblemTypeRegistry({\n *   ORDER_CONFLICT: {\n *     type: \"https://api.example.com/problems/order-conflict\",\n *     status: 409,\n *     title: \"Order Conflict\",\n *   },\n * });\n * throw problems.create(\"ORDER_CONFLICT\", { detail: \"Already exists\" });\n * ```\n */\nexport function createProblemTypeRegistry<K extends string>(\n  definitions: Record<K, ProblemTypeDefinition>\n): ProblemTypeRegistry<K> {\n  return {\n    create: (key, options) => new ProblemDetailsError({ ...definitions[key], ...options }),\n    get: (key) => ({ ...definitions[key] }),\n    types: () => Object.keys(definitions) as K[]\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAmDA,SAAgB,0BACd,aACwB;CACxB,OAAO;EACL,SAAS,KAAK,YAAY,IAAI,oBAAoB;GAAE,GAAG,YAAY;GAAM,GAAG;EAAQ,CAAC;EACrF,MAAM,SAAS,EAAE,GAAG,YAAY,KAAK;EACrC,aAAa,OAAO,KAAK,WAAW;CACtC;AACF"}