@agilesyndrome/cf-genai-base 5.0.2 → 6.0.0

package/dist/auth/identity/index.d.ts

@@ -0,0 +1,58 @@
+export interface CanonicalAuthUser {
+    id: string;
+    provider?: string;
+    subject?: string;
+    email?: string | null;
+    display_name?: string | null;
+    is_admin?: boolean | number;
+}
+export interface RequestUser {
+    sub?: string;
+    email?: string;
+    name?: string;
+    auth_strategy?: string;
+    authUser?: CanonicalAuthUser | null;
+}
+export interface IdentityState<Data = unknown> {
+    requestedBy?: string;
+    user?: RequestUser | null;
+    authUser?: CanonicalAuthUser | null;
+    userId?: string | null;
+    data?: Data;
+}
+export interface RequestIdentity {
+    user: RequestUser | null;
+    authUser: CanonicalAuthUser | null;
+    userId: string | null;
+    who: string;
+    isAuthenticated: boolean;
+    isAdmin: boolean;
+}
+type IdentityLike = IdentityState | RequestUser | CanonicalAuthUser | null | undefined;
+export declare function requestActor(value?: unknown): string;
+export declare function authUser(value: IdentityLike): CanonicalAuthUser | null;
+export declare function userId(value: IdentityLike): string | null;
+export declare function requestIdentity(state?: IdentityState): RequestIdentity;
+interface RequestContextInput<Env, Data, State extends IdentityState<Data>> {
+    request: Request;
+    env: Env;
+    ctx: ExecutionContext;
+    state: State;
+    data?: Data;
+}
+export declare function requestContext<Env, Data = unknown, State extends IdentityState<Data> = IdentityState<Data>>({ request, env, ctx, state, data, }: RequestContextInput<Env, Data, State>): {
+    request: Request<unknown, CfProperties<unknown>>;
+    env: Env;
+    ctx: ExecutionContext<unknown>;
+    state: State;
+    data: Data | undefined;
+    readonly user: RequestUser | null;
+    readonly authUser: CanonicalAuthUser | null;
+    readonly userId: string | null;
+    readonly who: string;
+    readonly isAuthenticated: boolean;
+    readonly isAdmin: boolean;
+    event: (what: string, where?: string, details?: Record<string, unknown>, when?: Date) => Promise<import("../../core/events/index.js").AppEvent<import("../../core/events/index.js").EventDetails> | null>;
+};
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/identity/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/identity/index.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,QAAQ,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;CACrC;AAED,MAAM,WAAW,aAAa,CAAC,IAAI,GAAG,OAAO;IAC3C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,WAAW,GAAG,IAAI,CAAC;IAC1B,QAAQ,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,WAAW,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACnC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,eAAe,EAAE,OAAO,CAAC;IACzB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,KAAK,YAAY,GAAG,aAAa,GAAG,WAAW,GAAG,iBAAiB,GAAG,IAAI,GAAG,SAAS,CAAC;AAEvF,wBAAgB,YAAY,CAAC,KAAK,GAAE,OAAY,GAAG,MAAM,CAQxD;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,iBAAiB,GAAG,IAAI,CAQtE;AAED,wBAAgB,MAAM,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED,wBAAgB,eAAe,CAAC,KAAK,GAAE,aAAkB,GAAG,eAAe,CAU1E;AAED,UAAU,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,SAAS,aAAa,CAAC,IAAI,CAAC;IACxE,OAAO,EAAE,OAAO,CAAC;IACjB,GAAG,EAAE,GAAG,CAAC;IACT,GAAG,EAAE,gBAAgB,CAAC;IACtB,KAAK,EAAE,KAAK,CAAC;IACb,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,wBAAgB,cAAc,CAC5B,GAAG,EACH,IAAI,GAAG,OAAO,EACd,KAAK,SAAS,aAAa,CAAC,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,EACvD,EACA,OAAO,EACP,GAAG,EACH,GAAG,EACH,KAAK,EACL,IAAI,GACL,EAAE,mBAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC;;;;;;;;;;;;kBAc5B,MAAM,4BAEH,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,SAC1B,IAAI;EAGf"}

package/dist/auth/identity/index.js

@@ -0,0 +1,58 @@
+import { Event, emitEvent } from "../../core/events/index.js";
+export function requestActor(value = {}) {
+    const state = value;
+    if (state.requestedBy)
+        return String(state.requestedBy);
+    const canonical = authUser(state);
+    if (canonical?.id)
+        return `user:${canonical.id}`;
+    if (state.user?.auth_strategy === "http_basic")
+        return "user:admin";
+    if (state.user?.sub)
+        return `user:${state.user.sub}`;
+    return "system:read";
+}
+export function authUser(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const candidate = value;
+    return candidate.authUser
+        ?? candidate.user?.authUser
+        ?? candidate.state?.authUser
+        ?? candidate.state?.user?.authUser
+        ?? (candidate.id && candidate.provider && candidate.subject ? candidate : null);
+}
+export function userId(value) {
+    if (!value || typeof value !== "object")
+        return null;
+    const candidate = value;
+    return authUser(value)?.id ?? candidate.userId ?? candidate.sub ?? candidate.email ?? null;
+}
+export function requestIdentity(state = {}) {
+    const canonical = authUser(state);
+    return {
+        user: state.user ?? null,
+        authUser: canonical,
+        userId: canonical?.id ?? null,
+        who: requestActor(state),
+        isAuthenticated: Boolean(canonical || state.user),
+        isAdmin: Boolean(state.user?.auth_strategy === "http_basic" || canonical?.is_admin),
+    };
+}
+export function requestContext({ request, env, ctx, state, data, }) {
+    return {
+        request,
+        env,
+        ctx,
+        state,
+        data: data ?? state.data,
+        get user() { return state.user ?? null; },
+        get authUser() { return authUser(state); },
+        get userId() { return userId(state); },
+        get who() { return requestActor(state); },
+        get isAuthenticated() { return Boolean(authUser(state) || state.user); },
+        get isAdmin() { return Boolean(state.user?.auth_strategy === "http_basic" || authUser(state)?.is_admin); },
+        event: (what, where = "application", details = {}, when = new Date()) => emitEvent(env, Event(requestActor(state), what, where, when, details), ctx),
+    };
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/identity/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/identity/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,4BAA4B,CAAC;AAsC9D,MAAM,UAAU,YAAY,CAAC,KAAK,GAAY,EAAE;IAC9C,MAAM,KAAK,GAAG,KAAsB,CAAC;IACrC,IAAI,KAAK,CAAC,WAAW;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,SAAS,EAAE,EAAE;QAAE,OAAO,QAAQ,SAAS,CAAC,EAAE,EAAE,CAAC;IACjD,IAAI,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY;QAAE,OAAO,YAAY,CAAC;IACpE,IAAI,KAAK,CAAC,IAAI,EAAE,GAAG;QAAE,OAAO,QAAQ,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;IACrD,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAmB;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,KAAoF,CAAC;IACvG,OAAO,SAAS,CAAC,QAAQ;WACpB,SAAS,CAAC,IAAI,EAAE,QAAQ;WACxB,SAAS,CAAC,KAAK,EAAE,QAAQ;WACzB,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ;WAC/B,CAAC,SAAS,CAAC,EAAE,IAAI,SAAS,CAAC,QAAQ,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,KAAmB;IACxC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,SAAS,GAAG,KAAoC,CAAC;IACvD,OAAO,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAK,GAAkB,EAAE;IACvD,MAAM,SAAS,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO;QACL,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,QAAQ,EAAE,SAAS;QACnB,MAAM,EAAE,SAAS,EAAE,EAAE,IAAI,IAAI;QAC7B,GAAG,EAAE,YAAY,CAAC,KAAK,CAAC;QACxB,eAAe,EAAE,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC;QACjD,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,SAAS,EAAE,QAAQ,CAAC;KACpF,CAAC;AACJ,CAAC;AAUD,MAAM,UAAU,cAAc,CAI5B,EACA,OAAO,EACP,GAAG,EACH,GAAG,EACH,KAAK,EACL,IAAI,GACkC;IACtC,OAAO;QACL,OAAO;QACP,GAAG;QACH,GAAG;QACH,KAAK;QACL,IAAI,EAAE,IAAI,IAAI,KAAK,CAAC,IAAI;QACxB,IAAI,IAAI,KAAK,OAAO,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC;QACzC,IAAI,QAAQ,KAAK,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,GAAG,KAAK,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACzC,IAAI,eAAe,KAAK,OAAO,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACxE,IAAI,OAAO,KAAK,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,KAAK,YAAY,IAAI,QAAQ,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC1G,KAAK,EAAE,CACL,IAAY,EACZ,KAAK,GAAG,aAAa,EACrB,OAAO,GAA4B,EAAE,EACrC,IAAI,GAAS,IAAI,IAAI,EAAE,EACvB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE,GAAG,CAAC;KACjF,CAAC;AACJ,CAAC"}

package/dist/auth/impersonation/constants.d.ts

@@ -0,0 +1,2 @@
+export declare const IMPERSONATION_COOKIE = "__Host-cfgenai_impersonation";
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/impersonation/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/constants.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,oBAAoB,iCAAiC,CAAC"}

package/dist/auth/impersonation/constants.js

@@ -0,0 +1,2 @@
+export const IMPERSONATION_COOKIE = "__Host-cfgenai_impersonation";
+//# sourceMappingURL=constants.js.map

package/dist/auth/impersonation/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/auth/impersonation/constants.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,oBAAoB,GAAG,8BAA8B,CAAC"}

package/dist/auth/impersonation/domain.d.ts

@@ -0,0 +1,6 @@
+import { AppDomain } from "../../domain/index.js";
+export declare class AuthImpersonationDomain extends AppDomain {
+    constructor();
+}
+export declare const authImpersonation: AuthImpersonationDomain;
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/impersonation/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAGlD,qBAAa,uBAAwB,SAAQ,SAAS;IACpD,cAYC;CACF;AAED,eAAO,MAAM,iBAAiB,yBAAgC,CAAC"}

package/dist/auth/impersonation/domain.js

@@ -0,0 +1,16 @@
+import { AppDomain } from "../../domain/index.js";
+import { jsonWithCookie } from "../../api/http.js";
+import { IMPERSONATION_COOKIE } from "./constants.js";
+export class AuthImpersonationDomain extends AppDomain {
+    constructor() {
+        super({ name: "auth.impersonation", basePath: "/api/admin/impersonate", auth: "user", scopes: "impersonation:start" });
+        this.route({
+            method: "POST",
+            path: "/clear",
+            csrf: true,
+            handler: () => jsonWithCookie({ ok: true }, `${IMPERSONATION_COOKIE}=; Max-Age=0; Path=/; Secure; HttpOnly; SameSite=Lax`),
+        });
+    }
+}
+export const authImpersonation = new AuthImpersonationDomain();
+//# sourceMappingURL=domain.js.map

package/dist/auth/impersonation/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/impersonation/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,gBAAgB,CAAC;AACtD,MAAM,OAAO,uBAAwB,SAAQ,SAAS;IACpD;QACE,KAAK,CAAC,EAAE,IAAI,EAAE,oBAAoB,EAAE,QAAQ,EAAE,wBAAwB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACvH,IAAI,CAAC,KAAK,CAAC;YACT,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,IAAI;YACV,OAAO,EAAE,GAAG,EAAE,CACZ,cAAc,CACZ,EAAE,EAAE,EAAE,IAAI,EAAE,EACZ,GAAG,oBAAoB,sDAAsD,CAC9E;SACJ,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,IAAI,uBAAuB,EAAE,CAAC"}

package/dist/auth/impersonation/index.d.ts

@@ -0,0 +1,6 @@
+export * from "./constants.js";
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/impersonation/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/impersonation/index.js

@@ -0,0 +1,6 @@
+export * from "./constants.js";
+export * from "./model.js";
+export * from "./validation.js";
+export * from "./service.js";
+export * from "./domain.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/impersonation/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/impersonation/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,YAAY,CAAC;AAC3B,cAAc,iBAAiB,CAAC;AAChC,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC"}

package/dist/auth/impersonation/model.d.ts

@@ -0,0 +1,12 @@
+export interface ImpersonationEnvironment {
+    AUTH_SESSION_SECRET?: string;
+}
+export interface ImpersonationTokenPayload {
+    adminUserId: string;
+    targetUserId: string;
+    exp: number;
+}
+export interface ImpersonationTokenOptions {
+    ttlSeconds?: number;
+}
+//# sourceMappingURL=model.d.ts.map

package/dist/auth/impersonation/model.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/model.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,wBAAwB;IACvC,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,yBAAyB;IACxC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB"}

package/dist/auth/impersonation/model.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=model.js.map

package/dist/auth/impersonation/model.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"model.js","sourceRoot":"","sources":["../../../src/auth/impersonation/model.ts"],"names":[],"mappings":""}

package/dist/auth/impersonation/service.d.ts

@@ -0,0 +1,4 @@
+import type { ImpersonationEnvironment, ImpersonationTokenOptions, ImpersonationTokenPayload } from "./model.js";
+export declare function createImpersonationToken(env: ImpersonationEnvironment, adminUserId: unknown, targetUserId: unknown, { ttlSeconds }?: ImpersonationTokenOptions): Promise<string>;
+export declare function verifyImpersonationToken(token: unknown, env: ImpersonationEnvironment): Promise<ImpersonationTokenPayload | null>;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/impersonation/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACV,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EAC1B,MAAM,YAAY,CAAC;AAGpB,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,wBAAwB,EAC7B,WAAW,EAAE,OAAO,EACpB,YAAY,EAAE,OAAO,EACrB,EAAE,UAAgB,EAAE,GAAE,yBAA8B,GACnD,OAAO,CAAC,MAAM,CAAC,CAWjB;AAED,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,OAAO,EACd,GAAG,EAAE,wBAAwB,GAC5B,OAAO,CAAC,yBAAyB,GAAG,IAAI,CAAC,CAY3C"}

package/dist/auth/impersonation/service.js

@@ -0,0 +1,32 @@
+import { base64url, base64urlDecode, constantTimeEqual, signValue } from "../encoding.js";
+import { isImpersonationPayload, normalizeImpersonationTtl } from "./validation.js";
+export async function createImpersonationToken(env, adminUserId, targetUserId, { ttlSeconds = 900 } = {}) {
+    if (!env.AUTH_SESSION_SECRET) {
+        throw new Error("AUTH_SESSION_SECRET is required for impersonation.");
+    }
+    const payload = {
+        adminUserId: String(adminUserId || "admin"),
+        targetUserId: String(targetUserId),
+        exp: Math.floor(Date.now() / 1000) + normalizeImpersonationTtl(ttlSeconds),
+    };
+    const encoded = base64url(new TextEncoder().encode(JSON.stringify(payload)));
+    return `${encoded}.${await signValue(encoded, env.AUTH_SESSION_SECRET)}`;
+}
+export async function verifyImpersonationToken(token, env) {
+    if (!env.AUTH_SESSION_SECRET)
+        return null;
+    const [encoded, signature] = String(token || "").split(".");
+    if (!encoded || !signature)
+        return null;
+    const expected = await signValue(encoded, env.AUTH_SESSION_SECRET);
+    if (!constantTimeEqual(signature, expected))
+        return null;
+    try {
+        const payload = JSON.parse(new TextDecoder().decode(base64urlDecode(encoded)));
+        return isImpersonationPayload(payload) ? payload : null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/impersonation/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/auth/impersonation/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAM1F,OAAO,EAAE,sBAAsB,EAAE,yBAAyB,EAAE,MAAM,iBAAiB,CAAC;AAEpF,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAA6B,EAC7B,WAAoB,EACpB,YAAqB,EACrB,EAAE,UAAU,GAAG,GAAG,EAAE,GAA8B,EAAE;IAEpD,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,OAAO,GAA8B;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW,IAAI,OAAO,CAAC;QAC3C,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC;QAClC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,yBAAyB,CAAC,UAAU,CAAC;KAC3E,CAAC;IACF,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,GAAG,OAAO,IAAI,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAC3E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAc,EACd,GAA6B;IAE7B,IAAI,CAAC,GAAG,CAAC,mBAAmB;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACnE,IAAI,CAAC,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IACzD,IAAI,CAAC;QACH,MAAM,OAAO,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACxF,OAAO,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/auth/impersonation/validation.d.ts

@@ -0,0 +1,4 @@
+import type { ImpersonationTokenPayload } from "./model.js";
+export declare function normalizeImpersonationTtl(value: unknown): number;
+export declare function isImpersonationPayload(value: unknown): value is ImpersonationTokenPayload;
+//# sourceMappingURL=validation.d.ts.map

package/dist/auth/impersonation/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../../src/auth/impersonation/validation.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,YAAY,CAAC;AAE5D,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAEhE;AAED,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,yBAAyB,CAQzF"}

package/dist/auth/impersonation/validation.js

@@ -0,0 +1,14 @@
+export function normalizeImpersonationTtl(value) {
+    return Math.min(Math.max(Number(value) || 900, 60), 3600);
+}
+export function isImpersonationPayload(value) {
+    if (!value || typeof value !== "object")
+        return false;
+    const payload = value;
+    return typeof payload.adminUserId === "string"
+        && typeof payload.targetUserId === "string"
+        && payload.targetUserId.length > 0
+        && typeof payload.exp === "number"
+        && payload.exp > Date.now() / 1000;
+}
+//# sourceMappingURL=validation.js.map

package/dist/auth/impersonation/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../../src/auth/impersonation/validation.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,yBAAyB,CAAC,KAAc;IACtD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;AAC5D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACnD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,MAAM,OAAO,GAAG,KAA2C,CAAC;IAC5D,OAAO,OAAO,OAAO,CAAC,WAAW,KAAK,QAAQ;WACzC,OAAO,OAAO,CAAC,YAAY,KAAK,QAAQ;WACxC,OAAO,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;WAC/B,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;WAC/B,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,13 @@
+export * from "./constants.js";
+export * from "./identity/index.js";
+export * from "./scopes/index.js";
+export * from "./users/index.js";
+export * from "./tenants/index.js";
+export * from "./groups/index.js";
+export * from "./domains.js";
+export * from "./repositories.js";
+export * from "./subscriptions/index.js";
+export * from "./impersonation/index.js";
+export * from "./users/domain.js";
+export * from "./oauth-single/index.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC"}

package/dist/auth/index.js

@@ -0,0 +1,13 @@
+export * from "./constants.js";
+export * from "./identity/index.js";
+export * from "./scopes/index.js";
+export * from "./users/index.js";
+export * from "./tenants/index.js";
+export * from "./groups/index.js";
+export * from "./domains.js";
+export * from "./repositories.js";
+export * from "./subscriptions/index.js";
+export * from "./impersonation/index.js";
+export * from "./users/domain.js";
+export * from "./oauth-single/index.js";
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,oBAAoB,CAAC;AACnC,cAAc,mBAAmB,CAAC;AAClC,cAAc,cAAc,CAAC;AAC7B,cAAc,mBAAmB,CAAC;AAClC,cAAc,0BAA0B,CAAC;AACzC,cAAc,0BAA0B,CAAC;AACzC,cAAc,mBAAmB,CAAC;AAClC,cAAc,yBAAyB,CAAC"}

package/dist/auth/oauth-single/constants.d.ts

@@ -0,0 +1,4 @@
+export declare const OAUTH_SINGLE = "OAUTH_SINGLE";
+export declare const PACKAGE_NAME = "@agilesyndrome/cf-genai-base";
+export declare const VERSION = "5.0.3";
+//# sourceMappingURL=constants.d.ts.map

package/dist/auth/oauth-single/constants.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/constants.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY,iBAAiB,CAAC;AAC3C,eAAO,MAAM,YAAY,iCAAoB,CAAC;AAC9C,eAAO,MAAM,OAAO,UAAe,CAAC"}

package/dist/auth/oauth-single/constants.js

@@ -0,0 +1,5 @@
+import { BASE_PACKAGE_NAME, BASE_VERSION } from "../../core/constants.js";
+export const OAUTH_SINGLE = "OAUTH_SINGLE";
+export const PACKAGE_NAME = BASE_PACKAGE_NAME;
+export const VERSION = BASE_VERSION;
+//# sourceMappingURL=constants.js.map

package/dist/auth/oauth-single/constants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/constants.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAE1E,MAAM,CAAC,MAAM,YAAY,GAAG,cAAc,CAAC;AAC3C,MAAM,CAAC,MAAM,YAAY,GAAG,iBAAiB,CAAC;AAC9C,MAAM,CAAC,MAAM,OAAO,GAAG,YAAY,CAAC"}

package/dist/auth/oauth-single/cookies.d.ts

@@ -0,0 +1,10 @@
+export declare function cookies(request: Request): Record<string, string>;
+export declare function cookie(name: string, value: string, age: number): string;
+export declare function clearCookie(name: string): string;
+export declare function redirect(location: string | URL, setCookies: readonly string[]): Response;
+export declare function safeReturnTo(value: string | null | undefined): string;
+export declare function decodeReturn(value: string | undefined): string;
+export declare function base64url(bytes: Uint8Array): string;
+export declare function decodeBase64Url(value: string): Uint8Array<ArrayBuffer>;
+export declare function constantTimeEqual(left: string, right: string): boolean;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/oauth-single/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/cookies.ts"],"names":[],"mappings":"AAEA,wBAAgB,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAShE;AAED,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,MAAM,EAAE,GAAG,QAAQ,CAOxF;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIrE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CAM9D;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAInD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAAC,WAAW,CAAC,CAItE;AAED,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAStE"}

package/dist/auth/oauth-single/cookies.js

@@ -0,0 +1,59 @@
+const decoder = new TextDecoder();
+export function cookies(request) {
+    return Object.fromEntries((request.headers.get("Cookie") || "").split(";").flatMap((part) => {
+        const separator = part.indexOf("=");
+        return separator < 0
+            ? []
+            : [[part.slice(0, separator).trim(), part.slice(separator + 1).trim()]];
+    }));
+}
+export function cookie(name, value, age) {
+    return `${name}=${value}; Max-Age=${age}; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}
+export function clearCookie(name) {
+    return `${name}=; Max-Age=0; Path=/; HttpOnly; Secure; SameSite=Lax`;
+}
+export function redirect(location, setCookies) {
+    const response = new Response(null, {
+        status: 302,
+        headers: { Location: String(location), "Cache-Control": "no-store" },
+    });
+    for (const value of setCookies)
+        response.headers.append("Set-Cookie", value);
+    return response;
+}
+export function safeReturnTo(value) {
+    return value?.startsWith("/") && !value.startsWith("//") && !value.startsWith("/auth/")
+        ? value
+        : "/";
+}
+export function decodeReturn(value) {
+    try {
+        return safeReturnTo(decoder.decode(decodeBase64Url(value || "")));
+    }
+    catch {
+        return "/";
+    }
+}
+export function base64url(bytes) {
+    let value = "";
+    for (const byte of bytes)
+        value += String.fromCharCode(byte);
+    return btoa(value).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function decodeBase64Url(value) {
+    const padded = value.replace(/-/g, "+").replace(/_/g, "/")
+        + "=".repeat((4 - value.length % 4) % 4);
+    return Uint8Array.from(atob(padded), (character) => character.charCodeAt(0));
+}
+export function constantTimeEqual(left, right) {
+    const encoder = new TextEncoder();
+    const a = encoder.encode(left);
+    const b = encoder.encode(right);
+    let difference = a.length ^ b.length;
+    for (let index = 0; index < Math.max(a.length, b.length); index += 1) {
+        difference |= (a[index] || 0) ^ (b[index] || 0);
+    }
+    return difference === 0;
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/oauth-single/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,MAAM,UAAU,OAAO,CAAC,OAAgB;IACtC,OAAO,MAAM,CAAC,WAAW,CACvB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE;QAChE,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,OAAO,SAAS,GAAG,CAAC;YAClB,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC5E,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW;IAC7D,OAAO,GAAG,IAAI,IAAI,KAAK,aAAa,GAAG,0CAA0C,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,GAAG,IAAI,sDAAsD,CAAC;AACvE,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,QAAsB,EAAE,UAA6B;IAC5E,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE;QAClC,MAAM,EAAE,GAAG;QACX,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE;KACrE,CAAC,CAAC;IACH,KAAK,MAAM,KAAK,IAAI,UAAU;QAAE,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC7E,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAgC;IAC3D,OAAO,KAAK,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,QAAQ,CAAC;QACrF,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,GAAG,CAAC;AACV,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAyB;IACpD,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAiB;IACzC,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,KAAK,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;UACtD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC3C,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAa;IAC3D,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;IAClC,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAChC,IAAI,UAAU,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrE,UAAU,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,UAAU,KAAK,CAAC,CAAC;AAC1B,CAAC"}

package/dist/auth/oauth-single/domain.d.ts

@@ -0,0 +1,14 @@
+import { AppDomain, type DomainHandler } from "../../domain/index.js";
+import type { AuthRequestState, OAuthEnvironment } from "./model.js";
+interface OAuthHandlers {
+    login: DomainHandler<OAuthEnvironment, AuthRequestState>;
+    callback: DomainHandler<OAuthEnvironment, AuthRequestState>;
+    logout: DomainHandler<OAuthEnvironment, AuthRequestState>;
+    me: DomainHandler<OAuthEnvironment, AuthRequestState>;
+}
+/** The domain owns only HTTP registration; protocol and session code live elsewhere. */
+export declare class OAuthSingleDomain extends AppDomain<unknown, OAuthEnvironment, AuthRequestState> {
+    constructor(handlers: OAuthHandlers);
+}
+export {};
+//# sourceMappingURL=domain.d.ts.map

package/dist/auth/oauth-single/domain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAErE,UAAU,aAAa;IACrB,KAAK,EAAE,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IACzD,QAAQ,EAAE,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC5D,MAAM,EAAE,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;IAC1D,EAAE,EAAE,aAAa,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,CAAC;CACvD;AAED,wFAAwF;AACxF,qBAAa,iBAAkB,SAAQ,SAAS,CAAC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,CAAC;IAC3F,YAAY,QAAQ,EAAE,aAAa,EAMlC;CACF"}

package/dist/auth/oauth-single/domain.js

@@ -0,0 +1,12 @@
+import { AppDomain } from "../../domain/index.js";
+/** The domain owns only HTTP registration; protocol and session code live elsewhere. */
+export class OAuthSingleDomain extends AppDomain {
+    constructor(handlers) {
+        super({ name: "auth.oauth-single", basePath: "/auth", auth: "user" });
+        this.route({ method: "GET", path: "/login", auth: "public", handler: handlers.login });
+        this.route({ method: "GET", path: "/callback", auth: "public", handler: handlers.callback });
+        this.route({ method: "POST", path: "/logout", auth: "public", handler: handlers.logout });
+        this.route({ method: "GET", absolutePath: "/api/me", auth: "public", handler: handlers.me });
+    }
+}
+//# sourceMappingURL=domain.js.map

package/dist/auth/oauth-single/domain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"domain.js","sourceRoot":"","sources":["../../../src/auth/oauth-single/domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAsB,MAAM,uBAAuB,CAAC;AAUtE,wFAAwF;AACxF,MAAM,OAAO,iBAAkB,SAAQ,SAAsD;IAC3F,YAAY,QAAuB;QACjC,KAAK,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;QACtE,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;QACvF,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC1F,IAAI,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC;IAC/F,CAAC;CACF"}

package/dist/auth/oauth-single/index.d.ts

@@ -0,0 +1,31 @@
+import type { AuthRequestState, OAuthEnvironment, OAuthIdentity, OAuthOptions } from "./model.js";
+export { OAUTH_SINGLE, PACKAGE_NAME, VERSION } from "./constants.js";
+export type * from "./model.js";
+/**
+ * Generic OIDC auth for Workers using Authorization Code + PKCE and a signed,
+ * host-only cookie. Application-specific authorization remains in the hooks.
+ */
+export declare function createAuth(options?: OAuthOptions): {
+    name: string;
+    displayName: string;
+    packageName: string;
+    version: string;
+    strategy: string;
+    requiredEnvironment: ({ request }: {
+        request: Request;
+        url: URL;
+    }) => string[];
+    domains: import("../../app.js").AnyAppDomain[];
+    healthchecks: readonly unknown[];
+    circuitBreakers: readonly unknown[];
+    handle(request: Request, env: OAuthEnvironment, _ctx?: ExecutionContext, state?: AuthRequestState): Promise<Response | null>;
+    getUser: (request: Request, env: OAuthEnvironment) => Promise<OAuthIdentity | null>;
+    healthcheck: (env: OAuthEnvironment) => Promise<{
+        feature: string;
+        component: string;
+        displayName: string;
+        state: string;
+    }>;
+    middleware(request: Request, env: OAuthEnvironment, ctx: ExecutionContext, next: (request: Request, env?: OAuthEnvironment, ctx?: ExecutionContext, state?: AuthRequestState) => Response | Promise<Response>, state?: AuthRequestState): Promise<Response>;
+};
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/oauth-single/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/auth/oauth-single/index.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,YAAY,EACb,MAAM,YAAY,CAAC;AAoBpB,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,gBAAgB,CAAC;AACrE,mBAAmB,YAAY,CAAC;AAEhC;;;GAGG;AACH,wBAAgB,UAAU,CAAC,OAAO,GAAE,YAAiB;;;;;;uCA+Id;QAAE,OAAO,EAAE,OAAO,CAAC;QAAC,GAAG,EAAE,GAAG,CAAA;KAAE;;;;oBAYtD,OAAO,OACX,gBAAgB,SACd,gBAAgB,UACf,gBAAgB,GACvB,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;uBAgCR,OAAO,OAAO,gBAAgB;uBACxB,gBAAgB;;;;;;wBAa9B,OAAO,OACX,gBAAgB,OAChB,gBAAgB,QACf,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,GAAG,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,EAAE,gBAAgB,KAAK,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,UAC1H,gBAAgB,GACvB,OAAO,CAAC,QAAQ,CAAC;EAKvB"}