@alneas/eaos-server 0.0.0-stage → 0.2.0

package/dist/auth-hooks/index.d.ts

@@ -0,0 +1,80 @@
+import * as hono_types from 'hono/types';
+import { Context, Hono } from 'hono';
+export { ApiKeyLookup, resolveApiKey } from './api-key.js';
+import '@alneas/eaos-core';
+
+/**
+ * Creates a body-limited registration endpoint that verifies the caller before parsing JSON.
+ * @typeParam T - Validated registration input returned by parse and passed unchanged to register.
+ * @param options - Host callbacks: verify receives the request context before parsing and must return a rejection Response or no value to continue; parse synchronously validates unknown JSON; register receives the parsed input and context and resolves the final response.
+ * @returns A Hono router serving POST /registration with a 128 KiB body limit; JSON or parser failures return 400.
+ * @throws Request handling propagates verify and register rejections; parse exceptions become 400 responses.
+ * @remarks The host owns authentication, registration persistence, duplicate handling, and transactional behavior. Body size enforcement precedes verify.
+ * @example
+ * ```typescript
+ * import type { Context } from "hono";
+ * import { createRegistrationHook } from "@alneas/eaos-server/auth-hooks";
+ * export function registrationRouter(
+ *   verify: (context: Context) => Promise<Response | void>,
+ *   register: (input: { email: string }, context: Context) => Promise<Response>,
+ * ) {
+ *   return createRegistrationHook({ verify, register, parse(body: unknown) {
+ *     if (!body || typeof body !== "object" || !("email" in body) || typeof body.email !== "string") {
+ *       throw new Error("email is required");
+ *     }
+ *     return { email: body.email };
+ *   } });
+ * }
+ * ```
+ */
+declare function createRegistrationHook<T>(options: {
+    /**
+     * Verifies the caller before request JSON is parsed.
+     * @param c - Hono request context containing the headers/credentials to verify.
+     * @returns A rejection Response, or no value to continue registration.
+     * @throws Host verification failures propagate through request handling.
+     * @example
+     * ```typescript
+     * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';
+     * import type { Context } from 'hono';
+     * export async function verifyCaller(options: Parameters<typeof createRegistrationHook>[0], context: Context) {
+     *   return options.verify(context);
+     * }
+     * ```
+     */
+    verify(c: Context): Promise<Response | void>;
+    /**
+     * Synchronously validates parsed JSON and produces the registration input.
+     * @param body - Unknown JSON value from the request body.
+     * @returns Validated registration data passed unchanged to register.
+     * @throws Validation errors are converted to a 400 Invalid registration payload response.
+     * @example
+     * ```typescript
+     * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';
+     * export function parseRegistration(options: Parameters<typeof createRegistrationHook>[0], body: unknown) {
+     *   return options.parse(body);
+     * }
+     * ```
+     */
+    parse(body: unknown): T;
+    /**
+     * Performs host registration after caller verification and input parsing.
+     * @param input - Validated parser result, passed unchanged from parse.
+     * @param c - Same Hono request context used for caller verification.
+     * @returns The final host registration response.
+     * @throws Host persistence/registration failures propagate; earlier external effects may already have occurred.
+     * @example
+     * ```typescript
+     * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';
+     * import type { Context } from 'hono';
+     * export async function registerValidated(options: Parameters<typeof createRegistrationHook>[0], body: unknown, context: Context) {
+     *   const denied = await options.verify(context);
+     *   if (denied) return denied;
+     *   return options.register(options.parse(body), context);
+     * }
+     * ```
+     */
+    register(input: T, c: Context): Promise<Response>;
+}): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
+
+export { createRegistrationHook };

package/dist/auth-hooks/index.js

@@ -0,0 +1,28 @@
+import {
+  resolveApiKey
+} from "../chunk-ZC3XWU7B.js";
+
+// src/auth-hooks/index.ts
+import { Hono } from "hono";
+import { bodyLimit } from "hono/body-limit";
+function createRegistrationHook(options) {
+  const app = new Hono();
+  app.use("*", bodyLimit({ maxSize: 128 * 1024 }));
+  app.post("/registration", async (c) => {
+    const denied = await options.verify(c);
+    if (denied) return denied;
+    let input;
+    try {
+      input = options.parse(await c.req.json());
+    } catch {
+      return c.json({ error: "Invalid registration payload" }, 400);
+    }
+    return options.register(input, c);
+  });
+  return app;
+}
+export {
+  createRegistrationHook,
+  resolveApiKey
+};
+//# sourceMappingURL=index.js.map

package/dist/auth-hooks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/auth-hooks/index.ts"],"sourcesContent":["import { Hono, type Context } from 'hono'\nimport { bodyLimit } from 'hono/body-limit'\nexport * from './api-key'\n/**\n * Creates a body-limited registration endpoint that verifies the caller before parsing JSON.\n * @typeParam T - Validated registration input returned by parse and passed unchanged to register.\n * @param options - Host callbacks: verify receives the request context before parsing and must return a rejection Response or no value to continue; parse synchronously validates unknown JSON; register receives the parsed input and context and resolves the final response.\n * @returns A Hono router serving POST /registration with a 128 KiB body limit; JSON or parser failures return 400.\n * @throws Request handling propagates verify and register rejections; parse exceptions become 400 responses.\n * @remarks The host owns authentication, registration persistence, duplicate handling, and transactional behavior. Body size enforcement precedes verify.\n * @example\n * ```typescript\n * import type { Context } from \"hono\";\n * import { createRegistrationHook } from \"@alneas/eaos-server/auth-hooks\";\n * export function registrationRouter(\n *   verify: (context: Context) => Promise<Response | void>,\n *   register: (input: { email: string }, context: Context) => Promise<Response>,\n * ) {\n *   return createRegistrationHook({ verify, register, parse(body: unknown) {\n *     if (!body || typeof body !== \"object\" || !(\"email\" in body) || typeof body.email !== \"string\") {\n *       throw new Error(\"email is required\");\n *     }\n *     return { email: body.email };\n *   } });\n * }\n * ```\n */\nexport function createRegistrationHook<T>(options: {\n /**\n  * Verifies the caller before request JSON is parsed.\n  * @param c - Hono request context containing the headers/credentials to verify.\n  * @returns A rejection Response, or no value to continue registration.\n  * @throws Host verification failures propagate through request handling.\n  * @example\n  * ```typescript\n  * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';\n  * import type { Context } from 'hono';\n  * export async function verifyCaller(options: Parameters<typeof createRegistrationHook>[0], context: Context) {\n  *   return options.verify(context);\n  * }\n  * ```\n  */\n \n verify(c: Context): Promise<Response | void>\n /**\n  * Synchronously validates parsed JSON and produces the registration input.\n  * @param body - Unknown JSON value from the request body.\n  * @returns Validated registration data passed unchanged to register.\n  * @throws Validation errors are converted to a 400 Invalid registration payload response.\n  * @example\n  * ```typescript\n  * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';\n  * export function parseRegistration(options: Parameters<typeof createRegistrationHook>[0], body: unknown) {\n  *   return options.parse(body);\n  * }\n  * ```\n  */\n parse(body: unknown): T\n /**\n  * Performs host registration after caller verification and input parsing.\n  * @param input - Validated parser result, passed unchanged from parse.\n  * @param c - Same Hono request context used for caller verification.\n  * @returns The final host registration response.\n  * @throws Host persistence/registration failures propagate; earlier external effects may already have occurred.\n  * @example\n  * ```typescript\n  * import { createRegistrationHook } from '@alneas/eaos-server/auth-hooks';\n  * import type { Context } from 'hono';\n  * export async function registerValidated(options: Parameters<typeof createRegistrationHook>[0], body: unknown, context: Context) {\n  *   const denied = await options.verify(context);\n  *   if (denied) return denied;\n  *   return options.register(options.parse(body), context);\n  * }\n  * ```\n  */\n register(input: T, c: Context): Promise<Response>\n}) {\n const app = new Hono()\n app.use('*', bodyLimit({ maxSize: 128 * 1024 }))\n app.post('/registration', async c => {\n  const denied = await options.verify(c); if (denied) return denied\n  let input: T\n  try { input = options.parse(await c.req.json()) } catch { return c.json({ error: 'Invalid registration payload' }, 400) }\n  return options.register(input, c)\n })\n return app\n}\n"],"mappings":";;;;;AAAA,SAAS,YAA0B;AACnC,SAAS,iBAAiB;AA0BnB,SAAS,uBAA0B,SAiDvC;AACF,QAAM,MAAM,IAAI,KAAK;AACrB,MAAI,IAAI,KAAK,UAAU,EAAE,SAAS,MAAM,KAAK,CAAC,CAAC;AAC/C,MAAI,KAAK,iBAAiB,OAAM,MAAK;AACpC,UAAM,SAAS,MAAM,QAAQ,OAAO,CAAC;AAAG,QAAI,OAAQ,QAAO;AAC3D,QAAI;AACJ,QAAI;AAAE,cAAQ,QAAQ,MAAM,MAAM,EAAE,IAAI,KAAK,CAAC;AAAA,IAAE,QAAQ;AAAE,aAAO,EAAE,KAAK,EAAE,OAAO,+BAA+B,GAAG,GAAG;AAAA,IAAE;AACxH,WAAO,QAAQ,SAAS,OAAO,CAAC;AAAA,EACjC,CAAC;AACD,SAAO;AACR;","names":[]}

package/dist/browser-auth/account-memberships.d.ts

@@ -0,0 +1,213 @@
+import { AccountMemberships } from '@alneas/eaos-server/platform';
+
+/**
+ * Provider metadata field updated by a membership migration; public metadata is visible to its account holder.
+ * @see applyAccountMembershipChange.
+ */
+type AccountMetadataField = 'metadata_public' | 'metadata_admin';
+/**
+ * Provider identity snapshot used for optimistic checks and metadata-preserving writes.
+ * @see planAccountMembershipPublication.
+ */
+interface ManagedIdentity {
+    /** Provider identity ID. */
+    id: string;
+    /** Provider lifecycle state; membership operations require active. */
+    state: string;
+    /** Optional editable traits; never used as membership authority here. */
+    traits?: Record<string, unknown>;
+    /** Public provider metadata; published membership fields are user-visible. */
+    metadata_public?: Record<string, unknown>;
+    /** Private administrator metadata; legacy membership migration defaults to this field. */
+    metadata_admin?: Record<string, unknown>;
+}
+/**
+ * Reviewed membership replacement bound to a hash of the selected metadata snapshot.
+ * @see applyAccountMembershipChange.
+ */
+interface MembershipMigrationPlan {
+    /** Identity whose metadata is being changed. */
+    identityId: string;
+    /** metadataHash of the selected metadata field before the change. */
+    beforeMetadataHash: string;
+    /** Validated target membership claims; all membership fields are replaced. */
+    memberships: AccountMemberships;
+    /** Metadata destination; omitted preserves the metadata_admin migration contract. */
+    metadataField?: AccountMetadataField;
+}
+/**
+ * Hashes metadata after recursively sorting object keys while preserving array order.
+ * @param metadata - JSON-serializable metadata; null/undefined at the root are normalized to an empty object.
+ * @returns Lower-case SHA-256 hexadecimal digest of canonicalized JSON.
+ * @throws For cyclic, BigInt, or other values that JSON serialization cannot encode.
+ * @remarks This is an optimistic snapshot comparison, not a signature or authentication mechanism.
+ * @example
+ * ```typescript
+ * import { metadataHash } from "@alneas/eaos-server/browser-auth/account-memberships";
+ * console.log(metadataHash({ b: 2, a: 1 }) === metadataHash({ a: 1, b: 2 })); // true
+ * ```
+ */
+declare function metadataHash(metadata: unknown): string;
+/**
+ * Durable mutation lock and audit boundary for account metadata updates.
+ * @remarks A failed or uncertain update retains its lock. The host must reconcile it rather than auto-expire or blindly retry.
+ * @see applyAccountMembershipChange.
+ */
+interface AccountMutationStore {
+    /**
+     * Acquires an exclusive durable mutation lock before provider reads/writes.
+     * @param identityId - Provider identity being changed.
+     * @param token - Fresh mutation token generated for this attempt.
+     * @param actor - Nonblank authenticated operator identity.
+     * @returns No value; resolves only when the lock is held.
+     * @throws Rejects conflicting or unavailable persistence; provider work will not start.
+     
+     * @example
+     * ```typescript
+     * import type { AccountMutationStore } from "@alneas/eaos-server/browser-auth";
+     * export async function lockReviewedIdentity(
+     *   store: AccountMutationStore, identityId: string, freshMutationToken: string, authenticatedActor: string,
+     * ) {
+     *   await store.acquire(identityId, freshMutationToken, authenticatedActor);
+     *   // Keep the token until verified completion; uncertain writes require reconciliation.
+     * }
+     * ```
+     */
+    acquire(identityId: string, token: string, actor: string): Promise<void>;
+    /**
+     * Records verified completion and finalizes the durable lock/audit state.
+     * @param identityId - Changed provider identity.
+     * @param token - Token acquired for this attempt; enforce ownership in the host store.
+     * @param actor - Authenticated operator identity.
+     * @param beforeHash - Reviewed pre-change snapshot hash.
+     * @param afterHash - Hash read back and verified after the update.
+     * @returns No value; resolves when completion is durably recorded.
+     * @throws Persistence errors propagate after the provider may already have changed.
+     
+     * @example
+     * ```typescript
+     * import type { AccountMutationStore } from "@alneas/eaos-server/browser-auth";
+     * export async function finishVerifiedIdentityMutation(
+     *   store: AccountMutationStore, identityId: string, ownedToken: string, authenticatedActor: string,
+     *   reviewedBeforeHash: string, verifiedAfterHash: string,
+     * ) {
+     *   // Call only after reading back and verifying the actual provider metadata update.
+     *   await store.complete(identityId, ownedToken, authenticatedActor, reviewedBeforeHash, verifiedAfterHash);
+     * }
+     * ```
+     */
+    complete(identityId: string, token: string, actor: string, beforeHash: string, afterHash: string): Promise<void>;
+}
+/**
+ * Host-authorized provider administration used by account membership operations.
+ * @see publishAccountMemberships.
+ */
+interface AccountAdminPort {
+    /**
+     * Reads the authoritative current provider identity, including both metadata fields.
+     * @param identityId - Provider identity ID.
+     * @returns Current identity snapshot used for lifecycle and hash checks.
+     * @throws Provider errors propagate and retain any acquired durable lock.
+     
+     * @example
+     * ```typescript
+     * import type { AccountAdminPort } from "@alneas/eaos-server/browser-auth";
+     * export async function readAuthoritativeIdentity(admin: AccountAdminPort, identityId: string) {
+     *   // The host supplies an authorized provider-admin connection.
+     *   const identity = await admin.read(identityId);
+     *   return { id: identity.id, state: identity.state };
+     * }
+     * ```
+     */
+    read(identityId: string): Promise<ManagedIdentity>;
+    /**
+     * Writes selected metadata while preserving unrelated identity fields.
+     * @param identity - Authoritative identity snapshot; publication supplies both changed metadata fields and requires the port to PUT both in one provider request.
+     * @param metadata - Complete replacement value for the selected metadata field.
+     * @param field - Selected destination field.
+     * @returns No value; resolves when the provider acknowledges the write, before independent readback verification.
+     * @throws Provider failures propagate; the provider outcome may be uncertain and the durable lock must remain held.
+     
+     * @example
+     * ```typescript
+     * import type { AccountAdminPort } from "@alneas/eaos-server/browser-auth";
+     * export async function writeReviewedIdentityMetadata(
+     *   admin: AccountAdminPort,
+     *   currentIdentity: Parameters<AccountAdminPort["write"]>[0],
+     *   reviewedMetadata: Parameters<AccountAdminPort["write"]>[1],
+     *   reviewedField: Parameters<AccountAdminPort["write"]>[2],
+     * ) {
+     *   // Host workflow acquires the mutation lock and checks the reviewed snapshot first.
+     *   await admin.write(currentIdentity, reviewedMetadata, reviewedField);
+     *   // Read back through admin.read before recording durable mutation completion.
+     * }
+     * ```
+     */
+    write(identity: ManagedIdentity, metadata: Record<string, unknown>, field: AccountMetadataField): Promise<void>;
+}
+/**
+ * Replaces membership fields under a durable lock and verifies provider readback before recording completion.
+ * @param plan - Reviewed target claims, metadata field, and expected pre-change field hash.
+ * @param actor - Nonblank authenticated operator identity; authorization is host-owned.
+ * @param store - Durable exclusive lock and completion audit implementation.
+ * @param admin - Trusted provider read/write implementation.
+ * @returns No value; resolves after verified provider update and durable completion. Unrelated metadata keys are retained and absent defaultTenantId is written as null.
+ * @throws Rejects invalid actor/metadata field/claims, stale or inactive identity, failed readback, or propagated lock/provider/completion errors.
+ * @remarks A failed/uncertain mutation retains its durable lock. Reconcile; never auto-expire or blindly retry. This function does not roll back provider changes. Defaults to metadata_admin; explicitly selecting metadata_public exposes claims to the account holder.
+ * @example
+ * ```typescript
+ * import { applyAccountMembershipChange, type MembershipMigrationPlan, type AccountMutationStore, type AccountAdminPort } from "@alneas/eaos-server/browser-auth/account-memberships";
+ * export async function applyReviewedPlan(plan: MembershipMigrationPlan, actor: string, store: AccountMutationStore, admin: AccountAdminPort) {
+ *   await applyAccountMembershipChange(plan, actor, store, admin);
+ * }
+ * ```
+ */
+declare function applyAccountMembershipChange(plan: MembershipMigrationPlan, actor: string, store: AccountMutationStore, admin: AccountAdminPort): Promise<void>;
+/**
+ * Reviewed plan moving existing private membership fields into public metadata without changing claims.
+ * @see planAccountMembershipPublication.
+ */
+interface MembershipPublicationPlan {
+    /** Active identity whose memberships will become public. */
+    identityId: string;
+    /** Combined public/admin metadata snapshot hash used to detect stale plans. */
+    beforeMetadataHash: string;
+    /** Validated claims copied from private membership fields. */
+    memberships: AccountMemberships;
+}
+/**
+ * Plans moving existing administrator membership claims into public identity metadata.
+ * @param identity - Active authoritative identity snapshot containing private membership fields and no public membership fields.
+ * @returns A new publication plan binding parsed claims to the combined public/admin metadata hash; no writes occur.
+ * @throws For inactive identity, missing private memberships, existing public membership fields, invalid claims, or unhashable metadata.
+ * @remarks Review the returned plan before publication: membership fields become visible to the account holder.
+ * @example
+ * ```typescript
+ * import { planAccountMembershipPublication, type AccountAdminPort } from "@alneas/eaos-server/browser-auth/account-memberships";
+ * export async function reviewPlan(admin: AccountAdminPort, identityId: string) {
+ *   return planAccountMembershipPublication(await admin.read(identityId));
+ * }
+ * ```
+ */
+declare function planAccountMembershipPublication(identity: ManagedIdentity): MembershipPublicationPlan;
+/**
+ * Moves reviewed membership fields from administrator to public metadata in one provider write and verifies readback.
+ * @param plan - Reviewed publication plan; current private claims must still match exactly.
+ * @param actor - Nonblank authenticated operator identity.
+ * @param store - Durable exclusive mutation lock and completion audit.
+ * @param admin - Provider port that must write both metadata fields from the supplied identity in one request.
+ * @returns No value; resolves after verified readback and durable completion, retaining unrelated public/private metadata.
+ * @throws Rejects invalid actor/claims, stale snapshot, changed memberships, failed provider verification, or propagated store/provider failures.
+ * @remarks The durable lock remains on any failed or uncertain outcome; reconcile instead of blind retry. This function does not roll back or independently authenticate the operator. Atomicity of the two-field update depends on the host port honoring its single-request contract.
+ * @example
+ * ```typescript
+ * import { publishAccountMemberships, type MembershipPublicationPlan, type AccountMutationStore, type AccountAdminPort } from "@alneas/eaos-server/browser-auth/account-memberships";
+ * export async function publishReviewedPlan(plan: MembershipPublicationPlan, actor: string, store: AccountMutationStore, admin: AccountAdminPort) {
+ *   await publishAccountMemberships(plan, actor, store, admin);
+ * }
+ * ```
+ */
+declare function publishAccountMemberships(plan: MembershipPublicationPlan, actor: string, store: AccountMutationStore, admin: AccountAdminPort): Promise<void>;
+
+export { applyAccountMembershipChange, metadataHash, planAccountMembershipPublication, publishAccountMemberships };
+export type { AccountAdminPort, AccountMetadataField, AccountMutationStore, ManagedIdentity, MembershipMigrationPlan, MembershipPublicationPlan };

package/dist/browser-auth/account-memberships.js

@@ -0,0 +1,13 @@
+import {
+  applyAccountMembershipChange,
+  metadataHash,
+  planAccountMembershipPublication,
+  publishAccountMemberships
+} from "../chunk-XMWPYZWZ.js";
+export {
+  applyAccountMembershipChange,
+  metadataHash,
+  planAccountMembershipPublication,
+  publishAccountMemberships
+};
+//# sourceMappingURL=account-memberships.js.map

package/dist/browser-auth/account-memberships.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/browser-auth/index.d.ts

@@ -0,0 +1,8 @@
+import 'hono/types';
+import 'hono';
+export { createKratosSessionVerifier } from './kratos-session.js';
+export { B as BrowserSession, Membership, c as createBrowserSessionRouter, createPlatformSessionResolver } from './platform-session.js';
+export { publicAccountMemberships } from './public-memberships.js';
+export { AccountAdminPort, AccountMetadataField, AccountMutationStore, ManagedIdentity, MembershipMigrationPlan, MembershipPublicationPlan, applyAccountMembershipChange, metadataHash, planAccountMembershipPublication, publishAccountMemberships } from './account-memberships.js';
+import '@alneas/eaos-server/lifecycle-engine';
+import '@alneas/eaos-server/platform';

package/dist/browser-auth/index.js

@@ -0,0 +1,59 @@
+import {
+  applyAccountMembershipChange,
+  metadataHash,
+  planAccountMembershipPublication,
+  publishAccountMemberships
+} from "../chunk-XMWPYZWZ.js";
+import {
+  createKratosSessionVerifier
+} from "../chunk-F3O7CELI.js";
+import {
+  createPlatformSessionResolver
+} from "../chunk-XUP6CNOM.js";
+import {
+  publicAccountMemberships
+} from "../chunk-FRRRWAHO.js";
+
+// src/browser-auth/index.ts
+import { Hono } from "hono";
+function createBrowserSessionRouter(options) {
+  const router = new Hono();
+  router.use("*", async (c, next) => {
+    c.header("Cache-Control", "no-store");
+    c.header("Vary", "Cookie, Authorization, X-Tenant-Id");
+    await next();
+  });
+  router.get("/config", (c) => {
+    try {
+      const v = options.configuration();
+      if (!v.publicUrl || !v.provider || !Array.isArray(v.redirectOrigins)) throw new Error("Unconfigured");
+      return c.json({ publicUrl: v.publicUrl, provider: v.provider, ...v.returnTo ? { returnTo: v.returnTo } : {}, redirectOrigins: v.redirectOrigins });
+    } catch {
+      return c.json({ error: "Authentication is not configured" }, 503);
+    }
+  });
+  router.get("/session", async (c) => {
+    try {
+      const value = await options.resolveSession(c);
+      if (!value) return c.json({ error: "Authentication required" }, 401);
+      if (options.tenantId && value.tenantId !== options.tenantId) return c.json({ error: "Tenant unavailable" }, 403);
+      if (typeof value.userId !== "string" || !value.userId.trim() || typeof value.tenantId !== "string" || !value.tenantId.trim() || !Array.isArray(value.roles) || !Array.isArray(value.enabledModules) || [...value.roles, ...value.enabledModules].some((v) => typeof v !== "string" || !v.trim())) throw new Error("Invalid session");
+      return c.json(value);
+    } catch (error) {
+      const status = error?.status;
+      return c.json({ error: "Authenticated membership unavailable" }, status === 401 ? 401 : status === 403 ? 403 : 503);
+    }
+  });
+  return router;
+}
+export {
+  applyAccountMembershipChange,
+  createBrowserSessionRouter,
+  createKratosSessionVerifier,
+  createPlatformSessionResolver,
+  metadataHash,
+  planAccountMembershipPublication,
+  publicAccountMemberships,
+  publishAccountMemberships
+};
+//# sourceMappingURL=index.js.map

package/dist/browser-auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/browser-auth/index.ts"],"sourcesContent":["import { Hono, type Context } from 'hono'\nexport * from './kratos-session'\nexport * from './platform-session'\nexport * from './public-memberships'\n/**\n * Verified browser identity and membership serialized by {@link createBrowserSessionRouter}.\n */\nexport interface BrowserSession {\n /** Nonblank authenticated identity ID. */\n userId: string\n /** Nonblank selected authorized tenant ID. */\n tenantId: string\n /** Verified nonblank role names; empty arrays are accepted. */\n roles: string[]\n /** Verified nonblank module entitlement names; empty arrays are accepted. */\n enabledModules: string[]\n}\n/**\n * Exposes browser-safe provider configuration and verified session data with no-store response headers.\n * @typeParam T - Host session shape extending required identity/membership fields; additional fields are serialized in full.\n * @param options - configuration synchronously supplies publicUrl/provider/redirectOrigins and optional returnTo for GET /config; resolveSession receives Hono context for GET /session and resolves a verified session or null; optional tenantId restricts returned sessions to one tenant.\n * @returns A router with GET /config and /session. Configuration failure returns 503; absent session returns 401, tenant mismatch returns 403, and resolver failures map status 401/403 or otherwise 503.\n * @remarks The host owns IdP settings and membership lookup. No identity creation, default roles, or token minting occurs. Configuration output whitelists fields, but session output serializes all T fields: do not place secrets in a session. Responses set Cache-Control: no-store and Vary: Cookie, Authorization, X-Tenant-Id.\n * @example\n * ```typescript\n * import type { Context } from \"hono\";\n * import { createBrowserSessionRouter, type BrowserSession } from \"@alneas/eaos-server/browser-auth\";\n * export function authRouter(resolveSession: (context: Context) => Promise<BrowserSession | null>) {\n *   return createBrowserSessionRouter({\n *     configuration: () => ({ publicUrl: \"https://identity.example.com\", provider: \"kratos\", redirectOrigins: [\"https://app.example.com\"] }),\n *     resolveSession,\n *   });\n * }\n * ```\n */\nexport function createBrowserSessionRouter<T extends BrowserSession>(options: {\n  /**\n   * Synchronous public IdP configuration callback evaluated on each /config request; failures become 503 and only explicitly selected fields are serialized.\n   */\n  configuration: () => {\n  /**\n   * Nonempty public identity-provider URL returned to the browser; the router does not validate its URL syntax.\n   */\n  publicUrl: string;\n  /**\n   * Nonempty provider label returned to the browser.\n   */\n  provider: string;\n  /**\n   * Optional post-authentication return URL included only when truthy; host configuration must validate redirect policy.\n   */\n  returnTo?: string;\n  /**\n   * Host redirect-origin list serialized to the browser; the router checks only that it is an array.\n   */\n  redirectOrigins: string[] }\n  /**\n   * Per-request host verifier resolving a trusted session or null for 401; thrown statuses 401/403 are preserved and other failures become 503.\n   */\n  resolveSession: (context: Context) => Promise<T | null>\n  /**\n   * Optional dedicated-backend tenant restriction; a session selecting another tenant returns 403.\n   */\n  tenantId?: string\n}) {\n  const router = new Hono()\n  router.use('*', async (c, next) => { c.header('Cache-Control', 'no-store'); c.header('Vary', 'Cookie, Authorization, X-Tenant-Id'); await next() })\n  router.get('/config', c => {\n    try {\n      const v = options.configuration()\n      // Explicit fields only: secrets in host configuration cannot be serialized accidentally.\n      if (!v.publicUrl || !v.provider || !Array.isArray(v.redirectOrigins)) throw new Error('Unconfigured')\n      return c.json({ publicUrl: v.publicUrl, provider: v.provider, ...(v.returnTo ? { returnTo: v.returnTo } : {}), redirectOrigins: v.redirectOrigins })\n    } catch { return c.json({ error: 'Authentication is not configured' }, 503) }\n  })\n  router.get('/session', async c => {\n    try {\n      const value = await options.resolveSession(c)\n      if (!value) return c.json({ error: 'Authentication required' }, 401)\n      if (options.tenantId && value.tenantId !== options.tenantId) return c.json({ error: 'Tenant unavailable' }, 403)\n      if (typeof value.userId !== 'string' || !value.userId.trim() || typeof value.tenantId !== 'string' || !value.tenantId.trim() || !Array.isArray(value.roles) || !Array.isArray(value.enabledModules) || [...value.roles, ...value.enabledModules].some(v => typeof v !== 'string' || !v.trim())) throw new Error('Invalid session')\n      return c.json(value)\n    } catch (error) {\n      const status = (error as { status?: number })?.status\n      return c.json({ error: 'Authenticated membership unavailable' }, status === 401 ? 401 : status === 403 ? 403 : 503)\n    }\n  })\n  return router\n}\n\nexport { applyAccountMembershipChange, metadataHash, planAccountMembershipPublication, publishAccountMemberships, type ManagedIdentity, type AccountMetadataField, type MembershipMigrationPlan, type MembershipPublicationPlan, type AccountMutationStore, type AccountAdminPort } from './account-memberships'\n"],"mappings":";;;;;;;;;;;;;;;;;AAAA,SAAS,YAA0B;AAmC5B,SAAS,2BAAqD,SA6BlE;AACD,QAAM,SAAS,IAAI,KAAK;AACxB,SAAO,IAAI,KAAK,OAAO,GAAG,SAAS;AAAE,MAAE,OAAO,iBAAiB,UAAU;AAAG,MAAE,OAAO,QAAQ,oCAAoC;AAAG,UAAM,KAAK;AAAA,EAAE,CAAC;AAClJ,SAAO,IAAI,WAAW,OAAK;AACzB,QAAI;AACF,YAAM,IAAI,QAAQ,cAAc;AAEhC,UAAI,CAAC,EAAE,aAAa,CAAC,EAAE,YAAY,CAAC,MAAM,QAAQ,EAAE,eAAe,EAAG,OAAM,IAAI,MAAM,cAAc;AACpG,aAAO,EAAE,KAAK,EAAE,WAAW,EAAE,WAAW,UAAU,EAAE,UAAU,GAAI,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,IAAI,CAAC,GAAI,iBAAiB,EAAE,gBAAgB,CAAC;AAAA,IACrJ,QAAQ;AAAE,aAAO,EAAE,KAAK,EAAE,OAAO,mCAAmC,GAAG,GAAG;AAAA,IAAE;AAAA,EAC9E,CAAC;AACD,SAAO,IAAI,YAAY,OAAM,MAAK;AAChC,QAAI;AACF,YAAM,QAAQ,MAAM,QAAQ,eAAe,CAAC;AAC5C,UAAI,CAAC,MAAO,QAAO,EAAE,KAAK,EAAE,OAAO,0BAA0B,GAAG,GAAG;AACnE,UAAI,QAAQ,YAAY,MAAM,aAAa,QAAQ,SAAU,QAAO,EAAE,KAAK,EAAE,OAAO,qBAAqB,GAAG,GAAG;AAC/G,UAAI,OAAO,MAAM,WAAW,YAAY,CAAC,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,aAAa,YAAY,CAAC,MAAM,SAAS,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,KAAK,KAAK,CAAC,MAAM,QAAQ,MAAM,cAAc,KAAK,CAAC,GAAG,MAAM,OAAO,GAAG,MAAM,cAAc,EAAE,KAAK,OAAK,OAAO,MAAM,YAAY,CAAC,EAAE,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,iBAAiB;AACjU,aAAO,EAAE,KAAK,KAAK;AAAA,IACrB,SAAS,OAAO;AACd,YAAM,SAAU,OAA+B;AAC/C,aAAO,EAAE,KAAK,EAAE,OAAO,uCAAuC,GAAG,WAAW,MAAM,MAAM,WAAW,MAAM,MAAM,GAAG;AAAA,IACpH;AAAA,EACF,CAAC;AACD,SAAO;AACT;","names":[]}

package/dist/browser-auth/kratos-session.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Creates a public Kratos whoami verifier without using the Admin API or minting sessions.
+ * @param options - publicUrl is an HTTP(S) origin with root path and no embedded credentials/query/fragment; fetch defaults to global fetch and timeoutMs to 10000 milliseconds.
+ * @returns An async verifier accepting cookie/sessionToken credentials and resolving userId plus provider identity, or null for absent credentials, 401/403 responses, inactive sessions, or missing identity IDs. sessionToken takes precedence over cookie.
+ * @throws Synchronously for an invalid provider URL. Verification rejects transport, abort, invalid timeout, non-OK provider responses other than 401/403, and JSON parsing failures.
+ * @remarks Credentials are forwarded only to the configured origin with redirects disabled and no-store caching. The host must trust this origin and separately resolve memberships and tenant lifecycle. This verifier creates no listeners or background work.
+ * @example
+ * ```typescript
+ * import { createKratosSessionVerifier } from "@alneas/eaos-server/browser-auth/kratos-session";
+ * const verify = createKratosSessionVerifier({ publicUrl: "https://identity.example.com" });
+ * export async function authenticate(cookie: string | undefined) {
+ *   return verify({ cookie });
+ * }
+ * ```
+ */
+declare function createKratosSessionVerifier(options: {
+    /**
+   * Trusted HTTP(S) Kratos origin with a root path and no embedded credentials, query, or fragment.
+   */
+    publicUrl: string;
+    /**
+   * Host transport for public whoami calls; defaults to global fetch, with redirects disabled and no-store caching.
+   */
+    fetch?: typeof fetch;
+    /**
+   * AbortSignal timeout in milliseconds for each whoami request; defaults to 10000 and invalid values fail when invoked.
+   */
+    timeoutMs?: number;
+}): (credentials: {
+    cookie?: string;
+    sessionToken?: string;
+}) => Promise<{
+    userId: string;
+    identity: Record<string, unknown>;
+} | null>;
+
+export { createKratosSessionVerifier };

package/dist/browser-auth/kratos-session.js

@@ -0,0 +1,7 @@
+import {
+  createKratosSessionVerifier
+} from "../chunk-F3O7CELI.js";
+export {
+  createKratosSessionVerifier
+};
+//# sourceMappingURL=kratos-session.js.map

package/dist/browser-auth/kratos-session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/browser-auth/platform-session.d.ts

@@ -0,0 +1,120 @@
+import * as hono_types from 'hono/types';
+import { Context, Hono } from 'hono';
+import { createKratosSessionVerifier } from './kratos-session.js';
+import './public-memberships.js';
+import './account-memberships.js';
+import { LifecycleStore, BackendTarget } from '@alneas/eaos-server/lifecycle-engine';
+import '@alneas/eaos-server/platform';
+
+/**
+ * Verified tenant membership candidate supplied to {@link createPlatformSessionResolver}.
+ */
+interface Membership {
+    /** Tenant ID matching the selected header, if provided; validated as a 1–128-character scope identifier. */
+    tenantId: string;
+    /** Verified role names, each a nonempty string. */
+    roles: string[];
+    /** Verified entitlement names, each a nonempty string. */
+    enabledModules: string[];
+}
+/**
+ * Combines a verified Kratos identity, unambiguous membership, active tenant, and expected backend placement.
+ * @param options - verify checks credentials; memberships receives verified userId, optional selected tenant ID, and provider identity and resolves candidate memberships; store supplies lifecycle state; targetFor synchronously resolves the expected backend for a selected tenant.
+ * @returns A resolver accepting Hono context and optional refresh flag. It resolves a BrowserSession or null for invalid credentials/selection, ambiguous membership, or inactive tenant. Each context caches the in-flight/result Promise unless refresh is true.
+ * @throws The resolver rejects verifier, membership, store, and targetFor errors, malformed membership fields, or backend placement mismatch. Rejected Promises are cached until refresh.
+ * @remarks Authorization accepts only the exact Bearer syntax with one space and a nonwhitespace token. Bearer token takes precedence over X-Session-Token; the verifier gives session tokens precedence over cookies. X-Tenant-Id selects a candidate but never grants membership. No default tenant or role is invented. The WeakMap cache is per resolver/context; refresh starts another lookup without cancelling previous work.
+ * @example
+ * ```typescript
+ * import { createPlatformSessionResolver } from "@alneas/eaos-server/browser-auth/platform-session";
+ * export function hostSessionResolver(options: Parameters<typeof createPlatformSessionResolver>[0]) {
+ *   // Supply verified membership reads, lifecycle store, and backend routing.
+ *   return createPlatformSessionResolver(options);
+ * }
+ * ```
+ */
+declare function createPlatformSessionResolver(options: {
+    /**
+     * Server whoami verifier receiving cookie/session-token credentials; token transport takes precedence over cookies.
+     */
+    verify: ReturnType<typeof createKratosSessionVerifier>;
+    /**
+     * Host callback receiving verified user ID, optional requested tenant, and provider identity; must resolve exactly one authorized membership or resolution returns null.
+     */
+    memberships: (userId: string, tenantId: string | undefined, identity: Record<string, unknown>) => Promise<Membership[]>;
+    /**
+     * Authoritative lifecycle store used to require an active tenant and its expected backend placement.
+     */
+    store: LifecycleStore;
+    /**
+     * Synchronous host backend selector for the verified membership tenant; an ID differing from lifecycle placement rejects resolution.
+     */
+    targetFor: (tenantId: string) => BackendTarget;
+}): (context: Context, resolution?: {
+    refresh?: boolean;
+}) => Promise<BrowserSession | null>;
+
+/**
+ * Verified browser identity and membership serialized by {@link createBrowserSessionRouter}.
+ */
+interface BrowserSession {
+    /** Nonblank authenticated identity ID. */
+    userId: string;
+    /** Nonblank selected authorized tenant ID. */
+    tenantId: string;
+    /** Verified nonblank role names; empty arrays are accepted. */
+    roles: string[];
+    /** Verified nonblank module entitlement names; empty arrays are accepted. */
+    enabledModules: string[];
+}
+/**
+ * Exposes browser-safe provider configuration and verified session data with no-store response headers.
+ * @typeParam T - Host session shape extending required identity/membership fields; additional fields are serialized in full.
+ * @param options - configuration synchronously supplies publicUrl/provider/redirectOrigins and optional returnTo for GET /config; resolveSession receives Hono context for GET /session and resolves a verified session or null; optional tenantId restricts returned sessions to one tenant.
+ * @returns A router with GET /config and /session. Configuration failure returns 503; absent session returns 401, tenant mismatch returns 403, and resolver failures map status 401/403 or otherwise 503.
+ * @remarks The host owns IdP settings and membership lookup. No identity creation, default roles, or token minting occurs. Configuration output whitelists fields, but session output serializes all T fields: do not place secrets in a session. Responses set Cache-Control: no-store and Vary: Cookie, Authorization, X-Tenant-Id.
+ * @example
+ * ```typescript
+ * import type { Context } from "hono";
+ * import { createBrowserSessionRouter, type BrowserSession } from "@alneas/eaos-server/browser-auth";
+ * export function authRouter(resolveSession: (context: Context) => Promise<BrowserSession | null>) {
+ *   return createBrowserSessionRouter({
+ *     configuration: () => ({ publicUrl: "https://identity.example.com", provider: "kratos", redirectOrigins: ["https://app.example.com"] }),
+ *     resolveSession,
+ *   });
+ * }
+ * ```
+ */
+declare function createBrowserSessionRouter<T extends BrowserSession>(options: {
+    /**
+     * Synchronous public IdP configuration callback evaluated on each /config request; failures become 503 and only explicitly selected fields are serialized.
+     */
+    configuration: () => {
+        /**
+         * Nonempty public identity-provider URL returned to the browser; the router does not validate its URL syntax.
+         */
+        publicUrl: string;
+        /**
+         * Nonempty provider label returned to the browser.
+         */
+        provider: string;
+        /**
+         * Optional post-authentication return URL included only when truthy; host configuration must validate redirect policy.
+         */
+        returnTo?: string;
+        /**
+         * Host redirect-origin list serialized to the browser; the router checks only that it is an array.
+         */
+        redirectOrigins: string[];
+    };
+    /**
+     * Per-request host verifier resolving a trusted session or null for 401; thrown statuses 401/403 are preserved and other failures become 503.
+     */
+    resolveSession: (context: Context) => Promise<T | null>;
+    /**
+     * Optional dedicated-backend tenant restriction; a session selecting another tenant returns 403.
+     */
+    tenantId?: string;
+}): Hono<hono_types.BlankEnv, hono_types.BlankSchema, "/">;
+
+export { createBrowserSessionRouter as c, createPlatformSessionResolver };
+export type { BrowserSession as B, Membership };

package/dist/browser-auth/platform-session.js

@@ -0,0 +1,7 @@
+import {
+  createPlatformSessionResolver
+} from "../chunk-XUP6CNOM.js";
+export {
+  createPlatformSessionResolver
+};
+//# sourceMappingURL=platform-session.js.map

package/dist/browser-auth/platform-session.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/browser-auth/public-memberships.d.ts

@@ -0,0 +1,22 @@
+import { AccountMemberships } from '@alneas/eaos-server/platform';
+
+/**
+ * Parses account membership claims exclusively from an active identity's public metadata.
+ * @param identity - Identity returned by a server-verified Kratos session; state must equal active.
+ * @returns Parsed memberships and optional defaultTenantId; absent/null public metadata supplies an empty membership list.
+ * @throws For inactive identities, malformed public metadata, or invalid membership claims rejected by the platform parser.
+ * @remarks Never pass editable traits or unverified client JSON. There is no fallback to private metadata or SQL membership lookup, and parsing does not authenticate the identity.
+ * @example
+ * ```typescript
+ * import { publicAccountMemberships } from "@alneas/eaos-server/browser-auth/public-memberships";
+ * import { createKratosSessionVerifier } from "@alneas/eaos-server/browser-auth/kratos-session";
+ * const verify = createKratosSessionVerifier({ publicUrl: "https://identity.example.com" });
+ * export async function memberships(cookie: string | undefined) {
+ *   const session = await verify({ cookie });
+ *   return session ? publicAccountMemberships(session.identity) : null;
+ * }
+ * ```
+ */
+declare function publicAccountMemberships(identity: Record<string, unknown>): AccountMemberships;
+
+export { publicAccountMemberships };