@argos-js/auth 0.0.0-stage → 0.1.0

package/dist/oauth/providers/github.provider.js

@@ -0,0 +1,70 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GitHubProvider = void 0;
+const base_provider_js_1 = require("../base.provider.js");
+class GitHubProvider extends base_provider_js_1.BaseOAuthProvider {
+    emailsUrl;
+    constructor(options) {
+        super({
+            authorizationUrl: 'https://github.com/login/oauth/authorize',
+            tokenUrl: 'https://github.com/login/oauth/access_token',
+            userInfoUrl: 'https://api.github.com/user',
+            scopes: ['read:user', 'user:email'],
+            ...options,
+        });
+        this.emailsUrl = options.emailsUrl || 'https://api.github.com/user/emails';
+    }
+    async fetchUserInfo(accessToken) {
+        const userResponse = await fetch(this.options.userInfoUrl, {
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                accept: 'application/json',
+                'user-agent': 'Argos-JS-Auth',
+            },
+        });
+        if (!userResponse.ok) {
+            const errorText = await userResponse.text();
+            throw new Error(`Failed to fetch GitHub user info (${userResponse.status}): ${errorText}`);
+        }
+        const profile = (await userResponse.json());
+        // If public email is empty, fetch private verified email from /user/emails
+        if (!profile.email) {
+            try {
+                const emailsResponse = await fetch(this.emailsUrl, {
+                    headers: {
+                        authorization: `Bearer ${accessToken}`,
+                        accept: 'application/json',
+                        'user-agent': 'Argos-JS-Auth',
+                    },
+                });
+                if (emailsResponse.ok) {
+                    const emails = (await emailsResponse.json());
+                    if (Array.isArray(emails)) {
+                        const primary = emails.find((e) => e.primary && e.verified) || emails.find((e) => e.verified) || emails[0];
+                        if (primary) {
+                            profile.email = primary.email;
+                            profile.email_verified = primary.verified;
+                        }
+                    }
+                }
+            }
+            catch {
+                // non-blocking
+            }
+        }
+        return profile;
+    }
+    mapUser(rawProfile, _tokens) {
+        return {
+            id: String(rawProfile.id ?? rawProfile.node_id ?? ''),
+            username: rawProfile.login,
+            email: rawProfile.email,
+            emailVerified: Boolean(rawProfile.email_verified ?? (rawProfile.email ? true : false)),
+            name: rawProfile.name ?? rawProfile.login,
+            avatar: rawProfile.avatar_url ?? undefined,
+            raw: rawProfile,
+        };
+    }
+}
+exports.GitHubProvider = GitHubProvider;
+//# sourceMappingURL=github.provider.js.map

package/dist/oauth/providers/github.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"github.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/github.provider.ts"],"names":[],"mappings":";;;AAAA,0DAAwD;AAUxD,MAAa,cAAe,SAAQ,oCAAiB;IAC3C,SAAS,CAAS;IAE1B,YAAY,OAA8B;QACxC,KAAK,CAAC;YACJ,gBAAgB,EAAE,0CAA0C;YAC5D,QAAQ,EAAE,6CAA6C;YACvD,WAAW,EAAE,6BAA6B;YAC1C,MAAM,EAAE,CAAC,WAAW,EAAE,YAAY,CAAC;YACnC,GAAG,OAAO;SACX,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,oCAAoC,CAAC;IAC7E,CAAC;IAEe,KAAK,CAAC,aAAa,CAAC,WAAmB;QACrD,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,WAAY,EAAE;YAC1D,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;gBAC1B,YAAY,EAAE,eAAe;aAC9B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,qCAAqC,YAAY,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QAC7F,CAAC;QAED,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAA4B,CAAC;QAEvE,2EAA2E;QAC3E,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE;oBACjD,OAAO,EAAE;wBACP,aAAa,EAAE,UAAU,WAAW,EAAE;wBACtC,MAAM,EAAE,kBAAkB;wBAC1B,YAAY,EAAE,eAAe;qBAC9B;iBACF,CAAC,CAAC;gBACH,IAAI,cAAc,CAAC,EAAE,EAAE,CAAC;oBACtB,MAAM,MAAM,GAAG,CAAC,MAAM,cAAc,CAAC,IAAI,EAAE,CAAkE,CAAC;oBAC9G,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;wBAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,CAAC;wBAC3G,IAAI,OAAO,EAAE,CAAC;4BACZ,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;4BAC9B,OAAO,CAAC,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC;wBAC5C,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,eAAe;YACjB,CAAC;QACH,CAAC;QAED,OAAO,OAAO,CAAC;IACjB,CAAC;IAEM,OAAO,CAAC,UAAmC,EAAE,OAAoB;QACtE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,UAAU,CAAC,OAAO,IAAI,EAAE,CAAC;YACrD,QAAQ,EAAE,UAAU,CAAC,KAA2B;YAChD,KAAK,EAAE,UAAU,CAAC,KAA2B;YAC7C,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtF,IAAI,EAAG,UAAU,CAAC,IAAe,IAAK,UAAU,CAAC,KAAgB;YACjE,MAAM,EAAG,UAAU,CAAC,UAAqB,IAAI,SAAS;YACtD,GAAG,EAAE,UAAU;SAChB,CAAC;IACJ,CAAC;CACF;AArED,wCAqEC"}

package/dist/oauth/providers/google.provider.d.ts

@@ -0,0 +1,12 @@
+import { BaseOAuthProvider } from '../base.provider.js';
+import type { BaseOAuthProviderOptions, OAuthTokens, OAuthUser } from '../oauth.types.js';
+export interface GoogleProviderOptions extends Omit<BaseOAuthProviderOptions, 'authorizationUrl' | 'tokenUrl'> {
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+}
+export declare class GoogleProvider extends BaseOAuthProvider {
+    constructor(options: GoogleProviderOptions);
+    mapUser(rawProfile: Record<string, unknown>, _tokens: OAuthTokens): OAuthUser;
+}
+//# sourceMappingURL=google.provider.d.ts.map

package/dist/oauth/providers/google.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/google.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE1F,MAAM,WAAW,qBAAsB,SAAQ,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,GAAG,UAAU,CAAC;IAC5G,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,cAAe,SAAQ,iBAAiB;gBACvC,OAAO,EAAE,qBAAqB;IAUnC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS;CAUrF"}

package/dist/oauth/providers/google.provider.js

@@ -0,0 +1,27 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GoogleProvider = void 0;
+const base_provider_js_1 = require("../base.provider.js");
+class GoogleProvider extends base_provider_js_1.BaseOAuthProvider {
+    constructor(options) {
+        super({
+            authorizationUrl: 'https://accounts.google.com/o/oauth2/v2/auth',
+            tokenUrl: 'https://oauth2.googleapis.com/token',
+            userInfoUrl: 'https://openidconnect.googleapis.com/v1/userinfo',
+            scopes: ['openid', 'email', 'profile'],
+            ...options,
+        });
+    }
+    mapUser(rawProfile, _tokens) {
+        return {
+            id: String(rawProfile.sub ?? rawProfile.id ?? ''),
+            email: rawProfile.email,
+            emailVerified: Boolean(rawProfile.email_verified),
+            name: rawProfile.name,
+            avatar: rawProfile.picture ?? undefined,
+            raw: rawProfile,
+        };
+    }
+}
+exports.GoogleProvider = GoogleProvider;
+//# sourceMappingURL=google.provider.js.map

package/dist/oauth/providers/google.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/google.provider.ts"],"names":[],"mappings":";;;AAAA,0DAAwD;AASxD,MAAa,cAAe,SAAQ,oCAAiB;IACnD,YAAY,OAA8B;QACxC,KAAK,CAAC;YACJ,gBAAgB,EAAE,8CAA8C;YAChE,QAAQ,EAAE,qCAAqC;YAC/C,WAAW,EAAE,kDAAkD;YAC/D,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,SAAS,CAAC;YACtC,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAEM,OAAO,CAAC,UAAmC,EAAE,OAAoB;QACtE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YACjD,KAAK,EAAE,UAAU,CAAC,KAA2B;YAC7C,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC;YACjD,IAAI,EAAE,UAAU,CAAC,IAA0B;YAC3C,MAAM,EAAG,UAAU,CAAC,OAAkB,IAAI,SAAS;YACnD,GAAG,EAAE,UAAU;SAChB,CAAC;IACJ,CAAC;CACF;AArBD,wCAqBC"}

package/dist/oauth/providers/index.d.ts

@@ -0,0 +1,5 @@
+export * from './google.provider.js';
+export * from './github.provider.js';
+export * from './microsoft.provider.js';
+export * from './generic-oidc.provider.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth/providers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,4BAA4B,CAAC"}

package/dist/oauth/providers/index.js

@@ -0,0 +1,21 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./google.provider.js"), exports);
+__exportStar(require("./github.provider.js"), exports);
+__exportStar(require("./microsoft.provider.js"), exports);
+__exportStar(require("./generic-oidc.provider.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/oauth/providers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/oauth/providers/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,uDAAqC;AACrC,uDAAqC;AACrC,0DAAwC;AACxC,6DAA2C"}

package/dist/oauth/providers/microsoft.provider.d.ts

@@ -0,0 +1,13 @@
+import { BaseOAuthProvider } from '../base.provider.js';
+import type { BaseOAuthProviderOptions, OAuthTokens, OAuthUser } from '../oauth.types.js';
+export interface MicrosoftProviderOptions extends Omit<BaseOAuthProviderOptions, 'authorizationUrl' | 'tokenUrl'> {
+    tenant?: string;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+}
+export declare class MicrosoftProvider extends BaseOAuthProvider {
+    constructor(options: MicrosoftProviderOptions);
+    mapUser(rawProfile: Record<string, unknown>, _tokens: OAuthTokens): OAuthUser;
+}
+//# sourceMappingURL=microsoft.provider.d.ts.map

package/dist/oauth/providers/microsoft.provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.provider.d.ts","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft.provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAE1F,MAAM,WAAW,wBAAyB,SAAQ,IAAI,CAAC,wBAAwB,EAAE,kBAAkB,GAAG,UAAU,CAAC;IAC/G,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,qBAAa,iBAAkB,SAAQ,iBAAiB;gBAC1C,OAAO,EAAE,wBAAwB;IAWtC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,WAAW,GAAG,SAAS;CAUrF"}

package/dist/oauth/providers/microsoft.provider.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MicrosoftProvider = void 0;
+const base_provider_js_1 = require("../base.provider.js");
+class MicrosoftProvider extends base_provider_js_1.BaseOAuthProvider {
+    constructor(options) {
+        const tenant = options.tenant || 'common';
+        super({
+            authorizationUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/authorize`,
+            tokenUrl: `https://login.microsoftonline.com/${tenant}/oauth2/v2.0/token`,
+            userInfoUrl: 'https://graph.microsoft.com/oidc/userinfo',
+            scopes: ['openid', 'profile', 'email'],
+            ...options,
+        });
+    }
+    mapUser(rawProfile, _tokens) {
+        return {
+            id: String(rawProfile.sub ?? rawProfile.id ?? ''),
+            email: rawProfile.email ?? rawProfile.preferred_username,
+            emailVerified: true,
+            name: rawProfile.name ?? undefined,
+            avatar: rawProfile.picture ?? undefined,
+            raw: rawProfile,
+        };
+    }
+}
+exports.MicrosoftProvider = MicrosoftProvider;
+//# sourceMappingURL=microsoft.provider.js.map

package/dist/oauth/providers/microsoft.provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"microsoft.provider.js","sourceRoot":"","sources":["../../../src/oauth/providers/microsoft.provider.ts"],"names":[],"mappings":";;;AAAA,0DAAwD;AAUxD,MAAa,iBAAkB,SAAQ,oCAAiB;IACtD,YAAY,OAAiC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;QAC1C,KAAK,CAAC;YACJ,gBAAgB,EAAE,qCAAqC,MAAM,wBAAwB;YACrF,QAAQ,EAAE,qCAAqC,MAAM,oBAAoB;YACzE,WAAW,EAAE,2CAA2C;YACxD,MAAM,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC;YACtC,GAAG,OAAO;SACX,CAAC,CAAC;IACL,CAAC;IAEM,OAAO,CAAC,UAAmC,EAAE,OAAoB;QACtE,OAAO;YACL,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,GAAG,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;YACjD,KAAK,EAAG,UAAU,CAAC,KAAgB,IAAK,UAAU,CAAC,kBAA6B;YAChF,aAAa,EAAE,IAAI;YACnB,IAAI,EAAG,UAAU,CAAC,IAAe,IAAI,SAAS;YAC9C,MAAM,EAAG,UAAU,CAAC,OAAkB,IAAI,SAAS;YACnD,GAAG,EAAE,UAAU;SAChB,CAAC;IACJ,CAAC;CACF;AAtBD,8CAsBC"}

package/dist/oauth2/client.d.ts

@@ -0,0 +1,63 @@
+import type { OAuthTokens } from '../oauth/oauth.types.js';
+export interface OAuth2ClientOptions {
+    clientId: string;
+    clientSecret?: string;
+    authorizationUrl?: string;
+    tokenUrl?: string;
+    userInfoUrl?: string;
+    redirectUri?: string;
+    scopes?: string[];
+}
+export interface GenerateAuthorizationUrlOptions {
+    state?: string;
+    scope?: string | string[];
+    clientId?: string;
+    redirectUri?: string;
+    codeVerifier?: string;
+    prompt?: string;
+    accessType?: string;
+    extraParams?: Record<string, string>;
+}
+export interface ExchangeCodeOptions {
+    code: string;
+    redirectUri?: string;
+    clientId?: string;
+    clientSecret?: string;
+    tokenUrl?: string;
+    codeVerifier?: string;
+}
+export declare class OAuth2Client {
+    private options;
+    constructor(options: OAuth2ClientOptions);
+    /**
+     * Generates authorization URL with state, scope, client_id, and PKCE code_challenge support.
+     */
+    generateAuthorizationUrl(options?: GenerateAuthorizationUrlOptions): {
+        url: string;
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+    };
+    /**
+     * Alias for generateAuthorizationUrl conforming to common naming conventions.
+     */
+    authorizationUrl(options?: GenerateAuthorizationUrlOptions): {
+        url: string;
+        state: string;
+        codeVerifier: string;
+        codeChallenge: string;
+    };
+    /**
+     * Exchanges an authorization code for access & refresh tokens.
+     */
+    exchangeCodeForToken(options: ExchangeCodeOptions): Promise<OAuthTokens>;
+    /**
+     * Fetches user info profile from userInfoUrl using bearer accessToken.
+     */
+    fetchUserInfo(accessToken: string, userInfoUrl?: string): Promise<Record<string, unknown>>;
+}
+/**
+ * Creates an OAuth2 client instance.
+ */
+export declare function createOAuth2Client(options: OAuth2ClientOptions): OAuth2Client;
+//# sourceMappingURL=client.d.ts.map

package/dist/oauth2/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/oauth2/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,+BAA+B;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,OAAO,CAAsB;gBAEzB,OAAO,EAAE,mBAAmB;IAIxC;;OAEG;IACI,wBAAwB,CAAC,OAAO,GAAE,+BAAoC,GAAG;QAC9E,GAAG,EAAE,MAAM,CAAC;QACZ,KAAK,EAAE,MAAM,CAAC;QACd,YAAY,EAAE,MAAM,CAAC;QACrB,aAAa,EAAE,MAAM,CAAC;KACvB;IA0DD;;OAEG;IACI,gBAAgB,CAAC,OAAO,GAAE,+BAAoC;aAjE9D,MAAM;eACJ,MAAM;sBACC,MAAM;uBACL,MAAM;;IAkEvB;;OAEG;IACU,oBAAoB,CAAC,OAAO,EAAE,mBAAmB,GAAG,OAAO,CAAC,WAAW,CAAC;IAwDrF;;OAEG;IACU,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAoBxG;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,YAAY,CAE7E"}

package/dist/oauth2/client.js

@@ -0,0 +1,150 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OAuth2Client = void 0;
+exports.createOAuth2Client = createOAuth2Client;
+const pkce_js_1 = require("../oauth/pkce.js");
+class OAuth2Client {
+    options;
+    constructor(options) {
+        this.options = { ...options };
+    }
+    /**
+     * Generates authorization URL with state, scope, client_id, and PKCE code_challenge support.
+     */
+    generateAuthorizationUrl(options = {}) {
+        const authUrl = this.options.authorizationUrl;
+        if (!authUrl) {
+            throw new Error('authorizationUrl is required to generate authorization URL');
+        }
+        const clientId = options.clientId || this.options.clientId;
+        if (!clientId) {
+            throw new Error('clientId is required to generate authorization URL');
+        }
+        const redirectUri = options.redirectUri || this.options.redirectUri;
+        const pkce = options.codeVerifier
+            ? {
+                codeVerifier: options.codeVerifier,
+                codeChallenge: options.codeVerifier,
+                codeChallengeMethod: 'S256',
+            }
+            : (0, pkce_js_1.generatePkcePair)();
+        const state = options.state || (0, pkce_js_1.generateState)();
+        const scopes = options.scope
+            ? (Array.isArray(options.scope) ? options.scope.join(' ') : options.scope)
+            : (this.options.scopes ? this.options.scopes.join(' ') : '');
+        const url = new URL(authUrl);
+        url.searchParams.set('response_type', 'code');
+        url.searchParams.set('client_id', clientId);
+        if (redirectUri) {
+            url.searchParams.set('redirect_uri', redirectUri);
+        }
+        if (scopes) {
+            url.searchParams.set('scope', scopes);
+        }
+        url.searchParams.set('state', state);
+        url.searchParams.set('code_challenge', pkce.codeChallenge);
+        url.searchParams.set('code_challenge_method', pkce.codeChallengeMethod);
+        if (options.prompt) {
+            url.searchParams.set('prompt', options.prompt);
+        }
+        if (options.accessType) {
+            url.searchParams.set('access_type', options.accessType);
+        }
+        if (options.extraParams) {
+            for (const [k, v] of Object.entries(options.extraParams)) {
+                url.searchParams.set(k, v);
+            }
+        }
+        return {
+            url: url.toString(),
+            state,
+            codeVerifier: pkce.codeVerifier,
+            codeChallenge: pkce.codeChallenge,
+        };
+    }
+    /**
+     * Alias for generateAuthorizationUrl conforming to common naming conventions.
+     */
+    authorizationUrl(options = {}) {
+        return this.generateAuthorizationUrl(options);
+    }
+    /**
+     * Exchanges an authorization code for access & refresh tokens.
+     */
+    async exchangeCodeForToken(options) {
+        const tokenUrl = options.tokenUrl || this.options.tokenUrl;
+        if (!tokenUrl) {
+            throw new Error('tokenUrl is required to exchange code for token');
+        }
+        const clientId = options.clientId || this.options.clientId;
+        const clientSecret = options.clientSecret || this.options.clientSecret;
+        const redirectUri = options.redirectUri || this.options.redirectUri;
+        const bodyParams = new URLSearchParams({
+            grant_type: 'authorization_code',
+            code: options.code,
+            client_id: clientId,
+        });
+        if (redirectUri) {
+            bodyParams.set('redirect_uri', redirectUri);
+        }
+        if (clientSecret) {
+            bodyParams.set('client_secret', clientSecret);
+        }
+        if (options.codeVerifier) {
+            bodyParams.set('code_verifier', options.codeVerifier);
+        }
+        const response = await fetch(tokenUrl, {
+            method: 'POST',
+            headers: {
+                'content-type': 'application/x-www-form-urlencoded',
+                accept: 'application/json',
+            },
+            body: bodyParams.toString(),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`OAuth token exchange failed (${response.status}): ${errorText}`);
+        }
+        const data = (await response.json());
+        const expiresIn = typeof data.expires_in === 'number' ? data.expires_in : undefined;
+        const expiresAt = expiresIn ? new Date(Date.now() + expiresIn * 1000) : undefined;
+        return {
+            accessToken: data.access_token,
+            refreshToken: data.refresh_token,
+            idToken: data.id_token,
+            tokenType: data.token_type || 'Bearer',
+            expiresIn,
+            expiresAt,
+            scope: data.scope,
+            raw: data,
+        };
+    }
+    /**
+     * Fetches user info profile from userInfoUrl using bearer accessToken.
+     */
+    async fetchUserInfo(accessToken, userInfoUrl) {
+        const url = userInfoUrl || this.options.userInfoUrl;
+        if (!url) {
+            throw new Error('userInfoUrl is required to fetch user info');
+        }
+        const response = await fetch(url, {
+            headers: {
+                authorization: `Bearer ${accessToken}`,
+                accept: 'application/json',
+            },
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`OAuth fetchUserInfo failed (${response.status}): ${errorText}`);
+        }
+        return (await response.json());
+    }
+}
+exports.OAuth2Client = OAuth2Client;
+/**
+ * Creates an OAuth2 client instance.
+ */
+function createOAuth2Client(options) {
+    return new OAuth2Client(options);
+}
+//# sourceMappingURL=client.js.map

package/dist/oauth2/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/oauth2/client.ts"],"names":[],"mappings":";;;AAwMA,gDAEC;AA1MD,8CAAmE;AAiCnE,MAAa,YAAY;IACf,OAAO,CAAsB;IAErC,YAAY,OAA4B;QACtC,IAAI,CAAC,OAAO,GAAG,EAAE,GAAG,OAAO,EAAE,CAAC;IAChC,CAAC;IAED;;OAEG;IACI,wBAAwB,CAAC,UAA2C,EAAE;QAM3E,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACpE,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY;YAC/B,CAAC,CAAC;gBACE,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,aAAa,EAAE,OAAO,CAAC,YAAY;gBACnC,mBAAmB,EAAE,MAAe;aACrC;YACH,CAAC,CAAC,IAAA,0BAAgB,GAAE,CAAC;QAEvB,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,IAAA,uBAAa,GAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK;YAC1B,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;YAC1E,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QAC7B,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;QAC9C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,WAAW,EAAE,CAAC;YAChB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QACpD,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACxC,CAAC;QACD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;QAC3D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAExE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACnB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;QACD,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;gBACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAC7B,CAAC;QACH,CAAC;QAED,OAAO;YACL,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE;YACnB,KAAK;YACL,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,gBAAgB,CAAC,UAA2C,EAAE;QACnE,OAAO,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;IAChD,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,oBAAoB,CAAC,OAA4B;QAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC;QAC3D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;QACvE,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QAEpE,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;YACrC,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,SAAS,EAAE,QAAQ;SACpB,CAAC,CAAC;QAEH,IAAI,WAAW,EAAE,CAAC;YAChB,UAAU,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,YAAY,EAAE,CAAC;YACjB,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;YACzB,UAAU,CAAC,GAAG,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QACxD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;YACrC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,mCAAmC;gBACnD,MAAM,EAAE,kBAAkB;aAC3B;YACD,IAAI,EAAE,UAAU,CAAC,QAAQ,EAAE;SAC5B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,gCAAgC,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QACpF,CAAC;QAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAwB,CAAC;QAC5D,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;QACpF,MAAM,SAAS,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAElF,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;YACtB,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;YACtC,SAAS;YACT,SAAS;YACT,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,GAAG,EAAE,IAAI;SACV,CAAC;IACJ,CAAC;IAED;;OAEG;IACI,KAAK,CAAC,aAAa,CAAC,WAAmB,EAAE,WAAoB;QAClE,MAAM,GAAG,GAAG,WAAW,IAAI,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACpD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,QAAQ,CAAC,MAAM,MAAM,SAAS,EAAE,CAAC,CAAC;QACnF,CAAC;QAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC5D,CAAC;CACF;AAlKD,oCAkKC;AAED;;GAEG;AACH,SAAgB,kBAAkB,CAAC,OAA4B;IAC7D,OAAO,IAAI,YAAY,CAAC,OAAO,CAAC,CAAC;AACnC,CAAC"}

package/dist/oauth2/index.d.ts

@@ -0,0 +1,2 @@
+export * from './client.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/oauth2/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/oauth2/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC"}

package/dist/oauth2/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./client.js"), exports);
+//# sourceMappingURL=index.js.map

package/dist/oauth2/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/oauth2/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA4B"}

package/dist/tokens/api-key.d.ts

@@ -0,0 +1,26 @@
+export interface CreateApiKeyOptions {
+    prefix?: string;
+    bytes?: number;
+    name?: string;
+}
+export interface GeneratedApiKey {
+    key: string;
+    hash: string;
+    preview: string;
+    name?: string;
+}
+/**
+ * Creates a cryptographically secure API key formatted in the style of Stripe / Laravel Sanctum.
+ * The plaintext key must be presented to the user immediately; only the SHA-256 hash is saved in storage.
+ */
+export declare function createApiKey(options?: CreateApiKeyOptions): GeneratedApiKey;
+/**
+ * Computes the SHA-256 hex digest of an API key for indexed database storage.
+ */
+export declare function hashApiKey(key: string): string;
+/**
+ * Constant-time comparison verifying a provided API key against a stored SHA-256 hash.
+ * Protects against side-channel timing attacks.
+ */
+export declare function verifyApiKey(providedKey: string, storedHash: string): boolean;
+//# sourceMappingURL=api-key.d.ts.map

package/dist/tokens/api-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.d.ts","sourceRoot":"","sources":["../../src/tokens/api-key.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,eAAe,CAiB/E;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAc7E"}

package/dist/tokens/api-key.js

@@ -0,0 +1,84 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createApiKey = createApiKey;
+exports.hashApiKey = hashApiKey;
+exports.verifyApiKey = verifyApiKey;
+const crypto = __importStar(require("node:crypto"));
+/**
+ * Creates a cryptographically secure API key formatted in the style of Stripe / Laravel Sanctum.
+ * The plaintext key must be presented to the user immediately; only the SHA-256 hash is saved in storage.
+ */
+function createApiKey(options = {}) {
+    const prefix = options.prefix ?? 'argos_live_';
+    const bytes = options.bytes ?? 32;
+    const randomPart = crypto.randomBytes(bytes).toString('base64url');
+    const key = `${prefix}${randomPart}`;
+    const hash = hashApiKey(key);
+    const suffix = randomPart.length > 4 ? randomPart.slice(-4) : randomPart;
+    const preview = `${prefix}...${suffix}`;
+    return {
+        key,
+        hash,
+        preview,
+        ...(options.name ? { name: options.name } : {}),
+    };
+}
+/**
+ * Computes the SHA-256 hex digest of an API key for indexed database storage.
+ */
+function hashApiKey(key) {
+    if (!key || typeof key !== 'string') {
+        throw new Error('API key must be a valid non-empty string');
+    }
+    return crypto.createHash('sha256').update(key.trim(), 'utf-8').digest('hex');
+}
+/**
+ * Constant-time comparison verifying a provided API key against a stored SHA-256 hash.
+ * Protects against side-channel timing attacks.
+ */
+function verifyApiKey(providedKey, storedHash) {
+    if (!providedKey || !storedHash || typeof providedKey !== 'string' || typeof storedHash !== 'string') {
+        return false;
+    }
+    const computedHash = hashApiKey(providedKey);
+    const computedBuffer = Buffer.from(computedHash, 'utf-8');
+    const storedBuffer = Buffer.from(storedHash.trim(), 'utf-8');
+    if (computedBuffer.length !== storedBuffer.length) {
+        return false;
+    }
+    return crypto.timingSafeEqual(computedBuffer, storedBuffer);
+}
+//# sourceMappingURL=api-key.js.map

package/dist/tokens/api-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key.js","sourceRoot":"","sources":["../../src/tokens/api-key.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmBA,oCAiBC;AAKD,gCAKC;AAMD,oCAcC;AAlED,oDAAsC;AAetC;;;GAGG;AACH,SAAgB,YAAY,CAAC,UAA+B,EAAE;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAElC,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnE,MAAM,GAAG,GAAG,GAAG,MAAM,GAAG,UAAU,EAAE,CAAC;IACrC,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE7B,MAAM,MAAM,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;IACzE,MAAM,OAAO,GAAG,GAAG,MAAM,MAAM,MAAM,EAAE,CAAC;IAExC,OAAO;QACL,GAAG;QACH,IAAI;QACJ,OAAO;QACP,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,UAAU,CAAC,GAAW;IACpC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/E,CAAC;AAED;;;GAGG;AACH,SAAgB,YAAY,CAAC,WAAmB,EAAE,UAAkB;IAClE,IAAI,CAAC,WAAW,IAAI,CAAC,UAAU,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,OAAO,UAAU,KAAK,QAAQ,EAAE,CAAC;QACrG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,YAAY,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7C,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,MAAM,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,EAAE,OAAO,CAAC,CAAC;IAE7D,IAAI,cAAc,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAClD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,OAAO,MAAM,CAAC,eAAe,CAAC,cAAc,EAAE,YAAY,CAAC,CAAC;AAC9D,CAAC"}

package/dist/tokens/index.d.ts

@@ -0,0 +1,3 @@
+export * from './jwt';
+export * from './api-key';
+//# sourceMappingURL=index.d.ts.map

package/dist/tokens/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":"AAAA,cAAc,OAAO,CAAC;AACtB,cAAc,WAAW,CAAC"}

package/dist/tokens/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./jwt"), exports);
+__exportStar(require("./api-key"), exports);
+//# sourceMappingURL=index.js.map

package/dist/tokens/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/tokens/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,wCAAsB;AACtB,4CAA0B"}