@atlasauth/backend 0.15.0 → 0.17.0

package/CHANGELOG.md

@@ -1,5 +1,32 @@
 # @atlasauth/backend changelog
 
+## 0.17.0 — 2026-10-24
+
+### Added
+
+- Better Auth session bridge: `exchangeBetterAuthSession()` exchanges a Better Auth session for an Atlas session server to server with your secret key (forwarding the user's IP and user agent), plus `migrations.betterAuthBridge` to read and change the bridge settings.
+- `legacyIssuers` on `AtlasBackend`: accept Better Auth-issued JWTs for a bounded window during a migration, mapping `sub` to the Atlas user through `external_id`.
+- `betterAuthImports`: migrate from Better Auth with a sealed bundle (`getPublicKey`, `rotatePublicKey`, `create`, `uploadPart`, `finalize`, `upload` for all three, `dryRun`, `apply` to import or resume, `get`, `list`, `waitFor`, `delete`, `listJwks`, `deleteJwk`), with `BetterAuthImport`, `BetterAuthImportOptions`, the report types and `splitBundleParts`.
+
+## 0.16.0 — 2026-10-24
+
+### Added
+
+- `actionGallery` (`list`, `get`, `install`, `installs`, `update`) and `actionTemplates` (`list`, `create`, `get`, `update`, `delete`, `addVersion`, `submitVersion`, `deleteVersion`, `publish`, `unlist`) for the Actions gallery.
+- `ActionTestResult.http_requests` (what `api.http` queued in a dry run) and `organizations` / `country` on the sample event.
+- DPoP server nonces (RFC 9449 §8) in `createAccessTokenVerifier`: `dpopNonces` requires every DPoP proof to carry a nonce the API issued, answering `use_dpop_nonce` with a fresh nonce otherwise; every result carries `dpopNonce` for the `DPoP-Nonce` response header. `memoryDpopNonceSource()` (one process) and `hmacDpopNonceSource(secret)` (stateless, shared by every process — and every Atlas server SDK — holding the same secret).
+- Opaque access tokens: `createAccessTokenVerifier({ introspection: { clientId, clientSecret } })` validates a token that is not a JWT at the instance's introspection endpoint (RFC 7662), caching each answer (60 seconds by default, never past `exp`; inactive answers 10 seconds). `introspectJwts: true` checks JWTs live too, so a revoked grant is refused before the token expires. DPoP-bound opaque tokens keep their sender constraint (`cnf.jkt` from introspection). `createIntrospector` is the cache on its own.
+- OAuth clients: `access_token_format` (`jwt` | `opaque`) and `token_lifetimes` (`OAuthTokenLifetimes`) on create, update and reads. Resource servers: `access_token_format`, `refresh_token_absolute_ttl_seconds`, `refresh_token_idle_ttl_seconds`, `introspection_client_ids`.
+- `RotateSigningKeyBody.key` (`main` | `secondary`) and `SigningKeyRotation.secondary_kid` for KMS setups with one key per algorithm (`config.secondary`).
+- KMS-backed signing keys: `instanceSecurity.getSigningKeyProvider()` / `setSigningKeyProvider({ provider, config, credentials })` / `removeSigningKeyProvider()` for AWS KMS, Google Cloud KMS and Azure Key Vault; `SigningKey.provider`.
+- SSO connections: SAML Single Logout fields (`saml_single_logout`, `saml_idp_slo_url`, `saml_idp_slo_response_url`, `saml_idp_slo_binding`, `saml_idp_slo_soap_url` for back-channel logout) and `saml_require_encrypted_assertions`. Reads add `has_saml_encryption_key`, `has_previous_saml_encryption_key`, `saml_encryption_rotated_at`; `SamlMetadata.slo_url`. New `getSamlEncryptionKey()`, `createSamlEncryptionKey()` (generate or rotate), `retirePreviousSamlEncryptionKey()` and `deleteSamlEncryptionKey()` (`SamlEncryptionKey`).
+- Custom OAuth 2.0 / OpenID Connect login providers: `customOAuthProviders` (`list`, `get`, `create`, `update`, `delete`, `discover`, `previewProfileMapping`, and `signingKeys(id)` with `list` / `rotate` / `retire` for `private_key_jwt`), with `ProfileMapping`, `TokenEndpointAuthMethod`, upstream (RP-initiated and front-channel) logout and third-party initiated login settings. Enterprise OIDC connections take the same `profile_mapping`, `token_endpoint_auth_method`, `client_assertion_audience`, `logout` and `idp_initiated_login`, and report `upstream_urls`.
+- Attack protection: `dormant_accounts` (`DormantAccountsSettings`), readable and writable; `country_restrictions` / `device_accounts` typed. Risk-based MFA weights and signals gain `dormantAccount`. Email template key `account_reactivated`.
+- Sessions: `custom_data` on reads and on create; `sessions.setCustomData(id, data)` (replace, `null` clears) and `sessions.updateCustomData(id, patch)` (merge).
+- Billing: add-on plans (`kind: 'base' | 'addon'`) and several subscriptions per subject (`billing.getSubscription(id)`, and `changeSubscription` / `cancelSubscription` / `restoreSubscription` by subscription id); providers `chargebee`, `autumn` and `commet` (`BillingProviderName`); plan `limits` and Autumn `seat_feature_id`; `syncPlanEntitlements(id)`; `getSettings()` / `updateSettings()` for how limits merge across subscriptions (`max` | `sum`); `checkFeature({ subject_type, subject_id, feature, required })`; metered usage takes `feature` and `subscription_id`.
+- Vercel BotID: `botIdAttestationHandler({ secret, checkBotId })` (a fetch-style route handler for your Vercel deployment) and `createBotIdAttestation()`, which sign a BotID verdict for Atlas's `vercel_botid` captcha provider.
+- `instanceSecurity.setWalletRpcSecret({ chain_id, url })`: the wallet RPC endpoint for an EIP-155 chain (token gating and the Sign in with Ethereum ENS lookup); captcha secrets take `provider`.
+
 ## 0.15.0 — 2026-10-23
 
 ### Added

package/dist/better-auth.d.ts

@@ -0,0 +1,157 @@
+/**
+ * Moving from Better Auth to Atlas without signing anyone out.
+ *
+ * During the migration window a returning user still carries their Better Auth
+ * session cookie (`better-auth.session_token`, `__Secure-` prefixed over
+ * https). It is HttpOnly, so only your server can read it. The bridge reads it,
+ * exchanges it ONCE with Atlas (`POST /v1/client/migrations/better_auth/exchange`),
+ * sets the Atlas session as your own first-party cookies and clears the Better
+ * Auth cookies. Atlas finds the session in your import (or asks your old app,
+ * with the live fallback on) and runs the normal sign-in path on it — MFA
+ * policy included: a user who still owes a second factor is sent to finish it.
+ *
+ * Framework-neutral: {@link createBetterAuthBridge} returns a decision with the
+ * cookies to set and clear; the Next.js middleware and the Express / Fastify /
+ * Hono adapters render it.
+ */
+/** Better Auth's default cookie prefix (`advanced.cookiePrefix`). */
+export declare const BETTER_AUTH_COOKIE_PREFIX = "better-auth";
+/** The FAPI path of the exchange (publishable key; per-IP limited — the browser / fallback path). */
+export declare const BETTER_AUTH_EXCHANGE_PATH = "/v1/client/migrations/better_auth/exchange";
+/** The Backend API path (secret key; limited per instance for a bulk cutover — the server path). */
+export declare const BETTER_AUTH_BAPI_EXCHANGE_PATH = "/v1/migrations/better_auth/exchange";
+/** A cookie to set (or, with `maxAge: 0`, clear) on the response. */
+export interface BridgeCookie {
+    name: string;
+    value: string;
+    options: {
+        path?: string;
+        domain?: string;
+        httpOnly?: boolean;
+        sameSite?: 'lax' | 'strict' | 'none';
+        secure?: boolean;
+        maxAge?: number;
+    };
+}
+/** The Better Auth cookies the bridge reads (session_token) and clears (all of them). */
+export declare function betterAuthCookieNames(prefix?: string): {
+    sessionToken: string[];
+    all: string[];
+};
+/**
+ * The raw Better Auth session cookie value from a `Cookie` header (the
+ * `__Secure-` name first), or undefined. `cookieName` overrides the name when
+ * the old app set `advanced.cookies.session_token.name`.
+ */
+export declare function readBetterAuthSessionCookie(cookieHeader: string | null | undefined, options?: {
+    cookiePrefix?: string;
+    cookieName?: string;
+}): string | undefined;
+/** Why Atlas refused an exchange (`meta.bridge_outcome`). */
+export type BetterAuthRefusal = 'closed' | 'invalid' | 'signature_invalid' | 'expired' | 'reused' | 'user_unavailable' | 'rate_limited' | 'unavailable';
+export type BetterAuthExchangeResult = {
+    kind: 'session';
+    jwt: string;
+    refreshToken: string;
+    sessionId: string;
+    userId: string;
+    expiresIn: number;
+} | {
+    /** The user still owes a second factor (or MFA enrolment) — the Better Auth session is spent. */
+    kind: 'needs_mfa';
+    attemptId: string;
+    status: 'needs_second_factor' | 'needs_mfa_enrollment';
+} | {
+    kind: 'refused';
+    outcome: BetterAuthRefusal;
+    status: number;
+};
+export interface ExchangeBetterAuthSessionOptions {
+    /** The instance's Frontend API origin, e.g. `https://clerk.example.com` or your FAPI host. */
+    fapiOrigin: string;
+    publishableKey: string;
+    /**
+     * The instance secret key. When set (recommended on a server), the exchange
+     * goes to the Backend API, which is limited per instance with a ceiling sized
+     * for a bulk cutover instead of per IP — your server speaks for every user —
+     * and takes the user's IP and user agent from `clientIp` / `userAgent`.
+     */
+    secretKey?: string;
+    /** Backend API origin for the secret-key path. Default `https://api.atlasauth.net`. */
+    bapiBaseUrl?: string;
+    /** The end user's IP (secret-key path), so Atlas's risk and geo checks see the user, not your server. */
+    clientIp?: string;
+    /** The raw Better Auth session cookie value (or the bare token). */
+    token: string;
+    /** false → the Atlas refresh cookie should be a browser-session cookie. */
+    remember?: boolean;
+    fetchImpl?: typeof fetch;
+    /** Forwarded so the session's device record shows the user's browser, not your server. */
+    userAgent?: string;
+}
+/**
+ * Exchange a Better Auth session for an Atlas session, server to server
+ * (`delivery: "body"`). Never throws: a transport failure is
+ * `{ kind: 'refused', outcome: 'unavailable' }`, so the caller keeps the Better
+ * Auth cookie and tries again on a later request.
+ */
+export declare function exchangeBetterAuthSession(options: ExchangeBetterAuthSessionOptions): Promise<BetterAuthExchangeResult>;
+export interface BetterAuthBridgeOptions {
+    fapiOrigin: string;
+    publishableKey: string;
+    /** The instance secret key: exchanges go through the Backend API (recommended; see {@link ExchangeBetterAuthSessionOptions.secretKey}). */
+    secretKey?: string;
+    bapiBaseUrl?: string;
+    /** Better Auth's `advanced.cookiePrefix` (default `better-auth`). */
+    cookiePrefix?: string;
+    /** The session cookie's full name, when the old app overrode it. */
+    cookieName?: string;
+    /** The `domain` the Better Auth cookies were set on (its `crossSubDomainCookies.domain`), so they clear. */
+    betterAuthCookieDomain?: string;
+    /** Mark the Atlas cookies `Secure`. Default true; set false only for plain-http local development. */
+    secure?: boolean;
+    fetchImpl?: typeof fetch;
+}
+/** What the bridge decided for one request. */
+export type BetterAuthBridgeDecision = 
+/** No Better Auth cookie, or an Atlas session already present: carry on. */
+{
+    action: 'none';
+}
+/** Exchanged: set these cookies and re-enter (redirect to the same URL) so the new session is read. */
+ | {
+    action: 'signed_in';
+    cookies: BridgeCookie[];
+    session: Extract<BetterAuthExchangeResult, {
+        kind: 'session';
+    }>;
+}
+/** A second factor is owed: send the browser to your sign-in page carrying the attempt (see `continuationUrl`). */
+ | {
+    action: 'needs_mfa';
+    cookies: BridgeCookie[];
+    attemptId: string;
+    status: string;
+    continuationUrl: (url: string) => string;
+}
+/** Refused. `cookies` clears the Better Auth cookies when the refusal is final (invalid, expired, reused). */
+ | {
+    action: 'refused';
+    cookies: BridgeCookie[];
+    outcome: BetterAuthRefusal;
+};
+/**
+ * The bridge as a function of a request's headers. Call it from middleware
+ * before your normal auth check; it does nothing (no network) for a request
+ * without a Better Auth cookie or with an Atlas session (`__session` /
+ * `__atlas_rt`) already present.
+ */
+export declare function createBetterAuthBridge(options: BetterAuthBridgeOptions): (request: {
+    headers: {
+        get(name: string): string | null;
+    } | Record<string, string | string[] | undefined>;
+    /** The end user's IP as your framework resolved it (forwarded on the secret-key path). */
+    ip?: string;
+}) => Promise<BetterAuthBridgeDecision>;
+/** Serialize a {@link BridgeCookie} as a `Set-Cookie` header value. */
+export declare function serializeBridgeCookie(cookie: BridgeCookie): string;

package/dist/better-auth.js

@@ -0,0 +1,245 @@
+"use strict";
+/**
+ * Moving from Better Auth to Atlas without signing anyone out.
+ *
+ * During the migration window a returning user still carries their Better Auth
+ * session cookie (`better-auth.session_token`, `__Secure-` prefixed over
+ * https). It is HttpOnly, so only your server can read it. The bridge reads it,
+ * exchanges it ONCE with Atlas (`POST /v1/client/migrations/better_auth/exchange`),
+ * sets the Atlas session as your own first-party cookies and clears the Better
+ * Auth cookies. Atlas finds the session in your import (or asks your old app,
+ * with the live fallback on) and runs the normal sign-in path on it — MFA
+ * policy included: a user who still owes a second factor is sent to finish it.
+ *
+ * Framework-neutral: {@link createBetterAuthBridge} returns a decision with the
+ * cookies to set and clear; the Next.js middleware and the Express / Fastify /
+ * Hono adapters render it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BETTER_AUTH_BAPI_EXCHANGE_PATH = exports.BETTER_AUTH_EXCHANGE_PATH = exports.BETTER_AUTH_COOKIE_PREFIX = void 0;
+exports.betterAuthCookieNames = betterAuthCookieNames;
+exports.readBetterAuthSessionCookie = readBetterAuthSessionCookie;
+exports.exchangeBetterAuthSession = exchangeBetterAuthSession;
+exports.createBetterAuthBridge = createBetterAuthBridge;
+exports.serializeBridgeCookie = serializeBridgeCookie;
+/** Better Auth's default cookie prefix (`advanced.cookiePrefix`). */
+exports.BETTER_AUTH_COOKIE_PREFIX = 'better-auth';
+/** The FAPI path of the exchange (publishable key; per-IP limited — the browser / fallback path). */
+exports.BETTER_AUTH_EXCHANGE_PATH = '/v1/client/migrations/better_auth/exchange';
+/** The Backend API path (secret key; limited per instance for a bulk cutover — the server path). */
+exports.BETTER_AUTH_BAPI_EXCHANGE_PATH = '/v1/migrations/better_auth/exchange';
+/** Default Backend API origin. */
+const DEFAULT_BAPI_URL = 'https://api.atlasauth.net';
+/** The Better Auth cookies the bridge reads (session_token) and clears (all of them). */
+function betterAuthCookieNames(prefix = exports.BETTER_AUTH_COOKIE_PREFIX) {
+    const base = ['session_token', 'session_data', 'account_data', 'dont_remember'].map((n) => `${prefix}.${n}`);
+    const secure = base.map((n) => `__Secure-${n}`);
+    return {
+        sessionToken: [`__Secure-${prefix}.session_token`, `${prefix}.session_token`],
+        all: [...secure, ...base],
+    };
+}
+function readCookie(header, name) {
+    if (!header)
+        return undefined;
+    for (const part of header.split(';')) {
+        const [key, ...rest] = part.trim().split('=');
+        if (key === name)
+            return rest.join('=');
+    }
+    return undefined;
+}
+/**
+ * The raw Better Auth session cookie value from a `Cookie` header (the
+ * `__Secure-` name first), or undefined. `cookieName` overrides the name when
+ * the old app set `advanced.cookies.session_token.name`.
+ */
+function readBetterAuthSessionCookie(cookieHeader, options = {}) {
+    const names = options.cookieName
+        ? [`__Secure-${options.cookieName}`, options.cookieName]
+        : betterAuthCookieNames(options.cookiePrefix).sessionToken;
+    for (const name of names) {
+        const value = readCookie(cookieHeader, name);
+        if (value)
+            return value;
+    }
+    return undefined;
+}
+/**
+ * Exchange a Better Auth session for an Atlas session, server to server
+ * (`delivery: "body"`). Never throws: a transport failure is
+ * `{ kind: 'refused', outcome: 'unavailable' }`, so the caller keeps the Better
+ * Auth cookie and tries again on a later request.
+ */
+async function exchangeBetterAuthSession(options) {
+    const doFetch = options.fetchImpl ?? fetch;
+    const viaSecretKey = Boolean(options.secretKey);
+    const url = viaSecretKey
+        ? `${(options.bapiBaseUrl ?? DEFAULT_BAPI_URL).replace(/\/+$/, '')}${exports.BETTER_AUTH_BAPI_EXCHANGE_PATH}`
+        : new URL(exports.BETTER_AUTH_EXCHANGE_PATH, options.fapiOrigin).toString();
+    const headers = { 'content-type': 'application/json' };
+    if (viaSecretKey) {
+        headers.authorization = `Bearer ${options.secretKey}`;
+        if (options.clientIp)
+            headers['x-atlas-client-ip'] = options.clientIp;
+        if (options.userAgent)
+            headers['x-atlas-client-user-agent'] = options.userAgent;
+    }
+    else {
+        headers['x-publishable-key'] = options.publishableKey;
+        if (options.userAgent)
+            headers['user-agent'] = options.userAgent;
+    }
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: 'POST',
+            headers,
+            body: JSON.stringify({
+                token: options.token,
+                ...(viaSecretKey ? {} : { delivery: 'body' }),
+                ...(options.remember === false ? { remember: false } : {}),
+            }),
+        });
+    }
+    catch {
+        return { kind: 'refused', outcome: 'unavailable', status: 0 };
+    }
+    const data = (await res.json().catch(() => null));
+    if (res.ok && data?.object === 'session_tokens' && data.jwt && data.refresh_token) {
+        return {
+            kind: 'session',
+            jwt: data.jwt,
+            refreshToken: data.refresh_token,
+            sessionId: data.session_id ?? '',
+            userId: data.user_id ?? '',
+            expiresIn: data.expires_in ?? 0,
+        };
+    }
+    if (res.ok &&
+        data?.object === 'sign_in_attempt' &&
+        data.id &&
+        (data.status === 'needs_second_factor' || data.status === 'needs_mfa_enrollment')) {
+        return { kind: 'needs_mfa', attemptId: data.id, status: data.status };
+    }
+    if (res.status === 429)
+        return { kind: 'refused', outcome: 'rate_limited', status: 429 };
+    const outcome = data?.errors?.[0]?.meta?.bridge_outcome;
+    const known = ['closed', 'invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'rate_limited'];
+    if (outcome && known.includes(outcome)) {
+        return { kind: 'refused', outcome: outcome, status: res.status };
+    }
+    // Anything else (a 5xx, a guard refusal, an unparsable body) is not a verdict
+    // on the Better Auth session: keep it and retry later.
+    return { kind: 'refused', outcome: 'unavailable', status: res.status };
+}
+/** Refusals that say the Better Auth session will never exchange: its cookies are cleared. */
+const FINAL = ['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable'];
+/**
+ * The bridge as a function of a request's headers. Call it from middleware
+ * before your normal auth check; it does nothing (no network) for a request
+ * without a Better Auth cookie or with an Atlas session (`__session` /
+ * `__atlas_rt`) already present.
+ */
+function createBetterAuthBridge(options) {
+    const secure = options.secure !== false;
+    const clearBetterAuth = () => betterAuthCookieNames(options.cookiePrefix).all.concat(options.cookieName ? [options.cookieName, `__Secure-${options.cookieName}`] : []).map((name) => ({
+        name,
+        value: '',
+        options: {
+            path: '/',
+            maxAge: 0,
+            ...(options.betterAuthCookieDomain ? { domain: options.betterAuthCookieDomain } : {}),
+            // A `__Secure-` cookie can only be overwritten by a Secure Set-Cookie.
+            ...(name.startsWith('__Secure-') ? { secure: true } : {}),
+        },
+    }));
+    return async function bridge(request) {
+        const cookieHeader = header(request.headers, 'cookie');
+        const token = readBetterAuthSessionCookie(cookieHeader, options);
+        if (!token)
+            return { action: 'none' };
+        // Already on Atlas: leave the old cookie for the old app's own expiry.
+        if (readCookie(cookieHeader, '__session') || readCookie(cookieHeader, '__atlas_rt'))
+            return { action: 'none' };
+        const result = await exchangeBetterAuthSession({
+            fapiOrigin: options.fapiOrigin,
+            publishableKey: options.publishableKey,
+            token,
+            fetchImpl: options.fetchImpl,
+            userAgent: header(request.headers, 'user-agent'),
+            secretKey: options.secretKey,
+            bapiBaseUrl: options.bapiBaseUrl,
+            clientIp: request.ip ?? clientIpFrom(request.headers),
+        });
+        if (result.kind === 'session') {
+            return {
+                action: 'signed_in',
+                session: result,
+                cookies: [
+                    { name: '__session', value: result.jwt, options: { path: '/', sameSite: 'lax', secure } },
+                    {
+                        name: '__atlas_rt',
+                        value: result.refreshToken,
+                        options: { path: '/', httpOnly: true, sameSite: 'lax', secure },
+                    },
+                    ...clearBetterAuth(),
+                ],
+            };
+        }
+        if (result.kind === 'needs_mfa') {
+            return {
+                action: 'needs_mfa',
+                attemptId: result.attemptId,
+                status: result.status,
+                cookies: clearBetterAuth(),
+                continuationUrl: (url) => {
+                    const next = new URL(url);
+                    next.searchParams.set('__atlas_attempt', result.attemptId);
+                    next.searchParams.set('__atlas_status', result.status);
+                    return next.toString();
+                },
+            };
+        }
+        return {
+            action: 'refused',
+            outcome: result.outcome,
+            cookies: FINAL.includes(result.outcome) ? clearBetterAuth() : [],
+        };
+    };
+}
+function header(headers, name) {
+    if (typeof headers.get === 'function') {
+        return headers.get(name) ?? undefined;
+    }
+    const record = headers;
+    const value = record[name] ?? record[name.toLowerCase()];
+    return Array.isArray(value) ? value.join('; ') : value;
+}
+/** Serialize a {@link BridgeCookie} as a `Set-Cookie` header value. */
+function serializeBridgeCookie(cookie) {
+    const o = cookie.options;
+    const parts = [`${cookie.name}=${cookie.value}`];
+    parts.push(`Path=${o.path ?? '/'}`);
+    if (o.domain)
+        parts.push(`Domain=${o.domain}`);
+    if (o.maxAge !== undefined) {
+        parts.push(`Max-Age=${o.maxAge}`);
+        if (o.maxAge === 0)
+            parts.push('Expires=Thu, 01 Jan 1970 00:00:00 GMT');
+    }
+    if (o.httpOnly)
+        parts.push('HttpOnly');
+    if (o.secure)
+        parts.push('Secure');
+    if (o.sameSite)
+        parts.push(`SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`);
+    return parts.join('; ');
+}
+/** The client IP a proxy in front of your server recorded (first X-Forwarded-For hop, or X-Real-IP). */
+function clientIpFrom(headers) {
+    const xff = header(headers, 'x-forwarded-for');
+    const first = xff?.split(',')[0]?.trim();
+    return first || header(headers, 'x-real-ip')?.trim() || undefined;
+}
+//# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA2BH,sDAUC;AAgBD,kEAYC;AA4DD,8DAuEC;AAuCD,wDA0EC;AAeD,sDAaC;AA/UD,qEAAqE;AACxD,QAAA,yBAAyB,GAAG,aAAa,CAAC;AAEvD,qGAAqG;AACxF,QAAA,yBAAyB,GAAG,4CAA4C,CAAC;AACtF,oGAAoG;AACvF,QAAA,8BAA8B,GAAG,qCAAqC,CAAC;AACpF,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAgBrD,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,SAAiB,iCAAyB;IAI9E,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO;QACL,YAAY,EAAE,CAAC,YAAY,MAAM,gBAAgB,EAAE,GAAG,MAAM,gBAAgB,CAAC;QAC7E,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiC,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,2BAA2B,CACzC,YAAuC,EACvC,UAA0D,EAAE;IAE5D,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU;QAC9B,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;QACxD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAsDD;;;;;GAKG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAyC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,sCAA8B,EAAE;QACrG,CAAC,CAAC,IAAI,GAAG,CAAC,iCAAyB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtE,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IAET,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,KAAK,iBAAiB;QAClC,IAAI,CAAC,EAAE;QACP,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EACjF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,MAAM,KAAK,GAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACvI,IAAI,OAAO,IAAK,KAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAA4B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,8EAA8E;IAC9E,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA8BD,8FAA8F;AAC9F,MAAM,KAAK,GAAwB,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,eAAe,GAAG,GAAmB,EAAE,CAC3C,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,MAAM,CACpD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACjF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,IAAI;QACJ,KAAK,EAAE,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,uEAAuE;YACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;KACF,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,UAAU,MAAM,CAAC,OAI5B;QACC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,2BAA2B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF;wBACE,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,MAAM,CAAC,YAAY;wBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;qBAChE;oBACD,GAAG,eAAe,EAAE;iBACrB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,eAAe,EAAE;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE;SACjE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,OAA6F,EAC7F,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,MAAoB;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CACnB,OAA6F;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}

package/dist/botid.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Vercel BotID for Atlas — the server half that runs on YOUR Vercel deployment.
+ *
+ * BotID's verdict only exists inside a Vercel-hosted request (`checkBotId()`
+ * from `botid/server` reads signals Vercel's edge attaches). Atlas is not that
+ * request, so your route runs `checkBotId()` and turns the verdict into a short
+ * signed attestation; the browser sends it to Atlas as `captcha_token`, and
+ * Atlas checks the signature, freshness and `isBot === false`, and spends it
+ * (each attestation passes once).
+ *
+ *   // app/api/atlas/botid/route.ts (Next.js on Vercel)
+ *   import { checkBotId } from 'botid/server';
+ *   import { botIdAttestationHandler } from '@atlasauth/backend';
+ *   export const POST = botIdAttestationHandler({
+ *     secret: process.env.ATLAS_BOTID_SECRET!,
+ *     checkBotId,
+ *   });
+ *
+ * The same secret is stored in Atlas for the `vercel_botid` captcha provider.
+ * Protect the route with BotID on the client (`initBotId({ protect: [{ path:
+ * '/api/atlas/botid', method: 'POST' }] })`) and set the captcha's
+ * `attestationUrl` to it, so the prebuilt components fetch a verdict on submit.
+ *
+ * Format (version 1): `atlas_botid.v1.<payload>.<sig>` — `payload` is base64url
+ * JSON `{ v: 1, is_bot, verified_bot, iat, exp, jti }`, `sig` is base64url
+ * HMAC-SHA256 over `atlas_botid.v1.<payload>` keyed by the shared secret.
+ */
+/** The prefix every attestation carries. */
+export declare const BOTID_ATTESTATION_PREFIX = "atlas_botid.v1.";
+/** Atlas refuses attestations that live longer than this, in seconds. */
+export declare const BOTID_ATTESTATION_MAX_TTL_SECONDS = 300;
+/** Atlas refuses secrets shorter than this. */
+export declare const BOTID_SECRET_MIN_LENGTH = 32;
+/** The fields of BotID's `checkBotId()` result this helper reads. */
+export interface BotIdVerdict {
+    isBot: boolean;
+    /** True for a known good bot (a search engine crawler). Recorded, still refused. */
+    isVerifiedBot?: boolean;
+}
+export interface CreateBotIdAttestationOptions {
+    /** The attestation secret shared with Atlas (at least 32 characters). */
+    secret: string;
+    /** The verdict `checkBotId()` returned for this request. */
+    verdict: BotIdVerdict;
+    /** Lifetime in seconds. Default 60, at most 300. */
+    ttlSeconds?: number;
+    /** Clock override, epoch ms (tests). */
+    now?: number;
+}
+/**
+ * Sign a BotID verdict for Atlas. Throws when the secret is too short (Atlas
+ * would refuse every attestation it signs). A bot verdict is still signed — it
+ * is Atlas that refuses it — so your route needs no branching.
+ */
+export declare function createBotIdAttestation(options: CreateBotIdAttestationOptions): string;
+export interface BotIdAttestationHandlerOptions {
+    /** The attestation secret shared with Atlas. */
+    secret: string;
+    /** `checkBotId` from `botid/server`. */
+    checkBotId: () => Promise<BotIdVerdict>;
+    /** Lifetime of each attestation in seconds. Default 60. */
+    ttlSeconds?: number;
+}
+/**
+ * A Web-standard `(request) => Response` route handler (Next.js App Router,
+ * Hono, any fetch-style runtime): runs `checkBotId()` and answers
+ * `{ token }` with the signed attestation, `no-store`. A BotID failure answers
+ * 503 so the client never sends a token that was never checked.
+ */
+export declare function botIdAttestationHandler(options: BotIdAttestationHandlerOptions): (request?: Request) => Promise<Response>;

package/dist/botid.js

@@ -0,0 +1,88 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BOTID_SECRET_MIN_LENGTH = exports.BOTID_ATTESTATION_MAX_TTL_SECONDS = exports.BOTID_ATTESTATION_PREFIX = void 0;
+exports.createBotIdAttestation = createBotIdAttestation;
+exports.botIdAttestationHandler = botIdAttestationHandler;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Vercel BotID for Atlas — the server half that runs on YOUR Vercel deployment.
+ *
+ * BotID's verdict only exists inside a Vercel-hosted request (`checkBotId()`
+ * from `botid/server` reads signals Vercel's edge attaches). Atlas is not that
+ * request, so your route runs `checkBotId()` and turns the verdict into a short
+ * signed attestation; the browser sends it to Atlas as `captcha_token`, and
+ * Atlas checks the signature, freshness and `isBot === false`, and spends it
+ * (each attestation passes once).
+ *
+ *   // app/api/atlas/botid/route.ts (Next.js on Vercel)
+ *   import { checkBotId } from 'botid/server';
+ *   import { botIdAttestationHandler } from '@atlasauth/backend';
+ *   export const POST = botIdAttestationHandler({
+ *     secret: process.env.ATLAS_BOTID_SECRET!,
+ *     checkBotId,
+ *   });
+ *
+ * The same secret is stored in Atlas for the `vercel_botid` captcha provider.
+ * Protect the route with BotID on the client (`initBotId({ protect: [{ path:
+ * '/api/atlas/botid', method: 'POST' }] })`) and set the captcha's
+ * `attestationUrl` to it, so the prebuilt components fetch a verdict on submit.
+ *
+ * Format (version 1): `atlas_botid.v1.<payload>.<sig>` — `payload` is base64url
+ * JSON `{ v: 1, is_bot, verified_bot, iat, exp, jti }`, `sig` is base64url
+ * HMAC-SHA256 over `atlas_botid.v1.<payload>` keyed by the shared secret.
+ */
+/** The prefix every attestation carries. */
+exports.BOTID_ATTESTATION_PREFIX = 'atlas_botid.v1.';
+/** Atlas refuses attestations that live longer than this, in seconds. */
+exports.BOTID_ATTESTATION_MAX_TTL_SECONDS = 300;
+/** Atlas refuses secrets shorter than this. */
+exports.BOTID_SECRET_MIN_LENGTH = 32;
+/**
+ * Sign a BotID verdict for Atlas. Throws when the secret is too short (Atlas
+ * would refuse every attestation it signs). A bot verdict is still signed — it
+ * is Atlas that refuses it — so your route needs no branching.
+ */
+function createBotIdAttestation(options) {
+    const { secret, verdict } = options;
+    if (typeof secret !== 'string' || secret.length < exports.BOTID_SECRET_MIN_LENGTH) {
+        throw new Error(`The BotID attestation secret must be at least ${exports.BOTID_SECRET_MIN_LENGTH} characters.`);
+    }
+    const ttl = Math.min(Math.max(Math.floor(options.ttlSeconds ?? 60), 1), exports.BOTID_ATTESTATION_MAX_TTL_SECONDS);
+    const iat = Math.floor((options.now ?? Date.now()) / 1000);
+    const payload = Buffer.from(JSON.stringify({
+        v: 1,
+        is_bot: verdict.isBot !== false,
+        verified_bot: verdict.isVerifiedBot === true,
+        iat,
+        exp: iat + ttl,
+        jti: (0, node_crypto_1.randomBytes)(18).toString('base64url'),
+    }), 'utf8').toString('base64url');
+    const sig = (0, node_crypto_1.createHmac)('sha256', secret).update(exports.BOTID_ATTESTATION_PREFIX + payload).digest('base64url');
+    return `${exports.BOTID_ATTESTATION_PREFIX}${payload}.${sig}`;
+}
+/**
+ * A Web-standard `(request) => Response` route handler (Next.js App Router,
+ * Hono, any fetch-style runtime): runs `checkBotId()` and answers
+ * `{ token }` with the signed attestation, `no-store`. A BotID failure answers
+ * 503 so the client never sends a token that was never checked.
+ */
+function botIdAttestationHandler(options) {
+    return async () => {
+        let verdict;
+        try {
+            verdict = await options.checkBotId();
+        }
+        catch {
+            return new Response(JSON.stringify({ error: 'botid_unavailable' }), {
+                status: 503,
+                headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+            });
+        }
+        const token = createBotIdAttestation({ secret: options.secret, verdict, ttlSeconds: options.ttlSeconds });
+        return new Response(JSON.stringify({ token }), {
+            status: 200,
+            headers: { 'content-type': 'application/json', 'cache-control': 'no-store' },
+        });
+    };
+}
+//# sourceMappingURL=botid.js.map

package/dist/botid.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"botid.js","sourceRoot":"","sources":["../src/botid.ts"],"names":[],"mappings":";;;AA8DA,wDAoBC;AAiBD,0DAiBC;AApHD,6CAAsD;AAEtD;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,4CAA4C;AAC/B,QAAA,wBAAwB,GAAG,iBAAiB,CAAC;AAE1D,yEAAyE;AAC5D,QAAA,iCAAiC,GAAG,GAAG,CAAC;AAErD,+CAA+C;AAClC,QAAA,uBAAuB,GAAG,EAAE,CAAC;AAoB1C;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,GAAG,+BAAuB,EAAE,CAAC;QAC1E,MAAM,IAAI,KAAK,CAAC,iDAAiD,+BAAuB,cAAc,CAAC,CAAC;IAC1G,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,yCAAiC,CAAC,CAAC;IAC3G,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CACzB,IAAI,CAAC,SAAS,CAAC;QACb,CAAC,EAAE,CAAC;QACJ,MAAM,EAAE,OAAO,CAAC,KAAK,KAAK,KAAK;QAC/B,YAAY,EAAE,OAAO,CAAC,aAAa,KAAK,IAAI;QAC5C,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,GAAG;QACd,GAAG,EAAE,IAAA,yBAAW,EAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;KAC3C,CAAC,EACF,MAAM,CACP,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,IAAA,wBAAU,EAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,gCAAwB,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACxG,OAAO,GAAG,gCAAwB,GAAG,OAAO,IAAI,GAAG,EAAE,CAAC;AACxD,CAAC;AAWD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,OAAuC;IAC7E,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,OAAqB,CAAC;QAC1B,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,EAAE,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,mBAAmB,EAAE,CAAC,EAAE;gBAClE,MAAM,EAAE,GAAG;gBACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;aAC7E,CAAC,CAAC;QACL,CAAC;QACD,MAAM,KAAK,GAAG,sBAAsB,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;QAC1G,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE;YAC7C,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,eAAe,EAAE,UAAU,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC"}