@atlasauth/backend 0.15.0 → 0.17.0

package/dist/client/sessions.d.ts

@@ -17,6 +17,8 @@ export interface Session {
      */
     idle_expires_at?: number;
     created_at: number;
+    /** Custom per-session data your backend (or a post_login Action) attached; null when none. */
+    custom_data?: Record<string, unknown> | null;
 }
 /** The session after a keep-alive {@link sessionsResource} `touch`. */
 export interface TouchedSession extends Session {
@@ -35,6 +37,8 @@ export interface CreateSessionParams {
     actor?: {
         sub: string;
     };
+    /** Custom per-session data to attach (a JSON object, at most 2 KB). */
+    custom_data?: Record<string, unknown>;
 }
 /**
  * A freshly-minted session. Unlike a listed {@link Session}, this carries the
@@ -52,6 +56,7 @@ export interface MintedSession {
     impersonated_by?: {
         sub: string;
     };
+    custom_data?: Record<string, unknown> | null;
 }
 /** A JWT minted from a named JWT template. */
 export interface SessionTemplateToken {
@@ -74,6 +79,17 @@ export declare function sessionsResource(request: RequestFn): {
         id: string;
         status: "revoked";
     }>;
+    /**
+     * `PUT /v1/sessions/:id/custom_data` — replace the session's custom data
+     * (null clears it). At most 2 KB; only an active session can be changed.
+     * Not for secrets: the signed-in user can read it.
+     */
+    setCustomData(id: string, customData: Record<string, unknown> | null): Promise<Session>;
+    /**
+     * `PATCH /v1/sessions/:id/custom_data` — merge keys into the session's custom
+     * data; a key set to null is removed.
+     */
+    updateCustomData(id: string, patch: Record<string, unknown>): Promise<Session>;
     /**
      * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
      * slides its inactivity window as if the user had just loaded a page. Never

package/dist/client/sessions.js

@@ -21,6 +21,21 @@ function sessionsResource(request) {
         revoke(id) {
             return request({ method: 'POST', path: `/v1/sessions/${(0, request_1.enc)(id)}/revoke` });
         },
+        /**
+         * `PUT /v1/sessions/:id/custom_data` — replace the session's custom data
+         * (null clears it). At most 2 KB; only an active session can be changed.
+         * Not for secrets: the signed-in user can read it.
+         */
+        setCustomData(id, customData) {
+            return request({ method: 'PUT', path: `/v1/sessions/${(0, request_1.enc)(id)}/custom_data`, body: { custom_data: customData } });
+        },
+        /**
+         * `PATCH /v1/sessions/:id/custom_data` — merge keys into the session's custom
+         * data; a key set to null is removed.
+         */
+        updateCustomData(id, patch) {
+            return request({ method: 'PATCH', path: `/v1/sessions/${(0, request_1.enc)(id)}/custom_data`, body: { custom_data: patch } });
+        },
         /**
          * `POST /v1/sessions/:id/touch` — keep a session alive from your backend:
          * slides its inactivity window as if the user had just loaded a page. Never

package/dist/client/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAiEA,4CAwCC;AAzGD,uCAAgD;AAiEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/client/sessions.ts"],"names":[],"mappings":";;AAsEA,4CAuDC;AA7HD,uCAAgD;AAsEhD,SAAgB,gBAAgB,CAAC,OAAkB;IACjD,OAAO;QACL;;;WAGG;QACH,MAAM,CAAC,MAA2B;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,wDAAwD;QACxD,IAAI,CAAC,MAA0B;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QAChF,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,SAAS,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD;;;;WAIG;QACH,aAAa,CAAC,EAAU,EAAE,UAA0C;YAClE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;QACpH,CAAC;QACD;;;WAGG;QACH,gBAAgB,CAAC,EAAU,EAAE,KAA8B;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QACjH,CAAC;QACD;;;;;;WAMG;QACH,KAAK,CAAC,EAAU;YACd,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD;;;WAGG;QACH,QAAQ,CAAC,EAAU,EAAE,QAAgB;YACnC,OAAO,OAAO,CAAC;gBACb,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE,gBAAgB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,IAAA,aAAG,EAAC,QAAQ,CAAC,EAAE;aACxD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/client/sso-connections.d.ts

@@ -1,5 +1,6 @@
 import { type RequestFn } from './request';
 import type { ListPage } from './types';
+import { type IdpInitiatedLoginSettings, type ProfileMapping, type ProfileMappingPreview, type ProfileMappingPreviewBody, type TokenEndpointAuthMethod, type UpstreamLogoutSettings, type UpstreamUrls } from './custom-oauth-providers';
 export interface ClaimRoleMapping {
     claim: string;
     value: string;
@@ -22,6 +23,21 @@ export interface SsoConnection {
     saml_allow_idp_initiated: boolean;
     saml_sign_authn_requests: boolean;
     saml_want_response_signed: boolean;
+    /** SAML Single Logout is on for the connection. */
+    saml_single_logout?: boolean;
+    /** The IdP SingleLogoutService Location / ResponseLocation and delivery binding. */
+    saml_idp_slo_url?: string | null;
+    saml_idp_slo_response_url?: string | null;
+    saml_idp_slo_binding?: 'redirect' | 'post';
+    /** The IdP SOAP SingleLogoutService — the back channel for sessions ended server-side. */
+    saml_idp_slo_soap_url?: string | null;
+    /** Assertions that are not encrypted to the connection's key are refused. */
+    saml_require_encrypted_assertions?: boolean;
+    /** An SP encryption key pair is set up (the private key is never returned). */
+    has_saml_encryption_key?: boolean;
+    /** A key rotation is in progress (the previous key is still accepted). */
+    has_previous_saml_encryption_key?: boolean;
+    saml_encryption_rotated_at?: number | null;
     has_discourse_secret: boolean;
     discourse_provider_url: string | null;
     allowed_domains: string[];
@@ -31,6 +47,14 @@ export interface SsoConnection {
     attribute_mapping?: SsoAttributeMapping;
     /** OIDC: extra scopes requested on top of openid email profile. */
     oidc_scopes?: string[];
+    /** OIDC relying-party settings (see custom OAuth providers). */
+    profile_mapping?: Required<ProfileMapping> | null;
+    token_endpoint_auth_method?: TokenEndpointAuthMethod | null;
+    client_assertion_audience?: string | null;
+    logout?: Required<UpstreamLogoutSettings>;
+    idp_initiated_login?: Required<IdpInitiatedLoginSettings>;
+    /** OIDC connections: the URLs to register at the IdP. */
+    upstream_urls?: UpstreamUrls | null;
     /** Routing domains of an org-owned connection that the org has not verified. */
     domain_warnings?: Array<{
         domain: string;
@@ -43,9 +67,23 @@ export interface SamlMetadata {
     object: 'sso_saml_metadata';
     sp_entity_id: string;
     acs_url: string;
+    /** Our SingleLogoutService URL (both bindings), when Single Logout is on. */
+    slo_url?: string | null;
     /** The SP EntityDescriptor XML, carried as a string inside this JSON envelope. */
     metadata_xml: string;
 }
+/** A SAML connection's SP encryption key pair — certificates only. */
+export interface SamlEncryptionKey {
+    object: 'sso_saml_encryption_key';
+    connection_id: string;
+    /** The current certificate (PEM), published in SP metadata; null when encryption is off. */
+    certificate: string | null;
+    /** The previous certificate during a rotation; null otherwise. */
+    previous_certificate: string | null;
+    /** When the current key was installed (epoch ms). */
+    rotated_at: number | null;
+    require_encrypted_assertions: boolean;
+}
 export interface CreateSsoConnectionBody {
     organization_id?: string | null;
     type?: 'oidc' | 'saml' | 'discourse' | 'discourse_consumer';
@@ -62,6 +100,16 @@ export interface CreateSsoConnectionBody {
     saml_allow_idp_initiated?: boolean;
     saml_sign_authn_requests?: boolean;
     saml_want_response_signed?: boolean;
+    /** SAML Single Logout on/off. */
+    saml_single_logout?: boolean;
+    /** https; null clears it. Filled by IdP metadata import when published. */
+    saml_idp_slo_url?: string | null;
+    saml_idp_slo_response_url?: string | null;
+    saml_idp_slo_binding?: 'redirect' | 'post' | null;
+    /** https; null clears it. The back channel for sessions ended server-side. */
+    saml_idp_slo_soap_url?: string | null;
+    /** Requires an encryption key (see `createSamlEncryptionKey`). */
+    saml_require_encrypted_assertions?: boolean;
     discourse_secret?: string;
     discourse_provider_url?: string;
     allowed_domains?: string[];
@@ -71,6 +119,15 @@ export interface CreateSsoConnectionBody {
     attribute_mapping?: SsoAttributeMapping | null;
     /** OIDC only; null clears them. */
     oidc_scopes?: string[] | null;
+    /** OIDC: declarative profile mapping; null clears it. */
+    profile_mapping?: ProfileMapping | null;
+    /** OIDC: token-endpoint client authentication (private_key_jwt needs no secret). */
+    token_endpoint_auth_method?: TokenEndpointAuthMethod | null;
+    client_assertion_audience?: string | null;
+    /** OIDC: RP-initiated and back-channel logout. */
+    logout?: UpstreamLogoutSettings | null;
+    /** OIDC: third-party initiated login. */
+    idp_initiated_login?: IdpInitiatedLoginSettings | null;
 }
 /** Claim (OIDC) or attribute (SAML) names for each profile field. */
 export interface SsoAttributeMapping {
@@ -93,6 +150,32 @@ export declare function ssoConnectionsResource(request: RequestFn): {
         id: string;
         deleted: true;
     }>;
+    /** OIDC: run the connection's profile mapping (or the body's) against a pasted sample. */
+    previewProfileMapping(id: string, body: ProfileMappingPreviewBody): Promise<ProfileMappingPreview>;
+    /** OIDC: the connection's private_key_jwt signing keys. */
+    signingKeys(id: string): {
+        list(): Promise<ListPage<import("./custom-oauth-providers").UpstreamSigningKey>>;
+        rotate(body?: {
+            alg?: "RS256" | "PS256" | "ES256";
+        }, idempotencyKey?: string): Promise<import("./custom-oauth-providers").UpstreamSigningKey>;
+        retire(kid: string): Promise<{
+            object: "upstream_signing_key";
+            kid: string;
+            status: "retired";
+        }>;
+    };
     /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
     samlMetadata(id: string): Promise<SamlMetadata>;
+    /** The SAML connection's SP encryption certificate(s). */
+    getSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
+    /**
+     * Generate the SP encryption key pair, or ROTATE it when one exists: the
+     * current pair becomes the previous one (still advertised and accepted until
+     * {@link retirePreviousSamlEncryptionKey}).
+     */
+    createSamlEncryptionKey(id: string, idempotencyKey?: string): Promise<SamlEncryptionKey>;
+    /** Finish a rotation: stop accepting the previous encryption key. */
+    retirePreviousSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
+    /** Turn assertion encryption off (refused while encrypted assertions are required). */
+    deleteSamlEncryptionKey(id: string): Promise<SamlEncryptionKey>;
 };

package/dist/client/sso-connections.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ssoConnectionsResource = ssoConnectionsResource;
 const request_1 = require("./request");
+const custom_oauth_providers_1 = require("./custom-oauth-providers");
 function ssoConnectionsResource(request) {
     return {
         list() {
@@ -19,10 +20,38 @@ function ssoConnectionsResource(request) {
         delete(id) {
             return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}` });
         },
+        /** OIDC: run the connection's profile mapping (or the body's) against a pasted sample. */
+        previewProfileMapping(id, body) {
+            return request({ method: 'POST', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/profile_mapping/preview`, body });
+        },
+        /** OIDC: the connection's private_key_jwt signing keys. */
+        signingKeys(id) {
+            return (0, custom_oauth_providers_1.upstreamSigningKeys)(request, `/v1/sso_connections/${(0, request_1.enc)(id)}`);
+        },
         /** SP SAML metadata for a connection (JSON envelope carrying the XML). */
         samlMetadata(id) {
             return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_metadata` });
         },
+        /** The SAML connection's SP encryption certificate(s). */
+        getSamlEncryptionKey(id) {
+            return request({ method: 'GET', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key` });
+        },
+        /**
+         * Generate the SP encryption key pair, or ROTATE it when one exists: the
+         * current pair becomes the previous one (still advertised and accepted until
+         * {@link retirePreviousSamlEncryptionKey}).
+         */
+        createSamlEncryptionKey(id, idempotencyKey) {
+            return request({ method: 'POST', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key`, idempotencyKey });
+        },
+        /** Finish a rotation: stop accepting the previous encryption key. */
+        retirePreviousSamlEncryptionKey(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key/previous` });
+        },
+        /** Turn assertion encryption off (refused while encrypted assertions are required). */
+        deleteSamlEncryptionKey(id) {
+            return request({ method: 'DELETE', path: `/v1/sso_connections/${(0, request_1.enc)(id)}/saml_encryption_key` });
+        },
     };
 }
 //# sourceMappingURL=sso-connections.js.map

package/dist/client/sso-connections.js.map

@@ -1 +1 @@
-{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AAyFA,wDAsBC;AA/GD,uCAAgD;AAyFhD,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"sso-connections.js","sourceRoot":"","sources":["../../src/client/sso-connections.ts"],"names":[],"mappings":";;AA4JA,wDAkDC;AA9MD,uCAAgD;AAEhD,qEASkC;AAiJlC,SAAgB,sBAAsB,CAAC,OAAkB;IACvD,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,CAAC,IAA6B,EAAE,cAAuB;YAC3D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA6B;YAC9C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,0FAA0F;QAC1F,qBAAqB,CAAC,EAAU,EAAE,IAA+B;YAC/D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,0BAA0B,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3G,CAAC;QACD,2DAA2D;QAC3D,WAAW,CAAC,EAAU;YACpB,OAAO,IAAA,4CAAmB,EAAC,OAAO,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,0EAA0E;QAC1E,YAAY,CAAC,EAAU;YACrB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAC1F,CAAC;QACD,0DAA0D;QAC1D,oBAAoB,CAAC,EAAU;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;QAChG,CAAC;QACD;;;;WAIG;QACH,uBAAuB,CAAC,EAAU,EAAE,cAAuB;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,cAAc,EAAE,CAAC,CAAC;QACjH,CAAC;QACD,qEAAqE;QACrE,+BAA+B,CAAC,EAAU;YACxC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,+BAA+B,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,uFAAuF;QACvF,uBAAuB,CAAC,EAAU;YAChC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,uBAAuB,IAAA,aAAG,EAAC,EAAE,CAAC,sBAAsB,EAAE,CAAC,CAAC;QACnG,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -3,12 +3,16 @@ export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishab
 export * from './verify';
 export * from './access-control';
 export * from './handshake';
+export * from './better-auth';
+export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
+export type { LegacyIssuer } from './legacy-issuers';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';
 export type { AtlasOidc, AtlasOidcErrorCode, OidcCallbackOptions, OidcClientAuth, OidcIdentity, OidcLogoutUrlOptions, OidcStartOptions, OidcStartResult, VerifyIdTokenOptions, } from './oidc';
 export * from './webhooks';
 export * from './referrals';
+export * from './botid';
 export { createAtlasClient } from './client';
 export type { AtlasClient } from './client';
 export * from './client';
@@ -20,5 +24,5 @@ export { verifyPCActn } from './pca/verify';
 export type { PcaVerdict, PcaContext, VerifyPCActnOptions } from './pca/verify';
 export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
 export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
-export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
-export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopReplayStore, ResourceRequestLike, } from './oauth-resource';
+export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
+export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -26,6 +26,11 @@ Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: tru
 __exportStar(require("./verify"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
+// Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.
+__exportStar(require("./better-auth"), exports);
+var legacy_issuers_1 = require("./legacy-issuers");
+Object.defineProperty(exports, "BETTER_AUTH_JWT_ALGS", { enumerable: true, get: function () { return legacy_issuers_1.BETTER_AUTH_JWT_ALGS; } });
+Object.defineProperty(exports, "peekIssuer", { enumerable: true, get: function () { return legacy_issuers_1.peekIssuer; } });
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
@@ -51,6 +56,8 @@ Object.defineProperty(exports, "resetOidcCaches", { enumerable: true, get: funct
 __exportStar(require("./webhooks"), exports);
 // The Atlas referral protocol, for a referral platform receiving Atlas's signed calls.
 __exportStar(require("./referrals"), exports);
+// Vercel BotID: sign checkBotId() verdicts on your Vercel route for Atlas's captcha gate.
+__exportStar(require("./botid"), exports);
 // The typed management client for the secret-key Backend API.
 var client_1 = require("./client");
 Object.defineProperty(exports, "createAtlasClient", { enumerable: true, get: function () { return client_1.createAtlasClient; } });
@@ -83,6 +90,9 @@ Object.defineProperty(exports, "ACCESS_TOKEN_CLOCK_SKEW_SECONDS", { enumerable:
 Object.defineProperty(exports, "DPOP_PROOF_MAX_AGE_SECONDS", { enumerable: true, get: function () { return oauth_resource_1.DPOP_PROOF_MAX_AGE_SECONDS; } });
 Object.defineProperty(exports, "buildWwwAuthenticate", { enumerable: true, get: function () { return oauth_resource_1.buildWwwAuthenticate; } });
 Object.defineProperty(exports, "createAccessTokenVerifier", { enumerable: true, get: function () { return oauth_resource_1.createAccessTokenVerifier; } });
+Object.defineProperty(exports, "createIntrospector", { enumerable: true, get: function () { return oauth_resource_1.createIntrospector; } });
+Object.defineProperty(exports, "hmacDpopNonceSource", { enumerable: true, get: function () { return oauth_resource_1.hmacDpopNonceSource; } });
+Object.defineProperty(exports, "memoryDpopNonceSource", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopNonceSource; } });
 Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get: function () { return oauth_resource_1.memoryDpopReplayStore; } });
 Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
 Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAS0B;AARxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/legacy-issuers.d.ts

@@ -0,0 +1,65 @@
+import { type Jwks } from './jwks-cache';
+/**
+ * Accepting your OLD auth provider's JWTs during a cutover — today, Better
+ * Auth's `jwt` plugin tokens.
+ *
+ * When you move to Atlas, API clients may still hold short-lived JWTs your
+ * Better Auth app minted. With `legacyIssuers` on an {@link AtlasBackend}, a
+ * token whose `iss` is one of these issuers is verified against THAT issuer's
+ * key set (the JWKS you imported into Atlas, or the old app's `/api/auth/jwks`)
+ * for a bounded window, and its `sub` (the Better Auth user id) is mapped to the
+ * Atlas user id — Atlas keeps the Better Auth id as the user's `external_id`.
+ * After `until`, those tokens are refused like any other foreign token.
+ */
+export interface LegacyIssuer {
+    /** The old provider. Only `better_auth` today. */
+    kind?: 'better_auth';
+    /** The `iss` the old tokens carry (Better Auth: its `baseURL`, unless `jwt.issuer` was set). */
+    issuer: string;
+    /** The imported key set. Exactly one of `jwks` / `jwksUrl`. */
+    jwks?: Jwks;
+    /** Where to fetch the old key set (e.g. `https://app.example.com/api/auth/jwks`). */
+    jwksUrl?: string;
+    /** Expected `aud` (Better Auth: its `baseURL`, unless `jwt.audience` was set). Unchecked when unset. */
+    audience?: string | readonly string[];
+    /** The end of the acceptance window. Required: a legacy issuer is never accepted forever. */
+    until: Date | string | number;
+    /** Signing algorithms to accept. Default: Better Auth's (EdDSA, ES256, ES512, RS256, PS256). */
+    algorithms?: readonly string[];
+    /**
+     * Map the old `sub` to the Atlas user id. Default: look the user up by
+     * `external_id` through the Backend API (needs `secretKey` + `bapiBaseUrl`
+     * on the backend), cached in memory. Return null to refuse the token.
+     */
+    resolveSubject?: (legacySub: string, claims: Record<string, unknown>) => Promise<string | null> | string | null;
+}
+/** Better Auth's `jwt` plugin key algorithms. */
+export declare const BETTER_AUTH_JWT_ALGS: string[];
+export interface LegacyVerifierDeps {
+    issuers: readonly LegacyIssuer[];
+    secretKey?: string;
+    bapiBaseUrl?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    clockToleranceSeconds: number;
+}
+export type LegacyVerifyOutcome = {
+    ok: true;
+    claims: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: 'invalid' | 'no_keys';
+};
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+export declare function peekIssuer(token: string): string | undefined;
+export declare class LegacyIssuerVerifier {
+    private readonly deps;
+    private readonly caches;
+    private readonly subjects;
+    constructor(deps: LegacyVerifierDeps);
+    private get now();
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss: string | undefined): LegacyIssuer | undefined;
+    verify(token: string, entry: LegacyIssuer): Promise<LegacyVerifyOutcome>;
+    private resolve;
+}

package/dist/legacy-issuers.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyIssuerVerifier = exports.BETTER_AUTH_JWT_ALGS = void 0;
+exports.peekIssuer = peekIssuer;
+const jose_1 = require("jose");
+const jwks_cache_1 = require("./jwks-cache");
+/** Better Auth's `jwt` plugin key algorithms. */
+exports.BETTER_AUTH_JWT_ALGS = ['EdDSA', 'ES256', 'ES512', 'RS256', 'PS256'];
+/** How long a resolved sub → Atlas id mapping is reused. */
+const SUBJECT_TTL_MS = 5 * 60_000;
+/** Cap on cached subjects, so a stream of distinct tokens can't grow memory without bound. */
+const SUBJECT_CACHE_MAX = 10_000;
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+function peekIssuer(token) {
+    try {
+        const iss = (0, jose_1.decodeJwt)(token).iss;
+        return typeof iss === 'string' ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function untilMs(until) {
+    const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(until);
+    return Number.isFinite(t) ? t : 0;
+}
+class LegacyIssuerVerifier {
+    deps;
+    caches = new Map();
+    subjects = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        for (const entry of deps.issuers) {
+            const hasUrl = typeof entry.jwksUrl === 'string' && entry.jwksUrl.length > 0;
+            if (hasUrl === (entry.jwks !== undefined)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs exactly one of \`jwks\` or \`jwksUrl\`.`);
+            }
+            if (!entry.issuer)
+                throw new Error('legacyIssuers: every entry needs `issuer`.');
+            if (!untilMs(entry.until))
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs a valid \`until\` (the end of the window).`);
+            if (!entry.resolveSubject && (!deps.secretKey || !deps.bapiBaseUrl)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" maps its \`sub\` to an Atlas user through the Backend API, which needs \`secretKey\` and \`bapiBaseUrl\` on AtlasBackend — or give the issuer a \`resolveSubject\`.`);
+            }
+            this.caches.set(entry.issuer, new jwks_cache_1.JwksCache({
+                url: hasUrl ? entry.jwksUrl : undefined,
+                staticJwks: entry.jwks,
+                fetchImpl: deps.fetchImpl,
+                now: deps.now,
+            }));
+        }
+    }
+    get now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss) {
+        if (!iss)
+            return undefined;
+        const entry = this.deps.issuers.find((e) => e.issuer === iss);
+        if (!entry)
+            return undefined;
+        return untilMs(entry.until) > this.now ? entry : undefined;
+    }
+    async verify(token, entry) {
+        const cache = this.caches.get(entry.issuer);
+        const keys = await cache.get((0, jwks_cache_1.readKid)(token));
+        if (!keys || keys.keys.length === 0)
+            return { ok: false, reason: 'no_keys' };
+        let payload;
+        try {
+            const verified = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                algorithms: [...(entry.algorithms ?? exports.BETTER_AUTH_JWT_ALGS)],
+                issuer: entry.issuer,
+                ...(entry.audience !== undefined ? { audience: entry.audience } : {}),
+                clockTolerance: this.deps.clockToleranceSeconds,
+                currentDate: this.deps.now ? new Date(this.deps.now()) : undefined,
+            });
+            payload = verified.payload;
+        }
+        catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        // A legacy token without an expiry would outlive the window it is accepted in.
+        if (typeof payload.exp !== 'number')
+            return { ok: false, reason: 'invalid' };
+        const legacySub = typeof payload.sub === 'string' && payload.sub ? payload.sub : typeof payload.id === 'string' ? payload.id : '';
+        if (!legacySub)
+            return { ok: false, reason: 'invalid' };
+        const atlasId = await this.resolve(legacySub, payload, entry);
+        if (!atlasId)
+            return { ok: false, reason: 'invalid' };
+        return {
+            ok: true,
+            claims: {
+                ...payload,
+                sub: atlasId,
+                sid: typeof payload.sid === 'string' ? payload.sid : '',
+                external_id: legacySub,
+                legacy: { kind: entry.kind ?? 'better_auth', issuer: entry.issuer, sub: legacySub },
+            },
+        };
+    }
+    async resolve(legacySub, claims, entry) {
+        if (entry.resolveSubject) {
+            try {
+                return (await entry.resolveSubject(legacySub, claims)) || null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const key = `${entry.issuer}\u0000${legacySub}`;
+        const hit = this.subjects.get(key);
+        if (hit && this.now - hit.at < SUBJECT_TTL_MS)
+            return hit.id;
+        let id = null;
+        try {
+            const url = new URL('/v1/users', this.deps.bapiBaseUrl);
+            url.searchParams.set('external_id', legacySub);
+            url.searchParams.set('limit', '1');
+            const res = await (this.deps.fetchImpl ?? fetch)(url.toString(), {
+                headers: { authorization: `Bearer ${this.deps.secretKey}` },
+            });
+            if (!res.ok)
+                return null; // not cached: a transient failure should not stick
+            const body = (await res.json());
+            id = body.data?.[0]?.id ?? null;
+        }
+        catch {
+            return null;
+        }
+        if (this.subjects.size >= SUBJECT_CACHE_MAX)
+            this.subjects.clear();
+        this.subjects.set(key, { id, at: this.now });
+        return id;
+    }
+}
+exports.LegacyIssuerVerifier = LegacyIssuerVerifier;
+//# sourceMappingURL=legacy-issuers.js.map

package/dist/legacy-issuers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-issuers.js","sourceRoot":"","sources":["../src/legacy-issuers.ts"],"names":[],"mappings":";;;AA4DA,gCAOC;AAnED,+BAA+D;AAC/D,6CAA6D;AAqC7D,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAejC,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,oBAAoB;IAIF;IAHZ,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,iDAAiD,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,oDAAoD,CAAC,CAAC;YAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uKAAuK,CACvM,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,KAAK,CAAC,MAAM,EACZ,IAAI,sBAAS,CAAC;gBACZ,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAuB;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBACxE,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACvD,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAA+B,EAAE,KAAmB;QAC3F,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,SAAS,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAE7D,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY,CAAC,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,SAAU,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;YAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YACrE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AA7GD,oDA6GC"}