@atlasauth/backend 0.16.0 → 0.17.0

package/dist/client/better-auth-imports.js

@@ -0,0 +1,107 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BETTER_AUTH_IMPORT_PART_BYTES = void 0;
+exports.splitBundleParts = splitBundleParts;
+exports.betterAuthImportsResource = betterAuthImportsResource;
+const request_1 = require("./request");
+/** Bytes per uploaded part (the API takes at most 10 MiB). Parts end on a line boundary. */
+exports.BETTER_AUTH_IMPORT_PART_BYTES = 8 * 1024 * 1024;
+/** Split a sealed bundle's text into upload parts on line boundaries. */
+function splitBundleParts(text, maxBytes = exports.BETTER_AUTH_IMPORT_PART_BYTES) {
+    const enc8 = new TextEncoder();
+    const parts = [];
+    let current = [];
+    let size = 0;
+    for (const line of text.split('\n')) {
+        if (!line)
+            continue;
+        const n = enc8.encode(line).length + 1;
+        if (size > 0 && size + n > maxBytes) {
+            parts.push(`${current.join('\n')}\n`);
+            current = [];
+            size = 0;
+        }
+        current.push(line);
+        size += n;
+    }
+    if (current.length)
+        parts.push(`${current.join('\n')}\n`);
+    return parts;
+}
+const TERMINAL = ['ready', 'invalid', 'completed', 'failed'];
+function betterAuthImportsResource(request) {
+    const base = '/v1/better_auth_imports';
+    const self = {
+        /** The import public key (created on first read). */
+        getPublicKey() {
+            return request({ method: 'GET', path: `${base}/public_key` });
+        },
+        /** Replace the import key; bundles sealed to the old one no longer finalize. */
+        rotatePublicKey() {
+            return request({ method: 'POST', path: `${base}/public_key/rotate` });
+        },
+        create(body = {}, idempotencyKey) {
+            return request({ method: 'POST', path: base, body, idempotencyKey });
+        },
+        list(params = {}) {
+            return request({ method: 'GET', path: base, query: { ...params } });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `${base}/${(0, request_1.enc)(id)}` });
+        },
+        /** Upload part `part` (1-based) of the sealed bundle text. */
+        uploadPart(id, part, data) {
+            return request({ method: 'PUT', path: `${base}/${(0, request_1.enc)(id)}/parts/${part}`, body: { data } });
+        },
+        /** Close the upload; Atlas checks the key and runs the dry run. */
+        finalize(id) {
+            return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/finalize` });
+        },
+        /** Run the dry run again, optionally with new options. */
+        dryRun(id, body = {}) {
+            return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/dry_run`, body });
+        },
+        /** Import (or resume). Pass confirm_conflicts when the dry run reported conflicts. */
+        apply(id, body = {}) {
+            return request({ method: 'POST', path: `${base}/${(0, request_1.enc)(id)}/apply`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `${base}/${(0, request_1.enc)(id)}` });
+        },
+        /** Better Auth JWT keys published in the instance JWKS for the cutover. */
+        listJwks() {
+            return request({ method: 'GET', path: `${base}/jwks` });
+        },
+        deleteJwk(kid) {
+            return request({ method: 'DELETE', path: `${base}/jwks/${(0, request_1.enc)(kid)}` });
+        },
+        /** Create an import, upload the sealed bundle text in parts and finalize it. */
+        async upload(bundleText, opts = {}) {
+            const parts = splitBundleParts(bundleText, opts.partBytes);
+            if (parts.length === 0)
+                throw new Error('The bundle is empty.');
+            const created = await self.create(opts.options ? { options: opts.options } : {});
+            for (let i = 0; i < parts.length; i++) {
+                await self.uploadPart(created.id, i + 1, parts[i]);
+                opts.onPart?.(i + 1, parts.length);
+            }
+            return self.finalize(created.id);
+        },
+        /** Poll until the import leaves analyzing / queued / applying. */
+        async waitFor(id, opts = {}) {
+            const sleep = opts.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+            const deadline = Date.now() + (opts.timeoutMs ?? 6 * 3600_000);
+            for (;;) {
+                const imp = await self.get(id);
+                opts.onProgress?.(imp);
+                if (TERMINAL.includes(imp.status) || imp.status === 'uploading')
+                    return imp;
+                if (Date.now() > deadline)
+                    throw new Error(`Timed out waiting for Better Auth import ${id} (status ${imp.status}).`);
+                await sleep(opts.intervalMs ?? 2000);
+            }
+        },
+    };
+    return self;
+}
+//# sourceMappingURL=better-auth-imports.js.map

package/dist/client/better-auth-imports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"better-auth-imports.js","sourceRoot":"","sources":["../../src/client/better-auth-imports.ts"],"names":[],"mappings":";;;AAgIA,4CAkBC;AAID,8DA6EC;AAnOD,uCAAgD;AA4HhD,4FAA4F;AAC/E,QAAA,6BAA6B,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE7D,yEAAyE;AACzE,SAAgB,gBAAgB,CAAC,IAAY,EAAE,QAAQ,GAAG,qCAA6B;IACrF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAa,EAAE,CAAC;IAC3B,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QACvC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,GAAG,QAAQ,EAAE,CAAC;YACpC,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,CAAC,CAAC;QACX,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,IAAI,CAAC,CAAC;IACZ,CAAC;IACD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,QAAQ,GAAsC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AAEhG,SAAgB,yBAAyB,CAAC,OAAkB;IAC1D,MAAM,IAAI,GAAG,yBAAyB,CAAC;IACvC,MAAM,IAAI,GAAG;QACX,qDAAqD;QACrD,YAAY;YACV,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,gFAAgF;QAChF,eAAe;YACb,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,OAA8C,EAAE,EAAE,cAAuB;YAC9E,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,CAAC,SAAuB,EAAE;YAC5B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,8DAA8D;QAC9D,UAAU,CAAC,EAAU,EAAE,IAAY,EAAE,IAAY;YAC/C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;QACD,mEAAmE;QACnE,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,0DAA0D;QAC1D,MAAM,CAAC,EAAU,EAAE,OAA8C,EAAE;YACjE,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/E,CAAC;QACD,sFAAsF;QACtF,KAAK,CAAC,EAAU,EAAE,OAAwC,EAAE;YAC1D,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,IAAI,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACnE,CAAC;QACD,2EAA2E;QAC3E,QAAQ;YACN,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,IAAI,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;QACD,SAAS,CAAC,GAAW;YACnB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,SAAS,IAAA,aAAG,EAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,gFAAgF;QAChF,KAAK,CAAC,MAAM,CACV,UAAkB,EAClB,OAA4G,EAAE;YAE9G,MAAM,KAAK,GAAG,gBAAgB,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YAChE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjF,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,MAAM,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC;gBACpD,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YACrC,CAAC;YACD,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACnC,CAAC;QACD,kEAAkE;QAClE,KAAK,CAAC,OAAO,CACX,EAAU,EACV,OAAyI,EAAE;YAE3I,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YAC1F,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;YAC/D,SAAS,CAAC;gBACR,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC/B,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC;gBACvB,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;oBAAE,OAAO,GAAG,CAAC;gBAC5E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,EAAE,YAAY,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;gBACrH,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;KACF,CAAC;IACF,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/client/index.d.ts

@@ -973,6 +973,51 @@ declare function buildNamespaces(request: RequestFn): {
         getJob(id: string): Promise<import("./import-export").Job>;
         getJobErrors(id: string): Promise<import("./types").ListPage<import("./import-export").JobError>>;
     };
+    betterAuthImports: {
+        getPublicKey(): Promise<import("./better-auth-imports").BetterAuthImportKey>;
+        rotatePublicKey(): Promise<import("./better-auth-imports").BetterAuthImportKey>;
+        create(body?: {
+            options?: import("./better-auth-imports").BetterAuthImportOptions;
+        }, idempotencyKey?: string): Promise<import("./better-auth-imports").BetterAuthImport>;
+        list(params?: import("./types").CursorParams): Promise<import("./types").CursorPage<import("./better-auth-imports").BetterAuthImport>>;
+        get(id: string): Promise<import("./better-auth-imports").BetterAuthImport>;
+        uploadPart(id: string, part: number, data: string): Promise<{
+            object: "better_auth_import_part";
+            import_id: string;
+            part: number;
+            bytes: number;
+            sha256: string;
+        }>;
+        finalize(id: string): Promise<import("./better-auth-imports").BetterAuthImport>;
+        dryRun(id: string, body?: {
+            options?: import("./better-auth-imports").BetterAuthImportOptions;
+        }): Promise<import("./better-auth-imports").BetterAuthImport>;
+        apply(id: string, body?: {
+            confirm_conflicts?: boolean;
+        }): Promise<import("./better-auth-imports").BetterAuthImport>;
+        delete(id: string): Promise<{
+            object: "better_auth_import";
+            id: string;
+            deleted: true;
+        }>;
+        listJwks(): Promise<import("./types").CursorPage<import("./better-auth-imports").ImportedJwk>>;
+        deleteJwk(kid: string): Promise<{
+            object: "imported_jwk";
+            kid: string;
+            deleted: true;
+        }>;
+        upload(bundleText: string, opts?: {
+            options?: import("./better-auth-imports").BetterAuthImportOptions;
+            partBytes?: number;
+            onPart?: (n: number, of: number) => void;
+        }): Promise<import("./better-auth-imports").BetterAuthImport>;
+        waitFor(id: string, opts?: {
+            intervalMs?: number;
+            timeoutMs?: number;
+            onProgress?: (imp: import("./better-auth-imports").BetterAuthImport) => void;
+            sleep?: (ms: number) => Promise<void>;
+        }): Promise<import("./better-auth-imports").BetterAuthImport>;
+    };
     dataSubjectRequests: {
         create(body: import("./data-subject-requests").CreateDataSubjectRequestBody, idempotencyKey?: string): Promise<import("./data-subject-requests").DataSubjectRequest>;
         cancel(id: string): Promise<import("./data-subject-requests").DataSubjectRequest>;
@@ -1494,6 +1539,7 @@ export * from './action-gallery';
 export * from './billing-plans';
 export * from './messaging';
 export * from './import-export';
+export * from './better-auth-imports';
 export * from './data-subject-requests';
 export * from './radius-clients';
 export * from './lti-platforms';

package/dist/client/index.js

@@ -57,6 +57,7 @@ const action_gallery_1 = require("./action-gallery");
 const billing_plans_1 = require("./billing-plans");
 const messaging_1 = require("./messaging");
 const import_export_1 = require("./import-export");
+const better_auth_imports_1 = require("./better-auth-imports");
 const data_subject_requests_1 = require("./data-subject-requests");
 const radius_clients_1 = require("./radius-clients");
 const lti_platforms_1 = require("./lti-platforms");
@@ -151,6 +152,8 @@ function buildNamespaces(request) {
         billing: (0, billing_plans_1.billingResource)(request),
         messaging: (0, messaging_1.messagingResource)(request),
         importExport: (0, import_export_1.importExportResource)(request),
+        // Migrate from Better Auth: sealed-bundle upload, dry run and resumable apply.
+        betterAuthImports: (0, better_auth_imports_1.betterAuthImportsResource)(request),
         dataSubjectRequests: (0, data_subject_requests_1.dataSubjectRequestsResource)(request),
         radiusClients: (0, radius_clients_1.radiusClientsResource)(request),
         ltiPlatforms: (0, lti_platforms_1.ltiPlatformsResource)(request),
@@ -247,6 +250,7 @@ __exportStar(require("./action-gallery"), exports);
 __exportStar(require("./billing-plans"), exports);
 __exportStar(require("./messaging"), exports);
 __exportStar(require("./import-export"), exports);
+__exportStar(require("./better-auth-imports"), exports);
 __exportStar(require("./data-subject-requests"), exports);
 __exportStar(require("./radius-clients"), exports);
 __exportStar(require("./lti-platforms"), exports);

package/dist/client/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAiFA,8CAQC;AAzFD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/client/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAkFA,8CAQC;AA1FD,uCAA6F;AAC7F,mCAAwC;AACxC,yCAA8C;AAC9C,mDAAwD;AACxD,mCAA6D;AAC7D,mDAAuD;AACvD,yDAA6D;AAC7D,uDAA2D;AAC3D,+CAAmD;AACnD,uCAA4C;AAC5C,yCAA8C;AAC9C,iDAAsE;AACtE,2DAA+D;AAC/D,iDAAqD;AACrD,+CAAoD;AACpD,yCAA8C;AAC9C,qDAAwD;AACxD,6CAAiD;AACjD,mDAAuD;AACvD,yCAA6C;AAC7C,2CAA+C;AAC/C,yCAA8C;AAC9C,uDAA2D;AAC3D,qDAAyD;AACzD,2DAA+D;AAC/D,+BAAoC;AACpC,6CAAuD;AACvD,qDAAwD;AACxD,+CAAmD;AACnD,iDAAqD;AACrD,+CAAmD;AACnD,+CAAmD;AACnD,yCAA8C;AAC9C,uDAA2D;AAC3D,mDAAuD;AACvD,mDAAwD;AACxD,uCAA4C;AAC5C,qDAAkF;AAClF,mDAAkD;AAClD,2CAAgD;AAChD,mDAAuD;AACvD,+DAAkE;AAClE,mEAAsE;AACtE,qDAAyD;AACzD,mDAAuD;AACvD,yCAA8C;AAC9C,2DAA+D;AAC/D,2CAAgD;AAChD,6CAAiD;AACjD,qCAA0C;AAC1C,uCAA4C;AAC5C,qCAA0C;AAC1C,mEAAuE;AACvE,iEAAoE;AACpE,iFAAoF;AACpF,uDAA2D;AAC3D,uCAA4C;AAC5C,6CAAkD;AAClD,qEAAwE;AACxE,mDAAwD;AACxD,iDAAqD;AACrD,yCAAoF;AACpF,uEAA0E;AAC1E,+BAAoC;AACpC,+BAA0D;AAC1D,+CAA6D;AAC7D,mDAAuD;AACvD,mEAAsE;AACtE,uCAA4C;AAC5C,2CAA+C;AAC/C,+CAAoD;AAGpD;;;;;;;;GAQG;AACH,SAAgB,iBAAiB,CAAC,MAAyB;IACzD,MAAM,OAAO,GAAG,IAAA,uBAAa,EAAC,MAAM,CAAC,CAAC;IACtC,OAAO;QACL,GAAG,eAAe,CAAC,OAAO,CAAC;QAC3B,WAAW,CAAC,SAA+B;YACzC,OAAO,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,SAAS,EAAE,CAAC,CAAC;QACxD,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,OAAkB;IACzC,OAAO;QACL,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,KAAK,EAAE,IAAA,qBAAa,EAAC,OAAO,CAAC;QAC7B,WAAW,EAAE,IAAA,2BAAmB,EAAC,OAAO,CAAC;QACzC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,eAAe,EAAE,IAAA,0CAAuB,EAAC,OAAO,CAAC;QACjD,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,SAAS,EAAE,IAAA,gCAAiB,EAAC,OAAO,CAAC;QACrC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,OAAO,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC;QACjC,wDAAwD;QACxD,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,8EAA8E;QAC9E,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,eAAe,EAAE,IAAA,oCAAuB,EAAC,OAAO,CAAC;QACjD,YAAY,EAAE,IAAA,qCAAoB,EAAC,OAAO,CAAC;QAC3C,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,UAAU,EAAE,IAAA,gCAAkB,EAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,eAAe,EAAE,IAAA,wCAAuB,EAAC,OAAO,CAAC;QACjD,OAAO,EAAE,IAAA,+BAAe,EAAC,OAAO,CAAC;QACjC,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,+EAA+E;QAC/E,iBAAiB,EAAE,IAAA,+CAAyB,EAAC,OAAO,CAAC;QACrD,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,aAAa,EAAE,IAAA,sCAAqB,EAAC,OAAO,CAAC;QAC7C,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,QAAQ,EAAE,IAAA,2BAAgB,EAAC,OAAO,CAAC;QACnC,gBAAgB,EAAE,IAAA,4CAAwB,EAAC,OAAO,CAAC;QACnD,kFAAkF;QAClF,SAAS,EAAE,IAAA,6BAAiB,EAAC,OAAO,CAAC;QACrC,yEAAyE;QACzE,SAAS,EAAE,IAAA,8BAAiB,EAAC,OAAO,CAAC;QACrC,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,0EAA0E;QAC1E,6EAA6E;QAC7E,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,+EAA+E;QAC/E,MAAM,EAAE,IAAA,uBAAc,EAAC,OAAO,CAAC;QAC/B,oBAAoB,EAAE,IAAA,oDAA4B,EAAC,OAAO,CAAC;QAC3D,kBAAkB,EAAE,IAAA,iDAA0B,EAAC,OAAO,CAAC;QACvD,0BAA0B,EAAE,IAAA,iEAAkC,EAAC,OAAO,CAAC;QACvE,cAAc,EAAE,IAAA,wCAAsB,EAAC,OAAO,CAAC;QAC/C,gDAAgD;QAChD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,UAAU,EAAE,IAAA,+BAAkB,EAAC,OAAO,CAAC;QACvC,oBAAoB,EAAE,IAAA,qDAA4B,EAAC,OAAO,CAAC;QAC3D,aAAa,EAAE,IAAA,qCAAqB,EAAC,OAAO,CAAC;QAC7C,0EAA0E;QAC1E,WAAW,EAAE,IAAA,kCAAmB,EAAC,OAAO,CAAC;QACzC,MAAM,EAAE,IAAA,yBAAc,EAAC,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAA,wBAAa,EAAC,OAAO,CAAC;QAC7B,eAAe,EAAE,IAAA,kCAAuB,EAAC,OAAO,CAAC;QACjD,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,GAAG,EAAE,IAAA,iBAAW,EAAC,OAAO,CAAC;QACzB,YAAY,EAAE,IAAA,0BAAoB,EAAC,OAAO,CAAC;QAC3C,oBAAoB,EAAE,IAAA,0CAA4B,EAAC,OAAO,CAAC;QAC3D,YAAY,EAAE,IAAA,oCAAoB,EAAC,OAAO,CAAC;QAC3C,mBAAmB,EAAE,IAAA,mDAA2B,EAAC,OAAO,CAAC;QACzD,OAAO,EAAE,IAAA,yBAAe,EAAC,OAAO,CAAC;QACjC,sFAAsF;QACtF,QAAQ,EAAE,IAAA,4BAAgB,EAAC,OAAO,CAAC;QACnC,WAAW,EAAE,IAAA,iCAAmB,EAAC,OAAO,CAAC;QACzC,wEAAwE;QACxE,qBAAqB,EAAE,IAAA,uDAA6B,EAAC,OAAO,CAAC;KAC9D,CAAC;AACJ,CAAC;AAoBD,qCAA4C;AAAnC,0GAAA,eAAe,OAAA;AACxB,iCAA+D;AAAtD,wGAAA,eAAe,OAAA;AACxB,uCAAuD;AAA9C,qHAAA,yBAAyB,OAAA;AAElC,iCAA6D;AAApD,sGAAA,aAAa,OAAA;AACtB,uCAA+C;AAAtC,oGAAA,QAAQ,OAAA;AAAE,mGAAA,OAAO,OAAA;AAE1B,oEAAoE;AACpE,0CAAwB;AACxB,0CAAwB;AACxB,6CAA2B;AAC3B,kDAAgC;AAChC,0CAAwB;AACxB,8CAA4B;AAC5B,kDAAgC;AAChC,qDAAmC;AACnC,oDAAkC;AAClC,gDAA8B;AAC9B,4CAA0B;AAC1B,6CAA2B;AAC3B,iDAA+B;AAC/B,sDAAoC;AACpC,iDAA+B;AAC/B,gDAA8B;AAC9B,6CAA2B;AAC3B,mDAAiC;AACjC,+CAA6B;AAC7B,kDAAgC;AAChC,6CAA2B;AAC3B,6CAA2B;AAC3B,oDAAkC;AAClC,mDAAiC;AACjC,sDAAoC;AACpC,wCAAsB;AACtB,+CAA6B;AAC7B,mDAAiC;AACjC,gDAA8B;AAC9B,iDAA+B;AAC/B,gDAA8B;AAC9B,gDAA8B;AAC9B,6CAA2B;AAC3B,oDAAkC;AAClC,kDAAgC;AAChC,kDAAgC;AAChC,4CAA0B;AAC1B,mDAAiC;AACjC,kDAAgC;AAChC,8CAA4B;AAC5B,kDAAgC;AAChC,wDAAsC;AACtC,0DAAwC;AACxC,mDAAiC;AACjC,kDAAgC;AAChC,6CAA2B;AAC3B,sDAAoC;AACpC,8CAA4B;AAC5B,+CAA6B;AAC7B,2CAAyB;AACzB,4CAA0B;AAC1B,2CAAyB;AACzB,0DAAwC;AACxC,yDAAuC;AACvC,iEAA+C;AAC/C,oDAAkC;AAClC,4CAA0B;AAC1B,+CAA6B;AAC7B,2DAAyC;AACzC,kDAAgC;AAChC,iDAA+B;AAC/B,6CAA2B;AAC3B,wCAAsB;AACtB,wCAAsB;AACtB,gDAA8B;AAC9B,kDAAgC;AAChC,0DAAwC;AACxC,4CAA0B;AAC1B,8CAA4B;AAC5B,gDAA8B;AAC9B,4DAA0C;AAC1C,6CAA2B"}

package/dist/index.d.ts

@@ -3,6 +3,9 @@ export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishab
 export * from './verify';
 export * from './access-control';
 export * from './handshake';
+export * from './better-auth';
+export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
+export type { LegacyIssuer } from './legacy-issuers';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { AtlasOidcError, OIDC_FLOW_COOKIE, OIDC_FLOW_MAX_AGE_SECONDS, oidc, oidcCallback, oidcClearCookie, oidcLogoutUrl, oidcStart, oidcVerifyIdToken, resetOidcCaches, } from './oidc';

package/dist/index.js

@@ -14,7 +14,7 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLY_API_VERSION = exports.referralEmailHash = exports.referallySignature = exports.signReferralUpdatedEvent = exports.signReferallyCall = exports.signAtlasReferralCall = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -26,6 +26,11 @@ Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: tru
 __exportStar(require("./verify"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
+// Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.
+__exportStar(require("./better-auth"), exports);
+var legacy_issuers_1 = require("./legacy-issuers");
+Object.defineProperty(exports, "BETTER_AUTH_JWT_ALGS", { enumerable: true, get: function () { return legacy_issuers_1.BETTER_AUTH_JWT_ALGS; } });
+Object.defineProperty(exports, "peekIssuer", { enumerable: true, get: function () { return legacy_issuers_1.peekIssuer; } });
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAE5B,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;AAAA,6DAA6D;AAC7D,+CAA6B;AAC7B,mEAAmE;AACnE,yCAA2G;AAAlG,2GAAA,cAAc,OAAA;AAAE,0GAAA,aAAa,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,yHAAA,4BAA4B,OAAA;AACrF,2CAAyB;AACzB,mDAAiC;AACjC,8CAA4B;AAC5B,2FAA2F;AAC3F,gDAA8B;AAC9B,mDAAoE;AAA3D,sHAAA,oBAAoB,OAAA;AAAE,4GAAA,UAAU,OAAA;AAGzC,6EAA6E;AAC7E,+CAOwB;AANtB,wHAAA,wBAAwB,OAAA;AACxB,+HAAA,+BAA+B,OAAA;AAC/B,4HAAA,4BAA4B,OAAA;AAC5B,mHAAA,mBAAmB,OAAA;AACnB,uHAAA,uBAAuB,OAAA;AACvB,iHAAA,iBAAiB,OAAA;AAUnB,sEAAsE;AACtE,iFAAiF;AACjF,+BAWgB;AAVd,sGAAA,cAAc,OAAA;AACd,wGAAA,gBAAgB,OAAA;AAChB,iHAAA,yBAAyB,OAAA;AACzB,4FAAA,IAAI,OAAA;AACJ,oGAAA,YAAY,OAAA;AACZ,uGAAA,eAAe,OAAA;AACf,qGAAA,aAAa,OAAA;AACb,iGAAA,SAAS,OAAA;AACT,yGAAA,iBAAiB,OAAA;AACjB,uGAAA,eAAe,OAAA;AAcjB,oDAAoD;AACpD,6CAA2B;AAE3B,uFAAuF;AACvF,8CAA4B;AAE5B,0FAA0F;AAC1F,0CAAwB;AAExB,8DAA8D;AAC9D,mCAA6C;AAApC,2GAAA,iBAAiB,OAAA;AAE1B,2CAAyB;AAEzB,yEAAyE;AACzE,2EAA2E;AAC3E,iEAAiE;AACjE,qCAAiE;AAAxD,2GAAA,gBAAgB,OAAA;AAAE,6GAAA,kBAAkB,OAAA;AAS7C,6DAO+B;AAN7B,4HAAA,qBAAqB,OAAA;AACrB,wHAAA,iBAAiB,OAAA;AACjB,+HAAA,wBAAwB,OAAA;AACxB,yHAAA,kBAAkB,OAAA;AAClB,wHAAA,iBAAiB,OAAA;AACjB,4HAAA,qBAAqB,OAAA;AAWvB,wFAAwF;AACxF,2CAA2C;AAC3C,uCAA4C;AAAnC,sGAAA,YAAY,OAAA;AAErB,iDAA+E;AAAtE,yGAAA,UAAU,OAAA;AAAE,6GAAA,cAAc,OAAA;AAAE,6GAAA,cAAc,OAAA;AAGnD,8EAA8E;AAC9E,gFAAgF;AAChF,mDAY0B;AAXxB,iIAAA,+BAA+B,OAAA;AAC/B,4HAAA,0BAA0B,OAAA;AAC1B,sHAAA,oBAAoB,OAAA;AACpB,2HAAA,yBAAyB,OAAA;AACzB,oHAAA,kBAAkB,OAAA;AAClB,qHAAA,mBAAmB,OAAA;AACnB,uHAAA,qBAAqB,OAAA;AACrB,uHAAA,qBAAqB,OAAA;AACrB,2HAAA,yBAAyB,OAAA;AACzB,+HAAA,6BAA6B,OAAA;AAC7B,mHAAA,iBAAiB,OAAA"}

package/dist/legacy-issuers.d.ts

@@ -0,0 +1,65 @@
+import { type Jwks } from './jwks-cache';
+/**
+ * Accepting your OLD auth provider's JWTs during a cutover — today, Better
+ * Auth's `jwt` plugin tokens.
+ *
+ * When you move to Atlas, API clients may still hold short-lived JWTs your
+ * Better Auth app minted. With `legacyIssuers` on an {@link AtlasBackend}, a
+ * token whose `iss` is one of these issuers is verified against THAT issuer's
+ * key set (the JWKS you imported into Atlas, or the old app's `/api/auth/jwks`)
+ * for a bounded window, and its `sub` (the Better Auth user id) is mapped to the
+ * Atlas user id — Atlas keeps the Better Auth id as the user's `external_id`.
+ * After `until`, those tokens are refused like any other foreign token.
+ */
+export interface LegacyIssuer {
+    /** The old provider. Only `better_auth` today. */
+    kind?: 'better_auth';
+    /** The `iss` the old tokens carry (Better Auth: its `baseURL`, unless `jwt.issuer` was set). */
+    issuer: string;
+    /** The imported key set. Exactly one of `jwks` / `jwksUrl`. */
+    jwks?: Jwks;
+    /** Where to fetch the old key set (e.g. `https://app.example.com/api/auth/jwks`). */
+    jwksUrl?: string;
+    /** Expected `aud` (Better Auth: its `baseURL`, unless `jwt.audience` was set). Unchecked when unset. */
+    audience?: string | readonly string[];
+    /** The end of the acceptance window. Required: a legacy issuer is never accepted forever. */
+    until: Date | string | number;
+    /** Signing algorithms to accept. Default: Better Auth's (EdDSA, ES256, ES512, RS256, PS256). */
+    algorithms?: readonly string[];
+    /**
+     * Map the old `sub` to the Atlas user id. Default: look the user up by
+     * `external_id` through the Backend API (needs `secretKey` + `bapiBaseUrl`
+     * on the backend), cached in memory. Return null to refuse the token.
+     */
+    resolveSubject?: (legacySub: string, claims: Record<string, unknown>) => Promise<string | null> | string | null;
+}
+/** Better Auth's `jwt` plugin key algorithms. */
+export declare const BETTER_AUTH_JWT_ALGS: string[];
+export interface LegacyVerifierDeps {
+    issuers: readonly LegacyIssuer[];
+    secretKey?: string;
+    bapiBaseUrl?: string;
+    fetchImpl?: typeof fetch;
+    now?: () => number;
+    clockToleranceSeconds: number;
+}
+export type LegacyVerifyOutcome = {
+    ok: true;
+    claims: Record<string, unknown>;
+} | {
+    ok: false;
+    reason: 'invalid' | 'no_keys';
+};
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+export declare function peekIssuer(token: string): string | undefined;
+export declare class LegacyIssuerVerifier {
+    private readonly deps;
+    private readonly caches;
+    private readonly subjects;
+    constructor(deps: LegacyVerifierDeps);
+    private get now();
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss: string | undefined): LegacyIssuer | undefined;
+    verify(token: string, entry: LegacyIssuer): Promise<LegacyVerifyOutcome>;
+    private resolve;
+}

package/dist/legacy-issuers.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LegacyIssuerVerifier = exports.BETTER_AUTH_JWT_ALGS = void 0;
+exports.peekIssuer = peekIssuer;
+const jose_1 = require("jose");
+const jwks_cache_1 = require("./jwks-cache");
+/** Better Auth's `jwt` plugin key algorithms. */
+exports.BETTER_AUTH_JWT_ALGS = ['EdDSA', 'ES256', 'ES512', 'RS256', 'PS256'];
+/** How long a resolved sub → Atlas id mapping is reused. */
+const SUBJECT_TTL_MS = 5 * 60_000;
+/** Cap on cached subjects, so a stream of distinct tokens can't grow memory without bound. */
+const SUBJECT_CACHE_MAX = 10_000;
+/** The unverified `iss` of a compact JWT, for routing only — never trusted on its own. */
+function peekIssuer(token) {
+    try {
+        const iss = (0, jose_1.decodeJwt)(token).iss;
+        return typeof iss === 'string' ? iss : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function untilMs(until) {
+    const t = until instanceof Date ? until.getTime() : typeof until === 'number' ? until : Date.parse(until);
+    return Number.isFinite(t) ? t : 0;
+}
+class LegacyIssuerVerifier {
+    deps;
+    caches = new Map();
+    subjects = new Map();
+    constructor(deps) {
+        this.deps = deps;
+        for (const entry of deps.issuers) {
+            const hasUrl = typeof entry.jwksUrl === 'string' && entry.jwksUrl.length > 0;
+            if (hasUrl === (entry.jwks !== undefined)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs exactly one of \`jwks\` or \`jwksUrl\`.`);
+            }
+            if (!entry.issuer)
+                throw new Error('legacyIssuers: every entry needs `issuer`.');
+            if (!untilMs(entry.until))
+                throw new Error(`legacyIssuers: "${entry.issuer}" needs a valid \`until\` (the end of the window).`);
+            if (!entry.resolveSubject && (!deps.secretKey || !deps.bapiBaseUrl)) {
+                throw new Error(`legacyIssuers: "${entry.issuer}" maps its \`sub\` to an Atlas user through the Backend API, which needs \`secretKey\` and \`bapiBaseUrl\` on AtlasBackend — or give the issuer a \`resolveSubject\`.`);
+            }
+            this.caches.set(entry.issuer, new jwks_cache_1.JwksCache({
+                url: hasUrl ? entry.jwksUrl : undefined,
+                staticJwks: entry.jwks,
+                fetchImpl: deps.fetchImpl,
+                now: deps.now,
+            }));
+        }
+    }
+    get now() {
+        return (this.deps.now ?? Date.now)();
+    }
+    /** The configured entry for this `iss`, when its window is still open. */
+    match(iss) {
+        if (!iss)
+            return undefined;
+        const entry = this.deps.issuers.find((e) => e.issuer === iss);
+        if (!entry)
+            return undefined;
+        return untilMs(entry.until) > this.now ? entry : undefined;
+    }
+    async verify(token, entry) {
+        const cache = this.caches.get(entry.issuer);
+        const keys = await cache.get((0, jwks_cache_1.readKid)(token));
+        if (!keys || keys.keys.length === 0)
+            return { ok: false, reason: 'no_keys' };
+        let payload;
+        try {
+            const verified = await (0, jose_1.jwtVerify)(token, (0, jose_1.createLocalJWKSet)(keys), {
+                algorithms: [...(entry.algorithms ?? exports.BETTER_AUTH_JWT_ALGS)],
+                issuer: entry.issuer,
+                ...(entry.audience !== undefined ? { audience: entry.audience } : {}),
+                clockTolerance: this.deps.clockToleranceSeconds,
+                currentDate: this.deps.now ? new Date(this.deps.now()) : undefined,
+            });
+            payload = verified.payload;
+        }
+        catch {
+            return { ok: false, reason: 'invalid' };
+        }
+        // A legacy token without an expiry would outlive the window it is accepted in.
+        if (typeof payload.exp !== 'number')
+            return { ok: false, reason: 'invalid' };
+        const legacySub = typeof payload.sub === 'string' && payload.sub ? payload.sub : typeof payload.id === 'string' ? payload.id : '';
+        if (!legacySub)
+            return { ok: false, reason: 'invalid' };
+        const atlasId = await this.resolve(legacySub, payload, entry);
+        if (!atlasId)
+            return { ok: false, reason: 'invalid' };
+        return {
+            ok: true,
+            claims: {
+                ...payload,
+                sub: atlasId,
+                sid: typeof payload.sid === 'string' ? payload.sid : '',
+                external_id: legacySub,
+                legacy: { kind: entry.kind ?? 'better_auth', issuer: entry.issuer, sub: legacySub },
+            },
+        };
+    }
+    async resolve(legacySub, claims, entry) {
+        if (entry.resolveSubject) {
+            try {
+                return (await entry.resolveSubject(legacySub, claims)) || null;
+            }
+            catch {
+                return null;
+            }
+        }
+        const key = `${entry.issuer}\u0000${legacySub}`;
+        const hit = this.subjects.get(key);
+        if (hit && this.now - hit.at < SUBJECT_TTL_MS)
+            return hit.id;
+        let id = null;
+        try {
+            const url = new URL('/v1/users', this.deps.bapiBaseUrl);
+            url.searchParams.set('external_id', legacySub);
+            url.searchParams.set('limit', '1');
+            const res = await (this.deps.fetchImpl ?? fetch)(url.toString(), {
+                headers: { authorization: `Bearer ${this.deps.secretKey}` },
+            });
+            if (!res.ok)
+                return null; // not cached: a transient failure should not stick
+            const body = (await res.json());
+            id = body.data?.[0]?.id ?? null;
+        }
+        catch {
+            return null;
+        }
+        if (this.subjects.size >= SUBJECT_CACHE_MAX)
+            this.subjects.clear();
+        this.subjects.set(key, { id, at: this.now });
+        return id;
+    }
+}
+exports.LegacyIssuerVerifier = LegacyIssuerVerifier;
+//# sourceMappingURL=legacy-issuers.js.map

package/dist/legacy-issuers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"legacy-issuers.js","sourceRoot":"","sources":["../src/legacy-issuers.ts"],"names":[],"mappings":";;;AA4DA,gCAOC;AAnED,+BAA+D;AAC/D,6CAA6D;AAqC7D,iDAAiD;AACpC,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAElF,4DAA4D;AAC5D,MAAM,cAAc,GAAG,CAAC,GAAG,MAAM,CAAC;AAClC,8FAA8F;AAC9F,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAejC,0FAA0F;AAC1F,SAAgB,UAAU,CAAC,KAAa;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAA,gBAAS,EAAC,KAAK,CAAC,CAAC,GAAG,CAAC;QACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,OAAO,CAAC,KAA4B;IAC3C,MAAM,CAAC,GAAG,KAAK,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC1G,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpC,CAAC;AAED,MAAa,oBAAoB;IAIF;IAHZ,MAAM,GAAG,IAAI,GAAG,EAAqB,CAAC;IACtC,QAAQ,GAAG,IAAI,GAAG,EAA6C,CAAC;IAEjF,YAA6B,IAAwB;QAAxB,SAAI,GAAJ,IAAI,CAAoB;QACnD,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;YAC7E,IAAI,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC1C,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,iDAAiD,CAAC,CAAC;YACpG,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;YACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,mBAAmB,KAAK,CAAC,MAAM,oDAAoD,CAAC,CAAC;YAChI,IAAI,CAAC,KAAK,CAAC,cAAc,IAAI,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBACpE,MAAM,IAAI,KAAK,CACb,mBAAmB,KAAK,CAAC,MAAM,uKAAuK,CACvM,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,MAAM,CAAC,GAAG,CACb,KAAK,CAAC,MAAM,EACZ,IAAI,sBAAS,CAAC;gBACZ,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;gBACvC,UAAU,EAAE,KAAK,CAAC,IAAI;gBACtB,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,EAAE,IAAI,CAAC,GAAG;aACd,CAAC,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAY,GAAG;QACb,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,GAAuB;QAC3B,IAAI,CAAC,GAAG;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC;QAC9D,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,KAAa,EAAE,KAAmB;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAE,CAAC;QAC7C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAA,oBAAO,EAAC,KAAK,CAAC,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,IAAI,OAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAA,gBAAS,EAAC,KAAK,EAAE,IAAA,wBAAiB,EAAC,IAAa,CAAC,EAAE;gBACxE,UAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,4BAAoB,CAAC,CAAC;gBAC3D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,GAAG,CAAC,KAAK,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,QAA6B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC1F,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,qBAAqB;gBAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;aACnE,CAAC,CAAC;YACH,OAAO,GAAG,QAAQ,CAAC,OAAkC,CAAC;QACxD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC1C,CAAC;QACD,+EAA+E;QAC/E,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAE7E,MAAM,SAAS,GAAG,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClI,IAAI,CAAC,SAAS;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QACxD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9D,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAEtD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE;gBACN,GAAG,OAAO;gBACV,GAAG,EAAE,OAAO;gBACZ,GAAG,EAAE,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE;gBACvD,WAAW,EAAE,SAAS;gBACtB,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE;aACpF;SACF,CAAC;IACJ,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,MAA+B,EAAE,KAAmB;QAC3F,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,KAAK,CAAC,cAAc,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,IAAI,IAAI,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,MAAM,SAAS,SAAS,EAAE,CAAC;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,GAAG,cAAc;YAAE,OAAO,GAAG,CAAC,EAAE,CAAC;QAE7D,IAAI,EAAE,GAAkB,IAAI,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAY,CAAC,CAAC;YACzD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC;YAC/C,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;YACnC,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;gBAC/D,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,SAAU,EAAE,EAAE;aAC7D,CAAC,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC,CAAC,mDAAmD;YAC7E,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;YACrE,EAAE,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,IAAI,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,iBAAiB;YAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACnE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC7C,OAAO,EAAE,CAAC;IACZ,CAAC;CACF;AA7GD,oDA6GC"}

package/dist/verify.d.ts

@@ -17,6 +17,7 @@ export interface AtlasBackendOidc {
     clearCookie: typeof oidcClearCookie;
 }
 export { type AuthzClaims, type ProtectCondition, type ProtectOutcome, type ProtectReason, evaluate, hasFromClaims, protectFromClaims, ForbiddenError, isRoleKey, isPermissionKey, } from '@atlasauth/authz';
+import { type LegacyIssuer } from './legacy-issuers';
 /**
  * §7.3 verification by customer backends.
  *
@@ -89,6 +90,16 @@ export interface SessionClaims {
      * `email` under the same opt-in, and only when the user carries one.
      */
     external_id?: string;
+    /**
+     * Present ONLY on a token accepted through `legacyIssuers` (a cutover from
+     * another provider): which issuer minted it and the subject it carried there.
+     * `sub` is already the Atlas user id.
+     */
+    legacy?: {
+        kind: string;
+        issuer: string;
+        sub: string;
+    };
     [claim: string]: unknown;
 }
 /**
@@ -175,10 +186,21 @@ export interface AtlasBackendOptions {
     bapiBaseUrl?: string;
     fetchImpl?: typeof fetch;
     now?: () => number;
+    /**
+     * Cutover from another auth provider (Better Auth): ALSO accept JWTs from
+     * these issuers until each one's `until`, verified against that issuer's own
+     * key set, with `sub` mapped to the Atlas user id (the old id is the user's
+     * `external_id`; mapped through the Backend API unless the issuer has a
+     * `resolveSubject`). The verified claims carry `sub` = the Atlas user id,
+     * `external_id` = the old id and `legacy` = `{ kind, issuer, sub }`, so code
+     * that needs to tell the two apart can. Atlas tokens are unaffected.
+     */
+    legacyIssuers?: readonly LegacyIssuer[];
 }
 export declare class AtlasBackend {
     private readonly options;
     private readonly jwks;
+    private readonly legacy?;
     /**
      * The server-side OIDC relying party (hosted-redirect sign-in) for this
      * instance: `start`, `callback`, `logoutUrl`, `verifyIdToken`. `issuer`,

package/dist/verify.js

@@ -24,6 +24,7 @@ Object.defineProperty(exports, "ForbiddenError", { enumerable: true, get: functi
 Object.defineProperty(exports, "isRoleKey", { enumerable: true, get: function () { return authz_2.isRoleKey; } });
 Object.defineProperty(exports, "isPermissionKey", { enumerable: true, get: function () { return authz_2.isPermissionKey; } });
 const algs_1 = require("./algs");
+const legacy_issuers_1 = require("./legacy-issuers");
 /**
  * §7.3 verification by customer backends.
  *
@@ -64,6 +65,7 @@ function authorized(claims) {
 class AtlasBackend {
     options;
     jwks;
+    legacy;
     /**
      * The server-side OIDC relying party (hosted-redirect sign-in) for this
      * instance: `start`, `callback`, `logoutUrl`, `verifyIdToken`. `issuer`,
@@ -110,6 +112,19 @@ class AtlasBackend {
             verifyIdToken: (token, o) => (0, oidc_1.oidcVerifyIdToken)(token, bind(o)),
             clearCookie: oidc_1.oidcClearCookie,
         };
+        if (options.legacyIssuers && options.legacyIssuers.length > 0) {
+            if (options.legacyIssuers.some((l) => l.issuer === options.issuer)) {
+                throw new Error('AtlasBackend: a legacy issuer cannot be the Atlas `issuer` itself.');
+            }
+            this.legacy = new legacy_issuers_1.LegacyIssuerVerifier({
+                issuers: options.legacyIssuers,
+                secretKey: options.secretKey,
+                bapiBaseUrl: options.bapiBaseUrl,
+                fetchImpl: options.fetchImpl,
+                now: options.now,
+                clockToleranceSeconds: exports.CLOCK_SKEW_SECONDS,
+            });
+        }
         this.jwks = new jwks_cache_1.JwksCache({
             url: hasUrl ? options.jwksUrl : undefined,
             staticJwks: options.jwks,
@@ -137,6 +152,23 @@ class AtlasBackend {
     async verify(token) {
         if (!token || token.split('.').length !== 3)
             return { ok: false, reason: 'malformed' };
+        // A token from a configured legacy issuer (within its window) is verified
+        // against THAT issuer's keys only — never the Atlas keys, and an Atlas
+        // token never reaches the legacy path (the `iss` routes, the signature decides).
+        if (this.legacy) {
+            const entry = this.legacy.match((0, legacy_issuers_1.peekIssuer)(token));
+            if (entry) {
+                const outcome = await this.legacy.verify(token, entry);
+                if (!outcome.ok)
+                    return { ok: false, reason: outcome.reason };
+                const claims = outcome.claims;
+                if (this.options.authorizedParties?.length && claims.azp !== undefined) {
+                    if (!this.options.authorizedParties.includes(claims.azp))
+                        return { ok: false, reason: 'unauthorized_party' };
+                }
+                return authorized(claims);
+            }
+        }
         const keys = await this.jwks.get((0, jwks_cache_1.readKid)(token));
         if (!keys || keys.keys.length === 0) {
             return this.jwks.lastError