@atlasauth/backend 0.23.0 → 0.25.0

package/CHANGELOG.md

@@ -2,6 +2,20 @@
 
 ## Unreleased
 
+## 0.25.0 — 2026-10-26
+
+### Added
+
+- `mfaFactors` client resource for the additional authentication factors: `setYubicoSecret` / `removeYubicoSecret`, `setDuoSecret` / `removeDuoSecret` / `duoHealthCheck`, `setSmartCardSecret` / `removeSmartCardSecret` (all write-only), `yubikeys` (`list`, `register`, `remove`), `smartCardMappings` (`list`, `add`, `remove`) and `resetSecurityQuestions`.
+- `users.create({ mfa })` is typed (`ImportedMfa`): an authenticator (`totp`: SHA-1/256/512, 6 or 8 digits, 30 or 60 seconds) or a counter-based token (`hotp`), plus recovery codes.
+
+## 0.24.0 — 2026-10-25
+
+### Added
+
+- Moving from any auth vendor without signing anyone out: `createMigrationBridge` / `exchangeMigrationSession` (the vendor-neutral session bridge, `POST /v1/migrations/{source}/exchange`), per-vendor bridge presets (`listMigrationBridgePresets`, `resolveMigrationBridgePreset`, `registerMigrationBridgePreset`) for Auth0, Clerk, Cognito, Firebase, Supabase, WorkOS, Okta, Stytch, Keycloak, FusionAuth, Kinde, Descope, Frontegg and session-table sources, and an `extractToken` hook for vendor cookies encrypted with your app's secret. `createBetterAuthBridge` / `exchangeBetterAuthSession` now run on it, unchanged.
+- `migrations` client resource: `imports(source)` (`getPublicKey`, `rotatePublicKey`, `create`, `list`, `get`, `uploadPart`, `finalize`, `dryRun`, `apply`, `delete`, `upload`, `waitFor`), `bridge(source)` (`get`, `update`, `delete`) and `sources()`.
+
 ## 0.23.0 — 2026-10-25
 
 ### Added

package/dist/auth0-session.d.ts

@@ -0,0 +1,23 @@
+import type { MigrationTokenExtractor } from './migration-bridge';
+/**
+ * Open an Auth0 SDK session cookie on YOUR server, for the zero-logout bridge.
+ *
+ * nextjs-auth0 (v4 `__session`, v3 `appSession`) and express-openid-connect
+ * (`appSession`) keep the session in a JWE (`alg: dir`, `enc: A256GCM`) whose
+ * key is HKDF-SHA256(AUTH0_SECRET, salt "", info "JWE CEK", 32 bytes). Large
+ * sessions are split across `__session__0, __session__1…` (v4) or
+ * `appSession.0, appSession.1…` (v3, express-openid-connect). Inside is the
+ * ID token Auth0 issued at sign-in; the bridge exchanges that (preset `auth0`).
+ *
+ *   migrationBridge({ source: 'auth0', presetVars: { domain, client_id },
+ *     extractToken: auth0SessionTokenExtractor({ secret: process.env.AUTH0_SECRET! }) })
+ *
+ * The secret never leaves your server. Pass several secrets while one rotates.
+ */
+export declare function auth0SessionTokenExtractor(options: {
+    secret: string | readonly string[];
+    /** Cookie names to try, in order (default `__session`, then `appSession`). */
+    cookieNames?: readonly string[];
+}): MigrationTokenExtractor;
+/** HKDF-SHA256(secret, salt "", info "JWE CEK", 32): the Auth0 SDKs' cookie key. */
+export declare function auth0CookieKey(secret: string): Uint8Array;

package/dist/auth0-session.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.auth0SessionTokenExtractor = auth0SessionTokenExtractor;
+exports.auth0CookieKey = auth0CookieKey;
+const hkdf_1 = require("@noble/hashes/hkdf");
+const sha256_1 = require("@noble/hashes/sha256");
+const jose_1 = require("jose");
+/**
+ * Open an Auth0 SDK session cookie on YOUR server, for the zero-logout bridge.
+ *
+ * nextjs-auth0 (v4 `__session`, v3 `appSession`) and express-openid-connect
+ * (`appSession`) keep the session in a JWE (`alg: dir`, `enc: A256GCM`) whose
+ * key is HKDF-SHA256(AUTH0_SECRET, salt "", info "JWE CEK", 32 bytes). Large
+ * sessions are split across `__session__0, __session__1…` (v4) or
+ * `appSession.0, appSession.1…` (v3, express-openid-connect). Inside is the
+ * ID token Auth0 issued at sign-in; the bridge exchanges that (preset `auth0`).
+ *
+ *   migrationBridge({ source: 'auth0', presetVars: { domain, client_id },
+ *     extractToken: auth0SessionTokenExtractor({ secret: process.env.AUTH0_SECRET! }) })
+ *
+ * The secret never leaves your server. Pass several secrets while one rotates.
+ */
+function auth0SessionTokenExtractor(options) {
+    const secrets = (typeof options.secret === 'string' ? [options.secret] : [...options.secret]).filter(Boolean);
+    if (secrets.length === 0)
+        throw new Error('auth0SessionTokenExtractor: pass your AUTH0_SECRET.');
+    const keys = secrets.map(auth0CookieKey);
+    const names = options.cookieNames ?? ['__session', 'appSession'];
+    return async ({ cookies }) => {
+        for (const name of names) {
+            const value = readChunked(cookies, name);
+            // A JWE has five segments; Atlas's own `__session` is a JWT (three) and is skipped.
+            if (!value || value.split('.').length !== 5)
+                continue;
+            for (const key of keys) {
+                const token = await openSession(value, key);
+                if (token)
+                    return token;
+            }
+        }
+        return undefined;
+    };
+}
+/** HKDF-SHA256(secret, salt "", info "JWE CEK", 32): the Auth0 SDKs' cookie key. */
+function auth0CookieKey(secret) {
+    return (0, hkdf_1.hkdf)(sha256_1.sha256, new TextEncoder().encode(secret), new Uint8Array(0), new TextEncoder().encode('JWE CEK'), 32);
+}
+/** The cookie value, joined from `name__0…` / `name.0…` chunks when it was split. */
+function readChunked(cookies, name) {
+    if (cookies[name])
+        return cookies[name];
+    for (const sep of ['__', '.']) {
+        const parts = [];
+        for (let i = 0; cookies[`${name}${sep}${i}`] !== undefined; i++)
+            parts.push(cookies[`${name}${sep}${i}`]);
+        if (parts.length)
+            return parts.join('');
+    }
+    return undefined;
+}
+async function openSession(jwe, key) {
+    let payload;
+    try {
+        const { plaintext, protectedHeader } = await (0, jose_1.compactDecrypt)(jwe, key, { keyManagementAlgorithms: ['dir'], contentEncryptionAlgorithms: ['A256GCM'] });
+        // express-openid-connect / nextjs-auth0 put the session expiry in the header.
+        if (typeof protectedHeader.exp === 'number' && protectedHeader.exp * 1000 < Date.now())
+            return undefined;
+        payload = JSON.parse(new TextDecoder().decode(plaintext));
+    }
+    catch {
+        return undefined;
+    }
+    if (!payload || typeof payload !== 'object')
+        return undefined;
+    const p = payload;
+    // v4: tokenSet.idToken; v3: idToken; express-openid-connect: id_token.
+    const token = p.tokenSet?.idToken ?? p.idToken ?? p.id_token;
+    return typeof token === 'string' && token.split('.').length === 3 ? token : undefined;
+}
+//# sourceMappingURL=auth0-session.js.map

package/dist/auth0-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth0-session.js","sourceRoot":"","sources":["../src/auth0-session.ts"],"names":[],"mappings":";;AAoBA,gEAqBC;AAGD,wCAEC;AA9CD,6CAA0C;AAC1C,iDAA8C;AAC9C,+BAAsC;AAGtC;;;;;;;;;;;;;;GAcG;AACH,SAAgB,0BAA0B,CAAC,OAI1C;IACC,MAAM,OAAO,GAAG,CAAC,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9G,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACjE,OAAO,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACzC,oFAAoF;YACpF,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACtD,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC5C,IAAI,KAAK;oBAAE,OAAO,KAAK,CAAC;YAC1B,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC;AAED,oFAAoF;AACpF,SAAgB,cAAc,CAAC,MAAc;IAC3C,OAAO,IAAA,WAAI,EAAC,eAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC,CAAC;AACpH,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAAC,OAA+B,EAAE,IAAY;IAChE,IAAI,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,KAAK,MAAM,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAa,EAAE,CAAC;QAC3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS,EAAE,CAAC,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,GAAG,GAAG,GAAG,CAAC,EAAE,CAAE,CAAC,CAAC;QAC3G,IAAI,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAe;IACrD,IAAI,OAAgB,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,GAAG,MAAM,IAAA,qBAAc,EAAC,GAAG,EAAE,GAAG,EAAE,EAAE,uBAAuB,EAAE,CAAC,KAAK,CAAC,EAAE,2BAA2B,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACtJ,8EAA8E;QAC9E,IAAI,OAAO,eAAe,CAAC,GAAG,KAAK,QAAQ,IAAI,eAAe,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE;YAAE,OAAO,SAAS,CAAC;QACzG,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAY,CAAC;IACvE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9D,MAAM,CAAC,GAAG,OAAsF,CAAC;IACjG,uEAAuE;IACvE,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,EAAE,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,QAAQ,CAAC;IAC7D,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACxF,CAAC"}

package/dist/better-auth.d.ts

@@ -1,3 +1,4 @@
+import { type MigrationBridgeRequest } from './migration-bridge';
 /**
  * Moving from Better Auth to Atlas without signing anyone out.
  *
@@ -144,14 +145,9 @@ export type BetterAuthBridgeDecision =
  * The bridge as a function of a request's headers. Call it from middleware
  * before your normal auth check; it does nothing (no network) for a request
  * without a Better Auth cookie or with an Atlas session (`__session` /
- * `__atlas_rt`) already present.
+ * `__atlas_rt`) already present. The generic {@link createMigrationBridge} with
+ * the Better Auth cookie names.
  */
-export declare function createBetterAuthBridge(options: BetterAuthBridgeOptions): (request: {
-    headers: {
-        get(name: string): string | null;
-    } | Record<string, string | string[] | undefined>;
-    /** The end user's IP as your framework resolved it (forwarded on the secret-key path). */
-    ip?: string;
-}) => Promise<BetterAuthBridgeDecision>;
+export declare function createBetterAuthBridge(options: BetterAuthBridgeOptions): (request: MigrationBridgeRequest) => Promise<BetterAuthBridgeDecision>;
 /** Serialize a {@link BridgeCookie} as a `Set-Cookie` header value. */
 export declare function serializeBridgeCookie(cookie: BridgeCookie): string;

package/dist/better-auth.js

@@ -1,4 +1,12 @@
 "use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BETTER_AUTH_BAPI_EXCHANGE_PATH = exports.BETTER_AUTH_EXCHANGE_PATH = exports.BETTER_AUTH_COOKIE_PREFIX = void 0;
+exports.betterAuthCookieNames = betterAuthCookieNames;
+exports.readBetterAuthSessionCookie = readBetterAuthSessionCookie;
+exports.exchangeBetterAuthSession = exchangeBetterAuthSession;
+exports.createBetterAuthBridge = createBetterAuthBridge;
+exports.serializeBridgeCookie = serializeBridgeCookie;
+const migration_bridge_1 = require("./migration-bridge");
 /**
  * Moving from Better Auth to Atlas without signing anyone out.
  *
@@ -15,21 +23,12 @@
  * cookies to set and clear; the Next.js middleware and the Express / Fastify /
  * Hono adapters render it.
  */
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.BETTER_AUTH_BAPI_EXCHANGE_PATH = exports.BETTER_AUTH_EXCHANGE_PATH = exports.BETTER_AUTH_COOKIE_PREFIX = void 0;
-exports.betterAuthCookieNames = betterAuthCookieNames;
-exports.readBetterAuthSessionCookie = readBetterAuthSessionCookie;
-exports.exchangeBetterAuthSession = exchangeBetterAuthSession;
-exports.createBetterAuthBridge = createBetterAuthBridge;
-exports.serializeBridgeCookie = serializeBridgeCookie;
 /** Better Auth's default cookie prefix (`advanced.cookiePrefix`). */
 exports.BETTER_AUTH_COOKIE_PREFIX = 'better-auth';
 /** The FAPI path of the exchange (publishable key; per-IP limited — the browser / fallback path). */
 exports.BETTER_AUTH_EXCHANGE_PATH = '/v1/client/migrations/better_auth/exchange';
 /** The Backend API path (secret key; limited per instance for a bulk cutover — the server path). */
 exports.BETTER_AUTH_BAPI_EXCHANGE_PATH = '/v1/migrations/better_auth/exchange';
-/** Default Backend API origin. */
-const DEFAULT_BAPI_URL = 'https://api.atlasauth.net';
 /** The Better Auth cookies the bridge reads (session_token) and clears (all of them). */
 function betterAuthCookieNames(prefix = exports.BETTER_AUTH_COOKIE_PREFIX) {
     const base = ['session_token', 'session_data', 'account_data', 'dont_remember'].map((n) => `${prefix}.${n}`);
@@ -72,150 +71,49 @@ function readBetterAuthSessionCookie(cookieHeader, options = {}) {
  * Auth cookie and tries again on a later request.
  */
 async function exchangeBetterAuthSession(options) {
-    const doFetch = options.fetchImpl ?? fetch;
-    const viaSecretKey = Boolean(options.secretKey);
-    const url = viaSecretKey
-        ? `${(options.bapiBaseUrl ?? DEFAULT_BAPI_URL).replace(/\/+$/, '')}${exports.BETTER_AUTH_BAPI_EXCHANGE_PATH}`
-        : new URL(exports.BETTER_AUTH_EXCHANGE_PATH, options.fapiOrigin).toString();
-    const headers = { 'content-type': 'application/json' };
-    if (viaSecretKey) {
-        headers.authorization = `Bearer ${options.secretKey}`;
-        if (options.clientIp)
-            headers['x-atlas-client-ip'] = options.clientIp;
-        if (options.userAgent)
-            headers['x-atlas-client-user-agent'] = options.userAgent;
-    }
-    else {
-        headers['x-publishable-key'] = options.publishableKey;
-        if (options.userAgent)
-            headers['user-agent'] = options.userAgent;
-    }
-    let res;
-    try {
-        res = await doFetch(url, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({
-                token: options.token,
-                ...(viaSecretKey ? {} : { delivery: 'body' }),
-                ...(options.remember === false ? { remember: false } : {}),
-            }),
-        });
-    }
-    catch {
-        return { kind: 'refused', outcome: 'unavailable', status: 0 };
-    }
-    const data = (await res.json().catch(() => null));
-    if (res.ok && data?.object === 'session_tokens' && data.jwt && data.refresh_token) {
-        return {
-            kind: 'session',
-            jwt: data.jwt,
-            refreshToken: data.refresh_token,
-            sessionId: data.session_id ?? '',
-            userId: data.user_id ?? '',
-            expiresIn: data.expires_in ?? 0,
-        };
-    }
-    if (res.ok &&
-        data?.object === 'sign_in_attempt' &&
-        data.id &&
-        (data.status === 'needs_second_factor' || data.status === 'needs_mfa_enrollment')) {
-        return { kind: 'needs_mfa', attemptId: data.id, status: data.status };
-    }
-    if (res.status === 429)
-        return { kind: 'refused', outcome: 'rate_limited', status: 429 };
-    const outcome = data?.errors?.[0]?.meta?.bridge_outcome;
-    const known = ['closed', 'invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable', 'rate_limited'];
-    if (outcome && known.includes(outcome)) {
-        return { kind: 'refused', outcome: outcome, status: res.status };
-    }
-    // Anything else (a 5xx, a guard refusal, an unparsable body) is not a verdict
-    // on the Better Auth session: keep it and retry later.
-    return { kind: 'refused', outcome: 'unavailable', status: res.status };
+    return toBetterAuthResult(await (0, migration_bridge_1.exchangeMigrationSession)({ ...options, source: 'better_auth' }));
+}
+/**
+ * The generic exchange's answer in Better Auth's terms. `user_unknown` is not a
+ * Better Auth outcome (the Better Auth exchange never sends it), so it reads as
+ * any other unknown verdict did before: not a judgement on the session.
+ */
+function toBetterAuthResult(result) {
+    if (result.kind === 'refused' && result.outcome === 'user_unknown')
+        return { kind: 'refused', outcome: 'unavailable', status: result.status };
+    return result;
 }
-/** Refusals that say the Better Auth session will never exchange: its cookies are cleared. */
-const FINAL = ['invalid', 'signature_invalid', 'expired', 'reused', 'user_unavailable'];
 /**
  * The bridge as a function of a request's headers. Call it from middleware
  * before your normal auth check; it does nothing (no network) for a request
  * without a Better Auth cookie or with an Atlas session (`__session` /
- * `__atlas_rt`) already present.
+ * `__atlas_rt`) already present. The generic {@link createMigrationBridge} with
+ * the Better Auth cookie names.
  */
 function createBetterAuthBridge(options) {
-    const secure = options.secure !== false;
-    const clearBetterAuth = () => betterAuthCookieNames(options.cookiePrefix).all.concat(options.cookieName ? [options.cookieName, `__Secure-${options.cookieName}`] : []).map((name) => ({
-        name,
-        value: '',
-        options: {
-            path: '/',
-            maxAge: 0,
-            ...(options.betterAuthCookieDomain ? { domain: options.betterAuthCookieDomain } : {}),
-            // A `__Secure-` cookie can only be overwritten by a Secure Set-Cookie.
-            ...(name.startsWith('__Secure-') ? { secure: true } : {}),
-        },
-    }));
-    return async function bridge(request) {
-        const cookieHeader = header(request.headers, 'cookie');
-        const token = readBetterAuthSessionCookie(cookieHeader, options);
-        if (!token)
-            return { action: 'none' };
-        // Already on Atlas: leave the old cookie for the old app's own expiry.
-        if (readCookie(cookieHeader, '__session') || readCookie(cookieHeader, '__atlas_rt'))
-            return { action: 'none' };
-        const result = await exchangeBetterAuthSession({
-            fapiOrigin: options.fapiOrigin,
-            publishableKey: options.publishableKey,
-            token,
-            fetchImpl: options.fetchImpl,
-            userAgent: header(request.headers, 'user-agent'),
-            secretKey: options.secretKey,
-            bapiBaseUrl: options.bapiBaseUrl,
-            clientIp: request.ip ?? clientIpFrom(request.headers),
-        });
-        if (result.kind === 'session') {
-            return {
-                action: 'signed_in',
-                session: result,
-                cookies: [
-                    { name: '__session', value: result.jwt, options: { path: '/', sameSite: 'lax', secure } },
-                    {
-                        name: '__atlas_rt',
-                        value: result.refreshToken,
-                        options: { path: '/', httpOnly: true, sameSite: 'lax', secure },
-                    },
-                    ...clearBetterAuth(),
-                ],
-            };
-        }
-        if (result.kind === 'needs_mfa') {
-            return {
-                action: 'needs_mfa',
-                attemptId: result.attemptId,
-                status: result.status,
-                cookies: clearBetterAuth(),
-                continuationUrl: (url) => {
-                    const next = new URL(url);
-                    next.searchParams.set('__atlas_attempt', result.attemptId);
-                    next.searchParams.set('__atlas_status', result.status);
-                    return next.toString();
-                },
-            };
-        }
-        return {
-            action: 'refused',
-            outcome: result.outcome,
-            cookies: FINAL.includes(result.outcome) ? clearBetterAuth() : [],
-        };
+    const names = betterAuthCookieNames(options.cookiePrefix);
+    const bridge = (0, migration_bridge_1.createMigrationBridge)({
+        source: 'better_auth',
+        preset: 'better_auth',
+        fapiOrigin: options.fapiOrigin,
+        publishableKey: options.publishableKey,
+        secretKey: options.secretKey,
+        bapiBaseUrl: options.bapiBaseUrl,
+        cookieNames: options.cookieName ? [`__Secure-${options.cookieName}`, options.cookieName] : names.sessionToken,
+        clearCookieNames: names.all.concat(options.cookieName ? [options.cookieName, `__Secure-${options.cookieName}`] : []),
+        tokenFormat: 'raw',
+        bearer: false,
+        oldCookieDomain: options.betterAuthCookieDomain,
+        secure: options.secure,
+        fetchImpl: options.fetchImpl,
+    });
+    return async function betterAuthBridge(request) {
+        const decision = await bridge(request);
+        if (decision.action === 'refused' && decision.outcome === 'user_unknown')
+            return { action: 'refused', outcome: 'unavailable', cookies: [] };
+        return decision;
     };
 }
-function header(headers, name) {
-    if (typeof headers.get === 'function') {
-        return headers.get(name) ?? undefined;
-    }
-    const record = headers;
-    const value = record[name] ?? record[name.toLowerCase()];
-    return Array.isArray(value) ? value.join('; ') : value;
-}
 /** Serialize a {@link BridgeCookie} as a `Set-Cookie` header value. */
 function serializeBridgeCookie(cookie) {
     const o = cookie.options;
@@ -236,10 +134,4 @@ function serializeBridgeCookie(cookie) {
         parts.push(`SameSite=${o.sameSite[0].toUpperCase()}${o.sameSite.slice(1)}`);
     return parts.join('; ');
 }
-/** The client IP a proxy in front of your server recorded (first X-Forwarded-For hop, or X-Real-IP). */
-function clientIpFrom(headers) {
-    const xff = header(headers, 'x-forwarded-for');
-    const first = xff?.split(',')[0]?.trim();
-    return first || header(headers, 'x-real-ip')?.trim() || undefined;
-}
 //# sourceMappingURL=better-auth.js.map

package/dist/better-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;GAeG;;;AA2BH,sDAUC;AAgBD,kEAYC;AA4DD,8DAuEC;AAuCD,wDA0EC;AAeD,sDAaC;AA/UD,qEAAqE;AACxD,QAAA,yBAAyB,GAAG,aAAa,CAAC;AAEvD,qGAAqG;AACxF,QAAA,yBAAyB,GAAG,4CAA4C,CAAC;AACtF,oGAAoG;AACvF,QAAA,8BAA8B,GAAG,qCAAqC,CAAC;AACpF,kCAAkC;AAClC,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAgBrD,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,SAAiB,iCAAyB;IAI9E,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO;QACL,YAAY,EAAE,CAAC,YAAY,MAAM,gBAAgB,EAAE,GAAG,MAAM,gBAAgB,CAAC;QAC7E,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiC,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,2BAA2B,CACzC,YAAuC,EACvC,UAA0D,EAAE;IAE5D,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU;QAC9B,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;QACxD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAsDD;;;;;GAKG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAyC;IAEzC,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,IAAI,KAAK,CAAC;IAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,YAAY;QACtB,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,IAAI,gBAAgB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,sCAA8B,EAAE;QACrG,CAAC,CAAC,IAAI,GAAG,CAAC,iCAAyB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtE,MAAM,OAAO,GAA2B,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAC;IAC/E,IAAI,YAAY,EAAE,CAAC;QACjB,OAAO,CAAC,aAAa,GAAG,UAAU,OAAO,CAAC,SAAS,EAAE,CAAC;QACtD,IAAI,OAAO,CAAC,QAAQ;YAAE,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC;QACtE,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,2BAA2B,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IAClF,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,mBAAmB,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC;QACtD,IAAI,OAAO,CAAC,SAAS;YAAE,OAAO,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACnE,CAAC;IACD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE;YACvB,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;gBAC7C,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAUxC,CAAC;IAET,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,EAAE,MAAM,KAAK,gBAAgB,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;QAClF,OAAO;YACL,IAAI,EAAE,SAAS;YACf,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;YAChC,MAAM,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE;YAC1B,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IACD,IACE,GAAG,CAAC,EAAE;QACN,IAAI,EAAE,MAAM,KAAK,iBAAiB;QAClC,IAAI,CAAC,EAAE;QACP,CAAC,IAAI,CAAC,MAAM,KAAK,qBAAqB,IAAI,IAAI,CAAC,MAAM,KAAK,sBAAsB,CAAC,EACjF,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC;IACxE,CAAC;IACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACzF,MAAM,OAAO,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC;IACxD,MAAM,KAAK,GAAwB,CAAC,QAAQ,EAAE,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,EAAE,cAAc,CAAC,CAAC;IACvI,IAAI,OAAO,IAAK,KAAkB,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAA4B,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;IACxF,CAAC;IACD,8EAA8E;IAC9E,uDAAuD;IACvD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;AACzE,CAAC;AA8BD,8FAA8F;AAC9F,MAAM,KAAK,GAAwB,CAAC,SAAS,EAAE,mBAAmB,EAAE,SAAS,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAE7G;;;;;GAKG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC;IACxC,MAAM,eAAe,GAAG,GAAmB,EAAE,CAC3C,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,MAAM,CACpD,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CACjF,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACf,IAAI;QACJ,KAAK,EAAE,EAAE;QACT,OAAO,EAAE;YACP,IAAI,EAAE,GAAG;YACT,MAAM,EAAE,CAAC;YACT,GAAG,CAAC,OAAO,CAAC,sBAAsB,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrF,uEAAuE;YACvE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1D;KACF,CAAC,CAAC,CAAC;IAEN,OAAO,KAAK,UAAU,MAAM,CAAC,OAI5B;QACC,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,2BAA2B,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QACtC,uEAAuE;QACvE,IAAI,UAAU,CAAC,YAAY,EAAE,WAAW,CAAC,IAAI,UAAU,CAAC,YAAY,EAAE,YAAY,CAAC;YAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;QAE/G,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC;YAC7C,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;YACtC,KAAK;YACL,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,YAAY,CAAC;YAChD,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;YAChC,QAAQ,EAAE,OAAO,CAAC,EAAE,IAAI,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC;SACtD,CAAC,CAAC;QAEH,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9B,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,OAAO,EAAE,MAAM;gBACf,OAAO,EAAE;oBACP,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;oBACzF;wBACE,IAAI,EAAE,YAAY;wBAClB,KAAK,EAAE,MAAM,CAAC,YAAY;wBAC1B,OAAO,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE;qBAChE;oBACD,GAAG,eAAe,EAAE;iBACrB;aACF,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,KAAK,WAAW,EAAE,CAAC;YAChC,OAAO;gBACL,MAAM,EAAE,WAAW;gBACnB,SAAS,EAAE,MAAM,CAAC,SAAS;gBAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,OAAO,EAAE,eAAe,EAAE;gBAC1B,eAAe,EAAE,CAAC,GAAW,EAAE,EAAE;oBAC/B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;oBAC1B,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;oBAC3D,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;oBACvD,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACzB,CAAC;aACF,CAAC;QACJ,CAAC;QACD,OAAO;YACL,MAAM,EAAE,SAAS;YACjB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE;SACjE,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CACb,OAA6F,EAC7F,IAAY;IAEZ,IAAI,OAAQ,OAA6B,CAAC,GAAG,KAAK,UAAU,EAAE,CAAC;QAC7D,OAAQ,OAAgD,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,SAAS,CAAC;IAClF,CAAC;IACD,MAAM,MAAM,GAAG,OAAwD,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IACzD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AACzD,CAAC;AAED,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,MAAoB;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CACnB,OAA6F;IAE7F,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;IACzC,OAAO,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;AACpE,CAAC"}
+{"version":3,"file":"better-auth.js","sourceRoot":"","sources":["../src/better-auth.ts"],"names":[],"mappings":";;;AA+CA,sDAUC;AAgBD,kEAYC;AA4DD,8DAIC;AA+CD,wDAsBC;AAGD,sDAaC;AA1OD,yDAK4B;AAE5B;;;;;;;;;;;;;;;GAeG;AAEH,qEAAqE;AACxD,QAAA,yBAAyB,GAAG,aAAa,CAAC;AAEvD,qGAAqG;AACxF,QAAA,yBAAyB,GAAG,4CAA4C,CAAC;AACtF,oGAAoG;AACvF,QAAA,8BAA8B,GAAG,qCAAqC,CAAC;AAgBpF,yFAAyF;AACzF,SAAgB,qBAAqB,CAAC,SAAiB,iCAAyB;IAI9E,MAAM,IAAI,GAAG,CAAC,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7G,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IAChD,OAAO;QACL,YAAY,EAAE,CAAC,YAAY,MAAM,gBAAgB,EAAE,GAAG,MAAM,gBAAgB,CAAC;QAC7E,GAAG,EAAE,CAAC,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC;KAC1B,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,MAAiC,EAAE,IAAY;IACjE,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9C,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,2BAA2B,CACzC,YAAuC,EACvC,UAA0D,EAAE;IAE5D,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU;QAC9B,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC;QACxD,CAAC,CAAC,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,YAAY,CAAC;IAC7D,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IAC1B,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAsDD;;;;;GAKG;AACI,KAAK,UAAU,yBAAyB,CAC7C,OAAyC;IAEzC,OAAO,kBAAkB,CAAC,MAAM,IAAA,2CAAwB,EAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,MAA+B;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;IAC9I,OAAO,MAAkC,CAAC;AAC5C,CAAC;AA8BD;;;;;;GAMG;AACH,SAAgB,sBAAsB,CAAC,OAAgC;IACrE,MAAM,KAAK,GAAG,qBAAqB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,IAAA,wCAAqB,EAAC;QACnC,MAAM,EAAE,aAAa;QACrB,MAAM,EAAE,aAAa;QACrB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,cAAc,EAAE,OAAO,CAAC,cAAc;QACtC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,UAAU,EAAE,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY;QAC7G,gBAAgB,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpH,WAAW,EAAE,KAAK;QAClB,MAAM,EAAE,KAAK;QACb,eAAe,EAAE,OAAO,CAAC,sBAAsB;QAC/C,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS,EAAE,OAAO,CAAC,SAAS;KAC7B,CAAC,CAAC;IACH,OAAO,KAAK,UAAU,gBAAgB,CAAC,OAA+B;QACpE,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,cAAc;YAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5I,OAAO,QAAoC,CAAC;IAC9C,CAAC,CAAC;AACJ,CAAC;AAED,uEAAuE;AACvE,SAAgB,qBAAqB,CAAC,MAAoB;IACxD,MAAM,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;IACjD,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;QAClC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/client/abac.d.ts

@@ -0,0 +1,132 @@
+import { type RequestFn } from './request';
+import type { ListPage } from './types';
+export interface AbacPolicyTestCase {
+    name: string;
+    /** principal, action, resource, context and optional entities. */
+    request: Record<string, unknown>;
+    expect: 'allow' | 'deny';
+}
+/** An ABAC policy: named, versioned source in the Cedar-subset policy language. */
+export interface AbacPolicy {
+    object: 'abac_policy';
+    id: string;
+    name: string;
+    description: string | null;
+    enabled: boolean;
+    current_version: number;
+    /** The FGA store `fga.check(...)` in the source consults. */
+    fga_store_id: string | null;
+    source: string;
+    tests: AbacPolicyTestCase[];
+    created_at: number;
+    updated_at: number;
+}
+export interface AbacPolicyVersion {
+    object: 'abac_policy_version';
+    policy_id: string;
+    version: number;
+    source: string;
+    tests: AbacPolicyTestCase[];
+    current: boolean;
+    created_at: number;
+}
+export interface CreateAbacPolicyBody {
+    name: string;
+    description?: string | null;
+    enabled?: boolean;
+    fga_store_id?: string | null;
+    source: string;
+    tests?: AbacPolicyTestCase[];
+}
+/** Sending `source` appends a new version; `current_version` (without source) rolls back. */
+export type UpdateAbacPolicyBody = Partial<CreateAbacPolicyBody> & {
+    current_version?: number;
+};
+export interface AbacEntity {
+    type: string;
+    id: string;
+    attributes?: Record<string, unknown>;
+    /** `Type::id` uids this entity is a member of (for `in`). */
+    parents?: string[];
+}
+export interface AbacEvaluateBody {
+    principal: AbacEntity;
+    action: string;
+    resource: AbacEntity;
+    context?: Record<string, unknown>;
+    entities?: AbacEntity[];
+    /** Evaluate only these policies (default: every enabled one). */
+    policy_ids?: string[];
+}
+export interface AbacDecision {
+    object: 'abac_decision';
+    decision: 'allow' | 'deny';
+    reasons: string[];
+    errors: string[];
+}
+export interface AbacTestRun {
+    object: 'abac_policy_test_run';
+    passed: boolean;
+    results: Array<{
+        name: string;
+        expect: 'allow' | 'deny';
+        actual: 'allow' | 'deny';
+        passed: boolean;
+    }>;
+}
+export interface AuthzenEvaluation {
+    subject?: {
+        type: string;
+        id: string;
+        properties?: Record<string, unknown>;
+    };
+    resource?: {
+        type: string;
+        id: string;
+        properties?: Record<string, unknown>;
+    };
+    action?: {
+        name: string;
+        properties?: Record<string, unknown>;
+    };
+    context?: Record<string, unknown>;
+}
+/** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
+export declare function abacResource(request: RequestFn): {
+    list(): Promise<ListPage<AbacPolicy>>;
+    get(id: string): Promise<AbacPolicy>;
+    create(body: CreateAbacPolicyBody, idempotencyKey?: string): Promise<AbacPolicy>;
+    update(id: string, body: UpdateAbacPolicyBody): Promise<AbacPolicy>;
+    delete(id: string): Promise<{
+        object: "abac_policy";
+        id: string;
+        deleted: true;
+    }>;
+    versions(id: string): Promise<ListPage<AbacPolicyVersion>>;
+    /** Run a version's tests (default: current), or a draft `source` and `tests`, without saving. */
+    test(id: string, body?: {
+        version?: number;
+        source?: string;
+        tests?: AbacPolicyTestCase[];
+    }): Promise<AbacTestRun>;
+    /** May `principal` perform `action` on `resource`? */
+    evaluate(body: AbacEvaluateBody): Promise<AbacDecision>;
+    /** Convenience: the boolean answer to {@link evaluate}. */
+    isAllowed(body: AbacEvaluateBody): Promise<boolean>;
+    /** AuthZEN 1.0 Access Evaluation. */
+    authzenEvaluation(body: AuthzenEvaluation): Promise<{
+        decision: boolean;
+        context?: Record<string, unknown>;
+    }>;
+    /** AuthZEN 1.0 Access Evaluations (batch). */
+    authzenEvaluations(body: AuthzenEvaluation & {
+        evaluations?: AuthzenEvaluation[];
+        options?: {
+            evaluations_semantic?: "execute_all" | "deny_on_first_deny" | "permit_on_first_permit";
+        };
+    }): Promise<{
+        evaluations: Array<{
+            decision: boolean;
+        }>;
+    }>;
+};

package/dist/client/abac.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.abacResource = abacResource;
+const request_1 = require("./request");
+/** ABAC policies and the policy decision point (including the AuthZEN endpoints). */
+function abacResource(request) {
+    return {
+        list() {
+            return request({ method: 'GET', path: '/v1/abac_policies' });
+        },
+        get(id) {
+            return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}` });
+        },
+        create(body, idempotencyKey) {
+            return request({ method: 'POST', path: '/v1/abac_policies', body, idempotencyKey });
+        },
+        update(id, body) {
+            return request({ method: 'PATCH', path: `/v1/abac_policies/${(0, request_1.enc)(id)}`, body });
+        },
+        delete(id) {
+            return request({ method: 'DELETE', path: `/v1/abac_policies/${(0, request_1.enc)(id)}` });
+        },
+        versions(id) {
+            return request({ method: 'GET', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/versions` });
+        },
+        /** Run a version's tests (default: current), or a draft `source` and `tests`, without saving. */
+        test(id, body = {}) {
+            return request({ method: 'POST', path: `/v1/abac_policies/${(0, request_1.enc)(id)}/test`, body });
+        },
+        /** May `principal` perform `action` on `resource`? */
+        evaluate(body) {
+            return request({ method: 'POST', path: '/v1/abac/evaluate', body });
+        },
+        /** Convenience: the boolean answer to {@link evaluate}. */
+        async isAllowed(body) {
+            return (await request({ method: 'POST', path: '/v1/abac/evaluate', body })).decision === 'allow';
+        },
+        /** AuthZEN 1.0 Access Evaluation. */
+        authzenEvaluation(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/evaluation', body });
+        },
+        /** AuthZEN 1.0 Access Evaluations (batch). */
+        authzenEvaluations(body) {
+            return request({ method: 'POST', path: '/v1/authzen/access/v1/evaluations', body });
+        },
+    };
+}
+//# sourceMappingURL=abac.js.map

package/dist/client/abac.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"abac.js","sourceRoot":"","sources":["../../src/client/abac.ts"],"names":[],"mappings":";;AAuFA,oCA2CC;AAlID,uCAAgD;AAsFhD,qFAAqF;AACrF,SAAgB,YAAY,CAAC,OAAkB;IAC7C,OAAO;QACL,IAAI;YACF,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,mBAAmB,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,GAAG,CAAC,EAAU;YACZ,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1E,CAAC;QACD,MAAM,CAAC,IAA0B,EAAE,cAAuB;YACxD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,MAAM,CAAC,EAAU,EAAE,IAA0B;YAC3C,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,MAAM,CAAC,EAAU;YACf,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAC7E,CAAC;QACD,QAAQ,CAAC,EAAU;YACjB,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,iGAAiG;QACjG,IAAI,CAAC,EAAU,EAAE,OAA4E,EAAE;YAC7F,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,IAAA,aAAG,EAAC,EAAE,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,sDAAsD;QACtD,QAAQ,CAAC,IAAsB;YAC7B,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;QACtE,CAAC;QACD,2DAA2D;QAC3D,KAAK,CAAC,SAAS,CAAC,IAAsB;YACpC,OAAO,CAAC,MAAM,OAAO,CAAe,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;QACjH,CAAC;QACD,qCAAqC;QACrC,iBAAiB,CAAC,IAAuB;YACvC,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,8CAA8C;QAC9C,kBAAkB,CAChB,IAAqK;YAErK,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,mCAAmC,EAAE,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;KACF,CAAC;AACJ,CAAC"}