@atlasauth/backend 0.23.0 → 0.25.0

package/dist/framework-sessions.js

@@ -0,0 +1,544 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DJANGO_SESSION_COOKIE = exports.LUCIA_SESSION_COOKIE = exports.EXPRESS_SESSION_COOKIE = exports.AUTHJS_SESSION_COOKIES = void 0;
+exports.readAuthJsSessionCookie = readAuthJsSessionCookie;
+exports.authJsSessionTokenKind = authJsSessionTokenKind;
+exports.decodeAuthJsSessionToken = decodeAuthJsSessionToken;
+exports.unsignExpressSessionCookie = unsignExpressSessionCookie;
+exports.luciaSessionId = luciaSessionId;
+exports.unsealIronSession = unsealIronSession;
+exports.sessionValueAt = sessionValueAt;
+exports.decryptRailsCookie = decryptRailsCookie;
+exports.deviseSessionUser = deviseSessionUser;
+exports.deviseSaltMatches = deviseSaltMatches;
+exports.decodeDjangoSignedCookie = decodeDjangoSignedCookie;
+exports.decodeDjangoPayload = decodeDjangoPayload;
+exports.djangoSessionUser = djangoSessionUser;
+exports.djangoSessionAuthHash = djangoSessionAuthHash;
+const jose_1 = require("jose");
+/**
+ * Reading the session a self-hosted auth framework left in the browser, so a
+ * returning user can be exchanged for an Atlas session without signing in
+ * again (the zero-logout bridge).
+ *
+ * Every framework here keeps its session in one of two shapes:
+ *
+ *   - an opaque id the framework looks up in its own store (Auth.js database
+ *     sessions, Lucia, express-session, Django's database sessions): the cookie
+ *     carries the id, the migration import carries the rows, and the bridge
+ *     only has to pull the id out of the cookie ({@link authJsSessionTokenKind},
+ *     {@link unsignExpressSessionCookie}, {@link luciaSessionId});
+ *   - a sealed or signed cookie that IS the session (Auth.js JWT sessions,
+ *     iron-session, Rails' cookie store under Devise, Django's signed-cookie
+ *     sessions): only the app's own secret opens it
+ *     ({@link decodeAuthJsSessionToken}, {@link unsealIronSession},
+ *     {@link decryptRailsCookie}, {@link decodeDjangoSignedCookie}).
+ *
+ * Each reader mirrors the framework's own source format exactly and FAILS
+ * CLOSED: a malformed, forged, expired or wrongly-keyed value is `null`, never
+ * a throw. Web Crypto only (plus jose, which Auth.js itself uses), so the same
+ * code runs in Node, edge middleware and the Atlas API.
+ */
+const enc = new TextEncoder();
+const dec = new TextDecoder();
+function bytes(input) {
+    return enc.encode(input);
+}
+function fromBase64(input) {
+    const std = input.replace(/-/g, '+').replace(/_/g, '/').replace(/=+$/, '');
+    if (!/^[A-Za-z0-9+/]*$/.test(std) || std.length % 4 === 1)
+        return null;
+    const bin = atob(std + '='.repeat((4 - (std.length % 4)) % 4));
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function toBase64(input, url) {
+    let bin = '';
+    for (const b of input)
+        bin += String.fromCharCode(b);
+    const b64 = btoa(bin);
+    return url ? b64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '') : b64;
+}
+function hex(input) {
+    let out = '';
+    for (const b of input)
+        out += b.toString(16).padStart(2, '0');
+    return out;
+}
+/** Length-safe constant-time comparison of two strings. */
+function sameString(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i++)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+async function hmac(hash, key, data) {
+    const k = await crypto.subtle.importKey('raw', key, { name: 'HMAC', hash }, false, ['sign']);
+    return new Uint8Array(await crypto.subtle.sign('HMAC', k, data));
+}
+async function digest(hash, data) {
+    return new Uint8Array(await crypto.subtle.digest(hash, data));
+}
+async function pbkdf2(hash, password, salt, iterations, length) {
+    const k = await crypto.subtle.importKey('raw', password, 'PBKDF2', false, ['deriveBits']);
+    return new Uint8Array(await crypto.subtle.deriveBits({ name: 'PBKDF2', hash, salt, iterations }, k, length * 8));
+}
+async function hkdfSha256(ikm, salt, info, length) {
+    const k = await crypto.subtle.importKey('raw', ikm, 'HKDF', false, ['deriveBits']);
+    return new Uint8Array(await crypto.subtle.deriveBits({ name: 'HKDF', hash: 'SHA-256', salt: bytes(salt), info: bytes(info) }, k, length * 8));
+}
+function asList(value) {
+    return (typeof value === 'string' ? [value] : [...value]).filter((v) => typeof v === 'string' && v.length > 0);
+}
+function decodeCookieValue(raw) {
+    const value = raw.trim();
+    if (!value.includes('%'))
+        return value;
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return null;
+    }
+}
+/** Every `name=value` pair of a `Cookie` header (first occurrence wins). */
+function cookieMap(header) {
+    const out = new Map();
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const eq = part.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const name = part.slice(0, eq).trim();
+        if (!out.has(name))
+            out.set(name, part.slice(eq + 1).trim());
+    }
+    return out;
+}
+// ── Auth.js / NextAuth ──────────────────────────────────────────────────────
+/** Auth.js v5 (`@auth/core`) and NextAuth v4 session cookie names, `__Secure-` first. */
+exports.AUTHJS_SESSION_COOKIES = [
+    '__Secure-authjs.session-token',
+    'authjs.session-token',
+    '__Secure-next-auth.session-token',
+    'next-auth.session-token',
+];
+/**
+ * The Auth.js session cookie from a `Cookie` header, reassembled when Auth.js
+ * split it into `<name>.0`, `<name>.1`, … chunks (it does above ~4 KB). `name`
+ * is the base cookie name — the HKDF salt of a v5 JWT. `cookieName` overrides
+ * the defaults when the app set `cookies.sessionToken.name`.
+ */
+function readAuthJsSessionCookie(cookieHeader, options = {}) {
+    const cookies = typeof cookieHeader === 'object' && cookieHeader !== null ? new Map(Object.entries(cookieHeader)) : cookieMap(cookieHeader);
+    const names = options.cookieName ? [options.cookieName] : [...exports.AUTHJS_SESSION_COOKIES];
+    for (const name of names) {
+        const whole = cookies.get(name);
+        if (whole)
+            return { name, value: whole };
+        const chunks = [];
+        for (let i = 0; cookies.has(`${name}.${i}`); i++)
+            chunks.push(cookies.get(`${name}.${i}`));
+        if (chunks.length)
+            return { name, value: chunks.join('') };
+    }
+    return undefined;
+}
+/**
+ * Which session strategy produced a cookie value: a five-part compact JWE is a
+ * JWT-strategy session; anything else is a database session token (the
+ * `sessionToken` column of the adapter's sessions table).
+ */
+function authJsSessionTokenKind(value) {
+    const v = decodeCookieValue(value);
+    if (!v || v.length > 16_384)
+        return null;
+    if (/^[A-Za-z0-9_-]+(\.[A-Za-z0-9_-]*){4}$/.test(v))
+        return 'jwt';
+    return /^[A-Za-z0-9_\-.]{8,512}$/.test(v) ? 'database' : null;
+}
+/**
+ * Decrypt an Auth.js JWT-strategy session cookie with the app's secret
+ * (`AUTH_SECRET` / `NEXTAUTH_SECRET`; pass every rotated secret, newest first).
+ *
+ *   - NextAuth v4: `dir` + `A256GCM`, key = HKDF-SHA256(secret, salt "", info
+ *     "NextAuth.js Generated Encryption Key", 32 bytes).
+ *   - Auth.js v5 (`@auth/core`): `dir` + `A256CBC-HS512` (or `A256GCM`), key =
+ *     HKDF-SHA256(secret, salt = the cookie name, info
+ *     "Auth.js Generated Encryption Key (<cookie name>)", 64 / 32 bytes).
+ *
+ * `salt` is the cookie the value came from (from {@link readAuthJsSessionCookie}).
+ * The JWT's `exp` is enforced with Auth.js's own 15 s tolerance.
+ */
+async function decodeAuthJsSessionToken(token, options) {
+    const value = decodeCookieValue(token);
+    if (!value || authJsSessionTokenKind(value) !== 'jwt')
+        return null;
+    let encAlg;
+    try {
+        const header = (0, jose_1.decodeProtectedHeader)(value);
+        if (header.alg !== 'dir')
+            return null;
+        encAlg = header.enc;
+    }
+    catch {
+        return null;
+    }
+    if (encAlg !== 'A256GCM' && encAlg !== 'A256CBC-HS512')
+        return null;
+    const candidates = [];
+    for (const secret of asList(options.secret)) {
+        const ikm = bytes(secret);
+        if (encAlg === 'A256CBC-HS512') {
+            candidates.push(await hkdfSha256(ikm, options.salt, `Auth.js Generated Encryption Key (${options.salt})`, 64));
+        }
+        else {
+            candidates.push(await hkdfSha256(ikm, options.salt, `Auth.js Generated Encryption Key (${options.salt})`, 32));
+            candidates.push(await hkdfSha256(ikm, '', 'NextAuth.js Generated Encryption Key', 32));
+        }
+    }
+    for (const key of candidates) {
+        try {
+            const { payload } = await (0, jose_1.jwtDecrypt)(value, key, {
+                keyManagementAlgorithms: ['dir'],
+                contentEncryptionAlgorithms: [encAlg],
+                clockTolerance: 15,
+                ...(options.now ? { currentDate: options.now } : {}),
+            });
+            return payload;
+        }
+        catch {
+            // wrong key, tampered, or expired: try the next secret
+        }
+    }
+    return null;
+}
+// ── express-session (Passport) ──────────────────────────────────────────────
+/** express-session's default cookie name. */
+exports.EXPRESS_SESSION_COOKIE = 'connect.sid';
+/**
+ * The session id inside an express-session cookie (`s:<sid>.<signature>`,
+ * URL-encoded), where the signature is cookie-signature's
+ * base64(HMAC-SHA256(secret, sid)) without padding. With `secrets` (the app's
+ * `session({ secret })`, a string or the rotation array) the signature must
+ * verify against one of them; without, the id is only parsed — the session id
+ * is itself a 24-byte random bearer value, so a store lookup by id is what
+ * authenticates it either way.
+ */
+async function unsignExpressSessionCookie(raw, secrets) {
+    const value = decodeCookieValue(raw);
+    if (!value || !value.startsWith('s:') || value.length > 1024)
+        return null;
+    const body = value.slice(2);
+    const dot = body.lastIndexOf('.');
+    if (dot <= 0)
+        return null;
+    const sid = body.slice(0, dot);
+    const signature = body.slice(dot + 1);
+    if (!/^[A-Za-z0-9_\-+/=]+$/.test(sid))
+        return null;
+    if (secrets === undefined)
+        return sid;
+    for (const secret of asList(secrets)) {
+        const expected = toBase64(await hmac('SHA-256', bytes(secret), bytes(sid)), false).replace(/=+$/, '');
+        if (sameString(expected, signature))
+            return sid;
+    }
+    return null;
+}
+// ── Lucia ───────────────────────────────────────────────────────────────────
+/** Lucia's default session cookie name (v2 and v3). */
+exports.LUCIA_SESSION_COOKIE = 'auth_session';
+/**
+ * The id a Lucia session row is stored under, from the cookie's token. Lucia
+ * v2/v3 store the cookie value itself (`none`); the current Lucia guide's
+ * session implementation stores `hex(sha256(token))` (`sha256-hex`).
+ */
+async function luciaSessionId(token, hashing = 'none') {
+    const value = decodeCookieValue(token);
+    if (!value || !/^[A-Za-z0-9_-]{8,256}$/.test(value))
+        return null;
+    return hashing === 'none' ? value : hex(await digest('SHA-256', bytes(value)));
+}
+// ── iron-session ────────────────────────────────────────────────────────────
+/**
+ * Open an iron-session cookie (an `@hapi/iron` `Fe26.2` seal, with iron-session
+ * v8's `~2` version suffix) with the app's `password` — a string, or the
+ * `{ id: password }` rotation map. Mirrors iron: HMAC-SHA256 integrity and
+ * AES-256-CBC, each keyed by PBKDF2-SHA1(password, the seal's salt, 1 iteration,
+ * 32 bytes); the seal's own expiry is enforced (60 s skew, as iron does).
+ * Returns the session object the app stored.
+ */
+async function unsealIronSession(raw, password, options = {}) {
+    const value = decodeCookieValue(raw);
+    if (!value || value.length > 16_384)
+        return null;
+    const [seal, version] = value.split('~');
+    const parts = (seal ?? '').split('*');
+    if (parts.length !== 8 || parts[0] !== 'Fe26.2')
+        return null;
+    const [, passwordId, encSalt, encIv, encrypted, expiration, hmacSalt, mac] = parts;
+    const secret = typeof password === 'string'
+        ? passwordId === '' || passwordId === '1'
+            ? password
+            : undefined
+        : password[passwordId || 'default'];
+    if (!secret)
+        return null;
+    const now = (options.now ?? new Date()).getTime();
+    if (expiration) {
+        const exp = Number(expiration);
+        if (!Number.isFinite(exp) || exp <= now - 60_000)
+            return null;
+    }
+    const integrityKey = await pbkdf2('SHA-1', bytes(secret), bytes(hmacSalt), 1, 32);
+    const expectedMac = toBase64(await hmac('SHA-256', integrityKey, bytes(parts.slice(0, 6).join('*'))), true);
+    if (!sameString(expectedMac, mac))
+        return null;
+    const iv = fromBase64(encIv);
+    const ciphertext = fromBase64(encrypted);
+    if (!iv || iv.length !== 16 || !ciphertext)
+        return null;
+    try {
+        const key = await crypto.subtle.importKey('raw', await pbkdf2('SHA-1', bytes(secret), bytes(encSalt), 1, 32), 'AES-CBC', false, ['decrypt']);
+        const plain = dec.decode(await crypto.subtle.decrypt({ name: 'AES-CBC', iv }, key, ciphertext));
+        const data = JSON.parse(plain);
+        // iron-session v8 reads a seal without the `~2` suffix as an older one whose
+        // data sits under `persistent`.
+        if (version !== '2' && data && typeof data.persistent === 'object' && data.persistent !== null) {
+            return data.persistent;
+        }
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+/** Read `path` (`"user.id"`) out of a session object, as a non-empty string. */
+function sessionValueAt(data, path) {
+    let cur = data;
+    for (const key of path.split('.')) {
+        if (!cur || typeof cur !== 'object')
+            return null;
+        cur = cur[key];
+    }
+    if (typeof cur === 'number' && Number.isFinite(cur))
+        return String(cur);
+    return typeof cur === 'string' && cur.length > 0 ? cur : null;
+}
+// ── Rails cookie store (Devise / Warden) ────────────────────────────────────
+/**
+ * Decrypt a Rails encrypted cookie — the session cookie of a Rails app using
+ * the default cookie store, which is where Devise (through Warden) keeps the
+ * signed-in user. Rails 5.2+ authenticated encryption:
+ * `base64(ciphertext)--base64(iv)--base64(auth tag)`, AES-256-GCM, empty AAD,
+ * key = PBKDF2(secret_key_base, "authenticated encrypted cookie", 1000
+ * iterations, 32 bytes) with SHA-256 (Rails 7 default) or SHA-1 (apps that kept
+ * `key_generator_hash_digest_class = SHA1`). Both are tried unless `keyDigest`
+ * pins one. The `_rails` envelope's purpose (`cookie.<cookieName>`) and expiry
+ * are enforced; JSON-serialized cookies only (`cookies_serializer :json` or
+ * `:hybrid` — a Marshal-serialized cookie cannot be read outside Ruby).
+ */
+async function decryptRailsCookie(raw, options) {
+    const value = decodeCookieValue(raw);
+    if (!value || value.length > 16_384)
+        return null;
+    const parts = value.split('--');
+    if (parts.length !== 3)
+        return null;
+    const [ct, ivPart, tagPart] = parts.map((p) => fromBase64(p));
+    if (!ct || !ivPart || !tagPart || ivPart.length !== 12 || tagPart.length !== 16)
+        return null;
+    const sealed = new Uint8Array(ct.length + tagPart.length);
+    sealed.set(ct);
+    sealed.set(tagPart, ct.length);
+    const digests = options.keyDigest ? [options.keyDigest] : ['SHA-256', 'SHA-1'];
+    const salt = options.salt ?? 'authenticated encrypted cookie';
+    let plain = null;
+    outer: for (const secret of asList(options.secretKeyBase)) {
+        for (const d of digests) {
+            try {
+                const raw = await pbkdf2(d, bytes(secret), bytes(salt), 1000, 32);
+                const key = await crypto.subtle.importKey('raw', raw, 'AES-GCM', false, ['decrypt']);
+                plain = dec.decode(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: ivPart, additionalData: new Uint8Array(0), tagLength: 128 }, key, sealed));
+                break outer;
+            }
+            catch {
+                // wrong key: try the next one
+            }
+        }
+    }
+    if (plain === null)
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(plain);
+    }
+    catch {
+        return null; // Marshal (or another non-JSON serializer)
+    }
+    const envelope = parsed?._rails;
+    if (!envelope)
+        return isRecord(parsed) ? parsed : null;
+    if (options.cookieName && envelope.pur != null && envelope.pur !== `cookie.${options.cookieName}`)
+        return null;
+    if (typeof envelope.exp === 'string' && envelope.exp) {
+        const exp = Date.parse(envelope.exp);
+        if (!Number.isFinite(exp) || exp <= (options.now ?? new Date()).getTime())
+            return null;
+    }
+    let data = envelope.data;
+    if (data === undefined && typeof envelope.message === 'string') {
+        const inner = fromBase64(envelope.message);
+        if (!inner)
+            return null;
+        try {
+            data = JSON.parse(dec.decode(inner));
+        }
+        catch {
+            return null;
+        }
+    }
+    return isRecord(data) ? data : null;
+}
+function isRecord(v) {
+    return typeof v === 'object' && v !== null && !Array.isArray(v);
+}
+/**
+ * The Devise user a Rails session holds: Warden stores
+ * `warden.user.<scope>.key` = `[[id], authenticatable_salt]`, where the salt is
+ * the first 29 characters of the user's bcrypt `encrypted_password` (so a
+ * password change signs every session out — check it against the imported
+ * hash with {@link deviseSaltMatches}).
+ */
+function deviseSessionUser(session, scope = 'user') {
+    const entry = session[`warden.user.${scope}.key`];
+    if (!Array.isArray(entry) || entry.length < 1)
+        return null;
+    const ids = entry[0];
+    const id = Array.isArray(ids) ? ids[0] : ids;
+    const idText = typeof id === 'number' && Number.isFinite(id) ? String(id) : typeof id === 'string' && id ? id : null;
+    if (!idText)
+        return null;
+    return { id: idText, salt: typeof entry[1] === 'string' ? entry[1] : null };
+}
+/** Devise's `authenticatable_salt`: the bcrypt digest's first 29 characters. */
+function deviseSaltMatches(salt, encryptedPassword) {
+    if (!salt || !encryptedPassword || encryptedPassword.length < 29)
+        return false;
+    return sameString(salt, encryptedPassword.slice(0, 29));
+}
+// ── Django ──────────────────────────────────────────────────────────────────
+/** Django's default session cookie name (`SESSION_COOKIE_NAME`). */
+exports.DJANGO_SESSION_COOKIE = 'sessionid';
+const B62 = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz';
+function b62decode(s) {
+    let n = 0;
+    for (const ch of s) {
+        const i = B62.indexOf(ch);
+        if (i < 0)
+            return NaN;
+        n = n * 62 + i;
+    }
+    return n;
+}
+/** Django's `salted_hmac(key_salt, value, secret, algorithm)`. */
+async function djangoSaltedHmac(keySalt, value, secret, algorithm) {
+    const hash = algorithm === 'sha256' ? 'SHA-256' : 'SHA-1';
+    const key = await digest(hash, bytes(keySalt + secret));
+    return hmac(hash, key, bytes(value));
+}
+async function inflate(data) {
+    const DS = globalThis.DecompressionStream;
+    if (!DS)
+        return null;
+    try {
+        const stream = new Blob([data]).stream().pipeThrough(new DS('deflate'));
+        return new Uint8Array(await new Response(stream).arrayBuffer());
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verify and decode a value made by Django's `signing.dumps` — the session
+ * cookie of `SESSION_ENGINE = "django.contrib.sessions.backends.signed_cookies"`.
+ * Format `<payload>:<base62 timestamp>:<signature>`, payload = urlsafe base64 of
+ * the JSON (zlib-compressed when it starts with `.`), signature = urlsafe
+ * base64 of salted_hmac(salt + "signer", "<payload>:<timestamp>", SECRET_KEY)
+ * with SHA-256 (Django ≥ 3.1) or SHA-1 (older). Pass SECRET_KEY first, then
+ * SECRET_KEY_FALLBACKS. `maxAgeSeconds` is SESSION_COOKIE_AGE.
+ */
+async function decodeDjangoSignedCookie(raw, options) {
+    const value = decodeCookieValue(raw)?.replace(/^"|"$/g, '');
+    if (!value || value.length > 16_384)
+        return null;
+    const parts = value.split(':');
+    if (parts.length !== 3)
+        return null;
+    const [payload, ts, signature] = parts;
+    const signed = `${payload}:${ts}`;
+    const salt = options.salt ?? 'django.contrib.sessions.backends.signed_cookies';
+    const algorithms = options.algorithm ? [options.algorithm] : ['sha256', 'sha1'];
+    let ok = false;
+    for (const secret of asList(options.secretKey)) {
+        for (const alg of algorithms) {
+            const expected = toBase64(await djangoSaltedHmac(`${salt}signer`, signed, secret, alg), true);
+            if (sameString(expected, signature))
+                ok = true;
+        }
+    }
+    if (!ok)
+        return null;
+    const issued = b62decode(ts);
+    if (!Number.isFinite(issued))
+        return null;
+    if (options.maxAgeSeconds !== undefined) {
+        const age = (options.now ?? new Date()).getTime() / 1000 - issued;
+        if (age > options.maxAgeSeconds)
+            return null;
+    }
+    return decodeDjangoPayload(payload);
+}
+/**
+ * Decode a `signing.dumps` payload (the part before the timestamp) WITHOUT
+ * verifying it — for rows read out of the app's own `django_session` table.
+ */
+async function decodeDjangoPayload(payload) {
+    const compressed = payload.startsWith('.');
+    const raw = fromBase64(compressed ? payload.slice(1) : payload);
+    if (!raw)
+        return null;
+    const json = compressed ? await inflate(raw) : raw;
+    if (!json)
+        return null;
+    try {
+        const data = JSON.parse(dec.decode(json));
+        return isRecord(data) ? data : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** The signed-in user of a Django session: `_auth_user_id` and `_auth_user_hash`. */
+function djangoSessionUser(data) {
+    const id = data._auth_user_id;
+    const idText = typeof id === 'number' ? String(id) : typeof id === 'string' && id ? id : null;
+    if (!idText)
+        return null;
+    return { id: idText, hash: typeof data._auth_user_hash === 'string' ? data._auth_user_hash : null };
+}
+/**
+ * Django's session auth hash for a user's stored password hash
+ * (`AbstractBaseUser.get_session_auth_hash`): hex salted_hmac with SHA-256. A
+ * session whose `_auth_user_hash` differs was signed out by a password change.
+ */
+async function djangoSessionAuthHash(passwordHash, secretKey) {
+    return hex(await djangoSaltedHmac('django.contrib.auth.models.AbstractBaseUser.get_session_auth_hash', passwordHash, secretKey, 'sha256'));
+}
+//# sourceMappingURL=framework-sessions.js.map

package/dist/framework-sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"framework-sessions.js","sourceRoot":"","sources":["../src/framework-sessions.ts"],"names":[],"mappings":";;;AAqIA,0DAeC;AAOD,wDAKC;AA0BD,4DAuCC;AAgBD,gEAkBC;AAYD,wCAIC;AAYD,8CAkDC;AAGD,wCAQC;AAgBD,gDA6DC;AAaD,8CAWC;AAGD,8CAGC;AA6CD,4DAiCC;AAMD,kDAYC;AAGD,8CAKC;AAOD,sDAIC;AA1jBD,+BAAyD;AAEzD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAC9B,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;AAE9B,SAAS,KAAK,CAAC,KAAa;IAC1B,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC/D,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAiB,EAAE,GAAY;IAC/C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACtB,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AACpF,CAAC;AAED,SAAS,GAAG,CAAC,KAAiB;IAC5B,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,2DAA2D;AAC3D,SAAS,UAAU,CAAC,CAAS,EAAE,CAAS;IACtC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAC7E,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,IAAqC,EAAE,GAA4B,EAAE,IAA6B;IACpH,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7F,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,IAAyB,EAAE,IAA6B;IAC5E,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAChE,CAAC;AAED,KAAK,UAAU,MAAM,CACnB,IAAyB,EACzB,QAAiC,EACjC,IAA6B,EAC7B,UAAkB,EAClB,MAAc;IAEd,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IAC1F,OAAO,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;AACnH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,GAA4B,EAAE,IAAY,EAAE,IAAY,EAAE,MAAc;IAChG,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;IACnF,OAAO,IAAI,UAAU,CACnB,MAAM,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,MAAM,GAAG,CAAC,CAAC,CACvH,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,KAAiC;IAC/C,OAAO,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACjH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAW;IACpC,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,SAAS,SAAS,CAAC,MAAiC;IAClD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAE/E,yFAAyF;AAC5E,QAAA,sBAAsB,GAAG;IACpC,+BAA+B;IAC/B,sBAAsB;IACtB,kCAAkC;IAClC,yBAAyB;CACjB,CAAC;AAEX;;;;;GAKG;AACH,SAAgB,uBAAuB,CACrC,YAAgE,EAChE,UAAmC,EAAE;IAErC,MAAM,OAAO,GACX,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAC9H,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,8BAAsB,CAAC,CAAC;IACtF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;QACzC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,EAAE,CAAE,CAAC,CAAC;QAC5F,IAAI,MAAM,CAAC,MAAM;YAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAa;IAClD,MAAM,CAAC,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACnC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,uCAAuC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,OAAO,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAaD;;;;;;;;;;;;GAYG;AACI,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,OAAyE;IAEzE,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,sBAAsB,CAAC,KAAK,CAAC,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnE,IAAI,MAA0B,CAAC;IAC/B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAA,4BAAqB,EAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,MAAM,CAAC,GAAG,KAAK,KAAK;YAAE,OAAO,IAAI,CAAC;QACtC,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,KAAK,eAAe;QAAE,OAAO,IAAI,CAAC;IACpE,MAAM,UAAU,GAA8B,EAAE,CAAC;IACjD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,eAAe,EAAE,CAAC;YAC/B,UAAU,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,qCAAqC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;QACjH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,EAAE,qCAAqC,OAAO,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC;YAC/G,UAAU,CAAC,IAAI,CAAC,MAAM,UAAU,CAAC,GAAG,EAAE,EAAE,EAAE,sCAAsC,EAAE,EAAE,CAAC,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,IAAA,iBAAU,EAAC,KAAK,EAAE,GAAG,EAAE;gBAC/C,uBAAuB,EAAE,CAAC,KAAK,CAAC;gBAChC,2BAA2B,EAAE,CAAC,MAAM,CAAC;gBACrC,cAAc,EAAE,EAAE;gBAClB,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACrD,CAAC,CAAC;YACH,OAAO,OAA8B,CAAC;QACxC,CAAC;QAAC,MAAM,CAAC;YACP,uDAAuD;QACzD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,6CAA6C;AAChC,QAAA,sBAAsB,GAAG,aAAa,CAAC;AAEpD;;;;;;;;GAQG;AACI,KAAK,UAAU,0BAA0B,CAC9C,GAAW,EACX,OAAoC;IAEpC,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,IAAI,CAAC;IAC1E,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IACtC,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC;IACtC,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACtG,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;YAAE,OAAO,GAAG,CAAC;IAClD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAE/E,uDAAuD;AAC1C,QAAA,oBAAoB,GAAG,cAAc,CAAC;AAEnD;;;;GAIG;AACI,KAAK,UAAU,cAAc,CAAC,KAAa,EAAE,UAAiC,MAAM;IACzF,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,CAAC,KAAK,IAAI,CAAC,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AACjF,CAAC;AAED,+EAA+E;AAE/E;;;;;;;GAOG;AACI,KAAK,UAAU,iBAAiB,CACrC,GAAW,EACX,QAAmD,EACnD,UAA0B,EAAE;IAE5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,CAAC,GAAG,KAE5E,CAAC;IACF,MAAM,MAAM,GACV,OAAO,QAAQ,KAAK,QAAQ;QAC1B,CAAC,CAAC,UAAU,KAAK,EAAE,IAAI,UAAU,KAAK,GAAG;YACvC,CAAC,CAAC,QAAQ;YACV,CAAC,CAAC,SAAS;QACb,CAAC,CAAC,QAAQ,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,GAAG,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,GAAG,GAAG,MAAM;YAAE,OAAO,IAAI,CAAC;IAChE,CAAC;IACD,MAAM,YAAY,GAAG,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAClF,MAAM,WAAW,GAAG,QAAQ,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5G,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/C,MAAM,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IACxD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,MAAM,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,EAC3D,SAAS,EACT,KAAK,EACL,CAAC,SAAS,CAAC,CACZ,CAAC;QACF,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC;QAChG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAA4B,CAAC;QAC1D,6EAA6E;QAC7E,gCAAgC;QAChC,IAAI,OAAO,KAAK,GAAG,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;YAC/F,OAAO,IAAI,CAAC,UAAe,CAAC;QAC9B,CAAC;QACD,OAAO,IAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAgB,cAAc,CAAC,IAAa,EAAE,IAAY;IACxD,IAAI,GAAG,GAAY,IAAI,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAClC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACjD,GAAG,GAAI,GAA+B,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC;IACxE,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACI,KAAK,UAAU,kBAAkB,CACtC,GAAW,EACX,OAMC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,IAAI,CAAC,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,KAAK,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1D,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,MAAM,OAAO,GAA+B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,gCAAgC,CAAC;IAC9D,IAAI,KAAK,GAAkB,IAAI,CAAC;IAChC,KAAK,EAAE,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1D,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBAClE,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;gBACrF,KAAK,GAAG,GAAG,CAAC,MAAM,CAChB,MAAM,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,CAC7H,CAAC;gBACF,MAAM,KAAK,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,8BAA8B;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAI,MAAkG,EAAE,MAAM,CAAC;IAC7H,IAAI,CAAC,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IACvD,IAAI,OAAO,CAAC,UAAU,IAAI,QAAQ,CAAC,GAAG,IAAI,IAAI,IAAI,QAAQ,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,UAAU,EAAE;QAAE,OAAO,IAAI,CAAC;IAC/G,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE;YAAE,OAAO,IAAI,CAAC;IACzF,CAAC;IACD,IAAI,IAAI,GAAY,QAAQ,CAAC,IAAI,CAAC;IAClC,IAAI,IAAI,KAAK,SAAS,IAAI,OAAO,QAAQ,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC/D,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3C,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACxB,IAAI,CAAC;YACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACtC,CAAC;AAED,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,iBAAiB,CAC/B,OAAgC,EAChC,KAAK,GAAG,MAAM;IAEd,MAAM,KAAK,GAAG,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3D,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACrB,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAC7C,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrH,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC9E,CAAC;AAED,gFAAgF;AAChF,SAAgB,iBAAiB,CAAC,IAAmB,EAAE,iBAA4C;IACjG,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,IAAI,iBAAiB,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,UAAU,CAAC,IAAI,EAAE,iBAAiB,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAE/E,oEAAoE;AACvD,QAAA,qBAAqB,GAAG,WAAW,CAAC;AAEjD,MAAM,GAAG,GAAG,gEAAgE,CAAC;AAC7E,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC;QACtB,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kEAAkE;AAClE,KAAK,UAAU,gBAAgB,CAAC,OAAe,EAAE,KAAa,EAAE,MAAc,EAAE,SAA4B;IAC1G,MAAM,IAAI,GAAG,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC;IACxD,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,OAAO,CAAC,IAA6B;IAClD,MAAM,EAAE,GAAI,UAAmF,CAAC,mBAAmB,CAAC;IACpH,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,SAAS,CAAU,CAAC,CAAC;QACjF,OAAO,IAAI,UAAU,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAwB,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACpF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACI,KAAK,UAAU,wBAAwB,CAC5C,GAAW,EACX,OAMC;IAED,MAAM,KAAK,GAAG,iBAAiB,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC5D,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,MAAM;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,OAAO,EAAE,EAAE,EAAE,SAAS,CAAC,GAAG,KAAiC,CAAC;IACnE,MAAM,MAAM,GAAG,GAAG,OAAO,IAAI,EAAE,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,iDAAiD,CAAC;IAC/E,MAAM,UAAU,GAA6B,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC1G,IAAI,EAAE,GAAG,KAAK,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC/C,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,gBAAgB,CAAC,GAAG,IAAI,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;YAC9F,IAAI,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC;gBAAE,EAAE,GAAG,IAAI,CAAC;QACjD,CAAC;IACH,CAAC;IACD,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,OAAO,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC;QAClE,IAAI,GAAG,GAAG,OAAO,CAAC,aAAa;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IACD,OAAO,mBAAmB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAChE,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACnD,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAY,CAAC;QACrD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,qFAAqF;AACrF,SAAgB,iBAAiB,CAAC,IAA6B;IAC7D,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,CAAC;IAC9B,MAAM,MAAM,GAAG,OAAO,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAC9F,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,IAAI,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AACtG,CAAC;AAED;;;;GAIG;AACI,KAAK,UAAU,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;IACjF,OAAO,GAAG,CACR,MAAM,gBAAgB,CAAC,mEAAmE,EAAE,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC,CAC/H,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,21 @@
 export * from './jwks-cache';
 export { DiscoveryError, JwksDiscovery, discoveryUrlFor, instanceIdFromPublishableKey } from './discovery';
 export * from './verify';
+export * from './request-auth';
 export * from './recent-auth';
 export * from './access-control';
 export * from './handshake';
 export * from './better-auth';
+export * from './migration-presets';
+export * from './migration-bridge';
+export * from './auth0-session';
+export { looksLikeMagicDidToken, magicDidTokenExtractor } from './magic-did';
+export { workosSessionTokenExtractor } from './workos-session';
 export { BETTER_AUTH_JWT_ALGS, peekIssuer } from './legacy-issuers';
-export type { LegacyIssuer } from './legacy-issuers';
+export type { LegacyIssuer, LegacyIssuerKind } from './legacy-issuers';
+export * from './legacy-issuer-presets';
+export * from './framework-sessions';
+export * from './framework-bridge';
 export { BACKCHANNEL_LOGOUT_EVENT, LOGOUT_TOKEN_CLOCK_SKEW_SECONDS, LOGOUT_TOKEN_MAX_AGE_SECONDS, LogoutTokenVerifier, memoryLogoutReplayStore, verifyLogoutToken, } from './logout-token';
 export type { LogoutReplayStore, LogoutTokenCheckOptions, LogoutTokenClaims, LogoutTokenResult, LogoutTokenVerifierOptions, } from './logout-token';
 export { expressBackchannelLogout, fastifyBackchannelLogout, fastifyBackchannelLogoutPlugin, fetchBackchannelLogout, handleBackchannelLogout, nextBackchannelLogout, readLogoutToken, } from './backchannel-handlers';
@@ -30,3 +39,4 @@ export { requirePCA, defaultExtract, memoryPcaStore } from './pca/require-pca';
 export type { RequirePcaOptions, PcaGuardResult, PcaRequestLike, PcaStateStore } from './pca/require-pca';
 export { ACCESS_TOKEN_CLOCK_SKEW_SECONDS, DPOP_PROOF_MAX_AGE_SECONDS, buildWwwAuthenticate, createAccessTokenVerifier, createIntrospector, hmacDpopNonceSource, memoryDpopNonceSource, memoryDpopReplayStore, protectedResourceMetadata, protectedResourceMetadataPath, verifyAccessToken, } from './oauth-resource';
 export type { AccessTokenClaims, AccessTokenErrorCode, AccessTokenResult, AccessTokenVerifierOptions, DpopNonceSource, DpopReplayStore, IntrospectionOptions, ResourceRequestLike, } from './oauth-resource';
+export * from './legacy-verify';

package/dist/index.js

@@ -14,8 +14,8 @@ var __exportStar = (this && this.__exportStar) || function(m, exports) {
     for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
-exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = void 0;
+exports.memoryPcaStore = exports.defaultExtract = exports.requirePCA = exports.verifyPCActn = exports.REFERALLI_API_VERSION = exports.referralEmailHash = exports.referalliSignatureV2 = exports.referalliSignature = exports.signReferralUpdatedEvent = exports.signReferalliCall = exports.signAtlasReferralCall = exports.testTenantClaims = exports.TEST_TOKEN_TAMPERS = exports.createTestIssuer = exports.createAtlasClient = exports.resetOidcCaches = exports.oidcSsoOf = exports.oidcOrganizationsOf = exports.oidcOrganizationOf = exports.oidcVerifyIdToken = exports.oidcStart = exports.oidcLogoutUrl = exports.oidcClearCookie = exports.oidcCallback = exports.oidc = exports.OIDC_FLOW_MAX_AGE_SECONDS = exports.OIDC_FLOW_COOKIE = exports.AtlasOidcError = exports.readLogoutToken = exports.nextBackchannelLogout = exports.handleBackchannelLogout = exports.fetchBackchannelLogout = exports.fastifyBackchannelLogoutPlugin = exports.fastifyBackchannelLogout = exports.expressBackchannelLogout = exports.verifyLogoutToken = exports.memoryLogoutReplayStore = exports.LogoutTokenVerifier = exports.LOGOUT_TOKEN_MAX_AGE_SECONDS = exports.LOGOUT_TOKEN_CLOCK_SKEW_SECONDS = exports.BACKCHANNEL_LOGOUT_EVENT = exports.peekIssuer = exports.BETTER_AUTH_JWT_ALGS = exports.workosSessionTokenExtractor = exports.magicDidTokenExtractor = exports.looksLikeMagicDidToken = exports.instanceIdFromPublishableKey = exports.discoveryUrlFor = exports.JwksDiscovery = exports.DiscoveryError = void 0;
+exports.verifyAccessToken = exports.protectedResourceMetadataPath = exports.protectedResourceMetadata = exports.memoryDpopReplayStore = exports.memoryDpopNonceSource = exports.hmacDpopNonceSource = exports.createIntrospector = exports.createAccessTokenVerifier = exports.buildWwwAuthenticate = exports.DPOP_PROOF_MAX_AGE_SECONDS = exports.ACCESS_TOKEN_CLOCK_SKEW_SECONDS = void 0;
 // §7.3 token verification — the original surface, unchanged.
 __exportStar(require("./jwks-cache"), exports);
 // OIDC discovery of the JWKS URL when only `issuer` is configured.
@@ -25,14 +25,30 @@ Object.defineProperty(exports, "JwksDiscovery", { enumerable: true, get: functio
 Object.defineProperty(exports, "discoveryUrlFor", { enumerable: true, get: function () { return discovery_1.discoveryUrlFor; } });
 Object.defineProperty(exports, "instanceIdFromPublishableKey", { enumerable: true, get: function () { return discovery_1.instanceIdFromPublishableKey; } });
 __exportStar(require("./verify"), exports);
+__exportStar(require("./request-auth"), exports);
 __exportStar(require("./recent-auth"), exports);
 __exportStar(require("./access-control"), exports);
 __exportStar(require("./handshake"), exports);
 // Moving from Better Auth: exchange its session cookie once, accept its JWTs for a window.
 __exportStar(require("./better-auth"), exports);
+// Moving from any vendor: the generic zero-logout bridge and its per-vendor presets.
+__exportStar(require("./migration-presets"), exports);
+__exportStar(require("./migration-bridge"), exports);
+__exportStar(require("./auth0-session"), exports);
+var magic_did_1 = require("./magic-did");
+Object.defineProperty(exports, "looksLikeMagicDidToken", { enumerable: true, get: function () { return magic_did_1.looksLikeMagicDidToken; } });
+Object.defineProperty(exports, "magicDidTokenExtractor", { enumerable: true, get: function () { return magic_did_1.magicDidTokenExtractor; } });
+var workos_session_1 = require("./workos-session");
+Object.defineProperty(exports, "workosSessionTokenExtractor", { enumerable: true, get: function () { return workos_session_1.workosSessionTokenExtractor; } });
 var legacy_issuers_1 = require("./legacy-issuers");
 Object.defineProperty(exports, "BETTER_AUTH_JWT_ALGS", { enumerable: true, get: function () { return legacy_issuers_1.BETTER_AUTH_JWT_ALGS; } });
 Object.defineProperty(exports, "peekIssuer", { enumerable: true, get: function () { return legacy_issuers_1.peekIssuer; } });
+__exportStar(require("./legacy-issuer-presets"), exports);
+// Moving from a self-hosted framework (Auth.js, Lucia, Passport, iron-session,
+// Devise, Django): read the session it left in the browser.
+__exportStar(require("./framework-sessions"), exports);
+// …and their bridge presets + token extractors (registers the presets on load).
+__exportStar(require("./framework-bridge"), exports);
 // OIDC Back-Channel Logout: verify the logout_token Atlas POSTs to your app.
 var logout_token_1 = require("./logout-token");
 Object.defineProperty(exports, "BACKCHANNEL_LOGOUT_EVENT", { enumerable: true, get: function () { return logout_token_1.BACKCHANNEL_LOGOUT_EVENT; } });
@@ -114,4 +130,5 @@ Object.defineProperty(exports, "memoryDpopReplayStore", { enumerable: true, get:
 Object.defineProperty(exports, "protectedResourceMetadata", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadata; } });
 Object.defineProperty(exports, "protectedResourceMetadataPath", { enumerable: true, get: function () { return oauth_resource_1.protectedResourceMetadataPath; } });
 Object.defineProperty(exports, "verifyAccessToken", { enumerable: true, get: function () { return oauth_resource_1.verifyAccessToken; } });
+__exportStar(require("./legacy-verify"), exports);
 //# sourceMappingURL=index.js.map