@authrim/sveltekit 0.1.2 → 0.1.4

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/lib/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EAgBd,MAAM,YAAY,CAAC;AAmEpB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CAkbxB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/lib/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAYH,OAAO,KAAK,EACV,aAAa,EACb,aAAa,EAgBd,MAAM,YAAY,CAAC;AAmEpB;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,CAAC,CAsbxB"}

package/dist/client.js

@@ -80,8 +80,8 @@ export async function createAuthrim(config) {
         http,
     });
     // Token exchange callback
-    const exchangeToken = async (authCode, codeVerifier) => {
-        return sessionManager.exchangeToken(authCode, codeVerifier);
+    const exchangeToken = async (authCode, codeVerifier, providerId) => {
+        return sessionManager.exchangeToken(authCode, codeVerifier, undefined, providerId);
     };
     // Create Direct Auth implementations
     const passkeyImpl = new PasskeyAuthImpl({

package/dist/direct-auth/session.d.ts

@@ -25,7 +25,7 @@ export declare class SessionAuthImpl implements SessionAuth {
     getUser(): Promise<User | null>;
     validate(): Promise<boolean>;
     logout(options?: DirectAuthLogoutOptions): Promise<void>;
-    exchangeToken(authCode: string, codeVerifier: string, requestRefreshToken?: boolean): Promise<{
+    exchangeToken(authCode: string, codeVerifier: string, requestRefreshToken?: boolean, providerId?: string): Promise<{
         session?: Session;
         user?: User;
     }>;

package/dist/direct-auth/session.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAG5B,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAU9D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAaD,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,OAAO,EAAE,qBAAqB;IAO1C,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IASnB,GAAG,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAyC9B,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAS/B,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAY5B,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxD,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,mBAAmB,CAAC,EAAE,OAAO,GAC5B,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IAgE9C;;;;;;;;;;OAUG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAKlC,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAUzC,UAAU,IAAI,IAAI;IAMlB,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}
+{"version":3,"file":"session.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/session.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAEL,KAAK,WAAW,EAChB,KAAK,OAAO,EACZ,KAAK,uBAAuB,EAG5B,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAU9D,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,iBAAiB,CAAC;CACzB;AAaD,qBAAa,eAAgB,YAAW,WAAW;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAoB;IACzC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,aAAa,CAAwB;IAC7C,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,CAAC,kBAAkB,CAAa;IACvC,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAS;gBAE/B,OAAO,EAAE,qBAAqB;IAO1C,OAAO,CAAC,cAAc;IAStB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,iBAAiB;IASnB,GAAG,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAyC9B,OAAO,IAAI,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;IAS/B,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC;IAY5B,MAAM,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,IAAI,CAAC;IAqCxD,aAAa,CACjB,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,mBAAmB,CAAC,EAAE,OAAO,EAC7B,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,IAAI,CAAC,EAAE,IAAI,CAAA;KAAE,CAAC;IAmE9C;;;;;;;;;;OAUG;IACG,OAAO,IAAI,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC;IAKlC,eAAe,IAAI,OAAO,CAAC,OAAO,CAAC;IAUzC,UAAU,IAAI,IAAI;IAMlB,QAAQ,IAAI,MAAM,GAAG,IAAI;CAG1B"}

package/dist/direct-auth/session.js

@@ -144,7 +144,7 @@ export class SessionAuthImpl {
             window.location.href = options.redirectUri;
         }
     }
-    async exchangeToken(authCode, codeVerifier, requestRefreshToken) {
+    async exchangeToken(authCode, codeVerifier, requestRefreshToken, providerId) {
         const request = {
             grant_type: 'authorization_code',
             code: authCode,
@@ -152,6 +152,9 @@ export class SessionAuthImpl {
             code_verifier: codeVerifier,
             request_refresh_token: requestRefreshToken,
         };
+        if (providerId) {
+            request.provider_id = providerId;
+        }
         const response = await this.http.fetch(`${this.issuer}${ENDPOINTS.TOKEN}`, {
             method: 'POST',
             headers: { 'Content-Type': 'application/json' },

package/dist/direct-auth/social.d.ts

@@ -7,7 +7,7 @@ export interface SocialAuthOptions {
     clientId: string;
     crypto: CryptoProvider;
     storage: AuthrimStorage;
-    exchangeToken: (authCode: string, codeVerifier: string) => Promise<{
+    exchangeToken: (authCode: string, codeVerifier: string, providerId?: string) => Promise<{
         session?: Session;
         user?: User;
     }>;

package/dist/direct-auth/social.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/social.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAwGvB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,KACjB,OAAO,CAAC;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC,CAAC;IACH;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;gBAE5D,OAAO,EAAE,iBAAiB;IActC;;OAEG;IACH,OAAO,IAAI,IAAI;IAOT,cAAc,CAClB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,UAAU,CAAC;IAmEhB,iBAAiB,CACrB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC;IA6BV,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC;IA+G3C,iBAAiB,IAAI,OAAO;IAK5B,qBAAqB,IAAI,cAAc,EAAE;YAI3B,aAAa;IAM3B,OAAO,CAAC,qBAAqB;IA+B7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,wBAAwB;YAelB,kBAAkB;IAoHhC,OAAO,CAAC,YAAY;YAaN,gBAAgB;IAO9B,OAAO,CAAC,cAAc;CAQvB"}
+{"version":3,"file":"social.d.ts","sourceRoot":"","sources":["../../src/lib/direct-auth/social.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAGL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,KAAK,IAAI,EACV,MAAM,eAAe,CAAC;AAwGvB,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,cAAc,CAAC;IACvB,OAAO,EAAE,cAAc,CAAC;IACxB,aAAa,EAAE,CACb,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,UAAU,CAAC,EAAE,MAAM,KAChB,OAAO,CAAC;QACX,OAAO,CAAC,EAAE,OAAO,CAAC;QAClB,IAAI,CAAC,EAAE,IAAI,CAAC;KACb,CAAC,CAAC;IACH;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAYD,qBAAa,cAAe,YAAW,UAAU;IAC/C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAa;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAiB;IACzC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAqC;IACnE,OAAO,CAAC,QAAQ,CAAC,oBAAoB,CAAS;IAC9C,OAAO,CAAC,WAAW,CAAuB;IAC1C,OAAO,CAAC,oBAAoB,CAAuB;IACnD,OAAO,CAAC,YAAY,CAA+C;IACnE,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAgC;gBAE5D,OAAO,EAAE,iBAAiB;IActC;;OAEG;IACH,OAAO,IAAI,IAAI;IAOT,cAAc,CAClB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,UAAU,CAAC;IAmEhB,iBAAiB,CACrB,QAAQ,EAAE,cAAc,EACxB,OAAO,CAAC,EAAE,kBAAkB,GAAG;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GACrD,OAAO,CAAC,IAAI,CAAC;IA6BV,cAAc,IAAI,OAAO,CAAC,UAAU,CAAC;IA6H3C,iBAAiB,IAAI,OAAO;IAK5B,qBAAqB,IAAI,cAAc,EAAE;YAI3B,aAAa;IAM3B,OAAO,CAAC,qBAAqB;IA+B7B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,gBAAgB;IASxB,OAAO,CAAC,wBAAwB;YAelB,kBAAkB;IAmIhC,OAAO,CAAC,YAAY;YAaN,gBAAgB;IAO9B,OAAO,CAAC,cAAc;CAQvB"}

package/dist/direct-auth/social.js

@@ -264,8 +264,21 @@ export class SocialAuthImpl {
                 },
             };
         }
+        const providerId = await this.storage.get(STORAGE_KEYS.PROVIDER);
+        if (!providerId) {
+            await this.clearStoredState();
+            return {
+                success: false,
+                error: {
+                    error: 'invalid_state',
+                    error_description: 'No provider found. Please try again.',
+                    code: 'AR004006',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            };
+        }
         try {
-            const { session, user } = await this.exchangeToken(code, codeVerifier);
+            const { session, user } = await this.exchangeToken(code, codeVerifier, providerId);
             // Extract redirectTo from state (after validation)
             const stateData = storedState ? decodeStateData(storedState) : null;
             const redirectTo = stateData?.redirectTo && isValidRelativePath(stateData.redirectTo)
@@ -428,8 +441,22 @@ export class SocialAuthImpl {
             await this.clearStoredState();
             return;
         }
+        const providerId = await this.storage.get(STORAGE_KEYS.PROVIDER);
+        if (!providerId) {
+            resolve({
+                success: false,
+                error: {
+                    error: 'invalid_state',
+                    error_description: 'No provider found',
+                    code: 'AR004006',
+                    meta: { retryable: false, severity: 'error' },
+                },
+            });
+            await this.clearStoredState();
+            return;
+        }
         try {
-            const { session, user } = await this.exchangeToken(data.code, codeVerifier);
+            const { session, user } = await this.exchangeToken(data.code, codeVerifier, providerId);
             // Extract redirectTo from state (after validation)
             const stateData = storedState ? decodeStateData(storedState) : null;
             const redirectTo = stateData?.redirectTo && isValidRelativePath(stateData.redirectTo)

package/dist/server/handoff.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Smart Handoff SSO Handler for SvelteKit
+ *
+ * Handles handoff token verification and session management for cross-domain SSO
+ * in SvelteKit server-side code.
+ */
+import type { Handle, RequestEvent } from '@sveltejs/kit';
+import type { Session, User } from '@authrim/core';
+import { type ServerSessionManagerOptions } from './session.js';
+/**
+ * Handoff verification options
+ */
+export interface HandoffVerifyOptions {
+    /**
+     * Authrim IdP URL (required if not using createAuthHandle)
+     */
+    issuer?: string;
+    /**
+     * OAuth client ID (required if not using createAuthHandle)
+     */
+    clientId?: string;
+    /**
+     * Handoff verify endpoint
+     * @default '/auth/external/handoff/verify'
+     */
+    verifyEndpoint?: string;
+    /**
+     * Error redirect path
+     * @default '/login'
+     */
+    errorRedirect?: string;
+    /**
+     * Session manager options
+     */
+    sessionOptions?: ServerSessionManagerOptions;
+}
+/**
+ * Verify handoff token from callback URL
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * export const load = async (event) => {
+ *   const result = await verifyHandoffToken(event);
+ *   if (!result.success) {
+ *     throw redirect(302, '/login');
+ *   }
+ *   return { session: result.session, user: result.user };
+ * };
+ * ```
+ */
+export declare function verifyHandoffToken(event: RequestEvent, options?: HandoffVerifyOptions): Promise<{
+    success: true;
+    session: Session;
+    user: User;
+} | {
+    success: false;
+    error: string;
+}>;
+/**
+ * Create handoff handler for SvelteKit hooks
+ *
+ * Usage in hooks.server.ts:
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createAuthHandle, createHandoffHandler } from '@authrim/sveltekit/server';
+ *
+ * export const handle = sequence(
+ *   createAuthHandle({
+ *     issuer: env.AUTHRIM_ISSUER,
+ *     clientId: env.AUTHRIM_CLIENT_ID,
+ *   }),
+ *   createHandoffHandler()
+ * );
+ * ```
+ */
+export declare function createHandoffHandler(options?: HandoffVerifyOptions): Handle;
+//# sourceMappingURL=handoff.d.ts.map

package/dist/server/handoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"handoff.d.ts","sourceRoot":"","sources":["../../src/lib/server/handoff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE1D,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AACnD,OAAO,EAGL,KAAK,2BAA2B,EACjC,MAAM,cAAc,CAAC;AAEtB;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAEhB;;OAEG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;IAElB;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IAExB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;IAEvB;;OAEG;IACH,cAAc,CAAC,EAAE,2BAA2B,CAAC;CAC9C;AAmDD;;;;;;;;;;;;;GAaG;AACH,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,YAAY,EACnB,OAAO,CAAC,EAAE,oBAAoB,GAC7B,OAAO,CACN;IAAE,OAAO,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,IAAI,CAAA;CAAE,GAC/C;IAAE,OAAO,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CACpC,CA+DA;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,CAwB3E"}

package/dist/server/handoff.js

@@ -0,0 +1,133 @@
+/**
+ * Smart Handoff SSO Handler for SvelteKit
+ *
+ * Handles handoff token verification and session management for cross-domain SSO
+ * in SvelteKit server-side code.
+ */
+import { redirect } from '@sveltejs/kit';
+import { createServerSessionManager, } from './session.js';
+/**
+ * Get auth config from options or event.locals
+ */
+function getAuthConfig(event, options) {
+    // Try to get from options first
+    if (options?.issuer && options?.clientId) {
+        return { issuer: options.issuer, clientId: options.clientId };
+    }
+    // Fallback to event.locals (set by createAuthHandle)
+    const issuer = event.locals.authrim_issuer;
+    const clientId = event.locals.authrim_client_id;
+    if (!issuer || !clientId) {
+        throw new Error('Authrim config not found. Please provide issuer and clientId in options, or use createAuthHandle.');
+    }
+    return { issuer, clientId };
+}
+/**
+ * Verify handoff token from callback URL
+ *
+ * Usage in +page.server.ts:
+ * ```typescript
+ * export const load = async (event) => {
+ *   const result = await verifyHandoffToken(event);
+ *   if (!result.success) {
+ *     throw redirect(302, '/login');
+ *   }
+ *   return { session: result.session, user: result.user };
+ * };
+ * ```
+ */
+export async function verifyHandoffToken(event, options) {
+    const { url } = event;
+    const handoffToken = url.searchParams.get('handoff_token');
+    const state = url.searchParams.get('state');
+    if (!handoffToken || !state) {
+        return { success: false, error: 'Missing handoff token or state' };
+    }
+    try {
+        const { issuer, clientId } = getAuthConfig(event, options);
+        const verifyEndpoint = options?.verifyEndpoint || '/auth/external/handoff/verify';
+        const response = await fetch(`${issuer}${verifyEndpoint}`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                handoff_token: handoffToken,
+                state: state,
+                client_id: clientId,
+            }),
+        });
+        if (!response.ok) {
+            const error = await response.json().catch(() => ({}));
+            return {
+                success: false,
+                error: error.error_description || 'Handoff verification failed',
+            };
+        }
+        const data = await response.json();
+        // Save session to cookie
+        const sessionManager = createServerSessionManager(options?.sessionOptions);
+        const authContext = {
+            session: {
+                id: data.session.id,
+                userId: data.session.userId,
+                createdAt: data.session.createdAt,
+                expiresAt: data.session.expiresAt,
+            },
+            user: {
+                id: data.user.id,
+                email: data.user.email ?? undefined,
+                name: data.user.name ?? undefined,
+                emailVerified: data.user.emailVerified,
+            },
+        };
+        sessionManager.set(event, authContext);
+        return {
+            success: true,
+            session: authContext.session,
+            user: authContext.user,
+        };
+    }
+    catch (error) {
+        return {
+            success: false,
+            error: error instanceof Error ? error.message : 'Unknown error',
+        };
+    }
+}
+/**
+ * Create handoff handler for SvelteKit hooks
+ *
+ * Usage in hooks.server.ts:
+ * ```typescript
+ * import { sequence } from '@sveltejs/kit/hooks';
+ * import { createAuthHandle, createHandoffHandler } from '@authrim/sveltekit/server';
+ *
+ * export const handle = sequence(
+ *   createAuthHandle({
+ *     issuer: env.AUTHRIM_ISSUER,
+ *     clientId: env.AUTHRIM_CLIENT_ID,
+ *   }),
+ *   createHandoffHandler()
+ * );
+ * ```
+ */
+export function createHandoffHandler(options) {
+    return async ({ event, resolve }) => {
+        // Check if this is a handoff callback
+        const { url } = event;
+        if (url.searchParams.has('handoff_token')) {
+            const result = await verifyHandoffToken(event, options);
+            if (!result.success) {
+                const errorRedirect = options?.errorRedirect || '/login';
+                // Use 303 See Other (POST → GET redirect, safer than 302)
+                throw redirect(303, errorRedirect);
+            }
+            // Remove handoff token from URL
+            const cleanUrl = new URL(url);
+            cleanUrl.searchParams.delete('handoff_token');
+            cleanUrl.searchParams.delete('state');
+            // Use 303 See Other (認証後のリダイレクトに適切)
+            throw redirect(303, cleanUrl.toString());
+        }
+        return resolve(event);
+    };
+}

package/dist/server/index.d.ts

@@ -1,4 +1,5 @@
 export { createServerSessionManager, type ServerSessionManager, type ServerSessionManagerOptions, type ServerAuthContext, } from './session.js';
 export { createAuthHandle, getServerSessionManager, getAuthFromEvent, type AuthHandleOptions, } from './handle.js';
 export { requireAuth, createAuthLoad, isAuthenticated, getUser, getSession, type AuthLoadOptions, } from './load.js';
+export { verifyHandoffToken, createHandoffHandler, type HandoffVerifyOptions, } from './handoff.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,OAAO,EACP,UAAU,EACV,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lib/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,EAC1B,KAAK,oBAAoB,EACzB,KAAK,2BAA2B,EAChC,KAAK,iBAAiB,GACvB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,gBAAgB,EAChB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,OAAO,EACL,WAAW,EACX,cAAc,EACd,eAAe,EACf,OAAO,EACP,UAAU,EACV,KAAK,eAAe,GACrB,MAAM,WAAW,CAAC;AAEnB,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,oBAAoB,GAC1B,MAAM,cAAc,CAAC"}

package/dist/server/index.js

@@ -1,3 +1,4 @@
 export { createServerSessionManager, } from './session.js';
 export { createAuthHandle, getServerSessionManager, getAuthFromEvent, } from './handle.js';
 export { requireAuth, createAuthLoad, isAuthenticated, getUser, getSession, } from './load.js';
+export { verifyHandoffToken, createHandoffHandler, } from './handoff.js';

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@authrim/sveltekit",
   "packageManager": "pnpm@9.15.0",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "SvelteKit SDK for Authrim authentication",
   "type": "module",
   "svelte": "./dist/index.js",
@@ -84,12 +84,12 @@
     "url": "https://github.com/authrim/js-sveltekit/issues"
   },
   "peerDependencies": {
-    "@authrim/core": ">=0.1.10",
+    "@authrim/core": ">=0.1.14",
     "svelte": "^4.0.0 || ^5.0.0",
     "@sveltejs/kit": "^2.0.0"
   },
   "devDependencies": {
-    "@authrim/core": "^0.1.10",
+    "@authrim/core": "^0.1.14",
     "@sveltejs/adapter-auto": "^3.0.0",
     "@sveltejs/kit": "^2.0.0",
     "@sveltejs/package": "^2.0.0",