@authyon/server 0.2.0-beta.6 → 0.2.0-beta.9

package/dist/bff.cjs

@@ -0,0 +1,1126 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/bff.ts
+var bff_exports = {};
+__export(bff_exports, {
+  BffSessionError: () => BffSessionError,
+  createAuthyonBffProvider: () => createAuthyonBffProvider,
+  createBffSession: () => createBffSession,
+  createMemoryBffSessionStore: () => createMemoryBffSessionStore,
+  createRedisBffSessionStore: () => createRedisBffSessionStore
+});
+module.exports = __toCommonJS(bff_exports);
+
+// src/bff/contracts.ts
+var BffSessionError = class extends Error {
+  constructor(code, status, clearCookie = false) {
+    super(code);
+    this.code = code;
+    this.status = status;
+    this.clearCookie = clearCookie;
+    this.name = "BffSessionError";
+  }
+};
+
+// ../../internal/core/errors/authyonError.ts
+var ErrorCodes = {
+  Unknown: "unknown",
+  NetworkError: "request.network_error",
+  Timeout: "request.timeout",
+  SessionMalformed: "session.malformed",
+  NotAuthenticated: "auth.not_authenticated",
+  InvalidToken: "auth.invalid_token",
+  MissingToken: "auth.missing_token",
+  EmailTaken: "user.email_taken",
+  PasswordWeak: "user.password_weak",
+  PasswordPwned: "user.password_pwned",
+  RateLimited: "rate_limited"
+};
+var AuthyonError = class extends Error {
+  constructor(status, body, options = {}) {
+    super(body.detail ?? body.title ?? `Authyon request failed with status ${status}`);
+    this.name = "AuthyonError";
+    this.status = status;
+    this.code = body.code ?? "unknown";
+    this.title = body.title ?? "Error";
+    this.detail = body.detail;
+    this.requestId = options.requestId;
+    this.retryAfter = options.retryAfter;
+    this.cause = options.cause;
+  }
+  is(code) {
+    return this.code === code;
+  }
+  isAny(...codes) {
+    return codes.includes(this.code);
+  }
+  hasPrefix(prefix) {
+    return this.code.startsWith(prefix);
+  }
+  isStatus(...statuses) {
+    return statuses.includes(this.status);
+  }
+  /** Stable interpretation for UI decisions, retries, telemetry and support flows. */
+  interpret() {
+    const category = classifyError(this.status, this.code);
+    return {
+      category,
+      action: actionFor(category),
+      retryable: isRetryable(category),
+      ...this.retryAfter !== void 0 ? { retryAfter: this.retryAfter } : {},
+      ...this.requestId !== void 0 ? { requestId: this.requestId } : {}
+    };
+  }
+  get category() {
+    return this.interpret().category;
+  }
+  get retryable() {
+    return this.interpret().retryable;
+  }
+  toJSON() {
+    return {
+      name: this.name,
+      message: this.message,
+      status: this.status,
+      code: this.code,
+      title: this.title,
+      detail: this.detail,
+      requestId: this.requestId,
+      retryAfter: this.retryAfter,
+      ...this.interpret()
+    };
+  }
+};
+function classifyError(status, code) {
+  if (code === ErrorCodes.NetworkError) return "network";
+  if (code === ErrorCodes.Timeout || status === 408) return "timeout";
+  if (code === ErrorCodes.RateLimited || status === 429) return "rate_limit";
+  if (code === ErrorCodes.EmailTaken || status === 409) return "conflict";
+  if (code === ErrorCodes.PasswordWeak || code === ErrorCodes.PasswordPwned) return "validation";
+  if (code === ErrorCodes.SessionMalformed) return "server";
+  if (code.startsWith("auth.") || status === 401) return "authentication";
+  if (status === 403) return "authorization";
+  if (status === 404) return "not_found";
+  if (status === 400 || status === 422) return "validation";
+  if (status >= 500) return "server";
+  return "unknown";
+}
+function actionFor(category) {
+  switch (category) {
+    case "network":
+    case "timeout":
+    case "rate_limit":
+    case "server":
+      return "retry";
+    case "authentication":
+      return "reauthenticate";
+    case "authorization":
+      return "request_access";
+    case "validation":
+      return "fix_input";
+    case "not_found":
+      return "not_found";
+    case "conflict":
+      return "resolve_conflict";
+    case "unknown":
+      return "contact_support";
+  }
+}
+function isRetryable(category) {
+  return category === "network" || category === "timeout" || category === "rate_limit" || category === "server";
+}
+
+// src/bff/http.ts
+var MAX_BODY_BYTES = 16384;
+var SESSION_ID = /^[a-f0-9]{64}$/;
+function createBffHttp(options) {
+  const url = new URL(options.origin);
+  const loopback = ["localhost", "127.0.0.1", "[::1]"].includes(url.hostname);
+  const insecure = url.protocol === "http:" && loopback && options.allowInsecureLocalhost === true;
+  if (!insecure && url.protocol !== "https:" || url.origin !== options.origin) {
+    throw new Error("Authyon BFF: origin must be an HTTPS origin, without path or credentials");
+  }
+  const cookieName = insecure ? "authyon.session" : "__Host-authyon.session";
+  const attributes = `Path=/; HttpOnly; SameSite=Lax${insecure ? "" : "; Secure"}`;
+  function assertRequest(request) {
+    if (new URL(request.url).origin !== options.origin)
+      throw new BffSessionError("request.origin_denied", 403);
+    const origin = request.headers.get("origin");
+    if (origin && origin !== options.origin || request.headers.get("sec-fetch-site") === "cross-site") {
+      throw new BffSessionError("request.origin_denied", 403);
+    }
+    if (!["GET", "HEAD"].includes(request.method)) {
+      if (origin !== options.origin || request.headers.get("x-authyon-csrf") !== "1") {
+        throw new BffSessionError("request.csrf_denied", 403);
+      }
+    }
+  }
+  function sessionId(request) {
+    const matches = (request.headers.get("cookie") ?? "").split(";").map((part) => part.trim()).filter((part) => part.startsWith(`${cookieName}=`));
+    if (matches.length > 1) throw new BffSessionError("session.ambiguous_cookie", 401, true);
+    const value = matches[0]?.slice(cookieName.length + 1);
+    return value && SESSION_ID.test(value) ? value : null;
+  }
+  function response(body, init = {}) {
+    const headers = new Headers({
+      "cache-control": "no-store",
+      pragma: "no-cache",
+      vary: "Cookie",
+      "x-content-type-options": "nosniff"
+    });
+    if (init.cookie) headers.set("set-cookie", init.cookie);
+    if (body !== null) headers.set("content-type", "application/json");
+    return new Response(body === null ? null : JSON.stringify(body), {
+      status: init.status ?? 200,
+      headers
+    });
+  }
+  function expireCookie() {
+    return `${cookieName}=; ${attributes}; Max-Age=0`;
+  }
+  function errorResponse(error) {
+    if (error instanceof BffSessionError) {
+      return response(
+        { error: { code: error.code } },
+        { status: error.status, cookie: error.clearCookie ? expireCookie() : void 0 }
+      );
+    }
+    if (error instanceof AuthyonError) {
+      const status = [400, 401, 403, 429].includes(error.status) ? error.status : 503;
+      const result = response(
+        { error: { code: status === 503 ? "provider.unavailable" : "provider.rejected" } },
+        { status }
+      );
+      if (error.retryAfter !== void 0)
+        result.headers.set("retry-after", String(error.retryAfter));
+      return result;
+    }
+    return response({ error: { code: "session.unavailable" } }, { status: 503 });
+  }
+  return {
+    assertRequest,
+    sessionId,
+    response,
+    expireCookie,
+    errorResponse,
+    cookie(id, expiresAt) {
+      return `${cookieName}=${id}; ${attributes}; Max-Age=${Math.max(0, Math.floor((expiresAt - Date.now()) / 1e3))}`;
+    }
+  };
+}
+async function readBffBody(request) {
+  if (request.headers.get("content-type")?.split(";")[0].trim().toLowerCase() !== "application/json") {
+    throw new BffSessionError("request.json_required", 415);
+  }
+  if (!request.body) throw new BffSessionError("request.invalid_body", 400);
+  const reader = request.body.getReader();
+  const chunks = [];
+  let size = 0;
+  try {
+    while (true) {
+      const { value, done } = await reader.read();
+      if (done) break;
+      size += value.byteLength;
+      if (size > MAX_BODY_BYTES) {
+        await reader.cancel();
+        throw new BffSessionError("request.body_too_large", 413);
+      }
+      chunks.push(value);
+    }
+    const bytes = new Uint8Array(size);
+    let offset = 0;
+    for (const chunk of chunks) {
+      bytes.set(chunk, offset);
+      offset += chunk.byteLength;
+    }
+    const body = JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(bytes));
+    if (!body || typeof body !== "object" || Array.isArray(body))
+      throw new Error("invalid JSON object");
+    return body;
+  } catch (error) {
+    if (error instanceof BffSessionError) throw error;
+    throw new BffSessionError("request.invalid_body", 400);
+  } finally {
+    reader.releaseLock();
+  }
+}
+function inputString(body, name) {
+  const value = body[name];
+  if (typeof value !== "string" || value.length === 0)
+    throw new BffSessionError("request.invalid_body", 400);
+  return value;
+}
+function sessionPersistence(body) {
+  const value = body.sessionPersistence;
+  if (value === void 0 || value === "standard") return "standard";
+  if (value === "remembered") return "remembered";
+  throw new BffSessionError("request.invalid_body", 400);
+}
+function loginInput(body) {
+  return {
+    password: inputString(body, "password"),
+    ...body.email !== void 0 ? { email: inputString(body, "email") } : { username: inputString(body, "username") },
+    ...body.organizationSlug !== void 0 ? { organizationSlug: inputString(body, "organizationSlug") } : {},
+    sessionPersistence: sessionPersistence(body)
+  };
+}
+function twoFactorInput(body) {
+  const method = inputString(body, "method");
+  const challengeToken = inputString(body, "challengeToken");
+  const persistence = sessionPersistence(body);
+  if (method !== "webauthn") {
+    return {
+      challengeToken,
+      method,
+      code: inputString(body, "code"),
+      sessionPersistence: persistence
+    };
+  }
+  const assertion = body.webAuthnAssertion;
+  if (!assertion || typeof assertion !== "object" || Array.isArray(assertion))
+    throw new BffSessionError("request.invalid_body", 400);
+  const fields = assertion;
+  return {
+    challengeToken,
+    method,
+    sessionPersistence: persistence,
+    webAuthnAssertion: {
+      ceremonyToken: inputString(fields, "ceremonyToken"),
+      assertionJson: inputString(fields, "assertionJson")
+    }
+  };
+}
+
+// src/bff/sessionRepository.ts
+var import_node_crypto = require("crypto");
+var OPERATION_TIMEOUT_MS = 12e4;
+var CONTENTION_TIMEOUT_MS = 2e3;
+var CONTENTION_POLL_MS = 20;
+var newSessionSecret = () => (0, import_node_crypto.randomBytes)(32).toString("hex");
+var sessionKey = (id, origin) => (0, import_node_crypto.createHash)("sha256").update(`${origin}\0${id}`).digest("hex");
+var BffSessionRepository = class {
+  constructor(store, origin) {
+    this.store = store;
+    this.origin = origin;
+  }
+  async create(record) {
+    const id = newSessionSecret();
+    if (!await this.store.compareAndSwap(sessionKey(id, this.origin), null, record)) {
+      throw new BffSessionError("session.creation_failed", 503);
+    }
+    return id;
+  }
+  async acquire(id) {
+    const key = sessionKey(id, this.origin);
+    const deadline = Date.now() + CONTENTION_TIMEOUT_MS;
+    while (Date.now() < deadline) {
+      const record = await this.readAvailable(key, deadline);
+      const reserved = {
+        ...record,
+        revision: newSessionSecret(),
+        busyUntil: Date.now() + OPERATION_TIMEOUT_MS
+      };
+      if (await this.store.compareAndSwap(key, record.revision, reserved))
+        return { key, record: reserved };
+    }
+    throw new BffSessionError("session.busy", 503);
+  }
+  async inspect(id) {
+    const key = sessionKey(id, this.origin);
+    const record = await this.readAvailable(key, Date.now() + CONTENTION_TIMEOUT_MS);
+    return { key, record };
+  }
+  async touch(lease, idleExpiresAt) {
+    const next = {
+      ...lease.record,
+      revision: newSessionSecret(),
+      idleExpiresAt
+    };
+    return await this.store.compareAndSwap(lease.key, lease.record.revision, next) ? next : null;
+  }
+  async removeIfCurrent(lease) {
+    return this.store.compareAndSwap(lease.key, lease.record.revision, null);
+  }
+  async release(lease) {
+    if (lease.record.busyUntil === null || lease.record.busyUntil <= Date.now()) {
+      await this.remove(lease);
+      throw new BffSessionError("session.interrupted", 503, true);
+    }
+    const next = { ...lease.record, revision: newSessionSecret(), busyUntil: null };
+    if (!await this.store.compareAndSwap(lease.key, lease.record.revision, next)) {
+      throw new BffSessionError("session.changed", 401, true);
+    }
+  }
+  async remove(lease) {
+    if (!await this.removeIfCurrent(lease)) {
+      throw new BffSessionError("session.changed", 401, true);
+    }
+  }
+  async readAvailable(key, deadline) {
+    while (Date.now() < deadline) {
+      const record = await this.store.read(key);
+      if (!record) throw new BffSessionError("session.missing", 401, true);
+      if (Math.min(record.expiresAt, record.idleExpiresAt) <= Date.now()) {
+        if (await this.store.compareAndSwap(key, record.revision, null)) {
+          throw new BffSessionError("session.expired", 401, true);
+        }
+        continue;
+      }
+      if (record.busyUntil === null) return record;
+      if (record.busyUntil <= Date.now()) {
+        if (await this.store.compareAndSwap(key, record.revision, null)) {
+          throw new BffSessionError("session.interrupted", 503, true);
+        }
+        continue;
+      }
+      await new Promise((resolve) => setTimeout(resolve, CONTENTION_POLL_MS));
+    }
+    throw new BffSessionError("session.busy", 503);
+  }
+};
+
+// src/bff/sessionManager.ts
+var DEFAULT_ABSOLUTE_TIMEOUT_MS = 8 * 60 * 60 * 1e3;
+var DEFAULT_IDLE_TIMEOUT_MS = 30 * 60 * 1e3;
+var DEFAULT_REMEMBERED_ABSOLUTE_TIMEOUT_MS = 90 * 24 * 60 * 60 * 1e3;
+var DEFAULT_REMEMBERED_IDLE_TIMEOUT_MS = 30 * 24 * 60 * 60 * 1e3;
+var DEFAULT_REFRESH_AHEAD_MS = 3e4;
+var MAX_SESSION_CHANGE_RETRIES = 2;
+function positiveDuration(value) {
+  if (!Number.isSafeInteger(value) || value <= 0)
+    throw new Error("Authyon BFF: durations must be positive integer milliseconds");
+  return value;
+}
+function rejectedCredential(error) {
+  return error instanceof AuthyonError && [401, 403].includes(error.status);
+}
+var BffSessionManager = class {
+  constructor(options) {
+    this.options = options;
+    this.repository = new BffSessionRepository(options.store, options.origin);
+    this.standardSession = this.createSessionLifetime({
+      absoluteTimeoutMs: options.absoluteTimeoutMs ?? DEFAULT_ABSOLUTE_TIMEOUT_MS,
+      idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS
+    });
+    this.rememberedSession = this.createSessionLifetime({
+      absoluteTimeoutMs: options.rememberedSession?.absoluteTimeoutMs ?? DEFAULT_REMEMBERED_ABSOLUTE_TIMEOUT_MS,
+      idleTimeoutMs: options.rememberedSession?.idleTimeoutMs ?? DEFAULT_REMEMBERED_IDLE_TIMEOUT_MS
+    });
+    this.refreshAhead = positiveDuration(options.refreshAheadMs ?? DEFAULT_REFRESH_AHEAD_MS);
+  }
+  async create(tokens, organizationSlug, sessionPersistence2 = "standard") {
+    try {
+      const user = await this.verifiedProfile(tokens);
+      if (organizationSlug !== void 0 && user.organization?.slug !== organizationSlug) {
+        throw new BffSessionError("session.organization_mismatch", 502);
+      }
+      const lifetime = this.sessionLifetime(sessionPersistence2);
+      const record = {
+        tokens,
+        user,
+        revision: newSessionSecret(),
+        busyUntil: null,
+        sessionPersistence: sessionPersistence2,
+        expiresAt: Date.now() + lifetime.absoluteTimeoutMs,
+        idleExpiresAt: Date.now() + lifetime.idleTimeoutMs
+      };
+      return { id: await this.repository.create(record), record };
+    } catch (error) {
+      await this.revokeUnstoredTokens(tokens);
+      throw error;
+    }
+  }
+  async read(id) {
+    return this.readCurrent(id, 0);
+  }
+  async switchOrganization(id, slug) {
+    return this.update(id, async (lease) => {
+      const refreshed = await this.refreshIfNeeded(lease);
+      if (!refreshed && !await this.options.provider.validate(lease.record.tokens.accessToken)) {
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      await this.rotate(lease, {
+        issue: () => this.issueOrganizationTokens(lease.record.tokens.accessToken, slug),
+        accepts: (user) => user.id === lease.record.user.id && user.organization?.slug === slug
+      });
+    });
+  }
+  async logout(id) {
+    const lease = await this.repository.acquire(id);
+    await this.repository.remove(lease);
+    try {
+      await this.options.provider.logout(lease.record.tokens.refreshToken);
+    } catch {
+      throw new BffSessionError("session.upstream_revocation_failed", 503, true);
+    }
+  }
+  async update(id, operation) {
+    const lease = await this.repository.acquire(id);
+    try {
+      await operation(lease);
+    } catch (error) {
+      if (rejectedCredential(error) || error instanceof BffSessionError && error.clearCookie) {
+        await this.repository.remove(lease);
+        if (error instanceof BffSessionError) throw error;
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      await this.repository.release(lease);
+      throw error;
+    }
+    lease.record.idleExpiresAt = Math.min(
+      lease.record.expiresAt,
+      Date.now() + this.sessionLifetime(lease.record.sessionPersistence).idleTimeoutMs
+    );
+    await this.repository.release(lease);
+    return lease.record;
+  }
+  async readCurrent(id, changeRetries) {
+    const lease = await this.repository.inspect(id);
+    if (this.needsRefresh(lease.record)) {
+      return this.update(id, async (reserved) => {
+        const refreshed = await this.refreshIfNeeded(reserved);
+        if (!refreshed && !await this.options.provider.validate(reserved.record.tokens.accessToken)) {
+          throw new BffSessionError("session.revoked", 401, true);
+        }
+      });
+    }
+    let valid;
+    try {
+      valid = await this.options.provider.validate(lease.record.tokens.accessToken);
+    } catch (error) {
+      if (!rejectedCredential(error)) throw error;
+      valid = false;
+    }
+    if (!valid) {
+      if (await this.repository.removeIfCurrent(lease)) {
+        throw new BffSessionError("session.revoked", 401, true);
+      }
+      if (changeRetries >= MAX_SESSION_CHANGE_RETRIES) {
+        throw new BffSessionError("session.changed", 503);
+      }
+      return this.readCurrent(id, changeRetries + 1);
+    }
+    const idleExpiresAt = Math.min(
+      lease.record.expiresAt,
+      Date.now() + this.sessionLifetime(lease.record.sessionPersistence).idleTimeoutMs
+    );
+    return await this.repository.touch(lease, idleExpiresAt) ?? lease.record;
+  }
+  createSessionLifetime(lifetime) {
+    const absoluteTimeoutMs = positiveDuration(lifetime.absoluteTimeoutMs);
+    const idleTimeoutMs = positiveDuration(lifetime.idleTimeoutMs);
+    if (idleTimeoutMs > absoluteTimeoutMs)
+      throw new Error("Authyon BFF: idle timeout must not exceed absolute timeout");
+    return { absoluteTimeoutMs, idleTimeoutMs };
+  }
+  sessionLifetime(sessionPersistence2) {
+    if (sessionPersistence2 === "remembered") return this.rememberedSession;
+    return this.standardSession;
+  }
+  needsRefresh(record) {
+    return record.tokens.expiresAt - this.refreshAhead <= Date.now();
+  }
+  async refreshIfNeeded(lease) {
+    if (!this.needsRefresh(lease.record)) return false;
+    await this.rotate(lease, {
+      issue: () => this.options.provider.refresh(lease.record.tokens.refreshToken),
+      accepts: (user) => user.id === lease.record.user.id && user.organization?.id === lease.record.user.organization?.id
+    });
+    return true;
+  }
+  async rotate(lease, operation) {
+    let tokens;
+    try {
+      tokens = await operation.issue();
+    } catch (error) {
+      if (error instanceof AuthyonError && error.status === 429) throw error;
+      if (error instanceof BffSessionError && error.code === "organization.forbidden") throw error;
+      if (rejectedCredential(error)) throw error;
+      if (error instanceof BffSessionError && error.clearCookie) throw error;
+      throw new BffSessionError("session.rotation_interrupted", 503, true);
+    }
+    try {
+      const user = await this.verifiedProfile(tokens);
+      if (!operation.accepts(user))
+        throw new BffSessionError("session.identity_changed", 502, true);
+      lease.record.tokens = tokens;
+      lease.record.user = user;
+    } catch {
+      await this.revokeUnstoredTokens(tokens);
+      throw new BffSessionError("session.rotation_interrupted", 503, true);
+    }
+  }
+  async issueOrganizationTokens(accessToken, slug) {
+    try {
+      return await this.options.provider.switchOrganization(accessToken, slug);
+    } catch (error) {
+      if (error instanceof AuthyonError && error.status === 403)
+        throw new BffSessionError("organization.forbidden", 403);
+      throw error;
+    }
+  }
+  async verifiedProfile(tokens) {
+    if (!tokens.accessToken || !tokens.refreshToken || !Number.isFinite(tokens.expiresAt) || tokens.expiresAt <= Date.now()) {
+      throw new BffSessionError("provider.invalid_tokens", 502);
+    }
+    if (!await this.options.provider.validate(tokens.accessToken))
+      throw new BffSessionError("session.revoked", 401, true);
+    const user = await this.options.provider.profile(tokens.accessToken);
+    return {
+      id: user.id,
+      email: user.email,
+      organization: user.organization ? { id: user.organization.id, slug: user.organization.slug } : null
+    };
+  }
+  async revokeUnstoredTokens(tokens) {
+    try {
+      await this.options.provider.logout(tokens.refreshToken);
+    } catch {
+      throw new BffSessionError("session.upstream_revocation_failed", 503, true);
+    }
+  }
+};
+
+// src/bff/handlers.ts
+function publicSession(record) {
+  return { authenticated: true, user: record.user, expiresAt: record.expiresAt };
+}
+function createBffSession(options) {
+  const http = createBffHttp(options);
+  const manager = new BffSessionManager(options);
+  function requiredSessionId(request) {
+    const id = http.sessionId(request);
+    if (!id) throw new BffSessionError("session.missing", 401, true);
+    return id;
+  }
+  function handler(method, action) {
+    return async (request) => {
+      try {
+        if (request.method !== method) {
+          const response = http.response(
+            { error: { code: "request.method_not_allowed" } },
+            { status: 405 }
+          );
+          response.headers.set("allow", method);
+          return response;
+        }
+        http.assertRequest(request);
+        return await action(request);
+      } catch (error) {
+        return http.errorResponse(error);
+      }
+    };
+  }
+  async function finishLogin(tokens, organizationSlug, sessionPersistence2) {
+    const { id, record } = await manager.create(tokens, organizationSlug, sessionPersistence2);
+    return http.response(publicSession(record), { cookie: http.cookie(id, record.expiresAt) });
+  }
+  async function assertSignedOut(request) {
+    const id = http.sessionId(request);
+    if (!id) return;
+    try {
+      await manager.read(id);
+    } catch (error) {
+      if (error instanceof BffSessionError && error.status === 401) return;
+      throw error;
+    }
+    throw new BffSessionError("session.already_authenticated", 409);
+  }
+  return {
+    login: handler("POST", async (request) => {
+      await assertSignedOut(request);
+      const input = loginInput(await readBffBody(request));
+      const result = await options.provider.login(input);
+      if ("twoFactorRequired" in result) {
+        return http.response({
+          twoFactorRequired: true,
+          challengeToken: result.challengeToken,
+          methods: result.methods
+        });
+      }
+      return finishLogin(result, input.organizationSlug, input.sessionPersistence);
+    }),
+    verifyTwoFactor: handler("POST", async (request) => {
+      await assertSignedOut(request);
+      const input = twoFactorInput(await readBffBody(request));
+      const tokens = await options.provider.verifyTwoFactor(input);
+      return finishLogin(tokens, void 0, input.sessionPersistence);
+    }),
+    session: handler(
+      "GET",
+      async (request) => http.response(publicSession(await manager.read(requiredSessionId(request))))
+    ),
+    switchOrganization: handler("POST", async (request) => {
+      const slug = inputString(await readBffBody(request), "organizationSlug");
+      return http.response(
+        publicSession(await manager.switchOrganization(requiredSessionId(request), slug))
+      );
+    }),
+    logout: handler("POST", async (request) => {
+      const id = http.sessionId(request);
+      if (id) {
+        try {
+          await manager.logout(id);
+        } catch (error) {
+          if (!(error instanceof BffSessionError) || error.status !== 401) throw error;
+        }
+      }
+      return http.response(null, { status: 204, cookie: http.expireCookie() });
+    }),
+    /** Server-only credential for downstream calls. Never serialize this result to the browser. */
+    async requireSession(request) {
+      http.assertRequest(request);
+      const record = await manager.read(requiredSessionId(request));
+      return {
+        accessToken: record.tokens.accessToken,
+        user: record.user,
+        expiresAt: record.expiresAt
+      };
+    },
+    errorResponse: http.errorResponse
+  };
+}
+
+// ../../internal/core/config/defaults.ts
+var DEFAULT_BASE_URL = "https://api.authyon.com";
+
+// ../../internal/core/http/query.ts
+function appendQuery(path, params) {
+  if (!params) return path;
+  const query = new URLSearchParams();
+  for (const [key, value2] of Object.entries(params)) {
+    if (value2 !== void 0) query.set(key, String(value2));
+  }
+  const value = query.toString();
+  return value ? `${path}${path.includes("?") ? "&" : "?"}${value}` : path;
+}
+
+// ../../internal/core/http/httpAdapter.ts
+var FetchHttpAdapter = class {
+  constructor(fetchImpl = fetch.bind(globalThis)) {
+    this.fetchImpl = fetchImpl;
+  }
+  request(request) {
+    return this.fetchImpl(request.url, {
+      method: request.method,
+      headers: request.headers,
+      body: request.body,
+      signal: request.signal,
+      redirect: "error"
+    });
+  }
+};
+var LoggingHttpAdapter = class {
+  constructor(adapter, options) {
+    this.adapter = adapter;
+    this.options = options;
+  }
+  async request(request) {
+    const startedAt = Date.now();
+    const eventBase = {
+      method: request.method,
+      url: sanitizeUrl(request.url)
+    };
+    this.log({ type: "request", ...eventBase, timestamp: startedAt });
+    try {
+      const response = await this.adapter.request(request);
+      this.log({
+        type: "response",
+        ...eventBase,
+        status: response.status,
+        durationMs: Date.now() - startedAt,
+        requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+        timestamp: Date.now()
+      });
+      return response;
+    } catch (error) {
+      this.log({
+        type: "error",
+        ...eventBase,
+        errorName: error instanceof Error ? error.name : "UnknownError",
+        durationMs: Date.now() - startedAt,
+        timestamp: Date.now()
+      });
+      throw error;
+    }
+  }
+  log(event) {
+    if (!this.options.enabled) return;
+    const logger = this.options.logger ?? defaultHttpLogger;
+    try {
+      logger(event);
+    } catch {
+    }
+  }
+};
+function defaultHttpLogger(event) {
+  console.debug("[Authyon HTTP]", event);
+}
+function sanitizeUrl(value) {
+  const url = new URL(value);
+  url.username = "";
+  url.password = "";
+  url.hash = "";
+  url.pathname = url.pathname.replace(/(\/platform\/workspace-invites\/)[^/]+/u, "$1REDACTED");
+  const queryKeys = /* @__PURE__ */ new Set();
+  url.searchParams.forEach((_value, key) => queryKeys.add(key));
+  url.search = queryKeys.size > 0 ? [...queryKeys].map((key) => `${encodeURIComponent(key)}=REDACTED`).join("&") : "";
+  return url.toString();
+}
+
+// ../../internal/core/http/transport.ts
+var DEFAULT_TIMEOUT_MS = 15e3;
+var SharedTransportError = class extends Error {
+  constructor(code, cause) {
+    super(code === "request.timeout" ? "Request timed out" : "Network request failed");
+    this.name = "SharedTransportError";
+    this.code = code;
+    this.cause = cause;
+  }
+};
+function createSharedTransport(options) {
+  const baseUrl = normalizeBaseUrl(options.baseUrl, options.allowInsecureHttp ?? false);
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 0) {
+    throw new Error("Authyon: `timeoutMs` must be a non-negative finite number");
+  }
+  if (options.httpAdapter && options.fetch) {
+    throw new Error("Authyon: use either `httpAdapter` or `fetch`, not both");
+  }
+  const baseAdapter = options.httpAdapter ?? new FetchHttpAdapter(options.fetch);
+  const httpAdapter = options.httpLogger ? new LoggingHttpAdapter(baseAdapter, options.httpLogger) : baseAdapter;
+  return {
+    baseUrl,
+    async request(path, init) {
+      const controller = new AbortController();
+      const timeout = timeoutMs > 0 ? setTimeout(() => controller.abort(), timeoutMs) : void 0;
+      try {
+        return await httpAdapter.request({
+          url: `${baseUrl}${path}`,
+          method: init.method ?? "GET",
+          headers: normalizeHeaders(init.headers),
+          body: init.body,
+          signal: controller.signal
+        });
+      } catch (cause) {
+        throw new SharedTransportError(
+          controller.signal.aborted ? ErrorCodes.Timeout : ErrorCodes.NetworkError,
+          cause
+        );
+      } finally {
+        if (timeout !== void 0) clearTimeout(timeout);
+      }
+    }
+  };
+}
+function normalizeHeaders(headers) {
+  const normalized = {};
+  new Headers(headers).forEach((value, key) => {
+    normalized[key] = value;
+  });
+  return normalized;
+}
+function responseMetadata(response) {
+  const retryAfterHeader = response.headers.get("retry-after");
+  const retryAfter = retryAfterHeader ? Number(retryAfterHeader) : void 0;
+  return {
+    requestId: response.headers.get("x-request-id") ?? response.headers.get("trace-id") ?? void 0,
+    retryAfter: Number.isFinite(retryAfter) ? retryAfter : void 0
+  };
+}
+function normalizeBaseUrl(value, allowInsecureHttp) {
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    throw new Error("Authyon: `baseUrl` must be an absolute URL");
+  }
+  const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1" || url.hostname === "[::1]";
+  if (url.protocol !== "https:" && !(url.protocol === "http:" && (loopback || allowInsecureHttp))) {
+    throw new Error(
+      "Authyon: `baseUrl` must use HTTPS (HTTP is allowed only for loopback or with `allowInsecureHttp`)"
+    );
+  }
+  if (url.username || url.password || url.search || url.hash) {
+    throw new Error(
+      "Authyon: `baseUrl` cannot contain credentials, query parameters, or fragments"
+    );
+  }
+  return url.toString().replace(/\/+$/, "");
+}
+
+// ../../internal/core/http/jsonHttpClient.ts
+var JsonHttpClient = class {
+  constructor(transport) {
+    this.transport = transport;
+  }
+  async send(path, options = {}) {
+    const headers = { ...options.headers };
+    if (options.body !== void 0) headers["Content-Type"] = "application/json";
+    try {
+      return await this.transport.request(appendQuery(path, options.query), {
+        method: options.method ?? "GET",
+        headers,
+        body: options.body !== void 0 ? JSON.stringify(options.body) : void 0
+      });
+    } catch (cause) {
+      if (!(cause instanceof SharedTransportError)) throw cause;
+      throw new AuthyonError(0, { code: cause.code, title: cause.message }, { cause: cause.cause });
+    }
+  }
+  async parse(response) {
+    if (!response.ok) {
+      let body = {};
+      try {
+        body = await response.json();
+      } catch {
+      }
+      throw new AuthyonError(response.status, body, responseMetadata(response));
+    }
+    if (response.status === 204) return void 0;
+    return await response.json();
+  }
+  async request(path, options = {}) {
+    return this.parse(await this.send(path, options));
+  }
+};
+
+// src/bff/authyonProvider.ts
+function object(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new BffSessionError("provider.malformed_response", 502);
+  }
+  return value;
+}
+function requiredString(value) {
+  if (typeof value !== "string" || value.length === 0) {
+    throw new BffSessionError("provider.malformed_response", 502);
+  }
+  return value;
+}
+function readTokens(value) {
+  const response = object(value);
+  const tokens = object(response.tokens ?? response);
+  if (typeof tokens.expiresIn !== "number" || !Number.isFinite(tokens.expiresIn) || tokens.expiresIn <= 0) {
+    throw new BffSessionError("provider.missing_token_lifetime", 502);
+  }
+  return {
+    accessToken: requiredString(tokens.accessToken),
+    refreshToken: requiredString(tokens.refreshToken),
+    expiresAt: Date.now() + tokens.expiresIn * 1e3
+  };
+}
+function readChallenge(value) {
+  const challenge = object(value);
+  if (!Array.isArray(challenge.methods) || !challenge.methods.every((method) => typeof method === "string")) {
+    throw new BffSessionError("provider.malformed_challenge", 502);
+  }
+  return {
+    twoFactorRequired: true,
+    challengeToken: requiredString(challenge.challengeToken),
+    methods: challenge.methods
+  };
+}
+function readProfile(value) {
+  const user = object(value);
+  const activeOrganization = user.activeOrganization ?? user.tenant;
+  const organization = activeOrganization == null ? null : object(activeOrganization);
+  return {
+    id: requiredString(user.id),
+    email: requiredString(user.email),
+    organization: organization ? { id: requiredString(organization.id), slug: requiredString(organization.slug) } : null
+  };
+}
+function createAuthyonBffProvider(options) {
+  if (!options.envKey) throw new Error("Authyon BFF: envKey is required");
+  const http = new JsonHttpClient(
+    createSharedTransport({
+      ...options,
+      baseUrl: options.baseUrl ?? DEFAULT_BASE_URL
+    })
+  );
+  const headers = { "X-Authyon-Environment": options.envKey };
+  const bearer = (token) => ({ ...headers, Authorization: `Bearer ${token}` });
+  return {
+    async login(input) {
+      const credentials = { ...input };
+      delete credentials.organizationSlug;
+      delete credentials.sessionPersistence;
+      const response = object(
+        await http.request("/auth/login", {
+          method: "POST",
+          headers,
+          body: {
+            ...credentials,
+            ...input.organizationSlug ? { tenantSlug: input.organizationSlug } : {}
+          }
+        })
+      );
+      return response.twoFactor ? readChallenge(response.twoFactor) : readTokens(response);
+    },
+    async verifyTwoFactor(input) {
+      const verification = { ...input };
+      delete verification.sessionPersistence;
+      return readTokens(
+        await http.request("/auth/2fa/verify", { method: "POST", headers, body: verification })
+      );
+    },
+    async refresh(refreshToken) {
+      return readTokens(
+        await http.request("/auth/refresh", { method: "POST", headers, body: { refreshToken } })
+      );
+    },
+    async logout(refreshToken) {
+      await http.request("/auth/logout", { method: "POST", headers, body: { refreshToken } });
+    },
+    async switchOrganization(accessToken, slug) {
+      return readTokens(
+        await http.request("/auth/switch-tenant", {
+          method: "POST",
+          headers: bearer(accessToken),
+          body: { tenantSlug: slug }
+        })
+      );
+    },
+    async validate(accessToken) {
+      try {
+        const result = await options.validator.validate(accessToken);
+        return result.valid === true && result.user != null;
+      } catch (error) {
+        if (error instanceof AuthyonError)
+          throw new BffSessionError("provider.validation_unavailable", 503);
+        throw error;
+      }
+    },
+    async profile(accessToken) {
+      return readProfile(await http.request("/auth/me", { headers: bearer(accessToken) }));
+    }
+  };
+}
+
+// src/bff/memoryStore.ts
+function createMemoryBffSessionStore() {
+  const sessions = /* @__PURE__ */ new Map();
+  function read(key) {
+    const session = sessions.get(key);
+    if (!session) return null;
+    if (Math.min(session.expiresAt, session.idleExpiresAt) <= Date.now()) {
+      sessions.delete(key);
+      return null;
+    }
+    return structuredClone(session);
+  }
+  return {
+    async read(key) {
+      return read(key);
+    },
+    async compareAndSwap(key, expectedRevision, next) {
+      if ((read(key)?.revision ?? null) !== expectedRevision) return false;
+      if (next) {
+        if (expectedRevision === null) {
+          for (const sessionKey2 of sessions.keys()) read(sessionKey2);
+        }
+        sessions.set(key, structuredClone(next));
+      } else {
+        sessions.delete(key);
+      }
+      return true;
+    }
+  };
+}
+
+// src/bff/redisStore.ts
+var import_jose = require("jose");
+var COMPARE_AND_SWAP = `
+local current = redis.call('GET', KEYS[1])
+local revision = ''
+if current then revision = cjson.decode(current).revision end
+if revision ~= ARGV[1] then return 0 end
+if ARGV[2] == '' then
+  redis.call('DEL', KEYS[1])
+else
+  redis.call('SET', KEYS[1], ARGV[2], 'PX', ARGV[3])
+end
+return 1
+`;
+function isObject(value) {
+  return typeof value === "object" && value !== null;
+}
+function isFiniteNumber(value) {
+  return typeof value === "number" && Number.isFinite(value);
+}
+function isOrganization(value) {
+  return value === null || isObject(value) && typeof value.id === "string" && typeof value.slug === "string";
+}
+function isSessionRecord(value) {
+  if (!isObject(value) || !isObject(value.tokens) || !isObject(value.user)) return false;
+  return typeof value.revision === "string" && typeof value.tokens.accessToken === "string" && typeof value.tokens.refreshToken === "string" && isFiniteNumber(value.tokens.expiresAt) && typeof value.user.id === "string" && typeof value.user.email === "string" && isOrganization(value.user.organization) && (value.sessionPersistence === void 0 || value.sessionPersistence === "standard" || value.sessionPersistence === "remembered") && isFiniteNumber(value.expiresAt) && isFiniteNumber(value.idleExpiresAt) && (value.busyUntil === null || isFiniteNumber(value.busyUntil));
+}
+function createRedisBffSessionStore(options) {
+  if (options.encryptionKey.byteLength !== 32) {
+    throw new Error("Authyon BFF: encryptionKey must contain 32 bytes");
+  }
+  const encryptionKey = new Uint8Array(options.encryptionKey);
+  const prefix = options.prefix ?? "authyon:bff:";
+  return {
+    async read(key) {
+      const serialized = await options.client.get(prefix + key);
+      if (!serialized) return null;
+      try {
+        const envelope = JSON.parse(serialized);
+        const { payload } = await (0, import_jose.jwtDecrypt)(envelope.ciphertext, encryptionKey, {
+          keyManagementAlgorithms: ["dir"],
+          contentEncryptionAlgorithms: ["A256GCM"],
+          audience: prefix + key
+        });
+        const record = payload.session;
+        if (!isSessionRecord(record) || record.revision !== envelope.revision) {
+          throw new Error("invalid session record");
+        }
+        return record;
+      } catch {
+        throw new BffSessionError("session.storage_invalid", 503);
+      }
+    },
+    async compareAndSwap(key, expectedRevision, next) {
+      const expiresAt = next ? Math.min(next.expiresAt, next.idleExpiresAt) : Date.now();
+      const ttl = Math.ceil(expiresAt - Date.now());
+      if (next && ttl <= 0) return false;
+      let serialized = "";
+      if (next) {
+        const ciphertext = await new import_jose.EncryptJWT({ session: next }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setAudience(prefix + key).encrypt(encryptionKey);
+        serialized = JSON.stringify({ revision: next.revision, ciphertext });
+      }
+      const result = await options.client.eval(COMPARE_AND_SWAP, {
+        keys: [prefix + key],
+        arguments: [expectedRevision ?? "", serialized, String(ttl)]
+      });
+      return result === 1;
+    }
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BffSessionError,
+  createAuthyonBffProvider,
+  createBffSession,
+  createMemoryBffSessionStore,
+  createRedisBffSessionStore
+});