@azlib/identity 0.2.1 → 0.3.0

package/dist/next.cjs

@@ -0,0 +1,285 @@
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_errors = require("./errors-Bcjx9o6g.cjs");
+const require_cookie_header = require("./cookie-header-Dqd5k5BU.cjs");
+//#region core/next/cookies.ts
+function maxAgeSeconds(expiresAt, now) {
+	return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1e3));
+}
+function writeAttributes(options, expiresAt, now) {
+	const attrs = require_cookie_header.resolveCookieAttributes(options);
+	return {
+		httpOnly: attrs.httpOnly,
+		secure: attrs.secure,
+		sameSite: attrs.sameSite,
+		path: attrs.path,
+		domain: attrs.domain,
+		maxAge: maxAgeSeconds(expiresAt, now),
+		expires: expiresAt
+	};
+}
+/**
+* Writes the access and refresh tokens as HttpOnly cookies.
+* `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+*/
+function applyAuthCookies(cookies, tokens, options = {}, now = /* @__PURE__ */ new Date()) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	cookies.set(names.access, tokens.accessToken, writeAttributes(options, tokens.accessTokenExpiresAt, now));
+	cookies.set(names.refresh, tokens.refreshToken, writeAttributes(options, tokens.refreshTokenExpiresAt, now));
+}
+/** Clears both identity cookies (logout or failed session). */
+function clearAuthCookies(cookies, options = {}) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	const attrs = require_cookie_header.resolveCookieAttributes(options);
+	const deleteOpts = {
+		path: attrs.path,
+		domain: attrs.domain
+	};
+	cookies.delete(names.access, deleteOpts);
+	cookies.delete(names.refresh, deleteOpts);
+}
+/**
+* In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+* Not for production browser storage.
+*/
+function createMemoryCookieStore(initial = {}) {
+	const values = new Map(Object.entries(initial).filter(([, value]) => value.length > 0));
+	return {
+		get(name) {
+			const value = values.get(name);
+			return value === void 0 ? void 0 : { value };
+		},
+		set(name, value) {
+			if (value.length === 0) {
+				values.delete(name);
+				return;
+			}
+			values.set(name, value);
+		},
+		delete(name) {
+			values.delete(name);
+		}
+	};
+}
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+function cookieStoreFromHeader(header) {
+	return createMemoryCookieStore(Object.fromEntries(require_cookie_header.parseCookieHeader(header)));
+}
+//#endregion
+//#region core/next/session.ts
+/**
+* Resolves the current principal from identity cookies.
+*
+* - Valid access cookie → `service.authenticate`.
+* - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+* - Failure → clear cookies and return `null` (degrade to logged out).
+*
+* Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+* rotates the refresh token; skipping the write would invalidate the browser session.
+*/
+async function getIdentity(service, cookies, options = {}) {
+	const names = require_cookie_header.resolveCookieNames(options);
+	const access = require_cookie_header.readCookieValue(cookies, names.access);
+	const refresh = require_cookie_header.readCookieValue(cookies, names.refresh);
+	if (access) try {
+		return await service.authenticate(access);
+	} catch (error) {
+		if (error instanceof require_errors.AccountUnavailableError) {
+			clearAuthCookies(cookies, options);
+			return null;
+		}
+		if (!(error instanceof require_errors.InvalidTokenError)) throw error;
+	}
+	if (!refresh) {
+		if (access) clearAuthCookies(cookies, options);
+		return null;
+	}
+	try {
+		const result = await service.refresh(refresh);
+		applyAuthCookies(cookies, result.tokens, options);
+		return result.user;
+	} catch (error) {
+		clearAuthCookies(cookies, options);
+		if (error instanceof require_errors.InvalidTokenError || error instanceof require_errors.AccountUnavailableError) return null;
+		throw error;
+	}
+}
+//#endregion
+//#region core/next/handlers.ts
+function json(body, status, cookies) {
+	const headers = new Headers({ "content-type": "application/json" });
+	if (cookies) for (const header of cookies.headers) headers.append("set-cookie", header);
+	return new Response(JSON.stringify(body), {
+		status,
+		headers
+	});
+}
+function errorResponse(error) {
+	if (error instanceof require_errors.IdentityError) return json({
+		code: error.code,
+		message: error.message
+	}, error.statusCode);
+	throw error;
+}
+function serializeSetCookie(cookie) {
+	const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];
+	const opts = cookie.options ?? {};
+	if (opts.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);
+	if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
+	parts.push(`Path=${opts.path ?? "/"}`);
+	if (opts.domain) parts.push(`Domain=${opts.domain}`);
+	if (opts.httpOnly !== false) parts.push("HttpOnly");
+	if (opts.secure) parts.push("Secure");
+	const sameSite = opts.sameSite ?? "lax";
+	parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+	return parts.join("; ");
+}
+function recordingStore(header) {
+	const inner = cookieStoreFromHeader(header);
+	const writes = [];
+	const deleted = [];
+	const expired = /* @__PURE__ */ new Date(0);
+	return {
+		store: {
+			get: inner.get.bind(inner),
+			set(name, value, options) {
+				inner.set(name, value, options);
+				writes.push({
+					name,
+					value,
+					options
+				});
+			},
+			delete(name, options) {
+				inner.delete(name, options);
+				deleted.push({
+					name,
+					value: "",
+					options: {
+						...options,
+						maxAge: 0,
+						expires: expired
+					}
+				});
+			}
+		},
+		headers() {
+			return [...writes.map(serializeSetCookie), ...deleted.map(serializeSetCookie)];
+		}
+	};
+}
+async function readJsonBody(request) {
+	try {
+		const body = await request.json();
+		if (typeof body === "object" && body !== null && !Array.isArray(body)) return body;
+		return {};
+	} catch {
+		return {};
+	}
+}
+function actionFromUrl(url, prefix) {
+	const pathname = new URL(url).pathname.replace(/\/+$/, "");
+	const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
+	if (normalizedPrefix) {
+		const marker = `/${normalizedPrefix}/`;
+		const idx = pathname.lastIndexOf(marker);
+		if (idx >= 0) return pathname.slice(idx + marker.length);
+	}
+	const slash = pathname.lastIndexOf("/");
+	return slash >= 0 ? pathname.slice(slash + 1) : pathname;
+}
+function createIdentityHandlers(service, options = {}) {
+	const prefix = options.prefix ?? "";
+	const names = require_cookie_header.resolveCookieNames(options);
+	const login = async (request) => {
+		try {
+			const body = await readJsonBody(request);
+			const email = typeof body.email === "string" ? body.email : "";
+			const password = typeof body.password === "string" ? body.password : "";
+			const result = await service.login({
+				email,
+				password
+			});
+			if ("kind" in result) return json(result, 200);
+			const recorded = recordingStore(request.headers.get("cookie"));
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const logout = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const refresh = require_cookie_header.readCookieValue(recorded.store, names.refresh);
+			if (refresh) await service.logout(refresh);
+			clearAuthCookies(recorded.store, options);
+			return json({ ok: true }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const refresh = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const token = require_cookie_header.readCookieValue(recorded.store, names.refresh);
+			if (!token) throw new require_errors.InvalidTokenError();
+			const result = await service.refresh(token);
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			clearAuthCookies(recorded.store, options);
+			if (error instanceof require_errors.IdentityError) return json({
+				code: error.code,
+				message: error.message
+			}, error.statusCode, { headers: recorded.headers() });
+			throw error;
+		}
+	};
+	const me = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const identity = await getIdentity(service, recorded.store, options);
+			if (!identity) return json({
+				code: "identity/unauthenticated",
+				message: "Authentication is required."
+			}, 401, { headers: recorded.headers() });
+			return json({ user: identity }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const dispatch = async (request) => {
+		const action = actionFromUrl(request.url, prefix);
+		const method = request.method.toUpperCase();
+		if (method === "POST" && action === "login") return login(request);
+		if (method === "POST" && action === "logout") return logout(request);
+		if (method === "POST" && action === "refresh") return refresh(request);
+		if (method === "GET" && action === "me") return me(request);
+		return json({
+			code: "identity/not-found",
+			message: "Not found."
+		}, 404);
+	};
+	return {
+		login,
+		logout,
+		refresh,
+		me,
+		dispatch
+	};
+}
+//#endregion
+exports.DEFAULT_ACCESS_COOKIE = require_cookie_header.DEFAULT_ACCESS_COOKIE;
+exports.DEFAULT_REFRESH_COOKIE = require_cookie_header.DEFAULT_REFRESH_COOKIE;
+exports.applyAuthCookies = applyAuthCookies;
+exports.clearAuthCookies = clearAuthCookies;
+exports.cookieStoreFromHeader = cookieStoreFromHeader;
+exports.createIdentityHandlers = createIdentityHandlers;
+exports.createMemoryCookieStore = createMemoryCookieStore;
+exports.getIdentity = getIdentity;
+exports.hasIdentityCookies = require_cookie_header.hasIdentityCookies;
+exports.parseCookieHeader = require_cookie_header.parseCookieHeader;
+exports.readCookieValue = require_cookie_header.readCookieValue;
+exports.resolveCookieAttributes = require_cookie_header.resolveCookieAttributes;
+exports.resolveCookieNames = require_cookie_header.resolveCookieNames;

package/dist/next.d.cts

@@ -0,0 +1,58 @@
+import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.cjs";
+import { t as IdentityService } from "./identity-service-DE0Ffguz.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+//#region core/next/cookies.d.ts
+/**
+ * Writes the access and refresh tokens as HttpOnly cookies.
+ * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+ */
+declare function applyAuthCookies(cookies: CookieWriter, tokens: AuthTokens, options?: IdentityCookieOptions, now?: Date): void;
+/** Clears both identity cookies (logout or failed session). */
+declare function clearAuthCookies(cookies: CookieWriter, options?: IdentityCookieOptions): void;
+/**
+ * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+ * Not for production browser storage.
+ */
+declare function createMemoryCookieStore(initial?: Record<string, string>): CookieStore;
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+declare function cookieStoreFromHeader(header: string | null | undefined): CookieStore;
+//#endregion
+//#region core/next/session.d.ts
+/** Subset of {@link IdentityService} used to read and rotate a cookie session. */
+type IdentitySessionService = Pick<IdentityService, "authenticate" | "refresh">;
+/**
+ * Resolves the current principal from identity cookies.
+ *
+ * - Valid access cookie → `service.authenticate`.
+ * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+ * - Failure → clear cookies and return `null` (degrade to logged out).
+ *
+ * Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+ * rotates the refresh token; skipping the write would invalidate the browser session.
+ */
+declare function getIdentity(service: IdentitySessionService, cookies: CookieStore, options?: IdentityCookieOptions): Promise<AuthenticatedIdentity | null>;
+//#endregion
+//#region core/next/handlers.d.ts
+interface IdentityHandlerOptions extends IdentityCookieOptions {
+  /**
+   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.
+   * Default: `""` (last path segment is the action: `login`, `logout`, …).
+   */
+  prefix?: string;
+}
+/**
+ * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).
+ *
+ * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.
+ */
+interface IdentityHandlers {
+  login(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  refresh(request: Request): Promise<Response>;
+  me(request: Request): Promise<Response>;
+  dispatch(request: Request): Promise<Response>;
+}
+declare function createIdentityHandlers(service: IdentityService, options?: IdentityHandlerOptions): IdentityHandlers;
+//#endregion
+export { type CookieReader, type CookieSource, type CookieStore, type CookieWriter, DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, type IdentityHandlerOptions, type IdentityHandlers, type IdentitySessionService, applyAuthCookies, clearAuthCookies, cookieStoreFromHeader, createIdentityHandlers, createMemoryCookieStore, getIdentity, hasIdentityCookies, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames };
+//# sourceMappingURL=next.d.cts.map

package/dist/next.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.cts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}

package/dist/next.d.mts

@@ -0,0 +1,58 @@
+import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.mjs";
+import { t as IdentityService } from "./identity-service-JtsoA6lv.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+//#region core/next/cookies.d.ts
+/**
+ * Writes the access and refresh tokens as HttpOnly cookies.
+ * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+ */
+declare function applyAuthCookies(cookies: CookieWriter, tokens: AuthTokens, options?: IdentityCookieOptions, now?: Date): void;
+/** Clears both identity cookies (logout or failed session). */
+declare function clearAuthCookies(cookies: CookieWriter, options?: IdentityCookieOptions): void;
+/**
+ * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+ * Not for production browser storage.
+ */
+declare function createMemoryCookieStore(initial?: Record<string, string>): CookieStore;
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+declare function cookieStoreFromHeader(header: string | null | undefined): CookieStore;
+//#endregion
+//#region core/next/session.d.ts
+/** Subset of {@link IdentityService} used to read and rotate a cookie session. */
+type IdentitySessionService = Pick<IdentityService, "authenticate" | "refresh">;
+/**
+ * Resolves the current principal from identity cookies.
+ *
+ * - Valid access cookie → `service.authenticate`.
+ * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+ * - Failure → clear cookies and return `null` (degrade to logged out).
+ *
+ * Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+ * rotates the refresh token; skipping the write would invalidate the browser session.
+ */
+declare function getIdentity(service: IdentitySessionService, cookies: CookieStore, options?: IdentityCookieOptions): Promise<AuthenticatedIdentity | null>;
+//#endregion
+//#region core/next/handlers.d.ts
+interface IdentityHandlerOptions extends IdentityCookieOptions {
+  /**
+   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.
+   * Default: `""` (last path segment is the action: `login`, `logout`, …).
+   */
+  prefix?: string;
+}
+/**
+ * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).
+ *
+ * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.
+ */
+interface IdentityHandlers {
+  login(request: Request): Promise<Response>;
+  logout(request: Request): Promise<Response>;
+  refresh(request: Request): Promise<Response>;
+  me(request: Request): Promise<Response>;
+  dispatch(request: Request): Promise<Response>;
+}
+declare function createIdentityHandlers(service: IdentityService, options?: IdentityHandlerOptions): IdentityHandlers;
+//#endregion
+export { type CookieReader, type CookieSource, type CookieStore, type CookieWriter, DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, type IdentityHandlerOptions, type IdentityHandlers, type IdentitySessionService, applyAuthCookies, clearAuthCookies, cookieStoreFromHeader, createIdentityHandlers, createMemoryCookieStore, getIdentity, hasIdentityCookies, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames };
+//# sourceMappingURL=next.d.mts.map

package/dist/next.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.mts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}

package/dist/next.mjs

@@ -0,0 +1,274 @@
+import { a as IdentityError, s as InvalidTokenError, t as AccountUnavailableError } from "./errors-CEmnZxIn.mjs";
+import { a as readCookieValue, i as parseCookieHeader, n as DEFAULT_REFRESH_COOKIE, o as resolveCookieAttributes, r as hasIdentityCookies, s as resolveCookieNames, t as DEFAULT_ACCESS_COOKIE } from "./cookie-header-DptIxRmW.mjs";
+//#region core/next/cookies.ts
+function maxAgeSeconds(expiresAt, now) {
+	return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1e3));
+}
+function writeAttributes(options, expiresAt, now) {
+	const attrs = resolveCookieAttributes(options);
+	return {
+		httpOnly: attrs.httpOnly,
+		secure: attrs.secure,
+		sameSite: attrs.sameSite,
+		path: attrs.path,
+		domain: attrs.domain,
+		maxAge: maxAgeSeconds(expiresAt, now),
+		expires: expiresAt
+	};
+}
+/**
+* Writes the access and refresh tokens as HttpOnly cookies.
+* `maxAge` is in seconds (Next.js / `Set-Cookie` convention).
+*/
+function applyAuthCookies(cookies, tokens, options = {}, now = /* @__PURE__ */ new Date()) {
+	const names = resolveCookieNames(options);
+	cookies.set(names.access, tokens.accessToken, writeAttributes(options, tokens.accessTokenExpiresAt, now));
+	cookies.set(names.refresh, tokens.refreshToken, writeAttributes(options, tokens.refreshTokenExpiresAt, now));
+}
+/** Clears both identity cookies (logout or failed session). */
+function clearAuthCookies(cookies, options = {}) {
+	const names = resolveCookieNames(options);
+	const attrs = resolveCookieAttributes(options);
+	const deleteOpts = {
+		path: attrs.path,
+		domain: attrs.domain
+	};
+	cookies.delete(names.access, deleteOpts);
+	cookies.delete(names.refresh, deleteOpts);
+}
+/**
+* In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
+* Not for production browser storage.
+*/
+function createMemoryCookieStore(initial = {}) {
+	const values = new Map(Object.entries(initial).filter(([, value]) => value.length > 0));
+	return {
+		get(name) {
+			const value = values.get(name);
+			return value === void 0 ? void 0 : { value };
+		},
+		set(name, value) {
+			if (value.length === 0) {
+				values.delete(name);
+				return;
+			}
+			values.set(name, value);
+		},
+		delete(name) {
+			values.delete(name);
+		}
+	};
+}
+/** Builds a cookie store seeded from an incoming `Cookie` header. */
+function cookieStoreFromHeader(header) {
+	return createMemoryCookieStore(Object.fromEntries(parseCookieHeader(header)));
+}
+//#endregion
+//#region core/next/session.ts
+/**
+* Resolves the current principal from identity cookies.
+*
+* - Valid access cookie → `service.authenticate`.
+* - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.
+* - Failure → clear cookies and return `null` (degrade to logged out).
+*
+* Call this where cookies can be written (Server Actions, Route Handlers). Refresh
+* rotates the refresh token; skipping the write would invalidate the browser session.
+*/
+async function getIdentity(service, cookies, options = {}) {
+	const names = resolveCookieNames(options);
+	const access = readCookieValue(cookies, names.access);
+	const refresh = readCookieValue(cookies, names.refresh);
+	if (access) try {
+		return await service.authenticate(access);
+	} catch (error) {
+		if (error instanceof AccountUnavailableError) {
+			clearAuthCookies(cookies, options);
+			return null;
+		}
+		if (!(error instanceof InvalidTokenError)) throw error;
+	}
+	if (!refresh) {
+		if (access) clearAuthCookies(cookies, options);
+		return null;
+	}
+	try {
+		const result = await service.refresh(refresh);
+		applyAuthCookies(cookies, result.tokens, options);
+		return result.user;
+	} catch (error) {
+		clearAuthCookies(cookies, options);
+		if (error instanceof InvalidTokenError || error instanceof AccountUnavailableError) return null;
+		throw error;
+	}
+}
+//#endregion
+//#region core/next/handlers.ts
+function json(body, status, cookies) {
+	const headers = new Headers({ "content-type": "application/json" });
+	if (cookies) for (const header of cookies.headers) headers.append("set-cookie", header);
+	return new Response(JSON.stringify(body), {
+		status,
+		headers
+	});
+}
+function errorResponse(error) {
+	if (error instanceof IdentityError) return json({
+		code: error.code,
+		message: error.message
+	}, error.statusCode);
+	throw error;
+}
+function serializeSetCookie(cookie) {
+	const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];
+	const opts = cookie.options ?? {};
+	if (opts.maxAge !== void 0) parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);
+	if (opts.expires) parts.push(`Expires=${opts.expires.toUTCString()}`);
+	parts.push(`Path=${opts.path ?? "/"}`);
+	if (opts.domain) parts.push(`Domain=${opts.domain}`);
+	if (opts.httpOnly !== false) parts.push("HttpOnly");
+	if (opts.secure) parts.push("Secure");
+	const sameSite = opts.sameSite ?? "lax";
+	parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);
+	return parts.join("; ");
+}
+function recordingStore(header) {
+	const inner = cookieStoreFromHeader(header);
+	const writes = [];
+	const deleted = [];
+	const expired = /* @__PURE__ */ new Date(0);
+	return {
+		store: {
+			get: inner.get.bind(inner),
+			set(name, value, options) {
+				inner.set(name, value, options);
+				writes.push({
+					name,
+					value,
+					options
+				});
+			},
+			delete(name, options) {
+				inner.delete(name, options);
+				deleted.push({
+					name,
+					value: "",
+					options: {
+						...options,
+						maxAge: 0,
+						expires: expired
+					}
+				});
+			}
+		},
+		headers() {
+			return [...writes.map(serializeSetCookie), ...deleted.map(serializeSetCookie)];
+		}
+	};
+}
+async function readJsonBody(request) {
+	try {
+		const body = await request.json();
+		if (typeof body === "object" && body !== null && !Array.isArray(body)) return body;
+		return {};
+	} catch {
+		return {};
+	}
+}
+function actionFromUrl(url, prefix) {
+	const pathname = new URL(url).pathname.replace(/\/+$/, "");
+	const normalizedPrefix = prefix.replace(/^\/+|\/+$/g, "");
+	if (normalizedPrefix) {
+		const marker = `/${normalizedPrefix}/`;
+		const idx = pathname.lastIndexOf(marker);
+		if (idx >= 0) return pathname.slice(idx + marker.length);
+	}
+	const slash = pathname.lastIndexOf("/");
+	return slash >= 0 ? pathname.slice(slash + 1) : pathname;
+}
+function createIdentityHandlers(service, options = {}) {
+	const prefix = options.prefix ?? "";
+	const names = resolveCookieNames(options);
+	const login = async (request) => {
+		try {
+			const body = await readJsonBody(request);
+			const email = typeof body.email === "string" ? body.email : "";
+			const password = typeof body.password === "string" ? body.password : "";
+			const result = await service.login({
+				email,
+				password
+			});
+			if ("kind" in result) return json(result, 200);
+			const recorded = recordingStore(request.headers.get("cookie"));
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const logout = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const refresh = readCookieValue(recorded.store, names.refresh);
+			if (refresh) await service.logout(refresh);
+			clearAuthCookies(recorded.store, options);
+			return json({ ok: true }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const refresh = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const token = readCookieValue(recorded.store, names.refresh);
+			if (!token) throw new InvalidTokenError();
+			const result = await service.refresh(token);
+			applyAuthCookies(recorded.store, result.tokens, options);
+			return json({ user: result.user }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			clearAuthCookies(recorded.store, options);
+			if (error instanceof IdentityError) return json({
+				code: error.code,
+				message: error.message
+			}, error.statusCode, { headers: recorded.headers() });
+			throw error;
+		}
+	};
+	const me = async (request) => {
+		try {
+			const recorded = recordingStore(request.headers.get("cookie"));
+			const identity = await getIdentity(service, recorded.store, options);
+			if (!identity) return json({
+				code: "identity/unauthenticated",
+				message: "Authentication is required."
+			}, 401, { headers: recorded.headers() });
+			return json({ user: identity }, 200, { headers: recorded.headers() });
+		} catch (error) {
+			return errorResponse(error);
+		}
+	};
+	const dispatch = async (request) => {
+		const action = actionFromUrl(request.url, prefix);
+		const method = request.method.toUpperCase();
+		if (method === "POST" && action === "login") return login(request);
+		if (method === "POST" && action === "logout") return logout(request);
+		if (method === "POST" && action === "refresh") return refresh(request);
+		if (method === "GET" && action === "me") return me(request);
+		return json({
+			code: "identity/not-found",
+			message: "Not found."
+		}, 404);
+	};
+	return {
+		login,
+		logout,
+		refresh,
+		me,
+		dispatch
+	};
+}
+//#endregion
+export { DEFAULT_ACCESS_COOKIE, DEFAULT_REFRESH_COOKIE, applyAuthCookies, clearAuthCookies, cookieStoreFromHeader, createIdentityHandlers, createMemoryCookieStore, getIdentity, hasIdentityCookies, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames };
+
+//# sourceMappingURL=next.mjs.map