@azlib/identity 0.2.1 → 0.3.0

package/dist/next.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.mjs","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"sourcesContent":["import {\n  parseCookieHeader,\n  resolveCookieAttributes,\n  resolveCookieNames,\n  type CookieStore,\n  type CookieWriter,\n  type IdentityCookieOptions,\n} from \"../cookie-header\";\nimport type { AuthTokens } from \"../types\";\n\nexport type { CookieStore, CookieWriter };\n\nfunction maxAgeSeconds(expiresAt: Date, now: Date): number {\n  return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1000));\n}\n\nfunction writeAttributes(\n  options: IdentityCookieOptions,\n  expiresAt: Date,\n  now: Date,\n) {\n  const attrs = resolveCookieAttributes(options);\n  return {\n    httpOnly: attrs.httpOnly,\n    secure: attrs.secure,\n    sameSite: attrs.sameSite,\n    path: attrs.path,\n    domain: attrs.domain,\n    maxAge: maxAgeSeconds(expiresAt, now),\n    expires: expiresAt,\n  };\n}\n\n/**\n * Writes the access and refresh tokens as HttpOnly cookies.\n * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).\n */\nexport function applyAuthCookies(\n  cookies: CookieWriter,\n  tokens: AuthTokens,\n  options: IdentityCookieOptions = {},\n  now: Date = new Date(),\n): void {\n  const names = resolveCookieNames(options);\n  cookies.set(\n    names.access,\n    tokens.accessToken,\n    writeAttributes(options, tokens.accessTokenExpiresAt, now),\n  );\n  cookies.set(\n    names.refresh,\n    tokens.refreshToken,\n    writeAttributes(options, tokens.refreshTokenExpiresAt, now),\n  );\n}\n\n/** Clears both identity cookies (logout or failed session). */\nexport function clearAuthCookies(\n  cookies: CookieWriter,\n  options: IdentityCookieOptions = {},\n): void {\n  const names = resolveCookieNames(options);\n  const attrs = resolveCookieAttributes(options);\n  const deleteOpts = { path: attrs.path, domain: attrs.domain };\n  cookies.delete(names.access, deleteOpts);\n  cookies.delete(names.refresh, deleteOpts);\n}\n\n/**\n * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.\n * Not for production browser storage.\n */\nexport function createMemoryCookieStore(\n  initial: Record<string, string> = {},\n): CookieStore {\n  const values = new Map(\n    Object.entries(initial).filter(([, value]) => value.length > 0),\n  );\n  return {\n    get(name) {\n      const value = values.get(name);\n      return value === undefined ? undefined : { value };\n    },\n    set(name, value) {\n      if (value.length === 0) {\n        values.delete(name);\n        return;\n      }\n      values.set(name, value);\n    },\n    delete(name) {\n      values.delete(name);\n    },\n  };\n}\n\n/** Builds a cookie store seeded from an incoming `Cookie` header. */\nexport function cookieStoreFromHeader(\n  header: string | null | undefined,\n): CookieStore {\n  return createMemoryCookieStore(\n    Object.fromEntries(parseCookieHeader(header)),\n  );\n}\n","import { AccountUnavailableError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type CookieStore,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport { applyAuthCookies, clearAuthCookies } from \"./cookies\";\n\n/** Subset of {@link IdentityService} used to read and rotate a cookie session. */\nexport type IdentitySessionService = Pick<\n  IdentityService,\n  \"authenticate\" | \"refresh\"\n>;\n\n/**\n * Resolves the current principal from identity cookies.\n *\n * - Valid access cookie → `service.authenticate`.\n * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.\n * - Failure → clear cookies and return `null` (degrade to logged out).\n *\n * Call this where cookies can be written (Server Actions, Route Handlers). Refresh\n * rotates the refresh token; skipping the write would invalidate the browser session.\n */\nexport async function getIdentity(\n  service: IdentitySessionService,\n  cookies: CookieStore,\n  options: IdentityCookieOptions = {},\n): Promise<AuthenticatedIdentity | null> {\n  const names = resolveCookieNames(options);\n  const access = readCookieValue(cookies, names.access);\n  const refresh = readCookieValue(cookies, names.refresh);\n\n  if (access) {\n    try {\n      return await service.authenticate(access);\n    } catch (error) {\n      if (error instanceof AccountUnavailableError) {\n        clearAuthCookies(cookies, options);\n        return null;\n      }\n      if (!(error instanceof InvalidTokenError)) {\n        throw error;\n      }\n    }\n  }\n\n  if (!refresh) {\n    if (access) {\n      clearAuthCookies(cookies, options);\n    }\n    return null;\n  }\n\n  try {\n    const result = await service.refresh(refresh);\n    applyAuthCookies(cookies, result.tokens, options);\n    return result.user;\n  } catch (error) {\n    clearAuthCookies(cookies, options);\n    if (\n      error instanceof InvalidTokenError ||\n      error instanceof AccountUnavailableError\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n","import { IdentityError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport { applyAuthCookies, clearAuthCookies, cookieStoreFromHeader } from \"./cookies\";\nimport { getIdentity } from \"./session\";\n\nexport interface IdentityHandlerOptions extends IdentityCookieOptions {\n  /**\n   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.\n   * Default: `\"\"` (last path segment is the action: `login`, `logout`, …).\n   */\n  prefix?: string;\n}\n\nfunction json(\n  body: unknown,\n  status: number,\n  cookies?: { headers: string[] },\n): Response {\n  const headers = new Headers({ \"content-type\": \"application/json\" });\n  if (cookies) {\n    for (const header of cookies.headers) {\n      headers.append(\"set-cookie\", header);\n    }\n  }\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof IdentityError) {\n    return json({ code: error.code, message: error.message }, error.statusCode);\n  }\n  throw error;\n}\n\ntype RecordedCookie = {\n  name: string;\n  value: string;\n  options?: {\n    httpOnly?: boolean;\n    secure?: boolean;\n    sameSite?: \"strict\" | \"lax\" | \"none\";\n    path?: string;\n    domain?: string;\n    maxAge?: number;\n    expires?: Date;\n  };\n};\n\nfunction serializeSetCookie(cookie: RecordedCookie): string {\n  const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];\n  const opts = cookie.options ?? {};\n  if (opts.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);\n  }\n  if (opts.expires) {\n    parts.push(`Expires=${opts.expires.toUTCString()}`);\n  }\n  parts.push(`Path=${opts.path ?? \"/\"}`);\n  if (opts.domain) parts.push(`Domain=${opts.domain}`);\n  if (opts.httpOnly !== false) parts.push(\"HttpOnly\");\n  if (opts.secure) parts.push(\"Secure\");\n  const sameSite = opts.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nfunction recordingStore(header: string | null) {\n  const inner = cookieStoreFromHeader(header);\n  const writes: RecordedCookie[] = [];\n  const deleted: RecordedCookie[] = [];\n  const expired = new Date(0);\n\n  return {\n    store: {\n      get: inner.get.bind(inner),\n      set(name: string, value: string, options?: RecordedCookie[\"options\"]) {\n        inner.set(name, value, options);\n        writes.push({ name, value, options });\n      },\n      delete(name: string, options?: { path?: string; domain?: string }) {\n        inner.delete(name, options);\n        deleted.push({\n          name,\n          value: \"\",\n          options: { ...options, maxAge: 0, expires: expired },\n        });\n      },\n    },\n    headers(): string[] {\n      return [\n        ...writes.map(serializeSetCookie),\n        ...deleted.map(serializeSetCookie),\n      ];\n    },\n  };\n}\n\nasync function readJsonBody(\n  request: Request,\n): Promise<Record<string, unknown>> {\n  try {\n    const body: unknown = await request.json();\n    if (typeof body === \"object\" && body !== null && !Array.isArray(body)) {\n      return body as Record<string, unknown>;\n    }\n    return {};\n  } catch {\n    return {};\n  }\n}\n\nfunction actionFromUrl(url: string, prefix: string): string {\n  const pathname = new URL(url).pathname.replace(/\\/+$/, \"\");\n  const normalizedPrefix = prefix.replace(/^\\/+|\\/+$/g, \"\");\n  if (normalizedPrefix) {\n    const marker = `/${normalizedPrefix}/`;\n    const idx = pathname.lastIndexOf(marker);\n    if (idx >= 0) {\n      return pathname.slice(idx + marker.length);\n    }\n  }\n  const slash = pathname.lastIndexOf(\"/\");\n  return slash >= 0 ? pathname.slice(slash + 1) : pathname;\n}\n\n/**\n * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).\n *\n * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.\n */\nexport interface IdentityHandlers {\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  refresh(request: Request): Promise<Response>;\n  me(request: Request): Promise<Response>;\n  dispatch(request: Request): Promise<Response>;\n}\n\nexport function createIdentityHandlers(\n  service: IdentityService,\n  options: IdentityHandlerOptions = {},\n): IdentityHandlers {\n  const prefix = options.prefix ?? \"\";\n  const names = resolveCookieNames(options);\n\n  const login = async (request: Request): Promise<Response> => {\n    try {\n      const body = await readJsonBody(request);\n      const email = typeof body.email === \"string\" ? body.email : \"\";\n      const password = typeof body.password === \"string\" ? body.password : \"\";\n      const result = await service.login({ email, password });\n      if (\"kind\" in result) {\n        return json(result, 200);\n      }\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const logout = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const refresh = readCookieValue(recorded.store, names.refresh);\n      if (refresh) {\n        await service.logout(refresh);\n      }\n      clearAuthCookies(recorded.store, options);\n      return json({ ok: true }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const refresh = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const token = readCookieValue(recorded.store, names.refresh);\n      if (!token) {\n        throw new InvalidTokenError();\n      }\n      const result = await service.refresh(token);\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      clearAuthCookies(recorded.store, options);\n      if (error instanceof IdentityError) {\n        return json(\n          { code: error.code, message: error.message },\n          error.statusCode,\n          { headers: recorded.headers() },\n        );\n      }\n      throw error;\n    }\n  };\n\n  const me = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const identity = await getIdentity(service, recorded.store, options);\n      if (!identity) {\n        return json(\n          { code: \"identity/unauthenticated\", message: \"Authentication is required.\" },\n          401,\n          { headers: recorded.headers() },\n        );\n      }\n      return json({ user: identity }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const dispatch = async (request: Request): Promise<Response> => {\n    const action = actionFromUrl(request.url, prefix);\n    const method = request.method.toUpperCase();\n    if (method === \"POST\" && action === \"login\") return login(request);\n    if (method === \"POST\" && action === \"logout\") return logout(request);\n    if (method === \"POST\" && action === \"refresh\") return refresh(request);\n    if (method === \"GET\" && action === \"me\") return me(request);\n    return json({ code: \"identity/not-found\", message: \"Not found.\" }, 404);\n  };\n\n  return { login, logout, refresh, me, dispatch };\n}\n"],"mappings":";;;AAYA,SAAS,cAAc,WAAiB,KAAmB;CACzD,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,KAAK,GAAI,CAAC;AAC7E;AAEA,SAAS,gBACP,SACA,WACA,KACA;CACA,MAAM,QAAQ,wBAAwB,OAAO;CAC7C,OAAO;EACL,UAAU,MAAM;EAChB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,QAAQ,cAAc,WAAW,GAAG;EACpC,SAAS;CACX;AACF;;;;;AAMA,SAAgB,iBACd,SACA,QACA,UAAiC,CAAC,GAClC,sBAAY,IAAI,KAAK,GACf;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,QAAQ,IACN,MAAM,QACN,OAAO,aACP,gBAAgB,SAAS,OAAO,sBAAsB,GAAG,CAC3D;CACA,QAAQ,IACN,MAAM,SACN,OAAO,cACP,gBAAgB,SAAS,OAAO,uBAAuB,GAAG,CAC5D;AACF;;AAGA,SAAgB,iBACd,SACA,UAAiC,CAAC,GAC5B;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,MAAM,QAAQ,wBAAwB,OAAO;CAC7C,MAAM,aAAa;EAAE,MAAM,MAAM;EAAM,QAAQ,MAAM;CAAO;CAC5D,QAAQ,OAAO,MAAM,QAAQ,UAAU;CACvC,QAAQ,OAAO,MAAM,SAAS,UAAU;AAC1C;;;;;AAMA,SAAgB,wBACd,UAAkC,CAAC,GACtB;CACb,MAAM,SAAS,IAAI,IACjB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,MAAM,SAAS,CAAC,CAChE;CACA,OAAO;EACL,IAAI,MAAM;GACR,MAAM,QAAQ,OAAO,IAAI,IAAI;GAC7B,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM;EACnD;EACA,IAAI,MAAM,OAAO;GACf,IAAI,MAAM,WAAW,GAAG;IACtB,OAAO,OAAO,IAAI;IAClB;GACF;GACA,OAAO,IAAI,MAAM,KAAK;EACxB;EACA,OAAO,MAAM;GACX,OAAO,OAAO,IAAI;EACpB;CACF;AACF;;AAGA,SAAgB,sBACd,QACa;CACb,OAAO,wBACL,OAAO,YAAY,kBAAkB,MAAM,CAAC,CAC9C;AACF;;;;;;;;;;;;;AC5EA,eAAsB,YACpB,SACA,SACA,UAAiC,CAAC,GACK;CACvC,MAAM,QAAQ,mBAAmB,OAAO;CACxC,MAAM,SAAS,gBAAgB,SAAS,MAAM,MAAM;CACpD,MAAM,UAAU,gBAAgB,SAAS,MAAM,OAAO;CAEtD,IAAI,QACF,IAAI;EACF,OAAO,MAAM,QAAQ,aAAa,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiB,yBAAyB;GAC5C,iBAAiB,SAAS,OAAO;GACjC,OAAO;EACT;EACA,IAAI,EAAE,iBAAiB,oBACrB,MAAM;CAEV;CAGF,IAAI,CAAC,SAAS;EACZ,IAAI,QACF,iBAAiB,SAAS,OAAO;EAEnC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;EAC5C,iBAAiB,SAAS,OAAO,QAAQ,OAAO;EAChD,OAAO,OAAO;CAChB,SAAS,OAAO;EACd,iBAAiB,SAAS,OAAO;EACjC,IACE,iBAAiB,qBACjB,iBAAiB,yBAEjB,OAAO;EAET,MAAM;CACR;AACF;;;ACrDA,SAAS,KACP,MACA,QACA,SACU;CACV,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;CAClE,IAAI,SACF,KAAK,MAAM,UAAU,QAAQ,SAC3B,QAAQ,OAAO,cAAc,MAAM;CAGvC,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EAAE;EAAQ;CAAQ,CAAC;AAC/D;AAEA,SAAS,cAAc,OAA0B;CAC/C,IAAI,iBAAiB,eACnB,OAAO,KAAK;EAAE,MAAM,MAAM;EAAM,SAAS,MAAM;CAAQ,GAAG,MAAM,UAAU;CAE5E,MAAM;AACR;AAgBA,SAAS,mBAAmB,QAAgC;CAC1D,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,GAAG,mBAAmB,OAAO,KAAK,GAAG;CACnE,MAAM,OAAO,OAAO,WAAW,CAAC;CAChC,IAAI,KAAK,WAAW,KAAA,GAClB,MAAM,KAAK,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,MAAM,CAAC,GAAG;CAE9D,IAAI,KAAK,SACP,MAAM,KAAK,WAAW,KAAK,QAAQ,YAAY,GAAG;CAEpD,MAAM,KAAK,QAAQ,KAAK,QAAQ,KAAK;CACrC,IAAI,KAAK,QAAQ,MAAM,KAAK,UAAU,KAAK,QAAQ;CACnD,IAAI,KAAK,aAAa,OAAO,MAAM,KAAK,UAAU;CAClD,IAAI,KAAK,QAAQ,MAAM,KAAK,QAAQ;CACpC,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,KAAK,YAAY,SAAS,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,MAAM,CAAC,GAAG;CAC7E,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,eAAe,QAAuB;CAC7C,MAAM,QAAQ,sBAAsB,MAAM;CAC1C,MAAM,SAA2B,CAAC;CAClC,MAAM,UAA4B,CAAC;CACnC,MAAM,0BAAU,IAAI,KAAK,CAAC;CAE1B,OAAO;EACL,OAAO;GACL,KAAK,MAAM,IAAI,KAAK,KAAK;GACzB,IAAI,MAAc,OAAe,SAAqC;IACpE,MAAM,IAAI,MAAM,OAAO,OAAO;IAC9B,OAAO,KAAK;KAAE;KAAM;KAAO;IAAQ,CAAC;GACtC;GACA,OAAO,MAAc,SAA8C;IACjE,MAAM,OAAO,MAAM,OAAO;IAC1B,QAAQ,KAAK;KACX;KACA,OAAO;KACP,SAAS;MAAE,GAAG;MAAS,QAAQ;MAAG,SAAS;KAAQ;IACrD,CAAC;GACH;EACF;EACA,UAAoB;GAClB,OAAO,CACL,GAAG,OAAO,IAAI,kBAAkB,GAChC,GAAG,QAAQ,IAAI,kBAAkB,CACnC;EACF;CACF;AACF;AAEA,eAAe,aACb,SACkC;CAClC,IAAI;EACF,MAAM,OAAgB,MAAM,QAAQ,KAAK;EACzC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI,GAClE,OAAO;EAET,OAAO,CAAC;CACV,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,cAAc,KAAa,QAAwB;CAC1D,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE;CACzD,MAAM,mBAAmB,OAAO,QAAQ,cAAc,EAAE;CACxD,IAAI,kBAAkB;EACpB,MAAM,SAAS,IAAI,iBAAiB;EACpC,MAAM,MAAM,SAAS,YAAY,MAAM;EACvC,IAAI,OAAO,GACT,OAAO,SAAS,MAAM,MAAM,OAAO,MAAM;CAE7C;CACA,MAAM,QAAQ,SAAS,YAAY,GAAG;CACtC,OAAO,SAAS,IAAI,SAAS,MAAM,QAAQ,CAAC,IAAI;AAClD;AAeA,SAAgB,uBACd,SACA,UAAkC,CAAC,GACjB;CAClB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,QAAQ,mBAAmB,OAAO;CAExC,MAAM,QAAQ,OAAO,YAAwC;EAC3D,IAAI;GACF,MAAM,OAAO,MAAM,aAAa,OAAO;GACvC,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;GAC5D,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;GACrE,MAAM,SAAS,MAAM,QAAQ,MAAM;IAAE;IAAO;GAAS,CAAC;GACtD,IAAI,UAAU,QACZ,OAAO,KAAK,QAAQ,GAAG;GAEzB,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,SAAS,OAAO,YAAwC;EAC5D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,UAAU,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC7D,IAAI,SACF,MAAM,QAAQ,OAAO,OAAO;GAE9B,iBAAiB,SAAS,OAAO,OAAO;GACxC,OAAO,KAAK,EAAE,IAAI,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EAChE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,UAAU,OAAO,YAAwC;EAC7D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,QAAQ,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC3D,IAAI,CAAC,OACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK;GAC1C,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO;GACxC,IAAI,iBAAiB,eACnB,OAAO,KACL;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,GAC3C,MAAM,YACN,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,MAAM;EACR;CACF;CAEA,MAAM,KAAK,OAAO,YAAwC;EACxD,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS,OAAO,OAAO;GACnE,IAAI,CAAC,UACH,OAAO,KACL;IAAE,MAAM;IAA4B,SAAS;GAA8B,GAC3E,KACA,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,OAAO,KAAK,EAAE,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACtE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,WAAW,OAAO,YAAwC;EAC9D,MAAM,SAAS,cAAc,QAAQ,KAAK,MAAM;EAChD,MAAM,SAAS,QAAQ,OAAO,YAAY;EAC1C,IAAI,WAAW,UAAU,WAAW,SAAS,OAAO,MAAM,OAAO;EACjE,IAAI,WAAW,UAAU,WAAW,UAAU,OAAO,OAAO,OAAO;EACnE,IAAI,WAAW,UAAU,WAAW,WAAW,OAAO,QAAQ,OAAO;EACrE,IAAI,WAAW,SAAS,WAAW,MAAM,OAAO,GAAG,OAAO;EAC1D,OAAO,KAAK;GAAE,MAAM;GAAsB,SAAS;EAAa,GAAG,GAAG;CACxE;CAEA,OAAO;EAAE;EAAO;EAAQ;EAAS;EAAI;CAAS;AAChD"}

package/dist/node.cjs

@@ -1,9 +1,10 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
 const require_errors = require("./errors-Bcjx9o6g.cjs");
 const require_logger = require("./logger-Be1wDzBC.cjs");
-const require_identity = require("./identity-4eP45YIP.cjs");
-let node_crypto = require("node:crypto");
+const require_identity = require("./identity-Yz1BVkrM.cjs");
+const require_cookie_header = require("./cookie-header-Dqd5k5BU.cjs");
 let jose = require("jose");
+let node_crypto = require("node:crypto");
 //#region core/password-hasher.ts
 /**
 * Password hashing using Node's scrypt. Hashes are self-describing:
@@ -58,22 +59,11 @@ function createTokenService(config) {
 			};
 		},
 		async verifyAccessToken(token) {
-			try {
-				const { payload } = await (0, jose.jwtVerify)(token, secret, {
-					issuer: config.issuer,
-					audience: config.audience
-				});
-				if (typeof payload.sub !== "string" || typeof payload.authVersion !== "number") throw new require_errors.InvalidTokenError();
-				return {
-					sub: payload.sub,
-					authVersion: payload.authVersion,
-					iat: payload.iat ?? 0,
-					exp: payload.exp ?? 0
-				};
-			} catch (error) {
-				if (error instanceof require_errors.InvalidTokenError) throw error;
-				throw new require_errors.InvalidTokenError();
-			}
+			return require_identity.verifyAccessToken(token, {
+				secret: config.accessTokenSecret,
+				issuer: config.issuer,
+				audience: config.audience
+			});
 		},
 		createRefreshToken(sessionId) {
 			const token = `${sessionId}.${(0, node_crypto.randomBytes)(32).toString("base64url")}`;
@@ -689,7 +679,7 @@ async function disableAccount(deps, userId) {
 //#region core/identity-service.ts
 /**
 * Wires the framework-agnostic identity runtime with Node defaults (scrypt hashing,
-* `jose` HS256 tokens). Express and NestJS adapters build on top of this service.
+* `jose` HS256 tokens). Express, NestJS, and Next.js adapters build on top of this service.
 */
 function createIdentityService(configInput, store) {
 	const config = require_identity.resolveIdentityConfig(configInput);
@@ -888,6 +878,9 @@ function createMicrosoftOAuthProvider(config) {
 //#endregion
 exports.AccountAdminError = AccountAdminError;
 exports.AccountUnavailableError = require_errors.AccountUnavailableError;
+exports.DEFAULT_ACCESS_COOKIE = require_cookie_header.DEFAULT_ACCESS_COOKIE;
+exports.DEFAULT_ISSUER = require_identity.DEFAULT_ISSUER;
+exports.DEFAULT_REFRESH_COOKIE = require_cookie_header.DEFAULT_REFRESH_COOKIE;
 exports.EmailAlreadyRegisteredError = require_errors.EmailAlreadyRegisteredError;
 exports.EmailVerificationError = EmailVerificationError;
 exports.ForbiddenError = require_errors.ForbiddenError;
@@ -922,6 +915,7 @@ exports.evaluateAuthorization = require_identity.evaluateAuthorization;
 exports.generateTotp = generateTotp;
 exports.generateTotpSecret = generateTotpSecret;
 exports.generateVerificationToken = generateVerificationToken;
+exports.hasIdentityCookies = require_cookie_header.hasIdentityCookies;
 exports.hashVerificationToken = hashVerificationToken;
 exports.identitySchemaModel = require_identity.identitySchemaModel;
 exports.isAuthorized = require_identity.isAuthorized;
@@ -930,17 +924,22 @@ exports.lockAccount = lockAccount;
 exports.loginUser = loginUser;
 exports.noopLogger = require_logger.noopLogger;
 exports.normalizeEmail = normalizeEmail;
+exports.parseCookieHeader = require_cookie_header.parseCookieHeader;
+exports.readCookieValue = require_cookie_header.readCookieValue;
 exports.recordFailedAttempt = recordFailedAttempt;
 exports.refreshSession = refreshSession;
 exports.registerUser = registerUser;
 exports.requestEmailVerification = requestEmailVerification;
 exports.requestPasswordReset = requestPasswordReset;
 exports.resetPassword = resetPassword;
+exports.resolveCookieAttributes = require_cookie_header.resolveCookieAttributes;
+exports.resolveCookieNames = require_cookie_header.resolveCookieNames;
 exports.resolveIdentityConfig = require_identity.resolveIdentityConfig;
 exports.resolveLogger = require_logger.resolveLogger;
 exports.revokeSession = revokeSession;
 exports.setup2FA = setup2FA;
 exports.unlockAccount = unlockAccount;
+exports.verifyAccessToken = require_identity.verifyAccessToken;
 exports.verifyEmail = verifyEmail;
 exports.verifyMfaChallenge = verifyMfaChallenge;
 exports.verifyTotp = verifyTotp;

package/dist/node.d.cts

@@ -1,7 +1,8 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-CBbiRO2n.cjs";
-import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service---OTann1.cjs";
-import { t as identitySchemaModel } from "./index-CpufYgyn.cjs";
+import { A as LockoutConfig, B as AuthorizationContext, C as createTokenService, D as IdentityConfig, E as DEFAULT_ISSUER, F as TwoFactorSmsParams, G as isAuthorized, H as AuthorizationRequirement, I as IdentityLogger, L as consoleLogger, M as EmailVerificationParams, N as NotificationService, O as IdentityConfigInput, P as PasswordResetParams, R as noopLogger, S as TokenService, T as createAuditLogger, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as resolveLogger } from "./errors-0Zh7EG06.cjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-DE0Ffguz.cjs";
+import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-CsYqHPvK.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}
@@ -255,5 +256,5 @@ declare function unlockAccount(deps: AccountAdminDeps, userId: string): Promise<
  */
 declare function disableAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
 //#endregion
-export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyEmail, verifyMfaChallenge, verifyTotp };
+export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hasIdentityCookies, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, parseCookieHeader, readCookieValue, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyAccessToken, verifyEmail, verifyMfaChallenge, verifyTotp };
 //# sourceMappingURL=node.d.cts.map

package/dist/node.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.cts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBAoDW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UCjDc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BAA0B,QAAQ,oBAAoB;;;;UC3CrD;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BAA6B,QAAQ,uBAAuB;;;;cCrE/D,+BAA+B;EAC9B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAiCmB,YACpB,MAAM,uBACN,mBACC;;;;cCrDU,2BAA2B;EAC1B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAsCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBCtEa,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAgD/B;;;;iBAOA,aAAa,sBAAsB,MAAK;;;;;;iBAUxC,WAAW,cAAc,sBAAsB,MAAK;;;;;iBAUpD,gBAAgB;EAC9B;EACA;EACA;;;;;cC5FW,uBAAuB;EACtB,YAAA;;;;;;cASD,+BAA+B;EAAA;;UAU3B,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA2BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cC9KE,0BAA0B;EACzB,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YAAY,MAAM,kBAAkB,iBAAiB;;;;;iBAiBrD,cAAc,MAAM,kBAAkB,iBAAiB;;;;;;iBAoBvD,eAAe,MAAM,kBAAkB,iBAAiB"}
+{"version":3,"file":"node.d.cts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBA+DW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UC5Dc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BACd,QAAQ,oBACP;;;;UC7Cc;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BACd,QAAQ,uBACP;;;;cCpEU,+BAA+B;EAC1C,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAmCmB,YACpB,MAAM,uBACN,mBACC;;;;cCvDU,2BAA2B;EACtC,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAwCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBC3Ea,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAkD/B;;;;iBAOA,aACd,sBACA,MAAK;;;;;;iBAWS,WACd,cACA,sBACA,MAAK;;;;;iBAaS,gBAAgB;EAC9B;EACA;EACA;;;;;cCvGW,uBAAuB;EAClC,YAAY;;;;;;cASD,+BAA+B;EAC1C;;UAae,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cCpLE,0BAA0B;EACrC,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YACpB,MAAM,kBACN,iBACC;;;;;iBAiBmB,cACpB,MAAM,kBACN,iBACC;;;;;;iBAoBmB,eACpB,MAAM,kBACN,iBACC"}

package/dist/node.d.mts

@@ -1,7 +1,8 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, a as generateVerificationToken, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, i as CreateVerificationTokenInput, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, o as hashVerificationToken, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
-import { A as resolveIdentityConfig, B as AuthorizationDecision, C as createTokenService, D as IdentityConfigInput, E as IdentityConfig, F as IdentityLogger, H as PolicyRule, I as consoleLogger, L as noopLogger, M as NotificationService, N as PasswordResetParams, O as IdentityOverrides, P as TwoFactorSmsParams, R as resolveLogger, S as TokenService, T as createAuditLogger, U as evaluateAuthorization, V as AuthorizationRequirement, W as isAuthorized, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as EmailVerificationParams, k as LockoutConfig, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as AuthorizationContext } from "./errors-_OcodtdV.mjs";
-import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-WpOKb0MK.mjs";
-import { t as identitySchemaModel } from "./index-CpufYgyn.mjs";
+import { A as LockoutConfig, B as AuthorizationContext, C as createTokenService, D as IdentityConfig, E as DEFAULT_ISSUER, F as TwoFactorSmsParams, G as isAuthorized, H as AuthorizationRequirement, I as IdentityLogger, L as consoleLogger, M as EmailVerificationParams, N as NotificationService, O as IdentityConfigInput, P as PasswordResetParams, R as noopLogger, S as TokenService, T as createAuditLogger, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as resolveLogger } from "./errors-DVDEUk9-.mjs";
+import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-JtsoA6lv.mjs";
+import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-LhSdoWEP.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}
@@ -255,5 +256,5 @@ declare function unlockAccount(deps: AccountAdminDeps, userId: string): Promise<
  */
 declare function disableAccount(deps: AccountAdminDeps, userId: string): Promise<void>;
 //#endregion
-export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyEmail, verifyMfaChallenge, verifyTotp };
+export { AccessTokenClaims, AccountAdminDeps, AccountAdminError, AccountUnavailableError, AuditLogger, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CreateVerificationTokenInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, EmailVerificationDeps, EmailVerificationError, EmailVerificationParams, ExchangeCodeParams, ForbiddenError, type GoogleOAuthConfig, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityLogger, IdentityOverrides, IdentityService, IdentityServiceConfig, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginDeps, LoginInput, LoginResult, MfaRequiredResult, type MicrosoftOAuthConfig, NotificationService, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, PasswordHasher, PasswordResetDeps, PasswordResetError, PasswordResetParams, Permission, PolicyRule, RefreshDeps, RegisterDeps, RegisterInput, RegistrationValidationError, Role, RolePermissionGrant, TokenService, TotpSecret, TotpSetupResult, TwoFactorDeps, TwoFactorError, TwoFactorRequiredError, TwoFactorSmsParams, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hasIdentityCookies, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, parseCookieHeader, readCookieValue, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyAccessToken, verifyEmail, verifyMfaChallenge, verifyTotp };
 //# sourceMappingURL=node.d.mts.map

package/dist/node.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"node.d.mts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBAoDW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UCjDc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BAA0B,QAAQ,oBAAoB;;;;UC3CrD;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BAA6B,QAAQ,uBAAuB;;;;cCrE/D,+BAA+B;EAC9B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAiCmB,YACpB,MAAM,uBACN,mBACC;;;;cCrDU,2BAA2B;EAC1B,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAsCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBCtEa,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAgD/B;;;;iBAOA,aAAa,sBAAsB,MAAK;;;;;;iBAUxC,WAAW,cAAc,sBAAsB,MAAK;;;;;iBAUpD,gBAAgB;EAC9B;EACA;EACA;;;;;cC5FW,uBAAuB;EACtB,YAAA;;;;;;cASD,+BAA+B;EAAA;;UAU3B,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA2BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cC9KE,0BAA0B;EACzB,YAAA;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YAAY,MAAM,kBAAkB,iBAAiB;;;;;iBAiBrD,cAAc,MAAM,kBAAkB,iBAAiB;;;;;;iBAoBvD,eAAe,MAAM,kBAAkB,iBAAiB"}
+{"version":3,"file":"node.d.mts","names":[],"sources":["../core/lockout.ts","../core/refresh-service.ts","../core/oauth/providers/google.ts","../core/oauth/providers/microsoft.ts","../core/email-verification.ts","../core/password-reset.ts","../core/totp.ts","../core/two-factor.ts","../core/account-admin.ts"],"mappings":";;;;;;;;;;;;;iBAYgB,aACd,MAAM,cACN,QAAQ,eACR,WAAW;;;;;iBAYS,oBACpB,OAAO,eACP,MAAM,cACN,QAAQ,eACR,WAAW,OACV;;;;;iBAwBmB,aACpB,OAAO,eACP,MAAM,eACL;;;;UClDc;EACf,QAAQ;EACR,OAAO;EACP,cAAc;EACd,OAAO;;;;;;;;;iBAUa,eACpB,MAAM,aACN,yBACC,QAAQ;;iBA+DW,cACpB,MAAM,KAAK,6DACX,yBACC;;;;UC5Dc;;EAEf;;;;;EAKA;;;;EAIA;;;;;;;;;;;iBA+Bc,0BACd,QAAQ,oBACP;;;;UC7Cc;;EAEf;;;;;EAKA;;;;;;EAMA;;;;;EAKA;;;;;;;;;;;iBA+Bc,6BACd,QAAQ,uBACP;;;;cCpEU,+BAA+B;EAC1C,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;iBASa,yBACpB,MAAM,uBACN,iBACC;;;;;;iBAmCmB,YACpB,MAAM,uBACN,mBACC;;;;cCvDU,2BAA2B;EACtC,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,QAAQ;EACR,OAAO;;;;;;;;iBASa,qBACpB,MAAM,mBACN,gBACC;;;;;;;iBAwCmB,cACpB,MAAM,mBACN,kBACA,sBACC;;;;iBC3Ea,aAAa,QAAQ;;iBAoBrB,aAAa,kBAAkB;;;;;iBAkD/B;;;;iBAOA,aACd,sBACA,MAAK;;;;;;iBAWS,WACd,cACA,sBACA,MAAK;;;;;iBAaS,gBAAgB;EAC9B;EACA;EACA;;;;;cCvGW,uBAAuB;EAClC,YAAY;;;;;;cASD,+BAA+B;EAC1C;;UAae,sBAAsB;EACrC,OAAO;;;;;;;;iBAaa,SACpB,MAAM,eACN,iBACC,QAAQ;;;;;iBAoCW,UACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,WACpB,MAAM,eACN,gBACA,mBACC;;;;;iBA6BmB,uBACpB,QAAQ,gBACR,iBACC;;;;;;;iBAqBmB,mBACpB,MAAM,eACN,kBACA,mBACC,QAAQ;;;;cCpLE,0BAA0B;EACrC,YAAY;;UAKG;EACf,QAAQ;EACR,OAAO;EACP,OAAO;;;;;;;;;iBAUa,YACpB,MAAM,kBACN,iBACC;;;;;iBAiBmB,cACpB,MAAM,kBACN,iBACC;;;;;;iBAoBmB,eACpB,MAAM,kBACN,iBACC"}

package/dist/node.mjs

@@ -1,8 +1,9 @@
 import { a as IdentityError, c as UnauthenticatedError, i as IdentityConfigError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError } from "./errors-CEmnZxIn.mjs";
 import { n as noopLogger, r as resolveLogger, t as consoleLogger } from "./logger-CcCHJVVe.mjs";
-import { a as hydratePrincipal, c as isAuthorized, i as createOAuthService, l as resolveIdentityConfig, n as OAuthProviderNotFoundError, o as issueSession, r as OAuthStateMismatchError, s as evaluateAuthorization, t as identitySchemaModel } from "./identity-Bz9RDOvT.mjs";
-import { createHash, createHmac, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
+import { a as createOAuthService, c as evaluateAuthorization, d as resolveIdentityConfig, i as OAuthStateMismatchError, l as isAuthorized, n as verifyAccessToken, o as hydratePrincipal, r as OAuthProviderNotFoundError, s as issueSession, t as identitySchemaModel, u as DEFAULT_ISSUER } from "./identity-D0qyca_c.mjs";
+import { a as readCookieValue, i as parseCookieHeader, n as DEFAULT_REFRESH_COOKIE, o as resolveCookieAttributes, r as hasIdentityCookies, s as resolveCookieNames, t as DEFAULT_ACCESS_COOKIE } from "./cookie-header-DptIxRmW.mjs";
 import { SignJWT, jwtVerify } from "jose";
+import { createHash, createHmac, randomBytes, scrypt, timingSafeEqual } from "node:crypto";
 //#region core/password-hasher.ts
 /**
 * Password hashing using Node's scrypt. Hashes are self-describing:
@@ -57,22 +58,11 @@ function createTokenService(config) {
 			};
 		},
 		async verifyAccessToken(token) {
-			try {
-				const { payload } = await jwtVerify(token, secret, {
-					issuer: config.issuer,
-					audience: config.audience
-				});
-				if (typeof payload.sub !== "string" || typeof payload.authVersion !== "number") throw new InvalidTokenError();
-				return {
-					sub: payload.sub,
-					authVersion: payload.authVersion,
-					iat: payload.iat ?? 0,
-					exp: payload.exp ?? 0
-				};
-			} catch (error) {
-				if (error instanceof InvalidTokenError) throw error;
-				throw new InvalidTokenError();
-			}
+			return verifyAccessToken(token, {
+				secret: config.accessTokenSecret,
+				issuer: config.issuer,
+				audience: config.audience
+			});
 		},
 		createRefreshToken(sessionId) {
 			const token = `${sessionId}.${randomBytes(32).toString("base64url")}`;
@@ -688,7 +678,7 @@ async function disableAccount(deps, userId) {
 //#region core/identity-service.ts
 /**
 * Wires the framework-agnostic identity runtime with Node defaults (scrypt hashing,
-* `jose` HS256 tokens). Express and NestJS adapters build on top of this service.
+* `jose` HS256 tokens). Express, NestJS, and Next.js adapters build on top of this service.
 */
 function createIdentityService(configInput, store) {
 	const config = resolveIdentityConfig(configInput);
@@ -885,6 +875,6 @@ function createMicrosoftOAuthProvider(config) {
 	};
 }
 //#endregion
-export { AccountAdminError, AccountUnavailableError, EmailAlreadyRegisteredError, EmailVerificationError, ForbiddenError, IdentityConfigError, IdentityError, InvalidCredentialsError, InvalidTokenError, OAuthProviderNotFoundError, OAuthStateMismatchError, PasswordResetError, RegistrationValidationError, TwoFactorError, TwoFactorRequiredError, UnauthenticatedError, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyEmail, verifyMfaChallenge, verifyTotp };
+export { AccountAdminError, AccountUnavailableError, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, EmailAlreadyRegisteredError, EmailVerificationError, ForbiddenError, IdentityConfigError, IdentityError, InvalidCredentialsError, InvalidTokenError, OAuthProviderNotFoundError, OAuthStateMismatchError, PasswordResetError, RegistrationValidationError, TwoFactorError, TwoFactorRequiredError, UnauthenticatedError, base32Decode, base32Encode, buildOtpAuthUri, checkLockout, clearLockout, consoleLogger, createAuditLogger, createGoogleOAuthProvider, createIdentityService, createMicrosoftOAuthProvider, createOAuthService, createPasswordHasher, createTokenService, disable2FA, disableAccount, enable2FA, evaluateAuthorization, generateTotp, generateTotpSecret, generateVerificationToken, hasIdentityCookies, hashVerificationToken, identitySchemaModel, isAuthorized, issueMfaChallengeToken, lockAccount, loginUser, noopLogger, normalizeEmail, parseCookieHeader, readCookieValue, recordFailedAttempt, refreshSession, registerUser, requestEmailVerification, requestPasswordReset, resetPassword, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, resolveLogger, revokeSession, setup2FA, unlockAccount, verifyAccessToken, verifyEmail, verifyMfaChallenge, verifyTotp };
 
 //# sourceMappingURL=node.mjs.map