@azlib/identity 0.3.0 → 0.3.1

package/dist/{cookie-header-LFWHKQ04.d.cts → cookie-header-DdTShpuc.d.cts}

@@ -59,10 +59,7 @@ interface CookieWriter {
     maxAge?: number;
     expires?: Date;
   }): unknown;
-  delete(name: string, options?: {
-    path?: string;
-    domain?: string;
-  }): unknown;
+  delete(name: string): unknown;
 }
 type CookieStore = CookieReader & CookieWriter;
 /** Anything {@link hasIdentityCookies} / {@link readCookieValue} can inspect. */
@@ -83,4 +80,4 @@ declare function readCookieValue(source: CookieSource, name: string): string | u
 declare function hasIdentityCookies(source: CookieSource, options?: IdentityCookieOptions): boolean;
 //#endregion
 export { DEFAULT_ACCESS_COOKIE as a, IdentityCookieNames as c, parseCookieHeader as d, readCookieValue as f, CookieWriter as i, IdentityCookieOptions as l, resolveCookieNames as m, CookieSource as n, DEFAULT_REFRESH_COOKIE as o, resolveCookieAttributes as p, CookieStore as r, IdentityCookieAttributes as s, CookieReader as t, hasIdentityCookies as u };
-//# sourceMappingURL=cookie-header-LFWHKQ04.d.cts.map
+//# sourceMappingURL=cookie-header-DdTShpuc.d.cts.map

package/dist/cookie-header-DdTShpuc.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-header-DdTShpuc.d.cts","names":[],"sources":["../core/cookie-header.ts"],"mappings":";;;;;;;;cAQa;;cAGA;;UAGI;;EAEf;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;UAIe,8BAA8B;;EAE7C;;EAEA;;;UAIe;EACf;EACA;;;;;UAMe;EACf,IAAI;IAAiB;;;;;;;UAON;EACf,IACE,cACA,eACA;IACE;IACA;IACA;IACA;IACA;IACA;IACA,UAAU;;EAGd,OAAO;;KAGG,cAAc,eAAe;;KAG7B,eACR,eACA;iBAKY,mBACd,UAAS,wBACR;iBAOa,wBACd,UAAS,wBACR,SAAS,KAAK,+DACf;;;;;iBAcc,kBACd,oCACC;;iBA8Ba,gBACd,QAAQ,cACR;;;;;iBAqBc,mBACd,QAAQ,cACR,UAAS"}

package/dist/{cookie-header-LFWHKQ04.d.mts → cookie-header-DdTShpuc.d.mts}

@@ -59,10 +59,7 @@ interface CookieWriter {
     maxAge?: number;
     expires?: Date;
   }): unknown;
-  delete(name: string, options?: {
-    path?: string;
-    domain?: string;
-  }): unknown;
+  delete(name: string): unknown;
 }
 type CookieStore = CookieReader & CookieWriter;
 /** Anything {@link hasIdentityCookies} / {@link readCookieValue} can inspect. */
@@ -83,4 +80,4 @@ declare function readCookieValue(source: CookieSource, name: string): string | u
 declare function hasIdentityCookies(source: CookieSource, options?: IdentityCookieOptions): boolean;
 //#endregion
 export { DEFAULT_ACCESS_COOKIE as a, IdentityCookieNames as c, parseCookieHeader as d, readCookieValue as f, CookieWriter as i, IdentityCookieOptions as l, resolveCookieNames as m, CookieSource as n, DEFAULT_REFRESH_COOKIE as o, resolveCookieAttributes as p, CookieStore as r, IdentityCookieAttributes as s, CookieReader as t, hasIdentityCookies as u };
-//# sourceMappingURL=cookie-header-LFWHKQ04.d.mts.map
+//# sourceMappingURL=cookie-header-DdTShpuc.d.mts.map

package/dist/cookie-header-DdTShpuc.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-header-DdTShpuc.d.mts","names":[],"sources":["../core/cookie-header.ts"],"mappings":";;;;;;;;cAQa;;cAGA;;UAGI;;EAEf;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;UAIe,8BAA8B;;EAE7C;;EAEA;;;UAIe;EACf;EACA;;;;;UAMe;EACf,IAAI;IAAiB;;;;;;;UAON;EACf,IACE,cACA,eACA;IACE;IACA;IACA;IACA;IACA;IACA;IACA,UAAU;;EAGd,OAAO;;KAGG,cAAc,eAAe;;KAG7B,eACR,eACA;iBAKY,mBACd,UAAS,wBACR;iBAOa,wBACd,UAAS,wBACR,SAAS,KAAK,+DACf;;;;;iBAcc,kBACd,oCACC;;iBA8Ba,gBACd,QAAQ,cACR;;;;;iBAqBc,mBACd,QAAQ,cACR,UAAS"}

package/dist/cookie-header-DptIxRmW.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"cookie-header-DptIxRmW.mjs","names":[],"sources":["../core/cookie-header.ts"],"sourcesContent":["/**\n * Cookie names and Cookie-header parsing for identity sessions.\n *\n * Edge-safe: no Node APIs. Use {@link hasIdentityCookies} in Next.js `proxy.ts` /\n * middleware to gate routes without hitting the database.\n */\n\n/** Default HttpOnly cookie that holds the short-lived access JWT. */\nexport const DEFAULT_ACCESS_COOKIE = \"azlib_at\";\n\n/** Default HttpOnly cookie that holds the rotating refresh token. */\nexport const DEFAULT_REFRESH_COOKIE = \"azlib_rt\";\n\n/** Cookie attribute set shared by access and refresh cookies. */\nexport interface IdentityCookieAttributes {\n  /** Mark cookies as `HttpOnly`. Default: `true`. */\n  httpOnly?: boolean;\n  /**\n   * Mark cookies as `Secure`. Defaults to `true` when `NODE_ENV` is `\"production\"`,\n   * `false` otherwise.\n   */\n  secure?: boolean;\n  /** `SameSite` policy. Default: `\"lax\"`. */\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  /** Cookie path. Default: `\"/\"`. */\n  path?: string;\n  /** Cookie domain. Omit to use the current host. */\n  domain?: string;\n}\n\n/** Names and attributes for the access + refresh cookie pair. */\nexport interface IdentityCookieOptions extends IdentityCookieAttributes {\n  /** Access-token cookie name. Default: {@link DEFAULT_ACCESS_COOKIE}. */\n  accessCookie?: string;\n  /** Refresh-token cookie name. Default: {@link DEFAULT_REFRESH_COOKIE}. */\n  refreshCookie?: string;\n}\n\n/** Resolved cookie names. */\nexport interface IdentityCookieNames {\n  access: string;\n  refresh: string;\n}\n\n/**\n * A Next.js `cookies().get` / Request-cookies compatible reader.\n */\nexport interface CookieReader {\n  get(name: string): { value: string } | undefined;\n}\n\n/**\n * A Next.js `cookies().set` / `cookies().delete` compatible writer.\n * `maxAge` is in **seconds** (Web / Next.js convention, not Express milliseconds).\n */\nexport interface CookieWriter {\n  set(\n    name: string,\n    value: string,\n    options?: {\n      httpOnly?: boolean;\n      secure?: boolean;\n      sameSite?: \"strict\" | \"lax\" | \"none\";\n      path?: string;\n      domain?: string;\n      maxAge?: number;\n      expires?: Date;\n    },\n  ): unknown;\n  delete(name: string, options?: { path?: string; domain?: string }): unknown;\n}\n\nexport type CookieStore = CookieReader & CookieWriter;\n\n/** Anything {@link hasIdentityCookies} / {@link readCookieValue} can inspect. */\nexport type CookieSource =\n  | CookieReader\n  | Headers\n  | string\n  | null\n  | undefined;\n\nexport function resolveCookieNames(\n  options: IdentityCookieOptions = {},\n): IdentityCookieNames {\n  return {\n    access: options.accessCookie ?? DEFAULT_ACCESS_COOKIE,\n    refresh: options.refreshCookie ?? DEFAULT_REFRESH_COOKIE,\n  };\n}\n\nexport function resolveCookieAttributes(\n  options: IdentityCookieOptions = {},\n): Required<Pick<IdentityCookieAttributes, \"httpOnly\" | \"sameSite\" | \"path\">> &\n  IdentityCookieAttributes {\n  return {\n    httpOnly: options.httpOnly ?? true,\n    secure: options.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: options.sameSite ?? \"lax\",\n    path: options.path ?? \"/\",\n    domain: options.domain,\n  };\n}\n\n/**\n * Parses a raw `Cookie` header into a name → value map.\n * Values are `decodeURIComponent`'d when possible.\n */\nexport function parseCookieHeader(\n  header: string | null | undefined,\n): Map<string, string> {\n  const result = new Map<string, string>();\n  if (!header) return result;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const key = part.slice(0, eq).trim();\n    if (!key) continue;\n    const raw = part.slice(eq + 1).trim();\n    if (result.has(key)) continue;\n    try {\n      result.set(key, decodeURIComponent(raw));\n    } catch {\n      result.set(key, raw);\n    }\n  }\n  return result;\n}\n\nfunction isCookieReader(source: CookieSource): source is CookieReader {\n  return (\n    typeof source === \"object\" &&\n    source !== null &&\n    \"get\" in source &&\n    typeof source.get === \"function\" &&\n    !(source instanceof Headers)\n  );\n}\n\n/** Reads a single cookie value from a header string, `Headers`, or cookie reader. */\nexport function readCookieValue(\n  source: CookieSource,\n  name: string,\n): string | undefined {\n  if (source == null) return undefined;\n  if (typeof source === \"string\") {\n    const value = parseCookieHeader(source).get(name);\n    return value && value.length > 0 ? value : undefined;\n  }\n  if (source instanceof Headers) {\n    return readCookieValue(source.get(\"cookie\"), name);\n  }\n  if (isCookieReader(source)) {\n    const value = source.get(name)?.value?.trim();\n    return value && value.length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\n/**\n * Returns true when the request carries an identity access and/or refresh cookie.\n * Intended for Edge/proxy gates: presence only — do not treat this as authentication.\n */\nexport function hasIdentityCookies(\n  source: CookieSource,\n  options: IdentityCookieOptions = {},\n): boolean {\n  const names = resolveCookieNames(options);\n  return (\n    readCookieValue(source, names.access) !== undefined ||\n    readCookieValue(source, names.refresh) !== undefined\n  );\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,wBAAwB;;AAGrC,MAAa,yBAAyB;AAuEtC,SAAgB,mBACd,UAAiC,CAAC,GACb;CACrB,OAAO;EACL,QAAQ,QAAQ,gBAAA;EAChB,SAAS,QAAQ,iBAAA;CACnB;AACF;AAEA,SAAgB,wBACd,UAAiC,CAAC,GAET;CACzB,OAAO;EACL,UAAU,QAAQ,YAAY;EAC9B,QAAQ,QAAQ,UAAU,QAAQ,IAAI,aAAa;EACnD,UAAU,QAAQ,YAAY;EAC9B,MAAM,QAAQ,QAAQ;EACtB,QAAQ,QAAQ;CAClB;AACF;;;;;AAMA,SAAgB,kBACd,QACqB;CACrB,MAAM,yBAAS,IAAI,IAAoB;CACvC,IAAI,CAAC,QAAQ,OAAO;CACpB,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IAAI;EACf,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK;EACnC,IAAI,CAAC,KAAK;EACV,MAAM,MAAM,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;EACpC,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,IAAI;GACF,OAAO,IAAI,KAAK,mBAAmB,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO,IAAI,KAAK,GAAG;EACrB;CACF;CACA,OAAO;AACT;AAEA,SAAS,eAAe,QAA8C;CACpE,OACE,OAAO,WAAW,YAClB,WAAW,QACX,SAAS,UACT,OAAO,OAAO,QAAQ,cACtB,EAAE,kBAAkB;AAExB;;AAGA,SAAgB,gBACd,QACA,MACoB;CACpB,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,IAAI,OAAO,WAAW,UAAU;EAC9B,MAAM,QAAQ,kBAAkB,MAAM,CAAC,CAAC,IAAI,IAAI;EAChD,OAAO,SAAS,MAAM,SAAS,IAAI,QAAQ,KAAA;CAC7C;CACA,IAAI,kBAAkB,SACpB,OAAO,gBAAgB,OAAO,IAAI,QAAQ,GAAG,IAAI;CAEnD,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,QAAQ,OAAO,IAAI,IAAI,CAAC,EAAE,OAAO,KAAK;EAC5C,OAAO,SAAS,MAAM,SAAS,IAAI,QAAQ,KAAA;CAC7C;AAEF;;;;;AAMA,SAAgB,mBACd,QACA,UAAiC,CAAC,GACzB;CACT,MAAM,QAAQ,mBAAmB,OAAO;CACxC,OACE,gBAAgB,QAAQ,MAAM,MAAM,MAAM,KAAA,KAC1C,gBAAgB,QAAQ,MAAM,OAAO,MAAM,KAAA;AAE/C"}
+{"version":3,"file":"cookie-header-DptIxRmW.mjs","names":[],"sources":["../core/cookie-header.ts"],"sourcesContent":["/**\n * Cookie names and Cookie-header parsing for identity sessions.\n *\n * Edge-safe: no Node APIs. Use {@link hasIdentityCookies} in Next.js `proxy.ts` /\n * middleware to gate routes without hitting the database.\n */\n\n/** Default HttpOnly cookie that holds the short-lived access JWT. */\nexport const DEFAULT_ACCESS_COOKIE = \"azlib_at\";\n\n/** Default HttpOnly cookie that holds the rotating refresh token. */\nexport const DEFAULT_REFRESH_COOKIE = \"azlib_rt\";\n\n/** Cookie attribute set shared by access and refresh cookies. */\nexport interface IdentityCookieAttributes {\n  /** Mark cookies as `HttpOnly`. Default: `true`. */\n  httpOnly?: boolean;\n  /**\n   * Mark cookies as `Secure`. Defaults to `true` when `NODE_ENV` is `\"production\"`,\n   * `false` otherwise.\n   */\n  secure?: boolean;\n  /** `SameSite` policy. Default: `\"lax\"`. */\n  sameSite?: \"strict\" | \"lax\" | \"none\";\n  /** Cookie path. Default: `\"/\"`. */\n  path?: string;\n  /** Cookie domain. Omit to use the current host. */\n  domain?: string;\n}\n\n/** Names and attributes for the access + refresh cookie pair. */\nexport interface IdentityCookieOptions extends IdentityCookieAttributes {\n  /** Access-token cookie name. Default: {@link DEFAULT_ACCESS_COOKIE}. */\n  accessCookie?: string;\n  /** Refresh-token cookie name. Default: {@link DEFAULT_REFRESH_COOKIE}. */\n  refreshCookie?: string;\n}\n\n/** Resolved cookie names. */\nexport interface IdentityCookieNames {\n  access: string;\n  refresh: string;\n}\n\n/**\n * A Next.js `cookies().get` / Request-cookies compatible reader.\n */\nexport interface CookieReader {\n  get(name: string): { value: string } | undefined;\n}\n\n/**\n * A Next.js `cookies().set` / `cookies().delete` compatible writer.\n * `maxAge` is in **seconds** (Web / Next.js convention, not Express milliseconds).\n */\nexport interface CookieWriter {\n  set(\n    name: string,\n    value: string,\n    options?: {\n      httpOnly?: boolean;\n      secure?: boolean;\n      sameSite?: \"strict\" | \"lax\" | \"none\";\n      path?: string;\n      domain?: string;\n      maxAge?: number;\n      expires?: Date;\n    },\n  ): unknown;\n  delete(name: string): unknown;\n}\n\nexport type CookieStore = CookieReader & CookieWriter;\n\n/** Anything {@link hasIdentityCookies} / {@link readCookieValue} can inspect. */\nexport type CookieSource =\n  | CookieReader\n  | Headers\n  | string\n  | null\n  | undefined;\n\nexport function resolveCookieNames(\n  options: IdentityCookieOptions = {},\n): IdentityCookieNames {\n  return {\n    access: options.accessCookie ?? DEFAULT_ACCESS_COOKIE,\n    refresh: options.refreshCookie ?? DEFAULT_REFRESH_COOKIE,\n  };\n}\n\nexport function resolveCookieAttributes(\n  options: IdentityCookieOptions = {},\n): Required<Pick<IdentityCookieAttributes, \"httpOnly\" | \"sameSite\" | \"path\">> &\n  IdentityCookieAttributes {\n  return {\n    httpOnly: options.httpOnly ?? true,\n    secure: options.secure ?? process.env.NODE_ENV === \"production\",\n    sameSite: options.sameSite ?? \"lax\",\n    path: options.path ?? \"/\",\n    domain: options.domain,\n  };\n}\n\n/**\n * Parses a raw `Cookie` header into a name → value map.\n * Values are `decodeURIComponent`'d when possible.\n */\nexport function parseCookieHeader(\n  header: string | null | undefined,\n): Map<string, string> {\n  const result = new Map<string, string>();\n  if (!header) return result;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    const key = part.slice(0, eq).trim();\n    if (!key) continue;\n    const raw = part.slice(eq + 1).trim();\n    if (result.has(key)) continue;\n    try {\n      result.set(key, decodeURIComponent(raw));\n    } catch {\n      result.set(key, raw);\n    }\n  }\n  return result;\n}\n\nfunction isCookieReader(source: CookieSource): source is CookieReader {\n  return (\n    typeof source === \"object\" &&\n    source !== null &&\n    \"get\" in source &&\n    typeof source.get === \"function\" &&\n    !(source instanceof Headers)\n  );\n}\n\n/** Reads a single cookie value from a header string, `Headers`, or cookie reader. */\nexport function readCookieValue(\n  source: CookieSource,\n  name: string,\n): string | undefined {\n  if (source == null) return undefined;\n  if (typeof source === \"string\") {\n    const value = parseCookieHeader(source).get(name);\n    return value && value.length > 0 ? value : undefined;\n  }\n  if (source instanceof Headers) {\n    return readCookieValue(source.get(\"cookie\"), name);\n  }\n  if (isCookieReader(source)) {\n    const value = source.get(name)?.value?.trim();\n    return value && value.length > 0 ? value : undefined;\n  }\n  return undefined;\n}\n\n/**\n * Returns true when the request carries an identity access and/or refresh cookie.\n * Intended for Edge/proxy gates: presence only — do not treat this as authentication.\n */\nexport function hasIdentityCookies(\n  source: CookieSource,\n  options: IdentityCookieOptions = {},\n): boolean {\n  const names = resolveCookieNames(options);\n  return (\n    readCookieValue(source, names.access) !== undefined ||\n    readCookieValue(source, names.refresh) !== undefined\n  );\n}\n"],"mappings":";;;;;;;;AAQA,MAAa,wBAAwB;;AAGrC,MAAa,yBAAyB;AAuEtC,SAAgB,mBACd,UAAiC,CAAC,GACb;CACrB,OAAO;EACL,QAAQ,QAAQ,gBAAA;EAChB,SAAS,QAAQ,iBAAA;CACnB;AACF;AAEA,SAAgB,wBACd,UAAiC,CAAC,GAET;CACzB,OAAO;EACL,UAAU,QAAQ,YAAY;EAC9B,QAAQ,QAAQ,UAAU,QAAQ,IAAI,aAAa;EACnD,UAAU,QAAQ,YAAY;EAC9B,MAAM,QAAQ,QAAQ;EACtB,QAAQ,QAAQ;CAClB;AACF;;;;;AAMA,SAAgB,kBACd,QACqB;CACrB,MAAM,yBAAS,IAAI,IAAoB;CACvC,IAAI,CAAC,QAAQ,OAAO;CACpB,KAAK,MAAM,QAAQ,OAAO,MAAM,GAAG,GAAG;EACpC,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,OAAO,IAAI;EACf,MAAM,MAAM,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK;EACnC,IAAI,CAAC,KAAK;EACV,MAAM,MAAM,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;EACpC,IAAI,OAAO,IAAI,GAAG,GAAG;EACrB,IAAI;GACF,OAAO,IAAI,KAAK,mBAAmB,GAAG,CAAC;EACzC,QAAQ;GACN,OAAO,IAAI,KAAK,GAAG;EACrB;CACF;CACA,OAAO;AACT;AAEA,SAAS,eAAe,QAA8C;CACpE,OACE,OAAO,WAAW,YAClB,WAAW,QACX,SAAS,UACT,OAAO,OAAO,QAAQ,cACtB,EAAE,kBAAkB;AAExB;;AAGA,SAAgB,gBACd,QACA,MACoB;CACpB,IAAI,UAAU,MAAM,OAAO,KAAA;CAC3B,IAAI,OAAO,WAAW,UAAU;EAC9B,MAAM,QAAQ,kBAAkB,MAAM,CAAC,CAAC,IAAI,IAAI;EAChD,OAAO,SAAS,MAAM,SAAS,IAAI,QAAQ,KAAA;CAC7C;CACA,IAAI,kBAAkB,SACpB,OAAO,gBAAgB,OAAO,IAAI,QAAQ,GAAG,IAAI;CAEnD,IAAI,eAAe,MAAM,GAAG;EAC1B,MAAM,QAAQ,OAAO,IAAI,IAAI,CAAC,EAAE,OAAO,KAAK;EAC5C,OAAO,SAAS,MAAM,SAAS,IAAI,QAAQ,KAAA;CAC7C;AAEF;;;;;AAMA,SAAgB,mBACd,QACA,UAAiC,CAAC,GACzB;CACT,MAAM,QAAQ,mBAAmB,OAAO;CACxC,OACE,gBAAgB,QAAQ,MAAM,MAAM,MAAM,KAAA,KAC1C,gBAAgB,QAAQ,MAAM,OAAO,MAAM,KAAA;AAE/C"}

package/dist/index.d.cts

@@ -1,5 +1,5 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.cjs";
 import { A as LockoutConfig, B as AuthorizationContext, D as IdentityConfig, E as DEFAULT_ISSUER, G as isAuthorized, H as AuthorizationRequirement, O as IdentityConfigInput, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens } from "./errors-0Zh7EG06.cjs";
 import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-CsYqHPvK.cjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.cjs";
 export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, createOAuthService, evaluateAuthorization, hasIdentityCookies, identitySchemaModel, isAuthorized, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, verifyAccessToken };

package/dist/index.d.mts

@@ -1,5 +1,5 @@
 import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignment, O as VerificationTokenType, S as Role, T as TotpSetupResult, _ as IdentityUserStatus, b as OAuthLinkedAccount, c as AuthResult, d as AuthenticatedIdentity, f as CredentialRecord, g as IdentityUser, h as IdentityEventType, l as AuthSession, m as IdentityEvent, n as CreateIdentityUserInput, p as DirectPermissionGrant, r as IdentityStore, s as AccessTokenClaims, t as CreateAuthSessionInput, u as AuthTokens, v as LoginResult, w as TotpSecret, x as Permission, y as MfaRequiredResult } from "./identity-store-BRRahxcS.mjs";
 import { A as LockoutConfig, B as AuthorizationContext, D as IdentityConfig, E as DEFAULT_ISSUER, G as isAuthorized, H as AuthorizationRequirement, O as IdentityConfigInput, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, y as OAuthTokens } from "./errors-DVDEUk9-.mjs";
 import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-LhSdoWEP.mjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.mjs";
 export { AccessTokenClaims, AccountUnavailableError, AuthResult, AuthSession, AuthTokens, AuthenticatedIdentity, AuthorizationContext, AuthorizationDecision, AuthorizationRequirement, BuildAuthUrlParams, type CookieReader, type CookieSource, type CookieStore, type CookieWriter, CreateAuthSessionInput, CreateIdentityUserInput, CredentialRecord, DEFAULT_ACCESS_COOKIE, DEFAULT_ISSUER, DEFAULT_REFRESH_COOKIE, DirectPermissionGrant, EmailAlreadyRegisteredError, ExchangeCodeParams, ForbiddenError, IdentityConfig, IdentityConfigError, IdentityConfigInput, type IdentityCookieAttributes, type IdentityCookieNames, type IdentityCookieOptions, IdentityError, IdentityEvent, IdentityEventType, IdentityOverrides, IdentityStore, IdentityUser, IdentityUserStatus, InvalidCredentialsError, InvalidTokenError, LockoutConfig, LoginResult, MfaRequiredResult, OAuthAuthorizationUrl, OAuthCallbackParams, OAuthLinkedAccount, OAuthProvider, OAuthProviderNotFoundError, OAuthService, OAuthServiceDeps, OAuthStateMismatchError, OAuthTokens, OAuthUserInfo, Permission, PolicyRule, Role, RolePermissionGrant, TotpSecret, TotpSetupResult, UnauthenticatedError, UserRoleAssignment, VerificationToken, VerificationTokenType, type VerifyAccessTokenOptions, createOAuthService, evaluateAuthorization, hasIdentityCookies, identitySchemaModel, isAuthorized, parseCookieHeader, readCookieValue, resolveCookieAttributes, resolveCookieNames, resolveIdentityConfig, verifyAccessToken };

package/dist/next.cjs

@@ -29,13 +29,8 @@ function applyAuthCookies(cookies, tokens, options = {}, now = /* @__PURE__ */ n
 /** Clears both identity cookies (logout or failed session). */
 function clearAuthCookies(cookies, options = {}) {
 	const names = require_cookie_header.resolveCookieNames(options);
-	const attrs = require_cookie_header.resolveCookieAttributes(options);
-	const deleteOpts = {
-		path: attrs.path,
-		domain: attrs.domain
-	};
-	cookies.delete(names.access, deleteOpts);
-	cookies.delete(names.refresh, deleteOpts);
+	cookies.delete(names.access);
+	cookies.delete(names.refresh);
 }
 /**
 * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
@@ -149,15 +144,15 @@ function recordingStore(header) {
 					options
 				});
 			},
-			delete(name, options) {
-				inner.delete(name, options);
+			delete(name) {
+				inner.delete(name);
 				deleted.push({
 					name,
 					value: "",
 					options: {
-						...options,
 						maxAge: 0,
-						expires: expired
+						expires: expired,
+						path: "/"
 					}
 				});
 			}

package/dist/next.d.cts

@@ -1,6 +1,6 @@
 import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.cjs";
 import { t as IdentityService } from "./identity-service-DE0Ffguz.cjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.cjs";
 //#region core/next/cookies.d.ts
 /**
  * Writes the access and refresh tokens as HttpOnly cookies.

package/dist/next.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"next.d.cts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}
+{"version":3,"file":"next.d.cts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAWK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCrFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}

package/dist/next.d.mts

@@ -1,6 +1,6 @@
 import { d as AuthenticatedIdentity, u as AuthTokens } from "./identity-store-BRRahxcS.mjs";
 import { t as IdentityService } from "./identity-service-JtsoA6lv.mjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.mjs";
 //#region core/next/cookies.d.ts
 /**
  * Writes the access and refresh tokens as HttpOnly cookies.

package/dist/next.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"next.d.mts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAaK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCvFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}
+{"version":3,"file":"next.d.mts","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"mappings":";;;;;;;;iBAqCgB,iBACd,SAAS,cACT,QAAQ,YACR,UAAS,uBACT,MAAK;;iBAgBS,iBACd,SAAS,cACT,UAAS;;;;;iBAWK,wBACd,UAAS,yBACR;;iBAuBa,sBACd,oCACC;;;;KCrFS,yBAAyB,KACnC;;;;;;;;;;;iBAcoB,YACpB,SAAS,wBACT,SAAS,aACT,UAAS,wBACR,QAAQ;;;UCrBM,+BAA+B;;;;;EAK9C;;;;;;;UAwHe;EACf,MAAM,SAAS,UAAU,QAAQ;EACjC,OAAO,SAAS,UAAU,QAAQ;EAClC,QAAQ,SAAS,UAAU,QAAQ;EACnC,GAAG,SAAS,UAAU,QAAQ;EAC9B,SAAS,SAAS,UAAU,QAAQ;;iBAGtB,uBACd,SAAS,iBACT,UAAS,yBACR"}

package/dist/next.mjs

@@ -28,13 +28,8 @@ function applyAuthCookies(cookies, tokens, options = {}, now = /* @__PURE__ */ n
 /** Clears both identity cookies (logout or failed session). */
 function clearAuthCookies(cookies, options = {}) {
 	const names = resolveCookieNames(options);
-	const attrs = resolveCookieAttributes(options);
-	const deleteOpts = {
-		path: attrs.path,
-		domain: attrs.domain
-	};
-	cookies.delete(names.access, deleteOpts);
-	cookies.delete(names.refresh, deleteOpts);
+	cookies.delete(names.access);
+	cookies.delete(names.refresh);
 }
 /**
 * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.
@@ -148,15 +143,15 @@ function recordingStore(header) {
 					options
 				});
 			},
-			delete(name, options) {
-				inner.delete(name, options);
+			delete(name) {
+				inner.delete(name);
 				deleted.push({
 					name,
 					value: "",
 					options: {
-						...options,
 						maxAge: 0,
-						expires: expired
+						expires: expired,
+						path: "/"
 					}
 				});
 			}

package/dist/next.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"next.mjs","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"sourcesContent":["import {\n  parseCookieHeader,\n  resolveCookieAttributes,\n  resolveCookieNames,\n  type CookieStore,\n  type CookieWriter,\n  type IdentityCookieOptions,\n} from \"../cookie-header\";\nimport type { AuthTokens } from \"../types\";\n\nexport type { CookieStore, CookieWriter };\n\nfunction maxAgeSeconds(expiresAt: Date, now: Date): number {\n  return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1000));\n}\n\nfunction writeAttributes(\n  options: IdentityCookieOptions,\n  expiresAt: Date,\n  now: Date,\n) {\n  const attrs = resolveCookieAttributes(options);\n  return {\n    httpOnly: attrs.httpOnly,\n    secure: attrs.secure,\n    sameSite: attrs.sameSite,\n    path: attrs.path,\n    domain: attrs.domain,\n    maxAge: maxAgeSeconds(expiresAt, now),\n    expires: expiresAt,\n  };\n}\n\n/**\n * Writes the access and refresh tokens as HttpOnly cookies.\n * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).\n */\nexport function applyAuthCookies(\n  cookies: CookieWriter,\n  tokens: AuthTokens,\n  options: IdentityCookieOptions = {},\n  now: Date = new Date(),\n): void {\n  const names = resolveCookieNames(options);\n  cookies.set(\n    names.access,\n    tokens.accessToken,\n    writeAttributes(options, tokens.accessTokenExpiresAt, now),\n  );\n  cookies.set(\n    names.refresh,\n    tokens.refreshToken,\n    writeAttributes(options, tokens.refreshTokenExpiresAt, now),\n  );\n}\n\n/** Clears both identity cookies (logout or failed session). */\nexport function clearAuthCookies(\n  cookies: CookieWriter,\n  options: IdentityCookieOptions = {},\n): void {\n  const names = resolveCookieNames(options);\n  const attrs = resolveCookieAttributes(options);\n  const deleteOpts = { path: attrs.path, domain: attrs.domain };\n  cookies.delete(names.access, deleteOpts);\n  cookies.delete(names.refresh, deleteOpts);\n}\n\n/**\n * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.\n * Not for production browser storage.\n */\nexport function createMemoryCookieStore(\n  initial: Record<string, string> = {},\n): CookieStore {\n  const values = new Map(\n    Object.entries(initial).filter(([, value]) => value.length > 0),\n  );\n  return {\n    get(name) {\n      const value = values.get(name);\n      return value === undefined ? undefined : { value };\n    },\n    set(name, value) {\n      if (value.length === 0) {\n        values.delete(name);\n        return;\n      }\n      values.set(name, value);\n    },\n    delete(name) {\n      values.delete(name);\n    },\n  };\n}\n\n/** Builds a cookie store seeded from an incoming `Cookie` header. */\nexport function cookieStoreFromHeader(\n  header: string | null | undefined,\n): CookieStore {\n  return createMemoryCookieStore(\n    Object.fromEntries(parseCookieHeader(header)),\n  );\n}\n","import { AccountUnavailableError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type CookieStore,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport { applyAuthCookies, clearAuthCookies } from \"./cookies\";\n\n/** Subset of {@link IdentityService} used to read and rotate a cookie session. */\nexport type IdentitySessionService = Pick<\n  IdentityService,\n  \"authenticate\" | \"refresh\"\n>;\n\n/**\n * Resolves the current principal from identity cookies.\n *\n * - Valid access cookie → `service.authenticate`.\n * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.\n * - Failure → clear cookies and return `null` (degrade to logged out).\n *\n * Call this where cookies can be written (Server Actions, Route Handlers). Refresh\n * rotates the refresh token; skipping the write would invalidate the browser session.\n */\nexport async function getIdentity(\n  service: IdentitySessionService,\n  cookies: CookieStore,\n  options: IdentityCookieOptions = {},\n): Promise<AuthenticatedIdentity | null> {\n  const names = resolveCookieNames(options);\n  const access = readCookieValue(cookies, names.access);\n  const refresh = readCookieValue(cookies, names.refresh);\n\n  if (access) {\n    try {\n      return await service.authenticate(access);\n    } catch (error) {\n      if (error instanceof AccountUnavailableError) {\n        clearAuthCookies(cookies, options);\n        return null;\n      }\n      if (!(error instanceof InvalidTokenError)) {\n        throw error;\n      }\n    }\n  }\n\n  if (!refresh) {\n    if (access) {\n      clearAuthCookies(cookies, options);\n    }\n    return null;\n  }\n\n  try {\n    const result = await service.refresh(refresh);\n    applyAuthCookies(cookies, result.tokens, options);\n    return result.user;\n  } catch (error) {\n    clearAuthCookies(cookies, options);\n    if (\n      error instanceof InvalidTokenError ||\n      error instanceof AccountUnavailableError\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n","import { IdentityError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport { applyAuthCookies, clearAuthCookies, cookieStoreFromHeader } from \"./cookies\";\nimport { getIdentity } from \"./session\";\n\nexport interface IdentityHandlerOptions extends IdentityCookieOptions {\n  /**\n   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.\n   * Default: `\"\"` (last path segment is the action: `login`, `logout`, …).\n   */\n  prefix?: string;\n}\n\nfunction json(\n  body: unknown,\n  status: number,\n  cookies?: { headers: string[] },\n): Response {\n  const headers = new Headers({ \"content-type\": \"application/json\" });\n  if (cookies) {\n    for (const header of cookies.headers) {\n      headers.append(\"set-cookie\", header);\n    }\n  }\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof IdentityError) {\n    return json({ code: error.code, message: error.message }, error.statusCode);\n  }\n  throw error;\n}\n\ntype RecordedCookie = {\n  name: string;\n  value: string;\n  options?: {\n    httpOnly?: boolean;\n    secure?: boolean;\n    sameSite?: \"strict\" | \"lax\" | \"none\";\n    path?: string;\n    domain?: string;\n    maxAge?: number;\n    expires?: Date;\n  };\n};\n\nfunction serializeSetCookie(cookie: RecordedCookie): string {\n  const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];\n  const opts = cookie.options ?? {};\n  if (opts.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);\n  }\n  if (opts.expires) {\n    parts.push(`Expires=${opts.expires.toUTCString()}`);\n  }\n  parts.push(`Path=${opts.path ?? \"/\"}`);\n  if (opts.domain) parts.push(`Domain=${opts.domain}`);\n  if (opts.httpOnly !== false) parts.push(\"HttpOnly\");\n  if (opts.secure) parts.push(\"Secure\");\n  const sameSite = opts.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nfunction recordingStore(header: string | null) {\n  const inner = cookieStoreFromHeader(header);\n  const writes: RecordedCookie[] = [];\n  const deleted: RecordedCookie[] = [];\n  const expired = new Date(0);\n\n  return {\n    store: {\n      get: inner.get.bind(inner),\n      set(name: string, value: string, options?: RecordedCookie[\"options\"]) {\n        inner.set(name, value, options);\n        writes.push({ name, value, options });\n      },\n      delete(name: string, options?: { path?: string; domain?: string }) {\n        inner.delete(name, options);\n        deleted.push({\n          name,\n          value: \"\",\n          options: { ...options, maxAge: 0, expires: expired },\n        });\n      },\n    },\n    headers(): string[] {\n      return [\n        ...writes.map(serializeSetCookie),\n        ...deleted.map(serializeSetCookie),\n      ];\n    },\n  };\n}\n\nasync function readJsonBody(\n  request: Request,\n): Promise<Record<string, unknown>> {\n  try {\n    const body: unknown = await request.json();\n    if (typeof body === \"object\" && body !== null && !Array.isArray(body)) {\n      return body as Record<string, unknown>;\n    }\n    return {};\n  } catch {\n    return {};\n  }\n}\n\nfunction actionFromUrl(url: string, prefix: string): string {\n  const pathname = new URL(url).pathname.replace(/\\/+$/, \"\");\n  const normalizedPrefix = prefix.replace(/^\\/+|\\/+$/g, \"\");\n  if (normalizedPrefix) {\n    const marker = `/${normalizedPrefix}/`;\n    const idx = pathname.lastIndexOf(marker);\n    if (idx >= 0) {\n      return pathname.slice(idx + marker.length);\n    }\n  }\n  const slash = pathname.lastIndexOf(\"/\");\n  return slash >= 0 ? pathname.slice(slash + 1) : pathname;\n}\n\n/**\n * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).\n *\n * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.\n */\nexport interface IdentityHandlers {\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  refresh(request: Request): Promise<Response>;\n  me(request: Request): Promise<Response>;\n  dispatch(request: Request): Promise<Response>;\n}\n\nexport function createIdentityHandlers(\n  service: IdentityService,\n  options: IdentityHandlerOptions = {},\n): IdentityHandlers {\n  const prefix = options.prefix ?? \"\";\n  const names = resolveCookieNames(options);\n\n  const login = async (request: Request): Promise<Response> => {\n    try {\n      const body = await readJsonBody(request);\n      const email = typeof body.email === \"string\" ? body.email : \"\";\n      const password = typeof body.password === \"string\" ? body.password : \"\";\n      const result = await service.login({ email, password });\n      if (\"kind\" in result) {\n        return json(result, 200);\n      }\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const logout = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const refresh = readCookieValue(recorded.store, names.refresh);\n      if (refresh) {\n        await service.logout(refresh);\n      }\n      clearAuthCookies(recorded.store, options);\n      return json({ ok: true }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const refresh = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const token = readCookieValue(recorded.store, names.refresh);\n      if (!token) {\n        throw new InvalidTokenError();\n      }\n      const result = await service.refresh(token);\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      clearAuthCookies(recorded.store, options);\n      if (error instanceof IdentityError) {\n        return json(\n          { code: error.code, message: error.message },\n          error.statusCode,\n          { headers: recorded.headers() },\n        );\n      }\n      throw error;\n    }\n  };\n\n  const me = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const identity = await getIdentity(service, recorded.store, options);\n      if (!identity) {\n        return json(\n          { code: \"identity/unauthenticated\", message: \"Authentication is required.\" },\n          401,\n          { headers: recorded.headers() },\n        );\n      }\n      return json({ user: identity }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const dispatch = async (request: Request): Promise<Response> => {\n    const action = actionFromUrl(request.url, prefix);\n    const method = request.method.toUpperCase();\n    if (method === \"POST\" && action === \"login\") return login(request);\n    if (method === \"POST\" && action === \"logout\") return logout(request);\n    if (method === \"POST\" && action === \"refresh\") return refresh(request);\n    if (method === \"GET\" && action === \"me\") return me(request);\n    return json({ code: \"identity/not-found\", message: \"Not found.\" }, 404);\n  };\n\n  return { login, logout, refresh, me, dispatch };\n}\n"],"mappings":";;;AAYA,SAAS,cAAc,WAAiB,KAAmB;CACzD,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,KAAK,GAAI,CAAC;AAC7E;AAEA,SAAS,gBACP,SACA,WACA,KACA;CACA,MAAM,QAAQ,wBAAwB,OAAO;CAC7C,OAAO;EACL,UAAU,MAAM;EAChB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,QAAQ,cAAc,WAAW,GAAG;EACpC,SAAS;CACX;AACF;;;;;AAMA,SAAgB,iBACd,SACA,QACA,UAAiC,CAAC,GAClC,sBAAY,IAAI,KAAK,GACf;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,QAAQ,IACN,MAAM,QACN,OAAO,aACP,gBAAgB,SAAS,OAAO,sBAAsB,GAAG,CAC3D;CACA,QAAQ,IACN,MAAM,SACN,OAAO,cACP,gBAAgB,SAAS,OAAO,uBAAuB,GAAG,CAC5D;AACF;;AAGA,SAAgB,iBACd,SACA,UAAiC,CAAC,GAC5B;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,MAAM,QAAQ,wBAAwB,OAAO;CAC7C,MAAM,aAAa;EAAE,MAAM,MAAM;EAAM,QAAQ,MAAM;CAAO;CAC5D,QAAQ,OAAO,MAAM,QAAQ,UAAU;CACvC,QAAQ,OAAO,MAAM,SAAS,UAAU;AAC1C;;;;;AAMA,SAAgB,wBACd,UAAkC,CAAC,GACtB;CACb,MAAM,SAAS,IAAI,IACjB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,MAAM,SAAS,CAAC,CAChE;CACA,OAAO;EACL,IAAI,MAAM;GACR,MAAM,QAAQ,OAAO,IAAI,IAAI;GAC7B,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM;EACnD;EACA,IAAI,MAAM,OAAO;GACf,IAAI,MAAM,WAAW,GAAG;IACtB,OAAO,OAAO,IAAI;IAClB;GACF;GACA,OAAO,IAAI,MAAM,KAAK;EACxB;EACA,OAAO,MAAM;GACX,OAAO,OAAO,IAAI;EACpB;CACF;AACF;;AAGA,SAAgB,sBACd,QACa;CACb,OAAO,wBACL,OAAO,YAAY,kBAAkB,MAAM,CAAC,CAC9C;AACF;;;;;;;;;;;;;AC5EA,eAAsB,YACpB,SACA,SACA,UAAiC,CAAC,GACK;CACvC,MAAM,QAAQ,mBAAmB,OAAO;CACxC,MAAM,SAAS,gBAAgB,SAAS,MAAM,MAAM;CACpD,MAAM,UAAU,gBAAgB,SAAS,MAAM,OAAO;CAEtD,IAAI,QACF,IAAI;EACF,OAAO,MAAM,QAAQ,aAAa,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiB,yBAAyB;GAC5C,iBAAiB,SAAS,OAAO;GACjC,OAAO;EACT;EACA,IAAI,EAAE,iBAAiB,oBACrB,MAAM;CAEV;CAGF,IAAI,CAAC,SAAS;EACZ,IAAI,QACF,iBAAiB,SAAS,OAAO;EAEnC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;EAC5C,iBAAiB,SAAS,OAAO,QAAQ,OAAO;EAChD,OAAO,OAAO;CAChB,SAAS,OAAO;EACd,iBAAiB,SAAS,OAAO;EACjC,IACE,iBAAiB,qBACjB,iBAAiB,yBAEjB,OAAO;EAET,MAAM;CACR;AACF;;;ACrDA,SAAS,KACP,MACA,QACA,SACU;CACV,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;CAClE,IAAI,SACF,KAAK,MAAM,UAAU,QAAQ,SAC3B,QAAQ,OAAO,cAAc,MAAM;CAGvC,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EAAE;EAAQ;CAAQ,CAAC;AAC/D;AAEA,SAAS,cAAc,OAA0B;CAC/C,IAAI,iBAAiB,eACnB,OAAO,KAAK;EAAE,MAAM,MAAM;EAAM,SAAS,MAAM;CAAQ,GAAG,MAAM,UAAU;CAE5E,MAAM;AACR;AAgBA,SAAS,mBAAmB,QAAgC;CAC1D,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,GAAG,mBAAmB,OAAO,KAAK,GAAG;CACnE,MAAM,OAAO,OAAO,WAAW,CAAC;CAChC,IAAI,KAAK,WAAW,KAAA,GAClB,MAAM,KAAK,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,MAAM,CAAC,GAAG;CAE9D,IAAI,KAAK,SACP,MAAM,KAAK,WAAW,KAAK,QAAQ,YAAY,GAAG;CAEpD,MAAM,KAAK,QAAQ,KAAK,QAAQ,KAAK;CACrC,IAAI,KAAK,QAAQ,MAAM,KAAK,UAAU,KAAK,QAAQ;CACnD,IAAI,KAAK,aAAa,OAAO,MAAM,KAAK,UAAU;CAClD,IAAI,KAAK,QAAQ,MAAM,KAAK,QAAQ;CACpC,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,KAAK,YAAY,SAAS,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,MAAM,CAAC,GAAG;CAC7E,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,eAAe,QAAuB;CAC7C,MAAM,QAAQ,sBAAsB,MAAM;CAC1C,MAAM,SAA2B,CAAC;CAClC,MAAM,UAA4B,CAAC;CACnC,MAAM,0BAAU,IAAI,KAAK,CAAC;CAE1B,OAAO;EACL,OAAO;GACL,KAAK,MAAM,IAAI,KAAK,KAAK;GACzB,IAAI,MAAc,OAAe,SAAqC;IACpE,MAAM,IAAI,MAAM,OAAO,OAAO;IAC9B,OAAO,KAAK;KAAE;KAAM;KAAO;IAAQ,CAAC;GACtC;GACA,OAAO,MAAc,SAA8C;IACjE,MAAM,OAAO,MAAM,OAAO;IAC1B,QAAQ,KAAK;KACX;KACA,OAAO;KACP,SAAS;MAAE,GAAG;MAAS,QAAQ;MAAG,SAAS;KAAQ;IACrD,CAAC;GACH;EACF;EACA,UAAoB;GAClB,OAAO,CACL,GAAG,OAAO,IAAI,kBAAkB,GAChC,GAAG,QAAQ,IAAI,kBAAkB,CACnC;EACF;CACF;AACF;AAEA,eAAe,aACb,SACkC;CAClC,IAAI;EACF,MAAM,OAAgB,MAAM,QAAQ,KAAK;EACzC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI,GAClE,OAAO;EAET,OAAO,CAAC;CACV,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,cAAc,KAAa,QAAwB;CAC1D,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE;CACzD,MAAM,mBAAmB,OAAO,QAAQ,cAAc,EAAE;CACxD,IAAI,kBAAkB;EACpB,MAAM,SAAS,IAAI,iBAAiB;EACpC,MAAM,MAAM,SAAS,YAAY,MAAM;EACvC,IAAI,OAAO,GACT,OAAO,SAAS,MAAM,MAAM,OAAO,MAAM;CAE7C;CACA,MAAM,QAAQ,SAAS,YAAY,GAAG;CACtC,OAAO,SAAS,IAAI,SAAS,MAAM,QAAQ,CAAC,IAAI;AAClD;AAeA,SAAgB,uBACd,SACA,UAAkC,CAAC,GACjB;CAClB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,QAAQ,mBAAmB,OAAO;CAExC,MAAM,QAAQ,OAAO,YAAwC;EAC3D,IAAI;GACF,MAAM,OAAO,MAAM,aAAa,OAAO;GACvC,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;GAC5D,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;GACrE,MAAM,SAAS,MAAM,QAAQ,MAAM;IAAE;IAAO;GAAS,CAAC;GACtD,IAAI,UAAU,QACZ,OAAO,KAAK,QAAQ,GAAG;GAEzB,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,SAAS,OAAO,YAAwC;EAC5D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,UAAU,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC7D,IAAI,SACF,MAAM,QAAQ,OAAO,OAAO;GAE9B,iBAAiB,SAAS,OAAO,OAAO;GACxC,OAAO,KAAK,EAAE,IAAI,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EAChE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,UAAU,OAAO,YAAwC;EAC7D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,QAAQ,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC3D,IAAI,CAAC,OACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK;GAC1C,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO;GACxC,IAAI,iBAAiB,eACnB,OAAO,KACL;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,GAC3C,MAAM,YACN,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,MAAM;EACR;CACF;CAEA,MAAM,KAAK,OAAO,YAAwC;EACxD,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS,OAAO,OAAO;GACnE,IAAI,CAAC,UACH,OAAO,KACL;IAAE,MAAM;IAA4B,SAAS;GAA8B,GAC3E,KACA,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,OAAO,KAAK,EAAE,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACtE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,WAAW,OAAO,YAAwC;EAC9D,MAAM,SAAS,cAAc,QAAQ,KAAK,MAAM;EAChD,MAAM,SAAS,QAAQ,OAAO,YAAY;EAC1C,IAAI,WAAW,UAAU,WAAW,SAAS,OAAO,MAAM,OAAO;EACjE,IAAI,WAAW,UAAU,WAAW,UAAU,OAAO,OAAO,OAAO;EACnE,IAAI,WAAW,UAAU,WAAW,WAAW,OAAO,QAAQ,OAAO;EACrE,IAAI,WAAW,SAAS,WAAW,MAAM,OAAO,GAAG,OAAO;EAC1D,OAAO,KAAK;GAAE,MAAM;GAAsB,SAAS;EAAa,GAAG,GAAG;CACxE;CAEA,OAAO;EAAE;EAAO;EAAQ;EAAS;EAAI;CAAS;AAChD"}
+{"version":3,"file":"next.mjs","names":[],"sources":["../core/next/cookies.ts","../core/next/session.ts","../core/next/handlers.ts"],"sourcesContent":["import {\n  parseCookieHeader,\n  resolveCookieAttributes,\n  resolveCookieNames,\n  type CookieStore,\n  type CookieWriter,\n  type IdentityCookieOptions,\n} from \"../cookie-header\";\nimport type { AuthTokens } from \"../types\";\n\nexport type { CookieStore, CookieWriter };\n\nfunction maxAgeSeconds(expiresAt: Date, now: Date): number {\n  return Math.max(0, Math.floor((expiresAt.getTime() - now.getTime()) / 1000));\n}\n\nfunction writeAttributes(\n  options: IdentityCookieOptions,\n  expiresAt: Date,\n  now: Date,\n) {\n  const attrs = resolveCookieAttributes(options);\n  return {\n    httpOnly: attrs.httpOnly,\n    secure: attrs.secure,\n    sameSite: attrs.sameSite,\n    path: attrs.path,\n    domain: attrs.domain,\n    maxAge: maxAgeSeconds(expiresAt, now),\n    expires: expiresAt,\n  };\n}\n\n/**\n * Writes the access and refresh tokens as HttpOnly cookies.\n * `maxAge` is in seconds (Next.js / `Set-Cookie` convention).\n */\nexport function applyAuthCookies(\n  cookies: CookieWriter,\n  tokens: AuthTokens,\n  options: IdentityCookieOptions = {},\n  now: Date = new Date(),\n): void {\n  const names = resolveCookieNames(options);\n  cookies.set(\n    names.access,\n    tokens.accessToken,\n    writeAttributes(options, tokens.accessTokenExpiresAt, now),\n  );\n  cookies.set(\n    names.refresh,\n    tokens.refreshToken,\n    writeAttributes(options, tokens.refreshTokenExpiresAt, now),\n  );\n}\n\n/** Clears both identity cookies (logout or failed session). */\nexport function clearAuthCookies(\n  cookies: CookieWriter,\n  options: IdentityCookieOptions = {},\n): void {\n  const names = resolveCookieNames(options);\n  cookies.delete(names.access);\n  cookies.delete(names.refresh);\n}\n\n/**\n * In-memory {@link CookieStore} for tests and Fetch-based Route Handlers.\n * Not for production browser storage.\n */\nexport function createMemoryCookieStore(\n  initial: Record<string, string> = {},\n): CookieStore {\n  const values = new Map(\n    Object.entries(initial).filter(([, value]) => value.length > 0),\n  );\n  return {\n    get(name) {\n      const value = values.get(name);\n      return value === undefined ? undefined : { value };\n    },\n    set(name, value) {\n      if (value.length === 0) {\n        values.delete(name);\n        return;\n      }\n      values.set(name, value);\n    },\n    delete(name) {\n      values.delete(name);\n    },\n  };\n}\n\n/** Builds a cookie store seeded from an incoming `Cookie` header. */\nexport function cookieStoreFromHeader(\n  header: string | null | undefined,\n): CookieStore {\n  return createMemoryCookieStore(\n    Object.fromEntries(parseCookieHeader(header)),\n  );\n}\n","import { AccountUnavailableError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type CookieStore,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport type { AuthenticatedIdentity } from \"../types\";\nimport { applyAuthCookies, clearAuthCookies } from \"./cookies\";\n\n/** Subset of {@link IdentityService} used to read and rotate a cookie session. */\nexport type IdentitySessionService = Pick<\n  IdentityService,\n  \"authenticate\" | \"refresh\"\n>;\n\n/**\n * Resolves the current principal from identity cookies.\n *\n * - Valid access cookie → `service.authenticate`.\n * - Expired/missing access + refresh cookie → `service.refresh` and rotate cookies.\n * - Failure → clear cookies and return `null` (degrade to logged out).\n *\n * Call this where cookies can be written (Server Actions, Route Handlers). Refresh\n * rotates the refresh token; skipping the write would invalidate the browser session.\n */\nexport async function getIdentity(\n  service: IdentitySessionService,\n  cookies: CookieStore,\n  options: IdentityCookieOptions = {},\n): Promise<AuthenticatedIdentity | null> {\n  const names = resolveCookieNames(options);\n  const access = readCookieValue(cookies, names.access);\n  const refresh = readCookieValue(cookies, names.refresh);\n\n  if (access) {\n    try {\n      return await service.authenticate(access);\n    } catch (error) {\n      if (error instanceof AccountUnavailableError) {\n        clearAuthCookies(cookies, options);\n        return null;\n      }\n      if (!(error instanceof InvalidTokenError)) {\n        throw error;\n      }\n    }\n  }\n\n  if (!refresh) {\n    if (access) {\n      clearAuthCookies(cookies, options);\n    }\n    return null;\n  }\n\n  try {\n    const result = await service.refresh(refresh);\n    applyAuthCookies(cookies, result.tokens, options);\n    return result.user;\n  } catch (error) {\n    clearAuthCookies(cookies, options);\n    if (\n      error instanceof InvalidTokenError ||\n      error instanceof AccountUnavailableError\n    ) {\n      return null;\n    }\n    throw error;\n  }\n}\n","import { IdentityError, InvalidTokenError } from \"../errors\";\nimport type { IdentityService } from \"../identity-service\";\nimport {\n  readCookieValue,\n  type IdentityCookieOptions,\n  resolveCookieNames,\n} from \"../cookie-header\";\nimport { applyAuthCookies, clearAuthCookies, cookieStoreFromHeader } from \"./cookies\";\nimport { getIdentity } from \"./session\";\n\nexport interface IdentityHandlerOptions extends IdentityCookieOptions {\n  /**\n   * Path prefix used by {@link createIdentityHandlers.dispatch} to match routes.\n   * Default: `\"\"` (last path segment is the action: `login`, `logout`, …).\n   */\n  prefix?: string;\n}\n\nfunction json(\n  body: unknown,\n  status: number,\n  cookies?: { headers: string[] },\n): Response {\n  const headers = new Headers({ \"content-type\": \"application/json\" });\n  if (cookies) {\n    for (const header of cookies.headers) {\n      headers.append(\"set-cookie\", header);\n    }\n  }\n  return new Response(JSON.stringify(body), { status, headers });\n}\n\nfunction errorResponse(error: unknown): Response {\n  if (error instanceof IdentityError) {\n    return json({ code: error.code, message: error.message }, error.statusCode);\n  }\n  throw error;\n}\n\ntype RecordedCookie = {\n  name: string;\n  value: string;\n  options?: {\n    httpOnly?: boolean;\n    secure?: boolean;\n    sameSite?: \"strict\" | \"lax\" | \"none\";\n    path?: string;\n    domain?: string;\n    maxAge?: number;\n    expires?: Date;\n  };\n};\n\nfunction serializeSetCookie(cookie: RecordedCookie): string {\n  const parts = [`${cookie.name}=${encodeURIComponent(cookie.value)}`];\n  const opts = cookie.options ?? {};\n  if (opts.maxAge !== undefined) {\n    parts.push(`Max-Age=${Math.max(0, Math.floor(opts.maxAge))}`);\n  }\n  if (opts.expires) {\n    parts.push(`Expires=${opts.expires.toUTCString()}`);\n  }\n  parts.push(`Path=${opts.path ?? \"/\"}`);\n  if (opts.domain) parts.push(`Domain=${opts.domain}`);\n  if (opts.httpOnly !== false) parts.push(\"HttpOnly\");\n  if (opts.secure) parts.push(\"Secure\");\n  const sameSite = opts.sameSite ?? \"lax\";\n  parts.push(`SameSite=${sameSite.charAt(0).toUpperCase()}${sameSite.slice(1)}`);\n  return parts.join(\"; \");\n}\n\nfunction recordingStore(header: string | null) {\n  const inner = cookieStoreFromHeader(header);\n  const writes: RecordedCookie[] = [];\n  const deleted: RecordedCookie[] = [];\n  const expired = new Date(0);\n\n  return {\n    store: {\n      get: inner.get.bind(inner),\n      set(name: string, value: string, options?: RecordedCookie[\"options\"]) {\n        inner.set(name, value, options);\n        writes.push({ name, value, options });\n      },\n      delete(name: string) {\n        inner.delete(name);\n        deleted.push({\n          name,\n          value: \"\",\n          options: { maxAge: 0, expires: expired, path: \"/\" },\n        });\n      },\n    },\n    headers(): string[] {\n      return [\n        ...writes.map(serializeSetCookie),\n        ...deleted.map(serializeSetCookie),\n      ];\n    },\n  };\n}\n\nasync function readJsonBody(\n  request: Request,\n): Promise<Record<string, unknown>> {\n  try {\n    const body: unknown = await request.json();\n    if (typeof body === \"object\" && body !== null && !Array.isArray(body)) {\n      return body as Record<string, unknown>;\n    }\n    return {};\n  } catch {\n    return {};\n  }\n}\n\nfunction actionFromUrl(url: string, prefix: string): string {\n  const pathname = new URL(url).pathname.replace(/\\/+$/, \"\");\n  const normalizedPrefix = prefix.replace(/^\\/+|\\/+$/g, \"\");\n  if (normalizedPrefix) {\n    const marker = `/${normalizedPrefix}/`;\n    const idx = pathname.lastIndexOf(marker);\n    if (idx >= 0) {\n      return pathname.slice(idx + marker.length);\n    }\n  }\n  const slash = pathname.lastIndexOf(\"/\");\n  return slash >= 0 ? pathname.slice(slash + 1) : pathname;\n}\n\n/**\n * Fetch API Route Handlers for cookie-based identity sessions (Next.js App Router).\n *\n * Mount individually or use {@link IdentityHandlers.dispatch} from a catch-all route.\n */\nexport interface IdentityHandlers {\n  login(request: Request): Promise<Response>;\n  logout(request: Request): Promise<Response>;\n  refresh(request: Request): Promise<Response>;\n  me(request: Request): Promise<Response>;\n  dispatch(request: Request): Promise<Response>;\n}\n\nexport function createIdentityHandlers(\n  service: IdentityService,\n  options: IdentityHandlerOptions = {},\n): IdentityHandlers {\n  const prefix = options.prefix ?? \"\";\n  const names = resolveCookieNames(options);\n\n  const login = async (request: Request): Promise<Response> => {\n    try {\n      const body = await readJsonBody(request);\n      const email = typeof body.email === \"string\" ? body.email : \"\";\n      const password = typeof body.password === \"string\" ? body.password : \"\";\n      const result = await service.login({ email, password });\n      if (\"kind\" in result) {\n        return json(result, 200);\n      }\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const logout = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const refresh = readCookieValue(recorded.store, names.refresh);\n      if (refresh) {\n        await service.logout(refresh);\n      }\n      clearAuthCookies(recorded.store, options);\n      return json({ ok: true }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const refresh = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const token = readCookieValue(recorded.store, names.refresh);\n      if (!token) {\n        throw new InvalidTokenError();\n      }\n      const result = await service.refresh(token);\n      applyAuthCookies(recorded.store, result.tokens, options);\n      return json({ user: result.user }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      clearAuthCookies(recorded.store, options);\n      if (error instanceof IdentityError) {\n        return json(\n          { code: error.code, message: error.message },\n          error.statusCode,\n          { headers: recorded.headers() },\n        );\n      }\n      throw error;\n    }\n  };\n\n  const me = async (request: Request): Promise<Response> => {\n    try {\n      const recorded = recordingStore(request.headers.get(\"cookie\"));\n      const identity = await getIdentity(service, recorded.store, options);\n      if (!identity) {\n        return json(\n          { code: \"identity/unauthenticated\", message: \"Authentication is required.\" },\n          401,\n          { headers: recorded.headers() },\n        );\n      }\n      return json({ user: identity }, 200, { headers: recorded.headers() });\n    } catch (error) {\n      return errorResponse(error);\n    }\n  };\n\n  const dispatch = async (request: Request): Promise<Response> => {\n    const action = actionFromUrl(request.url, prefix);\n    const method = request.method.toUpperCase();\n    if (method === \"POST\" && action === \"login\") return login(request);\n    if (method === \"POST\" && action === \"logout\") return logout(request);\n    if (method === \"POST\" && action === \"refresh\") return refresh(request);\n    if (method === \"GET\" && action === \"me\") return me(request);\n    return json({ code: \"identity/not-found\", message: \"Not found.\" }, 404);\n  };\n\n  return { login, logout, refresh, me, dispatch };\n}\n"],"mappings":";;;AAYA,SAAS,cAAc,WAAiB,KAAmB;CACzD,OAAO,KAAK,IAAI,GAAG,KAAK,OAAO,UAAU,QAAQ,IAAI,IAAI,QAAQ,KAAK,GAAI,CAAC;AAC7E;AAEA,SAAS,gBACP,SACA,WACA,KACA;CACA,MAAM,QAAQ,wBAAwB,OAAO;CAC7C,OAAO;EACL,UAAU,MAAM;EAChB,QAAQ,MAAM;EACd,UAAU,MAAM;EAChB,MAAM,MAAM;EACZ,QAAQ,MAAM;EACd,QAAQ,cAAc,WAAW,GAAG;EACpC,SAAS;CACX;AACF;;;;;AAMA,SAAgB,iBACd,SACA,QACA,UAAiC,CAAC,GAClC,sBAAY,IAAI,KAAK,GACf;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,QAAQ,IACN,MAAM,QACN,OAAO,aACP,gBAAgB,SAAS,OAAO,sBAAsB,GAAG,CAC3D;CACA,QAAQ,IACN,MAAM,SACN,OAAO,cACP,gBAAgB,SAAS,OAAO,uBAAuB,GAAG,CAC5D;AACF;;AAGA,SAAgB,iBACd,SACA,UAAiC,CAAC,GAC5B;CACN,MAAM,QAAQ,mBAAmB,OAAO;CACxC,QAAQ,OAAO,MAAM,MAAM;CAC3B,QAAQ,OAAO,MAAM,OAAO;AAC9B;;;;;AAMA,SAAgB,wBACd,UAAkC,CAAC,GACtB;CACb,MAAM,SAAS,IAAI,IACjB,OAAO,QAAQ,OAAO,CAAC,CAAC,QAAQ,GAAG,WAAW,MAAM,SAAS,CAAC,CAChE;CACA,OAAO;EACL,IAAI,MAAM;GACR,MAAM,QAAQ,OAAO,IAAI,IAAI;GAC7B,OAAO,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,MAAM;EACnD;EACA,IAAI,MAAM,OAAO;GACf,IAAI,MAAM,WAAW,GAAG;IACtB,OAAO,OAAO,IAAI;IAClB;GACF;GACA,OAAO,IAAI,MAAM,KAAK;EACxB;EACA,OAAO,MAAM;GACX,OAAO,OAAO,IAAI;EACpB;CACF;AACF;;AAGA,SAAgB,sBACd,QACa;CACb,OAAO,wBACL,OAAO,YAAY,kBAAkB,MAAM,CAAC,CAC9C;AACF;;;;;;;;;;;;;AC1EA,eAAsB,YACpB,SACA,SACA,UAAiC,CAAC,GACK;CACvC,MAAM,QAAQ,mBAAmB,OAAO;CACxC,MAAM,SAAS,gBAAgB,SAAS,MAAM,MAAM;CACpD,MAAM,UAAU,gBAAgB,SAAS,MAAM,OAAO;CAEtD,IAAI,QACF,IAAI;EACF,OAAO,MAAM,QAAQ,aAAa,MAAM;CAC1C,SAAS,OAAO;EACd,IAAI,iBAAiB,yBAAyB;GAC5C,iBAAiB,SAAS,OAAO;GACjC,OAAO;EACT;EACA,IAAI,EAAE,iBAAiB,oBACrB,MAAM;CAEV;CAGF,IAAI,CAAC,SAAS;EACZ,IAAI,QACF,iBAAiB,SAAS,OAAO;EAEnC,OAAO;CACT;CAEA,IAAI;EACF,MAAM,SAAS,MAAM,QAAQ,QAAQ,OAAO;EAC5C,iBAAiB,SAAS,OAAO,QAAQ,OAAO;EAChD,OAAO,OAAO;CAChB,SAAS,OAAO;EACd,iBAAiB,SAAS,OAAO;EACjC,IACE,iBAAiB,qBACjB,iBAAiB,yBAEjB,OAAO;EAET,MAAM;CACR;AACF;;;ACrDA,SAAS,KACP,MACA,QACA,SACU;CACV,MAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,mBAAmB,CAAC;CAClE,IAAI,SACF,KAAK,MAAM,UAAU,QAAQ,SAC3B,QAAQ,OAAO,cAAc,MAAM;CAGvC,OAAO,IAAI,SAAS,KAAK,UAAU,IAAI,GAAG;EAAE;EAAQ;CAAQ,CAAC;AAC/D;AAEA,SAAS,cAAc,OAA0B;CAC/C,IAAI,iBAAiB,eACnB,OAAO,KAAK;EAAE,MAAM,MAAM;EAAM,SAAS,MAAM;CAAQ,GAAG,MAAM,UAAU;CAE5E,MAAM;AACR;AAgBA,SAAS,mBAAmB,QAAgC;CAC1D,MAAM,QAAQ,CAAC,GAAG,OAAO,KAAK,GAAG,mBAAmB,OAAO,KAAK,GAAG;CACnE,MAAM,OAAO,OAAO,WAAW,CAAC;CAChC,IAAI,KAAK,WAAW,KAAA,GAClB,MAAM,KAAK,WAAW,KAAK,IAAI,GAAG,KAAK,MAAM,KAAK,MAAM,CAAC,GAAG;CAE9D,IAAI,KAAK,SACP,MAAM,KAAK,WAAW,KAAK,QAAQ,YAAY,GAAG;CAEpD,MAAM,KAAK,QAAQ,KAAK,QAAQ,KAAK;CACrC,IAAI,KAAK,QAAQ,MAAM,KAAK,UAAU,KAAK,QAAQ;CACnD,IAAI,KAAK,aAAa,OAAO,MAAM,KAAK,UAAU;CAClD,IAAI,KAAK,QAAQ,MAAM,KAAK,QAAQ;CACpC,MAAM,WAAW,KAAK,YAAY;CAClC,MAAM,KAAK,YAAY,SAAS,OAAO,CAAC,CAAC,CAAC,YAAY,IAAI,SAAS,MAAM,CAAC,GAAG;CAC7E,OAAO,MAAM,KAAK,IAAI;AACxB;AAEA,SAAS,eAAe,QAAuB;CAC7C,MAAM,QAAQ,sBAAsB,MAAM;CAC1C,MAAM,SAA2B,CAAC;CAClC,MAAM,UAA4B,CAAC;CACnC,MAAM,0BAAU,IAAI,KAAK,CAAC;CAE1B,OAAO;EACL,OAAO;GACL,KAAK,MAAM,IAAI,KAAK,KAAK;GACzB,IAAI,MAAc,OAAe,SAAqC;IACpE,MAAM,IAAI,MAAM,OAAO,OAAO;IAC9B,OAAO,KAAK;KAAE;KAAM;KAAO;IAAQ,CAAC;GACtC;GACA,OAAO,MAAc;IACnB,MAAM,OAAO,IAAI;IACjB,QAAQ,KAAK;KACX;KACA,OAAO;KACP,SAAS;MAAE,QAAQ;MAAG,SAAS;MAAS,MAAM;KAAI;IACpD,CAAC;GACH;EACF;EACA,UAAoB;GAClB,OAAO,CACL,GAAG,OAAO,IAAI,kBAAkB,GAChC,GAAG,QAAQ,IAAI,kBAAkB,CACnC;EACF;CACF;AACF;AAEA,eAAe,aACb,SACkC;CAClC,IAAI;EACF,MAAM,OAAgB,MAAM,QAAQ,KAAK;EACzC,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,CAAC,MAAM,QAAQ,IAAI,GAClE,OAAO;EAET,OAAO,CAAC;CACV,QAAQ;EACN,OAAO,CAAC;CACV;AACF;AAEA,SAAS,cAAc,KAAa,QAAwB;CAC1D,MAAM,WAAW,IAAI,IAAI,GAAG,CAAC,CAAC,SAAS,QAAQ,QAAQ,EAAE;CACzD,MAAM,mBAAmB,OAAO,QAAQ,cAAc,EAAE;CACxD,IAAI,kBAAkB;EACpB,MAAM,SAAS,IAAI,iBAAiB;EACpC,MAAM,MAAM,SAAS,YAAY,MAAM;EACvC,IAAI,OAAO,GACT,OAAO,SAAS,MAAM,MAAM,OAAO,MAAM;CAE7C;CACA,MAAM,QAAQ,SAAS,YAAY,GAAG;CACtC,OAAO,SAAS,IAAI,SAAS,MAAM,QAAQ,CAAC,IAAI;AAClD;AAeA,SAAgB,uBACd,SACA,UAAkC,CAAC,GACjB;CAClB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,QAAQ,mBAAmB,OAAO;CAExC,MAAM,QAAQ,OAAO,YAAwC;EAC3D,IAAI;GACF,MAAM,OAAO,MAAM,aAAa,OAAO;GACvC,MAAM,QAAQ,OAAO,KAAK,UAAU,WAAW,KAAK,QAAQ;GAC5D,MAAM,WAAW,OAAO,KAAK,aAAa,WAAW,KAAK,WAAW;GACrE,MAAM,SAAS,MAAM,QAAQ,MAAM;IAAE;IAAO;GAAS,CAAC;GACtD,IAAI,UAAU,QACZ,OAAO,KAAK,QAAQ,GAAG;GAEzB,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,SAAS,OAAO,YAAwC;EAC5D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,UAAU,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC7D,IAAI,SACF,MAAM,QAAQ,OAAO,OAAO;GAE9B,iBAAiB,SAAS,OAAO,OAAO;GACxC,OAAO,KAAK,EAAE,IAAI,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EAChE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,UAAU,OAAO,YAAwC;EAC7D,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,QAAQ,gBAAgB,SAAS,OAAO,MAAM,OAAO;GAC3D,IAAI,CAAC,OACH,MAAM,IAAI,kBAAkB;GAE9B,MAAM,SAAS,MAAM,QAAQ,QAAQ,KAAK;GAC1C,iBAAiB,SAAS,OAAO,OAAO,QAAQ,OAAO;GACvD,OAAO,KAAK,EAAE,MAAM,OAAO,KAAK,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACzE,SAAS,OAAO;GACd,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,iBAAiB,SAAS,OAAO,OAAO;GACxC,IAAI,iBAAiB,eACnB,OAAO,KACL;IAAE,MAAM,MAAM;IAAM,SAAS,MAAM;GAAQ,GAC3C,MAAM,YACN,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,MAAM;EACR;CACF;CAEA,MAAM,KAAK,OAAO,YAAwC;EACxD,IAAI;GACF,MAAM,WAAW,eAAe,QAAQ,QAAQ,IAAI,QAAQ,CAAC;GAC7D,MAAM,WAAW,MAAM,YAAY,SAAS,SAAS,OAAO,OAAO;GACnE,IAAI,CAAC,UACH,OAAO,KACL;IAAE,MAAM;IAA4B,SAAS;GAA8B,GAC3E,KACA,EAAE,SAAS,SAAS,QAAQ,EAAE,CAChC;GAEF,OAAO,KAAK,EAAE,MAAM,SAAS,GAAG,KAAK,EAAE,SAAS,SAAS,QAAQ,EAAE,CAAC;EACtE,SAAS,OAAO;GACd,OAAO,cAAc,KAAK;EAC5B;CACF;CAEA,MAAM,WAAW,OAAO,YAAwC;EAC9D,MAAM,SAAS,cAAc,QAAQ,KAAK,MAAM;EAChD,MAAM,SAAS,QAAQ,OAAO,YAAY;EAC1C,IAAI,WAAW,UAAU,WAAW,SAAS,OAAO,MAAM,OAAO;EACjE,IAAI,WAAW,UAAU,WAAW,UAAU,OAAO,OAAO,OAAO;EACnE,IAAI,WAAW,UAAU,WAAW,WAAW,OAAO,QAAQ,OAAO;EACrE,IAAI,WAAW,SAAS,WAAW,MAAM,OAAO,GAAG,OAAO;EAC1D,OAAO,KAAK;GAAE,MAAM;GAAsB,SAAS;EAAa,GAAG,GAAG;CACxE;CAEA,OAAO;EAAE;EAAO;EAAQ;EAAS;EAAI;CAAS;AAChD"}

package/dist/node.d.cts

@@ -2,7 +2,7 @@ import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignme
 import { A as LockoutConfig, B as AuthorizationContext, C as createTokenService, D as IdentityConfig, E as DEFAULT_ISSUER, F as TwoFactorSmsParams, G as isAuthorized, H as AuthorizationRequirement, I as IdentityLogger, L as consoleLogger, M as EmailVerificationParams, N as NotificationService, O as IdentityConfigInput, P as PasswordResetParams, R as noopLogger, S as TokenService, T as createAuditLogger, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as resolveLogger } from "./errors-0Zh7EG06.cjs";
 import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-DE0Ffguz.cjs";
 import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-CsYqHPvK.cjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.cjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.cjs";
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}

package/dist/node.d.mts

@@ -2,7 +2,7 @@ import { C as RolePermissionGrant, D as VerificationToken, E as UserRoleAssignme
 import { A as LockoutConfig, B as AuthorizationContext, C as createTokenService, D as IdentityConfig, E as DEFAULT_ISSUER, F as TwoFactorSmsParams, G as isAuthorized, H as AuthorizationRequirement, I as IdentityLogger, L as consoleLogger, M as EmailVerificationParams, N as NotificationService, O as IdentityConfigInput, P as PasswordResetParams, R as noopLogger, S as TokenService, T as createAuditLogger, U as PolicyRule, V as AuthorizationDecision, W as evaluateAuthorization, _ as ExchangeCodeParams, a as IdentityError, b as OAuthUserInfo, c as UnauthenticatedError, d as OAuthProviderNotFoundError, f as OAuthService, g as BuildAuthUrlParams, h as createOAuthService, i as IdentityConfigError, j as resolveIdentityConfig, k as IdentityOverrides, l as OAuthAuthorizationUrl, m as OAuthStateMismatchError, n as EmailAlreadyRegisteredError, o as InvalidCredentialsError, p as OAuthServiceDeps, r as ForbiddenError, s as InvalidTokenError, t as AccountUnavailableError, u as OAuthCallbackParams, v as OAuthProvider, w as AuditLogger, x as SessionDeps, y as OAuthTokens, z as resolveLogger } from "./errors-DVDEUk9-.mjs";
 import { a as RegisterInput, c as registerUser, d as loginUser, f as PasswordHasher, i as RegisterDeps, l as LoginDeps, n as IdentityServiceConfig, o as RegistrationValidationError, p as createPasswordHasher, r as createIdentityService, s as normalizeEmail, t as IdentityService, u as LoginInput } from "./identity-service-JtsoA6lv.mjs";
 import { n as VerifyAccessTokenOptions, r as verifyAccessToken, t as identitySchemaModel } from "./index-LhSdoWEP.mjs";
-import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-LFWHKQ04.mjs";
+import { a as DEFAULT_ACCESS_COOKIE, c as IdentityCookieNames, d as parseCookieHeader, f as readCookieValue, i as CookieWriter, l as IdentityCookieOptions, m as resolveCookieNames, n as CookieSource, o as DEFAULT_REFRESH_COOKIE, p as resolveCookieAttributes, r as CookieStore, s as IdentityCookieAttributes, t as CookieReader, u as hasIdentityCookies } from "./cookie-header-DdTShpuc.mjs";
 //#region core/lockout.d.ts
 /**
  * Checks whether the user account is currently locked. Throws {@link AccountUnavailableError}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@azlib/identity",
-  "version": "0.3.0",
+  "version": "0.3.1",
   "type": "module",
   "license": "MIT",
   "repository": {

package/dist/cookie-header-LFWHKQ04.d.cts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-header-LFWHKQ04.d.cts","names":[],"sources":["../core/cookie-header.ts"],"mappings":";;;;;;;;cAQa;;cAGA;;UAGI;;EAEf;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;UAIe,8BAA8B;;EAE7C;;EAEA;;;UAIe;EACf;EACA;;;;;UAMe;EACf,IAAI;IAAiB;;;;;;;UAON;EACf,IACE,cACA,eACA;IACE;IACA;IACA;IACA;IACA;IACA;IACA,UAAU;;EAGd,OAAO,cAAc;IAAY;IAAe;;;KAGtC,cAAc,eAAe;;KAG7B,eACR,eACA;iBAKY,mBACd,UAAS,wBACR;iBAOa,wBACd,UAAS,wBACR,SAAS,KAAK,+DACf;;;;;iBAcc,kBACd,oCACC;;iBA8Ba,gBACd,QAAQ,cACR;;;;;iBAqBc,mBACd,QAAQ,cACR,UAAS"}

package/dist/cookie-header-LFWHKQ04.d.mts.map

@@ -1 +0,0 @@
-{"version":3,"file":"cookie-header-LFWHKQ04.d.mts","names":[],"sources":["../core/cookie-header.ts"],"mappings":";;;;;;;;cAQa;;cAGA;;UAGI;;EAEf;;;;;EAKA;;EAEA;;EAEA;;EAEA;;;UAIe,8BAA8B;;EAE7C;;EAEA;;;UAIe;EACf;EACA;;;;;UAMe;EACf,IAAI;IAAiB;;;;;;;UAON;EACf,IACE,cACA,eACA;IACE;IACA;IACA;IACA;IACA;IACA;IACA,UAAU;;EAGd,OAAO,cAAc;IAAY;IAAe;;;KAGtC,cAAc,eAAe;;KAG7B,eACR,eACA;iBAKY,mBACd,UAAS,wBACR;iBAOa,wBACd,UAAS,wBACR,SAAS,KAAK,+DACf;;;;;iBAcc,kBACd,oCACC;;iBA8Ba,gBACd,QAAQ,cACR;;;;;iBAqBc,mBACd,QAAQ,cACR,UAAS"}