@bigso/auth-sdk 0.5.6 → 0.5.8

package/dist/browser/index.d.cts

@@ -1,4 +1,4 @@
-import { B as BigsoAuthOptions, a as BigsoAuthResult } from '../types-B51l8wWh.cjs';
+import { B as BigsoAuthOptions, a as BigsoAuthResult } from '../types-sI7dMCGy.cjs';
 
 declare class EventEmitter {
     private events;

package/dist/browser/index.d.ts

@@ -1,4 +1,4 @@
-import { B as BigsoAuthOptions, a as BigsoAuthResult } from '../types-B51l8wWh.js';
+import { B as BigsoAuthOptions, a as BigsoAuthResult } from '../types-sI7dMCGy.js';
 
 declare class EventEmitter {
     private events;

package/dist/browser/index.js

@@ -1,6 +1,6 @@
 import {
   verifySignedPayload
-} from "../chunk-PB3GVAEJ.js";
+} from "../chunk-BXRGCGYR.js";
 
 // src/utils/crypto.ts
 async function sha256Base64Url(input) {

package/dist/chunk-BXRGCGYR.js

@@ -0,0 +1,34 @@
+// src/utils/jws.ts
+import { createRemoteJWKSet, jwtVerify } from "jose";
+async function verifySignedPayload(token, jwksUrl, expectedAudience) {
+  const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+  const { payload } = await jwtVerify(token, JWKS, {
+    audience: expectedAudience
+  });
+  return payload;
+}
+async function verifyAccessToken(accessToken, jwksUrl) {
+  const JWKS = createRemoteJWKSet(new URL(jwksUrl));
+  const { payload } = await jwtVerify(accessToken, JWKS);
+  if (!payload.sub || !payload.jti) {
+    throw new Error("Invalid token structure: missing sub or jti");
+  }
+  return {
+    sub: payload.sub,
+    jti: payload.jti,
+    iss: payload.iss,
+    aud: payload.aud || "",
+    exp: payload.exp,
+    iat: payload.iat,
+    tenants: payload.tenants || [],
+    tenantId: payload.tenantId || "",
+    systemRole: payload.systemRole || "user",
+    scope: payload.scope,
+    deviceFingerprint: payload.deviceFingerprint
+  };
+}
+
+export {
+  verifySignedPayload,
+  verifyAccessToken
+};

package/dist/express/index.cjs

@@ -42,15 +42,6 @@ function ssoAuthMiddleware(options) {
         res.status(401).json({ error: "Invalid or expired access token" });
         return;
       }
-      const selectedTenantId = payload.tenantId;
-      const tenantInfo = payload.tenants.find((t) => t.id === selectedTenantId);
-      req.user = {
-        userId: payload.sub,
-        email: "",
-        firstName: "",
-        lastName: ""
-      };
-      req.tenant = tenantInfo;
       req.tokenPayload = payload;
       next();
     } catch (error) {
@@ -97,30 +88,38 @@ function ssoSyncGuardMiddleware(options) {
 
 // src/express/routes/createSsoAuthRouter.ts
 var import_express = require("express");
+function validateRequiredEnvs() {
+  const requiredEnvs = ["COOKIE_DOMAIN", "COOKIE_SAMESITE"];
+  const missingEnvs = requiredEnvs.filter((env) => !process.env[env]);
+  if (missingEnvs.length > 0) {
+    throw new Error(`Missing required environment variables: ${missingEnvs.join(", ")}`);
+  }
+}
+function extractCookieValueFromMap(cookieMapStr, key) {
+  if (!cookieMapStr) return null;
+  try {
+    const cookieMap = JSON.parse(cookieMapStr);
+    const entry = cookieMap.find((item) => item.startsWith(`${key}:`));
+    return entry ? entry.split(":")[1] : null;
+  } catch (error) {
+    console.warn("[BigsoAuthSDK] Failed to parse cookie name map:", error);
+    return null;
+  }
+}
+function extractCookieNameFromMap(cookieMapStr, key) {
+  if (!cookieMapStr) return null;
+  try {
+    const cookieMap = JSON.parse(cookieMapStr);
+    const entry = cookieMap.find((item) => item.startsWith(`${key}:`));
+    return entry ? entry.split(":")[0] : null;
+  } catch (error) {
+    console.warn("[BigsoAuthSDK] Failed to parse cookie name map:", error);
+    return null;
+  }
+}
 function createSsoAuthRouter(options) {
+  validateRequiredEnvs();
   const router = (0, import_express.Router)();
-  router.post("/exchange", async (req, res) => {
-    try {
-      const { code, codeVerifier } = req.body;
-      if (!code || !codeVerifier) {
-        res.status(400).json({ error: "code and codeVerifier are required" });
-        return;
-      }
-      const ssoResponse = await options.ssoClient.exchangeCode(code, codeVerifier);
-      if (options.onLoginSuccess) {
-        await options.onLoginSuccess(ssoResponse);
-      }
-      res.json({
-        success: true,
-        tokens: ssoResponse.tokens,
-        user: ssoResponse.user,
-        tenant: ssoResponse.tenant
-      });
-    } catch (error) {
-      console.error("[BigsoAuthSDK] Error exchanging code:", error.message);
-      res.status(401).json({ error: error.message || "Failed to exchange authorization code" });
-    }
-  });
   router.post("/exchange-v2", async (req, res) => {
     try {
       const { payload, codeVerifier: codeVerifierFromBody } = req.body;
@@ -146,33 +145,55 @@ function createSsoAuthRouter(options) {
         success: true,
         tokens: ssoResponse.tokens,
         user: ssoResponse.user,
-        tenant: ssoResponse.tenant
+        currentTenant: ssoResponse.currentTenant,
+        relatedTenants: ssoResponse.relatedTenants
       });
     } catch (error) {
       console.error("[BigsoAuthSDK] Error exchanging v2 payload:", error.message);
       res.status(401).json({ error: error.message || "Failed to verify signed payload" });
     }
   });
-  router.get("/session", ssoAuthMiddleware({ ssoClient: options.ssoClient }), (req, res) => {
+  router.post("/session", ssoAuthMiddleware({ ssoClient: options.ssoClient }), async (req, res) => {
     res.set("Cache-Control", "no-store, no-cache, must-revalidate, private");
     res.set("Pragma", "no-cache");
     res.set("Expires", "0");
+    const sessionId = extractCookieValueFromMap(req.cookies?.["bs_cookie_name_map"], "sessionId");
+    const ssoSession = await options.ssoClient.session(req.headers.authorization?.substring(7), sessionId, req.tokenPayload?.appId);
     res.json({
       success: true,
-      user: req.user,
-      tenant: req.tenant,
+      ...ssoSession,
       tokenPayload: req.tokenPayload
     });
   });
   router.post("/refresh", async (req, res) => {
+    const refreshTokenCookieName = extractCookieNameFromMap(req.cookies?.["bs_cookie_name_map"], "refreshToken");
     try {
-      const ssoResponse = await options.ssoClient.refreshTokens();
+      const refreshToken = extractCookieValueFromMap(req.cookies?.["bs_cookie_name_map"], "refreshToken");
+      const ssoResponse = await options.ssoClient.refreshTokens(refreshToken);
+      if (ssoResponse.tokens?.refreshToken) {
+        res.cookie(refreshTokenCookieName, ssoResponse.tokens.refreshToken, {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === "production",
+          sameSite: process.env.COOKIE_SAMESITE,
+          path: "/api/auth/refresh",
+          maxAge: 7 * 24 * 60 * 60 * 1e3,
+          domain: process.env.COOKIE_DOMAIN
+        });
+      } else {
+        console.warn("[BigsoAuthSDK] No refresh token received in refresh response, not setting cookie");
+      }
       res.json({
         success: true,
         tokens: ssoResponse.tokens
       });
     } catch (error) {
       console.error("[BigsoAuthSDK] Error refreshing tokens:", error.message);
+      if (error.message?.includes("revoked") || error.message?.includes("expired") || error.message?.includes("Invalid")) {
+        res.clearCookie(refreshTokenCookieName, {
+          path: "/api/auth/refresh",
+          domain: process.env.COOKIE_DOMAIN
+        });
+      }
       res.status(401).json({ error: error.message || "Failed to refresh tokens" });
     }
   });
@@ -184,9 +205,17 @@ function createSsoAuthRouter(options) {
       if (options.onLogout) {
         await options.onLogout(accessToken);
       }
+      res.clearCookie(process.env.REFRESH_COOKIE_NAME, {
+        path: "/api/auth/refresh",
+        domain: process.env.COOKIE_DOMAIN
+      });
       res.json({ success: true, message: "Logged out" });
     } catch (error) {
       console.warn("[BigsoAuthSDK] Failed to logout in SSO Backend.", error.message);
+      res.clearCookie(process.env.REFRESH_COOKIE_NAME, {
+        path: "/api/auth/refresh",
+        domain: process.env.COOKIE_DOMAIN
+      });
       res.json({ success: true, message: "Logged out (backend revocation failed)" });
     }
   });

package/dist/express/index.d.cts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction, Router } from 'express';
 import { BigsoSsoClient } from '../node/index.cjs';
-import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-B51l8wWh.cjs';
+import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-sI7dMCGy.cjs';
 
 interface SsoAuthMiddlewareOptions {
     ssoClient: BigsoSsoClient;

package/dist/express/index.d.ts

@@ -1,6 +1,6 @@
 import { Request, Response, NextFunction, Router } from 'express';
 import { BigsoSsoClient } from '../node/index.js';
-import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-B51l8wWh.js';
+import { S as SsoJwtTenant, b as SsoTokenPayload, V as V2ExchangeResponse } from '../types-sI7dMCGy.js';
 
 interface SsoAuthMiddlewareOptions {
     ssoClient: BigsoSsoClient;

package/dist/express/index.js

@@ -13,15 +13,6 @@ function ssoAuthMiddleware(options) {
         res.status(401).json({ error: "Invalid or expired access token" });
         return;
       }
-      const selectedTenantId = payload.tenantId;
-      const tenantInfo = payload.tenants.find((t) => t.id === selectedTenantId);
-      req.user = {
-        userId: payload.sub,
-        email: "",
-        firstName: "",
-        lastName: ""
-      };
-      req.tenant = tenantInfo;
       req.tokenPayload = payload;
       next();
     } catch (error) {
@@ -68,30 +59,38 @@ function ssoSyncGuardMiddleware(options) {
 
 // src/express/routes/createSsoAuthRouter.ts
 import { Router } from "express";
+function validateRequiredEnvs() {
+  const requiredEnvs = ["COOKIE_DOMAIN", "COOKIE_SAMESITE"];
+  const missingEnvs = requiredEnvs.filter((env) => !process.env[env]);
+  if (missingEnvs.length > 0) {
+    throw new Error(`Missing required environment variables: ${missingEnvs.join(", ")}`);
+  }
+}
+function extractCookieValueFromMap(cookieMapStr, key) {
+  if (!cookieMapStr) return null;
+  try {
+    const cookieMap = JSON.parse(cookieMapStr);
+    const entry = cookieMap.find((item) => item.startsWith(`${key}:`));
+    return entry ? entry.split(":")[1] : null;
+  } catch (error) {
+    console.warn("[BigsoAuthSDK] Failed to parse cookie name map:", error);
+    return null;
+  }
+}
+function extractCookieNameFromMap(cookieMapStr, key) {
+  if (!cookieMapStr) return null;
+  try {
+    const cookieMap = JSON.parse(cookieMapStr);
+    const entry = cookieMap.find((item) => item.startsWith(`${key}:`));
+    return entry ? entry.split(":")[0] : null;
+  } catch (error) {
+    console.warn("[BigsoAuthSDK] Failed to parse cookie name map:", error);
+    return null;
+  }
+}
 function createSsoAuthRouter(options) {
+  validateRequiredEnvs();
   const router = Router();
-  router.post("/exchange", async (req, res) => {
-    try {
-      const { code, codeVerifier } = req.body;
-      if (!code || !codeVerifier) {
-        res.status(400).json({ error: "code and codeVerifier are required" });
-        return;
-      }
-      const ssoResponse = await options.ssoClient.exchangeCode(code, codeVerifier);
-      if (options.onLoginSuccess) {
-        await options.onLoginSuccess(ssoResponse);
-      }
-      res.json({
-        success: true,
-        tokens: ssoResponse.tokens,
-        user: ssoResponse.user,
-        tenant: ssoResponse.tenant
-      });
-    } catch (error) {
-      console.error("[BigsoAuthSDK] Error exchanging code:", error.message);
-      res.status(401).json({ error: error.message || "Failed to exchange authorization code" });
-    }
-  });
   router.post("/exchange-v2", async (req, res) => {
     try {
       const { payload, codeVerifier: codeVerifierFromBody } = req.body;
@@ -117,33 +116,55 @@ function createSsoAuthRouter(options) {
         success: true,
         tokens: ssoResponse.tokens,
         user: ssoResponse.user,
-        tenant: ssoResponse.tenant
+        currentTenant: ssoResponse.currentTenant,
+        relatedTenants: ssoResponse.relatedTenants
       });
     } catch (error) {
       console.error("[BigsoAuthSDK] Error exchanging v2 payload:", error.message);
       res.status(401).json({ error: error.message || "Failed to verify signed payload" });
     }
   });
-  router.get("/session", ssoAuthMiddleware({ ssoClient: options.ssoClient }), (req, res) => {
+  router.post("/session", ssoAuthMiddleware({ ssoClient: options.ssoClient }), async (req, res) => {
     res.set("Cache-Control", "no-store, no-cache, must-revalidate, private");
     res.set("Pragma", "no-cache");
     res.set("Expires", "0");
+    const sessionId = extractCookieValueFromMap(req.cookies?.["bs_cookie_name_map"], "sessionId");
+    const ssoSession = await options.ssoClient.session(req.headers.authorization?.substring(7), sessionId, req.tokenPayload?.appId);
     res.json({
       success: true,
-      user: req.user,
-      tenant: req.tenant,
+      ...ssoSession,
       tokenPayload: req.tokenPayload
     });
   });
   router.post("/refresh", async (req, res) => {
+    const refreshTokenCookieName = extractCookieNameFromMap(req.cookies?.["bs_cookie_name_map"], "refreshToken");
     try {
-      const ssoResponse = await options.ssoClient.refreshTokens();
+      const refreshToken = extractCookieValueFromMap(req.cookies?.["bs_cookie_name_map"], "refreshToken");
+      const ssoResponse = await options.ssoClient.refreshTokens(refreshToken);
+      if (ssoResponse.tokens?.refreshToken) {
+        res.cookie(refreshTokenCookieName, ssoResponse.tokens.refreshToken, {
+          httpOnly: true,
+          secure: process.env.NODE_ENV === "production",
+          sameSite: process.env.COOKIE_SAMESITE,
+          path: "/api/auth/refresh",
+          maxAge: 7 * 24 * 60 * 60 * 1e3,
+          domain: process.env.COOKIE_DOMAIN
+        });
+      } else {
+        console.warn("[BigsoAuthSDK] No refresh token received in refresh response, not setting cookie");
+      }
       res.json({
         success: true,
         tokens: ssoResponse.tokens
       });
     } catch (error) {
       console.error("[BigsoAuthSDK] Error refreshing tokens:", error.message);
+      if (error.message?.includes("revoked") || error.message?.includes("expired") || error.message?.includes("Invalid")) {
+        res.clearCookie(refreshTokenCookieName, {
+          path: "/api/auth/refresh",
+          domain: process.env.COOKIE_DOMAIN
+        });
+      }
       res.status(401).json({ error: error.message || "Failed to refresh tokens" });
     }
   });
@@ -155,9 +176,17 @@ function createSsoAuthRouter(options) {
       if (options.onLogout) {
         await options.onLogout(accessToken);
       }
+      res.clearCookie(process.env.REFRESH_COOKIE_NAME, {
+        path: "/api/auth/refresh",
+        domain: process.env.COOKIE_DOMAIN
+      });
       res.json({ success: true, message: "Logged out" });
     } catch (error) {
       console.warn("[BigsoAuthSDK] Failed to logout in SSO Backend.", error.message);
+      res.clearCookie(process.env.REFRESH_COOKIE_NAME, {
+        path: "/api/auth/refresh",
+        domain: process.env.COOKIE_DOMAIN
+      });
       res.json({ success: true, message: "Logged out (backend revocation failed)" });
     }
   });

package/dist/node/index.cjs

@@ -47,6 +47,7 @@ async function verifyAccessToken(accessToken, jwksUrl) {
     exp: payload.exp,
     iat: payload.iat,
     tenants: payload.tenants || [],
+    tenantId: payload.tenantId || "",
     systemRole: payload.systemRole || "user",
     scope: payload.scope,
     deviceFingerprint: payload.deviceFingerprint
@@ -138,6 +139,21 @@ var BigsoSsoClient = class {
       throw new Error(err.message || "Logout failed");
     }
   }
+  async session(accessToken, sessionId, appId) {
+    const response = await fetch(`${this.ssoBackendUrl}/api/v2/auth/session`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${accessToken}`
+      },
+      body: JSON.stringify({ sessionId, appId }),
+      credentials: "include"
+    });
+    if (!response.ok) {
+      const err = await response.json().catch(() => ({}));
+      throw new Error(err.message || "Session validate failed");
+    }
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {

package/dist/node/index.d.cts

@@ -1,4 +1,4 @@
-import { b as SsoTokenPayload, c as V2LoginResponse, V as V2ExchangeResponse, d as V2RefreshResponse } from '../types-B51l8wWh.cjs';
+import { b as SsoTokenPayload, c as V2LoginResponse, V as V2ExchangeResponse, d as V2RefreshResponse } from '../types-sI7dMCGy.cjs';
 
 interface SsoClientOptions {
     ssoBackendUrl: string;
@@ -16,6 +16,7 @@ declare class BigsoSsoClient {
     exchangeCode(code: string, codeVerifier: string): Promise<V2ExchangeResponse>;
     refreshTokens(refreshToken?: string): Promise<V2RefreshResponse>;
     logout(accessToken: string, revokeAll?: boolean): Promise<void>;
+    session(accessToken: string, sessionId: string, appId: string): Promise<any>;
 }
 
 export { BigsoSsoClient, type SsoClientOptions };

package/dist/node/index.d.ts

@@ -1,4 +1,4 @@
-import { b as SsoTokenPayload, c as V2LoginResponse, V as V2ExchangeResponse, d as V2RefreshResponse } from '../types-B51l8wWh.js';
+import { b as SsoTokenPayload, c as V2LoginResponse, V as V2ExchangeResponse, d as V2RefreshResponse } from '../types-sI7dMCGy.js';
 
 interface SsoClientOptions {
     ssoBackendUrl: string;
@@ -16,6 +16,7 @@ declare class BigsoSsoClient {
     exchangeCode(code: string, codeVerifier: string): Promise<V2ExchangeResponse>;
     refreshTokens(refreshToken?: string): Promise<V2RefreshResponse>;
     logout(accessToken: string, revokeAll?: boolean): Promise<void>;
+    session(accessToken: string, sessionId: string, appId: string): Promise<any>;
 }
 
 export { BigsoSsoClient, type SsoClientOptions };

package/dist/node/index.js

@@ -1,7 +1,7 @@
 import {
   verifyAccessToken,
   verifySignedPayload
-} from "../chunk-PB3GVAEJ.js";
+} from "../chunk-BXRGCGYR.js";
 
 // src/node/SsoClient.ts
 var BigsoSsoClient = class {
@@ -88,6 +88,21 @@ var BigsoSsoClient = class {
       throw new Error(err.message || "Logout failed");
     }
   }
+  async session(accessToken, sessionId, appId) {
+    const response = await fetch(`${this.ssoBackendUrl}/api/v2/auth/session`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        "Authorization": `Bearer ${accessToken}`
+      },
+      body: JSON.stringify({ sessionId, appId }),
+      credentials: "include"
+    });
+    if (!response.ok) {
+      const err = await response.json().catch(() => ({}));
+      throw new Error(err.message || "Session validate failed");
+    }
+  }
 };
 export {
   BigsoSsoClient

package/dist/types-BE11MBpv.d.cts

@@ -0,0 +1,87 @@
+interface BigsoAuthOptions {
+    clientId: string;
+    ssoOrigin: string;
+    jwksUrl: string;
+    timeout?: number;
+    debug?: boolean;
+    redirectUri?: string;
+    tenantHint?: string;
+    theme?: 'light' | 'dark';
+}
+interface SsoUser {
+    userId: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+}
+interface SsoTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    permissions: Array<{
+        resource: string;
+        action: string;
+    }>;
+}
+interface SsoJwtTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    apps: string[];
+}
+interface SsoTokenPayload {
+    sub: string;
+    jti: string;
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    tenantId: string;
+    AppId: string;
+    systemRole: string;
+    scope: string[];
+}
+interface V2LoginResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+}
+interface V2ExchangeResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+    currentTenant: SsoTenant;
+    relatedTenants: SsoTenant[];
+}
+interface V2RefreshResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+        refreshToken?: string;
+    };
+}
+interface BigsoAuthResult {
+    code: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    signed_payload: string;
+    tenant?: SsoTenant;
+    jti?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+}
+
+export type { BigsoAuthOptions as B, SsoJwtTenant as S, V2ExchangeResponse as V, BigsoAuthResult as a, SsoTokenPayload as b, V2LoginResponse as c, V2RefreshResponse as d };

package/dist/types-BE11MBpv.d.ts

@@ -0,0 +1,87 @@
+interface BigsoAuthOptions {
+    clientId: string;
+    ssoOrigin: string;
+    jwksUrl: string;
+    timeout?: number;
+    debug?: boolean;
+    redirectUri?: string;
+    tenantHint?: string;
+    theme?: 'light' | 'dark';
+}
+interface SsoUser {
+    userId: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+}
+interface SsoTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    permissions: Array<{
+        resource: string;
+        action: string;
+    }>;
+}
+interface SsoJwtTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    apps: string[];
+}
+interface SsoTokenPayload {
+    sub: string;
+    jti: string;
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    tenantId: string;
+    AppId: string;
+    systemRole: string;
+    scope: string[];
+}
+interface V2LoginResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+}
+interface V2ExchangeResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+    currentTenant: SsoTenant;
+    relatedTenants: SsoTenant[];
+}
+interface V2RefreshResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+        refreshToken?: string;
+    };
+}
+interface BigsoAuthResult {
+    code: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    signed_payload: string;
+    tenant?: SsoTenant;
+    jti?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+}
+
+export type { BigsoAuthOptions as B, SsoJwtTenant as S, V2ExchangeResponse as V, BigsoAuthResult as a, SsoTokenPayload as b, V2LoginResponse as c, V2RefreshResponse as d };

package/dist/types-sI7dMCGy.d.cts

@@ -0,0 +1,87 @@
+interface BigsoAuthOptions {
+    clientId: string;
+    ssoOrigin: string;
+    jwksUrl: string;
+    timeout?: number;
+    debug?: boolean;
+    redirectUri?: string;
+    tenantHint?: string;
+    theme?: 'light' | 'dark';
+}
+interface SsoUser {
+    userId: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+}
+interface SsoTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    permissions: Array<{
+        resource: string;
+        action: string;
+    }>;
+}
+interface SsoJwtTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    apps: string[];
+}
+interface SsoTokenPayload {
+    sub: string;
+    jti: string;
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    tenantId: string;
+    appId: string;
+    systemRole: string;
+    scope: string[];
+}
+interface V2LoginResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+}
+interface V2ExchangeResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+    currentTenant: SsoTenant;
+    relatedTenants: SsoTenant[];
+}
+interface V2RefreshResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+        refreshToken?: string;
+    };
+}
+interface BigsoAuthResult {
+    code: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    signed_payload: string;
+    tenant?: SsoTenant;
+    jti?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+}
+
+export type { BigsoAuthOptions as B, SsoJwtTenant as S, V2ExchangeResponse as V, BigsoAuthResult as a, SsoTokenPayload as b, V2LoginResponse as c, V2RefreshResponse as d };

package/dist/types-sI7dMCGy.d.ts

@@ -0,0 +1,87 @@
+interface BigsoAuthOptions {
+    clientId: string;
+    ssoOrigin: string;
+    jwksUrl: string;
+    timeout?: number;
+    debug?: boolean;
+    redirectUri?: string;
+    tenantHint?: string;
+    theme?: 'light' | 'dark';
+}
+interface SsoUser {
+    userId: string;
+    email: string;
+    firstName: string;
+    lastName: string;
+}
+interface SsoTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    permissions: Array<{
+        resource: string;
+        action: string;
+    }>;
+}
+interface SsoJwtTenant {
+    id: string;
+    name: string;
+    slug: string;
+    role: string;
+    apps: string[];
+}
+interface SsoTokenPayload {
+    sub: string;
+    jti: string;
+    iss: string;
+    aud: string;
+    exp: number;
+    iat: number;
+    tenantId: string;
+    appId: string;
+    systemRole: string;
+    scope: string[];
+}
+interface V2LoginResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+}
+interface V2ExchangeResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        refreshToken: string;
+        expiresIn: number;
+    };
+    user: SsoUser;
+    currentTenant: SsoTenant;
+    relatedTenants: SsoTenant[];
+}
+interface V2RefreshResponse {
+    success: boolean;
+    tokens: {
+        accessToken: string;
+        expiresIn: number;
+        refreshToken?: string;
+    };
+}
+interface BigsoAuthResult {
+    code: string;
+    state: string;
+    nonce: string;
+    codeVerifier: string;
+    signed_payload: string;
+    tenant?: SsoTenant;
+    jti?: string;
+    iss?: string;
+    aud?: string;
+    exp?: number;
+    iat?: number;
+}
+
+export type { BigsoAuthOptions as B, SsoJwtTenant as S, V2ExchangeResponse as V, BigsoAuthResult as a, SsoTokenPayload as b, V2LoginResponse as c, V2RefreshResponse as d };

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@bigso/auth-sdk",
-    "version": "0.5.6",
+    "version": "0.5.8",
     "description": "SDK de autenticación para SSO v2 - JWT Bearer + PKCE",
     "publishConfig": {
         "registry": "https://registry.npmjs.org/",