@cboxdk/id-js 0.18.0 → 0.20.0

package/dist/nextjs.d.cts

@@ -1,7 +1,8 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { ApiKeyVerification } from './server.cjs';
-import { C as CboxIdClient } from './client-BxUHm5hX.cjs';
-import { A as AuthorizationRequestOptions, C as CboxUser, a as CboxIdConfig } from './types-BYZldock.cjs';
+import { a as ApiKeyVerification } from './api-keys-C8-Q4eFA.cjs';
+import { C as CboxIdClient } from './client-BT-jOm0p.cjs';
+import { A as AuthorizationRequestOptions, C as CboxUser, a as CboxIdConfig } from './types-CC1bz68x.cjs';
+import './errors-D61xljZE.cjs';
 
 interface CboxIdNext {
     /** The underlying framework-agnostic client. */

package/dist/nextjs.d.ts

@@ -1,7 +1,8 @@
 import { NextResponse, NextRequest } from 'next/server';
-import { ApiKeyVerification } from './server.js';
-import { C as CboxIdClient } from './client-BSZASrMo.js';
-import { A as AuthorizationRequestOptions, C as CboxUser, a as CboxIdConfig } from './types-BYZldock.js';
+import { a as ApiKeyVerification } from './api-keys-BE3R3q_A.js';
+import { C as CboxIdClient } from './client-xlEJalu8.js';
+import { A as AuthorizationRequestOptions, C as CboxUser, a as CboxIdConfig } from './types-CC1bz68x.js';
+import './errors-D61xljZE.js';
 
 interface CboxIdNext {
     /** The underlying framework-agnostic client. */

package/dist/nextjs.js

@@ -1,4 +1,4 @@
-import { CboxIdClient } from './chunk-CXGKOJRJ.js';
+import { CboxIdClient } from './chunk-YGLMLIKL.js';
 import { ApiKeyVerifier } from './chunk-2E25IPBA.js';
 import './chunk-QQW63PGU.js';
 import { ConfigurationError } from './chunk-SEUD4TE4.js';

package/dist/server.cjs

@@ -158,16 +158,16 @@ var ApiKeyVerifier = class {
     if (typeof body !== "object" || body === null) {
       throw new AuthenticationError("API key verification returned a body that is not a JSON object.");
     }
-    const record = body;
-    if (record["active"] !== true) {
+    const record2 = body;
+    if (record2["active"] !== true) {
       return { active: false };
     }
-    const keyId = record["key_id"];
-    const sub = record["sub"];
-    const org = record["org"];
-    const clientId = record["client_id"];
-    const expiresAt = record["expires_at"];
-    const permissions = record["permissions"];
+    const keyId = record2["key_id"];
+    const sub = record2["sub"];
+    const org = record2["org"];
+    const clientId = record2["client_id"];
+    const expiresAt = record2["expires_at"];
+    const permissions = record2["permissions"];
     if (!nonEmpty(keyId) || !nonEmpty(sub) || !nonEmpty(org) || !nonEmpty(clientId) || !Array.isArray(permissions) || expiresAt !== null && expiresAt !== void 0 && typeof expiresAt !== "string") {
       throw new AuthenticationError("API key verification returned an active answer without the promised fields.");
     }
@@ -182,7 +182,7 @@ var ApiKeyVerifier = class {
         return { active: false };
       }
     }
-    const role = record["org_role"];
+    const role = record2["org_role"];
     return {
       active: true,
       key_id: keyId,
@@ -214,7 +214,101 @@ async function digest(key) {
   return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, "0")).join("");
 }
 
+// src/decisions.ts
+var PermissionDecision = class {
+  constructor(subject, organization, clientId, organizationRole, organizationActive, permissions) {
+    this.subject = subject;
+    this.organization = organization;
+    this.clientId = clientId;
+    this.organizationRole = organizationRole;
+    this.organizationActive = organizationActive;
+    this.permissions = permissions;
+  }
+  subject;
+  organization;
+  clientId;
+  organizationRole;
+  organizationActive;
+  permissions;
+  allows(permission) {
+    return this.organizationActive && this.permissions[permission] === true;
+  }
+  allowed() {
+    const values = Object.values(this.permissions);
+    return this.organizationActive && values.length > 0 && values.every((value) => value === true);
+  }
+};
+async function checkPermissions(config, accessToken, subject, organization, permissions) {
+  assertSecureIssuer(config.issuer);
+  const issuer = new URL(config.issuer);
+  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId || !subject || organization === "" || !accessToken || accessToken.length > 32768 || /[\x00-\x20\x7f]/.test(accessToken) || !permissions.length || permissions.length > 50 || permissions.some((permission) => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {
+    throw new ConfigurationError("Permission decision request is not configured or valid.");
+  }
+  const requested = [...new Set(permissions)];
+  try {
+    const response = await fetch(`${config.issuer.replace(/\/$/, "")}/oauth/decisions`, {
+      method: "POST",
+      redirect: "error",
+      cache: "no-store",
+      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 1e4)),
+      headers: { authorization: `Bearer ${accessToken}`, accept: "application/json", "content-type": "application/json" },
+      body: JSON.stringify({ subject, org: organization, permission: requested })
+    });
+    if (response.status !== 200) {
+      await response.body?.cancel();
+      throw new AuthenticationError("Permission decision could not be verified.", void 0, void 0, response.status);
+    }
+    const reader = response.body?.getReader();
+    if (!reader) throw new AuthenticationError("Permission decision response is invalid.");
+    let size = 0;
+    let raw = "";
+    const decoder = new TextDecoder();
+    try {
+      for (; ; ) {
+        const { value, done } = await reader.read();
+        if (done) break;
+        size += value.byteLength;
+        if (size > 65536) throw new AuthenticationError("Permission decision response exceeded its limit.");
+        raw += decoder.decode(value, { stream: true });
+      }
+      raw += decoder.decode();
+    } finally {
+      await reader.cancel();
+      reader.releaseLock();
+    }
+    const data = JSON.parse(raw);
+    if (!record(data) || !record(data.subject) || data.mode !== "rbac" || data.subject.type !== "user" || data.subject.id !== subject || data.organization !== organization || data.client_id !== config.clientId || typeof data.organization_active !== "boolean" || typeof data.allowed !== "boolean" || !(data.org_role === null || typeof data.org_role === "string" && ["owner", "admin", "developer", "member", "viewer"].includes(data.org_role)) || !Array.isArray(data.results) || data.results.length !== requested.length) {
+      throw new AuthenticationError("Permission decision response binding is invalid.");
+    }
+    const checks = /* @__PURE__ */ Object.create(null);
+    for (const result of data.results) {
+      if (!record(result) || typeof result.permission !== "string" || typeof result.allowed !== "boolean" || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {
+        throw new AuthenticationError("Permission decision result is invalid.");
+      }
+      checks[result.permission] = result.allowed;
+    }
+    const decision = new PermissionDecision(
+      subject,
+      organization,
+      config.clientId,
+      data.org_role,
+      data.organization_active,
+      Object.freeze(checks)
+    );
+    if (data.allowed !== decision.allowed()) throw new AuthenticationError("Permission decision result is inconsistent.");
+    return decision;
+  } catch (error) {
+    if (error instanceof AuthenticationError) throw error;
+    throw new AuthenticationError("Permission decision could not be verified.");
+  }
+}
+function record(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
 exports.ApiKeyVerifier = ApiKeyVerifier;
 exports.MAX_API_KEY_CACHE_TTL_MS = MAX_API_KEY_CACHE_TTL_MS;
+exports.PermissionDecision = PermissionDecision;
+exports.checkPermissions = checkPermissions;
 //# sourceMappingURL=server.cjs.map
 //# sourceMappingURL=server.cjs.map

package/dist/server.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/issuer.ts","../src/api-keys.ts"],"names":[],"mappings":";;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC,CAAA;AAmB9C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,WAAA,CACE,OAAA,EAES,KAAA,EAEA,gBAAA,EAEA,QAUA,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAhBJ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAEA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAUA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EAjBW,KAAA;AAAA,EAEA,gBAAA;AAAA,EAEA,MAAA;AAAA,EAUA,UAAA;AAAA;AAAA,EAMX,IAAI,aAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,MAAA,KAAW,GAAA;AAAA,EACzB;AACF,CAAA;AAUA,eAAsB,UAAA,CAAW,UAAoB,QAAA,EAAgD;AACnG,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAEjD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,WAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAEvC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,gBAAA,EAAiB,GAAI,MAAA;AACvD,MAAA,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,KAAA,CAAA;AAC3C,MAAA,WAAA,GAAc,OAAO,gBAAA,KAAqB,QAAA,GAAW,gBAAA,GAAmB,KAAA,CAAA;AAAA,IAC1E;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAOA,EAAA,MAAM,MAAA,GAAS,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAM9C,EAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa,gBAAA,KAAqB,IAAA,IAAQ,OAAA,CAAQ,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAChF,MAAA,CAAO,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAC9B,MAAA;AAEJ,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AACzG;;;AC1FO,SAAS,mBAAmB,MAAA,EAAsB;AACvD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,MAAM,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,mBAAmB,6CAA6C,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,QAAA,KAAa,KAAA;AAE9H,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,QAAA,EAAU;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,kBAAA;AAAA,IACR,CAAA,6CAAA,EAAgD,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,EAAA;AAAA,GAC/E;AACF;;;ACiCO,IAAM,wBAAA,GAA2B;AAGxC,IAAM,iBAAA,GAAoB,GAAA;AAE1B,IAAM,kBAAA,uBAA8C,GAAA,CAAsB;AAAA,EACxE,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAqBM,IAAM,iBAAN,MAAqB;AAAA,EAM1B,YAA6B,MAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAG3B,IAAA,IAAI,OAAQ,UAAA,CAAsC,QAAA,KAAa,WAAA,EAAa;AAC1E,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,OAAO,MAAA,IAAU,CAAC,OAAO,QAAA,IAAY,CAAC,OAAO,YAAA,EAAc;AAC9D,MAAA,MAAM,IAAI,mBAAmB,6DAA6D,CAAA;AAAA,IAC5F;AACA,IAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAEhC,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,CAAA;AACxC,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,UAAU,KAAK,UAAA,GAAa,CAAA,IAAK,aAAa,wBAAA,EAA0B;AAC3F,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,oCAAoC,wBAAwB,CAAA,4DAAA;AAAA,OAC9D;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,WAAW,CAAA,EAAG,MAAA,CAAO,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,sBAAA,CAAA;AACnD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAAA,EACpB;AAAA,EAvB6B,MAAA;AAAA,EALZ,QAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAqD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoClF,MAAM,aAAa,GAAA,EAA0C;AAC3D,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAChD,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,UAAA,GAAa,IAAI,MAAM,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA;AAC3D,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACnC,MAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,GAAQ,IAAA,CAAK,KAAI,EAAG;AACjC,QAAA,OAAO,GAAA,CAAI,MAAA;AAAA,MACb;AACA,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,QAAQ,CAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAEjD,IAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,MAAA,CAAO,MAAA,EAAQ;AACtC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,MAAM,CAAA;AAAA,IAChC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,GAAA,EAA+B;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU;AAAA,QACpC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA;AAAA,UACnF,MAAA,EAAQ,kBAAA;AAAA,UACR,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,KAAK,CAAA;AAAA,QACjC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,6BAA6B,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,EACzC;AAAA,EAEQ,MAAM,IAAA,EAAmC;AAC/C,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AAC7C,MAAA,MAAM,IAAI,oBAAoB,iEAAiE,CAAA;AAAA,IACjG;AAEA,IAAA,MAAM,MAAA,GAAS,IAAA;AAGf,IAAA,IAAI,MAAA,CAAO,QAAQ,CAAA,KAAM,IAAA,EAAM;AAC7B,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,KAAA,GAAQ,OAAO,QAAQ,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,GAAA,GAAM,OAAO,KAAK,CAAA;AACxB,IAAA,MAAM,QAAA,GAAW,OAAO,WAAW,CAAA;AACnC,IAAA,MAAM,SAAA,GAAY,OAAO,YAAY,CAAA;AACrC,IAAA,MAAM,WAAA,GAAc,OAAO,aAAa,CAAA;AAExC,IAAA,IACE,CAAC,QAAA,CAAS,KAAK,CAAA,IACf,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,QAAQ,CAAA,IAClB,CAAC,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,IACzB,SAAA,KAAc,IAAA,IAAQ,SAAA,KAAc,MAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EACvE;AACA,MAAA,MAAM,IAAI,oBAAoB,6EAA6E,CAAA;AAAA,IAC7G;AAMA,IAAA,IAAI,QAAA,KAAa,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,yCAAA,EAA4C,QAAQ,CAAA,gBAAA,EAAmB,IAAA,CAAK,OAAO,QAAQ,CAAA,eAAA;AAAA,OAC7F;AAAA,IACF;AAGA,IAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnC,MAAA,IAAI,OAAO,KAAA,CAAM,MAAM,KAAK,MAAA,IAAU,IAAA,CAAK,KAAI,EAAG;AAChD,QAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,MACzB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,OAAO,UAAU,CAAA;AAE9B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,GAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAA,EAAU,OAAO,IAAA,KAAS,QAAA,IAAY,mBAAmB,GAAA,CAAI,IAAI,IAAK,IAAA,GAA4B,IAAA;AAAA,MAClG,aAAa,WAAA,CAAY,MAAA,CAAO,CAAC,KAAA,KAA2B,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,MAC3E,SAAA,EAAW,QAAA;AAAA,MACX,UAAA,EAAY,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,GAAY;AAAA,KAC1D;AAAA,EACF;AAAA,EAEQ,QAAA,CAAS,UAAkB,MAAA,EAA4B;AAC7D,IAAA,MAAM,MAAA,GAAS,OAAO,UAAA,KAAe,IAAA,GAAO,OAAO,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACnG,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,CAAI,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,YAAY,MAAM,CAAA;AAE3D,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,IAAA,IAAQ,iBAAA,EAAmB;AACxC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,IAAA,EAAK;AACtC,MAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,QAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,MAChC;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,QAAA,EAAU,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5C;AACF;AAEA,SAAS,SAAS,KAAA,EAAiC;AACjD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA;AAChD;AAGA,eAAe,OAAO,GAAA,EAA8B;AAClD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA;AACjF,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,WAAW,KAAK,CAAA,EAAG,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAChG","file":"server.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n *\n * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.\n * It used to be discarded at every back-channel boundary, leaving a single message string\n * for outcomes that need opposite responses: `invalid_grant` on a refresh means the\n * session is over and the person has to sign in again, while `temporarily_unavailable`\n * means try the same token in a moment. A caller reduced to matching on prose either\n * retries what can never succeed, or signs out somebody who did not need to be.\n */\nexport class AuthenticationError extends CboxIdError {\n  constructor(\n    message: string,\n    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */\n    readonly error?: string,\n    /** The server's `error_description`, verbatim. Not end-user copy. */\n    readonly errorDescription?: string,\n    /** HTTP status, for the cases where the body says nothing useful. */\n    readonly status?: number,\n    /**\n     * Seconds to wait, off the `Retry-After` header — set only on a 429.\n     *\n     * The distinction it carries is the one a caller most needs and could least infer:\n     * a 429 is the ONLY back-channel failure where the same request will succeed\n     * unchanged if you simply wait. Every other one needs a different request, or a new\n     * sign-in. Without this the SDK reported \"token refresh failed\" and a caller with a\n     * retry loop hammered a limiter that was already telling it exactly how long to stop.\n     */\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n\n  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */\n  get isRateLimited(): boolean {\n    return this.status === 429;\n  }\n}\n\n/**\n * Read an OAuth error out of a failed token-endpoint response.\n *\n * Best-effort by design: a 502 from a proxy is HTML, a captive portal is worse, and the\n * caller still needs an error rather than a parse exception. What it must never do is\n * invent a code — an absent or unparseable `error` stays undefined, so\n * `e.error === 'invalid_grant'` is true only because the server said so.\n */\nexport async function oauthError(response: Response, fallback: string): Promise<AuthenticationError> {\n  const body = await response.text().catch(() => '');\n\n  let code: string | undefined;\n  let description: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(body);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const { error, error_description: errorDescription } = parsed as Record<string, unknown>;\n      code = typeof error === 'string' ? error : undefined;\n      description = typeof errorDescription === 'string' ? errorDescription : undefined;\n    }\n  } catch {\n    // Not JSON. The status and the truncated body below are all there is to report.\n  }\n\n  // THE BODY IS NEVER ECHOED. These calls carry `client_secret`, `code_verifier` and\n  // refresh tokens in their REQUEST, and a debug proxy, a captive portal or an upstream\n  // error page that reflects what it received puts those straight into a thrown message\n  // — which production apps log. Only the server's own OAuth error code travels, and\n  // failing that, the status alone.\n  const detail = code ?? `HTTP ${response.status}`;\n\n  // `Retry-After` is seconds here — Laravel's throttler writes the integer form. The\n  // HTTP-date form is legal too and is deliberately NOT parsed: guessing at a clock\n  // skew is worse than saying nothing, and `status === 429` still tells the caller to\n  // back off.\n  const retryAfterHeader = response.headers.get('retry-after');\n  const retryAfter = retryAfterHeader !== null && /^\\d+$/.test(retryAfterHeader.trim())\n    ? Number(retryAfterHeader.trim())\n    : undefined;\n\n  return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);\n}\n\n/**\n * The Frontend API refused, or could not be reached.\n *\n * Carries a `code` because the four ways this goes wrong need four different responses\n * from the caller, and telling them apart from a message string is the kind of thing\n * that works until somebody rewords the message:\n *\n *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a\n *    configuration problem the developer fixes once in the console.\n *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.\n *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.\n *  - `malformed` — a 200 whose body is not the document we expect, which means something\n *    between the page and us is rewriting responses (a proxy, an extension, a captive\n *    portal). Worth distinguishing, because retrying it never helps.\n */\nexport class FrontendApiError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed',\n    readonly status?: number,\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n}\n","import { ConfigurationError } from './errors.js';\n\n/**\n * An issuer must be HTTPS.\n *\n * Everything this SDK does with it carries a credential: the authorization code, the PKCE\n * verifier, the client secret, the refresh token. Over `http://` a network attacker reads\n * all of them — and, worse, replaces the discovery document and JWKS, at which point a\n * forged id_token verifies cleanly and the whole verification chain proves nothing.\n *\n * Loopback is allowed because a native app's own callback listener is loopback by\n * definition (RFC 8252) and a dev instance runs there.\n */\nexport function assertSecureIssuer(issuer: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(issuer);\n  } catch {\n    throw new ConfigurationError('Cbox ID config `issuer` is not a valid URL.');\n  }\n\n  if (url.protocol === 'https:') {\n    return;\n  }\n\n  const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]' || url.hostname === '::1';\n\n  if (url.protocol === 'http:' && loopback) {\n    return;\n  }\n\n  throw new ConfigurationError(\n    `Cbox ID config \\`issuer\\` must be https (got ${url.protocol}//${url.hostname}).`,\n  );\n}\n","import type { OrganizationRole } from './claims.js';\nimport { AuthenticationError, ConfigurationError, oauthError } from './errors.js';\nimport { assertSecureIssuer } from './issuer.js';\n\n/**\n * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active\n * member of `org`.\n *\n * The field names are the endpoint's own, so the claim helpers read it like a token —\n * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type\n * alias rather than an interface for that reason: only an alias is assignable to the\n * helpers' record type.)\n */\nexport type ActiveApiKey = {\n  active: true;\n  /** The key's id — log this, never the key. */\n  key_id: string;\n  /** The person who holds the key (their subject id). */\n  sub: string;\n  /** The organization the key acts in. */\n  org: string;\n  /** The holder's membership tier in `org`; null for a tier this SDK does not know. */\n  org_role: OrganizationRole | null;\n  /**\n   * What the key may do, already re-capped by Cbox ID: the key's own list intersected\n   * with what the holder holds for your app right now. A demoted holder's key loses the\n   * permission on the next verification, not at the next reissue.\n   */\n  permissions: string[];\n  /** Your app's client id — always, or the answer is refused. */\n  client_id: string;\n  /** ISO 8601 UTC expiry, or null for a key that does not expire. */\n  expires_at: string | null;\n};\n\n/**\n * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who\n * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and\n * neither does this.\n */\nexport interface InactiveApiKey {\n  active: false;\n}\n\n/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */\nexport type ApiKeyVerification = ActiveApiKey | InactiveApiKey;\n\n/** Configuration for an {@link ApiKeyVerifier}. */\nexport interface ApiKeyVerifierConfig {\n  /** Base URL (issuer) of the Cbox ID instance. */\n  issuer: string;\n  /** Your app's OAuth client id — the app the keys were issued for. */\n  clientId: string;\n  /** Your app's client secret. Verification is a confidential-client call. */\n  clientSecret: string;\n  /** Timeout (ms) for the verification request. Defaults to `10000`. */\n  timeoutMs?: number;\n  /**\n   * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs\n   * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:\n   * while an answer is cached, a revoked key keeps working, and a demoted holder keeps\n   * the permissions they lost. Never cached past the key's `expires_at`. Refusals are\n   * never cached, so a key issued a moment ago works on its first request.\n   */\n  cacheTtlMs?: number;\n}\n\n/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */\nexport const MAX_API_KEY_CACHE_TTL_MS = 60_000;\n\n/** Enough for a busy API's working set; oldest entries go first beyond it. */\nconst MAX_CACHE_ENTRIES = 1_000;\n\nconst ORGANIZATION_ROLES: ReadonlySet<string> = new Set<OrganizationRole>([\n  'owner',\n  'admin',\n  'developer',\n  'member',\n  'viewer',\n]);\n\n/**\n * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,\n * authenticated with your app's own client credentials.\n *\n * SERVER-SIDE ONLY. It holds your client secret, so it lives in the\n * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a\n * browser bundle pulls in — and it refuses to be constructed in a browser at all.\n *\n * ```ts\n * import { ApiKeyVerifier } from '@cboxdk/id-js/server';\n * import { hasPermission } from '@cboxdk/id-js';\n *\n * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });\n *\n * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');\n * if (!answer.active) return unauthorized();\n * if (!hasPermission(answer, 'invoices:create')) return forbidden();\n * ```\n */\nexport class ApiKeyVerifier {\n  private readonly endpoint: string;\n  private readonly timeoutMs: number;\n  private readonly cacheTtlMs: number;\n  private readonly cache = new Map<string, { answer: ActiveApiKey; until: number }>();\n\n  constructor(private readonly config: ApiKeyVerifierConfig) {\n    // A heuristic, and enough of one: a page has a `document`, and no server runtime\n    // this SDK supports (Node, Deno, Bun, edge workers) defines one.\n    if (typeof (globalThis as { document?: unknown }).document !== 'undefined') {\n      throw new ConfigurationError(\n        'API key verification uses your client secret and must run on your server, never in a browser.',\n      );\n    }\n    if (!config.issuer || !config.clientId || !config.clientSecret) {\n      throw new ConfigurationError('Verifying API keys needs issuer, clientId and clientSecret.');\n    }\n    assertSecureIssuer(config.issuer);\n\n    const cacheTtlMs = config.cacheTtlMs ?? 0;\n    if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0 || cacheTtlMs > MAX_API_KEY_CACHE_TTL_MS) {\n      throw new ConfigurationError(\n        `cacheTtlMs must be between 0 and ${MAX_API_KEY_CACHE_TTL_MS}: a cached answer keeps a revoked key working for that long.`,\n      );\n    }\n\n    this.endpoint = `${config.issuer.replace(/\\/$/, '')}/oauth/api-keys/verify`;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.cacheTtlMs = cacheTtlMs;\n  }\n\n  /**\n   * Ask Cbox ID whether `key` is good for this app, and what it may do.\n   *\n   * Resolves `{ active: false }` for every kind of bad key, without a request for an empty\n   * one. Throws `AuthenticationError` when the call itself fails (wrong client\n   * credentials, an unreachable instance) or when the answer cannot be trusted — one that\n   * names another app's `client_id`, or does not have the promised shape. Both mean \"do\n   * not let this request in\"; the difference is that a throw is something to look at.\n   */\n  async verifyApiKey(key: string): Promise<ApiKeyVerification> {\n    if (typeof key !== 'string' || key.trim() === '') {\n      return { active: false };\n    }\n\n    const cacheKey = this.cacheTtlMs > 0 ? await digest(key) : null;\n    if (cacheKey !== null) {\n      const hit = this.cache.get(cacheKey);\n      if (hit && hit.until > Date.now()) {\n        return hit.answer;\n      }\n      this.cache.delete(cacheKey);\n    }\n\n    const answer = this.parse(await this.request(key));\n\n    if (cacheKey !== null && answer.active) {\n      this.remember(cacheKey, answer);\n    }\n\n    return answer;\n  }\n\n  private async request(key: string): Promise<unknown> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await fetch(this.endpoint, {\n        method: 'POST',\n        headers: {\n          authorization: `Basic ${btoa(`${this.config.clientId}:${this.config.clientSecret}`)}`,\n          accept: 'application/json',\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({ key }),\n        signal: controller.signal,\n      });\n    } catch (error) {\n      throw new AuthenticationError(`API key verification request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      throw await oauthError(response, 'API key verification failed');\n    }\n\n    return response.json().catch(() => null);\n  }\n\n  private parse(body: unknown): ApiKeyVerification {\n    if (typeof body !== 'object' || body === null) {\n      throw new AuthenticationError('API key verification returned a body that is not a JSON object.');\n    }\n\n    const record = body as Record<string, unknown>;\n\n    // Only a literal `true` lets anybody in.\n    if (record['active'] !== true) {\n      return { active: false };\n    }\n\n    const keyId = record['key_id'];\n    const sub = record['sub'];\n    const org = record['org'];\n    const clientId = record['client_id'];\n    const expiresAt = record['expires_at'];\n    const permissions = record['permissions'];\n\n    if (\n      !nonEmpty(keyId) ||\n      !nonEmpty(sub) ||\n      !nonEmpty(org) ||\n      !nonEmpty(clientId) ||\n      !Array.isArray(permissions) ||\n      (expiresAt !== null && expiresAt !== undefined && typeof expiresAt !== 'string')\n    ) {\n      throw new AuthenticationError('API key verification returned an active answer without the promised fields.');\n    }\n\n    // THE BINDING, CHECKED AGAIN HERE. Cbox ID only ever finds a key bound to the calling\n    // client, so this cannot fire against a correct instance — which is exactly when a\n    // check that it holds is worth having: a proxy, a misrouted base URL, or a shared\n    // secret between two apps would otherwise let one app's customers into another's API.\n    if (clientId !== this.config.clientId) {\n      throw new AuthenticationError(\n        `API key verification answered for client ${clientId}, not this app (${this.config.clientId}); refusing it.`,\n      );\n    }\n\n    // Past its expiry by our clock is expired, whatever the instance thought a moment ago.\n    if (typeof expiresAt === 'string') {\n      const expiry = Date.parse(expiresAt);\n      if (Number.isNaN(expiry) || expiry <= Date.now()) {\n        return { active: false };\n      }\n    }\n\n    const role = record['org_role'];\n\n    return {\n      active: true,\n      key_id: keyId,\n      sub,\n      org,\n      org_role: typeof role === 'string' && ORGANIZATION_ROLES.has(role) ? (role as OrganizationRole) : null,\n      permissions: permissions.filter((value): value is string => nonEmpty(value)),\n      client_id: clientId,\n      expires_at: typeof expiresAt === 'string' ? expiresAt : null,\n    };\n  }\n\n  private remember(cacheKey: string, answer: ActiveApiKey): void {\n    const expiry = answer.expires_at === null ? Number.POSITIVE_INFINITY : Date.parse(answer.expires_at);\n    const until = Math.min(Date.now() + this.cacheTtlMs, expiry);\n\n    if (this.cache.size >= MAX_CACHE_ENTRIES) {\n      const oldest = this.cache.keys().next();\n      if (!oldest.done) {\n        this.cache.delete(oldest.value);\n      }\n    }\n\n    this.cache.set(cacheKey, { answer, until });\n  }\n}\n\nfunction nonEmpty(value: unknown): value is string {\n  return typeof value === 'string' && value !== '';\n}\n\n/** The cache is keyed by a hash, so live keys are not sitting in memory as plaintext. */\nasync function digest(key: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(key));\n  return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n"]}
+{"version":3,"sources":["../src/errors.ts","../src/issuer.ts","../src/api-keys.ts","../src/decisions.ts"],"names":["record"],"mappings":";;;AAIO,IAAM,WAAA,GAAN,cAA0B,KAAA,CAAM;AAAA,EACrC,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,OAAO,GAAA,CAAA,MAAA,CAAW,IAAA;AAAA,EACzB;AACF,CAAA;AAGO,IAAM,kBAAA,GAAN,cAAiC,WAAA,CAAY;AAAC,CAAA;AAmB9C,IAAM,mBAAA,GAAN,cAAkC,WAAA,CAAY;AAAA,EACnD,WAAA,CACE,OAAA,EAES,KAAA,EAEA,gBAAA,EAEA,QAUA,UAAA,EACT;AACA,IAAA,KAAA,CAAM,OAAO,CAAA;AAhBJ,IAAA,IAAA,CAAA,KAAA,GAAA,KAAA;AAEA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AAEA,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAUA,IAAA,IAAA,CAAA,UAAA,GAAA,UAAA;AAAA,EAGX;AAAA,EAjBW,KAAA;AAAA,EAEA,gBAAA;AAAA,EAEA,MAAA;AAAA,EAUA,UAAA;AAAA;AAAA,EAMX,IAAI,aAAA,GAAyB;AAC3B,IAAA,OAAO,KAAK,MAAA,KAAW,GAAA;AAAA,EACzB;AACF,CAAA;AAUA,eAAsB,UAAA,CAAW,UAAoB,QAAA,EAAgD;AACnG,EAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,EAAE,CAAA;AAEjD,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI,WAAA;AAEJ,EAAA,IAAI;AACF,IAAA,MAAM,MAAA,GAAkB,IAAA,CAAK,KAAA,CAAM,IAAI,CAAA;AAEvC,IAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,KAAW,IAAA,EAAM;AACjD,MAAA,MAAM,EAAE,KAAA,EAAO,iBAAA,EAAmB,gBAAA,EAAiB,GAAI,MAAA;AACvD,MAAA,IAAA,GAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,KAAA,CAAA;AAC3C,MAAA,WAAA,GAAc,OAAO,gBAAA,KAAqB,QAAA,GAAW,gBAAA,GAAmB,KAAA,CAAA;AAAA,IAC1E;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AAOA,EAAA,MAAM,MAAA,GAAS,IAAA,IAAQ,CAAA,KAAA,EAAQ,QAAA,CAAS,MAAM,CAAA,CAAA;AAM9C,EAAA,MAAM,gBAAA,GAAmB,QAAA,CAAS,OAAA,CAAQ,GAAA,CAAI,aAAa,CAAA;AAC3D,EAAA,MAAM,UAAA,GAAa,gBAAA,KAAqB,IAAA,IAAQ,OAAA,CAAQ,IAAA,CAAK,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAChF,MAAA,CAAO,gBAAA,CAAiB,IAAA,EAAM,CAAA,GAC9B,MAAA;AAEJ,EAAA,OAAO,IAAI,mBAAA,CAAoB,CAAA,EAAG,QAAQ,CAAA,EAAA,EAAK,MAAM,CAAA,CAAA,EAAI,IAAA,EAAM,WAAA,EAAa,QAAA,CAAS,MAAA,EAAQ,UAAU,CAAA;AACzG;;;AC1FO,SAAS,mBAAmB,MAAA,EAAsB;AACvD,EAAA,IAAI,GAAA;AAEJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAI,IAAI,MAAM,CAAA;AAAA,EACtB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,mBAAmB,6CAA6C,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,GAAA,CAAI,aAAa,QAAA,EAAU;AAC7B,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,GAAA,CAAI,QAAA,KAAa,KAAA;AAE9H,EAAA,IAAI,GAAA,CAAI,QAAA,KAAa,OAAA,IAAW,QAAA,EAAU;AACxC,IAAA;AAAA,EACF;AAEA,EAAA,MAAM,IAAI,kBAAA;AAAA,IACR,CAAA,6CAAA,EAAgD,GAAA,CAAI,QAAQ,CAAA,EAAA,EAAK,IAAI,QAAQ,CAAA,EAAA;AAAA,GAC/E;AACF;;;ACiCO,IAAM,wBAAA,GAA2B;AAGxC,IAAM,iBAAA,GAAoB,GAAA;AAE1B,IAAM,kBAAA,uBAA8C,GAAA,CAAsB;AAAA,EACxE,OAAA;AAAA,EACA,OAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA;AACF,CAAC,CAAA;AAqBM,IAAM,iBAAN,MAAqB;AAAA,EAM1B,YAA6B,MAAA,EAA8B;AAA9B,IAAA,IAAA,CAAA,MAAA,GAAA,MAAA;AAG3B,IAAA,IAAI,OAAQ,UAAA,CAAsC,QAAA,KAAa,WAAA,EAAa;AAC1E,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,OAAO,MAAA,IAAU,CAAC,OAAO,QAAA,IAAY,CAAC,OAAO,YAAA,EAAc;AAC9D,MAAA,MAAM,IAAI,mBAAmB,6DAA6D,CAAA;AAAA,IAC5F;AACA,IAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAEhC,IAAA,MAAM,UAAA,GAAa,OAAO,UAAA,IAAc,CAAA;AACxC,IAAA,IAAI,CAAC,OAAO,QAAA,CAAS,UAAU,KAAK,UAAA,GAAa,CAAA,IAAK,aAAa,wBAAA,EAA0B;AAC3F,MAAA,MAAM,IAAI,kBAAA;AAAA,QACR,oCAAoC,wBAAwB,CAAA,4DAAA;AAAA,OAC9D;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,WAAW,CAAA,EAAG,MAAA,CAAO,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,sBAAA,CAAA;AACnD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,UAAA,GAAa,UAAA;AAAA,EACpB;AAAA,EAvB6B,MAAA;AAAA,EALZ,QAAA;AAAA,EACA,SAAA;AAAA,EACA,UAAA;AAAA,EACA,KAAA,uBAAY,GAAA,EAAqD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAoClF,MAAM,aAAa,GAAA,EAA0C;AAC3D,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,IAAA,OAAW,EAAA,EAAI;AAChD,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,WAAW,IAAA,CAAK,UAAA,GAAa,IAAI,MAAM,MAAA,CAAO,GAAG,CAAA,GAAI,IAAA;AAC3D,IAAA,IAAI,aAAa,IAAA,EAAM;AACrB,MAAA,MAAM,GAAA,GAAM,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,QAAQ,CAAA;AACnC,MAAA,IAAI,GAAA,IAAO,GAAA,CAAI,KAAA,GAAQ,IAAA,CAAK,KAAI,EAAG;AACjC,QAAA,OAAO,GAAA,CAAI,MAAA;AAAA,MACb;AACA,MAAA,IAAA,CAAK,KAAA,CAAM,OAAO,QAAQ,CAAA;AAAA,IAC5B;AAEA,IAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,MAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAC,CAAA;AAEjD,IAAA,IAAI,QAAA,KAAa,IAAA,IAAQ,MAAA,CAAO,MAAA,EAAQ;AACtC,MAAA,IAAA,CAAK,QAAA,CAAS,UAAU,MAAM,CAAA;AAAA,IAChC;AAEA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA,EAEA,MAAc,QAAQ,GAAA,EAA+B;AACnD,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,QAAA,EAAU;AAAA,QACpC,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA,EAAS;AAAA,UACP,aAAA,EAAe,CAAA,MAAA,EAAS,IAAA,CAAK,CAAA,EAAG,IAAA,CAAK,MAAA,CAAO,QAAQ,CAAA,CAAA,EAAI,IAAA,CAAK,MAAA,CAAO,YAAY,CAAA,CAAE,CAAC,CAAA,CAAA;AAAA,UACnF,MAAA,EAAQ,kBAAA;AAAA,UACR,cAAA,EAAgB;AAAA,SAClB;AAAA,QACA,IAAA,EAAM,IAAI,eAAA,CAAgB,EAAE,KAAK,CAAA;AAAA,QACjC,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,SAAS,KAAA,EAAO;AACd,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,qCAAA,EAAwC,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAAA,IACvF,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,MAAM,UAAA,CAAW,QAAA,EAAU,6BAA6B,CAAA;AAAA,IAChE;AAEA,IAAA,OAAO,QAAA,CAAS,IAAA,EAAK,CAAE,KAAA,CAAM,MAAM,IAAI,CAAA;AAAA,EACzC;AAAA,EAEQ,MAAM,IAAA,EAAmC;AAC/C,IAAA,IAAI,OAAO,IAAA,KAAS,QAAA,IAAY,IAAA,KAAS,IAAA,EAAM;AAC7C,MAAA,MAAM,IAAI,oBAAoB,iEAAiE,CAAA;AAAA,IACjG;AAEA,IAAA,MAAMA,OAAAA,GAAS,IAAA;AAGf,IAAA,IAAIA,OAAAA,CAAO,QAAQ,CAAA,KAAM,IAAA,EAAM;AAC7B,MAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,IACzB;AAEA,IAAA,MAAM,KAAA,GAAQA,QAAO,QAAQ,CAAA;AAC7B,IAAA,MAAM,GAAA,GAAMA,QAAO,KAAK,CAAA;AACxB,IAAA,MAAM,GAAA,GAAMA,QAAO,KAAK,CAAA;AACxB,IAAA,MAAM,QAAA,GAAWA,QAAO,WAAW,CAAA;AACnC,IAAA,MAAM,SAAA,GAAYA,QAAO,YAAY,CAAA;AACrC,IAAA,MAAM,WAAA,GAAcA,QAAO,aAAa,CAAA;AAExC,IAAA,IACE,CAAC,QAAA,CAAS,KAAK,CAAA,IACf,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,GAAG,CAAA,IACb,CAAC,QAAA,CAAS,QAAQ,CAAA,IAClB,CAAC,KAAA,CAAM,OAAA,CAAQ,WAAW,CAAA,IACzB,SAAA,KAAc,IAAA,IAAQ,SAAA,KAAc,MAAA,IAAa,OAAO,SAAA,KAAc,QAAA,EACvE;AACA,MAAA,MAAM,IAAI,oBAAoB,6EAA6E,CAAA;AAAA,IAC7G;AAMA,IAAA,IAAI,QAAA,KAAa,IAAA,CAAK,MAAA,CAAO,QAAA,EAAU;AACrC,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,yCAAA,EAA4C,QAAQ,CAAA,gBAAA,EAAmB,IAAA,CAAK,OAAO,QAAQ,CAAA,eAAA;AAAA,OAC7F;AAAA,IACF;AAGA,IAAA,IAAI,OAAO,cAAc,QAAA,EAAU;AACjC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,SAAS,CAAA;AACnC,MAAA,IAAI,OAAO,KAAA,CAAM,MAAM,KAAK,MAAA,IAAU,IAAA,CAAK,KAAI,EAAG;AAChD,QAAA,OAAO,EAAE,QAAQ,KAAA,EAAM;AAAA,MACzB;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAOA,QAAO,UAAU,CAAA;AAE9B,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,IAAA;AAAA,MACR,MAAA,EAAQ,KAAA;AAAA,MACR,GAAA;AAAA,MACA,GAAA;AAAA,MACA,QAAA,EAAU,OAAO,IAAA,KAAS,QAAA,IAAY,mBAAmB,GAAA,CAAI,IAAI,IAAK,IAAA,GAA4B,IAAA;AAAA,MAClG,aAAa,WAAA,CAAY,MAAA,CAAO,CAAC,KAAA,KAA2B,QAAA,CAAS,KAAK,CAAC,CAAA;AAAA,MAC3E,SAAA,EAAW,QAAA;AAAA,MACX,UAAA,EAAY,OAAO,SAAA,KAAc,QAAA,GAAW,SAAA,GAAY;AAAA,KAC1D;AAAA,EACF;AAAA,EAEQ,QAAA,CAAS,UAAkB,MAAA,EAA4B;AAC7D,IAAA,MAAM,MAAA,GAAS,OAAO,UAAA,KAAe,IAAA,GAAO,OAAO,iBAAA,GAAoB,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,UAAU,CAAA;AACnG,IAAA,MAAM,KAAA,GAAQ,KAAK,GAAA,CAAI,IAAA,CAAK,KAAI,GAAI,IAAA,CAAK,YAAY,MAAM,CAAA;AAE3D,IAAA,IAAI,IAAA,CAAK,KAAA,CAAM,IAAA,IAAQ,iBAAA,EAAmB;AACxC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,IAAA,GAAO,IAAA,EAAK;AACtC,MAAA,IAAI,CAAC,OAAO,IAAA,EAAM;AAChB,QAAA,IAAA,CAAK,KAAA,CAAM,MAAA,CAAO,MAAA,CAAO,KAAK,CAAA;AAAA,MAChC;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,MAAM,GAAA,CAAI,QAAA,EAAU,EAAE,MAAA,EAAQ,OAAO,CAAA;AAAA,EAC5C;AACF;AAEA,SAAS,SAAS,KAAA,EAAiC;AACjD,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,IAAY,KAAA,KAAU,EAAA;AAChD;AAGA,eAAe,OAAO,GAAA,EAA8B;AAClD,EAAA,MAAM,KAAA,GAAQ,MAAM,MAAA,CAAO,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,IAAI,WAAA,EAAY,CAAE,MAAA,CAAO,GAAG,CAAC,CAAA;AACjF,EAAA,OAAO,MAAM,IAAA,CAAK,IAAI,WAAW,KAAK,CAAA,EAAG,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,EAAE,EAAE,QAAA,CAAS,CAAA,EAAG,GAAG,CAAC,CAAA,CAAE,KAAK,EAAE,CAAA;AAChG;;;AC1QO,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YACW,OAAA,EACA,YAAA,EACA,QAAA,EACA,gBAAA,EACA,oBACA,WAAA,EACT;AANS,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AACA,IAAA,IAAA,CAAA,YAAA,GAAA,YAAA;AACA,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AACA,IAAA,IAAA,CAAA,gBAAA,GAAA,gBAAA;AACA,IAAA,IAAA,CAAA,kBAAA,GAAA,kBAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EACR;AAAA,EANQ,OAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,gBAAA;AAAA,EACA,kBAAA;AAAA,EACA,WAAA;AAAA,EAGX,OAAO,UAAA,EAA6B;AAClC,IAAA,OAAO,IAAA,CAAK,kBAAA,IAAsB,IAAA,CAAK,WAAA,CAAY,UAAU,CAAA,KAAM,IAAA;AAAA,EACrE;AAAA,EAEA,OAAA,GAAmB;AACjB,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,WAAW,CAAA;AAC7C,IAAA,OAAO,IAAA,CAAK,sBAAsB,MAAA,CAAO,MAAA,GAAS,KAAK,MAAA,CAAO,KAAA,CAAM,CAAA,KAAA,KAAS,KAAA,KAAU,IAAI,CAAA;AAAA,EAC7F;AACF;AAGA,eAAsB,gBAAA,CACpB,MAAA,EACA,WAAA,EACA,OAAA,EACA,cACA,WAAA,EAC6B;AAC7B,EAAA,kBAAA,CAAmB,OAAO,MAAM,CAAA;AAChC,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,MAAA,CAAO,MAAM,CAAA;AACpC,EAAA,IAAI,MAAA,CAAO,YAAY,MAAA,CAAO,QAAA,IAAY,OAAO,MAAA,IAAU,MAAA,CAAO,QAAQ,CAAC,MAAA,CAAO,YAC7E,CAAC,OAAA,IAAW,iBAAiB,EAAA,IAAM,CAAC,eAAe,WAAA,CAAY,MAAA,GAAS,SACxE,iBAAA,CAAkB,IAAA,CAAK,WAAW,CAAA,IAAK,CAAC,YAAY,MAAA,IAAU,WAAA,CAAY,SAAS,EAAA,IACnF,WAAA,CAAY,KAAK,CAAA,UAAA,KAAc,CAAC,WAAW,IAAA,EAAK,IAAK,IAAI,WAAA,EAAY,CAAE,OAAO,UAAU,CAAA,CAAE,MAAA,GAAS,GAAG,CAAA,EAAG;AAC5G,IAAA,MAAM,IAAI,mBAAmB,yDAAyD,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,YAAY,CAAC,GAAG,IAAI,GAAA,CAAI,WAAW,CAAC,CAAA;AAC1C,EAAA,IAAI;AACF,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,EAAG,MAAA,CAAO,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,gBAAA,CAAA,EAAoB;AAAA,MAClF,MAAA,EAAQ,MAAA;AAAA,MAAQ,QAAA,EAAU,OAAA;AAAA,MAAS,KAAA,EAAO,UAAA;AAAA,MAC1C,MAAA,EAAQ,YAAY,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,EAAG,MAAA,CAAO,SAAA,IAAa,GAAM,CAAC,CAAA;AAAA,MACnE,OAAA,EAAS,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,WAAW,CAAA,CAAA,EAAI,MAAA,EAAQ,kBAAA,EAAoB,cAAA,EAAgB,kBAAA,EAAmB;AAAA,MAClH,IAAA,EAAM,KAAK,SAAA,CAAU,EAAE,SAAS,GAAA,EAAK,YAAA,EAAc,UAAA,EAAY,SAAA,EAAW;AAAA,KAC3E,CAAA;AACD,IAAA,IAAI,QAAA,CAAS,WAAW,GAAA,EAAK;AAC3B,MAAA,MAAM,QAAA,CAAS,MAAM,MAAA,EAAO;AAC5B,MAAA,MAAM,IAAI,mBAAA,CAAoB,4CAAA,EAA8C,KAAA,CAAA,EAAW,KAAA,CAAA,EAAW,SAAS,MAAM,CAAA;AAAA,IACnH;AACA,IAAA,MAAM,MAAA,GAAS,QAAA,CAAS,IAAA,EAAM,SAAA,EAAU;AACxC,IAAA,IAAI,CAAC,MAAA,EAAQ,MAAM,IAAI,oBAAoB,0CAA0C,CAAA;AACrF,IAAA,IAAI,IAAA,GAAO,CAAA;AACX,IAAA,IAAI,GAAA,GAAM,EAAA;AACV,IAAA,MAAM,OAAA,GAAU,IAAI,WAAA,EAAY;AAChC,IAAA,IAAI;AACF,MAAA,WAAS;AACP,QAAA,MAAM,EAAE,KAAA,EAAO,IAAA,EAAK,GAAI,MAAM,OAAO,IAAA,EAAK;AAC1C,QAAA,IAAI,IAAA,EAAM;AACV,QAAA,IAAA,IAAQ,KAAA,CAAM,UAAA;AACd,QAAA,IAAI,IAAA,GAAO,KAAA,EAAO,MAAM,IAAI,oBAAoB,kDAAkD,CAAA;AAClG,QAAA,GAAA,IAAO,QAAQ,MAAA,CAAO,KAAA,EAAO,EAAE,MAAA,EAAQ,MAAM,CAAA;AAAA,MAC/C;AACA,MAAA,GAAA,IAAO,QAAQ,MAAA,EAAO;AAAA,IACxB,CAAA,SAAE;AACA,MAAA,MAAM,OAAO,MAAA,EAAO;AACpB,MAAA,MAAA,CAAO,WAAA,EAAY;AAAA,IACrB;AACA,IAAA,MAAM,IAAA,GAAgB,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AACpC,IAAA,IAAI,CAAC,MAAA,CAAO,IAAI,CAAA,IAAK,CAAC,MAAA,CAAO,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA,CAAK,IAAA,KAAS,MAAA,IACvD,KAAK,OAAA,CAAQ,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,OAAA,CAAQ,EAAA,KAAO,OAAA,IACpD,IAAA,CAAK,YAAA,KAAiB,YAAA,IAAgB,IAAA,CAAK,SAAA,KAAc,MAAA,CAAO,QAAA,IAChE,OAAO,IAAA,CAAK,wBAAwB,SAAA,IAAa,OAAO,IAAA,CAAK,OAAA,KAAY,SAAA,IACzE,EAAE,IAAA,CAAK,QAAA,KAAa,IAAA,IAAS,OAAO,IAAA,CAAK,QAAA,KAAa,QAAA,IACpD,CAAC,OAAA,EAAS,OAAA,EAAS,aAAa,QAAA,EAAU,QAAQ,CAAA,CAAE,QAAA,CAAS,IAAA,CAAK,QAAQ,CAAA,CAAA,IAC5E,CAAC,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,OAAO,CAAA,IAAK,IAAA,CAAK,OAAA,CAAQ,MAAA,KAAW,UAAU,MAAA,EAAQ;AAC7E,MAAA,MAAM,IAAI,oBAAoB,kDAAkD,CAAA;AAAA,IAClF;AACA,IAAA,MAAM,MAAA,mBAAkC,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA;AAC1D,IAAA,KAAA,MAAW,MAAA,IAAU,KAAK,OAAA,EAAsB;AAC9C,MAAA,IAAI,CAAC,OAAO,MAAM,CAAA,IAAK,OAAO,MAAA,CAAO,UAAA,KAAe,QAAA,IAAY,OAAO,MAAA,CAAO,OAAA,KAAY,aACrF,CAAC,SAAA,CAAU,QAAA,CAAS,MAAA,CAAO,UAAU,CAAA,IAAK,OAAO,MAAA,CAAO,MAAA,EAAQ,MAAA,CAAO,UAAU,CAAA,EAAG;AACvF,QAAA,MAAM,IAAI,oBAAoB,wCAAwC,CAAA;AAAA,MACxE;AACA,MAAA,MAAA,CAAO,MAAA,CAAO,UAAU,CAAA,GAAI,MAAA,CAAO,OAAA;AAAA,IACrC;AACA,IAAA,MAAM,WAAW,IAAI,kBAAA;AAAA,MAAmB,OAAA;AAAA,MAAS,YAAA;AAAA,MAAc,MAAA,CAAO,QAAA;AAAA,MACpE,IAAA,CAAK,QAAA;AAAA,MAAqC,IAAA,CAAK,mBAAA;AAAA,MAAqB,MAAA,CAAO,OAAO,MAAM;AAAA,KAAC;AAC3F,IAAA,IAAI,IAAA,CAAK,YAAY,QAAA,CAAS,OAAA,IAAW,MAAM,IAAI,oBAAoB,6CAA6C,CAAA;AACpH,IAAA,OAAO,QAAA;AAAA,EACT,SAAS,KAAA,EAAO;AACd,IAAA,IAAI,KAAA,YAAiB,qBAAqB,MAAM,KAAA;AAChD,IAAA,MAAM,IAAI,oBAAoB,4CAA4C,CAAA;AAAA,EAC5E;AACF;AAEA,SAAS,OAAO,KAAA,EAAkD;AAChE,EAAA,OAAO,KAAA,KAAU,QAAQ,OAAO,KAAA,KAAU,YAAY,CAAC,KAAA,CAAM,QAAQ,KAAK,CAAA;AAC5E","file":"server.cjs","sourcesContent":["/**\n * Base class for every error this SDK throws, so callers can `catch (e) { if (e\n * instanceof CboxIdError) ... }` in one branch.\n */\nexport class CboxIdError extends Error {\n  constructor(message: string) {\n    super(message);\n    this.name = new.target.name;\n  }\n}\n\n/** The client is misconfigured (a required option is missing or empty). */\nexport class ConfigurationError extends CboxIdError {}\n\n/**\n * The login `state` did not match what was stored — the callback is forged or\n * stale. Treat as a fresh start, not an error to surface to the user.\n */\nexport class InvalidStateError extends CboxIdError {}\n\n/**\n * Login could not be completed: the provider returned an error, the callback was\n * missing a code, or a token / id_token failed verification.\n *\n * `error` carries the RFC 6749 §5.2 code the authorization server sent, when it sent one.\n * It used to be discarded at every back-channel boundary, leaving a single message string\n * for outcomes that need opposite responses: `invalid_grant` on a refresh means the\n * session is over and the person has to sign in again, while `temporarily_unavailable`\n * means try the same token in a moment. A caller reduced to matching on prose either\n * retries what can never succeed, or signs out somebody who did not need to be.\n */\nexport class AuthenticationError extends CboxIdError {\n  constructor(\n    message: string,\n    /** RFC 6749 §5.2 error code, when the server sent a parseable one. */\n    readonly error?: string,\n    /** The server's `error_description`, verbatim. Not end-user copy. */\n    readonly errorDescription?: string,\n    /** HTTP status, for the cases where the body says nothing useful. */\n    readonly status?: number,\n    /**\n     * Seconds to wait, off the `Retry-After` header — set only on a 429.\n     *\n     * The distinction it carries is the one a caller most needs and could least infer:\n     * a 429 is the ONLY back-channel failure where the same request will succeed\n     * unchanged if you simply wait. Every other one needs a different request, or a new\n     * sign-in. Without this the SDK reported \"token refresh failed\" and a caller with a\n     * retry loop hammered a limiter that was already telling it exactly how long to stop.\n     */\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n\n  /** Whether waiting `retryAfter` seconds and repeating the same request is worth it. */\n  get isRateLimited(): boolean {\n    return this.status === 429;\n  }\n}\n\n/**\n * Read an OAuth error out of a failed token-endpoint response.\n *\n * Best-effort by design: a 502 from a proxy is HTML, a captive portal is worse, and the\n * caller still needs an error rather than a parse exception. What it must never do is\n * invent a code — an absent or unparseable `error` stays undefined, so\n * `e.error === 'invalid_grant'` is true only because the server said so.\n */\nexport async function oauthError(response: Response, fallback: string): Promise<AuthenticationError> {\n  const body = await response.text().catch(() => '');\n\n  let code: string | undefined;\n  let description: string | undefined;\n\n  try {\n    const parsed: unknown = JSON.parse(body);\n\n    if (typeof parsed === 'object' && parsed !== null) {\n      const { error, error_description: errorDescription } = parsed as Record<string, unknown>;\n      code = typeof error === 'string' ? error : undefined;\n      description = typeof errorDescription === 'string' ? errorDescription : undefined;\n    }\n  } catch {\n    // Not JSON. The status and the truncated body below are all there is to report.\n  }\n\n  // THE BODY IS NEVER ECHOED. These calls carry `client_secret`, `code_verifier` and\n  // refresh tokens in their REQUEST, and a debug proxy, a captive portal or an upstream\n  // error page that reflects what it received puts those straight into a thrown message\n  // — which production apps log. Only the server's own OAuth error code travels, and\n  // failing that, the status alone.\n  const detail = code ?? `HTTP ${response.status}`;\n\n  // `Retry-After` is seconds here — Laravel's throttler writes the integer form. The\n  // HTTP-date form is legal too and is deliberately NOT parsed: guessing at a clock\n  // skew is worse than saying nothing, and `status === 429` still tells the caller to\n  // back off.\n  const retryAfterHeader = response.headers.get('retry-after');\n  const retryAfter = retryAfterHeader !== null && /^\\d+$/.test(retryAfterHeader.trim())\n    ? Number(retryAfterHeader.trim())\n    : undefined;\n\n  return new AuthenticationError(`${fallback}: ${detail}`, code, description, response.status, retryAfter);\n}\n\n/**\n * The Frontend API refused, or could not be reached.\n *\n * Carries a `code` because the four ways this goes wrong need four different responses\n * from the caller, and telling them apart from a message string is the kind of thing\n * that works until somebody rewords the message:\n *\n *  - `origin_not_allowed` — the overwhelmingly likely cause of a refusal, and a\n *    configuration problem the developer fixes once in the console.\n *  - `rate_limited` — back off; `retryAfter` says for how long, when the server said.\n *  - `unavailable` — the network, or a 5xx. Transient by assumption; already retried.\n *  - `malformed` — a 200 whose body is not the document we expect, which means something\n *    between the page and us is rewriting responses (a proxy, an extension, a captive\n *    portal). Worth distinguishing, because retrying it never helps.\n */\nexport class FrontendApiError extends CboxIdError {\n  constructor(\n    message: string,\n    readonly code: 'origin_not_allowed' | 'rate_limited' | 'unavailable' | 'malformed',\n    readonly status?: number,\n    readonly retryAfter?: number,\n  ) {\n    super(message);\n  }\n}\n","import { ConfigurationError } from './errors.js';\n\n/**\n * An issuer must be HTTPS.\n *\n * Everything this SDK does with it carries a credential: the authorization code, the PKCE\n * verifier, the client secret, the refresh token. Over `http://` a network attacker reads\n * all of them — and, worse, replaces the discovery document and JWKS, at which point a\n * forged id_token verifies cleanly and the whole verification chain proves nothing.\n *\n * Loopback is allowed because a native app's own callback listener is loopback by\n * definition (RFC 8252) and a dev instance runs there.\n */\nexport function assertSecureIssuer(issuer: string): void {\n  let url: URL;\n\n  try {\n    url = new URL(issuer);\n  } catch {\n    throw new ConfigurationError('Cbox ID config `issuer` is not a valid URL.');\n  }\n\n  if (url.protocol === 'https:') {\n    return;\n  }\n\n  const loopback = url.hostname === 'localhost' || url.hostname === '127.0.0.1' || url.hostname === '[::1]' || url.hostname === '::1';\n\n  if (url.protocol === 'http:' && loopback) {\n    return;\n  }\n\n  throw new ConfigurationError(\n    `Cbox ID config \\`issuer\\` must be https (got ${url.protocol}//${url.hostname}).`,\n  );\n}\n","import type { OrganizationRole } from './claims.js';\nimport { AuthenticationError, ConfigurationError, oauthError } from './errors.js';\nimport { assertSecureIssuer } from './issuer.js';\n\n/**\n * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active\n * member of `org`.\n *\n * The field names are the endpoint's own, so the claim helpers read it like a token —\n * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type\n * alias rather than an interface for that reason: only an alias is assignable to the\n * helpers' record type.)\n */\nexport type ActiveApiKey = {\n  active: true;\n  /** The key's id — log this, never the key. */\n  key_id: string;\n  /** The person who holds the key (their subject id). */\n  sub: string;\n  /** The organization the key acts in. */\n  org: string;\n  /** The holder's membership tier in `org`; null for a tier this SDK does not know. */\n  org_role: OrganizationRole | null;\n  /**\n   * What the key may do, already re-capped by Cbox ID: the key's own list intersected\n   * with what the holder holds for your app right now. A demoted holder's key loses the\n   * permission on the next verification, not at the next reissue.\n   */\n  permissions: string[];\n  /** Your app's client id — always, or the answer is refused. */\n  client_id: string;\n  /** ISO 8601 UTC expiry, or null for a key that does not expire. */\n  expires_at: string | null;\n};\n\n/**\n * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who\n * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and\n * neither does this.\n */\nexport interface InactiveApiKey {\n  active: false;\n}\n\n/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */\nexport type ApiKeyVerification = ActiveApiKey | InactiveApiKey;\n\n/** Configuration for an {@link ApiKeyVerifier}. */\nexport interface ApiKeyVerifierConfig {\n  /** Base URL (issuer) of the Cbox ID instance. */\n  issuer: string;\n  /** Your app's OAuth client id — the app the keys were issued for. */\n  clientId: string;\n  /** Your app's client secret. Verification is a confidential-client call. */\n  clientSecret: string;\n  /** Timeout (ms) for the verification request. Defaults to `10000`. */\n  timeoutMs?: number;\n  /**\n   * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs\n   * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:\n   * while an answer is cached, a revoked key keeps working, and a demoted holder keeps\n   * the permissions they lost. Never cached past the key's `expires_at`. Refusals are\n   * never cached, so a key issued a moment ago works on its first request.\n   */\n  cacheTtlMs?: number;\n}\n\n/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */\nexport const MAX_API_KEY_CACHE_TTL_MS = 60_000;\n\n/** Enough for a busy API's working set; oldest entries go first beyond it. */\nconst MAX_CACHE_ENTRIES = 1_000;\n\nconst ORGANIZATION_ROLES: ReadonlySet<string> = new Set<OrganizationRole>([\n  'owner',\n  'admin',\n  'developer',\n  'member',\n  'viewer',\n]);\n\n/**\n * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,\n * authenticated with your app's own client credentials.\n *\n * SERVER-SIDE ONLY. It holds your client secret, so it lives in the\n * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a\n * browser bundle pulls in — and it refuses to be constructed in a browser at all.\n *\n * ```ts\n * import { ApiKeyVerifier } from '@cboxdk/id-js/server';\n * import { hasPermission } from '@cboxdk/id-js';\n *\n * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });\n *\n * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');\n * if (!answer.active) return unauthorized();\n * if (!hasPermission(answer, 'invoices:create')) return forbidden();\n * ```\n */\nexport class ApiKeyVerifier {\n  private readonly endpoint: string;\n  private readonly timeoutMs: number;\n  private readonly cacheTtlMs: number;\n  private readonly cache = new Map<string, { answer: ActiveApiKey; until: number }>();\n\n  constructor(private readonly config: ApiKeyVerifierConfig) {\n    // A heuristic, and enough of one: a page has a `document`, and no server runtime\n    // this SDK supports (Node, Deno, Bun, edge workers) defines one.\n    if (typeof (globalThis as { document?: unknown }).document !== 'undefined') {\n      throw new ConfigurationError(\n        'API key verification uses your client secret and must run on your server, never in a browser.',\n      );\n    }\n    if (!config.issuer || !config.clientId || !config.clientSecret) {\n      throw new ConfigurationError('Verifying API keys needs issuer, clientId and clientSecret.');\n    }\n    assertSecureIssuer(config.issuer);\n\n    const cacheTtlMs = config.cacheTtlMs ?? 0;\n    if (!Number.isFinite(cacheTtlMs) || cacheTtlMs < 0 || cacheTtlMs > MAX_API_KEY_CACHE_TTL_MS) {\n      throw new ConfigurationError(\n        `cacheTtlMs must be between 0 and ${MAX_API_KEY_CACHE_TTL_MS}: a cached answer keeps a revoked key working for that long.`,\n      );\n    }\n\n    this.endpoint = `${config.issuer.replace(/\\/$/, '')}/oauth/api-keys/verify`;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.cacheTtlMs = cacheTtlMs;\n  }\n\n  /**\n   * Ask Cbox ID whether `key` is good for this app, and what it may do.\n   *\n   * Resolves `{ active: false }` for every kind of bad key, without a request for an empty\n   * one. Throws `AuthenticationError` when the call itself fails (wrong client\n   * credentials, an unreachable instance) or when the answer cannot be trusted — one that\n   * names another app's `client_id`, or does not have the promised shape. Both mean \"do\n   * not let this request in\"; the difference is that a throw is something to look at.\n   */\n  async verifyApiKey(key: string): Promise<ApiKeyVerification> {\n    if (typeof key !== 'string' || key.trim() === '') {\n      return { active: false };\n    }\n\n    const cacheKey = this.cacheTtlMs > 0 ? await digest(key) : null;\n    if (cacheKey !== null) {\n      const hit = this.cache.get(cacheKey);\n      if (hit && hit.until > Date.now()) {\n        return hit.answer;\n      }\n      this.cache.delete(cacheKey);\n    }\n\n    const answer = this.parse(await this.request(key));\n\n    if (cacheKey !== null && answer.active) {\n      this.remember(cacheKey, answer);\n    }\n\n    return answer;\n  }\n\n  private async request(key: string): Promise<unknown> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await fetch(this.endpoint, {\n        method: 'POST',\n        headers: {\n          authorization: `Basic ${btoa(`${this.config.clientId}:${this.config.clientSecret}`)}`,\n          accept: 'application/json',\n          'content-type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({ key }),\n        signal: controller.signal,\n      });\n    } catch (error) {\n      throw new AuthenticationError(`API key verification request failed: ${String(error)}`);\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      throw await oauthError(response, 'API key verification failed');\n    }\n\n    return response.json().catch(() => null);\n  }\n\n  private parse(body: unknown): ApiKeyVerification {\n    if (typeof body !== 'object' || body === null) {\n      throw new AuthenticationError('API key verification returned a body that is not a JSON object.');\n    }\n\n    const record = body as Record<string, unknown>;\n\n    // Only a literal `true` lets anybody in.\n    if (record['active'] !== true) {\n      return { active: false };\n    }\n\n    const keyId = record['key_id'];\n    const sub = record['sub'];\n    const org = record['org'];\n    const clientId = record['client_id'];\n    const expiresAt = record['expires_at'];\n    const permissions = record['permissions'];\n\n    if (\n      !nonEmpty(keyId) ||\n      !nonEmpty(sub) ||\n      !nonEmpty(org) ||\n      !nonEmpty(clientId) ||\n      !Array.isArray(permissions) ||\n      (expiresAt !== null && expiresAt !== undefined && typeof expiresAt !== 'string')\n    ) {\n      throw new AuthenticationError('API key verification returned an active answer without the promised fields.');\n    }\n\n    // THE BINDING, CHECKED AGAIN HERE. Cbox ID only ever finds a key bound to the calling\n    // client, so this cannot fire against a correct instance — which is exactly when a\n    // check that it holds is worth having: a proxy, a misrouted base URL, or a shared\n    // secret between two apps would otherwise let one app's customers into another's API.\n    if (clientId !== this.config.clientId) {\n      throw new AuthenticationError(\n        `API key verification answered for client ${clientId}, not this app (${this.config.clientId}); refusing it.`,\n      );\n    }\n\n    // Past its expiry by our clock is expired, whatever the instance thought a moment ago.\n    if (typeof expiresAt === 'string') {\n      const expiry = Date.parse(expiresAt);\n      if (Number.isNaN(expiry) || expiry <= Date.now()) {\n        return { active: false };\n      }\n    }\n\n    const role = record['org_role'];\n\n    return {\n      active: true,\n      key_id: keyId,\n      sub,\n      org,\n      org_role: typeof role === 'string' && ORGANIZATION_ROLES.has(role) ? (role as OrganizationRole) : null,\n      permissions: permissions.filter((value): value is string => nonEmpty(value)),\n      client_id: clientId,\n      expires_at: typeof expiresAt === 'string' ? expiresAt : null,\n    };\n  }\n\n  private remember(cacheKey: string, answer: ActiveApiKey): void {\n    const expiry = answer.expires_at === null ? Number.POSITIVE_INFINITY : Date.parse(answer.expires_at);\n    const until = Math.min(Date.now() + this.cacheTtlMs, expiry);\n\n    if (this.cache.size >= MAX_CACHE_ENTRIES) {\n      const oldest = this.cache.keys().next();\n      if (!oldest.done) {\n        this.cache.delete(oldest.value);\n      }\n    }\n\n    this.cache.set(cacheKey, { answer, until });\n  }\n}\n\nfunction nonEmpty(value: unknown): value is string {\n  return typeof value === 'string' && value !== '';\n}\n\n/** The cache is keyed by a hash, so live keys are not sitting in memory as plaintext. */\nasync function digest(key: string): Promise<string> {\n  const bytes = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(key));\n  return Array.from(new Uint8Array(bytes), (byte) => byte.toString(16).padStart(2, '0')).join('');\n}\n","import { AuthenticationError, ConfigurationError } from './errors.js';\nimport { assertSecureIssuer } from './issuer.js';\nimport type { OrganizationRole } from './claims.js';\n\nexport interface PermissionDecisionConfig {\n  issuer: string;\n  clientId: string;\n  timeoutMs?: number;\n}\n\n/** A current server decision; shared membership tiers are not app grants. */\nexport class PermissionDecision {\n  constructor(\n    readonly subject: string,\n    readonly organization: string | null,\n    readonly clientId: string,\n    readonly organizationRole: OrganizationRole | null,\n    readonly organizationActive: boolean,\n    readonly permissions: Readonly<Record<string, boolean>>,\n  ) {}\n\n  allows(permission: string): boolean {\n    return this.organizationActive && this.permissions[permission] === true;\n  }\n\n  allowed(): boolean {\n    const values = Object.values(this.permissions);\n    return this.organizationActive && values.length > 0 && values.every(value => value === true);\n  }\n}\n\n/** No positive cache: check each request and again when queued work starts. */\nexport async function checkPermissions(\n  config: PermissionDecisionConfig,\n  accessToken: string,\n  subject: string,\n  organization: string | null,\n  permissions: readonly string[],\n): Promise<PermissionDecision> {\n  assertSecureIssuer(config.issuer);\n  const issuer = new URL(config.issuer);\n  if (issuer.username || issuer.password || issuer.search || issuer.hash || !config.clientId\n    || !subject || organization === '' || !accessToken || accessToken.length > 32768\n    || /[\\x00-\\x20\\x7f]/.test(accessToken) || !permissions.length || permissions.length > 50\n    || permissions.some(permission => !permission.trim() || new TextEncoder().encode(permission).length > 255)) {\n    throw new ConfigurationError('Permission decision request is not configured or valid.');\n  }\n  const requested = [...new Set(permissions)];\n  try {\n    const response = await fetch(`${config.issuer.replace(/\\/$/, '')}/oauth/decisions`, {\n      method: 'POST', redirect: 'error', cache: 'no-store',\n      signal: AbortSignal.timeout(Math.max(1, config.timeoutMs ?? 10_000)),\n      headers: { authorization: `Bearer ${accessToken}`, accept: 'application/json', 'content-type': 'application/json' },\n      body: JSON.stringify({ subject, org: organization, permission: requested }),\n    });\n    if (response.status !== 200) {\n      await response.body?.cancel();\n      throw new AuthenticationError('Permission decision could not be verified.', undefined, undefined, response.status);\n    }\n    const reader = response.body?.getReader();\n    if (!reader) throw new AuthenticationError('Permission decision response is invalid.');\n    let size = 0;\n    let raw = '';\n    const decoder = new TextDecoder();\n    try {\n      for (;;) {\n        const { value, done } = await reader.read();\n        if (done) break;\n        size += value.byteLength;\n        if (size > 65536) throw new AuthenticationError('Permission decision response exceeded its limit.');\n        raw += decoder.decode(value, { stream: true });\n      }\n      raw += decoder.decode();\n    } finally {\n      await reader.cancel();\n      reader.releaseLock();\n    }\n    const data: unknown = JSON.parse(raw);\n    if (!record(data) || !record(data.subject) || data.mode !== 'rbac'\n      || data.subject.type !== 'user' || data.subject.id !== subject\n      || data.organization !== organization || data.client_id !== config.clientId\n      || typeof data.organization_active !== 'boolean' || typeof data.allowed !== 'boolean'\n      || !(data.org_role === null || (typeof data.org_role === 'string'\n        && ['owner', 'admin', 'developer', 'member', 'viewer'].includes(data.org_role)))\n      || !Array.isArray(data.results) || data.results.length !== requested.length) {\n      throw new AuthenticationError('Permission decision response binding is invalid.');\n    }\n    const checks: Record<string, boolean> = Object.create(null) as Record<string, boolean>;\n    for (const result of data.results as unknown[]) {\n      if (!record(result) || typeof result.permission !== 'string' || typeof result.allowed !== 'boolean'\n        || !requested.includes(result.permission) || Object.hasOwn(checks, result.permission)) {\n        throw new AuthenticationError('Permission decision result is invalid.');\n      }\n      checks[result.permission] = result.allowed;\n    }\n    const decision = new PermissionDecision(subject, organization, config.clientId,\n      data.org_role as OrganizationRole | null, data.organization_active, Object.freeze(checks));\n    if (data.allowed !== decision.allowed()) throw new AuthenticationError('Permission decision result is inconsistent.');\n    return decision;\n  } catch (error) {\n    if (error instanceof AuthenticationError) throw error;\n    throw new AuthenticationError('Permission decision could not be verified.');\n  }\n}\n\nfunction record(value: unknown): value is Record<string, unknown> {\n  return value !== null && typeof value === 'object' && !Array.isArray(value);\n}\n"]}

package/dist/server.d.cts

@@ -1,105 +1,3 @@
-import { O as OrganizationRole } from './types-BYZldock.cjs';
-
-/**
- * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active
- * member of `org`.
- *
- * The field names are the endpoint's own, so the claim helpers read it like a token —
- * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type
- * alias rather than an interface for that reason: only an alias is assignable to the
- * helpers' record type.)
- */
-type ActiveApiKey = {
-    active: true;
-    /** The key's id — log this, never the key. */
-    key_id: string;
-    /** The person who holds the key (their subject id). */
-    sub: string;
-    /** The organization the key acts in. */
-    org: string;
-    /** The holder's membership tier in `org`; null for a tier this SDK does not know. */
-    org_role: OrganizationRole | null;
-    /**
-     * What the key may do, already re-capped by Cbox ID: the key's own list intersected
-     * with what the holder holds for your app right now. A demoted holder's key loses the
-     * permission on the next verification, not at the next reissue.
-     */
-    permissions: string[];
-    /** Your app's client id — always, or the answer is refused. */
-    client_id: string;
-    /** ISO 8601 UTC expiry, or null for a key that does not expire. */
-    expires_at: string | null;
-};
-/**
- * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who
- * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and
- * neither does this.
- */
-interface InactiveApiKey {
-    active: false;
-}
-/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */
-type ApiKeyVerification = ActiveApiKey | InactiveApiKey;
-/** Configuration for an {@link ApiKeyVerifier}. */
-interface ApiKeyVerifierConfig {
-    /** Base URL (issuer) of the Cbox ID instance. */
-    issuer: string;
-    /** Your app's OAuth client id — the app the keys were issued for. */
-    clientId: string;
-    /** Your app's client secret. Verification is a confidential-client call. */
-    clientSecret: string;
-    /** Timeout (ms) for the verification request. Defaults to `10000`. */
-    timeoutMs?: number;
-    /**
-     * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs
-     * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:
-     * while an answer is cached, a revoked key keeps working, and a demoted holder keeps
-     * the permissions they lost. Never cached past the key's `expires_at`. Refusals are
-     * never cached, so a key issued a moment ago works on its first request.
-     */
-    cacheTtlMs?: number;
-}
-/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */
-declare const MAX_API_KEY_CACHE_TTL_MS = 60000;
-/**
- * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,
- * authenticated with your app's own client credentials.
- *
- * SERVER-SIDE ONLY. It holds your client secret, so it lives in the
- * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a
- * browser bundle pulls in — and it refuses to be constructed in a browser at all.
- *
- * ```ts
- * import { ApiKeyVerifier } from '@cboxdk/id-js/server';
- * import { hasPermission } from '@cboxdk/id-js';
- *
- * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });
- *
- * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');
- * if (!answer.active) return unauthorized();
- * if (!hasPermission(answer, 'invoices:create')) return forbidden();
- * ```
- */
-declare class ApiKeyVerifier {
-    private readonly config;
-    private readonly endpoint;
-    private readonly timeoutMs;
-    private readonly cacheTtlMs;
-    private readonly cache;
-    constructor(config: ApiKeyVerifierConfig);
-    /**
-     * Ask Cbox ID whether `key` is good for this app, and what it may do.
-     *
-     * Resolves `{ active: false }` for every kind of bad key, without a request for an empty
-     * one. Throws `AuthenticationError` when the call itself fails (wrong client
-     * credentials, an unreachable instance) or when the answer cannot be trusted — one that
-     * names another app's `client_id`, or does not have the promised shape. Both mean "do
-     * not let this request in"; the difference is that a throw is something to look at.
-     */
-    verifyApiKey(key: string): Promise<ApiKeyVerification>;
-    private request;
-    private parse;
-    private remember;
-}
-
-export { type ActiveApiKey, type ApiKeyVerification, ApiKeyVerifier, type ApiKeyVerifierConfig, type InactiveApiKey, MAX_API_KEY_CACHE_TTL_MS };
+export { A as ActiveApiKey, a as ApiKeyVerification, b as ApiKeyVerifier, c as ApiKeyVerifierConfig, I as InactiveApiKey, M as MAX_API_KEY_CACHE_TTL_MS } from './api-keys-C8-Q4eFA.cjs';
+export { P as PermissionDecision, a as PermissionDecisionConfig, c as checkPermissions } from './decisions-DNd9UXwi.cjs';
+import './types-CC1bz68x.cjs';

package/dist/server.d.ts

@@ -1,105 +1,3 @@
-import { O as OrganizationRole } from './types-BYZldock.js';
-
-/**
- * A customer API key Cbox ID vouches for: live, bound to YOUR app, and held by an active
- * member of `org`.
- *
- * The field names are the endpoint's own, so the claim helpers read it like a token —
- * `hasPermission(answer, 'invoices:create')`, `organization(answer)?.role`. (A type
- * alias rather than an interface for that reason: only an alias is assignable to the
- * helpers' record type.)
- */
-type ActiveApiKey = {
-    active: true;
-    /** The key's id — log this, never the key. */
-    key_id: string;
-    /** The person who holds the key (their subject id). */
-    sub: string;
-    /** The organization the key acts in. */
-    org: string;
-    /** The holder's membership tier in `org`; null for a tier this SDK does not know. */
-    org_role: OrganizationRole | null;
-    /**
-     * What the key may do, already re-capped by Cbox ID: the key's own list intersected
-     * with what the holder holds for your app right now. A demoted holder's key loses the
-     * permission on the next verification, not at the next reissue.
-     */
-    permissions: string[];
-    /** Your app's client id — always, or the answer is refused. */
-    client_id: string;
-    /** ISO 8601 UTC expiry, or null for a key that does not expire. */
-    expires_at: string | null;
-};
-/**
- * Every refusal: unknown, malformed, revoked, expired, another app's key, a holder who
- * left. Cbox ID never says which, so the endpoint cannot be used to probe keys — and
- * neither does this.
- */
-interface InactiveApiKey {
-    active: false;
-}
-/** What {@link ApiKeyVerifier.verifyApiKey} returns. Narrow on `active`. */
-type ApiKeyVerification = ActiveApiKey | InactiveApiKey;
-/** Configuration for an {@link ApiKeyVerifier}. */
-interface ApiKeyVerifierConfig {
-    /** Base URL (issuer) of the Cbox ID instance. */
-    issuer: string;
-    /** Your app's OAuth client id — the app the keys were issued for. */
-    clientId: string;
-    /** Your app's client secret. Verification is a confidential-client call. */
-    clientSecret: string;
-    /** Timeout (ms) for the verification request. Defaults to `10000`. */
-    timeoutMs?: number;
-    /**
-     * Cache an ACTIVE answer for this long (ms), so a burst of requests with one key costs
-     * one round-trip. Off (`0`) by default and at most {@link MAX_API_KEY_CACHE_TTL_MS}:
-     * while an answer is cached, a revoked key keeps working, and a demoted holder keeps
-     * the permissions they lost. Never cached past the key's `expires_at`. Refusals are
-     * never cached, so a key issued a moment ago works on its first request.
-     */
-    cacheTtlMs?: number;
-}
-/** The longest {@link ApiKeyVerifierConfig.cacheTtlMs} allowed: one minute. */
-declare const MAX_API_KEY_CACHE_TTL_MS = 60000;
-/**
- * Verifies customer API keys presented to your API: `POST {issuer}/oauth/api-keys/verify`,
- * authenticated with your app's own client credentials.
- *
- * SERVER-SIDE ONLY. It holds your client secret, so it lives in the
- * `@cboxdk/id-js/server` entry and the Next.js adapter, never in the main entry that a
- * browser bundle pulls in — and it refuses to be constructed in a browser at all.
- *
- * ```ts
- * import { ApiKeyVerifier } from '@cboxdk/id-js/server';
- * import { hasPermission } from '@cboxdk/id-js';
- *
- * const keys = new ApiKeyVerifier({ issuer, clientId, clientSecret, cacheTtlMs: 10_000 });
- *
- * const answer = await keys.verifyApiKey(request.headers.get('x-api-key') ?? '');
- * if (!answer.active) return unauthorized();
- * if (!hasPermission(answer, 'invoices:create')) return forbidden();
- * ```
- */
-declare class ApiKeyVerifier {
-    private readonly config;
-    private readonly endpoint;
-    private readonly timeoutMs;
-    private readonly cacheTtlMs;
-    private readonly cache;
-    constructor(config: ApiKeyVerifierConfig);
-    /**
-     * Ask Cbox ID whether `key` is good for this app, and what it may do.
-     *
-     * Resolves `{ active: false }` for every kind of bad key, without a request for an empty
-     * one. Throws `AuthenticationError` when the call itself fails (wrong client
-     * credentials, an unreachable instance) or when the answer cannot be trusted — one that
-     * names another app's `client_id`, or does not have the promised shape. Both mean "do
-     * not let this request in"; the difference is that a throw is something to look at.
-     */
-    verifyApiKey(key: string): Promise<ApiKeyVerification>;
-    private request;
-    private parse;
-    private remember;
-}
-
-export { type ActiveApiKey, type ApiKeyVerification, ApiKeyVerifier, type ApiKeyVerifierConfig, type InactiveApiKey, MAX_API_KEY_CACHE_TTL_MS };
+export { A as ActiveApiKey, a as ApiKeyVerification, b as ApiKeyVerifier, c as ApiKeyVerifierConfig, I as InactiveApiKey, M as MAX_API_KEY_CACHE_TTL_MS } from './api-keys-BE3R3q_A.js';
+export { P as PermissionDecision, a as PermissionDecisionConfig, c as checkPermissions } from './decisions-C84Fzah4.js';
+import './types-CC1bz68x.js';

package/dist/server.js

@@ -1,3 +1,4 @@
+export { PermissionDecision, checkPermissions } from './chunk-EVZ6RB3K.js';
 export { ApiKeyVerifier, MAX_API_KEY_CACHE_TTL_MS } from './chunk-2E25IPBA.js';
 import './chunk-QQW63PGU.js';
 import './chunk-SEUD4TE4.js';

package/dist/{types-BYZldock.d.cts → types-CC1bz68x.d.cts}

@@ -85,6 +85,29 @@ declare function hasRole(source: ClaimSource, role: string): boolean;
  * issuing side ever mints one.
  */
 declare function hasPermission(source: ClaimSource, permission: string): boolean;
+/**
+ * The scope that puts the `feature_flags` claim on the ID token, the access token and
+ * UserInfo. Request it at sign-in (`scopes: ['openid', 'profile', FEATURE_FLAGS_SCOPE]`)
+ * and give the app the scope on its Scopes tab.
+ */
+declare const FEATURE_FLAGS_SCOPE = "feature_flags";
+/**
+ * The keys of the feature flags that are on for this person, in the organization the
+ * session is bound to — the `feature_flags` claim, sorted as the server sent it.
+ *
+ * NULL IS NOT EMPTY. `null` means the claim is absent: the `feature_flags` scope was not
+ * requested, or the instance predates it. `[]` means it was asked and nothing is on. A
+ * token carries the flags as they were when it was issued; the next refresh, or UserInfo,
+ * picks up a change.
+ */
+declare function featureFlags(source: ClaimSource): string[] | null;
+/**
+ * Whether the feature flag `key` is on for this session. Exact match on the key.
+ *
+ * False when the claim is absent — an app that forgot to request the scope sees every
+ * feature off, never every feature on. Use {@link featureFlags} to tell the two apart.
+ */
+declare function hasFeature(source: ClaimSource, key: string): boolean;
 
 /** Configuration for a {@link CboxIdClient}. */
 interface CboxIdConfig {
@@ -289,6 +312,12 @@ interface CboxUser {
     roles: string[];
     /** Permissions held in this session (`permissions` claim); empty when there are none. */
     permissions: string[];
+    /**
+     * The keys of the feature flags on for this person in this organization (the
+     * `feature_flags` claim), or null when the claim is absent — the `feature_flags` scope
+     * was not requested. See `featureFlags()` / `hasFeature()`.
+     */
+    featureFlags: string[] | null;
     /**
      * Set when this is a SUPPORT SESSION — a staff member acting as this person (the RFC
      * 8693 `act` claim). Null for an ordinary sign-in. Show it: see `isSupportSession()`.
@@ -313,4 +342,4 @@ interface CboxUser {
     expiresIn: number;
 }
 
-export { type AuthorizationRequestOptions as A, type CboxUser as C, type DeviceAuthorization as D, type OrganizationRole as O, type RefreshedTokens as R, type TokenTypeHint as T, type CboxIdConfig as a, type AuthorizationRequest as b, type AuthorizationPrompt as c, type CboxActiveOrganization as d, type CboxActor as e, type CboxOrganization as f, type ClaimSource as g, type DiscoveryDocument as h, type TokenResponse as i, actor as j, hasPermission as k, hasRole as l, isSupportSession as m, organization as o, permissions as p, roles as r, sessionId as s };
+export { type AuthorizationRequestOptions as A, type CboxUser as C, type DeviceAuthorization as D, FEATURE_FLAGS_SCOPE as F, type OrganizationRole as O, type RefreshedTokens as R, type TokenTypeHint as T, type CboxIdConfig as a, type AuthorizationRequest as b, type AuthorizationPrompt as c, type CboxActiveOrganization as d, type CboxActor as e, type CboxOrganization as f, type ClaimSource as g, type DiscoveryDocument as h, type TokenResponse as i, actor as j, featureFlags as k, hasFeature as l, hasPermission as m, hasRole as n, isSupportSession as o, organization as p, permissions as q, roles as r, sessionId as s };

package/dist/{types-BYZldock.d.ts → types-CC1bz68x.d.ts}

@@ -85,6 +85,29 @@ declare function hasRole(source: ClaimSource, role: string): boolean;
  * issuing side ever mints one.
  */
 declare function hasPermission(source: ClaimSource, permission: string): boolean;
+/**
+ * The scope that puts the `feature_flags` claim on the ID token, the access token and
+ * UserInfo. Request it at sign-in (`scopes: ['openid', 'profile', FEATURE_FLAGS_SCOPE]`)
+ * and give the app the scope on its Scopes tab.
+ */
+declare const FEATURE_FLAGS_SCOPE = "feature_flags";
+/**
+ * The keys of the feature flags that are on for this person, in the organization the
+ * session is bound to — the `feature_flags` claim, sorted as the server sent it.
+ *
+ * NULL IS NOT EMPTY. `null` means the claim is absent: the `feature_flags` scope was not
+ * requested, or the instance predates it. `[]` means it was asked and nothing is on. A
+ * token carries the flags as they were when it was issued; the next refresh, or UserInfo,
+ * picks up a change.
+ */
+declare function featureFlags(source: ClaimSource): string[] | null;
+/**
+ * Whether the feature flag `key` is on for this session. Exact match on the key.
+ *
+ * False when the claim is absent — an app that forgot to request the scope sees every
+ * feature off, never every feature on. Use {@link featureFlags} to tell the two apart.
+ */
+declare function hasFeature(source: ClaimSource, key: string): boolean;
 
 /** Configuration for a {@link CboxIdClient}. */
 interface CboxIdConfig {
@@ -289,6 +312,12 @@ interface CboxUser {
     roles: string[];
     /** Permissions held in this session (`permissions` claim); empty when there are none. */
     permissions: string[];
+    /**
+     * The keys of the feature flags on for this person in this organization (the
+     * `feature_flags` claim), or null when the claim is absent — the `feature_flags` scope
+     * was not requested. See `featureFlags()` / `hasFeature()`.
+     */
+    featureFlags: string[] | null;
     /**
      * Set when this is a SUPPORT SESSION — a staff member acting as this person (the RFC
      * 8693 `act` claim). Null for an ordinary sign-in. Show it: see `isSupportSession()`.
@@ -313,4 +342,4 @@ interface CboxUser {
     expiresIn: number;
 }
 
-export { type AuthorizationRequestOptions as A, type CboxUser as C, type DeviceAuthorization as D, type OrganizationRole as O, type RefreshedTokens as R, type TokenTypeHint as T, type CboxIdConfig as a, type AuthorizationRequest as b, type AuthorizationPrompt as c, type CboxActiveOrganization as d, type CboxActor as e, type CboxOrganization as f, type ClaimSource as g, type DiscoveryDocument as h, type TokenResponse as i, actor as j, hasPermission as k, hasRole as l, isSupportSession as m, organization as o, permissions as p, roles as r, sessionId as s };
+export { type AuthorizationRequestOptions as A, type CboxUser as C, type DeviceAuthorization as D, FEATURE_FLAGS_SCOPE as F, type OrganizationRole as O, type RefreshedTokens as R, type TokenTypeHint as T, type CboxIdConfig as a, type AuthorizationRequest as b, type AuthorizationPrompt as c, type CboxActiveOrganization as d, type CboxActor as e, type CboxOrganization as f, type ClaimSource as g, type DiscoveryDocument as h, type TokenResponse as i, actor as j, featureFlags as k, hasFeature as l, hasPermission as m, hasRole as n, isSupportSession as o, organization as p, permissions as q, roles as r, sessionId as s };