@cleverbrush/auth 0.0.0-beta-20260413195755

package/README.md

@@ -0,0 +1,163 @@
+# @cleverbrush/auth
+
+[![CI](https://github.com/cleverbrush/framework/actions/workflows/ci.yml/badge.svg)](https://github.com/cleverbrush/framework/actions/workflows/ci.yml)
+[![License: BSD-3-Clause](https://img.shields.io/badge/license-BSD--3--Clause-blue.svg)](../../LICENSE)
+
+Transport-agnostic authentication and authorization for TypeScript. Ships with JWT and cookie schemes, a fluent policy builder, and a typed `Principal` value object. Designed for [`@cleverbrush/server`](../server) but usable in any Node.js context.
+
+## Features
+
+- **Transport-agnostic** — authentication schemes receive a plain `AuthenticationContext` (headers + cookies + items), not a raw HTTP request.
+- **`Principal<T>`** — immutable, typed value object exposing `.hasRole()`, `.hasClaim()`, `.isAuthenticated`, and `.claims`.
+- **JWT scheme** — `jwtScheme()` supports HS256/HS384/HS512 and RS256/RS384/RS512; configurable issuer, audience, clock tolerance, and role claim.
+- **Cookie scheme** — `cookieScheme()` with a user-supplied async `validate()` function (session lookup, signature check, etc.).
+- **Authorization** — `PolicyBuilder` with `.requireRole()` / `.require(predicate)` fluent API; `AuthorizationService.authorize()` accepts requirements or a named policy.
+- **`requireRole()` helper** — convenience factory for single-call role requirements.
+- **Cookie utilities** — `parseCookies()` and `serializeCookie()` for low-level cookie handling.
+- **Zero runtime dependencies** — uses only Node.js built-in `crypto`.
+
+## Installation
+
+```bash
+npm install @cleverbrush/auth
+```
+
+## Quick Start
+
+```ts
+import { jwtScheme, Principal } from '@cleverbrush/auth';
+
+type UserClaims = { sub: string; role: string };
+
+const jwt = jwtScheme<UserClaims>({
+    secret: process.env.JWT_SECRET!,
+    mapClaims: claims => ({
+        sub: claims.sub as string,
+        role: claims.role as string
+    })
+});
+
+// Authenticate a request context (built from HTTP headers)
+const result = await jwt.authenticate({
+    headers: { authorization: 'Bearer <token>' },
+    cookies: {},
+    items: new Map()
+});
+
+if (result.succeeded) {
+    const principal: Principal<UserClaims> = result.principal;
+    principal.isAuthenticated; // true
+    principal.hasRole('admin'); // boolean
+    principal.value.sub;       // string
+}
+```
+
+## JWT Authentication
+
+```ts
+import { jwtScheme, signJwt } from '@cleverbrush/auth';
+
+// Sign a token (for testing or token issuance)
+const token = signJwt({ sub: 'user-1', role: 'admin' }, 'my-secret');
+
+// Verify and authenticate
+const scheme = jwtScheme({
+    secret: 'my-secret',
+    algorithms: ['HS256'],          // default
+    issuer: 'https://my-app.com',   // optional iss check
+    audience: 'my-api',             // optional aud check
+    clockTolerance: 5,              // seconds
+    roleClaim: 'role',              // default
+    mapClaims: c => ({ sub: c.sub as string, role: c.role as string })
+});
+```
+
+Supported algorithms: `HS256`, `HS384`, `HS512`, `RS256`, `RS384`, `RS512`.
+
+## Cookie Authentication
+
+```ts
+import { cookieScheme } from '@cleverbrush/auth';
+
+const cookie = cookieScheme<{ userId: string; role: string }>({
+    cookieName: 'session',
+    validate: async (cookieValue) => {
+        // Look up session from DB, verify signature, etc.
+        const session = await sessionStore.get(cookieValue);
+        if (!session) return null;
+        return { userId: session.userId, role: session.role };
+    }
+});
+```
+
+## Authorization
+
+### Policy Builder
+
+```ts
+import { PolicyBuilder, requireRole } from '@cleverbrush/auth';
+
+const adminPolicy = new PolicyBuilder()
+    .requireRole('admin')
+    .require(principal => principal.hasClaim('verified', 'true'))
+    .build('admin-only');
+```
+
+### Authorization Service
+
+```ts
+import { AuthorizationService } from '@cleverbrush/auth';
+
+const policies = new Map([['admin-only', adminPolicy]]);
+const authz = new AuthorizationService(policies);
+
+// Check by requirements array
+const result = await authz.authorize(principal, [requireRole('admin')]);
+
+// Check by named policy
+const result2 = await authz.authorize(principal, 'admin-only');
+
+if (!result.allowed) {
+    console.log(result.reason); // 'Not authenticated' | 'Forbidden'
+}
+```
+
+## Cookie Utilities
+
+```ts
+import { parseCookies, serializeCookie } from '@cleverbrush/auth';
+
+// Parse Cookie header
+const cookies = parseCookies('session=abc123; theme=dark');
+// { session: 'abc123', theme: 'dark' }
+
+// Build Set-Cookie header value
+const header = serializeCookie('session', 'abc123', {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'Lax',
+    maxAge: 3600
+});
+```
+
+## Integration with @cleverbrush/server
+
+```ts
+import { ServerBuilder } from '@cleverbrush/server';
+import { jwtScheme } from '@cleverbrush/auth';
+
+const server = new ServerBuilder();
+
+server
+    .useAuthentication({
+        defaultScheme: 'jwt',
+        schemes: [jwtScheme({ secret: process.env.JWT_SECRET!, mapClaims: c => c })]
+    })
+    .useAuthorization();
+
+await server.listen(3000);
+```
+
+## License
+
+BSD-3-Clause — see [LICENSE](../../LICENSE).

package/dist/AuthenticationScheme.d.ts

@@ -0,0 +1,43 @@
+import type { Principal } from './Principal.js';
+/**
+ * Transport-agnostic context passed to authentication schemes.
+ * HTTP middleware builds this from `RequestContext`; future transports
+ * (WebSocket, gRPC) provide the same shape.
+ */
+export interface AuthenticationContext {
+    readonly headers: Record<string, string>;
+    readonly cookies: Record<string, string>;
+    readonly items: Map<string, unknown>;
+}
+/**
+ * The result returned by {@link AuthenticationScheme.authenticate}.
+ * On success, provides a typed `Principal`; on failure, an optional reason.
+ */
+export type AuthenticationResult<T = unknown> = {
+    succeeded: true;
+    principal: Principal<T>;
+} | {
+    succeeded: false;
+    failure?: string;
+};
+/**
+ * An authentication scheme extracts and validates credentials from the
+ * transport-agnostic `AuthenticationContext`.
+ */
+export interface AuthenticationScheme<T = unknown> {
+    /** Unique name for this scheme (e.g. "jwt", "cookie"). */
+    readonly name: string;
+    /**
+     * Attempt to authenticate the request.
+     * Returns a successful result with a `Principal<T>` or a failure.
+     */
+    authenticate(context: AuthenticationContext): Promise<AuthenticationResult<T>>;
+    /**
+     * Optional challenge header for 401 responses.
+     * E.g. `{ headerName: 'WWW-Authenticate', headerValue: 'Bearer' }`
+     */
+    challenge?(): {
+        headerName: string;
+        headerValue: string;
+    };
+}

package/dist/Authorization.d.ts

@@ -0,0 +1,67 @@
+import type { Principal } from './Principal.js';
+/**
+ * A predicate that a principal must satisfy.
+ * Return `true` to allow, `false` to deny.
+ */
+export type AuthorizationRequirement = (principal: Principal<any>) => boolean | Promise<boolean>;
+/**
+ * Creates an authorization requirement that checks if the principal
+ * has at least one of the specified roles.
+ */
+export declare function requireRole(...roles: string[]): AuthorizationRequirement;
+/**
+ * A named set of authorization requirements.
+ * All requirements must pass (AND semantics) for the policy to be satisfied.
+ * Build instances using {@link PolicyBuilder}.
+ */
+export interface AuthorizationPolicy {
+    readonly name: string;
+    readonly requirements: readonly AuthorizationRequirement[];
+}
+/**
+ * Fluent builder for composing {@link AuthorizationPolicy} instances.
+ *
+ * @example
+ * ```ts
+ * const policy = new PolicyBuilder()
+ *     .requireRole('admin')
+ *     .require(p => p.hasClaim('verified', 'true'))
+ *     .build('admin-only');
+ * ```
+ */
+export declare class PolicyBuilder {
+    #private;
+    /** Add a role requirement: at least one of `roles` must be held by the principal. */
+    requireRole(...roles: string[]): this;
+    /** Add an arbitrary predicate requirement. */
+    require(requirement: AuthorizationRequirement): this;
+    /** Finalize the policy with the given name. */
+    build(name: string): AuthorizationPolicy;
+}
+/**
+ * The result of an authorization check performed by {@link AuthorizationService.authorize}.
+ */
+export type AuthorizationResult = {
+    allowed: true;
+} | {
+    allowed: false;
+    reason: string;
+};
+/**
+ * Evaluates authorization requirements or named policies against a principal.
+ *
+ * Instantiated internally by `ServerBuilder.useAuthorization()` or directly
+ * for use outside the server framework.
+ */
+export declare class AuthorizationService {
+    #private;
+    constructor(policies?: Map<string, AuthorizationPolicy>);
+    /**
+     * Evaluate authorization for a principal.
+     *
+     * - `requirements` array: all must pass (AND semantics).
+     * - Named policy string: looks up registered policy, then checks its requirements.
+     */
+    authorize(principal: Principal<any>, requirements: readonly AuthorizationRequirement[]): Promise<AuthorizationResult>;
+    authorize(principal: Principal<any>, policyName: string): Promise<AuthorizationResult>;
+}

package/dist/CookieScheme.d.ts

@@ -0,0 +1,24 @@
+import type { AuthenticationScheme } from './AuthenticationScheme.js';
+/**
+ * Configuration for {@link cookieScheme}.
+ *
+ * @template T - The type of the principal value returned by `validate`.
+ */
+export interface CookieSchemeOptions<T> {
+    /** Name of the cookie to read (e.g. "session", "sid"). */
+    cookieName: string;
+    /**
+     * Validate the cookie value and return the principal data, or `null`
+     * if the cookie is invalid / session expired.
+     *
+     * The implementer is responsible for session lookup, signature
+     * verification, etc.
+     */
+    validate: (cookieValue: string) => Promise<T | null>;
+    /** Custom scheme name (default: "cookie"). */
+    name?: string;
+}
+/**
+ * Create a cookie-based authentication scheme.
+ */
+export declare function cookieScheme<T>(options: CookieSchemeOptions<T>): AuthenticationScheme<T>;

package/dist/JwtScheme.d.ts

@@ -0,0 +1,53 @@
+import type { AuthenticationScheme } from './AuthenticationScheme.js';
+/**
+ * The decoded JWT header. Contains the algorithm (`alg`) and optionally
+ * the token type (`typ`, typically `"JWT"`).
+ */
+export interface JwtHeader {
+    alg: string;
+    typ?: string;
+}
+/**
+ * The decoded JWT payload. Includes standard registered claims (`iss`, `sub`,
+ * `aud`, `exp`, `nbf`, `iat`, `jti`) and any custom claims.
+ */
+export interface JwtPayload {
+    [key: string]: unknown;
+    iss?: string;
+    sub?: string;
+    aud?: string | string[];
+    exp?: number;
+    nbf?: number;
+    iat?: number;
+    jti?: string;
+}
+/**
+ * Configuration for {@link jwtScheme}.
+ *
+ * @template T - The type of the principal value produced by `mapClaims`.
+ */
+export interface JwtSchemeOptions<T> {
+    /** HMAC secret (for HS256/HS384/HS512) or PEM public key (for RS256/RS384/RS512). */
+    secret: string | Buffer;
+    /** Map raw JWT claims to the typed principal value. */
+    mapClaims: (claims: JwtPayload) => T;
+    /** Allowed algorithms (default: ['HS256']). */
+    algorithms?: string[];
+    /** Expected issuer — if set, `iss` must match. */
+    issuer?: string;
+    /** Expected audience — if set, `aud` must include it. */
+    audience?: string;
+    /** Clock tolerance in seconds for exp/nbf checks (default: 0). */
+    clockTolerance?: number;
+    /** Custom scheme name (default: 'jwt'). */
+    name?: string;
+}
+/**
+ * Create a JWT authentication scheme.
+ */
+export declare function jwtScheme<T>(options: JwtSchemeOptions<T>): AuthenticationScheme<T>;
+/**
+ * Sign a JWT payload. Utility for tests and token generation.
+ * Supports HS256/HS384/HS512 (HMAC) and RS256/RS384/RS512 (RSA).
+ */
+export declare function signJwt(payload: JwtPayload, secret: string | Buffer, algorithm?: string): string;

package/dist/Principal.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Principal — represents an authenticated (or anonymous) user identity.
+ *
+ * Generic over `T` — the user-defined principal shape, typically
+ * declared as a `@cleverbrush/schema` object schema.
+ */
+export declare class Principal<T = unknown> {
+    readonly isAuthenticated: boolean;
+    readonly value: T | undefined;
+    readonly claims: Map<string, string | string[]>;
+    constructor(isAuthenticated: boolean, value: T | undefined, claims?: Map<string, string | string[]>);
+    /**
+     * Returns true if the principal has the given role.
+     * Checks the "role" claim by default; supports both single-value
+     * and array-value claims.
+     */
+    hasRole(role: string, claimKey?: string): boolean;
+    /**
+     * Returns true if the principal has a claim with the given type.
+     * If `value` is provided, also checks the claim value matches.
+     */
+    hasClaim(type: string, value?: string): boolean;
+    /**
+     * Creates an anonymous (unauthenticated) principal.
+     */
+    static anonymous(): Principal<undefined>;
+}

package/dist/cookies.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Parse a `Cookie` header string into a Record.
+ *
+ * @example parseCookies('name1=val1; name2=val2') → { name1: 'val1', name2: 'val2' }
+ */
+export declare function parseCookies(header: string): Record<string, string>;
+/**
+ * Options for the `Set-Cookie` header, controlling cookie lifetime,
+ * scope, and security attributes.
+ */
+export interface CookieOptions {
+    /** Max lifetime in seconds. */
+    maxAge?: number;
+    /** Absolute expiry date. */
+    expires?: Date;
+    /** Cookie path (default "/"). */
+    path?: string;
+    /** Cookie domain. */
+    domain?: string;
+    /** HTTPS only. */
+    secure?: boolean;
+    /** Prevent client-side JS access. */
+    httpOnly?: boolean;
+    /** SameSite attribute. */
+    sameSite?: 'Strict' | 'Lax' | 'None';
+}
+/**
+ * Serialize a `Set-Cookie` header value.
+ */
+export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;

package/dist/index.d.ts

@@ -0,0 +1,19 @@
+export type { AuthenticationContext, AuthenticationResult, AuthenticationScheme } from './AuthenticationScheme.js';
+export { type AuthorizationPolicy, type AuthorizationRequirement, type AuthorizationResult, AuthorizationService, PolicyBuilder, requireRole } from './Authorization.js';
+export { type CookieSchemeOptions, cookieScheme } from './CookieScheme.js';
+export { type CookieOptions, parseCookies, serializeCookie } from './cookies.js';
+export { type JwtPayload, type JwtSchemeOptions, jwtScheme, signJwt } from './JwtScheme.js';
+export { Principal } from './Principal.js';
+/**
+ * Define application roles as a typed constant object.
+ * The returned object is frozen and its values form the role
+ * string-literal union used by `createEndpoints()`.
+ *
+ * @example
+ * ```ts
+ * const Roles = defineRoles({ admin: 'admin', editor: 'editor' });
+ * const ep = createEndpoints(Roles);
+ * ep.get('/api/admin').authorize(IPrincipal, 'admin'); // ✓
+ * ```
+ */
+export declare function defineRoles<const T extends Record<string, string>>(roles: T): Readonly<T>;

package/dist/index.js

@@ -0,0 +1,2 @@
+function R(...i){return e=>i.some(t=>e.hasRole(t))}var m=class{#e=[];requireRole(...e){return this.#e.push(R(...e)),this}require(e){return this.#e.push(e),this}build(e){return{name:e,requirements:[...this.#e]}}},g=class{#e;constructor(e){this.#e=e??new Map}async authorize(e,t){if(!e.isAuthenticated)return{allowed:!1,reason:"Not authenticated"};let r;if(typeof t=="string"){let n=this.#e.get(t);if(!n)return{allowed:!1,reason:`Unknown authorization policy: "${t}"`};r=n.requirements}else r=t;for(let n of r)if(!await n(e))return{allowed:!1,reason:"Forbidden"};return{allowed:!0}}};function y(i){let e={};if(!i)return e;let t=i.split(";");for(let r of t){let n=r.indexOf("=");if(n<0)continue;let a=r.slice(0,n).trim(),o=r.slice(n+1).trim();a.length>0&&(e[a]=decodeURIComponent(o))}return e}function b(i,e,t){let r=`${encodeURIComponent(i)}=${encodeURIComponent(e)}`;return t?.maxAge!==void 0&&(r+=`; Max-Age=${t.maxAge}`),t?.expires&&(r+=`; Expires=${t.expires.toUTCString()}`),t?.path&&(r+=`; Path=${t.path}`),t?.domain&&(r+=`; Domain=${t.domain}`),t?.secure&&(r+="; Secure"),t?.httpOnly&&(r+="; HttpOnly"),t?.sameSite&&(r+=`; SameSite=${t.sameSite}`),r}var h=class i{isAuthenticated;value;claims;constructor(e,t,r){this.isAuthenticated=e,this.value=t,this.claims=r??new Map}hasRole(e,t="role"){let r=this.claims.get(t);return r===void 0?!1:Array.isArray(r)?r.includes(e):r===e}hasClaim(e,t){let r=this.claims.get(e);return r===void 0?!1:t===void 0?!0:Array.isArray(r)?r.includes(t):r===t}static anonymous(){return new i(!1,void 0)}};var A=class{name;#e;constructor(e){this.name=e.name??"cookie",this.#e=e}async authenticate(e){let t=e.cookies[this.#e.cookieName];if(t===void 0){let a=e.headers.cookie;a&&(t=y(a)[this.#e.cookieName])}if(t===void 0||t==="")return{succeeded:!1,failure:`Cookie "${this.#e.cookieName}" not found`};let r=await this.#e.validate(t);return r===null?{succeeded:!1,failure:"Cookie validation failed"}:{succeeded:!0,principal:new h(!0,r)}}};function C(i){return new A(i)}import*as l from"crypto";function x(i){let e=i.replace(/-/g,"+").replace(/_/g,"/"),t=e.length%4;return t===2?e+="==":t===3&&(e+="="),Buffer.from(e,"base64")}var T={HS256:"sha256",HS384:"sha384",HS512:"sha512"},z={RS256:"sha256",RS384:"sha384",RS512:"sha512"};function P(i,e,t,r,n){let a=`${i}.${e}`,o=x(t),c=T[r];if(c){let s=l.createHmac(c,n).update(a).digest();return s.length!==o.length?!1:l.timingSafeEqual(s,o)}let u=z[r];return u?l.createVerify(u).update(a).verify(typeof n=="string"?n:{key:n},o):!1}function J(i,e,t,r,n,a=0){let o=i.split(".");if(o.length!==3)return{error:"Malformed JWT: expected 3 segments"};let[c,u,s]=o,f;try{f=JSON.parse(x(c).toString("utf-8"))}catch{return{error:"Malformed JWT header"}}if(!t.includes(f.alg))return{error:`Unsupported algorithm: ${f.alg}`};if(!P(c,u,s,f.alg,e))return{error:"Invalid signature"};let d;try{d=JSON.parse(x(u).toString("utf-8"))}catch{return{error:"Malformed JWT payload"}}let k=Math.floor(Date.now()/1e3);if(d.exp!==void 0&&k>d.exp+a)return{error:"Token expired"};if(d.nbf!==void 0&&k<d.nbf-a)return{error:"Token not yet valid"};if(r!==void 0&&d.iss!==r)return{error:`Invalid issuer: expected "${r}"`};if(n!==void 0){let p=d.aud;if(!(Array.isArray(p)?p:p?[p]:[]).includes(n))return{error:`Invalid audience: expected "${n}"`}}return{header:f,payload:d}}var w=class{name;#e;#t;constructor(e){this.name=e.name??"jwt",this.#e=e,this.#t=e.algorithms??["HS256"]}async authenticate(e){let t=e.headers.authorization;if(!t)return{succeeded:!1,failure:"Missing Authorization header"};if(!t.startsWith("Bearer "))return{succeeded:!1,failure:"Authorization header must use Bearer scheme"};let r=t.slice(7).trim();if(!r)return{succeeded:!1,failure:"Empty Bearer token"};let n=J(r,this.#e.secret,this.#t,this.#e.issuer,this.#e.audience,this.#e.clockTolerance);if("error"in n)return{succeeded:!1,failure:n.error};let a=this.#e.mapClaims(n.payload),o=new Map;for(let[u,s]of Object.entries(n.payload))(typeof s=="string"||Array.isArray(s)&&s.every(f=>typeof f=="string"))&&o.set(u,s);return{succeeded:!0,principal:new h(!0,a,o)}}challenge(){return{headerName:"WWW-Authenticate",headerValue:"Bearer"}}};function O(i){return new w(i)}function S(i){return i.toString("base64").replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/,"")}function B(i,e,t="HS256"){let r={alg:t,typ:"JWT"},n=S(Buffer.from(JSON.stringify(r),"utf-8")),a=S(Buffer.from(JSON.stringify(i),"utf-8")),o=`${n}.${a}`,c,u=T[t];if(u)c=l.createHmac(u,e).update(o).digest();else{let s=z[t];if(!s)throw new Error(`Unsupported algorithm: ${t}`);c=l.createSign(s).update(o).sign(typeof e=="string"?e:{key:e})}return`${o}.${S(c)}`}function I(i){return Object.freeze(i)}export{g as AuthorizationService,m as PolicyBuilder,h as Principal,C as cookieScheme,I as defineRoles,O as jwtScheme,y as parseCookies,R as requireRole,b as serializeCookie,B as signJwt};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/Authorization.ts","../src/cookies.ts","../src/Principal.ts","../src/CookieScheme.ts","../src/JwtScheme.ts","../src/index.ts"],"sourcesContent":["import type { Principal } from './Principal.js';\n\n// ---------------------------------------------------------------------------\n// Authorization Requirement\n// ---------------------------------------------------------------------------\n\n/**\n * A predicate that a principal must satisfy.\n * Return `true` to allow, `false` to deny.\n */\nexport type AuthorizationRequirement = (\n    principal: Principal<any>\n) => boolean | Promise<boolean>;\n\n// ---------------------------------------------------------------------------\n// Roles Requirement\n// ---------------------------------------------------------------------------\n\n/**\n * Creates an authorization requirement that checks if the principal\n * has at least one of the specified roles.\n */\nexport function requireRole(...roles: string[]): AuthorizationRequirement {\n    return (principal: Principal<any>) =>\n        roles.some(role => principal.hasRole(role));\n}\n\n// ---------------------------------------------------------------------------\n// Authorization Policy\n// ---------------------------------------------------------------------------\n\n/**\n * A named set of authorization requirements.\n * All requirements must pass (AND semantics) for the policy to be satisfied.\n * Build instances using {@link PolicyBuilder}.\n */\nexport interface AuthorizationPolicy {\n    readonly name: string;\n    readonly requirements: readonly AuthorizationRequirement[];\n}\n\n// ---------------------------------------------------------------------------\n// Policy Builder (fluent API for useAuthorization config)\n// ---------------------------------------------------------------------------\n\n/**\n * Fluent builder for composing {@link AuthorizationPolicy} instances.\n *\n * @example\n * ```ts\n * const policy = new PolicyBuilder()\n *     .requireRole('admin')\n *     .require(p => p.hasClaim('verified', 'true'))\n *     .build('admin-only');\n * ```\n */\nexport class PolicyBuilder {\n    readonly #requirements: AuthorizationRequirement[] = [];\n\n    /** Add a role requirement: at least one of `roles` must be held by the principal. */\n    requireRole(...roles: string[]): this {\n        this.#requirements.push(requireRole(...roles));\n        return this;\n    }\n\n    /** Add an arbitrary predicate requirement. */\n    require(requirement: AuthorizationRequirement): this {\n        this.#requirements.push(requirement);\n        return this;\n    }\n\n    /** Finalize the policy with the given name. */\n    build(name: string): AuthorizationPolicy {\n        return { name, requirements: [...this.#requirements] };\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Authorization Result\n// ---------------------------------------------------------------------------\n\n/**\n * The result of an authorization check performed by {@link AuthorizationService.authorize}.\n */\nexport type AuthorizationResult =\n    | { allowed: true }\n    | { allowed: false; reason: string };\n\n// ---------------------------------------------------------------------------\n// Authorization Service\n// ---------------------------------------------------------------------------\n\n/**\n * Evaluates authorization requirements or named policies against a principal.\n *\n * Instantiated internally by `ServerBuilder.useAuthorization()` or directly\n * for use outside the server framework.\n */\nexport class AuthorizationService {\n    readonly #policies: Map<string, AuthorizationPolicy>;\n\n    constructor(policies?: Map<string, AuthorizationPolicy>) {\n        this.#policies = policies ?? new Map();\n    }\n\n    /**\n     * Evaluate authorization for a principal.\n     *\n     * - `requirements` array: all must pass (AND semantics).\n     * - Named policy string: looks up registered policy, then checks its requirements.\n     */\n    async authorize(\n        principal: Principal<any>,\n        requirements: readonly AuthorizationRequirement[]\n    ): Promise<AuthorizationResult>;\n    async authorize(\n        principal: Principal<any>,\n        policyName: string\n    ): Promise<AuthorizationResult>;\n    async authorize(\n        principal: Principal<any>,\n        requirementsOrPolicy: readonly AuthorizationRequirement[] | string\n    ): Promise<AuthorizationResult> {\n        if (!principal.isAuthenticated) {\n            return { allowed: false, reason: 'Not authenticated' };\n        }\n\n        let requirements: readonly AuthorizationRequirement[];\n\n        if (typeof requirementsOrPolicy === 'string') {\n            const policy = this.#policies.get(requirementsOrPolicy);\n            if (!policy) {\n                return {\n                    allowed: false,\n                    reason: `Unknown authorization policy: \"${requirementsOrPolicy}\"`\n                };\n            }\n            requirements = policy.requirements;\n        } else {\n            requirements = requirementsOrPolicy;\n        }\n\n        for (const req of requirements) {\n            const result = await req(principal);\n            if (!result) {\n                return { allowed: false, reason: 'Forbidden' };\n            }\n        }\n\n        return { allowed: true };\n    }\n}\n","// ---------------------------------------------------------------------------\n// Cookie Parsing\n// ---------------------------------------------------------------------------\n\n/**\n * Parse a `Cookie` header string into a Record.\n *\n * @example parseCookies('name1=val1; name2=val2') → { name1: 'val1', name2: 'val2' }\n */\nexport function parseCookies(header: string): Record<string, string> {\n    const cookies: Record<string, string> = {};\n    if (!header) return cookies;\n\n    const pairs = header.split(';');\n    for (const pair of pairs) {\n        const idx = pair.indexOf('=');\n        if (idx < 0) continue;\n        const key = pair.slice(0, idx).trim();\n        const value = pair.slice(idx + 1).trim();\n        if (key.length > 0) {\n            cookies[key] = decodeURIComponent(value);\n        }\n    }\n    return cookies;\n}\n\n// ---------------------------------------------------------------------------\n// Cookie Serialization\n// ---------------------------------------------------------------------------\n\n/**\n * Options for the `Set-Cookie` header, controlling cookie lifetime,\n * scope, and security attributes.\n */\nexport interface CookieOptions {\n    /** Max lifetime in seconds. */\n    maxAge?: number;\n    /** Absolute expiry date. */\n    expires?: Date;\n    /** Cookie path (default \"/\"). */\n    path?: string;\n    /** Cookie domain. */\n    domain?: string;\n    /** HTTPS only. */\n    secure?: boolean;\n    /** Prevent client-side JS access. */\n    httpOnly?: boolean;\n    /** SameSite attribute. */\n    sameSite?: 'Strict' | 'Lax' | 'None';\n}\n\n/**\n * Serialize a `Set-Cookie` header value.\n */\nexport function serializeCookie(\n    name: string,\n    value: string,\n    options?: CookieOptions\n): string {\n    let cookie = `${encodeURIComponent(name)}=${encodeURIComponent(value)}`;\n\n    if (options?.maxAge !== undefined) {\n        cookie += `; Max-Age=${options.maxAge}`;\n    }\n    if (options?.expires) {\n        cookie += `; Expires=${options.expires.toUTCString()}`;\n    }\n    if (options?.path) {\n        cookie += `; Path=${options.path}`;\n    }\n    if (options?.domain) {\n        cookie += `; Domain=${options.domain}`;\n    }\n    if (options?.secure) {\n        cookie += '; Secure';\n    }\n    if (options?.httpOnly) {\n        cookie += '; HttpOnly';\n    }\n    if (options?.sameSite) {\n        cookie += `; SameSite=${options.sameSite}`;\n    }\n\n    return cookie;\n}\n","/**\n * Principal — represents an authenticated (or anonymous) user identity.\n *\n * Generic over `T` — the user-defined principal shape, typically\n * declared as a `@cleverbrush/schema` object schema.\n */\nexport class Principal<T = unknown> {\n    readonly isAuthenticated: boolean;\n    readonly value: T | undefined;\n    readonly claims: Map<string, string | string[]>;\n\n    constructor(\n        isAuthenticated: boolean,\n        value: T | undefined,\n        claims?: Map<string, string | string[]>\n    ) {\n        this.isAuthenticated = isAuthenticated;\n        this.value = value;\n        this.claims = claims ?? new Map();\n    }\n\n    /**\n     * Returns true if the principal has the given role.\n     * Checks the \"role\" claim by default; supports both single-value\n     * and array-value claims.\n     */\n    hasRole(role: string, claimKey = 'role'): boolean {\n        const v = this.claims.get(claimKey);\n        if (v === undefined) return false;\n        if (Array.isArray(v)) return v.includes(role);\n        return v === role;\n    }\n\n    /**\n     * Returns true if the principal has a claim with the given type.\n     * If `value` is provided, also checks the claim value matches.\n     */\n    hasClaim(type: string, value?: string): boolean {\n        const v = this.claims.get(type);\n        if (v === undefined) return false;\n        if (value === undefined) return true;\n        if (Array.isArray(v)) return v.includes(value);\n        return v === value;\n    }\n\n    /**\n     * Creates an anonymous (unauthenticated) principal.\n     */\n    static anonymous(): Principal<undefined> {\n        return new Principal(false, undefined);\n    }\n}\n","import type {\n    AuthenticationContext,\n    AuthenticationResult,\n    AuthenticationScheme\n} from './AuthenticationScheme.js';\nimport { parseCookies } from './cookies.js';\nimport { Principal } from './Principal.js';\n\n// ---------------------------------------------------------------------------\n// Cookie Scheme Config\n// ---------------------------------------------------------------------------\n\n/**\n * Configuration for {@link cookieScheme}.\n *\n * @template T - The type of the principal value returned by `validate`.\n */\nexport interface CookieSchemeOptions<T> {\n    /** Name of the cookie to read (e.g. \"session\", \"sid\"). */\n    cookieName: string;\n    /**\n     * Validate the cookie value and return the principal data, or `null`\n     * if the cookie is invalid / session expired.\n     *\n     * The implementer is responsible for session lookup, signature\n     * verification, etc.\n     */\n    validate: (cookieValue: string) => Promise<T | null>;\n    /** Custom scheme name (default: \"cookie\"). */\n    name?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Cookie Authentication Scheme\n// ---------------------------------------------------------------------------\n\nclass CookieAuthenticationScheme<T> implements AuthenticationScheme<T> {\n    readonly name: string;\n    readonly #options: CookieSchemeOptions<T>;\n\n    constructor(options: CookieSchemeOptions<T>) {\n        this.name = options.name ?? 'cookie';\n        this.#options = options;\n    }\n\n    async authenticate(\n        context: AuthenticationContext\n    ): Promise<AuthenticationResult<T>> {\n        // Try pre-parsed cookies first, fall back to header parsing\n        let cookieValue: string | undefined =\n            context.cookies[this.#options.cookieName];\n\n        if (cookieValue === undefined) {\n            const cookieHeader = context.headers['cookie'];\n            if (cookieHeader) {\n                const parsed = parseCookies(cookieHeader);\n                cookieValue = parsed[this.#options.cookieName];\n            }\n        }\n\n        if (cookieValue === undefined || cookieValue === '') {\n            return {\n                succeeded: false,\n                failure: `Cookie \"${this.#options.cookieName}\" not found`\n            };\n        }\n\n        const value = await this.#options.validate(cookieValue);\n        if (value === null) {\n            return {\n                succeeded: false,\n                failure: 'Cookie validation failed'\n            };\n        }\n\n        const principal = new Principal(true, value);\n        return { succeeded: true, principal };\n    }\n}\n\n/**\n * Create a cookie-based authentication scheme.\n */\nexport function cookieScheme<T>(\n    options: CookieSchemeOptions<T>\n): AuthenticationScheme<T> {\n    return new CookieAuthenticationScheme(options);\n}\n","import * as crypto from 'node:crypto';\nimport type {\n    AuthenticationContext,\n    AuthenticationResult,\n    AuthenticationScheme\n} from './AuthenticationScheme.js';\nimport { Principal } from './Principal.js';\n\n// ---------------------------------------------------------------------------\n// JWT Types\n// ---------------------------------------------------------------------------\n\n/**\n * The decoded JWT header. Contains the algorithm (`alg`) and optionally\n * the token type (`typ`, typically `\"JWT\"`).\n */\nexport interface JwtHeader {\n    alg: string;\n    typ?: string;\n}\n\n/**\n * The decoded JWT payload. Includes standard registered claims (`iss`, `sub`,\n * `aud`, `exp`, `nbf`, `iat`, `jti`) and any custom claims.\n */\nexport interface JwtPayload {\n    [key: string]: unknown;\n    iss?: string;\n    sub?: string;\n    aud?: string | string[];\n    exp?: number;\n    nbf?: number;\n    iat?: number;\n    jti?: string;\n}\n\n// ---------------------------------------------------------------------------\n// JWT Scheme Config\n// ---------------------------------------------------------------------------\n\n/**\n * Configuration for {@link jwtScheme}.\n *\n * @template T - The type of the principal value produced by `mapClaims`.\n */\nexport interface JwtSchemeOptions<T> {\n    /** HMAC secret (for HS256/HS384/HS512) or PEM public key (for RS256/RS384/RS512). */\n    secret: string | Buffer;\n    /** Map raw JWT claims to the typed principal value. */\n    mapClaims: (claims: JwtPayload) => T;\n    /** Allowed algorithms (default: ['HS256']). */\n    algorithms?: string[];\n    /** Expected issuer — if set, `iss` must match. */\n    issuer?: string;\n    /** Expected audience — if set, `aud` must include it. */\n    audience?: string;\n    /** Clock tolerance in seconds for exp/nbf checks (default: 0). */\n    clockTolerance?: number;\n    /** Custom scheme name (default: 'jwt'). */\n    name?: string;\n}\n\n// ---------------------------------------------------------------------------\n// Base64url helpers\n// ---------------------------------------------------------------------------\n\nfunction base64urlDecode(input: string): Buffer {\n    // Restore standard base64 padding\n    let base64 = input.replace(/-/g, '+').replace(/_/g, '/');\n    const pad = base64.length % 4;\n    if (pad === 2) base64 += '==';\n    else if (pad === 3) base64 += '=';\n    return Buffer.from(base64, 'base64');\n}\n\n// ---------------------------------------------------------------------------\n// Algorithm mapping\n// ---------------------------------------------------------------------------\n\nconst HMAC_ALGOS: Record<string, string> = {\n    HS256: 'sha256',\n    HS384: 'sha384',\n    HS512: 'sha512'\n};\n\nconst RSA_ALGOS: Record<string, string> = {\n    RS256: 'sha256',\n    RS384: 'sha384',\n    RS512: 'sha512'\n};\n\n// ---------------------------------------------------------------------------\n// JWT verification\n// ---------------------------------------------------------------------------\n\nfunction verifySignature(\n    headerB64: string,\n    payloadB64: string,\n    signatureB64: string,\n    alg: string,\n    secret: string | Buffer\n): boolean {\n    const data = `${headerB64}.${payloadB64}`;\n    const signatureBytes = base64urlDecode(signatureB64);\n\n    const hmacHash = HMAC_ALGOS[alg];\n    if (hmacHash) {\n        const expected = crypto\n            .createHmac(hmacHash, secret)\n            .update(data)\n            .digest();\n        if (expected.length !== signatureBytes.length) {\n            return false;\n        }\n        return crypto.timingSafeEqual(expected, signatureBytes);\n    }\n\n    const rsaHash = RSA_ALGOS[alg];\n    if (rsaHash) {\n        return crypto\n            .createVerify(rsaHash)\n            .update(data)\n            .verify(\n                typeof secret === 'string' ? secret : { key: secret },\n                signatureBytes\n            );\n    }\n\n    return false;\n}\n\nfunction decodeJwt(\n    token: string,\n    secret: string | Buffer,\n    allowedAlgorithms: string[],\n    issuer?: string,\n    audience?: string,\n    clockTolerance = 0\n): { header: JwtHeader; payload: JwtPayload } | { error: string } {\n    const parts = token.split('.');\n    if (parts.length !== 3) {\n        return { error: 'Malformed JWT: expected 3 segments' };\n    }\n\n    const [headerB64, payloadB64, signatureB64] = parts;\n\n    let header: JwtHeader;\n    try {\n        header = JSON.parse(base64urlDecode(headerB64).toString('utf-8'));\n    } catch {\n        return { error: 'Malformed JWT header' };\n    }\n\n    if (!allowedAlgorithms.includes(header.alg)) {\n        return { error: `Unsupported algorithm: ${header.alg}` };\n    }\n\n    if (\n        !verifySignature(\n            headerB64,\n            payloadB64,\n            signatureB64,\n            header.alg,\n            secret\n        )\n    ) {\n        return { error: 'Invalid signature' };\n    }\n\n    let payload: JwtPayload;\n    try {\n        payload = JSON.parse(base64urlDecode(payloadB64).toString('utf-8'));\n    } catch {\n        return { error: 'Malformed JWT payload' };\n    }\n\n    const now = Math.floor(Date.now() / 1000);\n\n    if (payload.exp !== undefined && now > payload.exp + clockTolerance) {\n        return { error: 'Token expired' };\n    }\n\n    if (payload.nbf !== undefined && now < payload.nbf - clockTolerance) {\n        return { error: 'Token not yet valid' };\n    }\n\n    if (issuer !== undefined && payload.iss !== issuer) {\n        return { error: `Invalid issuer: expected \"${issuer}\"` };\n    }\n\n    if (audience !== undefined) {\n        const aud = payload.aud;\n        const audArray = Array.isArray(aud) ? aud : aud ? [aud] : [];\n        if (!audArray.includes(audience)) {\n            return { error: `Invalid audience: expected \"${audience}\"` };\n        }\n    }\n\n    return { header, payload };\n}\n\n// ---------------------------------------------------------------------------\n// JWT Authentication Scheme\n// ---------------------------------------------------------------------------\n\nclass JwtAuthenticationScheme<T> implements AuthenticationScheme<T> {\n    readonly name: string;\n    readonly #options: JwtSchemeOptions<T>;\n    readonly #algorithms: string[];\n\n    constructor(options: JwtSchemeOptions<T>) {\n        this.name = options.name ?? 'jwt';\n        this.#options = options;\n        this.#algorithms = options.algorithms ?? ['HS256'];\n    }\n\n    async authenticate(\n        context: AuthenticationContext\n    ): Promise<AuthenticationResult<T>> {\n        const authHeader = context.headers['authorization'];\n        if (!authHeader) {\n            return {\n                succeeded: false,\n                failure: 'Missing Authorization header'\n            };\n        }\n\n        if (!authHeader.startsWith('Bearer ')) {\n            return {\n                succeeded: false,\n                failure: 'Authorization header must use Bearer scheme'\n            };\n        }\n\n        const token = authHeader.slice(7).trim();\n        if (!token) {\n            return { succeeded: false, failure: 'Empty Bearer token' };\n        }\n\n        const result = decodeJwt(\n            token,\n            this.#options.secret,\n            this.#algorithms,\n            this.#options.issuer,\n            this.#options.audience,\n            this.#options.clockTolerance\n        );\n\n        if ('error' in result) {\n            return { succeeded: false, failure: result.error };\n        }\n\n        const value = this.#options.mapClaims(result.payload);\n\n        // Build claims map from JWT payload\n        const claims = new Map<string, string | string[]>();\n        for (const [key, val] of Object.entries(result.payload)) {\n            if (typeof val === 'string') {\n                claims.set(key, val);\n            } else if (\n                Array.isArray(val) &&\n                val.every(v => typeof v === 'string')\n            ) {\n                claims.set(key, val);\n            }\n        }\n\n        const principal = new Principal(true, value, claims);\n        return { succeeded: true, principal };\n    }\n\n    challenge(): { headerName: string; headerValue: string } {\n        return {\n            headerName: 'WWW-Authenticate',\n            headerValue: 'Bearer'\n        };\n    }\n}\n\n/**\n * Create a JWT authentication scheme.\n */\nexport function jwtScheme<T>(\n    options: JwtSchemeOptions<T>\n): AuthenticationScheme<T> {\n    return new JwtAuthenticationScheme(options);\n}\n\n// ---------------------------------------------------------------------------\n// JWT signing (utility for tests / token generation)\n// ---------------------------------------------------------------------------\n\nfunction base64urlEncode(data: Buffer): string {\n    return data\n        .toString('base64')\n        .replace(/\\+/g, '-')\n        .replace(/\\//g, '_')\n        .replace(/=+$/, '');\n}\n\n/**\n * Sign a JWT payload. Utility for tests and token generation.\n * Supports HS256/HS384/HS512 (HMAC) and RS256/RS384/RS512 (RSA).\n */\nexport function signJwt(\n    payload: JwtPayload,\n    secret: string | Buffer,\n    algorithm = 'HS256'\n): string {\n    const header: JwtHeader = { alg: algorithm, typ: 'JWT' };\n\n    const headerB64 = base64urlEncode(\n        Buffer.from(JSON.stringify(header), 'utf-8')\n    );\n    const payloadB64 = base64urlEncode(\n        Buffer.from(JSON.stringify(payload), 'utf-8')\n    );\n\n    const data = `${headerB64}.${payloadB64}`;\n\n    let signature: Buffer;\n\n    const hmacHash = HMAC_ALGOS[algorithm];\n    if (hmacHash) {\n        signature = crypto.createHmac(hmacHash, secret).update(data).digest();\n    } else {\n        const rsaHash = RSA_ALGOS[algorithm];\n        if (!rsaHash) {\n            throw new Error(`Unsupported algorithm: ${algorithm}`);\n        }\n        signature = crypto\n            .createSign(rsaHash)\n            .update(data)\n            .sign(typeof secret === 'string' ? secret : { key: secret });\n    }\n\n    return `${data}.${base64urlEncode(signature)}`;\n}\n","// Core\n\nexport type {\n    AuthenticationContext,\n    AuthenticationResult,\n    AuthenticationScheme\n} from './AuthenticationScheme.js';\nexport {\n    type AuthorizationPolicy,\n    type AuthorizationRequirement,\n    type AuthorizationResult,\n    AuthorizationService,\n    PolicyBuilder,\n    requireRole\n} from './Authorization.js';\nexport { type CookieSchemeOptions, cookieScheme } from './CookieScheme.js';\n\n// Cookie utilities\nexport {\n    type CookieOptions,\n    parseCookies,\n    serializeCookie\n} from './cookies.js';\n\n// Built-in schemes\nexport {\n    type JwtPayload,\n    type JwtSchemeOptions,\n    jwtScheme,\n    signJwt\n} from './JwtScheme.js';\nexport { Principal } from './Principal.js';\n\n// Helpers\n\n/**\n * Define application roles as a typed constant object.\n * The returned object is frozen and its values form the role\n * string-literal union used by `createEndpoints()`.\n *\n * @example\n * ```ts\n * const Roles = defineRoles({ admin: 'admin', editor: 'editor' });\n * const ep = createEndpoints(Roles);\n * ep.get('/api/admin').authorize(IPrincipal, 'admin'); // ✓\n * ```\n */\nexport function defineRoles<const T extends Record<string, string>>(\n    roles: T\n): Readonly<T> {\n    return Object.freeze(roles);\n}\n"],"mappings":"AAsBO,SAASA,KAAeC,EAA2C,CACtE,OAAQC,GACJD,EAAM,KAAKE,GAAQD,EAAU,QAAQC,CAAI,CAAC,CAClD,CA+BO,IAAMC,EAAN,KAAoB,CACdC,GAA4C,CAAC,EAGtD,eAAeJ,EAAuB,CAClC,YAAKI,GAAc,KAAKL,EAAY,GAAGC,CAAK,CAAC,EACtC,IACX,CAGA,QAAQK,EAA6C,CACjD,YAAKD,GAAc,KAAKC,CAAW,EAC5B,IACX,CAGA,MAAMC,EAAmC,CACrC,MAAO,CAAE,KAAAA,EAAM,aAAc,CAAC,GAAG,KAAKF,EAAa,CAAE,CACzD,CACJ,EAuBaG,EAAN,KAA2B,CACrBC,GAET,YAAYC,EAA6C,CACrD,KAAKD,GAAYC,GAAY,IAAI,GACrC,CAgBA,MAAM,UACFR,EACAS,EAC4B,CAC5B,GAAI,CAACT,EAAU,gBACX,MAAO,CAAE,QAAS,GAAO,OAAQ,mBAAoB,EAGzD,IAAIU,EAEJ,GAAI,OAAOD,GAAyB,SAAU,CAC1C,IAAME,EAAS,KAAKJ,GAAU,IAAIE,CAAoB,EACtD,GAAI,CAACE,EACD,MAAO,CACH,QAAS,GACT,OAAQ,kCAAkCF,CAAoB,GAClE,EAEJC,EAAeC,EAAO,YAC1B,MACID,EAAeD,EAGnB,QAAWG,KAAOF,EAEd,GAAI,CADW,MAAME,EAAIZ,CAAS,EAE9B,MAAO,CAAE,QAAS,GAAO,OAAQ,WAAY,EAIrD,MAAO,CAAE,QAAS,EAAK,CAC3B,CACJ,EC9IO,SAASa,EAAaC,EAAwC,CACjE,IAAMC,EAAkC,CAAC,EACzC,GAAI,CAACD,EAAQ,OAAOC,EAEpB,IAAMC,EAAQF,EAAO,MAAM,GAAG,EAC9B,QAAWG,KAAQD,EAAO,CACtB,IAAME,EAAMD,EAAK,QAAQ,GAAG,EAC5B,GAAIC,EAAM,EAAG,SACb,IAAMC,EAAMF,EAAK,MAAM,EAAGC,CAAG,EAAE,KAAK,EAC9BE,EAAQH,EAAK,MAAMC,EAAM,CAAC,EAAE,KAAK,EACnCC,EAAI,OAAS,IACbJ,EAAQI,CAAG,EAAI,mBAAmBC,CAAK,EAE/C,CACA,OAAOL,CACX,CA8BO,SAASM,EACZC,EACAF,EACAG,EACM,CACN,IAAIC,EAAS,GAAG,mBAAmBF,CAAI,CAAC,IAAI,mBAAmBF,CAAK,CAAC,GAErE,OAAIG,GAAS,SAAW,SACpBC,GAAU,aAAaD,EAAQ,MAAM,IAErCA,GAAS,UACTC,GAAU,aAAaD,EAAQ,QAAQ,YAAY,CAAC,IAEpDA,GAAS,OACTC,GAAU,UAAUD,EAAQ,IAAI,IAEhCA,GAAS,SACTC,GAAU,YAAYD,EAAQ,MAAM,IAEpCA,GAAS,SACTC,GAAU,YAEVD,GAAS,WACTC,GAAU,cAEVD,GAAS,WACTC,GAAU,cAAcD,EAAQ,QAAQ,IAGrCC,CACX,CC9EO,IAAMC,EAAN,MAAMC,CAAuB,CACvB,gBACA,MACA,OAET,YACIC,EACAC,EACAC,EACF,CACE,KAAK,gBAAkBF,EACvB,KAAK,MAAQC,EACb,KAAK,OAASC,GAAU,IAAI,GAChC,CAOA,QAAQC,EAAcC,EAAW,OAAiB,CAC9C,IAAMC,EAAI,KAAK,OAAO,IAAID,CAAQ,EAClC,OAAIC,IAAM,OAAkB,GACxB,MAAM,QAAQA,CAAC,EAAUA,EAAE,SAASF,CAAI,EACrCE,IAAMF,CACjB,CAMA,SAASG,EAAcL,EAAyB,CAC5C,IAAMI,EAAI,KAAK,OAAO,IAAIC,CAAI,EAC9B,OAAID,IAAM,OAAkB,GACxBJ,IAAU,OAAkB,GAC5B,MAAM,QAAQI,CAAC,EAAUA,EAAE,SAASJ,CAAK,EACtCI,IAAMJ,CACjB,CAKA,OAAO,WAAkC,CACrC,OAAO,IAAIF,EAAU,GAAO,MAAS,CACzC,CACJ,ECfA,IAAMQ,EAAN,KAAuE,CAC1D,KACAC,GAET,YAAYC,EAAiC,CACzC,KAAK,KAAOA,EAAQ,MAAQ,SAC5B,KAAKD,GAAWC,CACpB,CAEA,MAAM,aACFC,EACgC,CAEhC,IAAIC,EACAD,EAAQ,QAAQ,KAAKF,GAAS,UAAU,EAE5C,GAAIG,IAAgB,OAAW,CAC3B,IAAMC,EAAeF,EAAQ,QAAQ,OACjCE,IAEAD,EADeE,EAAaD,CAAY,EACnB,KAAKJ,GAAS,UAAU,EAErD,CAEA,GAAIG,IAAgB,QAAaA,IAAgB,GAC7C,MAAO,CACH,UAAW,GACX,QAAS,WAAW,KAAKH,GAAS,UAAU,aAChD,EAGJ,IAAMM,EAAQ,MAAM,KAAKN,GAAS,SAASG,CAAW,EACtD,OAAIG,IAAU,KACH,CACH,UAAW,GACX,QAAS,0BACb,EAIG,CAAE,UAAW,GAAM,UADR,IAAIC,EAAU,GAAMD,CAAK,CACP,CACxC,CACJ,EAKO,SAASE,EACZP,EACuB,CACvB,OAAO,IAAIF,EAA2BE,CAAO,CACjD,CCvFA,UAAYQ,MAAY,SAkExB,SAASC,EAAgBC,EAAuB,CAE5C,IAAIC,EAASD,EAAM,QAAQ,KAAM,GAAG,EAAE,QAAQ,KAAM,GAAG,EACjDE,EAAMD,EAAO,OAAS,EAC5B,OAAIC,IAAQ,EAAGD,GAAU,KAChBC,IAAQ,IAAGD,GAAU,KACvB,OAAO,KAAKA,EAAQ,QAAQ,CACvC,CAMA,IAAME,EAAqC,CACvC,MAAO,SACP,MAAO,SACP,MAAO,QACX,EAEMC,EAAoC,CACtC,MAAO,SACP,MAAO,SACP,MAAO,QACX,EAMA,SAASC,EACLC,EACAC,EACAC,EACAC,EACAC,EACO,CACP,IAAMC,EAAO,GAAGL,CAAS,IAAIC,CAAU,GACjCK,EAAiBb,EAAgBS,CAAY,EAE7CK,EAAWV,EAAWM,CAAG,EAC/B,GAAII,EAAU,CACV,IAAMC,EACD,aAAWD,EAAUH,CAAM,EAC3B,OAAOC,CAAI,EACX,OAAO,EACZ,OAAIG,EAAS,SAAWF,EAAe,OAC5B,GAEG,kBAAgBE,EAAUF,CAAc,CAC1D,CAEA,IAAMG,EAAUX,EAAUK,CAAG,EAC7B,OAAIM,EAEK,eAAaA,CAAO,EACpB,OAAOJ,CAAI,EACX,OACG,OAAOD,GAAW,SAAWA,EAAS,CAAE,IAAKA,CAAO,EACpDE,CACJ,EAGD,EACX,CAEA,SAASI,EACLC,EACAP,EACAQ,EACAC,EACAC,EACAC,EAAiB,EAC6C,CAC9D,IAAMC,EAAQL,EAAM,MAAM,GAAG,EAC7B,GAAIK,EAAM,SAAW,EACjB,MAAO,CAAE,MAAO,oCAAqC,EAGzD,GAAM,CAAChB,EAAWC,EAAYC,CAAY,EAAIc,EAE1CC,EACJ,GAAI,CACAA,EAAS,KAAK,MAAMxB,EAAgBO,CAAS,EAAE,SAAS,OAAO,CAAC,CACpE,MAAQ,CACJ,MAAO,CAAE,MAAO,sBAAuB,CAC3C,CAEA,GAAI,CAACY,EAAkB,SAASK,EAAO,GAAG,EACtC,MAAO,CAAE,MAAO,0BAA0BA,EAAO,GAAG,EAAG,EAG3D,GACI,CAAClB,EACGC,EACAC,EACAC,EACAe,EAAO,IACPb,CACJ,EAEA,MAAO,CAAE,MAAO,mBAAoB,EAGxC,IAAIc,EACJ,GAAI,CACAA,EAAU,KAAK,MAAMzB,EAAgBQ,CAAU,EAAE,SAAS,OAAO,CAAC,CACtE,MAAQ,CACJ,MAAO,CAAE,MAAO,uBAAwB,CAC5C,CAEA,IAAMkB,EAAM,KAAK,MAAM,KAAK,IAAI,EAAI,GAAI,EAExC,GAAID,EAAQ,MAAQ,QAAaC,EAAMD,EAAQ,IAAMH,EACjD,MAAO,CAAE,MAAO,eAAgB,EAGpC,GAAIG,EAAQ,MAAQ,QAAaC,EAAMD,EAAQ,IAAMH,EACjD,MAAO,CAAE,MAAO,qBAAsB,EAG1C,GAAIF,IAAW,QAAaK,EAAQ,MAAQL,EACxC,MAAO,CAAE,MAAO,6BAA6BA,CAAM,GAAI,EAG3D,GAAIC,IAAa,OAAW,CACxB,IAAMM,EAAMF,EAAQ,IAEpB,GAAI,EADa,MAAM,QAAQE,CAAG,EAAIA,EAAMA,EAAM,CAACA,CAAG,EAAI,CAAC,GAC7C,SAASN,CAAQ,EAC3B,MAAO,CAAE,MAAO,+BAA+BA,CAAQ,GAAI,CAEnE,CAEA,MAAO,CAAE,OAAAG,EAAQ,QAAAC,CAAQ,CAC7B,CAMA,IAAMG,EAAN,KAAoE,CACvD,KACAC,GACAC,GAET,YAAYC,EAA8B,CACtC,KAAK,KAAOA,EAAQ,MAAQ,MAC5B,KAAKF,GAAWE,EAChB,KAAKD,GAAcC,EAAQ,YAAc,CAAC,OAAO,CACrD,CAEA,MAAM,aACFC,EACgC,CAChC,IAAMC,EAAaD,EAAQ,QAAQ,cACnC,GAAI,CAACC,EACD,MAAO,CACH,UAAW,GACX,QAAS,8BACb,EAGJ,GAAI,CAACA,EAAW,WAAW,SAAS,EAChC,MAAO,CACH,UAAW,GACX,QAAS,6CACb,EAGJ,IAAMf,EAAQe,EAAW,MAAM,CAAC,EAAE,KAAK,EACvC,GAAI,CAACf,EACD,MAAO,CAAE,UAAW,GAAO,QAAS,oBAAqB,EAG7D,IAAMgB,EAASjB,EACXC,EACA,KAAKW,GAAS,OACd,KAAKC,GACL,KAAKD,GAAS,OACd,KAAKA,GAAS,SACd,KAAKA,GAAS,cAClB,EAEA,GAAI,UAAWK,EACX,MAAO,CAAE,UAAW,GAAO,QAASA,EAAO,KAAM,EAGrD,IAAMC,EAAQ,KAAKN,GAAS,UAAUK,EAAO,OAAO,EAG9CE,EAAS,IAAI,IACnB,OAAW,CAACC,EAAKC,CAAG,IAAK,OAAO,QAAQJ,EAAO,OAAO,GAC9C,OAAOI,GAAQ,UAGf,MAAM,QAAQA,CAAG,GACjBA,EAAI,MAAMC,GAAK,OAAOA,GAAM,QAAQ,IAEpCH,EAAO,IAAIC,EAAKC,CAAG,EAK3B,MAAO,CAAE,UAAW,GAAM,UADR,IAAIE,EAAU,GAAML,EAAOC,CAAM,CACf,CACxC,CAEA,WAAyD,CACrD,MAAO,CACH,WAAY,mBACZ,YAAa,QACjB,CACJ,CACJ,EAKO,SAASK,EACZV,EACuB,CACvB,OAAO,IAAIH,EAAwBG,CAAO,CAC9C,CAMA,SAASW,EAAgB9B,EAAsB,CAC3C,OAAOA,EACF,SAAS,QAAQ,EACjB,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,GAAG,EAClB,QAAQ,MAAO,EAAE,CAC1B,CAMO,SAAS+B,EACZlB,EACAd,EACAiC,EAAY,QACN,CACN,IAAMpB,EAAoB,CAAE,IAAKoB,EAAW,IAAK,KAAM,EAEjDrC,EAAYmC,EACd,OAAO,KAAK,KAAK,UAAUlB,CAAM,EAAG,OAAO,CAC/C,EACMhB,EAAakC,EACf,OAAO,KAAK,KAAK,UAAUjB,CAAO,EAAG,OAAO,CAChD,EAEMb,EAAO,GAAGL,CAAS,IAAIC,CAAU,GAEnCqC,EAEE/B,EAAWV,EAAWwC,CAAS,EACrC,GAAI9B,EACA+B,EAAmB,aAAW/B,EAAUH,CAAM,EAAE,OAAOC,CAAI,EAAE,OAAO,MACjE,CACH,IAAMI,EAAUX,EAAUuC,CAAS,EACnC,GAAI,CAAC5B,EACD,MAAM,IAAI,MAAM,0BAA0B4B,CAAS,EAAE,EAEzDC,EACK,aAAW7B,CAAO,EAClB,OAAOJ,CAAI,EACX,KAAK,OAAOD,GAAW,SAAWA,EAAS,CAAE,IAAKA,CAAO,CAAC,CACnE,CAEA,MAAO,GAAGC,CAAI,IAAI8B,EAAgBG,CAAS,CAAC,EAChD,CClSO,SAASC,EACZC,EACW,CACX,OAAO,OAAO,OAAOA,CAAK,CAC9B","names":["requireRole","roles","principal","role","PolicyBuilder","#requirements","requirement","name","AuthorizationService","#policies","policies","requirementsOrPolicy","requirements","policy","req","parseCookies","header","cookies","pairs","pair","idx","key","value","serializeCookie","name","options","cookie","Principal","_Principal","isAuthenticated","value","claims","role","claimKey","v","type","CookieAuthenticationScheme","#options","options","context","cookieValue","cookieHeader","parseCookies","value","Principal","cookieScheme","crypto","base64urlDecode","input","base64","pad","HMAC_ALGOS","RSA_ALGOS","verifySignature","headerB64","payloadB64","signatureB64","alg","secret","data","signatureBytes","hmacHash","expected","rsaHash","decodeJwt","token","allowedAlgorithms","issuer","audience","clockTolerance","parts","header","payload","now","aud","JwtAuthenticationScheme","#options","#algorithms","options","context","authHeader","result","value","claims","key","val","v","Principal","jwtScheme","base64urlEncode","signJwt","algorithm","signature","defineRoles","roles"]}

package/package.json

@@ -0,0 +1,47 @@
+{
+    "author": "Andrew Zolotukhin <andrew_zol@cleverbrush.com>",
+    "bugs": {
+        "url": "https://github.com/cleverbrush/framework/issues",
+        "email": "andrew_zol@cleverbrush.com"
+    },
+    "dependencies": {
+        "@cleverbrush/schema": "0.0.0-beta-20260413195755"
+    },
+    "description": "Transport-agnostic authentication & authorization — JWT, cookies, role-based policies, schema-typed principals",
+    "files": [
+        "dist"
+    ],
+    "homepage": "https://docs.cleverbrush.com/auth",
+    "keywords": [
+        "authentication",
+        "authorization",
+        "jwt",
+        "cookies",
+        "roles",
+        "typescript",
+        "cleverbrush"
+    ],
+    "license": "BSD 3-Clause",
+    "main": "./dist/index.js",
+    "exports": {
+        ".": {
+            "types": "./dist/index.d.ts",
+            "import": "./dist/index.js"
+        }
+    },
+    "sideEffects": false,
+    "name": "@cleverbrush/auth",
+    "readme": "https://github.com/cleverbrush/framework/tree/master/libs/auth#readme",
+    "repository": {
+        "type": "git",
+        "url": "github:cleverbrush/framework"
+    },
+    "scripts": {
+        "watch": "tsc --build tsconfig.build.json --watch",
+        "build": "tsup && tsc --project tsconfig.build.json --emitDeclarationOnly",
+        "clean": "rm -rf dist tsconfig.build.tsbuildinfo"
+    },
+    "type": "module",
+    "types": "./dist/index.d.ts",
+    "version": "0.0.0-beta-20260413195755"
+}