@coreiam/auth 1.0.392-beta.1 → 1.0.392-beta.12

package/dist/core/index.d.ts

@@ -41,6 +41,7 @@ export interface RefreshSessionResult {
 }
 /** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
 export declare function toIdentity(payload: JWTPayload): CoreIAMIdentity;
+export declare function retryAfterSeconds(body: unknown): number | undefined;
 /**
 export class CoreIAM {
   private apiKey: string = '';
@@ -55,6 +56,16 @@ export class CoreIAM {
     if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
   }
 */
+/** Default gateway labels (the retired coreiam.e-qalam.com is never a default). */
+export declare const COREIAM_DEV_GATEWAY_URL = "https://dev.e-qalam.com";
+export declare const COREIAM_LIVE_GATEWAY_URL = "https://api.e-qalam.com";
+/** Default by key prefix: pk_dev_ → dev label, anything else → live. */
+export declare function defaultGatewayUrlForKey(apiKey: string): string;
+/** Resolution order: explicit baseUrl > COREIAM_API_URL > key-prefix default. */
+export declare function resolveGatewayUrl(config?: {
+    baseUrl?: string;
+    apiKey?: string;
+}): string;
 export declare class CoreIAM {
     private apiKey;
     private baseUrl;
@@ -73,9 +84,14 @@ export declare class CoreIAM {
       * this instance's API key. Server-to-server, read-only.
       * THROWS on failure — an audit must never silently see an empty roster.
       */
-    listIdentities(): Promise<{
+    listIdentities(params?: {
+        limit?: number;
+        offset?: number;
+        roles?: string[];
+    }): Promise<{
         users: DirectoryIdentity[];
         total: number;
+        next_offset?: number;
     }>;
     private readCookieHeader;
     private readSessionCookie;
@@ -131,9 +147,53 @@ export declare class CoreIAM {
     loginWithCsrfProtection(identifier: string, password: string, incomingHeaders: Headers): Promise<Response>;
     registerWithCsrfProtection(userData: any, incomingHeaders: Headers): Promise<Response>;
     updateProfile(updateData: any, incomingHeaders: Headers): Promise<Response>;
+    changePassword(currentPassword: string, newPassword: string, incomingHeaders: Headers): Promise<Response>;
     setupMfa(incomingHeaders: Headers): Promise<Response>;
     verifyMfa(token: string, incomingHeaders: Headers): Promise<Response>;
     disableMfa(incomingHeaders: Headers): Promise<Response>;
-    requestOtp(body: any, incomingHeaders: Headers): Promise<Response>;
-    verifyOtp(body: any, incomingHeaders: Headers): Promise<Response>;
+    requestOtp(body: RequestOtpBody, incomingHeaders: Headers): Promise<Response>;
+    verifyOtp(body: VerifyOtpBody, incomingHeaders: Headers): Promise<Response>;
+    forgotPassword(email: string, incomingHeaders: Headers): Promise<Response>;
+    verifyEmail(body: VerifyEmailBody, incomingHeaders: Headers): Promise<Response>;
+    resendVerification(email: string, incomingHeaders: Headers): Promise<Response>;
+    resetPassword(email: string, otp: string, newPassword: string, incomingHeaders: Headers): Promise<Response>;
+    listSessions(incomingHeaders: Headers): Promise<Response>;
+    revokeSession(sessionId: string, incomingHeaders: Headers): Promise<Response>;
+    revokeAllSessions(incomingHeaders: Headers): Promise<Response>;
+}
+export declare const CSRF_PROTECTED_PATHS: ReadonlySet<string>;
+export declare const OAUTH_PROVIDERS: ReadonlySet<string>;
+export interface RequestOtpBody {
+    email: string;
+}
+export interface VerifyOtpBody {
+    email: string;
+    otp: string;
+}
+export interface VerifyEmailBody {
+    email: string;
+    otp: string;
+}
+export interface RequestResetBody {
+    email: string;
+}
+export interface ResetPasswordBody {
+    email: string;
+    otp: string;
+    newPassword: string;
+}
+export interface SessionSummary {
+    id: string;
+    userAgent: string;
+    ipAddress: string;
+    createdAt: string;
+    lastActiveAt: string;
+    isCurrent: boolean;
+}
+export interface ListSessionsResponse {
+    sessions: SessionSummary[];
+}
+export interface RevokeAllSessionsResponse {
+    success: boolean;
+    sessionsRevoked: number;
 }

package/dist/core/index.js

@@ -1,7 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreIAM = void 0;
+exports.OAUTH_PROVIDERS = exports.CSRF_PROTECTED_PATHS = exports.CoreIAM = exports.COREIAM_LIVE_GATEWAY_URL = exports.COREIAM_DEV_GATEWAY_URL = void 0;
 exports.toIdentity = toIdentity;
+exports.retryAfterSeconds = retryAfterSeconds;
+exports.defaultGatewayUrlForKey = defaultGatewayUrlForKey;
+exports.resolveGatewayUrl = resolveGatewayUrl;
 // src/core/index.ts
 const jose_1 = require("jose");
 /** Maps gateway token claims → CoreIAMIdentity (same shape the Next.js middleware injects). */
@@ -13,6 +16,17 @@ function toIdentity(payload) {
         roles: Array.isArray(payload.roles) ? payload.roles : [],
     };
 }
+function retryAfterSeconds(body) {
+    const msg = body?.message;
+    for (const m of Array.isArray(msg) ? msg : [msg]) {
+        if (typeof m === 'string') {
+            const match = m.match(/Try again in (\d+) seconds?/);
+            if (match)
+                return Number(match[1]);
+        }
+    }
+    return undefined;
+}
 /**
 export class CoreIAM {
   private apiKey: string = '';
@@ -27,6 +41,21 @@ export class CoreIAM {
     if (!this.baseUrl) throw new Error('CoreIAM: Missing Gateway URL (COREIAM_API_URL)');
   }
 */
+// ── K13c: config layer ──────────────────────────────────────────────
+/** Default gateway labels (the retired coreiam.e-qalam.com is never a default). */
+exports.COREIAM_DEV_GATEWAY_URL = 'https://dev.e-qalam.com';
+exports.COREIAM_LIVE_GATEWAY_URL = 'https://api.e-qalam.com';
+/** Default by key prefix: pk_dev_ → dev label, anything else → live. */
+function defaultGatewayUrlForKey(apiKey) {
+    return (apiKey || '').startsWith('pk_dev_') ? exports.COREIAM_DEV_GATEWAY_URL : exports.COREIAM_LIVE_GATEWAY_URL;
+}
+/** Resolution order: explicit baseUrl > COREIAM_API_URL > key-prefix default. */
+function resolveGatewayUrl(config) {
+    const explicit = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    if (explicit)
+        return explicit;
+    return defaultGatewayUrlForKey(config?.apiKey || process.env.COREIAM_API_KEY || '');
+}
 class CoreIAM {
     apiKey = '';
     baseUrl = '';
@@ -38,7 +67,7 @@ class CoreIAM {
     refreshInFlight = null;
     constructor(config) {
         this.apiKey = config?.apiKey || process.env.COREIAM_API_KEY || '';
-        this.baseUrl = (config?.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+        this.baseUrl = resolveGatewayUrl(config);
         this.issuer = config?.issuer ?? 'coreiam';
         this.audience = config?.audience;
         this.sessionCookieName = config?.sessionCookieName ?? 'jwt';
@@ -72,14 +101,30 @@ class CoreIAM {
       * this instance's API key. Server-to-server, read-only.
       * THROWS on failure — an audit must never silently see an empty roster.
       */
-    async listIdentities() {
-        const response = await this.proxy('/api/v1/directory', { method: 'GET' }, new Headers());
+    async listIdentities(params) {
+        const search = new URLSearchParams();
+        if (params?.limit != null)
+            search.set('limit', String(params.limit));
+        if (params?.offset != null)
+            search.set('offset', String(params.offset));
+        if (params?.roles?.length)
+            search.set('roles', params.roles.join(','));
+        const qs = search.toString();
+        const response = await this.proxy(`/api/v1/directory${qs ? `?${qs}` : ''}`, { method: 'GET' }, new Headers());
         if (!response.ok) {
             const body = await response.text().catch(() => '');
             throw new Error(`listIdentities failed: ${response.status} ${body}`);
         }
-        const data = await response.json();
-        return { users: data.users ?? [], total: data.total ?? 0 };
+        const data = await response.json().catch(() => null);
+        if (!data || !Array.isArray(data.users)) {
+            throw new Error(`listIdentities: unexpected response shape — HTTP 200 without a users array. ` +
+                `This is not an empty directory; verify COREIAM_API_URL points at the CoreIAM gateway.`);
+        }
+        return {
+            users: data.users,
+            total: typeof data.total === 'number' ? data.total : data.users.length,
+            ...(typeof data.next_offset === 'number' ? { next_offset: data.next_offset } : {}),
+        };
     }
     readCookieHeader(input) {
         if (typeof input === 'string')
@@ -88,15 +133,33 @@ class CoreIAM {
             return input.get('cookie') || '';
         return input.cookie || '';
     }
+    // private readSessionCookie(input: SessionInput): string | null {
+    //   const raw = this.readCookieHeader(input);
+    //   if (!raw) return null;
+    //   // Anchored to a real cookie-name boundary (same pattern proxy() uses),
+    //   // so a cookie named "notjwt" or "xjwt" can never match.
+    //   const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    //   const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
+    //   return match ? decodeURIComponent(match[1]) : null;
+    // }
+    // PATCH 1 — readSessionCookie: a corrupt cookie value (%E0%A4%A) currently
+    // throws URIError out of verifySession → 500 on /session. A corrupt value is
+    // an invalid token, not a server error: return it raw; jwtVerify classifies
+    // it as 'invalid_signature'.
     readSessionCookie(input) {
         const raw = this.readCookieHeader(input);
         if (!raw)
             return null;
-        // Anchored to a real cookie-name boundary (same pattern proxy() uses),
-        // so a cookie named "notjwt" or "xjwt" can never match.
         const escaped = this.sessionCookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
         const match = raw.match(new RegExp(`(?:^|;\\s*)${escaped}=([^;]+)`));
-        return match ? decodeURIComponent(match[1]) : null;
+        if (!match)
+            return null;
+        try {
+            return decodeURIComponent(match[1]);
+        }
+        catch {
+            return match[1];
+        }
     }
     async verifySession(input) {
         const token = this.readSessionCookie(input);
@@ -305,8 +368,22 @@ class CoreIAM {
         const existingCookieStr = incomingHeaders.get('cookie') || '';
         const newCookiePairs = csrfCookies.map(c => c.split(';')[0]);
         if (newCookiePairs.length > 0) {
-            const combinedCookies = [existingCookieStr, ...newCookiePairs].filter(Boolean).join('; ');
-            authHeaders.set('cookie', combinedCookies);
+            // FIX (SDK-4): dedupe by cookie NAME, newest value wins. The old
+            // [existing, ...new].join() emitted 'csrfToken=old; csrfToken=new' once
+            // the browser jar already held a csrf cookie and the handshake rotated
+            // it — whether the backend parser reads the first or last duplicate
+            // decided 403-or-pass. Nondeterministic across parsers is a bug.
+            const jar = new Map();
+            for (const pair of [...existingCookieStr.split(';'), ...newCookiePairs]) {
+                const trimmed = pair.trim();
+                if (!trimmed)
+                    continue;
+                const eq = trimmed.indexOf('=');
+                if (eq === -1)
+                    continue;
+                jar.set(trimmed.slice(0, eq), trimmed.slice(eq + 1));
+            }
+            authHeaders.set('cookie', [...jar.entries()].map(([k, v]) => `${k}=${v}`).join('; '));
         }
         return this.proxy(path, init, authHeaders);
     }
@@ -331,6 +408,13 @@ class CoreIAM {
             body: JSON.stringify(updateData),
         }, incomingHeaders);
     }
+    async changePassword(currentPassword, newPassword, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/password', {
+            method: 'PUT',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ currentPassword, newPassword }),
+        }, incomingHeaders);
+    }
     async setupMfa(incomingHeaders) {
         return this.proxyWithCsrfProtection('/auth/mfa/setup', { method: 'POST' }, incomingHeaders);
     }
@@ -358,5 +442,77 @@ class CoreIAM {
             body: JSON.stringify(body),
         }, incomingHeaders);
     }
+    // W3 beta.6: forgot-password / reset-password. Both go through the same
+    // CSRF funnel as every other CsrfGuard-decorated endpoint — the paths are
+    // pre-registered in CSRF_PROTECTED_PATHS (SDK-6), so the middleware proxy
+    // and these methods stay in parity.
+    async forgotPassword(email, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/request-reset', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email }),
+        }, incomingHeaders);
+    }
+    async verifyEmail(body, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/verify-email', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify(body),
+        }, incomingHeaders);
+    }
+    async resendVerification(email, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/resend-verification', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email }),
+        }, incomingHeaders);
+    }
+    async resetPassword(email, otp, newPassword, incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/reset-password', {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ email, otp, newPassword }),
+        }, incomingHeaders);
+    }
+    // W4 (beta.7): session management surface. listSessions is a plain
+    // authenticated GET (same shape as the /auth/profile GET precedent —
+    // JWT comes from the forwarded cookie via proxy(), reads carry no CSRF
+    // requirement); the two state-changing calls go through the shared CSRF
+    // handshake exactly like changePassword.
+    async listSessions(incomingHeaders) {
+        return this.proxy('/auth/sessions', { method: 'GET' }, incomingHeaders);
+    }
+    async revokeSession(sessionId, incomingHeaders) {
+        // Same rationale as OAUTH_PROVIDERS (SDK-5): never interpolate an
+        // unvalidated path segment into a URL. The backend's ParseUUIDPipe
+        // would reject garbage with a 400 anyway — this fails fast
+        // client-side and can never become a traversal string.
+        if (!/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(sessionId)) {
+            throw new Error('revokeSession: sessionId must be a UUID');
+        }
+        return this.proxyWithCsrfProtection(`/auth/sessions/${sessionId}`, { method: 'DELETE' }, incomingHeaders);
+    }
+    async revokeAllSessions(incomingHeaders) {
+        return this.proxyWithCsrfProtection('/auth/sessions/revoke-all', { method: 'POST' }, incomingHeaders);
+    }
 }
 exports.CoreIAM = CoreIAM;
+exports.CSRF_PROTECTED_PATHS = new Set([
+    '/auth/login', '/auth/register', '/auth/discover-tenants',
+    '/auth/request-otp', '/auth/verify-otp', '/auth/mfa/login', '/auth/verify-email', '/auth/resend-verification',
+    '/auth/profile', '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
+    '/auth/password',
+    '/auth/request-reset', '/auth/reset-password',
+    // W4 (beta.7): revoke-all is exact-matched. The per-session revoke is a
+    // DYNAMIC path (/auth/sessions/<uuid>) a string Set cannot match — the SDK
+    // methods self-handshake via proxyWithCsrfProtection so server-action
+    // callers are fully covered; middleware-proxied browser-direct DELETEs to
+    // /api/auth/sessions/<uuid> are not auto-handshaked (known limitation; the
+    // fix is a prefix matcher inside middleware.ts, deliberately deferred to
+    // keep this patch off that file).
+    '/auth/sessions/revoke-all',
+]);
+// FIX (SDK-5): single source of truth for supported OAuth providers. Every
+// place that interpolates a provider segment into a backend URL must check
+// this set first — an unvalidated path segment is a traversal surface.
+exports.OAUTH_PROVIDERS = new Set(['google', 'github']);

package/dist/express/index.js

@@ -6,11 +6,6 @@ exports.requireAuth = requireAuth;
 // src/express/index.ts
 const express_1 = require("express");
 const core_1 = require("../core");
-const CSRF_PROTECTED = new Set([
-    '/auth/login', '/auth/register', '/auth/profile',
-    '/auth/mfa/setup', '/auth/mfa/verify', '/auth/mfa/disable',
-    '/auth/request-otp', '/auth/verify-otp',
-]);
 /** Express 4 does not catch async rejections — route them to next(err). */
 const wrap = (fn) => (req, res, next) => { fn(req, res, next).catch(next); };
 function sessionCookie(name, value, maxAgeSec, isProd) {
@@ -21,7 +16,7 @@ function coreIamExpress(options) {
     const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
     const successUrl = options.successUrl ?? '/';
     const signInUrl = options.signInUrl ?? '/login';
-    const gatewayUrl = (options.baseUrl || process.env.COREIAM_API_URL || '').replace(/\/+$/, '');
+    const gatewayUrl = (0, core_1.resolveGatewayUrl)(options);
     const isProd = process.env.NODE_ENV === 'production';
     const iam = new core_1.CoreIAM(options);
     const router = (0, express_1.Router)();
@@ -70,7 +65,12 @@ function coreIamExpress(options) {
         const code = req.query.code;
         const state = req.query.state;
         const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
-        const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        // const target = `/auth/oauth/callback/${provider}?code=${code}&state=${state}&redirectUri=${encodeURIComponent(redirectUri)}`;
+        // OAuth callback — encode all three params:
+        const target = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(String(code ?? ''))}`
+            + `&state=${encodeURIComponent(String(state ?? ''))}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
         const response = await iam.proxy(target, { method: 'GET' }, toHeaders(req));
         const data = await response.json().catch(() => ({}));
         // Account linking: redirect to CoreIAM's hosted confirmation page
@@ -138,7 +138,7 @@ function coreIamExpress(options) {
             init.body = req.body ? JSON.stringify(req.body) : undefined;
             init.headers = { 'Content-Type': 'application/json' };
         }
-        const response = CSRF_PROTECTED.has(target)
+        const response = core_1.CSRF_PROTECTED_PATHS.has(target)
             ? await iam.proxyWithCsrfProtection(target, init, toHeaders(req))
             : await iam.proxy(target, init, toHeaders(req));
         const data = await response.json().catch(() => ({}));

package/dist/hono/index.d.ts

@@ -0,0 +1,33 @@
+import { Hono, type MiddlewareHandler } from 'hono';
+import { CoreIAMIdentity } from '../core';
+export interface CoreIamHonoOptions {
+    apiKey: string;
+    baseUrl: string;
+    /** Your app's public URL (OAuth callbacks redirect back here). */
+    appUrl: string;
+    /** Mount path of the adapter. MUST match how you mount it. Default '/api/auth'. */
+    authPath?: string;
+    signInUrl?: string;
+    successUrl?: string;
+}
+/** Pass to your app: `new Hono<CoreIAMEnv>()` so `c.get('identity')` is typed. */
+export type CoreIAMEnv = {
+    Variables: {
+        identity: CoreIAMIdentity;
+    };
+};
+/**
+ * Drop-in auth router for Hono (Node, Bun, Deno, Workers).
+ *   const app = new Hono();
+ *   app.route('/api/auth', coreIamHono({ apiKey, baseUrl, appUrl }));
+ * Same behavior as the Express adapter: CSRF handshake, OAuth + account
+ * linking, cookie forwarding, silent refresh on /session.
+ */
+export declare function coreIamHono(options: CoreIamHonoOptions): Hono;
+export interface RequireAuthConfig {
+    apiKey?: string;
+    baseUrl?: string;
+    signInUrl?: string;
+}
+/** Route guard: local verify → c.get('identity'); 401s API requests, redirects pages. */
+export declare function requireAuth(config?: RequireAuthConfig): MiddlewareHandler<CoreIAMEnv>;

package/dist/hono/index.js

@@ -0,0 +1,195 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.coreIamHono = coreIamHono;
+exports.requireAuth = requireAuth;
+// src/hono/index.ts
+const hono_1 = require("hono");
+const core_1 = require("../core");
+/**
+ * Drop-in auth router for Hono (Node, Bun, Deno, Workers).
+ *   const app = new Hono();
+ *   app.route('/api/auth', coreIamHono({ apiKey, baseUrl, appUrl }));
+ * Same behavior as the Express adapter: CSRF handshake, OAuth + account
+ * linking, cookie forwarding, silent refresh on /session.
+ */
+function coreIamHono(options) {
+    const appUrl = options.appUrl.replace(/\/+$/, '');
+    const authPath = (options.authPath ?? '/api/auth').replace(/\/+$/, '');
+    const successUrl = options.successUrl ?? '/';
+    const signInUrl = options.signInUrl ?? '/login';
+    const gatewayUrl = options.baseUrl.replace(/\/+$/, '');
+    const isProd = process.env.NODE_ENV === 'production';
+    const iam = new core_1.CoreIAM(options);
+    const app = new hono_1.Hono();
+    // c.req.path is always the FULL path (Hono does not rewrite it per sub-app),
+    // so the mount prefix must be stripped by hand to get '/login' → '/auth/login'.
+    const relPath = (c) => {
+        const p = c.req.path;
+        if (p === authPath)
+            return '/';
+        if (p.startsWith(`${authPath}/`))
+            return p.slice(authPath.length);
+        if (process.env.NODE_ENV !== 'production') {
+            console.warn(`[coreIamHono] ${p} does not start with authPath '${authPath}' — ` +
+                `if you mounted the adapter elsewhere, pass the same value as authPath.`);
+        }
+        return p;
+    };
+    // Same attributes as the Express adapter's sessionCookie().
+    const sessionCookie = (name, value, maxAgeSec) => `${name}=${encodeURIComponent(value)}; Path=/; HttpOnly; SameSite=Lax; Max-Age=${maxAgeSec}${isProd ? '; Secure' : ''}`;
+    // Mirrors the Express adapter (json() + urlencoded()): both content types
+    // accepted on every auth route, re-serialized as JSON for the gateway.
+    const readBody = async (c) => {
+        if ((c.req.header('content-type') || '').includes('application/x-www-form-urlencoded')) {
+            return Object.fromEntries(new URLSearchParams(await c.req.text()).entries());
+        }
+        return c.req.json().catch(() => undefined);
+    };
+    // ── CORS preflight short-circuit — same as the Next.js middleware, so ──
+    // cross-origin frontends work with zero setup. Same-origin (the documented
+    // pattern) never sends OPTIONS.
+    app.options('*', (c) => {
+        const origin = c.req.header('origin');
+        if (origin) {
+            c.header('Access-Control-Allow-Origin', origin);
+            c.header('Access-Control-Allow-Credentials', 'true');
+            c.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+            c.header('Access-Control-Allow-Headers', 'Content-Type, Authorization, X-CSRF-Token');
+            c.header('Vary', 'Origin', { append: true });
+        }
+        return c.body(null, 204);
+    });
+    // ── GET {authPath}/session — local verify + silent refresh (React provider) ──
+    app.get('/session', async (c) => {
+        const result = await iam.verifySession(c.req.raw.headers);
+        if (result.identity)
+            return c.json(result.identity);
+        if (result.reason === 'expired') {
+            const { identity, setCookies } = await iam.refreshSession(c.req.raw.headers);
+            if (identity) {
+                setCookies?.forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+                return c.json(identity);
+            }
+        }
+        return c.json({ error: 'unauthenticated' }, 401);
+    });
+    // ── GET {authPath}/oauth/:provider — initiate ──
+    app.get('/oauth/:provider', async (c, next) => {
+        const provider = c.req.param('provider');
+        if (provider === 'link')
+            return next(); // link/confirm is POSTed below
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/initiate/${provider}?redirectUri=${encodeURIComponent(redirectUri)}&scopes=email,profile`;
+        const response = await iam.proxy(target, { method: 'GET' }, c.req.raw.headers);
+        const data = await response.json().catch(() => ({}));
+        if (data.url)
+            return c.redirect(data.url, 302);
+        return c.redirect(signInUrl, 302);
+    });
+    // ── GET {authPath}/callback/:provider ──
+    app.get('/callback/:provider', async (c) => {
+        const provider = c.req.param('provider');
+        const code = c.req.query('code');
+        const state = c.req.query('state');
+        const redirectUri = `${appUrl}${authPath}/callback/${provider}`;
+        const target = `/auth/oauth/callback/${provider}`
+            + `?code=${encodeURIComponent(code ?? '')}`
+            + `&state=${encodeURIComponent(state ?? '')}`
+            + `&redirectUri=${encodeURIComponent(redirectUri)}`;
+        const response = await iam.proxy(target, { method: 'GET' }, c.req.raw.headers);
+        const data = (await response.json().catch(() => ({})));
+        // Account linking → CoreIAM's hosted confirmation page
+        if (data.action === 'link_candidate') {
+            const redirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+            redirect.searchParams.set('token', data.tempToken);
+            redirect.searchParams.set('provider', data.provider);
+            redirect.searchParams.set('email', data.email || '');
+            redirect.searchParams.set('appOrigin', appUrl);
+            return c.redirect(redirect.toString(), 303);
+        }
+        // Normal login: forward gateway cookies, then redirect.
+        response.headers.getSetCookie().forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+        return c.redirect(successUrl, 302);
+    });
+    // ── POST {authPath}/oauth/link/confirm (hosted page posts urlencoded) ──
+    app.post('/oauth/link/confirm', async (c) => {
+        const contentType = c.req.header('content-type') || '';
+        let formData;
+        if (contentType.includes('application/x-www-form-urlencoded')) {
+            const params = new URLSearchParams(await c.req.text());
+            formData = { tempToken: params.get('tempToken') ?? undefined, password: params.get('password') ?? undefined };
+        }
+        else {
+            formData = (await c.req.json().catch(() => ({})));
+        }
+        const response = await iam.proxy('/auth/oauth/link/confirm', {
+            method: 'POST',
+            body: JSON.stringify(formData),
+            headers: { 'Content-Type': 'application/json' },
+        }, c.req.raw.headers);
+        const data = (await response.json().catch(() => ({})));
+        if (response.ok && data.success) {
+            const finalUrl = new URL(data.redirectUri || '/', appUrl).toString();
+            if (data.accessToken)
+                c.header('Set-Cookie', sessionCookie('jwt', data.accessToken, 24 * 60 * 60), { append: true });
+            if (data.clientRefreshToken)
+                c.header('Set-Cookie', sessionCookie('refreshToken', data.clientRefreshToken, 7 * 24 * 60 * 60), { append: true });
+            // 200 + JS redirect — NOT a 303: breaks the cross-site redirect chain so
+            // the browser sends the freshly-set SameSite=Lax cookies on the next hop.
+            // (Identical to the Express adapter and Next middleware — do not "simplify".)
+            return c.html(`<!DOCTYPE html>
+<html>
+  <head><title>Linking Successful</title></head>
+  <body>
+    <p>Account linked successfully! Redirecting...</p>
+    <script>window.location.href = ${JSON.stringify(finalUrl)};</script>
+  </body>
+</html>`);
+        }
+        const errorRedirect = new URL(`${gatewayUrl}/auth/hosted/confirm-link`);
+        errorRedirect.searchParams.set('token', formData.tempToken || '');
+        errorRedirect.searchParams.set('provider', data.provider || 'google');
+        errorRedirect.searchParams.set('email', data.email || '');
+        errorRedirect.searchParams.set('appOrigin', appUrl);
+        errorRedirect.searchParams.set('error', data.message || 'Invalid password. Link failed.');
+        return c.redirect(errorRedirect.toString(), 303);
+    });
+    // ── Everything else: generic JSON passthrough (login, register, logout,
+    //    csrf-token, MFA, OTP, profile). CSRF-protected endpoints run the
+    //    handshake first — the same set, from core, as Express/Next. ──
+    app.all('*', async (c) => {
+        const target = `/auth${relPath(c)}`;
+        const init = { method: c.req.method };
+        if (c.req.method !== 'GET' && c.req.method !== 'HEAD') {
+            const body = await readBody(c);
+            if (body !== undefined) {
+                init.body = JSON.stringify(body);
+                init.headers = { 'Content-Type': 'application/json' };
+            }
+        }
+        const response = core_1.CSRF_PROTECTED_PATHS.has(target)
+            ? await iam.proxyWithCsrfProtection(target, init, c.req.raw.headers)
+            : await iam.proxy(target, init, c.req.raw.headers);
+        c.status(response.status);
+        response.headers.getSetCookie().forEach((sc) => c.header('Set-Cookie', sc, { append: true }));
+        return c.json(await response.json().catch(() => ({})));
+    });
+    return app;
+}
+/** Route guard: local verify → c.get('identity'); 401s API requests, redirects pages. */
+function requireAuth(config = {}) {
+    const iam = new core_1.CoreIAM(config);
+    const { signInUrl = '/login' } = config;
+    return async (c, next) => {
+        const identity = await iam.getSession(c.req.raw.headers);
+        if (!identity) {
+            const accept = c.req.header('accept') || '';
+            const wantsJson = c.req.path.startsWith('/api') || accept.includes('json') || accept.trim() === '*/*';
+            if (wantsJson)
+                return c.json({ error: 'unauthenticated' }, 401);
+            return c.redirect(signInUrl, 302);
+        }
+        c.set('identity', identity);
+        await next();
+    };
+}

package/dist/nextjs/actions.d.ts

@@ -1,7 +1,8 @@
-import { CoreIAMIdentity } from '../core';
+import { CoreIAMIdentity, RequestOtpBody, VerifyOtpBody, VerifyEmailBody } from '../core';
 export interface AuthResult {
     ok: boolean;
     status: number;
+    retryAfter?: number;
     data: any;
 }
 export declare function getSession(): Promise<CoreIAMIdentity | null>;
@@ -9,8 +10,16 @@ export declare function loginActionSdk(identifier: string, password: string): Pr
 export declare function registerActionSdk(userData: any): Promise<AuthResult>;
 export declare function logoutActionSdk(): Promise<AuthResult>;
 export declare function updateProfileActionSdk(updateData: Record<string, any>): Promise<AuthResult>;
+export declare function changePasswordActionSdk(currentPassword: string, newPassword: string): Promise<AuthResult>;
 export declare function setupMfaActionSdk(): Promise<AuthResult>;
 export declare function verifyMfaActionSdk(token: string): Promise<AuthResult>;
 export declare function disableMfaActionSdk(): Promise<AuthResult>;
-export declare function requestOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;
-export declare function verifyOtpActionSdk(body: Record<string, any>): Promise<AuthResult>;
+export declare function requestOtpActionSdk(body: RequestOtpBody): Promise<AuthResult>;
+export declare function verifyOtpActionSdk(body: VerifyOtpBody): Promise<AuthResult>;
+export declare function verifyEmailActionSdk(body: VerifyEmailBody): Promise<AuthResult>;
+export declare function resendVerificationActionSdk(email: string): Promise<AuthResult>;
+export declare function forgotPasswordActionSdk(email: string): Promise<AuthResult>;
+export declare function resetPasswordActionSdk(email: string, otp: string, newPassword: string): Promise<AuthResult>;
+export declare function listSessionsActionSdk(): Promise<AuthResult>;
+export declare function revokeSessionActionSdk(sessionId: string): Promise<AuthResult>;
+export declare function revokeAllSessionsActionSdk(): Promise<AuthResult>;