@digimuza/saas-core 0.0.2

package/dist/auth/cookies.js

@@ -0,0 +1,58 @@
+/**
+ * Adapt a Next.js-style cookie jar to a {@link CookieStore}.
+ *
+ * Pass the accessor itself, not the jar: Next resolves `cookies()` per request,
+ * so calling it once at module scope would bind every request to the first one.
+ *
+ * ```ts
+ * // lib/auth.ts
+ * import { cookies } from "next/headers";
+ * import { createConfiguredAuthService, createCookieStore } from "@digimuza/saas-core/auth";
+ *
+ * export const auth = createConfiguredAuthService(createCookieStore(cookies));
+ * ```
+ *
+ * Writes only succeed in Server Actions, Route Handlers and middleware. Next
+ * throws on cookie writes from Server Components; session refresh tolerates
+ * that, but sign-in and sign-out must run somewhere writable.
+ */
+export function createCookieStore(getJar) {
+    return {
+        async get(name) {
+            const jar = await getJar();
+            return jar.get(name)?.value;
+        },
+        async set(name, value, options) {
+            const jar = await getJar();
+            await jar.set(name, value, {
+                httpOnly: options.httpOnly,
+                secure: options.secure,
+                sameSite: options.sameSite,
+                path: options.path,
+                maxAge: options.maxAge,
+            });
+        },
+        async delete(name) {
+            const jar = await getJar();
+            await jar.delete(name);
+        },
+    };
+}
+/**
+ * An in-memory cookie store. Useful for tests and for non-HTTP runtimes that
+ * still need to hold a session for the duration of a call.
+ */
+export function createMemoryCookieStore(initial = {}) {
+    const entries = new Map(Object.entries(initial));
+    return {
+        entries,
+        get: (name) => entries.get(name),
+        set: (name, value) => {
+            entries.set(name, value);
+        },
+        delete: (name) => {
+            entries.delete(name);
+        },
+    };
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAyBA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAA0D;IAE1D,OAAO;QACL,KAAK,CAAC,GAAG,CAAC,IAAY;YACpB,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,OAAO,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QAC9B,CAAC;QAED,KAAK,CAAC,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,OAA6B;YAClE,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;gBACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,IAAI,EAAE,OAAO,CAAC,IAAI;gBAClB,MAAM,EAAE,OAAO,CAAC,MAAM;aACvB,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,MAAM,CAAC,IAAY;YACvB,MAAM,GAAG,GAAG,MAAM,MAAM,EAAE,CAAC;YAC3B,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAO,GAA2B,EAAE;IAEpC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAiB,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IAEjE,OAAO;QACL,OAAO;QACP,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAChC,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YACnB,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;YACf,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,14 @@
+import { type AuthService } from "./service.ts";
+import type { CookieStore } from "./types.ts";
+export { getWorkos, resetWorkos } from "./client.ts";
+export { createCookieStore, createMemoryCookieStore, type NextCookieAttributes, type RequestCookieJar, } from "./cookies.ts";
+export { createAuthService, DEFAULT_SESSION_COOKIE, DEFAULT_STATE_COOKIE, type AuthorizationUrl, type AuthService, type AuthServiceDeps, } from "./service.ts";
+export type { AuthorizationUrlOptions, AuthSession, CallbackResult, CookieStore, SessionCookieOptions, } from "./types.ts";
+/**
+ * Build an auth service from configuration, for a given cookie store.
+ *
+ * `secureCookies` follows `APP_ENV`: cookies must be `Secure` in production, but
+ * requiring it in local development over plain HTTP would break sign-in.
+ */
+export declare function createConfiguredAuthService(cookieStore: CookieStore): AuthService;
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAqB,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,GACtB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,gBAAgB,EACrB,KAAK,WAAW,EAChB,KAAK,eAAe,GACrB,MAAM,cAAc,CAAC;AACtB,YAAY,EACV,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,WAAW,EACX,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,WAAW,EAAE,WAAW,GAAG,WAAW,CAYjF"}

package/dist/auth/index.js

@@ -0,0 +1,46 @@
+/**
+ * Public auth surface: `@digimuza/saas-core/auth`. Server-only.
+ *
+ * WorkOS owns identity: OAuth, SAML, OIDC, passkeys, MFA and session sealing.
+ * This module keeps its details behind a small API so application code never
+ * imports the WorkOS SDK directly.
+ *
+ * Applications construct the service once against their runtime's cookie store:
+ *
+ * ```ts
+ * // lib/auth.ts
+ * import { cookies } from "next/headers";
+ * import { createConfiguredAuthService, createCookieStore } from "@digimuza/saas-core/auth";
+ *
+ * export const auth = createConfiguredAuthService(createCookieStore(cookies));
+ * ```
+ *
+ * Then `auth.getCurrentUser()`, `auth.requireUser()`, `auth.getSession()` and
+ * `auth.signOut()` are available throughout the application.
+ */
+import { config } from "../config/index.js";
+import { users } from "../users/index.js";
+import { getWorkos } from "./client.js";
+import { createAuthService } from "./service.js";
+export { getWorkos, resetWorkos } from "./client.js";
+export { createCookieStore, createMemoryCookieStore, } from "./cookies.js";
+export { createAuthService, DEFAULT_SESSION_COOKIE, DEFAULT_STATE_COOKIE, } from "./service.js";
+/**
+ * Build an auth service from configuration, for a given cookie store.
+ *
+ * `secureCookies` follows `APP_ENV`: cookies must be `Secure` in production, but
+ * requiring it in local development over plain HTTP would break sign-in.
+ */
+export function createConfiguredAuthService(cookieStore) {
+    const auth = config.auth;
+    return createAuthService({
+        workos: getWorkos(),
+        cookies: cookieStore,
+        users,
+        clientId: auth.workosClientId,
+        cookiePassword: auth.cookiePassword,
+        redirectUri: auth.redirectUri,
+        secureCookies: config.app.isProduction,
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,iBAAiB,EAAoB,MAAM,cAAc,CAAC;AAGnE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EACL,iBAAiB,EACjB,uBAAuB,GAGxB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,sBAAsB,EACtB,oBAAoB,GAIrB,MAAM,cAAc,CAAC;AAStB;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,WAAwB;IAClE,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;IAEzB,OAAO,iBAAiB,CAAC;QACvB,MAAM,EAAE,SAAS,EAAE;QACnB,OAAO,EAAE,WAAW;QACpB,KAAK;QACL,QAAQ,EAAE,IAAI,CAAC,cAAc;QAC7B,cAAc,EAAE,IAAI,CAAC,cAAc;QACnC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,aAAa,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY;KACvC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/service.d.ts

@@ -0,0 +1,67 @@
+import type { WorkOS } from "@workos-inc/node";
+import type { UsersService, UserWithProfile } from "../users/service.ts";
+import type { AuthorizationUrlOptions, AuthSession, CallbackResult, CookieStore } from "./types.ts";
+export declare const DEFAULT_SESSION_COOKIE = "dg_session";
+export declare const DEFAULT_STATE_COOKIE = "dg_oauth_state";
+export interface AuthServiceDeps {
+    readonly workos: WorkOS;
+    readonly cookies: CookieStore;
+    readonly users: UsersService;
+    readonly clientId: string;
+    readonly cookiePassword: string;
+    readonly redirectUri: string;
+    /** Set `Secure` on session cookies. Must be true in production. */
+    readonly secureCookies: boolean;
+    readonly sessionCookieName?: string;
+    readonly stateCookieName?: string;
+    readonly sessionMaxAgeSeconds?: number;
+}
+export interface AuthorizationUrl {
+    readonly url: string;
+    /**
+     * The generated CSRF state. Already stored in a cookie and verified by
+     * {@link AuthService.handleCallback}; returned for logging and tests.
+     */
+    readonly state: string;
+}
+export interface AuthService {
+    /**
+     * Build the WorkOS AuthKit URL and store a single-use CSRF state cookie.
+     *
+     * Asynchronous because it writes a cookie.
+     */
+    getAuthorizationUrl(options?: AuthorizationUrlOptions): Promise<AuthorizationUrl>;
+    /**
+     * Exchange the callback code for a session.
+     *
+     * Verifies `state` against the cookie set by {@link getAuthorizationUrl},
+     * seals the session into an httpOnly cookie, and syncs the identity into
+     * `users` / `user_profiles`.
+     */
+    handleCallback(input: {
+        code: string;
+        state?: string;
+    }): Promise<CallbackResult>;
+    /** The current session, or `undefined` when unauthenticated. */
+    getSession(): Promise<AuthSession | undefined>;
+    /** As {@link getSession}, but throws {@link UnauthorizedError}. */
+    requireSession(): Promise<AuthSession>;
+    /** The current user, or `undefined` when unauthenticated. */
+    getCurrentUser(): Promise<UserWithProfile | undefined>;
+    /** As {@link getCurrentUser}, but throws {@link UnauthorizedError}. */
+    requireUser(): Promise<UserWithProfile>;
+    /**
+     * Clear the session cookie and return the WorkOS logout URL.
+     *
+     * The caller must redirect to that URL to end the session at the identity
+     * provider too; clearing the cookie alone leaves the WorkOS session alive, so
+     * the next sign-in would silently succeed without re-authenticating.
+     */
+    signOut(options?: {
+        returnTo?: string;
+    }): Promise<{
+        logoutUrl: string | undefined;
+    }>;
+}
+export declare function createAuthService(deps: AuthServiceDeps): AuthService;
+//# sourceMappingURL=service.d.ts.map

package/dist/auth/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAG/C,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,KAAK,EACV,uBAAuB,EACvB,WAAW,EACX,cAAc,EACd,WAAW,EAEZ,MAAM,YAAY,CAAC;AAEpB,eAAO,MAAM,sBAAsB,eAAe,CAAC;AACnD,eAAO,MAAM,oBAAoB,mBAAmB,CAAC;AAQrD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,mEAAmE;IACnE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;CACxC;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,mBAAmB,CAAC,OAAO,CAAC,EAAE,uBAAuB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAElF;;;;;;OAMG;IACH,cAAc,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAEjF,gEAAgE;IAChE,UAAU,IAAI,OAAO,CAAC,WAAW,GAAG,SAAS,CAAC,CAAC;IAE/C,mEAAmE;IACnE,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;IAEvC,6DAA6D;IAC7D,cAAc,IAAI,OAAO,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC;IAEvD,uEAAuE;IACvE,WAAW,IAAI,OAAO,CAAC,eAAe,CAAC,CAAC;IAExC;;;;;;OAMG;IACH,OAAO,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC;QAAE,SAAS,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAC,CAAC;CACtF;AAuCD,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,eAAe,GAAG,WAAW,CAwRpE"}

package/dist/auth/service.js

@@ -0,0 +1,275 @@
+import { randomBytes, timingSafeEqual } from "node:crypto";
+import { UnauthorizedError } from "../errors.js";
+export const DEFAULT_SESSION_COOKIE = "dg_session";
+export const DEFAULT_STATE_COOKIE = "dg_oauth_state";
+/** 30 days. The sealed session carries a refresh token, not a bearer token. */
+const DEFAULT_SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
+/** Long enough to complete a sign-in, short enough to limit replay. */
+const STATE_MAX_AGE_SECONDS = 60 * 10;
+function newState() {
+    return randomBytes(32).toString("base64url");
+}
+/**
+ * Read the `sid` claim from a WorkOS access token.
+ *
+ * The signature is deliberately not verified: this token was just received over
+ * TLS in a direct response from WorkOS, so it has not passed through anything
+ * that could tamper with it, and re-verifying would mean an extra JWKS fetch.
+ * Never use this on a token that arrived from a client.
+ */
+function readSessionId(accessToken) {
+    const payload = accessToken.split(".")[1];
+    if (payload === undefined) {
+        return "";
+    }
+    try {
+        const decoded = JSON.parse(Buffer.from(payload, "base64url").toString("utf8"));
+        return typeof decoded.sid === "string" ? decoded.sid : "";
+    }
+    catch {
+        return "";
+    }
+}
+/** Constant-time comparison, safe for values of differing length. */
+function statesMatch(a, b) {
+    const left = Buffer.from(a);
+    const right = Buffer.from(b);
+    if (left.length !== right.length) {
+        return false;
+    }
+    return timingSafeEqual(left, right);
+}
+export function createAuthService(deps) {
+    const sessionCookie = deps.sessionCookieName ?? DEFAULT_SESSION_COOKIE;
+    const stateCookie = deps.stateCookieName ?? DEFAULT_STATE_COOKIE;
+    const sessionMaxAge = deps.sessionMaxAgeSeconds ?? DEFAULT_SESSION_MAX_AGE_SECONDS;
+    function cookieOptions(maxAge) {
+        return {
+            httpOnly: true,
+            secure: deps.secureCookies,
+            /**
+             * `lax`, not `strict`: the identity provider returns the user via a
+             * top-level GET navigation, and `strict` would withhold the cookie on
+             * that request and break every sign-in.
+             */
+            sameSite: "lax",
+            path: "/",
+            maxAge,
+        };
+    }
+    /**
+     * Persist a refreshed session cookie.
+     *
+     * Next.js Server Components cannot write cookies, and attempting it throws. A
+     * refresh that succeeded at WorkOS is still a usable session for this request,
+     * so the write failure is tolerated rather than surfaced. Applications that
+     * want the rotated token to stick should refresh in middleware, where writing
+     * cookies is allowed.
+     */
+    async function tryPersistSession(sealed) {
+        try {
+            await deps.cookies.set(sessionCookie, sealed, cookieOptions(sessionMaxAge));
+        }
+        catch {
+            // Intentionally ignored; see above.
+        }
+    }
+    async function toSession(input) {
+        /**
+         * Resolve the local user id on every session read, and provision it if the
+         * identity is new. A session sealed by WorkOS is proof of identity, but it
+         * says nothing about whether this database has seen the user yet — that is
+         * not true after a restore, or the first sign-in following a deploy.
+         */
+        const user = (await deps.users.getByWorkosId(input.workosUserId)) ??
+            (await deps.users.syncFromWorkos({
+                workosUserId: input.workosUserId,
+                email: input.email,
+                firstName: input.firstName ?? null,
+                lastName: input.lastName ?? null,
+                profilePictureUrl: input.profilePictureUrl ?? null,
+            }));
+        return {
+            userId: user.id,
+            workosUserId: input.workosUserId,
+            sessionId: input.sessionId,
+            email: input.email,
+            ...(input.organizationId !== undefined ? { organizationId: input.organizationId } : {}),
+            ...(input.impersonatorEmail !== undefined
+                ? { impersonatorEmail: input.impersonatorEmail }
+                : {}),
+        };
+    }
+    async function readSealedSession() {
+        const value = await deps.cookies.get(sessionCookie);
+        return value !== undefined && value.length > 0 ? value : undefined;
+    }
+    return {
+        async getAuthorizationUrl(options = {}) {
+            const state = options.state ?? newState();
+            await deps.cookies.set(stateCookie, state, cookieOptions(STATE_MAX_AGE_SECONDS));
+            /**
+             * WorkOS expects exactly one selector. `provider: "authkit"` means "show
+             * the hosted sign-in UI"; sending it alongside an organization or
+             * connection would conflict with the more specific choice.
+             */
+            const targetsSpecificConnection = options.organizationId !== undefined || options.connectionId !== undefined;
+            const url = deps.workos.userManagement.getAuthorizationUrl({
+                clientId: deps.clientId,
+                redirectUri: options.redirectUri ?? deps.redirectUri,
+                state,
+                ...(targetsSpecificConnection ? {} : { provider: "authkit" }),
+                ...(options.screenHint !== undefined ? { screenHint: options.screenHint } : {}),
+                ...(options.loginHint !== undefined ? { loginHint: options.loginHint } : {}),
+                ...(options.organizationId !== undefined ? { organizationId: options.organizationId } : {}),
+                ...(options.connectionId !== undefined ? { connectionId: options.connectionId } : {}),
+                ...(options.invitationToken !== undefined
+                    ? { invitationToken: options.invitationToken }
+                    : {}),
+            });
+            return { url, state };
+        },
+        async handleCallback({ code, state }) {
+            const expected = await deps.cookies.get(stateCookie);
+            /**
+             * CSRF defence. Without this, an attacker can feed a victim's browser a
+             * callback URL bearing the attacker's `code` and log the victim into the
+             * attacker's account.
+             */
+            if (expected === undefined || state === undefined || !statesMatch(expected, state)) {
+                throw new UnauthorizedError("Invalid or missing OAuth state.");
+            }
+            // Single use, regardless of what happens next.
+            await deps.cookies.delete(stateCookie);
+            const authenticated = await deps.workos.userManagement.authenticateWithCode({
+                code,
+                clientId: deps.clientId,
+                session: { sealSession: true, cookiePassword: deps.cookiePassword },
+            });
+            if (authenticated.sealedSession === undefined) {
+                throw new UnauthorizedError("WorkOS did not return a sealed session.");
+            }
+            await deps.cookies.set(sessionCookie, authenticated.sealedSession, cookieOptions(sessionMaxAge));
+            const synced = await deps.users.syncFromWorkos({
+                workosUserId: authenticated.user.id,
+                email: authenticated.user.email,
+                firstName: authenticated.user.firstName,
+                lastName: authenticated.user.lastName,
+                profilePictureUrl: authenticated.user.profilePictureUrl,
+            });
+            return {
+                session: {
+                    userId: synced.id,
+                    workosUserId: authenticated.user.id,
+                    sessionId: readSessionId(authenticated.accessToken),
+                    email: authenticated.user.email,
+                    ...(authenticated.organizationId !== undefined
+                        ? { organizationId: authenticated.organizationId }
+                        : {}),
+                    ...(authenticated.impersonator?.email !== undefined
+                        ? { impersonatorEmail: authenticated.impersonator.email }
+                        : {}),
+                },
+                ...(state !== undefined ? { state } : {}),
+            };
+        },
+        async getSession() {
+            const sealed = await readSealedSession();
+            if (sealed === undefined) {
+                return undefined;
+            }
+            const session = deps.workos.userManagement.loadSealedSession({
+                sessionData: sealed,
+                cookiePassword: deps.cookiePassword,
+            });
+            const result = await session.authenticate();
+            if (result.authenticated) {
+                return toSession({
+                    workosUserId: result.user.id,
+                    email: result.user.email,
+                    sessionId: result.sessionId,
+                    firstName: result.user.firstName,
+                    lastName: result.user.lastName,
+                    profilePictureUrl: result.user.profilePictureUrl,
+                    ...(result.organizationId !== undefined
+                        ? { organizationId: result.organizationId }
+                        : {}),
+                    ...(result.impersonator?.email !== undefined
+                        ? { impersonatorEmail: result.impersonator.email }
+                        : {}),
+                });
+            }
+            /**
+             * A short-lived access token expiring is the normal case, not an error:
+             * the sealed session still holds a valid refresh token. Any other reason
+             * (tampered or absent cookie) is treated as unauthenticated.
+             */
+            if (result.reason !== "invalid_jwt") {
+                return undefined;
+            }
+            const refreshed = await session.refresh({ cookiePassword: deps.cookiePassword });
+            if (!refreshed.authenticated) {
+                return undefined;
+            }
+            if (refreshed.sealedSession !== undefined) {
+                await tryPersistSession(refreshed.sealedSession);
+            }
+            return toSession({
+                workosUserId: refreshed.user.id,
+                email: refreshed.user.email,
+                sessionId: refreshed.sessionId,
+                firstName: refreshed.user.firstName,
+                lastName: refreshed.user.lastName,
+                profilePictureUrl: refreshed.user.profilePictureUrl,
+                ...(refreshed.organizationId !== undefined
+                    ? { organizationId: refreshed.organizationId }
+                    : {}),
+                ...(refreshed.impersonator?.email !== undefined
+                    ? { impersonatorEmail: refreshed.impersonator.email }
+                    : {}),
+            });
+        },
+        async requireSession() {
+            const session = await this.getSession();
+            if (session === undefined) {
+                throw new UnauthorizedError();
+            }
+            return session;
+        },
+        async getCurrentUser() {
+            const session = await this.getSession();
+            if (session === undefined) {
+                return undefined;
+            }
+            return deps.users.getById(session.userId);
+        },
+        async requireUser() {
+            const user = await this.getCurrentUser();
+            if (user === undefined) {
+                throw new UnauthorizedError();
+            }
+            return user;
+        },
+        async signOut(options = {}) {
+            const sealed = await readSealedSession();
+            // Clear locally first, so a WorkOS failure cannot leave the user signed in.
+            await deps.cookies.delete(sessionCookie);
+            if (sealed === undefined) {
+                return { logoutUrl: undefined };
+            }
+            try {
+                const session = deps.workos.userManagement.loadSealedSession({
+                    sessionData: sealed,
+                    cookiePassword: deps.cookiePassword,
+                });
+                const logoutUrl = await session.getLogoutUrl(options.returnTo !== undefined ? { returnTo: options.returnTo } : {});
+                return { logoutUrl };
+            }
+            catch {
+                // An unreadable or already-invalid session has nothing left to log out.
+                return { logoutUrl: undefined };
+            }
+        },
+    };
+}
+//# sourceMappingURL=service.js.map

package/dist/auth/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/auth/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAI3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAUjD,MAAM,CAAC,MAAM,sBAAsB,GAAG,YAAY,CAAC;AACnD,MAAM,CAAC,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AAErD,+EAA+E;AAC/E,MAAM,+BAA+B,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE1D,uEAAuE;AACvE,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC;AAgEtC,SAAS,QAAQ;IACf,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,WAAmB;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAE5E,CAAC;QACF,OAAO,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,qEAAqE;AACrE,SAAS,WAAW,CAAC,CAAS,EAAE,CAAS;IACvC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,eAAe,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,IAAqB;IACrD,MAAM,aAAa,GAAG,IAAI,CAAC,iBAAiB,IAAI,sBAAsB,CAAC;IACvE,MAAM,WAAW,GAAG,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC;IACjE,MAAM,aAAa,GAAG,IAAI,CAAC,oBAAoB,IAAI,+BAA+B,CAAC;IAEnF,SAAS,aAAa,CAAC,MAAc;QACnC,OAAO;YACL,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,IAAI,CAAC,aAAa;YAC1B;;;;eAIG;YACH,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,GAAG;YACT,MAAM;SACP,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,UAAU,iBAAiB,CAAC,MAAc;QAC7C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,EAAE,aAAa,CAAC,aAAa,CAAC,CAAC,CAAC;QAC9E,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;IACH,CAAC;IAED,KAAK,UAAU,SAAS,CAAC,KASxB;QACC;;;;;WAKG;QACH,MAAM,IAAI,GACR,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;YACpD,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC/B,YAAY,EAAE,KAAK,CAAC,YAAY;gBAChC,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,IAAI;gBAChC,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,IAAI,IAAI;aACnD,CAAC,CAAC,CAAC;QAEN,OAAO;YACL,MAAM,EAAE,IAAI,CAAC,EAAE;YACf,YAAY,EAAE,KAAK,CAAC,YAAY;YAChC,SAAS,EAAE,KAAK,CAAC,SAAS;YAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,GAAG,CAAC,KAAK,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,GAAG,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS;gBACvC,CAAC,CAAC,EAAE,iBAAiB,EAAE,KAAK,CAAC,iBAAiB,EAAE;gBAChD,CAAC,CAAC,EAAE,CAAC;SACR,CAAC;IACJ,CAAC;IAED,KAAK,UAAU,iBAAiB;QAC9B,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;QACpD,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IACrE,CAAC;IAED,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,OAAO,GAAG,EAAE;YACpC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,QAAQ,EAAE,CAAC;YAE1C,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC,CAAC;YAEjF;;;;eAIG;YACH,MAAM,yBAAyB,GAC7B,OAAO,CAAC,cAAc,KAAK,SAAS,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC;YAE7E,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,mBAAmB,CAAC;gBACzD,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW;gBACpD,KAAK;gBACL,GAAG,CAAC,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;gBAC7D,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/E,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC5E,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC3F,GAAG,CAAC,OAAO,CAAC,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACrF,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,SAAS;oBACvC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,eAAe,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;YAEH,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;QACxB,CAAC;QAED,KAAK,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAErD;;;;eAIG;YACH,IAAI,QAAQ,KAAK,SAAS,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnF,MAAM,IAAI,iBAAiB,CAAC,iCAAiC,CAAC,CAAC;YACjE,CAAC;YAED,+CAA+C;YAC/C,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAEvC,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,oBAAoB,CAAC;gBAC1E,IAAI;gBACJ,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,OAAO,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE;aACpE,CAAC,CAAC;YAEH,IAAI,aAAa,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC9C,MAAM,IAAI,iBAAiB,CAAC,yCAAyC,CAAC,CAAC;YACzE,CAAC;YAED,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CACpB,aAAa,EACb,aAAa,CAAC,aAAa,EAC3B,aAAa,CAAC,aAAa,CAAC,CAC7B,CAAC;YAEF,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC;gBAC7C,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;gBACnC,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK;gBAC/B,SAAS,EAAE,aAAa,CAAC,IAAI,CAAC,SAAS;gBACvC,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ;gBACrC,iBAAiB,EAAE,aAAa,CAAC,IAAI,CAAC,iBAAiB;aACxD,CAAC,CAAC;YAEH,OAAO;gBACL,OAAO,EAAE;oBACP,MAAM,EAAE,MAAM,CAAC,EAAE;oBACjB,YAAY,EAAE,aAAa,CAAC,IAAI,CAAC,EAAE;oBACnC,SAAS,EAAE,aAAa,CAAC,aAAa,CAAC,WAAW,CAAC;oBACnD,KAAK,EAAE,aAAa,CAAC,IAAI,CAAC,KAAK;oBAC/B,GAAG,CAAC,aAAa,CAAC,cAAc,KAAK,SAAS;wBAC5C,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,CAAC,cAAc,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS;wBACjD,CAAC,CAAC,EAAE,iBAAiB,EAAE,aAAa,CAAC,YAAY,CAAC,KAAK,EAAE;wBACzD,CAAC,CAAC,EAAE,CAAC;iBACR;gBACD,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC1C,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,UAAU;YACd,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;YACzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;gBAC3D,WAAW,EAAE,MAAM;gBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;aACpC,CAAC,CAAC;YAEH,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;YAE5C,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;gBACzB,OAAO,SAAS,CAAC;oBACf,YAAY,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE;oBAC5B,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK;oBACxB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS;oBAChC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ;oBAC9B,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB;oBAChD,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,SAAS;wBACrC,CAAC,CAAC,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE;wBAC3C,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS;wBAC1C,CAAC,CAAC,EAAE,iBAAiB,EAAE,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE;wBAClD,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;YACL,CAAC;YAED;;;;eAIG;YACH,IAAI,MAAM,CAAC,MAAM,KAAK,aAAa,EAAE,CAAC;gBACpC,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;YACjF,IAAI,CAAC,SAAS,CAAC,aAAa,EAAE,CAAC;gBAC7B,OAAO,SAAS,CAAC;YACnB,CAAC;YAED,IAAI,SAAS,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;gBAC1C,MAAM,iBAAiB,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC;YACnD,CAAC;YAED,OAAO,SAAS,CAAC;gBACf,YAAY,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE;gBAC/B,KAAK,EAAE,SAAS,CAAC,IAAI,CAAC,KAAK;gBAC3B,SAAS,EAAE,SAAS,CAAC,SAAS;gBAC9B,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,SAAS;gBACnC,QAAQ,EAAE,SAAS,CAAC,IAAI,CAAC,QAAQ;gBACjC,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC,iBAAiB;gBACnD,GAAG,CAAC,SAAS,CAAC,cAAc,KAAK,SAAS;oBACxC,CAAC,CAAC,EAAE,cAAc,EAAE,SAAS,CAAC,cAAc,EAAE;oBAC9C,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,KAAK,SAAS;oBAC7C,CAAC,CAAC,EAAE,iBAAiB,EAAE,SAAS,CAAC,YAAY,CAAC,KAAK,EAAE;oBACrD,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,KAAK,CAAC,cAAc;YAClB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;QAED,KAAK,CAAC,WAAW;YACf,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;YACzC,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBACvB,MAAM,IAAI,iBAAiB,EAAE,CAAC;YAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,OAAO,GAAG,EAAE;YACxB,MAAM,MAAM,GAAG,MAAM,iBAAiB,EAAE,CAAC;YAEzC,4EAA4E;YAC5E,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YAEzC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAClC,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,iBAAiB,CAAC;oBAC3D,WAAW,EAAE,MAAM;oBACnB,cAAc,EAAE,IAAI,CAAC,cAAc;iBACpC,CAAC,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,YAAY,CAC1C,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CACrE,CAAC;gBACF,OAAO,EAAE,SAAS,EAAE,CAAC;YACvB,CAAC;YAAC,MAAM,CAAC;gBACP,wEAAwE;gBACxE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;YAClC,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/auth/types.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Transport-neutral session storage.
+ *
+ * The core does not import `next/headers`: it also runs in route handlers,
+ * Trigger.dev tasks and tests. A Next.js adapter lives in
+ * `@digimuza/saas-core/auth/next`.
+ *
+ * Methods may return promises — Next.js `cookies()` is async in the App Router.
+ */
+export interface CookieStore {
+    get(name: string): string | undefined | Promise<string | undefined>;
+    set(name: string, value: string, options: SessionCookieOptions): void | Promise<void>;
+    delete(name: string): void | Promise<void>;
+}
+export interface SessionCookieOptions {
+    readonly httpOnly: boolean;
+    readonly secure: boolean;
+    readonly sameSite: "lax" | "strict" | "none";
+    readonly path: string;
+    readonly maxAge: number;
+}
+/**
+ * A resolved session.
+ *
+ * `userId` is the local user id; `workosUserId` is the identity-provider id.
+ * Application code should key off `userId`.
+ */
+export interface AuthSession {
+    readonly userId: string;
+    readonly workosUserId: string;
+    readonly sessionId: string;
+    readonly email: string;
+    /** WorkOS organization, when the session was established against one. */
+    readonly organizationId?: string;
+    /** Set when an administrator is impersonating this user. */
+    readonly impersonatorEmail?: string;
+}
+export interface AuthorizationUrlOptions {
+    /** Overrides the configured `WORKOS_REDIRECT_URI`. */
+    readonly redirectUri?: string;
+    /** Opaque value echoed back to the callback. Use it for CSRF defence. */
+    readonly state?: string;
+    readonly screenHint?: "sign-up" | "sign-in";
+    readonly loginHint?: string;
+    readonly organizationId?: string;
+    /** Authenticate against a specific SSO connection. */
+    readonly connectionId?: string;
+    /** Accept a workspace invitation as part of signing in. */
+    readonly invitationToken?: string;
+}
+export interface CallbackResult {
+    readonly session: AuthSession;
+    /** WorkOS `state` echoed back, for the caller to verify. */
+    readonly state?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/auth/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,oBAAoB,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,yEAAyE;IACzE,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,4DAA4D;IAC5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;CACrC;AAED,MAAM,WAAW,uBAAuB;IACtC,sDAAsD;IACtD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,yEAAyE;IACzE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,SAAS,CAAC;IAC5C,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,sDAAsD;IACtD,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,2DAA2D;IAC3D,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,4DAA4D;IAC5D,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB"}

package/dist/auth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/auth/types.ts"],"names":[],"mappings":""}

package/dist/authorization/index.d.ts

@@ -0,0 +1,4 @@
+export { createAuthorizationService, definePermissions, findRolesWithPermission, type AuthorizationService, type AuthorizationServiceDeps, type CreateRoleInput, type PermissionDefinition, type PermissionKey, } from "./service.ts";
+/** Default service, bound to the configuration-driven database handle. */
+export declare const authorization: import("./service.ts").AuthorizationService;
+//# sourceMappingURL=index.d.ts.map

package/dist/authorization/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,wBAAwB,EAC7B,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,aAAa,GACnB,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,eAAO,MAAM,aAAa,6CAKxB,CAAC"}

package/dist/authorization/index.js

@@ -0,0 +1,24 @@
+/**
+ * Public authorization surface: `@digimuza/saas-core/authorization`. Server-only.
+ *
+ * Authorization always requires workspace context. A user's effective
+ * permissions are the union of the permissions carried by every role they hold
+ * in that workspace.
+ *
+ * Permissions are application-defined; the core stores the vocabulary an
+ * application registers rather than shipping its own. Application code should
+ * check permissions, not roles or subscription plans — see
+ * `@digimuza/saas-core/entitlements` for what a customer has paid for.
+ */
+import { getDatabase } from "../db/client.js";
+import { events as coreEventsService } from "../events/index.js";
+import { createAuthorizationService } from "./service.js";
+export { createAuthorizationService, definePermissions, findRolesWithPermission, } from "./service.js";
+/** Default service, bound to the configuration-driven database handle. */
+export const authorization = createAuthorizationService({
+    get db() {
+        return getDatabase();
+    },
+    events: coreEventsService,
+});
+//# sourceMappingURL=index.js.map

package/dist/authorization/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/authorization/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAC9C,OAAO,EAAE,MAAM,IAAI,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,cAAc,CAAC;AAE1D,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,uBAAuB,GAMxB,MAAM,cAAc,CAAC;AAEtB,0EAA0E;AAC1E,MAAM,CAAC,MAAM,aAAa,GAAG,0BAA0B,CAAC;IACtD,IAAI,EAAE;QACJ,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IACD,MAAM,EAAE,iBAAiB;CAC1B,CAAC,CAAC"}