@dreadkn1ght123/auth-core 0.2.0

package/README.md

@@ -0,0 +1,50 @@
+# @dreadkn1ght123/auth-core
+
+Framework-neutral server-side VVP OpenID Connect foundations, built on
+`openid-client` v6. It provides discovery, Authorization Code + PKCE, callback,
+refresh and RP-initiated logout primitives, claim/role normalization, safe
+redirect handling, safe error classification, and pluggable session storage.
+
+`MemorySessionStore` is deliberately limited to development and test. Supply a
+durable/shared `SessionStore` in production. Keep callback verifiers, session
+identifiers and all tokens in HTTP-only server-managed storage/cookies; never
+send `ServerSession.tokens` to a browser or logger.
+
+This SDK supports confidential server-side clients only: `clientSecret` is
+mandatory in every environment and is always sent with `ClientSecretBasic`.
+Production also requires `publicOrigin`; callback and post-logout defaults are
+derived as `<publicOrigin>/auth/callback` and
+`<publicOrigin>/auth/signed-out`. Explicit overrides must remain HTTPS,
+same-origin, and match configured routes.
+
+The default requested scopes are `openid profile email vvp-identity`. Custom
+scope lists must retain both `openid` and `vvp-identity` so applications
+receive the VVP identity-claim contract.
+
+JWT access tokens are independently verified against the discovered provider
+JWKS, including issuer, lifetime, signature, and configured `aud`/Keycloak
+`azp` policy. Both defaults require the client ID: `aud` must include
+`clientId` and `azp` must equal it. Configure `accessTokenAudiences` and
+`accessTokenAuthorizedParties` explicitly when a deployment uses different
+token mappings. Configure every Keycloak client with an audience mapper that
+adds its client ID to access-token `aud`. Opaque tokens require an injected
+`AccessTokenValidator` backed by a trusted introspection strategy.
+
+## Safe diagnostics
+
+`AuthError` carries a stable `code`, callback `stage`, `reason`, strictly typed
+`details`, and an optional `cause`. Use `safeAuthErrorDetails(error)` and
+`classifyAuthError(error)` at logging boundaries. They recursively recognize
+supported `openid-client`, `oauth4webapi`, and `jose` error families but return
+only allowlisted machine fields such as library/code, HTTP status, and failed
+claim. They never copy an exception message, response body, headers, full URL,
+query string, `error_description`, tokens, or raw claims.
+
+An unknown library error intentionally produces an `unknown` reason plus any
+safe details that can be recognized. Do not spread the original error or
+`details` into an HTTP response.
+
+For Keycloak setup and expected safe claim shapes, use
+[`../../docs/keycloak-client-template.md`](../../docs/keycloak-client-template.md).
+Migration from `0.1.x` to the aligned `0.2.0` packages is documented in
+[`../../UPGRADE.md`](../../UPGRADE.md).

package/dist/access-token.d.ts

@@ -0,0 +1,18 @@
+import type { AuthConfig } from "@dreadkn1ght123/auth-types";
+import { type JWTPayload, type JWTVerifyGetKey } from "jose";
+export interface AccessTokenValidator {
+    /**
+     * Return only claims obtained after validating the token. Implementations
+     * may support opaque tokens through introspection; unverified decoding is
+     * never a valid implementation.
+     */
+    validate(accessToken: string): Promise<Readonly<Record<string, unknown>>>;
+}
+export declare class KeycloakJwtAccessTokenValidator implements AccessTokenValidator {
+    #private;
+    constructor(config: AuthConfig, jwksUri: URL, options?: {
+        keyResolver?: JWTVerifyGetKey;
+    });
+    validate(accessToken: string): Promise<JWTPayload>;
+}
+//# sourceMappingURL=access-token.d.ts.map

package/dist/access-token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.d.ts","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EAGL,KAAK,UAAU,EACf,KAAK,eAAe,EACrB,MAAM,MAAM,CAAC;AAGd,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;CAC3E;AAED,qBAAa,+BAAgC,YAAW,oBAAoB;;gBAKxE,MAAM,EAAE,UAAU,EAClB,OAAO,EAAE,GAAG,EACZ,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,eAAe,CAAA;KAAO;IAM3C,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAkDzD"}

package/dist/access-token.js

@@ -0,0 +1,49 @@
+import { createRemoteJWKSet, jwtVerify, } from "jose";
+import { AuthError, classifyAuthError } from "./errors.js";
+export class KeycloakJwtAccessTokenValidator {
+    #config;
+    #jwks;
+    constructor(config, jwksUri, options = {}) {
+        this.#config = config;
+        this.#jwks = options.keyResolver ?? createRemoteJWKSet(jwksUri);
+    }
+    async validate(accessToken) {
+        if (accessToken.split(".").length !== 3) {
+            throw new AuthError("ACCESS_TOKEN_INVALID", "Opaque access token requires a configured validation strategy", {
+                stage: "access_token_validation",
+                reason: "access_token_not_jwt",
+            });
+        }
+        try {
+            const { payload } = await jwtVerify(accessToken, this.#jwks, {
+                issuer: this.#config.issuer.href.replace(/\/$/, ""),
+                ...(this.#config.accessTokenAudiences.length > 0
+                    ? { audience: [...this.#config.accessTokenAudiences] }
+                    : {}),
+                requiredClaims: ["exp", "iss", "sub"],
+            });
+            if (this.#config.accessTokenAuthorizedParties.length > 0 &&
+                (typeof payload["azp"] !== "string" ||
+                    !this.#config.accessTokenAuthorizedParties.includes(payload["azp"]))) {
+                throw new AuthError("ACCESS_TOKEN_INVALID", "Access token authorized party is not allowed", {
+                    stage: "access_token_validation",
+                    reason: "authorized_party_mismatch",
+                    details: { claim: "azp" },
+                });
+            }
+            return payload;
+        }
+        catch (cause) {
+            if (cause instanceof AuthError)
+                throw cause;
+            const classified = classifyAuthError(cause);
+            throw new AuthError("ACCESS_TOKEN_INVALID", "Access token signature or claims validation failed", {
+                cause,
+                stage: "access_token_validation",
+                reason: classified.reason,
+                details: classified.details,
+            });
+        }
+    }
+}
+//# sourceMappingURL=access-token.js.map

package/dist/access-token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-token.js","sourceRoot":"","sources":["../src/access-token.ts"],"names":[],"mappings":"AACA,OAAO,EACL,kBAAkB,EAClB,SAAS,GAGV,MAAM,MAAM,CAAC;AACd,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAW3D,MAAM,OAAO,+BAA+B;IACjC,OAAO,CAAa;IACpB,KAAK,CAAkB;IAEhC,YACE,MAAkB,EAClB,OAAY,EACZ,UAA6C,EAAE;QAE/C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,WAAW,IAAI,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClE,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,WAAmB;QAChC,IAAI,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxC,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,+DAA+D,EAC/D;gBACE,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,sBAAsB;aAC/B,CACF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3D,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;gBACnD,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;oBAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE;oBACtD,CAAC,CAAC,EAAE,CAAC;gBACP,cAAc,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC;aACtC,CAAC,CAAC;YACH,IACE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,MAAM,GAAG,CAAC;gBACpD,CAAC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ;oBACjC,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EACtE,CAAC;gBACD,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,8CAA8C,EAC9C;oBACE,KAAK,EAAE,yBAAyB;oBAChC,MAAM,EAAE,2BAA2B;oBACnC,OAAO,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;iBAC1B,CACF,CAAC;YACJ,CAAC;YACD,OAAO,OAAO,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,SAAS;gBAAE,MAAM,KAAK,CAAC;YAC5C,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;YAC5C,MAAM,IAAI,SAAS,CACjB,sBAAsB,EACtB,oDAAoD,EACpD;gBACE,KAAK;gBACL,KAAK,EAAE,yBAAyB;gBAChC,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,OAAO,EAAE,UAAU,CAAC,OAAO;aAC5B,CACF,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/claims.d.ts

@@ -0,0 +1,14 @@
+import { type Actor, type VvpClaims } from "@dreadkn1ght123/auth-types";
+export declare function normalizeRoles(value: unknown): readonly string[];
+export declare function actorFromClaims(claims: Readonly<Record<string, unknown>>): Actor;
+export declare function isVvpClaims(claims: unknown): claims is VvpClaims;
+export declare function hasRealmRole(actor: Actor | undefined, role: string): boolean;
+export declare function hasClientRole(actor: Actor | undefined, role: string, clientId: string): boolean;
+export declare function hasAnyClientRole(actor: Actor | undefined, roles: readonly string[], clientId: string): boolean;
+/** Binds helpers to the configured client so callers need not duplicate its ID. */
+export declare function createClientRoleHelpers(clientId: string): {
+    hasClientRole: (actor: Actor | undefined, role: string) => boolean;
+    hasAnyClientRole: (actor: Actor | undefined, roles: readonly string[]) => boolean;
+    roles: (actor: Actor | undefined) => readonly string[];
+};
+//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,KAAK,EACV,KAAK,SAAS,EACf,MAAM,4BAA4B,CAAC;AAKpC,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,SAAS,MAAM,EAAE,CAQhE;AAuBD,wBAAgB,eAAe,CAC7B,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GACxC,KAAK,CAyDP;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,SAAS,CAOhE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,GAAG,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAE5E;AAED,wBAAgB,aAAa,CAC3B,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,KAAK,GAAG,SAAS,EACxB,KAAK,EAAE,SAAS,MAAM,EAAE,EACxB,QAAQ,EAAE,MAAM,GACf,OAAO,CAET;AAED,mFAAmF;AACnF,wBAAgB,uBAAuB,CAAC,QAAQ,EAAE,MAAM;2BAM7B,KAAK,GAAG,SAAS,QAAQ,MAAM;8BAE5B,KAAK,GAAG,SAAS,SAAS,SAAS,MAAM,EAAE;mBAEtD,KAAK,GAAG,SAAS,KAAG,SAAS,MAAM,EAAE;EAGvD"}

package/dist/claims.js

@@ -0,0 +1,110 @@
+import {} from "@dreadkn1ght123/auth-types";
+import { AuthError } from "./errors.js";
+const ROLE_PATTERN = /^[a-z0-9][a-z0-9._:-]{0,127}$/;
+export function normalizeRoles(value) {
+    if (!Array.isArray(value))
+        return [];
+    return [...new Set(value
+            .filter((role) => typeof role === "string")
+            .map((role) => role.trim().toLowerCase())
+            .filter((role) => ROLE_PATTERN.test(role)))].sort();
+}
+function requiredString(claims, name) {
+    const value = claims[name];
+    if (typeof value !== "string" || !value.trim()) {
+        throw new AuthError("CLAIMS_INVALID", `Required claim ${name} is missing`, {
+            stage: "actor_claims_mapping",
+            reason: "required_claim_missing",
+            safeDetails: name === "sub"
+                ? { failedClaim: "sub", claimFailureReason: "missing" }
+                : {},
+        });
+    }
+    return value.trim();
+}
+function optionalString(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+export function actorFromClaims(claims) {
+    const realmAccess = claims["realm_access"] && typeof claims["realm_access"] === "object"
+        ? claims["realm_access"]
+        : {};
+    const resourceAccess = claims["resource_access"] && typeof claims["resource_access"] === "object"
+        ? claims["resource_access"]
+        : {};
+    const clientRoles = {};
+    for (const [clientId, access] of Object.entries(resourceAccess)) {
+        if (access && typeof access === "object") {
+            clientRoles[clientId] = normalizeRoles(access["roles"]);
+        }
+    }
+    return {
+        sub: requiredString(claims, "sub"),
+        ...(optionalString(claims["vvp_actor_id"])
+            ? { vvpActorId: optionalString(claims["vvp_actor_id"]) }
+            : {}),
+        ...(optionalString(claims["actor_type"])
+            ? { actorType: optionalString(claims["actor_type"]) }
+            : {}),
+        ...(optionalString(claims["organization_id"])
+            ? { organizationId: optionalString(claims["organization_id"]) }
+            : {}),
+        ...(optionalString(claims["employee_id"])
+            ? { employeeId: optionalString(claims["employee_id"]) }
+            : {}),
+        ...(optionalString(claims["department_id"])
+            ? { departmentId: optionalString(claims["department_id"]) }
+            : {}),
+        ...(optionalString(claims["email"])
+            ? { email: optionalString(claims["email"]) }
+            : {}),
+        ...(typeof claims["email_verified"] === "boolean"
+            ? { emailVerified: claims["email_verified"] }
+            : {}),
+        ...(optionalString(claims["preferred_username"])
+            ? { username: optionalString(claims["preferred_username"]) }
+            : {}),
+        ...(optionalString(claims["name"])
+            ? { name: optionalString(claims["name"]) }
+            : {}),
+        ...(optionalString(claims["given_name"])
+            ? { givenName: optionalString(claims["given_name"]) }
+            : {}),
+        ...(optionalString(claims["family_name"])
+            ? { familyName: optionalString(claims["family_name"]) }
+            : {}),
+        realmRoles: normalizeRoles(realmAccess["roles"]),
+        clientRoles,
+    };
+}
+export function isVvpClaims(claims) {
+    try {
+        actorFromClaims(claims);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function hasRealmRole(actor, role) {
+    return actor?.realmRoles.includes(role.trim().toLowerCase()) ?? false;
+}
+export function hasClientRole(actor, role, clientId) {
+    return actor?.clientRoles[clientId]?.includes(role.trim().toLowerCase()) ?? false;
+}
+export function hasAnyClientRole(actor, roles, clientId) {
+    return roles.some((role) => hasClientRole(actor, role, clientId));
+}
+/** Binds helpers to the configured client so callers need not duplicate its ID. */
+export function createClientRoleHelpers(clientId) {
+    const normalizedClientId = clientId.trim();
+    if (!normalizedClientId) {
+        throw new AuthError("CONFIG_INVALID", "clientId must not be empty");
+    }
+    return {
+        hasClientRole: (actor, role) => hasClientRole(actor, role, normalizedClientId),
+        hasAnyClientRole: (actor, roles) => hasAnyClientRole(actor, roles, normalizedClientId),
+        roles: (actor) => actor?.clientRoles[normalizedClientId] ?? [],
+    };
+}
+//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,YAAY,GAAG,+BAA+B,CAAC;AAErD,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,CAAC,GAAG,IAAI,GAAG,CAChB,KAAK;aACF,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC;aAC1D,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;aACxC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAC7C,CAAC,CAAC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CACrB,MAAyC,EACzC,IAAY;IAEZ,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,kBAAkB,IAAI,aAAa,EAAE;YACzE,KAAK,EAAE,sBAAsB;YAC7B,MAAM,EAAE,wBAAwB;YAChC,WAAW,EAAE,IAAI,KAAK,KAAK;gBACzB,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,kBAAkB,EAAE,SAAS,EAAE;gBACvD,CAAC,CAAC,EAAE;SACP,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,MAAyC;IAEzC,MAAM,WAAW,GACf,MAAM,CAAC,cAAc,CAAC,IAAI,OAAO,MAAM,CAAC,cAAc,CAAC,KAAK,QAAQ;QAClE,CAAC,CAAE,MAAM,CAAC,cAAc,CAA6B;QACrD,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,cAAc,GAClB,MAAM,CAAC,iBAAiB,CAAC,IAAI,OAAO,MAAM,CAAC,iBAAiB,CAAC,KAAK,QAAQ;QACxE,CAAC,CAAE,MAAM,CAAC,iBAAiB,CAA6B;QACxD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,WAAW,GAAsC,EAAE,CAAC;IAC1D,KAAK,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,cAAc,CAAC,EAAE,CAAC;QAChE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,WAAW,CAAC,QAAQ,CAAC,GAAG,cAAc,CACnC,MAAkC,CAAC,OAAO,CAAC,CAC7C,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,GAAG,EAAE,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;QAClC,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;YACxC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,cAAc,CAAC,CAAE,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAE,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAC3C,CAAC,CAAC,EAAE,cAAc,EAAE,cAAc,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAE,EAAE;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;YACzC,CAAC,CAAC,EAAE,YAAY,EAAE,cAAc,CAAC,MAAM,CAAC,eAAe,CAAC,CAAE,EAAE;YAC5D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC,CAAC,EAAE,KAAK,EAAE,cAAc,CAAC,MAAM,CAAC,OAAO,CAAC,CAAE,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,MAAM,CAAC,gBAAgB,CAAC,KAAK,SAAS;YAC/C,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,gBAAgB,CAAC,EAAE;YAC7C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC9C,CAAC,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAE,EAAE;YAC7D,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAChC,CAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,CAAE,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;YACtC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAE,EAAE;YACtD,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACvC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,MAAM,CAAC,aAAa,CAAC,CAAE,EAAE;YACxD,CAAC,CAAC,EAAE,CAAC;QACP,UAAU,EAAE,cAAc,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QAChD,WAAW;KACZ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAe;IACzC,IAAI,CAAC;QACH,eAAe,CAAC,MAA2C,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAwB,EAAE,IAAY;IACjE,OAAO,KAAK,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AACxE,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,KAAwB,EACxB,IAAY,EACZ,QAAgB;IAEhB,OAAO,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,IAAI,KAAK,CAAC;AACpF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,KAAwB,EACxB,KAAwB,EACxB,QAAgB;IAEhB,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;AACpE,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,uBAAuB,CAAC,QAAgB;IACtD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACxB,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,aAAa,EAAE,CAAC,KAAwB,EAAE,IAAY,EAAE,EAAE,CACxD,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,kBAAkB,CAAC;QAChD,gBAAgB,EAAE,CAAC,KAAwB,EAAE,KAAwB,EAAE,EAAE,CACvE,gBAAgB,CAAC,KAAK,EAAE,KAAK,EAAE,kBAAkB,CAAC;QACpD,KAAK,EAAE,CAAC,KAAwB,EAAqB,EAAE,CACrD,KAAK,EAAE,WAAW,CAAC,kBAAkB,CAAC,IAAI,EAAE;KAC/C,CAAC;AACJ,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,10 @@
+import type { AuthConfig, AuthConfigInput, AuthRouteSettings, AuthRouteSettingsInput, AuthRoutesOption } from "@dreadkn1ght123/auth-types";
+export declare function normalizeAuthRoutes(input?: AuthRouteSettingsInput): AuthRouteSettings;
+/**
+ * Combines nested core configuration and the adapter-level `{ routes }` shape.
+ * Supplying both is supported only when they normalize to the same routes, so
+ * a top-level adapter option can never silently override security settings.
+ */
+export declare function withAuthRoutes(input: AuthConfigInput, routeOptions?: AuthRoutesOption | AuthRouteSettingsInput): AuthConfigInput;
+export declare function validateConfig(configInput: AuthConfigInput, routeOptions?: AuthRoutesOption | AuthRouteSettingsInput): AuthConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,gBAAgB,EAIjB,MAAM,4BAA4B,CAAC;AA6BpC,wBAAgB,mBAAmB,CACjC,KAAK,GAAE,sBAA2B,GACjC,iBAAiB,CAiCnB;AAuFD;;;;GAIG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,eAAe,EACtB,YAAY,CAAC,EAAE,gBAAgB,GAAG,sBAAsB,GACvD,eAAe,CAmBjB;AAED,wBAAgB,cAAc,CAC5B,WAAW,EAAE,eAAe,EAC5B,YAAY,CAAC,EAAE,gBAAgB,GAAG,sBAAsB,GACvD,UAAU,CAsJZ"}

package/dist/config.js

@@ -0,0 +1,229 @@
+import { AuthError } from "./errors.js";
+const DEFAULT_SCOPES = ["openid", "profile", "email", "vvp-identity"];
+const DEFAULT_TTL_SECONDS = 8 * 60 * 60;
+const PATH_PATTERN = /^\/(?:[A-Za-z0-9._~-]+\/?)*$/;
+function path(value, field) {
+    const normalized = value.trim();
+    if (!PATH_PATTERN.test(normalized) || normalized.includes("//")) {
+        throw new AuthError("CONFIG_INVALID", `${field} must be an absolute local path without query or fragment`);
+    }
+    return normalized.length > 1 ? normalized.replace(/\/+$/, "") : normalized;
+}
+function route(basePath, value, fallback, field) {
+    if (!value)
+        return `${basePath === "/" ? "" : basePath}/${fallback}`;
+    const supplied = path(value.startsWith("/") ? value : `/${value}`, field);
+    if (supplied === basePath || supplied.startsWith(`${basePath}/`))
+        return supplied;
+    return path(`${basePath === "/" ? "" : basePath}${supplied}`, field);
+}
+function containsPath(parent, child) {
+    return parent === "/" || child === parent || child.startsWith(`${parent}/`);
+}
+export function normalizeAuthRoutes(input = {}) {
+    const basePath = path(input.basePath ?? "/auth", "routes.basePath");
+    const callbackPath = route(basePath, input.callbackPath, "callback", "routes.callbackPath");
+    const cookiePath = path(input.cookiePath ?? basePath, "routes.cookiePath");
+    if (!containsPath(cookiePath, callbackPath)) {
+        throw new AuthError("CONFIG_INVALID", "routes.cookiePath must contain routes.callbackPath");
+    }
+    const result = {
+        basePath,
+        startPath: route(basePath, input.startPath, "start", "routes.startPath"),
+        loginPath: route(basePath, input.loginPath, "login", "routes.loginPath"),
+        callbackPath,
+        logoutPath: route(basePath, input.logoutPath, "logout", "routes.logoutPath"),
+        signedOutPath: route(basePath, input.signedOutPath, "signed-out", "routes.signedOutPath"),
+        errorPath: route(basePath, input.errorPath, "error", "routes.errorPath"),
+        sessionPath: route(basePath, input.sessionPath, "me", "routes.sessionPath"),
+        cookiePath,
+    };
+    const endpointPaths = [
+        result.startPath, result.loginPath, result.callbackPath, result.logoutPath,
+        result.signedOutPath, result.errorPath, result.sessionPath,
+    ];
+    if (new Set(endpointPaths).size !== endpointPaths.length) {
+        throw new AuthError("CONFIG_INVALID", "Authentication route paths must be unique");
+    }
+    return result;
+}
+function required(value, field) {
+    const normalized = value.trim();
+    if (!normalized) {
+        throw new AuthError("CONFIG_INVALID", `${field} must not be empty`);
+    }
+    return normalized;
+}
+function parseHttpUrl(value, field) {
+    let url;
+    try {
+        url = new URL(value);
+    }
+    catch {
+        throw new AuthError("CONFIG_INVALID", `${field} must be an absolute URL`);
+    }
+    if (url.protocol !== "https:" && url.protocol !== "http:") {
+        throw new AuthError("CONFIG_INVALID", `${field} must use HTTP or HTTPS`);
+    }
+    if (url.username || url.password || url.hash) {
+        throw new AuthError("CONFIG_INVALID", `${field} must not contain credentials or a fragment`);
+    }
+    return url;
+}
+function assertTransport(url, field, environment) {
+    if (environment === "production" && url.protocol !== "https:") {
+        throw new AuthError("CONFIG_INVALID", `${field} must use HTTPS in production`);
+    }
+    if (url.protocol === "http:" &&
+        url.hostname !== "localhost" &&
+        url.hostname !== "127.0.0.1" &&
+        url.hostname !== "::1") {
+        throw new AuthError("CONFIG_INVALID", `${field} may use HTTP only for a loopback host`);
+    }
+}
+function parseOrigin(value, field, environment) {
+    const url = parseHttpUrl(value, field);
+    assertTransport(url, field, environment);
+    if (url.pathname !== "/" || url.search) {
+        throw new AuthError("CONFIG_INVALID", `${field} must be an origin without path, query, or fragment`);
+    }
+    return new URL(url.origin);
+}
+function uiText(value, fallback, field) {
+    return value === undefined ? fallback : required(value, field);
+}
+function normalizeAuthUi(input = {}) {
+    const locale = input.locale ?? "ru";
+    if (locale !== "ru" && locale !== "en") {
+        throw new AuthError("CONFIG_INVALID", "ui.locale must be ru or en");
+    }
+    return {
+        locale,
+        productName: uiText(input.productName, "VVP", "ui.productName"),
+        ...(input.logoUrl === undefined
+            ? {}
+            : { logoUrl: path(input.logoUrl, "ui.logoUrl") }),
+        supportText: uiText(input.supportText, locale === "ru"
+            ? "Обратитесь к администратору системы"
+            : "Contact your system administrator", "ui.supportText"),
+    };
+}
+/**
+ * Combines nested core configuration and the adapter-level `{ routes }` shape.
+ * Supplying both is supported only when they normalize to the same routes, so
+ * a top-level adapter option can never silently override security settings.
+ */
+export function withAuthRoutes(input, routeOptions) {
+    let routes;
+    if (routeOptions && "routes" in routeOptions) {
+        routes = routeOptions.routes;
+    }
+    else {
+        routes = routeOptions;
+    }
+    if (!routes)
+        return input;
+    if (input.routes) {
+        const configured = normalizeAuthRoutes(input.routes);
+        const supplied = normalizeAuthRoutes(routes);
+        if (JSON.stringify(configured) !== JSON.stringify(supplied)) {
+            throw new AuthError("CONFIG_INVALID", "Top-level routes and config.routes must match when both are supplied");
+        }
+    }
+    return { ...input, routes };
+}
+export function validateConfig(configInput, routeOptions) {
+    const input = withAuthRoutes(configInput, routeOptions);
+    const environment = input.environment ?? "production";
+    const issuer = parseHttpUrl(required(input.issuer, "issuer"), "issuer");
+    assertTransport(issuer, "issuer", environment);
+    const routes = normalizeAuthRoutes(input.routes);
+    if (environment === "production" && !input.publicOrigin) {
+        throw new AuthError("CONFIG_INVALID", "publicOrigin is required in production");
+    }
+    const publicOrigin = input.publicOrigin
+        ? parseOrigin(input.publicOrigin, "publicOrigin", environment)
+        : undefined;
+    if (!input.redirectUri && !publicOrigin) {
+        throw new AuthError("CONFIG_INVALID", "redirectUri is required when publicOrigin is omitted");
+    }
+    const redirectUri = input.redirectUri
+        ? parseHttpUrl(input.redirectUri, "redirectUri")
+        : new URL(routes.callbackPath, publicOrigin);
+    const postLogoutRedirectUri = input.postLogoutRedirectUri
+        ? parseHttpUrl(input.postLogoutRedirectUri, "postLogoutRedirectUri")
+        : publicOrigin
+            ? new URL(routes.signedOutPath, publicOrigin)
+            : undefined;
+    assertTransport(redirectUri, "redirectUri", environment);
+    if (postLogoutRedirectUri) {
+        assertTransport(postLogoutRedirectUri, "postLogoutRedirectUri", environment);
+    }
+    if (publicOrigin && redirectUri.origin !== publicOrigin.origin) {
+        throw new AuthError("CONFIG_INVALID", "redirectUri must have the same origin as publicOrigin");
+    }
+    if (publicOrigin && postLogoutRedirectUri &&
+        postLogoutRedirectUri.origin !== publicOrigin.origin) {
+        throw new AuthError("CONFIG_INVALID", "postLogoutRedirectUri must have the same origin as publicOrigin");
+    }
+    const scopes = [...new Set(input.scopes ?? DEFAULT_SCOPES)].map((scope) => required(scope, "scope"));
+    if (!scopes.includes("openid") || !scopes.includes("vvp-identity")) {
+        throw new AuthError("CONFIG_INVALID", "scopes must include openid and vvp-identity");
+    }
+    const sessionTtlSeconds = input.sessionTtlSeconds ?? DEFAULT_TTL_SECONDS;
+    if (!Number.isSafeInteger(sessionTtlSeconds) || sessionTtlSeconds <= 0) {
+        throw new AuthError("CONFIG_INVALID", "sessionTtlSeconds must be a positive integer");
+    }
+    const allowedReturnToOrigins = [...new Set((input.allowedReturnToOrigins ?? []).map((origin) => {
+            const url = parseHttpUrl(origin, "allowedReturnToOrigins");
+            assertTransport(url, "allowedReturnToOrigins", environment);
+            if (url.origin !== url.href.replace(/\/$/, "")) {
+                throw new AuthError("CONFIG_INVALID", "allowedReturnToOrigins entries must be origins without paths");
+            }
+            return url.origin;
+        }))];
+    const accessTokenAudiences = [...new Set((input.accessTokenAudiences ?? [input.clientId]).map((audience) => required(audience, "accessTokenAudiences")))];
+    const accessTokenAuthorizedParties = [...new Set((input.accessTokenAuthorizedParties ?? [input.clientId]).map((party) => required(party, "accessTokenAuthorizedParties")))];
+    if ((input.accessTokenAudiences !== undefined &&
+        input.accessTokenAudiences.length === 0) ||
+        (input.accessTokenAuthorizedParties !== undefined &&
+            input.accessTokenAuthorizedParties.length === 0)) {
+        throw new AuthError("CONFIG_INVALID", "access-token audience and authorized-party arrays must not be empty");
+    }
+    if (accessTokenAudiences.length === 0 &&
+        accessTokenAuthorizedParties.length === 0) {
+        throw new AuthError("CONFIG_INVALID", "At least one access-token audience or authorized-party rule is required");
+    }
+    const clientAuthenticationMethod = input.clientAuthenticationMethod ?? "client_secret_basic";
+    if ((input.routes || environment === "production") &&
+        redirectUri.pathname !== routes.callbackPath) {
+        throw new AuthError("CONFIG_INVALID", "redirectUri pathname must match routes.callbackPath");
+    }
+    if (postLogoutRedirectUri &&
+        (publicOrigin || input.routes || environment === "production") &&
+        (postLogoutRedirectUri.pathname !== routes.signedOutPath ||
+            postLogoutRedirectUri.search)) {
+        throw new AuthError("CONFIG_INVALID", "postLogoutRedirectUri must exactly target routes.signedOutPath");
+    }
+    if (environment === "production" && !postLogoutRedirectUri) {
+        throw new AuthError("CONFIG_INVALID", "postLogoutRedirectUri is required in production");
+    }
+    return {
+        issuer,
+        clientId: required(input.clientId, "clientId"),
+        clientSecret: required(input.clientSecret, "clientSecret"),
+        ...(publicOrigin ? { publicOrigin } : {}),
+        redirectUri,
+        ...(postLogoutRedirectUri ? { postLogoutRedirectUri } : {}),
+        scopes,
+        environment,
+        sessionTtlSeconds,
+        allowedReturnToOrigins,
+        accessTokenAudiences,
+        accessTokenAuthorizedParties,
+        routes,
+        ui: normalizeAuthUi(input.ui),
+        clientAuthenticationMethod,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAUA,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,cAAc,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,cAAc,CAAU,CAAC;AAC/E,MAAM,mBAAmB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;AACxC,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,SAAS,IAAI,CAAC,KAAa,EAAE,KAAa;IACxC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,GAAG,KAAK,2DAA2D,CACpE,CAAC;IACJ,CAAC;IACD,OAAO,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC;AAC7E,CAAC;AAED,SAAS,KAAK,CAAC,QAAgB,EAAE,KAAyB,EAAE,QAAgB,EAAE,KAAa;IACzF,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC;IACrE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,EAAE,EAAE,KAAK,CAAC,CAAC;IAC1E,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAClF,OAAO,IAAI,CAAC,GAAG,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,GAAG,QAAQ,EAAE,EAAE,KAAK,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,YAAY,CAAC,MAAc,EAAE,KAAa;IACjD,OAAO,MAAM,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,QAAgC,EAAE;IAElC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,OAAO,EAAE,iBAAiB,CAAC,CAAC;IACpE,MAAM,YAAY,GAAG,KAAK,CACxB,QAAQ,EAAE,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,qBAAqB,CAChE,CAAC;IACF,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,QAAQ,EAAE,mBAAmB,CAAC,CAAC;IAC3E,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,CAAC;QAC5C,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,oDAAoD,CACrD,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG;QACb,QAAQ;QACR,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC;QACxE,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC;QACxE,YAAY;QACZ,UAAU,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,UAAU,EAAE,QAAQ,EAAE,mBAAmB,CAAC;QAC5E,aAAa,EAAE,KAAK,CAClB,QAAQ,EAAE,KAAK,CAAC,aAAa,EAAE,YAAY,EAAE,sBAAsB,CACpE;QACD,SAAS,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,SAAS,EAAE,OAAO,EAAE,kBAAkB,CAAC;QACxE,WAAW,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,WAAW,EAAE,IAAI,EAAE,oBAAoB,CAAC;QAC3E,UAAU;KACX,CAAC;IACF,MAAM,aAAa,GAAG;QACpB,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,UAAU;QAC1E,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,WAAW;KAC3D,CAAC;IACF,IAAI,IAAI,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,aAAa,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,2CAA2C,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAa,EAAE,KAAa;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAChC,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,oBAAoB,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,KAAa,EAAE,KAAa;IAChD,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,0BAA0B,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,yBAAyB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,GAAG,KAAK,6CAA6C,CACtD,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,eAAe,CAAC,GAAQ,EAAE,KAAa,EAAE,WAA+B;IAC/E,IAAI,WAAW,KAAK,YAAY,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9D,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,GAAG,KAAK,+BAA+B,CAAC,CAAC;IACjF,CAAC;IACD,IACE,GAAG,CAAC,QAAQ,KAAK,OAAO;QACxB,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,WAAW;QAC5B,GAAG,CAAC,QAAQ,KAAK,KAAK,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,GAAG,KAAK,wCAAwC,CACjD,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAClB,KAAa,EACb,KAAa,EACb,WAA+B;IAE/B,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvC,eAAe,CAAC,GAAG,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACzC,IAAI,GAAG,CAAC,QAAQ,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,GAAG,KAAK,qDAAqD,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,MAAM,CAAC,KAAyB,EAAE,QAAgB,EAAE,KAAa;IACxE,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,eAAe,CAAC,QAA2B,EAAE;IACpD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC;IACpC,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,4BAA4B,CAAC,CAAC;IACtE,CAAC;IACD,OAAO;QACL,MAAM;QACN,WAAW,EAAE,MAAM,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,EAAE,gBAAgB,CAAC;QAC/D,GAAG,CAAC,KAAK,CAAC,OAAO,KAAK,SAAS;YAC7B,CAAC,CAAC,EAAE;YACJ,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,YAAY,CAAC,EAAE,CAAC;QACnD,WAAW,EAAE,MAAM,CACjB,KAAK,CAAC,WAAW,EACjB,MAAM,KAAK,IAAI;YACb,CAAC,CAAC,qCAAqC;YACvC,CAAC,CAAC,mCAAmC,EACvC,gBAAgB,CACjB;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC5B,KAAsB,EACtB,YAAwD;IAExD,IAAI,MAA0C,CAAC;IAC/C,IAAI,YAAY,IAAI,QAAQ,IAAI,YAAY,EAAE,CAAC;QAC7C,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,YAAkD,CAAC;IAC9D,CAAC;IACD,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;QACjB,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5D,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,sEAAsE,CACvE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,WAA4B,EAC5B,YAAwD;IAExD,MAAM,KAAK,GAAG,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;IACxD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC;IACtD,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAC;IACxE,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;IAC/C,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjD,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,gBAAgB,EAAE,wCAAwC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,YAAY;QACrC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,EAAE,WAAW,CAAC;QAC9D,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,CAAC,KAAK,CAAC,WAAW,IAAI,CAAC,YAAY,EAAE,CAAC;QACxC,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,sDAAsD,CACvD,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW;QACnC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;QAChD,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,YAAY,EAAE,YAAa,CAAC,CAAC;IAChD,MAAM,qBAAqB,GAAG,KAAK,CAAC,qBAAqB;QACvD,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,qBAAqB,EAAE,uBAAuB,CAAC;QACpE,CAAC,CAAC,YAAY;YACZ,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,EAAE,YAAY,CAAC;YAC7C,CAAC,CAAC,SAAS,CAAC;IAEhB,eAAe,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,CAAC,CAAC;IACzD,IAAI,qBAAqB,EAAE,CAAC;QAC1B,eAAe,CAAC,qBAAqB,EAAE,uBAAuB,EAAE,WAAW,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,YAAY,IAAI,WAAW,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,YAAY,IAAI,qBAAqB;QACrC,qBAAqB,CAAC,MAAM,KAAK,YAAY,CAAC,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,iEAAiE,CAClE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,IAAI,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACxE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,6CAA6C,CAC9C,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAG,KAAK,CAAC,iBAAiB,IAAI,mBAAmB,CAAC;IACzE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,iBAAiB,CAAC,IAAI,iBAAiB,IAAI,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,8CAA8C,CAC/C,CAAC;IACJ,CAAC;IAED,MAAM,sBAAsB,GAAG,CAAC,GAAG,IAAI,GAAG,CACxC,CAAC,KAAK,CAAC,sBAAsB,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE;YAClD,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;YAC3D,eAAe,CAAC,GAAG,EAAE,wBAAwB,EAAE,WAAW,CAAC,CAAC;YAC5D,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,CAAC;gBAC/C,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,8DAA8D,CAC/D,CAAC;YACJ,CAAC;YACD,OAAO,GAAG,CAAC,MAAM,CAAC;QACpB,CAAC,CAAC,CACH,CAAC,CAAC;IACH,MAAM,oBAAoB,GAAG,CAAC,GAAG,IAAI,GAAG,CACtC,CAAC,KAAK,CAAC,oBAAoB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAChE,QAAQ,CAAC,QAAQ,EAAE,sBAAsB,CAAC,CAC3C,CACF,CAAC,CAAC;IACH,MAAM,4BAA4B,GAAG,CAAC,GAAG,IAAI,GAAG,CAC9C,CAAC,KAAK,CAAC,4BAA4B,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CACrE,QAAQ,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAChD,CACF,CAAC,CAAC;IACH,IACE,CAAC,KAAK,CAAC,oBAAoB,KAAK,SAAS;QACvC,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC;QAC1C,CAAC,KAAK,CAAC,4BAA4B,KAAK,SAAS;YAC/C,KAAK,CAAC,4BAA4B,CAAC,MAAM,KAAK,CAAC,CAAC,EAClD,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,IACE,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACjC,4BAA4B,CAAC,MAAM,KAAK,CAAC,EACzC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,0BAA0B,GAC9B,KAAK,CAAC,0BAA0B,IAAI,qBAAqB,CAAC;IAC5D,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,WAAW,KAAK,YAAY,CAAC;QAC9C,WAAW,CAAC,QAAQ,KAAK,MAAM,CAAC,YAAY,EAAE,CAAC;QACjD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,qDAAqD,CACtD,CAAC;IACJ,CAAC;IACD,IACE,qBAAqB;QACrB,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,IAAI,WAAW,KAAK,YAAY,CAAC;QAC9D,CAAC,qBAAqB,CAAC,QAAQ,KAAK,MAAM,CAAC,aAAa;YACtD,qBAAqB,CAAC,MAAM,CAAC,EAC/B,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,KAAK,YAAY,IAAI,CAAC,qBAAqB,EAAE,CAAC;QAC3D,MAAM,IAAI,SAAS,CACjB,gBAAgB,EAChB,iDAAiD,CAClD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM;QACN,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,CAAC;QAC9C,YAAY,EAAE,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC;QAC1D,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,WAAW;QACX,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,MAAM;QACN,WAAW;QACX,iBAAiB;QACjB,sBAAsB;QACtB,oBAAoB;QACpB,4BAA4B;QAC5B,MAAM;QACN,EAAE,EAAE,eAAe,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,0BAA0B;KAC3B,CAAC;AACJ,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,25 @@
+import type { AuthErrorCode, AuthDiagnosticReason, AuthDiagnosticStage, SafeAuthErrorDetails, SafeAuthErrorFields } from "@dreadkn1ght123/auth-types";
+export interface AuthErrorOptions {
+    cause?: unknown;
+    stage?: AuthDiagnosticStage;
+    reason?: AuthDiagnosticReason;
+    details?: Readonly<SafeAuthErrorDetails>;
+    safeDetails?: Readonly<SafeAuthErrorDetails>;
+}
+/** Extracts only audited scalar fields from supported error families. */
+export declare function safeAuthErrorDetails(error: unknown): Readonly<SafeAuthErrorDetails>;
+export declare function classifyAuthError(error: unknown): {
+    reason: AuthDiagnosticReason;
+    details: Readonly<SafeAuthErrorDetails>;
+};
+export declare function toSafeAuthErrorFields(error: unknown, correlationId?: string): Readonly<SafeAuthErrorFields>;
+export declare class AuthError extends Error {
+    readonly code: AuthErrorCode;
+    readonly stage: AuthDiagnosticStage;
+    readonly reason: AuthDiagnosticReason;
+    readonly details: Readonly<SafeAuthErrorDetails>;
+    readonly safeDetails: Readonly<SafeAuthErrorDetails>;
+    readonly cause?: unknown;
+    constructor(code: AuthErrorCode, message: string, options?: AuthErrorOptions);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,mBAAmB,EACpB,MAAM,4BAA4B,CAAC;AAEpC,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,KAAK,CAAC,EAAE,mBAAmB,CAAC;IAC5B,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,OAAO,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACzC,WAAW,CAAC,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CAC9C;AAiDD,yEAAyE;AACzE,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,CAAC,oBAAoB,CAAC,CAkDnF;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG;IACjD,MAAM,EAAE,oBAAoB,CAAC;IAC7B,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;CACzC,CA+BA;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,aAAa,CAAC,EAAE,MAAM,GACrB,QAAQ,CAAC,mBAAmB,CAAC,CAc/B;AAED,qBAAa,SAAU,SAAQ,KAAK;IAClC,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC;IACpC,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACjD,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IACrD,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB;CAcjF"}