@empire-builder-kit/runtime 0.0.1-alpha.9 → 1.0.0-beta.4

package/src/auth-web.js

@@ -0,0 +1,153 @@
+import { __awaiter } from "tslib";
+import { isAuthError, toPrincipal, } from './auth.js';
+import { createCognitoJwtVerifier, extractBearerToken, } from './auth-backend.js';
+/**
+ * Creates Next.js middleware configuration for auth.
+ * Validates JWTs from the standard Authorization header.
+ *
+ * The verifier defaults to `tokenUse: 'access'` (matching `createAuthGuard`),
+ * so a Cognito id token — which is audience-scoped to the client and not
+ * intended as an API access credential (OAuth 2.0 Security BCP / RFC 9700) —
+ * is rejected as a bearer credential. Pass `verifierOptions.tokenUse` to
+ * override (e.g. `'any'` or `'id'`).
+ */
+export function createAuthMiddlewareConfig(config, options = {}) {
+    var _a, _b;
+    const verifier = createCognitoJwtVerifier(config, Object.assign(Object.assign({}, options.verifierOptions), { tokenUse: (_b = (_a = options.verifierOptions) === null || _a === void 0 ? void 0 : _a.tokenUse) !== null && _b !== void 0 ? _b : 'access' }));
+    /**
+     * Extract and verify session from a Next.js request.
+     */
+    function getSession(request) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const authHeader = request.headers.get('authorization');
+            const token = extractBearerToken(authHeader !== null && authHeader !== void 0 ? authHeader : undefined);
+            if (!token) {
+                return null;
+            }
+            try {
+                return yield verifier.verify(token);
+            }
+            catch (_a) {
+                return null;
+            }
+        });
+    }
+    return {
+        verifier,
+        getSession,
+        /**
+         * Resolve a typed principal from the request session. Returns null
+         * (never throws) when the token is missing/invalid, no policy is
+         * configured, or the session maps to no principal kind.
+         */
+        getPrincipal(request) {
+            return __awaiter(this, void 0, void 0, function* () {
+                if (!options.policy) {
+                    return null;
+                }
+                const session = yield getSession(request);
+                if (!session) {
+                    return null;
+                }
+                try {
+                    return toPrincipal(session, options.policy);
+                }
+                catch (_a) {
+                    return null;
+                }
+            });
+        },
+    };
+}
+function normalizePath(path) {
+    var _a, _b;
+    const pathOnly = (_b = (_a = path.split(/[?#]/, 1)[0]) === null || _a === void 0 ? void 0 : _a.replace(/\\/g, '/')) !== null && _b !== void 0 ? _b : '/';
+    if (/%(?:2f|5c)/i.test(pathOnly)) {
+        return null;
+    }
+    let decoded;
+    try {
+        decoded = decodeURI(pathOnly);
+    }
+    catch (_c) {
+        return null;
+    }
+    if (/%(?:2f|5c)/i.test(decoded)) {
+        return null;
+    }
+    const segments = [];
+    for (const segment of decoded.split('/')) {
+        if (!segment || segment === '.') {
+            continue;
+        }
+        if (segment === '..') {
+            segments.pop();
+            continue;
+        }
+        segments.push(segment);
+    }
+    return `/${segments.join('/')}`.replace(/\/+$/, '') || '/';
+}
+function matchesRoute(rulePath, pathname) {
+    return ((rulePath === '/' && pathname === '/') ||
+        pathname === rulePath ||
+        pathname.startsWith(`${rulePath}/`));
+}
+/**
+ * Framework-agnostic route guard for web middleware. Returns a decision
+ * object instead of throwing so middleware templates can translate it into
+ * redirects or responses. The most specific (longest) matching rule wins;
+ * equal-length rules keep their input order; unmatched paths are denied
+ * unless `defaultBehavior` is set to `allow`.
+ *
+ * Path matching is case-sensitive: `/Admin` does not match a `/admin` rule.
+ * Under the default `deny` this fails closed (an unmatched `/Admin` is
+ * denied). Do not combine `defaultBehavior: 'allow'` with a case-insensitive
+ * routing layer, or a case-variant of a protected path can bypass its rule
+ * and fall through to `allow`.
+ */
+export function createRouteGuard(options) {
+    var _a;
+    const rules = options.rules
+        .map((rule) => {
+        const normalizedPath = normalizePath(rule.path);
+        if (!normalizedPath) {
+            throw new Error(`Invalid route rule path: ${rule.path}`);
+        }
+        return Object.assign(Object.assign({}, rule), { path: normalizedPath });
+    })
+        .sort((a, b) => b.path.length - a.path.length);
+    const defaultBehavior = (_a = options.defaultBehavior) !== null && _a !== void 0 ? _a : 'deny';
+    return {
+        check(pathname, session) {
+            const normalizedPathname = normalizePath(pathname);
+            if (!normalizedPathname) {
+                return { allowed: false, reason: 'forbidden', status: 403 };
+            }
+            const rule = rules.find((candidate) => matchesRoute(candidate.path, normalizedPathname));
+            if (!rule) {
+                return defaultBehavior === 'allow'
+                    ? { allowed: true }
+                    : { allowed: false, reason: 'forbidden', status: 403 };
+            }
+            if (rule.public) {
+                return { allowed: true };
+            }
+            let principal;
+            try {
+                principal = toPrincipal(session !== null && session !== void 0 ? session : { metadata: {}, status: 'anonymous' }, options.policy);
+            }
+            catch (error) {
+                if (isAuthError(error) && error.status === 401) {
+                    return { allowed: false, reason: 'unauthenticated', status: 401 };
+                }
+                return { allowed: false, reason: 'forbidden', status: 403 };
+            }
+            if (rule.allow && !rule.allow.includes(principal.kind)) {
+                return { allowed: false, reason: 'forbidden', status: 403 };
+            }
+            return { allowed: true, principal };
+        },
+    };
+}
+//# sourceMappingURL=auth-web.js.map

package/src/auth-web.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-web.js","sourceRoot":"","sources":["../../../../packages/runtime/src/auth-web.ts"],"names":[],"mappings":";AAAA,OAAO,EACL,WAAW,EACX,WAAW,GAMZ,MAAM,WAAW,CAAC;AACnB,OAAO,EACL,wBAAwB,EACxB,kBAAkB,GAEnB,MAAM,mBAAmB,CAAC;AAW3B;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CACxC,MAAwB,EACxB,UAA6C,EAAE;;IAE/C,MAAM,QAAQ,GAAG,wBAAwB,CAAC,MAAM,kCAC3C,OAAO,CAAC,eAAe,KAC1B,QAAQ,EAAE,MAAA,MAAA,OAAO,CAAC,eAAe,0CAAE,QAAQ,mCAAI,QAAQ,IACvD,CAAC;IAEH;;OAEG;IACH,SAAe,UAAU,CAAC,OAA8B;;YACtD,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACxD,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,aAAV,UAAU,cAAV,UAAU,GAAI,SAAS,CAAC,CAAC;YAE1D,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,IAAI,CAAC;YACd,CAAC;YAED,IAAI,CAAC;gBACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,CAAC;YAAC,WAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KAAA;IAED,OAAO;QACL,QAAQ;QACR,UAAU;QACV;;;;WAIG;QACG,YAAY,CAChB,OAA8B;;gBAE9B,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;oBACpB,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,CAAC;gBAC1C,IAAI,CAAC,OAAO,EAAE,CAAC;oBACb,OAAO,IAAI,CAAC;gBACd,CAAC;gBAED,IAAI,CAAC;oBACH,OAAO,WAAW,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC9C,CAAC;gBAAC,WAAM,CAAC;oBACP,OAAO,IAAI,CAAC;gBACd,CAAC;YACH,CAAC;SAAA;KACF,CAAC;AACJ,CAAC;AA2CD,SAAS,aAAa,CAAC,IAAY;;IACjC,MAAM,QAAQ,GAAG,MAAA,MAAA,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,0CAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,mCAAI,GAAG,CAAC;IAEtE,IAAI,aAAa,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IAAC,WAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YAChC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;YACrB,QAAQ,CAAC,GAAG,EAAE,CAAC;YACf,SAAS;QACX,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzB,CAAC;IAED,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY,CAAC,QAAgB,EAAE,QAAgB;IACtD,OAAO,CACL,CAAC,QAAQ,KAAK,GAAG,IAAI,QAAQ,KAAK,GAAG,CAAC;QACtC,QAAQ,KAAK,QAAQ;QACrB,QAAQ,CAAC,UAAU,CAAC,GAAG,QAAQ,GAAG,CAAC,CACpC,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAgC;;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK;SACxB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACZ,MAAM,cAAc,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;QACD,uCAAY,IAAI,KAAE,IAAI,EAAE,cAAc,IAAG;IAC3C,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,MAAM,eAAe,GAAG,MAAA,OAAO,CAAC,eAAe,mCAAI,MAAM,CAAC;IAE1D,OAAO;QACL,KAAK,CAAC,QAAQ,EAAE,OAAO;YACrB,MAAM,kBAAkB,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YACnD,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBACxB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC9D,CAAC;YAED,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CACpC,YAAY,CAAC,SAAS,CAAC,IAAI,EAAE,kBAAkB,CAAC,CACjD,CAAC;YAEF,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,OAAO,eAAe,KAAK,OAAO;oBAChC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE;oBACnB,CAAC,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC3D,CAAC;YAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;gBAChB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC3B,CAAC;YAED,IAAI,SAAoB,CAAC;YACzB,IAAI,CAAC;gBACH,SAAS,GAAG,WAAW,CACrB,OAAO,aAAP,OAAO,cAAP,OAAO,GAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,EAChD,OAAO,CAAC,MAAM,CACf,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;oBAC/C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;gBACpE,CAAC;gBACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC9D,CAAC;YAED,IAAI,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;gBACvD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;YAC9D,CAAC;YAED,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;QACtC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/src/auth.d.ts

@@ -0,0 +1,143 @@
+import type { RequestActor, RequestMetadata, RequestMetadataValue } from './request-context.js';
+import { RuntimeError, type RuntimeErrorDetails } from './response.js';
+export type AuthSessionStatus = 'anonymous' | 'authenticated';
+export interface AuthSessionSubject {
+    displayName?: string;
+    email?: string;
+    id: string;
+    permissions?: string[];
+    roles?: string[];
+    tenantId?: string;
+    type: RequestActor['type'];
+}
+export interface AuthSession {
+    audience?: string;
+    expiresAt?: string;
+    issuedAt?: string;
+    metadata: RequestMetadata;
+    sessionId?: string;
+    status: AuthSessionStatus;
+    subject?: AuthSessionSubject;
+}
+export interface AnonymousSessionInput {
+    audience?: string;
+    expiresAt?: string;
+    issuedAt?: string;
+    metadata?: Record<string, RequestMetadataValue | undefined>;
+    sessionId?: string;
+}
+export interface AuthenticatedSessionInput extends AnonymousSessionInput {
+    subject: AuthSessionSubject;
+}
+export interface AuthenticatedSession extends AuthSession {
+    status: 'authenticated';
+    subject: AuthSessionSubject;
+}
+export declare const authContract: {
+    readonly exportPath: "@empire-builder-kit/runtime/auth";
+    readonly packageName: "@empire-builder-kit/runtime";
+};
+export declare function createAnonymousSession(input?: AnonymousSessionInput): AuthSession;
+export declare function createAuthenticatedSession(input: AuthenticatedSessionInput): AuthenticatedSession;
+export declare function isAuthenticatedSession(session: AuthSession): session is AuthenticatedSession;
+export declare function toRequestActor(session: AuthSession): RequestActor | undefined;
+export declare function toSessionLogMetadata(session: AuthSession): RequestMetadata;
+/**
+ * BetterAuth configuration contract.
+ *
+ * App groups consume auth from the core SDK. The core app group owns
+ * the Cognito user pool and exposes these connection details so
+ * BetterAuth can be configured against the shared pool.
+ */
+export interface BetterAuthConfig {
+    provider: 'cognito';
+    userPoolId: string;
+    clientId: string;
+    issuerUrl: string;
+}
+export declare function createBetterAuthConfig(options: {
+    userPoolId: string;
+    clientId: string;
+    region: string;
+}): BetterAuthConfig;
+export interface CognitoTokenClaims {
+    sub: string;
+    aud?: string | string[];
+    client_id?: string;
+    email?: string;
+    'cognito:username'?: string;
+    'cognito:groups'?: string[];
+    exp?: number;
+    iat?: number;
+    scope?: string;
+    token_use?: string;
+}
+export declare function sessionFromCognitoToken(decoded: CognitoTokenClaims): AuthenticatedSession;
+export type PrincipalKind = 'admin' | 'agent' | 'customer';
+export type DefaultPrincipalKind = Exclude<PrincipalKind, 'admin'>;
+/**
+ * A typed identity resolved from an authenticated session via an
+ * {@link AuthPolicy}. Guards and handlers should authorize against the
+ * principal instead of inspecting raw Cognito claims.
+ */
+export interface Principal {
+    audience?: string;
+    id: string;
+    kind: PrincipalKind;
+    roles: string[];
+    scopes: string[];
+    session: AuthenticatedSession;
+}
+export interface AuthPolicyRule {
+    /**
+     * App client ids. Audience matching is ignored for admin rules and only
+     * matches agent rules for service principals. Use Cognito groups for
+     * privileged human access; scopes only grant privileged (admin/agent)
+     * access to service principals, so a human token carrying a privileged
+     * scope cannot elevate above customer.
+     */
+    audiences?: string[];
+    groups?: string[];
+    scopes?: string[];
+}
+/**
+ * Maps Cognito groups, safe token audience matches, and OAuth scopes onto
+ * principal kinds. When several kinds match, the more privileged kind wins:
+ * admin, then agent, then customer. Admin defaults are intentionally
+ * disallowed; unaffiliated authenticated users may only default to agent or
+ * customer.
+ */
+export interface AuthPolicy {
+    admin?: AuthPolicyRule;
+    agent?: AuthPolicyRule;
+    customer?: AuthPolicyRule;
+    defaultKind?: DefaultPrincipalKind;
+}
+export declare const authErrorCodes: {
+    readonly forbiddenKind: "auth_forbidden_kind";
+    readonly forbiddenRole: "auth_forbidden_role";
+    readonly forbiddenScope: "auth_forbidden_scope";
+    readonly invalidToken: "auth_invalid_token";
+    readonly principalMismatch: "auth_principal_mismatch";
+    readonly unauthenticated: "auth_unauthenticated";
+};
+export type AuthErrorCode = (typeof authErrorCodes)[keyof typeof authErrorCodes];
+export interface AuthErrorOptions {
+    code: AuthErrorCode;
+    details?: RuntimeErrorDetails;
+    message: string;
+    status: 401 | 403;
+}
+export declare class AuthError extends RuntimeError {
+    constructor(options: AuthErrorOptions);
+}
+export declare function isAuthError(error: unknown): error is AuthError;
+export declare function toPrincipal(session: AuthSession, policy: AuthPolicy): Principal;
+export declare function hasRole(principal: Principal, role: string): boolean;
+export declare function hasScope(principal: Principal, scope: string): boolean;
+export declare function isAdmin(principal: Principal): boolean;
+export declare function isAgent(principal: Principal): boolean;
+export declare function isCustomer(principal: Principal): boolean;
+export declare function assertPrincipalKind(principal: Principal, allowed: PrincipalKind[]): void;
+export declare function assertRole(principal: Principal, role: string): void;
+export declare function assertScope(principal: Principal, scope: string): void;

package/src/auth.js

@@ -0,0 +1,233 @@
+import { RuntimeError } from './response.js';
+export const authContract = {
+    exportPath: '@empire-builder-kit/runtime/auth',
+    packageName: '@empire-builder-kit/runtime',
+};
+function normalizeMetadata(metadata) {
+    const entries = Object.entries(metadata !== null && metadata !== void 0 ? metadata : {}).filter(([, value]) => value !== undefined);
+    return Object.fromEntries(entries);
+}
+function normalizeList(values) {
+    const normalized = (values !== null && values !== void 0 ? values : [])
+        .map((value) => value.trim())
+        .filter(Boolean);
+    if (normalized.length === 0) {
+        return undefined;
+    }
+    return [...new Set(normalized)];
+}
+function normalizeSubject(subject) {
+    var _a, _b, _c;
+    return Object.assign(Object.assign({}, subject), { displayName: ((_a = subject.displayName) === null || _a === void 0 ? void 0 : _a.trim()) || undefined, email: ((_b = subject.email) === null || _b === void 0 ? void 0 : _b.trim()) || undefined, permissions: normalizeList(subject.permissions), roles: normalizeList(subject.roles), tenantId: ((_c = subject.tenantId) === null || _c === void 0 ? void 0 : _c.trim()) || undefined });
+}
+export function createAnonymousSession(input = {}) {
+    var _a;
+    return {
+        audience: ((_a = input.audience) === null || _a === void 0 ? void 0 : _a.trim()) || undefined,
+        expiresAt: input.expiresAt,
+        issuedAt: input.issuedAt,
+        metadata: normalizeMetadata(input.metadata),
+        sessionId: input.sessionId,
+        status: 'anonymous',
+    };
+}
+export function createAuthenticatedSession(input) {
+    return Object.assign(Object.assign({}, createAnonymousSession(input)), { status: 'authenticated', subject: normalizeSubject(input.subject) });
+}
+export function isAuthenticatedSession(session) {
+    return session.status === 'authenticated' && session.subject !== undefined;
+}
+export function toRequestActor(session) {
+    if (!isAuthenticatedSession(session)) {
+        return undefined;
+    }
+    return {
+        id: session.subject.id,
+        type: session.subject.type,
+    };
+}
+export function toSessionLogMetadata(session) {
+    var _a, _b, _c, _d, _e, _f, _g, _h, _j;
+    return normalizeMetadata(Object.assign({ authAudience: session.audience, authExpiresAt: session.expiresAt, authIssuedAt: session.issuedAt, authPermissions: (_b = (_a = session.subject) === null || _a === void 0 ? void 0 : _a.permissions) === null || _b === void 0 ? void 0 : _b.join(','), authRoles: (_d = (_c = session.subject) === null || _c === void 0 ? void 0 : _c.roles) === null || _d === void 0 ? void 0 : _d.join(','), authSessionId: session.sessionId, authStatus: session.status, authSubjectEmail: (_e = session.subject) === null || _e === void 0 ? void 0 : _e.email, authSubjectId: (_f = session.subject) === null || _f === void 0 ? void 0 : _f.id, authSubjectName: (_g = session.subject) === null || _g === void 0 ? void 0 : _g.displayName, authSubjectType: (_h = session.subject) === null || _h === void 0 ? void 0 : _h.type, authTenantId: (_j = session.subject) === null || _j === void 0 ? void 0 : _j.tenantId }, session.metadata));
+}
+export function createBetterAuthConfig(options) {
+    const region = options.region.trim();
+    const userPoolId = options.userPoolId.trim();
+    const clientId = options.clientId.trim();
+    if (!region || !userPoolId || !clientId) {
+        throw new Error('Cognito region, userPoolId, and clientId must be non-empty.');
+    }
+    return {
+        provider: 'cognito',
+        userPoolId,
+        clientId,
+        issuerUrl: `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`,
+    };
+}
+function resolveTokenAudience(decoded) {
+    if (decoded.client_id) {
+        return decoded.client_id;
+    }
+    if (typeof decoded.aud === 'string') {
+        return decoded.aud;
+    }
+    if (Array.isArray(decoded.aud)) {
+        return decoded.aud.find((audience) => audience.trim() !== '');
+    }
+    return undefined;
+}
+export function sessionFromCognitoToken(decoded) {
+    var _a;
+    // Client-credentials access tokens carry sub === client_id and no user
+    // claims; they represent a machine caller, not a Cognito user.
+    const isServiceToken = decoded.client_id !== undefined && decoded.client_id === decoded.sub;
+    return createAuthenticatedSession({
+        audience: resolveTokenAudience(decoded),
+        subject: {
+            id: decoded.sub,
+            email: decoded.email,
+            displayName: decoded['cognito:username'],
+            permissions: (_a = decoded.scope) === null || _a === void 0 ? void 0 : _a.split(/\s+/),
+            roles: decoded['cognito:groups'],
+            type: isServiceToken ? 'service' : 'user',
+        },
+        expiresAt: decoded.exp
+            ? new Date(decoded.exp * 1000).toISOString()
+            : undefined,
+        issuedAt: decoded.iat
+            ? new Date(decoded.iat * 1000).toISOString()
+            : undefined,
+    });
+}
+export const authErrorCodes = {
+    forbiddenKind: 'auth_forbidden_kind',
+    forbiddenRole: 'auth_forbidden_role',
+    forbiddenScope: 'auth_forbidden_scope',
+    invalidToken: 'auth_invalid_token',
+    principalMismatch: 'auth_principal_mismatch',
+    unauthenticated: 'auth_unauthenticated',
+};
+export class AuthError extends RuntimeError {
+    constructor(options) {
+        super(Object.assign(Object.assign({}, options), { retryable: false }));
+        this.name = 'AuthError';
+    }
+}
+export function isAuthError(error) {
+    return error instanceof AuthError;
+}
+const principalKindPrecedence = ['admin', 'agent', 'customer'];
+function matchesPolicyRule(kind, rule, input) {
+    var _a, _b, _c;
+    if ((_a = rule.groups) === null || _a === void 0 ? void 0 : _a.some((group) => input.roles.includes(group))) {
+        return true;
+    }
+    if (((_b = rule.scopes) === null || _b === void 0 ? void 0 : _b.some((scope) => input.scopes.includes(scope))) &&
+        (kind === 'customer' || input.subjectType === 'service')) {
+        return true;
+    }
+    if (input.audience !== undefined &&
+        ((_c = rule.audiences) === null || _c === void 0 ? void 0 : _c.includes(input.audience)) &&
+        (kind === 'customer' ||
+            (kind === 'agent' && input.subjectType === 'service'))) {
+        return true;
+    }
+    return false;
+}
+function resolveDefaultPrincipalKind(policy) {
+    const defaultKind = policy.defaultKind;
+    if (defaultKind === 'admin') {
+        throw new AuthError({
+            code: authErrorCodes.principalMismatch,
+            message: 'Auth policy defaultKind cannot be admin',
+            status: 403,
+        });
+    }
+    return defaultKind;
+}
+export function toPrincipal(session, policy) {
+    var _a, _b, _c;
+    if (!isAuthenticatedSession(session)) {
+        throw new AuthError({
+            code: authErrorCodes.unauthenticated,
+            message: 'Authentication required',
+            status: 401,
+        });
+    }
+    const audience = session.audience;
+    const roles = (_a = session.subject.roles) !== null && _a !== void 0 ? _a : [];
+    const scopes = (_b = session.subject.permissions) !== null && _b !== void 0 ? _b : [];
+    const defaultKind = resolveDefaultPrincipalKind(policy);
+    const kind = (_c = principalKindPrecedence.find((candidate) => {
+        const rule = policy[candidate];
+        return rule !== undefined
+            ? matchesPolicyRule(candidate, rule, {
+                audience,
+                roles,
+                scopes,
+                subjectType: session.subject.type,
+            })
+            : false;
+    })) !== null && _c !== void 0 ? _c : defaultKind;
+    if (!kind) {
+        throw new AuthError({
+            code: authErrorCodes.principalMismatch,
+            message: 'Session does not map to a known principal kind',
+            status: 403,
+        });
+    }
+    return {
+        audience,
+        id: session.subject.id,
+        kind,
+        roles,
+        scopes,
+        session,
+    };
+}
+export function hasRole(principal, role) {
+    return principal.roles.includes(role);
+}
+export function hasScope(principal, scope) {
+    return principal.scopes.includes(scope);
+}
+export function isAdmin(principal) {
+    return principal.kind === 'admin';
+}
+export function isAgent(principal) {
+    return principal.kind === 'agent';
+}
+export function isCustomer(principal) {
+    return principal.kind === 'customer';
+}
+export function assertPrincipalKind(principal, allowed) {
+    if (!allowed.includes(principal.kind)) {
+        throw new AuthError({
+            code: authErrorCodes.forbiddenKind,
+            details: { allowed, kind: principal.kind },
+            message: `Principal kind '${principal.kind}' is not allowed`,
+            status: 403,
+        });
+    }
+}
+export function assertRole(principal, role) {
+    if (!hasRole(principal, role)) {
+        throw new AuthError({
+            code: authErrorCodes.forbiddenRole,
+            details: { role },
+            message: `Principal is missing required role '${role}'`,
+            status: 403,
+        });
+    }
+}
+export function assertScope(principal, scope) {
+    if (!hasScope(principal, scope)) {
+        throw new AuthError({
+            code: authErrorCodes.forbiddenScope,
+            details: { scope },
+            message: `Principal is missing required scope '${scope}'`,
+            status: 403,
+        });
+    }
+}
+//# sourceMappingURL=auth.js.map

package/src/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../../packages/runtime/src/auth.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,YAAY,EAA4B,MAAM,eAAe,CAAC;AAyCvE,MAAM,CAAC,MAAM,YAAY,GAAG;IAC1B,UAAU,EAAE,kCAAkC;IAC9C,WAAW,EAAE,6BAA6B;CAClC,CAAC;AAEX,SAAS,iBAAiB,CACxB,QAA2D;IAE3D,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,aAAR,QAAQ,cAAR,QAAQ,GAAI,EAAE,CAAC,CAAC,MAAM,CACnD,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,SAAS,CACC,CAAC;IAEtC,OAAO,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,MAAiB;IACtC,MAAM,UAAU,GAAG,CAAC,MAAM,aAAN,MAAM,cAAN,MAAM,GAAI,EAAE,CAAC;SAC9B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;IAEnB,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAA2B;;IACnD,uCACK,OAAO,KACV,WAAW,EAAE,CAAA,MAAA,OAAO,CAAC,WAAW,0CAAE,IAAI,EAAE,KAAI,SAAS,EACrD,KAAK,EAAE,CAAA,MAAA,OAAO,CAAC,KAAK,0CAAE,IAAI,EAAE,KAAI,SAAS,EACzC,WAAW,EAAE,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAC/C,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EACnC,QAAQ,EAAE,CAAA,MAAA,OAAO,CAAC,QAAQ,0CAAE,IAAI,EAAE,KAAI,SAAS,IAC/C;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,QAA+B,EAAE;;IAEjC,OAAO;QACL,QAAQ,EAAE,CAAA,MAAA,KAAK,CAAC,QAAQ,0CAAE,IAAI,EAAE,KAAI,SAAS;QAC7C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC3C,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,MAAM,EAAE,WAAW;KACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,KAAgC;IAEhC,uCACK,sBAAsB,CAAC,KAAK,CAAC,KAChC,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,gBAAgB,CAAC,KAAK,CAAC,OAAO,CAAC,IACxC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAoB;IAEpB,OAAO,OAAO,CAAC,MAAM,KAAK,eAAe,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC;AAC7E,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAoB;IACjD,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,OAAoB;;IACvD,OAAO,iBAAiB,iBACtB,YAAY,EAAE,OAAO,CAAC,QAAQ,EAC9B,aAAa,EAAE,OAAO,CAAC,SAAS,EAChC,YAAY,EAAE,OAAO,CAAC,QAAQ,EAC9B,eAAe,EAAE,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,WAAW,0CAAE,IAAI,CAAC,GAAG,CAAC,EACxD,SAAS,EAAE,MAAA,MAAA,OAAO,CAAC,OAAO,0CAAE,KAAK,0CAAE,IAAI,CAAC,GAAG,CAAC,EAC5C,aAAa,EAAE,OAAO,CAAC,SAAS,EAChC,UAAU,EAAE,OAAO,CAAC,MAAM,EAC1B,gBAAgB,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAE,KAAK,EACxC,aAAa,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAE,EAAE,EAClC,eAAe,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAE,WAAW,EAC7C,eAAe,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAE,IAAI,EACtC,YAAY,EAAE,MAAA,OAAO,CAAC,OAAO,0CAAE,QAAQ,IACpC,OAAO,CAAC,QAAQ,EACnB,CAAC;AACL,CAAC;AAgBD,MAAM,UAAU,sBAAsB,CAAC,OAItC;IACC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IACrC,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,IAAI,CAAC,UAAU,IAAI,CAAC,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CACb,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO;QACL,QAAQ,EAAE,SAAS;QACnB,UAAU;QACV,QAAQ;QACR,SAAS,EAAE,uBAAuB,MAAM,kBAAkB,UAAU,EAAE;KACvE,CAAC;AACJ,CAAC;AAeD,SAAS,oBAAoB,CAAC,OAA2B;IACvD,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,OAAO,OAAO,CAAC,SAAS,CAAC;IAC3B,CAAC;IAED,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;QACpC,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,OAA2B;;IAE3B,uEAAuE;IACvE,+DAA+D;IAC/D,MAAM,cAAc,GAClB,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS,KAAK,OAAO,CAAC,GAAG,CAAC;IAEvE,OAAO,0BAA0B,CAAC;QAChC,QAAQ,EAAE,oBAAoB,CAAC,OAAO,CAAC;QACvC,OAAO,EAAE;YACP,EAAE,EAAE,OAAO,CAAC,GAAG;YACf,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,WAAW,EAAE,OAAO,CAAC,kBAAkB,CAAC;YACxC,WAAW,EAAE,MAAA,OAAO,CAAC,KAAK,0CAAE,KAAK,CAAC,KAAK,CAAC;YACxC,KAAK,EAAE,OAAO,CAAC,gBAAgB,CAAC;YAChC,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;SAC1C;QACD,SAAS,EAAE,OAAO,CAAC,GAAG;YACpB,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,SAAS;QACb,QAAQ,EAAE,OAAO,CAAC,GAAG;YACnB,CAAC,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;YAC5C,CAAC,CAAC,SAAS;KACd,CAAC,CAAC;AACL,CAAC;AA8CD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa,EAAE,qBAAqB;IACpC,aAAa,EAAE,qBAAqB;IACpC,cAAc,EAAE,sBAAsB;IACtC,YAAY,EAAE,oBAAoB;IAClC,iBAAiB,EAAE,yBAAyB;IAC5C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAYX,MAAM,OAAO,SAAU,SAAQ,YAAY;IACzC,YAAY,OAAyB;QACnC,KAAK,iCAAM,OAAO,KAAE,SAAS,EAAE,KAAK,IAAG,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAED,MAAM,UAAU,WAAW,CAAC,KAAc;IACxC,OAAO,KAAK,YAAY,SAAS,CAAC;AACpC,CAAC;AAED,MAAM,uBAAuB,GAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;AAEhF,SAAS,iBAAiB,CACxB,IAAmB,EACnB,IAAoB,EACpB,KAKC;;IAED,IAAI,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,CAAA,MAAA,IAAI,CAAC,MAAM,0CAAE,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC1D,CAAC,IAAI,KAAK,UAAU,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,KAAK,CAAC,QAAQ,KAAK,SAAS;SAC5B,MAAA,IAAI,CAAC,SAAS,0CAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAA;QACxC,CAAC,IAAI,KAAK,UAAU;YAClB,CAAC,IAAI,KAAK,OAAO,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,EACxD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,2BAA2B,CAClC,MAAkB;IAElB,MAAM,WAAW,GAAI,MAA0C,CAAC,WAAW,CAAC;IAC5E,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,OAAO,EAAE,yCAAyC;YAClD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,MAAM,UAAU,WAAW,CACzB,OAAoB,EACpB,MAAkB;;IAElB,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,eAAe;YACpC,OAAO,EAAE,yBAAyB;YAClC,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAClC,MAAM,KAAK,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,KAAK,mCAAI,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,MAAA,OAAO,CAAC,OAAO,CAAC,WAAW,mCAAI,EAAE,CAAC;IACjD,MAAM,WAAW,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAExD,MAAM,IAAI,GACR,MAAA,uBAAuB,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;QACzC,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;QAC/B,OAAO,IAAI,KAAK,SAAS;YACvB,CAAC,CAAC,iBAAiB,CAAC,SAAS,EAAE,IAAI,EAAE;gBACjC,QAAQ;gBACR,KAAK;gBACL,MAAM;gBACN,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI;aAClC,CAAC;YACJ,CAAC,CAAC,KAAK,CAAC;IACZ,CAAC,CAAC,mCAAI,WAAW,CAAC;IAEpB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,iBAAiB;YACtC,OAAO,EAAE,gDAAgD;YACzD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;IAED,OAAO;QACL,QAAQ;QACR,EAAE,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE;QACtB,IAAI;QACJ,KAAK;QACL,MAAM;QACN,OAAO;KACR,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAoB,EAAE,IAAY;IACxD,OAAO,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,SAAoB,EAAE,KAAa;IAC1D,OAAO,SAAS,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAoB;IAC1C,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,SAAoB;IAC1C,OAAO,SAAS,CAAC,IAAI,KAAK,OAAO,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoB;IAC7C,OAAO,SAAS,CAAC,IAAI,KAAK,UAAU,CAAC;AACvC,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,SAAoB,EACpB,OAAwB;IAExB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,OAAO,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;YAC1C,OAAO,EAAE,mBAAmB,SAAS,CAAC,IAAI,kBAAkB;YAC5D,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,SAAoB,EAAE,IAAY;IAC3D,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,aAAa;YAClC,OAAO,EAAE,EAAE,IAAI,EAAE;YACjB,OAAO,EAAE,uCAAuC,IAAI,GAAG;YACvD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,SAAoB,EAAE,KAAa;IAC7D,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,SAAS,CAAC;YAClB,IAAI,EAAE,cAAc,CAAC,cAAc;YACnC,OAAO,EAAE,EAAE,KAAK,EAAE;YAClB,OAAO,EAAE,wCAAwC,KAAK,GAAG;YACzD,MAAM,EAAE,GAAG;SACZ,CAAC,CAAC;IACL,CAAC;AACH,CAAC"}

package/{dist → src}/config.d.ts

@@ -49,4 +49,3 @@ export declare function number(options?: NumberOptions): ConfigParser<number>;
 export declare function boolean(options?: BooleanOptions): ConfigParser<boolean>;
 export declare function enumValue<const T extends string>(values: readonly T[], options?: EnumOptions<T>): ConfigParser<T>;
 export {};
-//# sourceMappingURL=config.d.ts.map

package/{dist → src}/config.js

@@ -1,30 +1,17 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.ConfigValidationError = void 0;
-exports.formatConfigIssues = formatConfigIssues;
-exports.loadConfig = loadConfig;
-exports.string = string;
-exports.optionalString = optionalString;
-exports.number = number;
-exports.boolean = boolean;
-exports.enumValue = enumValue;
 class ConfigFieldError extends Error {
-    issue;
     constructor(issue) {
         super(`${issue.key}: ${issue.message}`);
         this.name = 'ConfigFieldError';
         this.issue = issue;
     }
 }
-class ConfigValidationError extends Error {
-    issues;
+export class ConfigValidationError extends Error {
     constructor(issues) {
         super(formatConfigIssues(issues));
         this.name = 'ConfigValidationError';
         this.issues = issues;
     }
 }
-exports.ConfigValidationError = ConfigValidationError;
 function normalizeEnvKey(propertyKey, env) {
     if (env) {
         return env;
@@ -53,7 +40,7 @@ function resolveStringValue(rawValue, defaultValue) {
     }
     return rawValue;
 }
-function formatConfigIssues(issues) {
+export function formatConfigIssues(issues) {
     const summary = issues
         .map(({ key, message, value }) => value === undefined
         ? `- ${key}: ${message}`
@@ -61,7 +48,7 @@ function formatConfigIssues(issues) {
         .join('\n');
     return `Invalid configuration:\n${summary}`;
 }
-function loadConfig(schema, source = process.env) {
+export function loadConfig(schema, source = process.env) {
     const issues = [];
     const config = {};
     for (const [propertyKey, parser] of Object.entries(schema)) {
@@ -84,7 +71,7 @@ function loadConfig(schema, source = process.env) {
     }
     return config;
 }
-function string(options = {}) {
+export function string(options = {}) {
     return ({ propertyKey, source }) => {
         const envKey = normalizeEnvKey(propertyKey, options.env);
         const rawValue = resolveStringValue(source[envKey], options.defaultValue);
@@ -104,7 +91,7 @@ function string(options = {}) {
         return value;
     };
 }
-function optionalString(options = {}) {
+export function optionalString(options = {}) {
     return ({ propertyKey, source }) => {
         const envKey = normalizeEnvKey(propertyKey, options.env);
         const rawValue = resolveStringValue(source[envKey], options.defaultValue);
@@ -124,7 +111,7 @@ function optionalString(options = {}) {
         return value;
     };
 }
-function number(options = {}) {
+export function number(options = {}) {
     return ({ propertyKey, source }) => {
         const envKey = normalizeEnvKey(propertyKey, options.env);
         const rawValue = source[envKey];
@@ -150,7 +137,7 @@ function number(options = {}) {
         return value;
     };
 }
-function boolean(options = {}) {
+export function boolean(options = {}) {
     return ({ propertyKey, source }) => {
         const envKey = normalizeEnvKey(propertyKey, options.env);
         const rawValue = source[envKey];
@@ -170,7 +157,7 @@ function boolean(options = {}) {
         throwFieldError(envKey, 'must be a boolean value', rawValue);
     };
 }
-function enumValue(values, options = {}) {
+export function enumValue(values, options = {}) {
     return ({ propertyKey, source }) => {
         const envKey = normalizeEnvKey(propertyKey, options.env);
         const rawValue = resolveStringValue(source[envKey], options.defaultValue);
@@ -183,3 +170,4 @@ function enumValue(values, options = {}) {
         return rawValue;
     };
 }
+//# sourceMappingURL=config.js.map

package/src/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../../packages/runtime/src/config.ts"],"names":[],"mappings":"AA6CA,MAAM,gBAAiB,SAAQ,KAAK;IAGlC,YAAY,KAAkB;QAC5B,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IACrB,CAAC;CACF;AAED,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAG9C,YAAY,MAAqB;QAC/B,KAAK,CAAC,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;QAClC,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,SAAS,eAAe,CAAC,WAAmB,EAAE,GAAY;IACxD,IAAI,GAAG,EAAE,CAAC;QACR,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,WAAW;SACf,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,WAAW,EAAE,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAClB,GAAW,EACX,OAAe,EACf,KAAc;IAEd,OAAO;QACL,GAAG;QACH,OAAO;QACP,KAAK;KACN,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,GAAW,EAAE,OAAe,EAAE,KAAc;IACnE,MAAM,IAAI,gBAAgB,CAAC,WAAW,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa,EAAE,IAAI,GAAG,IAAI;IACtD,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AACrC,CAAC;AAED,SAAS,kBAAkB,CACzB,QAA4B,EAC5B,YAAgC;IAEhC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,MAAqB;IACtD,MAAM,OAAO,GAAG,MAAM;SACnB,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,CAC/B,KAAK,KAAK,SAAS;QACjB,CAAC,CAAC,KAAK,GAAG,KAAK,OAAO,EAAE;QACxB,CAAC,CAAC,KAAK,GAAG,KAAK,OAAO,eAAe,KAAK,IAAI,CACjD;SACA,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO,2BAA2B,OAAO,EAAE,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,UAAU,CACxB,MAAS,EACT,SAAuB,OAAO,CAAC,GAAG;IAElC,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,EAAoB,CAAC;IAEpC,KAAK,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAGtD,EAAE,CAAC;QACJ,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;gBAC3B,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC;gBAChC,MAAM;aACP,CAAuC,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;gBACtC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACzB,SAAS;YACX,CAAC;YAED,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,qBAAqB,CAAC,MAAM,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,UAAyB,EAAE;IAChD,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAErE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,eAAe,CAAC,MAAM,EAAE,mBAAmB,EAAE,QAAQ,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxE,eAAe,CACb,MAAM,EACN,oBAAoB,OAAO,CAAC,SAAS,aAAa,EAClD,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,MAAM,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,UAEI,EAAE;IAEN,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,KAAK,GAAG,oBAAoB,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC;QAErE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;YACxE,eAAe,CACb,MAAM,EACN,oBAAoB,OAAO,CAAC,SAAS,aAAa,EAClD,KAAK,CACN,CAAC;QACJ,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACpD,eAAe,CAAC,MAAM,EAAE,qCAAqC,EAAE,KAAK,CAAC,CAAC;QACxE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,UAAyB,EAAE;IAChD,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,OAAO,CAAC,YAAY,CAAC;YAC9B,CAAC;YAED,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE/B,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,eAAe,CAAC,MAAM,EAAE,wBAAwB,EAAE,QAAQ,CAAC,CAAC;QAC9D,CAAC;QAED,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;YAChD,eAAe,CAAC,MAAM,EAAE,oBAAoB,EAAE,QAAQ,CAAC,CAAC;QAC1D,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,eAAe,CAAC,MAAM,EAAE,oBAAoB,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACvE,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,KAAK,SAAS,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;YACrD,eAAe,CAAC,MAAM,EAAE,mBAAmB,OAAO,CAAC,GAAG,EAAE,EAAE,QAAQ,CAAC,CAAC;QACtE,CAAC;QAED,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,UAA0B,EAAE;IAClD,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAEhC,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC3D,IAAI,OAAO,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;gBACvC,OAAO,OAAO,CAAC,YAAY,CAAC;YAC9B,CAAC;YAED,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAEjD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;YACrD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,eAAe,CAAC,MAAM,EAAE,yBAAyB,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,SAAS,CACvB,MAAoB,EACpB,UAA0B,EAAE;IAE5B,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE,EAAE;QACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;QACzD,MAAM,QAAQ,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;QAE1E,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,eAAe,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAa,CAAC,EAAE,CAAC;YACpC,eAAe,CACb,MAAM,EACN,kBAAkB,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClE,QAAQ,CACT,CAAC;QACJ,CAAC;QAED,OAAO,QAAa,CAAC;IACvB,CAAC,CAAC;AACJ,CAAC"}