@geekmidas/auth 0.1.0 → 1.0.0

package/dist/oidc-C0KyYaAK.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-C0KyYaAK.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n  nonce?: string;\n  auth_time?: number;\n  at_hash?: string;\n  c_hash?: string;\n  azp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: string;\n  birthdate?: string;\n  zoneinfo?: string;\n  locale?: string;\n  phone_number?: string;\n  phone_number_verified?: boolean;\n  address?: {\n    formatted?: string;\n    street_address?: string;\n    locality?: string;\n    region?: string;\n    postal_code?: string;\n    country?: string;\n  };\n  updated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint?: string;\n  jwks_uri: string;\n  scopes_supported?: string[];\n  response_types_supported: string[];\n  claims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n  issuer: string;\n  audience: string | string[];\n  cacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n  TClaims extends OidcClaims = OidcClaims,\n  TUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n  private discovery: OidcDiscovery | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n  private readonly discoveryUrl: string;\n\n  constructor(private readonly config: OidcConfig) {\n    this.discoveryUrl = config.issuer.endsWith('/')\n      ? `${config.issuer}.well-known/openid-configuration`\n      : `${config.issuer}/.well-known/openid-configuration`;\n  }\n\n  async getDiscovery(): Promise<OidcDiscovery> {\n    if (this.discovery && this.config.cacheDiscovery !== false) {\n      return this.discovery;\n    }\n\n    const response = await fetch(this.discoveryUrl);\n    if (!response.ok) {\n      throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n    }\n\n    this.discovery = (await response.json()) as OidcDiscovery;\n    return this.discovery;\n  }\n\n  private async getJwks(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks && this.config.cacheDiscovery !== false) {\n      return this.jwks;\n    }\n\n    const disc = await this.getDiscovery();\n    this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n    return this.jwks;\n  }\n\n  async verify(token: string): Promise<TClaims> {\n    const key = await this.getJwks();\n    const { payload } = await jose.jwtVerify(token, key, {\n      issuer: this.config.issuer,\n      audience: this.config.audience,\n    });\n    return payload as unknown as TClaims;\n  }\n\n  async verifyOrNull(token: string): Promise<TClaims | null> {\n    try {\n      return await this.verify(token);\n    } catch {\n      return null;\n    }\n  }\n\n  async fetchUserInfo(token: string): Promise<TUserInfo | null> {\n    try {\n      const disc = await this.getDiscovery();\n      if (!disc.userinfo_endpoint) {\n        return null;\n      }\n\n      const response = await fetch(disc.userinfo_endpoint, {\n        headers: { Authorization: `Bearer ${token}` },\n      });\n\n      if (!response.ok) {\n        return null;\n      }\n\n      return (await response.json()) as TUserInfo;\n    } catch {\n      return null;\n    }\n  }\n\n  clearCache(): void {\n    this.discovery = null;\n    this.jwks = null;\n  }\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACA,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC3B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC1C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACtB;CAED,MAAM,eAAuC;AAC3C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACnD,QAAO,KAAK;EAGd,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACZ,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGzE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACb;CAED,MAAc,UAAyC;AACrD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC9C,QAAO,KAAK;EAGd,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACb;CAED,MAAM,OAAOC,OAAiC;EAC5C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACnD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACvB,EAAC;AACF,SAAO;CACR;CAED,MAAM,aAAaA,OAAwC;AACzD,MAAI;AACF,UAAO,MAAM,KAAK,OAAO,MAAM;EAChC,QAAO;AACN,UAAO;EACR;CACF;CAED,MAAM,cAAcA,OAA0C;AAC5D,MAAI;GACF,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACR,QAAO;GAGT,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACnD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC9C,EAAC;AAEF,QAAK,SAAS,GACZ,QAAO;AAGT,UAAQ,MAAM,SAAS,MAAM;EAC9B,QAAO;AACN,UAAO;EACR;CACF;CAED,aAAmB;AACjB,OAAK,YAAY;AACjB,OAAK,OAAO;CACb;AACF"}
+{"version":3,"file":"oidc-C0KyYaAK.cjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}

package/dist/{oidc-CKOGLxjV.d.mts → oidc-ChA17wLB.d.cts}

@@ -1,4 +1,4 @@
-import { JwtClaims } from "./jwt-DH8CJ2xC.mjs";
+import { JwtClaims } from "./jwt-3eIuY2dg.cjs";
 
 //#region src/oidc.d.ts
 
@@ -81,6 +81,7 @@ declare class OidcVerifier<TClaims extends OidcClaims = OidcClaims, TUserInfo ex
   fetchUserInfo(token: string): Promise<TUserInfo | null>;
   clearCache(): void;
 }
+//# sourceMappingURL=oidc.d.ts.map
 //#endregion
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier };
-//# sourceMappingURL=oidc-CKOGLxjV.d.mts.map
+//# sourceMappingURL=oidc-ChA17wLB.d.cts.map

package/dist/oidc-ChA17wLB.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-ChA17wLB.d.cts","names":[],"sources":["../src/oidc.ts"],"sourcesContent":[],"mappings":";;;;;AAQA;AAWA;AAiCiB,UA5CA,UAAA,SAAmB,SA4CN,CAAA;EAcb,KAAA,CAAA,EAAA,MAAU;EASd,SAAA,CAAA,EAAA,MAAY;EAAA,OAAA,CAAA,EAAA,MAAA;EAAA,MACR,CAAA,EAAA,MAAA;EAAU,GAAG,CAAA,EAAA,MAAA;;;;;AAaP,UAtEN,YAAA,CAsEM;EAAO,GAwBQ,EAAA,MAAA;EAAO,IAAf,CAAA,EAAA,MAAA;EAAO,UASO,CAAA,EAAA,MAAA;EAAO,WAAf,CAAA,EAAA,MAAA;EAAO,WAQE,CAAA,EAAA,MAAA;EAAS,QAAjB,CAAA,EAAA,MAAA;EAAO,kBAAA,CAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;UA9E3B,aAAA;;;;;;;;;;;;;UAcA,UAAA;;;;;;;;cASJ,6BACI,aAAa,8BACX,eAAe;;;;;sBAMI;kBAMf,QAAQ;;yBAwBD,QAAQ;+BASF,QAAQ;gCAQP,QAAQ"}

package/dist/{oidc-DDLIB5gb.d.cts → oidc-DTRgBBl6.d.mts}

@@ -1,4 +1,4 @@
-import { JwtClaims } from "./jwt-DF9kFbmh.cjs";
+import { JwtClaims } from "./jwt-BqLlRkw-.mjs";
 
 //#region src/oidc.d.ts
 
@@ -81,6 +81,7 @@ declare class OidcVerifier<TClaims extends OidcClaims = OidcClaims, TUserInfo ex
   fetchUserInfo(token: string): Promise<TUserInfo | null>;
   clearCache(): void;
 }
+//# sourceMappingURL=oidc.d.ts.map
 //#endregion
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier };
-//# sourceMappingURL=oidc-DDLIB5gb.d.cts.map
+//# sourceMappingURL=oidc-DTRgBBl6.d.mts.map

package/dist/oidc-DTRgBBl6.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oidc-DTRgBBl6.d.mts","names":[],"sources":["../src/oidc.ts"],"sourcesContent":[],"mappings":";;;;;AAQA;AAWA;AAiCiB,UA5CA,UAAA,SAAmB,SA4CN,CAAA;EAcb,KAAA,CAAA,EAAA,MAAU;EASd,SAAA,CAAA,EAAA,MAAY;EAAA,OAAA,CAAA,EAAA,MAAA;EAAA,MACR,CAAA,EAAA,MAAA;EAAU,GAAG,CAAA,EAAA,MAAA;;;;;AAaP,UAtEN,YAAA,CAsEM;EAAO,GAwBQ,EAAA,MAAA;EAAO,IAAf,CAAA,EAAA,MAAA;EAAO,UASO,CAAA,EAAA,MAAA;EAAO,WAAf,CAAA,EAAA,MAAA;EAAO,WAQE,CAAA,EAAA,MAAA;EAAS,QAAjB,CAAA,EAAA,MAAA;EAAO,kBAAA,CAAA,EAAA,MAAA;;;;;;;;;;;;;;;;;;;;;;;;;UA9E3B,aAAA;;;;;;;;;;;;;UAcA,UAAA;;;;;;;;cASJ,6BACI,aAAa,8BACX,eAAe;;;;;sBAMI;kBAMf,QAAQ;;yBAwBD,QAAQ;+BASF,QAAQ;gCAQP,QAAQ"}

package/dist/oidc-KA30gMlx.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc-KA30gMlx.mjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n  nonce?: string;\n  auth_time?: number;\n  at_hash?: string;\n  c_hash?: string;\n  azp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n  sub: string;\n  name?: string;\n  given_name?: string;\n  family_name?: string;\n  middle_name?: string;\n  nickname?: string;\n  preferred_username?: string;\n  profile?: string;\n  picture?: string;\n  website?: string;\n  email?: string;\n  email_verified?: boolean;\n  gender?: string;\n  birthdate?: string;\n  zoneinfo?: string;\n  locale?: string;\n  phone_number?: string;\n  phone_number_verified?: boolean;\n  address?: {\n    formatted?: string;\n    street_address?: string;\n    locality?: string;\n    region?: string;\n    postal_code?: string;\n    country?: string;\n  };\n  updated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint?: string;\n  jwks_uri: string;\n  scopes_supported?: string[];\n  response_types_supported: string[];\n  claims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n  issuer: string;\n  audience: string | string[];\n  cacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n  TClaims extends OidcClaims = OidcClaims,\n  TUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n  private discovery: OidcDiscovery | null = null;\n  private jwks: jose.JWTVerifyGetKey | null = null;\n  private readonly discoveryUrl: string;\n\n  constructor(private readonly config: OidcConfig) {\n    this.discoveryUrl = config.issuer.endsWith('/')\n      ? `${config.issuer}.well-known/openid-configuration`\n      : `${config.issuer}/.well-known/openid-configuration`;\n  }\n\n  async getDiscovery(): Promise<OidcDiscovery> {\n    if (this.discovery && this.config.cacheDiscovery !== false) {\n      return this.discovery;\n    }\n\n    const response = await fetch(this.discoveryUrl);\n    if (!response.ok) {\n      throw new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n    }\n\n    this.discovery = (await response.json()) as OidcDiscovery;\n    return this.discovery;\n  }\n\n  private async getJwks(): Promise<jose.JWTVerifyGetKey> {\n    if (this.jwks && this.config.cacheDiscovery !== false) {\n      return this.jwks;\n    }\n\n    const disc = await this.getDiscovery();\n    this.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n    return this.jwks;\n  }\n\n  async verify(token: string): Promise<TClaims> {\n    const key = await this.getJwks();\n    const { payload } = await jose.jwtVerify(token, key, {\n      issuer: this.config.issuer,\n      audience: this.config.audience,\n    });\n    return payload as unknown as TClaims;\n  }\n\n  async verifyOrNull(token: string): Promise<TClaims | null> {\n    try {\n      return await this.verify(token);\n    } catch {\n      return null;\n    }\n  }\n\n  async fetchUserInfo(token: string): Promise<TUserInfo | null> {\n    try {\n      const disc = await this.getDiscovery();\n      if (!disc.userinfo_endpoint) {\n        return null;\n      }\n\n      const response = await fetch(disc.userinfo_endpoint, {\n        headers: { Authorization: `Bearer ${token}` },\n      });\n\n      if (!response.ok) {\n        return null;\n      }\n\n      return (await response.json()) as TUserInfo;\n    } catch {\n      return null;\n    }\n  }\n\n  clearCache(): void {\n    this.discovery = null;\n    this.jwks = null;\n  }\n}\n"],"mappings":";;;;;;AA2EA,IAAa,eAAb,MAGE;CACA,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC3B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC1C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACtB;CAED,MAAM,eAAuC;AAC3C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACnD,QAAO,KAAK;EAGd,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACZ,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGzE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACb;CAED,MAAc,UAAyC;AACrD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC9C,QAAO,KAAK;EAGd,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACb;CAED,MAAM,OAAOC,OAAiC;EAC5C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACnD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACvB,EAAC;AACF,SAAO;CACR;CAED,MAAM,aAAaA,OAAwC;AACzD,MAAI;AACF,UAAO,MAAM,KAAK,OAAO,MAAM;EAChC,QAAO;AACN,UAAO;EACR;CACF;CAED,MAAM,cAAcA,OAA0C;AAC5D,MAAI;GACF,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACR,QAAO;GAGT,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACnD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC9C,EAAC;AAEF,QAAK,SAAS,GACZ,QAAO;AAGT,UAAQ,MAAM,SAAS,MAAM;EAC9B,QAAO;AACN,UAAO;EACR;CACF;CAED,aAAmB;AACjB,OAAK,YAAY;AACjB,OAAK,OAAO;CACb;AACF"}
+{"version":3,"file":"oidc-KA30gMlx.mjs","names":["config: OidcConfig","token: string"],"sources":["../src/oidc.ts"],"sourcesContent":["import * as jose from 'jose';\nimport type { JwtClaims, TokenExtractionOptions } from './jwt';\n\nexport type { TokenExtractionOptions };\n\n/**\n * Standard OIDC claims (extends JWT claims)\n */\nexport interface OidcClaims extends JwtClaims {\n\tnonce?: string;\n\tauth_time?: number;\n\tat_hash?: string;\n\tc_hash?: string;\n\tazp?: string;\n}\n\n/**\n * Standard OIDC user info claims\n */\nexport interface OidcUserInfo {\n\tsub: string;\n\tname?: string;\n\tgiven_name?: string;\n\tfamily_name?: string;\n\tmiddle_name?: string;\n\tnickname?: string;\n\tpreferred_username?: string;\n\tprofile?: string;\n\tpicture?: string;\n\twebsite?: string;\n\temail?: string;\n\temail_verified?: boolean;\n\tgender?: string;\n\tbirthdate?: string;\n\tzoneinfo?: string;\n\tlocale?: string;\n\tphone_number?: string;\n\tphone_number_verified?: boolean;\n\taddress?: {\n\t\tformatted?: string;\n\t\tstreet_address?: string;\n\t\tlocality?: string;\n\t\tregion?: string;\n\t\tpostal_code?: string;\n\t\tcountry?: string;\n\t};\n\tupdated_at?: number;\n}\n\n/**\n * OIDC Discovery document\n */\nexport interface OidcDiscovery {\n\tissuer: string;\n\tauthorization_endpoint: string;\n\ttoken_endpoint: string;\n\tuserinfo_endpoint?: string;\n\tjwks_uri: string;\n\tscopes_supported?: string[];\n\tresponse_types_supported: string[];\n\tclaims_supported?: string[];\n}\n\n/**\n * Configuration for OIDC verification\n */\nexport interface OidcConfig {\n\tissuer: string;\n\taudience: string | string[];\n\tcacheDiscovery?: boolean;\n}\n\n/**\n * OIDC Verifier with auto-discovery and caching\n */\nexport class OidcVerifier<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate discovery: OidcDiscovery | null = null;\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly discoveryUrl: string;\n\n\tconstructor(private readonly config: OidcConfig) {\n\t\tthis.discoveryUrl = config.issuer.endsWith('/')\n\t\t\t? `${config.issuer}.well-known/openid-configuration`\n\t\t\t: `${config.issuer}/.well-known/openid-configuration`;\n\t}\n\n\tasync getDiscovery(): Promise<OidcDiscovery> {\n\t\tif (this.discovery && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.discovery;\n\t\t}\n\n\t\tconst response = await fetch(this.discoveryUrl);\n\t\tif (!response.ok) {\n\t\t\tthrow new Error(`Failed to fetch OIDC discovery: ${response.statusText}`);\n\t\t}\n\n\t\tthis.discovery = (await response.json()) as OidcDiscovery;\n\t\treturn this.discovery;\n\t}\n\n\tprivate async getJwks(): Promise<jose.JWTVerifyGetKey> {\n\t\tif (this.jwks && this.config.cacheDiscovery !== false) {\n\t\t\treturn this.jwks;\n\t\t}\n\n\t\tconst disc = await this.getDiscovery();\n\t\tthis.jwks = jose.createRemoteJWKSet(new URL(disc.jwks_uri));\n\t\treturn this.jwks;\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tconst key = await this.getJwks();\n\t\tconst { payload } = await jose.jwtVerify(token, key, {\n\t\t\tissuer: this.config.issuer,\n\t\t\taudience: this.config.audience,\n\t\t});\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tasync fetchUserInfo(token: string): Promise<TUserInfo | null> {\n\t\ttry {\n\t\t\tconst disc = await this.getDiscovery();\n\t\t\tif (!disc.userinfo_endpoint) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\tconst response = await fetch(disc.userinfo_endpoint, {\n\t\t\t\theaders: { Authorization: `Bearer ${token}` },\n\t\t\t});\n\n\t\t\tif (!response.ok) {\n\t\t\t\treturn null;\n\t\t\t}\n\n\t\t\treturn (await response.json()) as TUserInfo;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.discovery = null;\n\t\tthis.jwks = null;\n\t}\n}\n"],"mappings":";;;;;;AA2EA,IAAa,eAAb,MAGE;CACD,AAAQ,YAAkC;CAC1C,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAoB;EAApB;AAC5B,OAAK,eAAe,OAAO,OAAO,SAAS,IAAI,IAC3C,EAAE,OAAO,OAAO,qCAChB,EAAE,OAAO,OAAO;CACpB;CAED,MAAM,eAAuC;AAC5C,MAAI,KAAK,aAAa,KAAK,OAAO,mBAAmB,MACpD,QAAO,KAAK;EAGb,MAAM,WAAW,MAAM,MAAM,KAAK,aAAa;AAC/C,OAAK,SAAS,GACb,OAAM,IAAI,OAAO,kCAAkC,SAAS,WAAW;AAGxE,OAAK,YAAa,MAAM,SAAS,MAAM;AACvC,SAAO,KAAK;CACZ;CAED,MAAc,UAAyC;AACtD,MAAI,KAAK,QAAQ,KAAK,OAAO,mBAAmB,MAC/C,QAAO,KAAK;EAGb,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,OAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,UAAU;AAC3D,SAAO,KAAK;CACZ;CAED,MAAM,OAAOC,OAAiC;EAC7C,MAAM,MAAM,MAAM,KAAK,SAAS;EAChC,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,KAAK;GACpD,QAAQ,KAAK,OAAO;GACpB,UAAU,KAAK,OAAO;EACtB,EAAC;AACF,SAAO;CACP;CAED,MAAM,aAAaA,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,MAAM,cAAcA,OAA0C;AAC7D,MAAI;GACH,MAAM,OAAO,MAAM,KAAK,cAAc;AACtC,QAAK,KAAK,kBACT,QAAO;GAGR,MAAM,WAAW,MAAM,MAAM,KAAK,mBAAmB,EACpD,SAAS,EAAE,gBAAgB,SAAS,MAAM,EAAG,EAC7C,EAAC;AAEF,QAAK,SAAS,GACb,QAAO;AAGR,UAAQ,MAAM,SAAS,MAAM;EAC7B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,YAAY;AACjB,OAAK,OAAO;CACZ;AACD"}

package/dist/oidc.d.cts

@@ -1,3 +1,3 @@
-import { TokenExtractionOptions } from "./jwt-DF9kFbmh.cjs";
-import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-DDLIB5gb.cjs";
+import { TokenExtractionOptions } from "./jwt-3eIuY2dg.cjs";
+import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-ChA17wLB.cjs";
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier, TokenExtractionOptions };

package/dist/oidc.d.mts

@@ -1,3 +1,3 @@
-import { TokenExtractionOptions } from "./jwt-DH8CJ2xC.mjs";
-import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-CKOGLxjV.mjs";
+import { TokenExtractionOptions } from "./jwt-BqLlRkw-.mjs";
+import { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier } from "./oidc-DTRgBBl6.mjs";
 export { OidcClaims, OidcConfig, OidcDiscovery, OidcUserInfo, OidcVerifier, TokenExtractionOptions };

package/dist/server.cjs

@@ -1,5 +1,5 @@
-const require_cacheTokenStorage = require('./cacheTokenStorage-CvptztkW.cjs');
-const require_tokenManager = require('./tokenManager-EPmwgai2.cjs');
+const require_cacheTokenStorage = require('./cacheTokenStorage-CEpMniTi.cjs');
+const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
 
 exports.CacheTokenStorage = require_cacheTokenStorage.CacheTokenStorage;
 exports.TokenManager = require_tokenManager.TokenManager;

package/dist/server.d.cts

@@ -1,3 +1,3 @@
-import { CacheTokenStorage } from "./cacheTokenStorage-yNUpDD8W.cjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-H6-lWEah.cjs";
+import { CacheTokenStorage } from "./cacheTokenStorage-B7sOoysu.cjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CL3yE06D.cjs";
 export { CacheTokenStorage, DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/server.d.mts

@@ -1,3 +1,3 @@
-import { CacheTokenStorage } from "./cacheTokenStorage-BzBRJfd-.mjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager--Q93eNYr.mjs";
+import { CacheTokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
 export { CacheTokenStorage, DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/server.mjs

@@ -1,4 +1,4 @@
-import { CacheTokenStorage } from "./cacheTokenStorage-Ca05vf3T.mjs";
-import { TokenManager } from "./tokenManager-BVXxfHRa.mjs";
+import { CacheTokenStorage } from "./cacheTokenStorage-16NE8Cd9.mjs";
+import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
 
 export { CacheTokenStorage, TokenManager };

package/dist/{tokenManager--Q93eNYr.d.mts → tokenManager-CL3yE06D.d.cts}

@@ -34,6 +34,7 @@ declare class TokenManager {
   isTokenExpired(token: string): boolean;
   getTokenExpiration(token: string): Date | null;
 }
+//# sourceMappingURL=tokenManager.d.ts.map
 //#endregion
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };
-//# sourceMappingURL=tokenManager--Q93eNYr.d.mts.map
+//# sourceMappingURL=tokenManager-CL3yE06D.d.cts.map

package/dist/tokenManager-CL3yE06D.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenManager-CL3yE06D.d.cts","names":[],"sources":["../src/tokenManager.ts"],"sourcesContent":[],"mappings":";;;UAGiB,YAAA;;EAAA,KAAA,CAAA,EAAA,MAAA;EAMA,CAAA,GAAA,EAAA,MAAS,CAAA,EAAA,GAAA;AAK1B;AAAoC,UALnB,SAAA,CAKmB;EAAA,WAGT,EAAA,MAAA;EAAW,YACV,EAAA,MAAA;AAAW;AAGtB,UAPA,mBAAA,CAOqB;EAKzB,iBAAY,EAAA,MAAA;EAAA,kBAAA,EAAA,MAAA;EAAA,oBAMH,CAAA,EAfE,EAAA,CAAG,WAeL;EAAmB,qBAOb,CAAA,EArBH,EAAA,CAAG,WAqBA;;AAeO,UAjClB,YAAA,SAAqB,YAiCH,CAAA;EAAY,GASX,EAAA,MAAA;EAAY,GAoBnB,EAAA,MAAA;;AAgBW,cAzE3B,YAAA,CAyE2B;;;;;uBAnElB;6BAOM,eAAe;oCAeR;qCASC;;8BAoBP;;qCAgBO"}

package/dist/{tokenManager-BVXxfHRa.mjs → tokenManager-Ci2Tgxp8.mjs}

@@ -24,14 +24,16 @@ var TokenManager = class {
 		try {
 			return jwt.verify(token, this.accessTokenSecret);
 		} catch (error) {
-			throw new Error(`Invalid access token: ${error.message}`);
+			const message = error instanceof Error ? error.message : String(error);
+			throw new Error(`Invalid access token: ${message}`);
 		}
 	}
 	verifyRefreshToken(token) {
 		try {
 			return jwt.verify(token, this.refreshTokenSecret);
 		} catch (error) {
-			throw new Error(`Invalid refresh token: ${error.message}`);
+			const message = error instanceof Error ? error.message : String(error);
+			throw new Error(`Invalid refresh token: ${message}`);
 		}
 	}
 	refreshAccessToken(refreshToken) {
@@ -61,4 +63,4 @@ var TokenManager = class {
 
 //#endregion
 export { TokenManager };
-//# sourceMappingURL=tokenManager-BVXxfHRa.mjs.map
+//# sourceMappingURL=tokenManager-Ci2Tgxp8.mjs.map

package/dist/tokenManager-Ci2Tgxp8.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenManager-Ci2Tgxp8.mjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,IAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,IAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,IAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}

package/dist/{tokenManager-EPmwgai2.cjs → tokenManager-CvEMgxOp.cjs}

@@ -25,14 +25,16 @@ var TokenManager = class {
 		try {
 			return jsonwebtoken.default.verify(token, this.accessTokenSecret);
 		} catch (error) {
-			throw new Error(`Invalid access token: ${error.message}`);
+			const message = error instanceof Error ? error.message : String(error);
+			throw new Error(`Invalid access token: ${message}`);
 		}
 	}
 	verifyRefreshToken(token) {
 		try {
 			return jsonwebtoken.default.verify(token, this.refreshTokenSecret);
 		} catch (error) {
-			throw new Error(`Invalid refresh token: ${error.message}`);
+			const message = error instanceof Error ? error.message : String(error);
+			throw new Error(`Invalid refresh token: ${message}`);
 		}
 	}
 	refreshAccessToken(refreshToken) {
@@ -67,4 +69,4 @@ Object.defineProperty(exports, 'TokenManager', {
     return TokenManager;
   }
 });
-//# sourceMappingURL=tokenManager-EPmwgai2.cjs.map
+//# sourceMappingURL=tokenManager-CvEMgxOp.cjs.map

package/dist/tokenManager-CvEMgxOp.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenManager-CvEMgxOp.cjs","names":["options: TokenManagerOptions","payload: TokenPayload","token: string","refreshToken: string"],"sources":["../src/tokenManager.ts"],"sourcesContent":["import jwt from 'jsonwebtoken';\nimport type ms from 'ms';\n\nexport interface TokenPayload {\n\tuserId: string;\n\temail?: string;\n\t[key: string]: any;\n}\n\nexport interface TokenPair {\n\taccessToken: string;\n\trefreshToken: string;\n}\n\nexport interface TokenManagerOptions {\n\taccessTokenSecret: string;\n\trefreshTokenSecret: string;\n\taccessTokenExpiresIn?: ms.StringValue;\n\trefreshTokenExpiresIn?: ms.StringValue;\n}\n\nexport interface DecodedToken extends TokenPayload {\n\tiat: number;\n\texp: number;\n}\n\nexport class TokenManager {\n\tprivate accessTokenSecret: string;\n\tprivate refreshTokenSecret: string;\n\tprivate accessTokenExpiresIn: ms.StringValue;\n\tprivate refreshTokenExpiresIn: ms.StringValue;\n\n\tconstructor(options: TokenManagerOptions) {\n\t\tthis.accessTokenSecret = options.accessTokenSecret;\n\t\tthis.refreshTokenSecret = options.refreshTokenSecret;\n\t\tthis.accessTokenExpiresIn = options.accessTokenExpiresIn || '15m';\n\t\tthis.refreshTokenExpiresIn = options.refreshTokenExpiresIn || '7d';\n\t}\n\n\tgenerateTokenPair(payload: TokenPayload): TokenPair {\n\t\tconst accessToken = jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\n\t\tconst refreshToken = jwt.sign(payload, this.refreshTokenSecret, {\n\t\t\texpiresIn: this.refreshTokenExpiresIn,\n\t\t});\n\n\t\treturn {\n\t\t\taccessToken,\n\t\t\trefreshToken,\n\t\t};\n\t}\n\n\tverifyAccessToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.accessTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid access token: ${message}`);\n\t\t}\n\t}\n\n\tverifyRefreshToken(token: string): DecodedToken {\n\t\ttry {\n\t\t\treturn jwt.verify(token, this.refreshTokenSecret) as DecodedToken;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tthrow new Error(`Invalid refresh token: ${message}`);\n\t\t}\n\t}\n\n\trefreshAccessToken(refreshToken: string): string {\n\t\tconst decoded = this.verifyRefreshToken(refreshToken);\n\n\t\t// Remove JWT specific fields before creating new token\n\t\tconst { iat, exp, ...payload } = decoded;\n\n\t\treturn jwt.sign(payload, this.accessTokenSecret, {\n\t\t\texpiresIn: this.accessTokenExpiresIn,\n\t\t});\n\t}\n\n\tdecodeToken(token: string): DecodedToken | null {\n\t\ttry {\n\t\t\treturn jwt.decode(token) as DecodedToken;\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tisTokenExpired(token: string): boolean {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return true;\n\n\t\tconst now = Math.floor(Date.now() / 1000);\n\t\treturn decoded.exp < now;\n\t}\n\n\tgetTokenExpiration(token: string): Date | null {\n\t\tconst decoded = this.decodeToken(token);\n\t\tif (!decoded) return null;\n\n\t\treturn new Date(decoded.exp * 1000);\n\t}\n}\n"],"mappings":";;;;AA0BA,IAAa,eAAb,MAA0B;CACzB,AAAQ;CACR,AAAQ;CACR,AAAQ;CACR,AAAQ;CAER,YAAYA,SAA8B;AACzC,OAAK,oBAAoB,QAAQ;AACjC,OAAK,qBAAqB,QAAQ;AAClC,OAAK,uBAAuB,QAAQ,wBAAwB;AAC5D,OAAK,wBAAwB,QAAQ,yBAAyB;CAC9D;CAED,kBAAkBC,SAAkC;EACnD,MAAM,cAAc,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAC7D,WAAW,KAAK,qBAChB,EAAC;EAEF,MAAM,eAAe,qBAAI,KAAK,SAAS,KAAK,oBAAoB,EAC/D,WAAW,KAAK,sBAChB,EAAC;AAEF,SAAO;GACN;GACA;EACA;CACD;CAED,kBAAkBC,OAA6B;AAC9C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,kBAAkB;EAChD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,wBAAwB,QAAQ;EACjD;CACD;CAED,mBAAmBA,OAA6B;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,OAAO,KAAK,mBAAmB;EACjD,SAAQ,OAAO;GACf,MAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;AACtE,SAAM,IAAI,OAAO,yBAAyB,QAAQ;EAClD;CACD;CAED,mBAAmBC,cAA8B;EAChD,MAAM,UAAU,KAAK,mBAAmB,aAAa;EAGrD,MAAM,EAAE,KAAK,IAAK,GAAG,SAAS,GAAG;AAEjC,SAAO,qBAAI,KAAK,SAAS,KAAK,mBAAmB,EAChD,WAAW,KAAK,qBAChB,EAAC;CACF;CAED,YAAYD,OAAoC;AAC/C,MAAI;AACH,UAAO,qBAAI,OAAO,MAAM;EACxB,QAAO;AACP,UAAO;EACP;CACD;CAED,eAAeA,OAAwB;EACtC,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;EAErB,MAAM,MAAM,KAAK,MAAM,KAAK,KAAK,GAAG,IAAK;AACzC,SAAO,QAAQ,MAAM;CACrB;CAED,mBAAmBA,OAA4B;EAC9C,MAAM,UAAU,KAAK,YAAY,MAAM;AACvC,OAAK,QAAS,QAAO;AAErB,SAAO,IAAI,KAAK,QAAQ,MAAM;CAC9B;AACD"}

package/dist/{tokenManager-H6-lWEah.d.cts → tokenManager-RrwjL0y-.d.mts}

@@ -34,6 +34,7 @@ declare class TokenManager {
   isTokenExpired(token: string): boolean;
   getTokenExpiration(token: string): Date | null;
 }
+//# sourceMappingURL=tokenManager.d.ts.map
 //#endregion
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };
-//# sourceMappingURL=tokenManager-H6-lWEah.d.cts.map
+//# sourceMappingURL=tokenManager-RrwjL0y-.d.mts.map

package/dist/tokenManager-RrwjL0y-.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokenManager-RrwjL0y-.d.mts","names":[],"sources":["../src/tokenManager.ts"],"sourcesContent":[],"mappings":";;;UAGiB,YAAA;;EAAA,KAAA,CAAA,EAAA,MAAA;EAMA,CAAA,GAAA,EAAA,MAAS,CAAA,EAAA,GAAA;AAK1B;AAAoC,UALnB,SAAA,CAKmB;EAAA,WAGT,EAAA,MAAA;EAAW,YACV,EAAA,MAAA;AAAW;AAGtB,UAPA,mBAAA,CAOqB;EAKzB,iBAAY,EAAA,MAAA;EAAA,kBAAA,EAAA,MAAA;EAAA,oBAMH,CAAA,EAfE,EAAA,CAAG,WAeL;EAAmB,qBAOb,CAAA,EArBH,EAAA,CAAG,WAqBA;;AAeO,UAjClB,YAAA,SAAqB,YAiCH,CAAA;EAAY,GASX,EAAA,MAAA;EAAY,GAoBnB,EAAA,MAAA;;AAgBW,cAzE3B,YAAA,CAyE2B;;;;;uBAnElB;6BAOM,eAAe;oCAeR;qCASC;;8BAoBP;;qCAgBO"}

package/dist/tokenManager.cjs

@@ -1,3 +1,3 @@
-const require_tokenManager = require('./tokenManager-EPmwgai2.cjs');
+const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
 
 exports.TokenManager = require_tokenManager.TokenManager;

package/dist/tokenManager.d.cts

@@ -1,2 +1,2 @@
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-H6-lWEah.cjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CL3yE06D.cjs";
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/tokenManager.d.mts

@@ -1,2 +1,2 @@
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager--Q93eNYr.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
 export { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload };

package/dist/tokenManager.mjs

@@ -1,3 +1,3 @@
-import { TokenManager } from "./tokenManager-BVXxfHRa.mjs";
+import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
 
 export { TokenManager };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geekmidas/auth",
-  "version": "0.1.0",
+  "version": "1.0.0",
   "description": "JWT and OIDC authentication with token verification, Hono middleware, and Lambda authorizers",
   "type": "module",
   "exports": {
@@ -66,12 +66,12 @@
   },
   "devDependencies": {
     "@types/jsonwebtoken": "^9.0.5",
-    "@geekmidas/cache": "^0.1.0"
+    "@geekmidas/cache": "^1.0.0"
   },
   "peerDependencies": {
     "@types/aws-lambda": ">=8.10.92",
     "hono": ">=4.0.0",
-    "@geekmidas/cache": "^0.1.0"
+    "@geekmidas/cache": "^1.0.0"
   },
   "peerDependenciesMeta": {
     "@geekmidas/cache": {