@geekmidas/auth 10.0.0-alpha.99 → 10.0.0

package/dist/hono/oidc.d.mts

@@ -1,8 +1,9 @@
-import { o as TokenExtractionOptions } from "../jwt-CoKrpeMB.mjs";
-import { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier } from "../oidc.mjs";
+import { TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
+import { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier } from "../oidc-DTRgBBl6.mjs";
 import { Context, MiddlewareHandler } from "hono";
+
 //#region src/hono/oidc.d.ts
-export interface OidcMiddlewareOptions<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
+interface OidcMiddlewareOptions<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
   config: OidcConfig;
   extraction?: TokenExtractionOptions;
   contextKey?: string;
@@ -31,7 +32,7 @@ export interface OidcMiddlewareOptions<TClaims extends OidcClaims = OidcClaims,
  * });
  * ```
  */
-export declare class OidcMiddleware<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
+declare class OidcMiddleware<TClaims extends OidcClaims = OidcClaims, TUserInfo extends OidcUserInfo = OidcUserInfo> {
   private readonly verifier;
   private readonly extraction;
   private readonly contextKey;
@@ -42,6 +43,7 @@ export declare class OidcMiddleware<TClaims extends OidcClaims = OidcClaims, TUs
   handler(): MiddlewareHandler;
   optional(): MiddlewareHandler;
 }
+//# sourceMappingURL=oidc.d.ts.map
 //#endregion
-export type { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier, TokenExtractionOptions };
+export { OidcClaims, OidcConfig, OidcMiddleware, OidcMiddlewareOptions, OidcUserInfo, OidcVerifier, TokenExtractionOptions };
 //# sourceMappingURL=oidc.d.mts.map

package/dist/hono/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/hono/oidc.ts"],"mappings":";;;;iBA8CiB,sBAChB,gBAAgB,aAAa,YAC7B,kBAAkB,eAAe;EAEjC,QAAQ;EACR,aAAa;EACb;EACA;EACA,WAAW,GAAG,SAAS,OAAO,UAAU,WAAW,QAAQ;EAC3D,mBAAmB,QAAQ,YAAY,WAAW,cAAc;;;;;;;;;;;;;;;;;;;;;;;qBAwBpD,eACZ,gBAAgB,aAAa,YAC7B,kBAAkB,eAAe;mBAEhB;mBACA;mBACA;mBACA;mBACA;mBAIA;EAKjB,YAAY,SAAS,sBAAsB,SAAS;EASpD,WAAW;EAqCX,YAAY"}
+{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAgDiB,sCACA,aAAa,8BACX,eAAe;UAEzB;EAJQ,UAAA,CAAA,EAKH,sBALwB;EAAA,UAAA,CAAA,EAAA,MAAA;EAAA,aACrB,CAAA,EAAA,OAAA;EAAU,OAAG,CAAA,EAAA,CAAA,CAAA,EAOf,OAPe,EAAA,KAAA,EAOC,KAPD,EAAA,GAOW,QAPX,GAOsB,OAPtB,CAO8B,QAP9B,CAAA;EAAU,eACrB,CAAA,EAAA,CAAA,MAAA,EAOS,UAPT,EAAA,QAAA,CAAA,EAOgC,SAPhC,EAAA,GAO8C,OAP9C;;;;;;;;;;;;AAOqD;AAwBxE;;;;;;;;;;AA+Da,cA/DA,cA+DA,CAAA,gBA9DI,UA8DJ,GA9DiB,UA8DjB,EAAA,kBA7DM,YA6DN,GA7DqB,YA6DrB,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;;uBA9CR,sBAAsB,SAAS;aASzC;cAqCC"}

package/dist/hono/oidc.mjs

@@ -1,5 +1,5 @@
-import { readCookie } from "../cookies.mjs";
-import { OidcVerifier } from "../oidc.mjs";
+import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+
 //#region src/hono/oidc.ts
 function extractToken(c, options = {}) {
 	const { headerName = "authorization", cookieName, tokenPrefix = "Bearer " } = options;
@@ -9,8 +9,11 @@ function extractToken(c, options = {}) {
 		return headerValue;
 	}
 	if (cookieName) {
-		const cookie = readCookie(c.req.header("cookie"), cookieName);
-		if (cookie) return cookie;
+		const cookieHeader = c.req.header("cookie");
+		if (cookieHeader) {
+			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+			if (match?.[1]) return match[1];
+		}
 	}
 	return null;
 }
@@ -54,7 +57,7 @@ var OidcMiddleware = class {
 		return async (c, next) => {
 			const token = extractToken(c, this.extraction);
 			if (!token) {
-				if (this.onError) return this.onError(c, /* @__PURE__ */ new Error("No token provided"));
+				if (this.onError) return this.onError(c, new Error("No token provided"));
 				return c.json({ error: "Unauthorized" }, 401);
 			}
 			try {
@@ -94,7 +97,7 @@ var OidcMiddleware = class {
 		};
 	}
 };
-//#endregion
-export { OidcMiddleware };
 
+//#endregion
+export { OidcMiddleware, OidcVerifier };
 //# sourceMappingURL=oidc.mjs.map

package/dist/hono/oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.mjs","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type {\n\tOidcVerifier,\n\tOidcClaims,\n\tOidcConfig,\n\tOidcUserInfo,\n\tTokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookie = readCookie(c.req.header('cookie'), cookieName);\n\t\tif (cookie) {\n\t\t\treturn cookie;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAkBA,SAAS,aACR,GACA,UAAkC,CAAC,GACnB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,UAAU;CAC3C,IAAI,aAAa;EAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;EAE5C,OAAO;CACR;CAEA,IAAI,YAAY;EACf,MAAM,SAAS,WAAW,EAAE,IAAI,OAAO,QAAQ,GAAG,UAAU;EAC5D,IAAI,QACH,OAAO;CAET;CAEA,OAAO;AACR;;;;;;;;;;;;;;;;;;;;;;AAmCA,IAAa,iBAAb,MAGE;CACD;CACA;CACA;CACA;CACA;CAIA;CAKA,YAAY,SAAoD;EAC/D,KAAK,WAAW,IAAI,aAAa,QAAQ,MAAM;EAC/C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,aAAa,QAAQ,cAAc;EACxC,KAAK,gBAAgB,QAAQ,iBAAiB;EAC9C,KAAK,UAAU,QAAQ;EACvB,KAAK,kBAAkB,QAAQ;CAChC;CAEA,UAA6B;EAC5B,OAAO,OAAO,GAAY,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,UAAU;GAE7C,IAAI,CAAC,OAAO;IACX,IAAI,KAAK,SACR,OAAO,KAAK,QAAQ,mBAAG,IAAI,MAAM,mBAAmB,CAAC;IAEtD,OAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;GAC7C;GAEA,IAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,KAAK;IAEhD,IAAI;IACJ,IAAI,KAAK,eAAe;KACvB,WAAY,MAAM,KAAK,SAAS,cAAc,KAAK,KAAM,KAAA;KACzD,EAAE,IAAI,gBAAgB,QAAQ;IAC/B;IAEA,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,QAAQ,IACtC;IAEH,EAAE,IAAI,KAAK,YAAY,MAAM;IAC7B,EAAE,IAAI,aAAa,KAAK;IAExB,MAAM,KAAK;GACZ,SAAS,OAAO;IACf,IAAI,KAAK,SACR,OAAO,KAAK,QAAQ,GAAG,KAAc;IAEtC,OAAO,EAAE,KAAK,EAAE,OAAO,gBAAgB,GAAG,GAAG;GAC9C;EACD;CACD;CAEA,WAA8B;EAC7B,OAAO,OAAO,GAAY,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,UAAU;GAE7C,IAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,KAAK;IACtD,IAAI,SAAS;KACZ,IAAI;KACJ,IAAI,KAAK,eAAe;MACvB,WAAY,MAAM,KAAK,SAAS,cAAc,KAAK,KAAM,KAAA;MACzD,EAAE,IAAI,gBAAgB,QAAQ;KAC/B;KAEA,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,QAAQ,IACtC;KAEH,EAAE,IAAI,KAAK,YAAY,MAAM;KAC7B,EAAE,IAAI,aAAa,KAAK;IACzB;GACD;GAEA,MAAM,KAAK;EACZ;CACD;AACD"}
+{"version":3,"file":"oidc.mjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\ttype TokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookieHeader = c.req.header('cookie');\n\t\tif (cookieHeader) {\n\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\tif (match?.[1]) {\n\t\t\t\treturn match[1];\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GACjB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,QAAQ,GACX,QAAO,MAAM;EAEd;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC/D,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;CAED,UAA6B;AAC5B,SAAO,OAAOF,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACvB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAC/B;IAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;CAED,WAA8B;AAC7B,SAAO,OAAOJ,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACZ,IAAIC;AACJ,SAAI,KAAK,eAAe;AACvB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAC/B;KAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IACzB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}

package/dist/index.cjs

@@ -1,9 +1,9 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cacheTokenStorage = require("./cacheTokenStorage.cjs");
-const require_client = require("./client.cjs");
-const require_tokenManager = require("./tokenManager.cjs");
+const require_cacheTokenStorage = require('./cacheTokenStorage-CEpMniTi.cjs');
+const require_client = require('./client-BPl_mMvb.cjs');
+const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
+
 exports.CacheTokenStorage = require_cacheTokenStorage.CacheTokenStorage;
 exports.LocalStorageTokenStorage = require_client.LocalStorageTokenStorage;
 exports.MemoryTokenStorage = require_client.MemoryTokenStorage;
 exports.TokenClient = require_client.TokenClient;
-exports.TokenManager = require_tokenManager.TokenManager;
+exports.TokenManager = require_tokenManager.TokenManager;

package/dist/index.d.cts

@@ -1,3 +1,3 @@
-import { a as TokenClientOptions, i as TokenClient, n as LocalStorageTokenStorage, o as TokenStorage, r as MemoryTokenStorage, t as CacheTokenStorage } from "./cacheTokenStorage-B3u8Sf-6.cjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager.cjs";
+import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-B7sOoysu.cjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CL3yE06D.cjs";
 export { CacheTokenStorage, DecodedToken, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenManager, TokenManagerOptions, TokenPair, TokenPayload, TokenStorage };

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-import { a as TokenClientOptions, i as TokenClient, n as LocalStorageTokenStorage, o as TokenStorage, r as MemoryTokenStorage, t as CacheTokenStorage } from "./cacheTokenStorage-B3u8Sf-6.mjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager.mjs";
+import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
 export { CacheTokenStorage, DecodedToken, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenManager, TokenManagerOptions, TokenPair, TokenPayload, TokenStorage };

package/dist/index.mjs

@@ -1,4 +1,5 @@
-import { CacheTokenStorage } from "./cacheTokenStorage.mjs";
-import { LocalStorageTokenStorage, MemoryTokenStorage, TokenClient } from "./client.mjs";
-import { TokenManager } from "./tokenManager.mjs";
-export { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenManager };
+import { CacheTokenStorage } from "./cacheTokenStorage-16NE8Cd9.mjs";
+import { LocalStorageTokenStorage, MemoryTokenStorage, TokenClient } from "./client-eidYNJSH.mjs";
+import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
+
+export { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenManager };

package/dist/{jwt-CoKrpeMB.d.mts → jwt-3eIuY2dg.d.cts}

@@ -56,6 +56,7 @@ declare class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
  * WARNING: This does NOT verify the token signature!
  */
 declare function decodeJwt<TClaims extends JwtClaims = JwtClaims>(token: string): TClaims;
+//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export { JwtVerifier as a, isJwksConfig as c, JwtSecretConfig as i, JwtConfig as n, TokenExtractionOptions as o, JwtJwksConfig as r, decodeJwt as s, JwtClaims as t };
-//# sourceMappingURL=jwt-CoKrpeMB.d.mts.map
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-3eIuY2dg.d.cts.map

package/dist/jwt-3eIuY2dg.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-3eIuY2dg.d.cts","names":[],"sources":["../src/jwt.ts"],"sourcesContent":[],"mappings":";;AAKA;AAaA;AAUiB,UAvBA,SAAA,CAuBa;EAOlB,GAAA,CAAA,EAAA,MAAS;EAAA,GAAA,CAAA,EAAA,MAAA;EAAA,GAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAe,GAAG,CAAA,EAAA,MAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EAKtC,GAAA,CAAA,EAAA,MAAA;EAMD,GAAA,CAAA,EAAA,MAAA;;;;AAAwD;AAO3D,UAnCI,eAAA,CAmCO;EAAA,MAAA,EAAA,MAAA;EAAA,MAAiB,CAAA,EAAA,MAAA;EAAS,QAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAIxB,CAAA,EAAA,MAAA,EAAA;;;;;AA2BK,UAxD1B,aAAA,CAwD0B;EAiB3B,OAAA,EAAA,MAAS;EAAA,MAAA,CAAA,EAAA,MAAA;EAAA,QAAiB,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAAG,CAAA,EAAA,MAAA,EAAA;;AAE5C,KApEE,SAAA,GAAY,eAoEd,GApEgC,aAoEhC;;;;UA/DO,sBAAA;;;;;iBAMD,YAAA,SAAqB,sBAAsB;;;;cAO9C,4BAA4B,YAAY;;;;sBAIf;yBASR,QAAQ;+BAkBF,QAAQ;;;;;;;iBAiB5B,0BAA0B,YAAY,2BAEnD"}

package/dist/jwt-Bo_eACEi.cjs

@@ -0,0 +1,70 @@
+const require_chunk = require('./chunk-CUT6urMc.cjs');
+const jose = require_chunk.__toESM(require("jose"));
+
+//#region src/jwt.ts
+function isJwksConfig(config) {
+	return "jwksUri" in config;
+}
+/**
+* JWT Verifier with JWKS caching
+*/
+var JwtVerifier = class {
+	jwks = null;
+	verifyOptions;
+	constructor(config) {
+		this.config = config;
+		this.verifyOptions = {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
+		};
+	}
+	async verify(token) {
+		if (isJwksConfig(this.config)) {
+			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+			const { payload: payload$1 } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
+			return payload$1;
+		}
+		const secret = new TextEncoder().encode(this.config.secret);
+		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.jwks = null;
+	}
+};
+/**
+* Decode a JWT without verification
+* WARNING: This does NOT verify the token signature!
+*/
+function decodeJwt(token) {
+	return jose.decodeJwt(token);
+}
+
+//#endregion
+Object.defineProperty(exports, 'JwtVerifier', {
+  enumerable: true,
+  get: function () {
+    return JwtVerifier;
+  }
+});
+Object.defineProperty(exports, 'decodeJwt', {
+  enumerable: true,
+  get: function () {
+    return decodeJwt;
+  }
+});
+Object.defineProperty(exports, 'isJwksConfig', {
+  enumerable: true,
+  get: function () {
+    return isJwksConfig;
+  }
+});
+//# sourceMappingURL=jwt-Bo_eACEi.cjs.map

package/dist/jwt-Bo_eACEi.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-Bo_eACEi.cjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}

package/dist/{jwt-CoKrpeMB.d.cts → jwt-BqLlRkw-.d.mts}

@@ -56,6 +56,7 @@ declare class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {
  * WARNING: This does NOT verify the token signature!
  */
 declare function decodeJwt<TClaims extends JwtClaims = JwtClaims>(token: string): TClaims;
+//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export { JwtVerifier as a, isJwksConfig as c, JwtSecretConfig as i, JwtConfig as n, TokenExtractionOptions as o, JwtJwksConfig as r, decodeJwt as s, JwtClaims as t };
-//# sourceMappingURL=jwt-CoKrpeMB.d.cts.map
+export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-BqLlRkw-.d.mts.map

package/dist/jwt-BqLlRkw-.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-BqLlRkw-.d.mts","names":[],"sources":["../src/jwt.ts"],"sourcesContent":[],"mappings":";;AAKA;AAaA;AAUiB,UAvBA,SAAA,CAuBa;EAOlB,GAAA,CAAA,EAAA,MAAS;EAAA,GAAA,CAAA,EAAA,MAAA;EAAA,GAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAe,GAAG,CAAA,EAAA,MAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EAKtC,GAAA,CAAA,EAAA,MAAA;EAMD,GAAA,CAAA,EAAA,MAAA;;;;AAAwD;AAO3D,UAnCI,eAAA,CAmCO;EAAA,MAAA,EAAA,MAAA;EAAA,MAAiB,CAAA,EAAA,MAAA;EAAS,QAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAIxB,CAAA,EAAA,MAAA,EAAA;;;;;AA2BK,UAxD1B,aAAA,CAwD0B;EAiB3B,OAAA,EAAA,MAAS;EAAA,MAAA,CAAA,EAAA,MAAA;EAAA,QAAiB,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAAG,CAAA,EAAA,MAAA,EAAA;;AAE5C,KApEE,SAAA,GAAY,eAoEd,GApEgC,aAoEhC;;;;UA/DO,sBAAA;;;;;iBAMD,YAAA,SAAqB,sBAAsB;;;;cAO9C,4BAA4B,YAAY;;;;sBAIf;yBASR,QAAQ;+BAkBF,QAAQ;;;;;;;iBAiB5B,0BAA0B,YAAY,2BAEnD"}

package/dist/jwt-D88cPJyT.mjs

@@ -0,0 +1,52 @@
+import * as jose from "jose";
+
+//#region src/jwt.ts
+function isJwksConfig(config) {
+	return "jwksUri" in config;
+}
+/**
+* JWT Verifier with JWKS caching
+*/
+var JwtVerifier = class {
+	jwks = null;
+	verifyOptions;
+	constructor(config) {
+		this.config = config;
+		this.verifyOptions = {
+			issuer: config.issuer,
+			audience: config.audience,
+			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
+		};
+	}
+	async verify(token) {
+		if (isJwksConfig(this.config)) {
+			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
+			const { payload: payload$1 } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
+			return payload$1;
+		}
+		const secret = new TextEncoder().encode(this.config.secret);
+		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
+		return payload;
+	}
+	async verifyOrNull(token) {
+		try {
+			return await this.verify(token);
+		} catch {
+			return null;
+		}
+	}
+	clearCache() {
+		this.jwks = null;
+	}
+};
+/**
+* Decode a JWT without verification
+* WARNING: This does NOT verify the token signature!
+*/
+function decodeJwt(token) {
+	return jose.decodeJwt(token);
+}
+
+//#endregion
+export { JwtVerifier, decodeJwt, isJwksConfig };
+//# sourceMappingURL=jwt-D88cPJyT.mjs.map

package/dist/jwt-D88cPJyT.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-D88cPJyT.mjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}

package/dist/jwt.cjs

@@ -1,57 +1,5 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_rolldown_runtime = require("./rolldown-runtime-VH7oDXx4.cjs");
-let jose = require("jose");
-jose = require_rolldown_runtime.__toESM(jose, 1);
-//#region src/jwt.ts
-function isJwksConfig(config) {
-	return "jwksUri" in config;
-}
-/**
-* JWT Verifier with JWKS caching
-*/
-var JwtVerifier = class {
-	config;
-	jwks = null;
-	verifyOptions;
-	constructor(config) {
-		this.config = config;
-		this.verifyOptions = {
-			issuer: config.issuer,
-			audience: config.audience,
-			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
-		};
-	}
-	async verify(token) {
-		if (isJwksConfig(this.config)) {
-			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
-			const { payload } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
-			return payload;
-		}
-		const secret = new TextEncoder().encode(this.config.secret);
-		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
-		return payload;
-	}
-	async verifyOrNull(token) {
-		try {
-			return await this.verify(token);
-		} catch {
-			return null;
-		}
-	}
-	clearCache() {
-		this.jwks = null;
-	}
-};
-/**
-* Decode a JWT without verification
-* WARNING: This does NOT verify the token signature!
-*/
-function decodeJwt(token) {
-	return jose.decodeJwt(token);
-}
-//#endregion
-exports.JwtVerifier = JwtVerifier;
-exports.decodeJwt = decodeJwt;
-exports.isJwksConfig = isJwksConfig;
+const require_jwt = require('./jwt-Bo_eACEi.cjs');
 
-//# sourceMappingURL=jwt.cjs.map
+exports.JwtVerifier = require_jwt.JwtVerifier;
+exports.decodeJwt = require_jwt.decodeJwt;
+exports.isJwksConfig = require_jwt.isJwksConfig;

package/dist/jwt.d.cts

@@ -1,2 +1,2 @@
-import { a as JwtVerifier, c as isJwksConfig, i as JwtSecretConfig, n as JwtConfig, o as TokenExtractionOptions, r as JwtJwksConfig, s as decodeJwt, t as JwtClaims } from "./jwt-CoKrpeMB.cjs";
+import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-3eIuY2dg.cjs";
 export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };

package/dist/jwt.d.mts

@@ -1,2 +1,2 @@
-import { a as JwtVerifier, c as isJwksConfig, i as JwtSecretConfig, n as JwtConfig, o as TokenExtractionOptions, r as JwtJwksConfig, s as decodeJwt, t as JwtClaims } from "./jwt-CoKrpeMB.mjs";
+import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-BqLlRkw-.mjs";
 export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };

package/dist/jwt.mjs

@@ -1,52 +1,3 @@
-import * as jose from "jose";
-//#region src/jwt.ts
-function isJwksConfig(config) {
-	return "jwksUri" in config;
-}
-/**
-* JWT Verifier with JWKS caching
-*/
-var JwtVerifier = class {
-	config;
-	jwks = null;
-	verifyOptions;
-	constructor(config) {
-		this.config = config;
-		this.verifyOptions = {
-			issuer: config.issuer,
-			audience: config.audience,
-			algorithms: config.algorithms ?? (isJwksConfig(config) ? void 0 : ["HS256"])
-		};
-	}
-	async verify(token) {
-		if (isJwksConfig(this.config)) {
-			if (!this.jwks) this.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));
-			const { payload } = await jose.jwtVerify(token, this.jwks, this.verifyOptions);
-			return payload;
-		}
-		const secret = new TextEncoder().encode(this.config.secret);
-		const { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);
-		return payload;
-	}
-	async verifyOrNull(token) {
-		try {
-			return await this.verify(token);
-		} catch {
-			return null;
-		}
-	}
-	clearCache() {
-		this.jwks = null;
-	}
-};
-/**
-* Decode a JWT without verification
-* WARNING: This does NOT verify the token signature!
-*/
-function decodeJwt(token) {
-	return jose.decodeJwt(token);
-}
-//#endregion
-export { JwtVerifier, decodeJwt, isJwksConfig };
+import { JwtVerifier, decodeJwt, isJwksConfig } from "./jwt-D88cPJyT.mjs";
 
-//# sourceMappingURL=jwt.mjs.map
+export { JwtVerifier, decodeJwt, isJwksConfig };

package/dist/lambda/jwt.cjs

@@ -1,18 +1,18 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_cookies = require("../cookies.cjs");
-const require_jwt = require("../jwt.cjs");
+const require_jwt = require('../jwt-Bo_eACEi.cjs');
+
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
+	const policyDocument = {
+		Version: "2012-10-17",
+		Statement: [{
+			Action: "execute-api:Invoke",
+			Effect: effect,
+			Resource: resource
+		}]
+	};
 	return {
 		principalId,
-		policyDocument: {
-			Version: "2012-10-17",
-			Statement: [{
-				Action: "execute-api:Invoke",
-				Effect: effect,
-				Resource: resource
-			}]
-		},
+		policyDocument,
 		context
 	};
 }
@@ -66,7 +66,8 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -92,8 +93,9 @@ var JwtAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookie = require_cookies.readCookie(headers.cookie ?? headers.Cookie, cookieName);
-				if (cookie) return cookie;
+				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
+				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
+				if (match?.[1]) return match[1];
 			}
 			return null;
 		};
@@ -105,7 +107,8 @@ var JwtAuthorizer = class {
 			try {
 				const claims = await this.verifier.verify(token);
 				if (this.authorize) {
-					if (!await this.authorize(claims)) return generatePolicy("unauthorized", "Deny", resource);
+					const isAuthorized = await this.authorize(claims);
+					if (!isAuthorized) return generatePolicy("unauthorized", "Deny", resource);
 				}
 				const principalId = this.getPrincipalId(claims);
 				const context = this.getContext?.(claims);
@@ -116,7 +119,8 @@ var JwtAuthorizer = class {
 		};
 	}
 };
+
 //#endregion
 exports.JwtAuthorizer = JwtAuthorizer;
-
+exports.JwtVerifier = require_jwt.JwtVerifier;
 //# sourceMappingURL=jwt.cjs.map

package/dist/lambda/jwt.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.cjs","names":["JwtVerifier","readCookie"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookie = readCookie(headers.cookie ?? headers.Cookie, cookieName);\n\t\t\t\tif (cookie) {\n\t\t\t\t\treturn cookie;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAiBA,SAAS,eACR,aACA,QACA,UACA,SAC6B;CAY7B,OAAO;EACN;EACA,gBAAA;GAZA,SAAS;GACT,WAAW,CACV;IACC,QAAQ;IACR,QAAQ;IACR,UAAU;GACX,CACD;EAKa;EACb;CACD;AACD;AAEA,SAAS,oBAAoB,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,GAAG;CACjC,OAAO,GAAG,MAAM,GAAG,GAAG,MAAM,GAAG;AAChC;;;;;;;;;;;;;;;;;;;;;AAiCA,IAAa,gBAAb,MAAkE;CACjE;CACA;CACA;CACA;CACA;CAGA;CAEA,YAAY,SAAwC;EACnD,KAAK,WAAW,IAAIA,YAAAA,YAAY,QAAQ,MAAM;EAC9C,KAAK,aAAa,QAAQ,cAAc,CAAC;EACzC,KAAK,mBAAmB,QAAQ,oBAAoB;EACpD,KAAK,iBAAiB,QAAQ,oBAAoB,MAAM,EAAE,OAAO;EACjE,KAAK,aAAa,QAAQ;EAC1B,KAAK,YAAY,QAAQ;CAC1B;;;;CAKA,eAAe;EACd,OAAO,OACN,OACA,aACyC;GACzC,MAAM,EAAE,oBAAoB,cAAc;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,SAAS,IAClD,mBAAmB,MAAM,CAAC,IAC1B;GAEH,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;;;;CAKA,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,cACX,KAAK;EAET,MAAM,gBACL,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAC;GAClC,MAAM,YAAY,OAAO,KAAK,OAAO,CAAC,CAAC,MACrC,MAAM,EAAE,YAAY,MAAM,WAAW,YAAY,CACnD;GACA,IAAI,WAAW;IACd,MAAM,cAAc,QAAQ;IAC5B,IAAI,aAAa;KAChB,IAAI,eAAe,YAAY,WAAW,WAAW,GACpD,OAAO,YAAY,MAAM,YAAY,MAAM;KAE5C,OAAO;IACR;GACD;GAEA,IAAI,YAAY;IACf,MAAM,SAASC,gBAAAA,WAAW,QAAQ,UAAU,QAAQ,QAAQ,UAAU;IACtE,IAAI,QACH,OAAO;GAET;GAEA,OAAO;EACR;EAEA,OAAO,OACN,OACA,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,SAAS,IAC7B;GAEH,MAAM,QAAQ,aAAa,KAAK;GAEhC,IAAI,CAAC,OACJ,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GAGvD,IAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,KAAK;IAE/C,IAAI,KAAK,WAEJ;SAAA,CAAC,MADsB,KAAK,UAAU,MAAM,GAE/C,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;IAAA;IAIxD,MAAM,cAAc,KAAK,eAAe,MAAM;IAC9C,MAAM,UAAU,KAAK,aAAa,MAAM;IAExC,OAAO,eAAe,aAAa,SAAS,UAAU,OAAO;GAC9D,QAAQ;IACP,OAAO,eAAe,gBAAgB,QAAQ,QAAQ;GACvD;EACD;CACD;AACD"}
+{"version":3,"file":"jwt.cjs","names":["principalId: string","effect: 'Allow' | 'Deny'","resource: string","context?: Record<string, string | number | boolean>","policyDocument: PolicyDocument","methodArn: string","options: JwtAuthorizerOptions<TClaims>","JwtVerifier","event: APIGatewayTokenAuthorizerEvent","_context: LambdaContext","event: APIGatewayRequestAuthorizerEvent"],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":["import type {\n\tAPIGatewayAuthorizerResult,\n\tAPIGatewayRequestAuthorizerEvent,\n\tAPIGatewayTokenAuthorizerEvent,\n\tContext as LambdaContext,\n\tPolicyDocument,\n} from 'aws-lambda';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction generatePolicy(\n\tprincipalId: string,\n\teffect: 'Allow' | 'Deny',\n\tresource: string,\n\tcontext?: Record<string, string | number | boolean>,\n): APIGatewayAuthorizerResult {\n\tconst policyDocument: PolicyDocument = {\n\t\tVersion: '2012-10-17',\n\t\tStatement: [\n\t\t\t{\n\t\t\t\tAction: 'execute-api:Invoke',\n\t\t\t\tEffect: effect,\n\t\t\t\tResource: resource,\n\t\t\t},\n\t\t],\n\t};\n\n\treturn {\n\t\tprincipalId,\n\t\tpolicyDocument,\n\t\tcontext,\n\t};\n}\n\nfunction getWildcardResource(methodArn: string): string {\n\tconst parts = methodArn.split('/');\n\treturn `${parts[0]}/${parts[1]}/*`;\n}\n\nexport interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\twildcardResource?: boolean;\n\tgetPrincipalId?: (claims: TClaims) => string;\n\tgetContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tauthorize?: (claims: TClaims) => boolean | Promise<boolean>;\n}\n\n/**\n * JWT Lambda Authorizer\n *\n * @example\n * ```typescript\n * const authorizer = new JwtAuthorizer({\n *   config: {\n *     jwksUri: 'https://auth.example.com/.well-known/jwks.json',\n *     issuer: 'https://auth.example.com',\n *   },\n *   getContext: (claims) => ({ userId: claims.sub! }),\n * });\n *\n * // TOKEN authorizer\n * export const tokenHandler = authorizer.tokenHandler();\n *\n * // REQUEST authorizer\n * export const requestHandler = authorizer.requestHandler();\n * ```\n */\nexport class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly wildcardResource: boolean;\n\tprivate readonly getPrincipalId: (claims: TClaims) => string;\n\tprivate readonly getContext?: (\n\t\tclaims: TClaims,\n\t) => Record<string, string | number | boolean> | undefined;\n\tprivate readonly authorize?: (claims: TClaims) => boolean | Promise<boolean>;\n\n\tconstructor(options: JwtAuthorizerOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.wildcardResource = options.wildcardResource ?? true;\n\t\tthis.getPrincipalId = options.getPrincipalId ?? ((c) => c.sub ?? 'unknown');\n\t\tthis.getContext = options.getContext;\n\t\tthis.authorize = options.authorize;\n\t}\n\n\t/**\n\t * Returns a TOKEN authorizer handler\n\t */\n\ttokenHandler() {\n\t\treturn async (\n\t\t\tevent: APIGatewayTokenAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst { authorizationToken, methodArn } = event;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = authorizationToken.startsWith('Bearer ')\n\t\t\t\t? authorizationToken.slice(7)\n\t\t\t\t: authorizationToken;\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns a REQUEST authorizer handler\n\t */\n\trequestHandler() {\n\t\tconst {\n\t\t\theaderName = 'authorization',\n\t\t\tcookieName,\n\t\t\ttokenPrefix = 'Bearer ',\n\t\t} = this.extraction;\n\n\t\tconst extractToken = (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t): string | null => {\n\t\t\tconst headers = event.headers ?? {};\n\t\t\tconst headerKey = Object.keys(headers).find(\n\t\t\t\t(k) => k.toLowerCase() === headerName.toLowerCase(),\n\t\t\t);\n\t\t\tif (headerKey) {\n\t\t\t\tconst headerValue = headers[headerKey];\n\t\t\t\tif (headerValue) {\n\t\t\t\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\t\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t\t\t\t}\n\t\t\t\t\treturn headerValue;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tif (cookieName) {\n\t\t\t\tconst cookieHeader = headers.cookie ?? headers.Cookie ?? '';\n\t\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\t\tif (match?.[1]) {\n\t\t\t\t\treturn match[1];\n\t\t\t\t}\n\t\t\t}\n\n\t\t\treturn null;\n\t\t};\n\n\t\treturn async (\n\t\t\tevent: APIGatewayRequestAuthorizerEvent,\n\t\t\t_context: LambdaContext,\n\t\t): Promise<APIGatewayAuthorizerResult> => {\n\t\t\tconst methodArn = event.methodArn;\n\t\t\tconst resource = this.wildcardResource\n\t\t\t\t? getWildcardResource(methodArn)\n\t\t\t\t: methodArn;\n\n\t\t\tconst token = extractToken(event);\n\n\t\t\tif (!token) {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst claims = await this.verifier.verify(token);\n\n\t\t\t\tif (this.authorize) {\n\t\t\t\t\tconst isAuthorized = await this.authorize(claims);\n\t\t\t\t\tif (!isAuthorized) {\n\t\t\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t\t\t}\n\t\t\t\t}\n\n\t\t\t\tconst principalId = this.getPrincipalId(claims);\n\t\t\t\tconst context = this.getContext?.(claims);\n\n\t\t\t\treturn generatePolicy(principalId, 'Allow', resource, context);\n\t\t\t} catch {\n\t\t\t\treturn generatePolicy('unauthorized', 'Deny', resource);\n\t\t\t}\n\t\t};\n\t}\n}\n"],"mappings":";;;AAqBA,SAAS,eACRA,aACAC,QACAC,UACAC,SAC6B;CAC7B,MAAMC,iBAAiC;EACtC,SAAS;EACT,WAAW,CACV;GACC,QAAQ;GACR,QAAQ;GACR,UAAU;EACV,CACD;CACD;AAED,QAAO;EACN;EACA;EACA;CACA;AACD;AAED,SAAS,oBAAoBC,WAA2B;CACvD,MAAM,QAAQ,UAAU,MAAM,IAAI;AAClC,SAAQ,EAAE,MAAM,GAAG,GAAG,MAAM,GAAG;AAC/B;;;;;;;;;;;;;;;;;;;;;AAiCD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAGjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,mBAAmB,QAAQ,oBAAoB;AACpD,OAAK,iBAAiB,QAAQ,mBAAmB,CAAC,MAAM,EAAE,OAAO;AACjE,OAAK,aAAa,QAAQ;AAC1B,OAAK,YAAY,QAAQ;CACzB;;;;CAKD,eAAe;AACd,SAAO,OACNC,OACAC,aACyC;GACzC,MAAM,EAAE,oBAAoB,WAAW,GAAG;GAC1C,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,mBAAmB,WAAW,UAAU,GACnD,mBAAmB,MAAM,EAAE,GAC3B;AAEH,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;;;;CAKD,iBAAiB;EAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG,KAAK;EAET,MAAM,eAAe,CACpBC,UACmB;GACnB,MAAM,UAAU,MAAM,WAAW,CAAE;GACnC,MAAM,YAAY,OAAO,KAAK,QAAQ,CAAC,KACtC,CAAC,MAAM,EAAE,aAAa,KAAK,WAAW,aAAa,CACnD;AACD,OAAI,WAAW;IACd,MAAM,cAAc,QAAQ;AAC5B,QAAI,aAAa;AAChB,SAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,YAAO;IACP;GACD;AAED,OAAI,YAAY;IACf,MAAM,eAAe,QAAQ,UAAU,QAAQ,UAAU;IACzD,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,QAAI,QAAQ,GACX,QAAO,MAAM;GAEd;AAED,UAAO;EACP;AAED,SAAO,OACNA,OACAD,aACyC;GACzC,MAAM,YAAY,MAAM;GACxB,MAAM,WAAW,KAAK,mBACnB,oBAAoB,UAAU,GAC9B;GAEH,MAAM,QAAQ,aAAa,MAAM;AAEjC,QAAK,MACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;AAGxD,OAAI;IACH,MAAM,SAAS,MAAM,KAAK,SAAS,OAAO,MAAM;AAEhD,QAAI,KAAK,WAAW;KACnB,MAAM,eAAe,MAAM,KAAK,UAAU,OAAO;AACjD,UAAK,aACJ,QAAO,eAAe,gBAAgB,QAAQ,SAAS;IAExD;IAED,MAAM,cAAc,KAAK,eAAe,OAAO;IAC/C,MAAM,UAAU,KAAK,aAAa,OAAO;AAEzC,WAAO,eAAe,aAAa,SAAS,UAAU,QAAQ;GAC9D,QAAO;AACP,WAAO,eAAe,gBAAgB,QAAQ,SAAS;GACvD;EACD;CACD;AACD"}

package/dist/lambda/jwt.d.cts

@@ -1,7 +1,8 @@
-import { a as JwtVerifier, n as JwtConfig, o as TokenExtractionOptions, t as JwtClaims } from "../jwt-CoKrpeMB.cjs";
+import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-3eIuY2dg.cjs";
 import { APIGatewayAuthorizerResult, APIGatewayRequestAuthorizerEvent, APIGatewayTokenAuthorizerEvent, Context } from "aws-lambda";
+
 //#region src/lambda/jwt.d.ts
-export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
+interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
   config: JwtConfig;
   extraction?: TokenExtractionOptions;
   wildcardResource?: boolean;
@@ -29,7 +30,7 @@ export interface JwtAuthorizerOptions<TClaims extends JwtClaims = JwtClaims> {
  * export const requestHandler = authorizer.requestHandler();
  * ```
  */
-export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
+declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
   private readonly verifier;
   private readonly extraction;
   private readonly wildcardResource;
@@ -46,6 +47,7 @@ export declare class JwtAuthorizer<TClaims extends JwtClaims = JwtClaims> {
    */
   requestHandler(): (event: APIGatewayRequestAuthorizerEvent, _context: Context) => Promise<APIGatewayAuthorizerResult>;
 }
+//# sourceMappingURL=jwt.d.ts.map
 //#endregion
-export type { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
+export { JwtAuthorizer, JwtAuthorizerOptions, JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions };
 //# sourceMappingURL=jwt.d.cts.map

package/dist/lambda/jwt.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.cts","names":["LambdaContext"],"sources":["../../src/lambda/jwt.ts"],"mappings":";;;iBA8CiB,qBAAqB,gBAAgB,YAAY;EACjE,QAAQ;EACR,aAAa;EACb;EACA,kBAAkB,QAAQ;EAC1B,cACC,QAAQ,YACJ;EACL,aAAa,QAAQ,sBAAsB;;;;;;;;;;;;;;;;;;;;;;qBAuB/B,cAAc,gBAAgB,YAAY;mBACrC;mBACA;mBACA;mBACA;mBACA;mBAGA;EAEjB,YAAY,SAAS,qBAAqB;;;;EAY1C,iBAAY,OAEH,gCAA8B,UAC3BA,YACR,QAAQ;;;;EAiCZ,mBAAc,OAmCL,kCAAgC,UAC7BA,YACR,QAAQ"}
+{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/lambda/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,gBAAiB,CAAA,EAAA,OAAA;EAAS,cAAG,CAAA,EAAA,CAAA,MAAA,EAIvC,OAJuC,EAAA,GAAA,MAAA;EAAS,UAClE,CAAA,EAAA,CAAA,MAAA,EAKC,OALD,EAAA,GAMH,MANG,CAAA,MAAA,EAAA,MAAA,GAAA,MAAA,GAAA,OAAA,CAAA,GAAA,SAAA;EAAS,SACJ,CAAA,EAAA,CAAA,MAAA,EAMQ,OANR,EAAA,GAAA,OAAA,GAM8B,OAN9B,CAAA,OAAA,CAAA;;;;;;AAMqC;AAuBnD;;;;;;;;;;;;;;AAiGY;cAjGC,8BAA8B,YAAY;;;;;;;uBAUjC,qBAAqB;;;;0BAcjC,0CACG,YACR,QAAQ;;;;4BAqEH,4CACG,YACR,QAAQ"}