@geekmidas/auth 9.0.2 → 10.0.0-alpha.1

package/dist/{cacheTokenStorage-_tq4Kmhc.d.mts → cacheTokenStorage-DaqxdNxI.d.mts}

@@ -70,4 +70,4 @@ declare class CacheTokenStorage implements TokenStorage {
 
 //#endregion
 export { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage };
-//# sourceMappingURL=cacheTokenStorage-_tq4Kmhc.d.mts.map
+//# sourceMappingURL=cacheTokenStorage-DaqxdNxI.d.mts.map

package/dist/cacheTokenStorage-DaqxdNxI.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cacheTokenStorage-DaqxdNxI.d.mts","names":[],"sources":["../src/client.ts","../src/cacheTokenStorage.ts"],"sourcesContent":[],"mappings":";;;UAAiB,YAAA;oBACE;+CAC2B;EAF7B,eAAY,EAAA,EAGT,OAHS,CAAA,MAAA,GAAA,IAAA,CAAA,GAAA,MAAA,GAAA,IAAA;EAAA,eAAA,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,EAIkB,OAJlB,CAAA,IAAA,CAAA,GAAA,IAAA;EAAA,WACV,EAAA,EAIH,OAJG,CAAA,IAAA,CAAA,GAAA,IAAA;;AAEC,cAKP,wBAAA,YAAoC,YAL7B,CAAA;EAAO,QACoB,cAAA;EAAO,QACtC,eAAA;EAAO,WAAA,CAAA,cAAA,CAAA,EAAA,MAAA,EAAA,eAAA,CAAA,EAAA,MAAA;EAGV,cAAA,CAAA,CAAA,EAAA,MAAA,GAAyB,IAAA;EAuCzB,cAAA,CAAA,KAAA,EAAmB,MAAA,EAAA,IAAW,CAAA,EAAA,MAAA,CAAY,EAAA,IAAA;EA0BtC,eAAA,CAAA,CAAA,EAAA,MAAkB,GAAA,IACxB;EASE,eAAW,CAAA,KAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAA,WAAA,CAAA,CAAA,EAAA,IAAA;;AAgBC,cApDZ,kBAAA,YAA8B,YAoDlB,CAAA;EAAO,QAIN,WAAA;EAAO,QAS7B,YAAA;EAAO,cAOW,CAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAAO,cAiBO,CAAA,KAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAI,eAYhB,CAAA,CAAA,EAAA,MAAA,GAAA,IAAA;EAAO,eA0CD,CAAA,KAAA,EAAA,MAAA,EAAA,IAAA,CAAA,EAAA,MAAA,CAAA,EAAA,IAAA;EAAO,WAkBD,CAAA,CAAA,EAAA,IAAA;;AAKK,UA5IxB,kBAAA,CA4IwB;EAAM,OAAd,CAAA,EA3ItB,YA2IsB;EAAO,eAAA,CAAA,EAAA,MAAA;;;;EClN3B,CAAA,EAAA,GAAA,IAAA;EAAkB,cAAA,CAAA,EAAA,GAAA,GAAA,IAAA;;AAeN,cDiEZ,WAAA,CCjEY;EAAO,QAKoB,OAAA;EAAO,QAIjC,eAAA;EAAO,QAKoB,cAAA;EAAO,QAItC,cAAA;EAAO,WAjCa,CAAA,OAAA,CAAA,EDyFpB,kBCzFoB;EAAY,cAAA,CAAA,CAAA,EDgG7B,OChG6B,CAAA,MAAA,GAAA,IAAA,CAAA;qBDoG5B;kGAStB;iBAOkB;;qCAiBc;mBAYZ;yBA0CM;uBAkBF,QAAQ;4BAKH,QAAQ;;;;cClN5B,iBAAA,YAA6B;EDHzB,QAAA,KAAA;EAAY,QAAA,cAAA;EAAA,QACV,eAAA;EAAO,WACoB,CAAA,KAAA,ECOrC,KDPqC,EAAA,cAAA,CAAA,EAAA,MAAA,EAAA,eAAA,CAAA,EAAA,MAAA;EAAO,cACjC,CAAA,CAAA,ECeK,ODfL,CAAA,MAAA,GAAA,IAAA,CAAA;EAAO,cACoB,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,ECmBK,ODnBL,CAAA,IAAA,CAAA;EAAO,eACtC,CAAA,CAAA,ECsBU,ODtBV,CAAA,MAAA,GAAA,IAAA,CAAA;EAAO,eAAA,CAAA,KAAA,EAAA,MAAA,EAAA,GAAA,CAAA,EAAA,MAAA,CAAA,EC2B8B,OD3B9B,CAAA,IAAA,CAAA;EAGV,WAAA,CAAA,CAAA,EC4BS,OD5BT,CAAA,IAAyB,CAAA;AAuCtC;AA0BA"}

package/dist/cacheTokenStorage.d.mts

@@ -1,2 +1,2 @@
-import { CacheTokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
+import { CacheTokenStorage } from "./cacheTokenStorage-DaqxdNxI.mjs";
 export { CacheTokenStorage };

package/dist/client.d.mts

@@ -1,2 +1,2 @@
-import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
+import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-DaqxdNxI.mjs";
 export { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage };

package/dist/cookies-Bc6gUjb6.cjs

@@ -0,0 +1,30 @@
+
+//#region src/cookies.ts
+/**
+* Reads one cookie out of a `Cookie` header.
+*
+* The header is a list of `name=value` pairs, so the name has to be matched
+* against a whole pair. Searching the raw header for `name=` instead lets an
+* attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`
+* contains `session=ATTACKER` — and the first match wins.
+*/
+function readCookie(cookieHeader, name) {
+	if (!cookieHeader) return null;
+	for (const pair of cookieHeader.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator === -1) continue;
+		if (pair.slice(0, separator).trim() !== name) continue;
+		const value = pair.slice(separator + 1).trim();
+		return value === "" ? null : value;
+	}
+	return null;
+}
+
+//#endregion
+Object.defineProperty(exports, 'readCookie', {
+  enumerable: true,
+  get: function () {
+    return readCookie;
+  }
+});
+//# sourceMappingURL=cookies-Bc6gUjb6.cjs.map

package/dist/cookies-Bc6gUjb6.cjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies-Bc6gUjb6.cjs","names":["cookieHeader: string | undefined","name: string"],"sources":["../src/cookies.ts"],"sourcesContent":["/**\n * Reads one cookie out of a `Cookie` header.\n *\n * The header is a list of `name=value` pairs, so the name has to be matched\n * against a whole pair. Searching the raw header for `name=` instead lets an\n * attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`\n * contains `session=ATTACKER` — and the first match wins.\n */\nexport function readCookie(\n\tcookieHeader: string | undefined,\n\tname: string,\n): string | null {\n\tif (!cookieHeader) {\n\t\treturn null;\n\t}\n\n\tfor (const pair of cookieHeader.split(';')) {\n\t\tconst separator = pair.indexOf('=');\n\t\tif (separator === -1) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (pair.slice(0, separator).trim() !== name) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst value = pair.slice(separator + 1).trim();\n\t\treturn value === '' ? null : value;\n\t}\n\n\treturn null;\n}\n"],"mappings":";;;;;;;;;;AAQA,SAAgB,WACfA,cACAC,MACgB;AAChB,MAAK,aACJ,QAAO;AAGR,MAAK,MAAM,QAAQ,aAAa,MAAM,IAAI,EAAE;EAC3C,MAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,MAAI,cAAc,GACjB;AAGD,MAAI,KAAK,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,KACvC;EAGD,MAAM,QAAQ,KAAK,MAAM,YAAY,EAAE,CAAC,MAAM;AAC9C,SAAO,UAAU,KAAK,OAAO;CAC7B;AAED,QAAO;AACP"}

package/dist/cookies-C80f8JtE.mjs

@@ -0,0 +1,24 @@
+//#region src/cookies.ts
+/**
+* Reads one cookie out of a `Cookie` header.
+*
+* The header is a list of `name=value` pairs, so the name has to be matched
+* against a whole pair. Searching the raw header for `name=` instead lets an
+* attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`
+* contains `session=ATTACKER` — and the first match wins.
+*/
+function readCookie(cookieHeader, name) {
+	if (!cookieHeader) return null;
+	for (const pair of cookieHeader.split(";")) {
+		const separator = pair.indexOf("=");
+		if (separator === -1) continue;
+		if (pair.slice(0, separator).trim() !== name) continue;
+		const value = pair.slice(separator + 1).trim();
+		return value === "" ? null : value;
+	}
+	return null;
+}
+
+//#endregion
+export { readCookie };
+//# sourceMappingURL=cookies-C80f8JtE.mjs.map

package/dist/cookies-C80f8JtE.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies-C80f8JtE.mjs","names":["cookieHeader: string | undefined","name: string"],"sources":["../src/cookies.ts"],"sourcesContent":["/**\n * Reads one cookie out of a `Cookie` header.\n *\n * The header is a list of `name=value` pairs, so the name has to be matched\n * against a whole pair. Searching the raw header for `name=` instead lets an\n * attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`\n * contains `session=ATTACKER` — and the first match wins.\n */\nexport function readCookie(\n\tcookieHeader: string | undefined,\n\tname: string,\n): string | null {\n\tif (!cookieHeader) {\n\t\treturn null;\n\t}\n\n\tfor (const pair of cookieHeader.split(';')) {\n\t\tconst separator = pair.indexOf('=');\n\t\tif (separator === -1) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tif (pair.slice(0, separator).trim() !== name) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tconst value = pair.slice(separator + 1).trim();\n\t\treturn value === '' ? null : value;\n\t}\n\n\treturn null;\n}\n"],"mappings":";;;;;;;;;AAQA,SAAgB,WACfA,cACAC,MACgB;AAChB,MAAK,aACJ,QAAO;AAGR,MAAK,MAAM,QAAQ,aAAa,MAAM,IAAI,EAAE;EAC3C,MAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,MAAI,cAAc,GACjB;AAGD,MAAI,KAAK,MAAM,GAAG,UAAU,CAAC,MAAM,KAAK,KACvC;EAGD,MAAM,QAAQ,KAAK,MAAM,YAAY,EAAE,CAAC,MAAM;AAC9C,SAAO,UAAU,KAAK,OAAO;CAC7B;AAED,QAAO;AACP"}

package/dist/cookies.cjs

@@ -0,0 +1,3 @@
+const require_cookies = require('./cookies-Bc6gUjb6.cjs');
+
+exports.readCookie = require_cookies.readCookie;

package/dist/cookies.d.cts

@@ -0,0 +1,14 @@
+//#region src/cookies.d.ts
+/**
+ * Reads one cookie out of a `Cookie` header.
+ *
+ * The header is a list of `name=value` pairs, so the name has to be matched
+ * against a whole pair. Searching the raw header for `name=` instead lets an
+ * attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`
+ * contains `session=ATTACKER` — and the first match wins.
+ */
+declare function readCookie(cookieHeader: string | undefined, name: string): string | null;
+//# sourceMappingURL=cookies.d.ts.map
+//#endregion
+export { readCookie };
+//# sourceMappingURL=cookies.d.cts.map

package/dist/cookies.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.cts","names":[],"sources":["../src/cookies.ts"],"sourcesContent":[],"mappings":";;AAQA;;;;;;;iBAAgB,UAAA"}

package/dist/cookies.d.mts

@@ -0,0 +1,14 @@
+//#region src/cookies.d.ts
+/**
+ * Reads one cookie out of a `Cookie` header.
+ *
+ * The header is a list of `name=value` pairs, so the name has to be matched
+ * against a whole pair. Searching the raw header for `name=` instead lets an
+ * attacker prefix their own cookie — `evil_session=ATTACKER; session=REAL`
+ * contains `session=ATTACKER` — and the first match wins.
+ */
+declare function readCookie(cookieHeader: string | undefined, name: string): string | null;
+//# sourceMappingURL=cookies.d.ts.map
+//#endregion
+export { readCookie };
+//# sourceMappingURL=cookies.d.mts.map

package/dist/cookies.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.mts","names":[],"sources":["../src/cookies.ts"],"sourcesContent":[],"mappings":";;AAQA;;;;;;;iBAAgB,UAAA"}

package/dist/cookies.mjs

@@ -0,0 +1,3 @@
+import { readCookie } from "./cookies-C80f8JtE.mjs";
+
+export { readCookie };

package/dist/hono/jwt.cjs

@@ -1,4 +1,5 @@
-const require_jwt = require('../jwt-Bo_eACEi.cjs');
+const require_cookies = require('../cookies-Bc6gUjb6.cjs');
+const require_jwt = require('../jwt-clq6I6vG.cjs');
 
 //#region src/hono/jwt.ts
 function extractToken(c, options = {}) {
@@ -9,11 +10,8 @@ function extractToken(c, options = {}) {
 		return headerValue;
 	}
 	if (cookieName) {
-		const cookieHeader = c.req.header("cookie");
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) return match[1];
-		}
+		const cookie = require_cookies.readCookie(c.req.header("cookie"), cookieName);
+		if (cookie) return cookie;
 	}
 	return null;
 }
@@ -88,5 +86,4 @@ var JwtMiddleware = class {
 
 //#endregion
 exports.JwtMiddleware = JwtMiddleware;
-exports.JwtVerifier = require_jwt.JwtVerifier;
 //# sourceMappingURL=jwt.cjs.map

package/dist/hono/jwt.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.cjs","names":["c: Context","options: TokenExtractionOptions","options: JwtMiddlewareOptions<TClaims>","JwtVerifier","next: Next"],"sources":["../../src/hono/jwt.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookieHeader = c.req.header('cookie');\n\t\tif (cookieHeader) {\n\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\tif (match?.[1]) {\n\t\t\t\treturn match[1];\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface JwtMiddlewareOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: JwtClaims) => TClaims;\n}\n\n/**\n * JWT Middleware for Hono\n *\n * @example\n * ```typescript\n * const jwt = new JwtMiddleware({\n *   config: { secret: process.env.JWT_SECRET! },\n * });\n *\n * app.use('/api/*', jwt.handler());\n *\n * // Or for optional auth\n * app.use('/public/*', jwt.optional());\n * ```\n */\nexport class JwtMiddleware<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (claims: JwtClaims) => TClaims;\n\n\tconstructor(options: JwtMiddlewareOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'jwtClaims';\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\t/**\n\t * Returns middleware that requires valid JWT\n\t */\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('jwtToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns middleware that allows unauthenticated requests\n\t */\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst claims = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (claims) {\n\t\t\t\t\tconst transformed = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(claims)\n\t\t\t\t\t\t: claims;\n\t\t\t\t\tc.set(this.contextKey, transformed);\n\t\t\t\t\tc.set('jwtToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAeA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GACjB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,QAAQ,GACX,QAAO,MAAM;EAEd;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;;;AAyBD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;;;;CAKD,UAA6B;AAC5B,SAAO,OAAOH,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IACjD,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,QAAQ,GAC7B;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,YAAY,MAAM;AAExB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;;;;CAKD,WAA8B;AAC7B,SAAO,OAAOJ,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,SAAS,MAAM,KAAK,SAAS,aAAa,MAAM;AACtD,QAAI,QAAQ;KACX,MAAM,cAAc,KAAK,kBACtB,KAAK,gBAAgB,OAAO,GAC5B;AACH,OAAE,IAAI,KAAK,YAAY,YAAY;AACnC,OAAE,IAAI,YAAY,MAAM;IACxB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}
+{"version":3,"file":"jwt.cjs","names":["c: Context","options: TokenExtractionOptions","options: JwtMiddlewareOptions<TClaims>","JwtVerifier","next: Next"],"sources":["../../src/hono/jwt.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookie = readCookie(c.req.header('cookie'), cookieName);\n\t\tif (cookie) {\n\t\t\treturn cookie;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface JwtMiddlewareOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: JwtClaims) => TClaims;\n}\n\n/**\n * JWT Middleware for Hono\n *\n * @example\n * ```typescript\n * const jwt = new JwtMiddleware({\n *   config: { secret: process.env.JWT_SECRET! },\n * });\n *\n * app.use('/api/*', jwt.handler());\n *\n * // Or for optional auth\n * app.use('/public/*', jwt.optional());\n * ```\n */\nexport class JwtMiddleware<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (claims: JwtClaims) => TClaims;\n\n\tconstructor(options: JwtMiddlewareOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'jwtClaims';\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\t/**\n\t * Returns middleware that requires valid JWT\n\t */\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('jwtToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns middleware that allows unauthenticated requests\n\t */\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst claims = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (claims) {\n\t\t\t\t\tconst transformed = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(claims)\n\t\t\t\t\t\t: claims;\n\t\t\t\t\tc.set(this.contextKey, transformed);\n\t\t\t\t\tc.set('jwtToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAWA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,SAAS,2BAAW,EAAE,IAAI,OAAO,SAAS,EAAE,WAAW;AAC7D,MAAI,OACH,QAAO;CAER;AAED,QAAO;AACP;;;;;;;;;;;;;;;;AAyBD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAIC,wBAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;;;;CAKD,UAA6B;AAC5B,SAAO,OAAOH,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IACjD,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,QAAQ,GAC7B;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,YAAY,MAAM;AAExB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;;;;CAKD,WAA8B;AAC7B,SAAO,OAAOJ,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,SAAS,MAAM,KAAK,SAAS,aAAa,MAAM;AACtD,QAAI,QAAQ;KACX,MAAM,cAAc,KAAK,kBACtB,KAAK,gBAAgB,OAAO,GAC5B;AACH,OAAE,IAAI,KAAK,YAAY,YAAY;AACnC,OAAE,IAAI,YAAY,MAAM;IACxB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}

package/dist/hono/jwt.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/hono/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,UAAiB,CAAA,EAAA,MAAA;EAAS,OAAG,CAAA,EAAA,CAAA,CAAA,EAInD,OAJmD,EAAA,KAAA,EAInC,KAJmC,EAAA,GAIzB,QAJyB,GAId,OAJc,CAIN,QAJM,CAAA;EAAS,eAClE,CAAA,EAAA,CAAA,MAAA,EAImB,SAJnB,EAAA,GAIiC,OAJjC;;;;;;;;;AAIwC;AAkBjD;;;;;;;AAsDa,cAtDA,aAsDA,CAAA,gBAtD8B,SAsD9B,GAtD0C,SAsD1C,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;uBA5CR,qBAAqB;;;;aAW/B;;;;cAiCC"}
+{"version":3,"file":"jwt.d.cts","names":[],"sources":["../../src/hono/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAuCiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,UAAiB,CAAA,EAAA,MAAA;EAAS,OAAG,CAAA,EAAA,CAAA,CAAA,EAInD,OAJmD,EAAA,KAAA,EAInC,KAJmC,EAAA,GAIzB,QAJyB,GAId,OAJc,CAIN,QAJM,CAAA;EAAS,eAClE,CAAA,EAAA,CAAA,MAAA,EAImB,SAJnB,EAAA,GAIiC,OAJjC;;;;;;;;;AAIwC;AAkBjD;;;;;;;AAsDa,cAtDA,aAsDA,CAAA,gBAtD8B,SAsD9B,GAtD0C,SAsD1C,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;uBA5CR,qBAAqB;;;;aAW/B;;;;cAiCC"}

package/dist/hono/jwt.d.mts

@@ -1,4 +1,4 @@
-import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
+import { JwtClaims, JwtConfig, JwtVerifier, TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
 import { Context, MiddlewareHandler } from "hono";
 
 //#region src/hono/jwt.d.ts

package/dist/hono/jwt.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/hono/jwt.ts"],"sourcesContent":[],"mappings":";;;;UA8CiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,UAAiB,CAAA,EAAA,MAAA;EAAS,OAAG,CAAA,EAAA,CAAA,CAAA,EAInD,OAJmD,EAAA,KAAA,EAInC,KAJmC,EAAA,GAIzB,QAJyB,GAId,OAJc,CAIN,QAJM,CAAA;EAAS,eAClE,CAAA,EAAA,CAAA,MAAA,EAImB,SAJnB,EAAA,GAIiC,OAJjC;;;;;;;;;AAIwC;AAkBjD;;;;;;;AAsDa,cAtDA,aAsDA,CAAA,gBAtD8B,SAsD9B,GAtD0C,SAsD1C,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;uBA5CR,qBAAqB;;;;aAW/B;;;;cAiCC"}
+{"version":3,"file":"jwt.d.mts","names":[],"sources":["../../src/hono/jwt.ts"],"sourcesContent":[],"mappings":";;;;UAuCiB,qCAAqC,YAAY;EAAjD,MAAA,EACR,SADQ;EAAoB,UAAA,CAAA,EAEvB,sBAFuB;EAAA,UAAiB,CAAA,EAAA,MAAA;EAAS,OAAG,CAAA,EAAA,CAAA,CAAA,EAInD,OAJmD,EAAA,KAAA,EAInC,KAJmC,EAAA,GAIzB,QAJyB,GAId,OAJc,CAIN,QAJM,CAAA;EAAS,eAClE,CAAA,EAAA,CAAA,MAAA,EAImB,SAJnB,EAAA,GAIiC,OAJjC;;;;;;;;;AAIwC;AAkBjD;;;;;;;AAsDa,cAtDA,aAsDA,CAAA,gBAtD8B,SAsD9B,GAtD0C,SAsD1C,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;uBA5CR,qBAAqB;;;;aAW/B;;;;cAiCC"}

package/dist/hono/jwt.mjs

@@ -1,4 +1,5 @@
-import { JwtVerifier } from "../jwt-D88cPJyT.mjs";
+import { readCookie } from "../cookies-C80f8JtE.mjs";
+import { JwtVerifier } from "../jwt-bZR2_t8F.mjs";
 
 //#region src/hono/jwt.ts
 function extractToken(c, options = {}) {
@@ -9,11 +10,8 @@ function extractToken(c, options = {}) {
 		return headerValue;
 	}
 	if (cookieName) {
-		const cookieHeader = c.req.header("cookie");
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) return match[1];
-		}
+		const cookie = readCookie(c.req.header("cookie"), cookieName);
+		if (cookie) return cookie;
 	}
 	return null;
 }
@@ -87,5 +85,5 @@ var JwtMiddleware = class {
 };
 
 //#endregion
-export { JwtMiddleware, JwtVerifier };
+export { JwtMiddleware };
 //# sourceMappingURL=jwt.mjs.map

package/dist/hono/jwt.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"jwt.mjs","names":["c: Context","options: TokenExtractionOptions","options: JwtMiddlewareOptions<TClaims>","next: Next"],"sources":["../../src/hono/jwt.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport {\n\tJwtVerifier,\n\ttype JwtClaims,\n\ttype JwtConfig,\n\ttype TokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookieHeader = c.req.header('cookie');\n\t\tif (cookieHeader) {\n\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\tif (match?.[1]) {\n\t\t\t\treturn match[1];\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface JwtMiddlewareOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: JwtClaims) => TClaims;\n}\n\n/**\n * JWT Middleware for Hono\n *\n * @example\n * ```typescript\n * const jwt = new JwtMiddleware({\n *   config: { secret: process.env.JWT_SECRET! },\n * });\n *\n * app.use('/api/*', jwt.handler());\n *\n * // Or for optional auth\n * app.use('/public/*', jwt.optional());\n * ```\n */\nexport class JwtMiddleware<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (claims: JwtClaims) => TClaims;\n\n\tconstructor(options: JwtMiddlewareOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'jwtClaims';\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\t/**\n\t * Returns middleware that requires valid JWT\n\t */\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('jwtToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns middleware that allows unauthenticated requests\n\t */\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst claims = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (claims) {\n\t\t\t\t\tconst transformed = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(claims)\n\t\t\t\t\t\t: claims;\n\t\t\t\t\tc.set(this.contextKey, transformed);\n\t\t\t\t\tc.set('jwtToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAeA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GACjB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,QAAQ,GACX,QAAO,MAAM;EAEd;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;;;AAyBD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;;;;CAKD,UAA6B;AAC5B,SAAO,OAAOF,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IACjD,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,QAAQ,GAC7B;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,YAAY,MAAM;AAExB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;;;;CAKD,WAA8B;AAC7B,SAAO,OAAOH,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,SAAS,MAAM,KAAK,SAAS,aAAa,MAAM;AACtD,QAAI,QAAQ;KACX,MAAM,cAAc,KAAK,kBACtB,KAAK,gBAAgB,OAAO,GAC5B;AACH,OAAE,IAAI,KAAK,YAAY,YAAY;AACnC,OAAE,IAAI,YAAY,MAAM;IACxB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}
+{"version":3,"file":"jwt.mjs","names":["c: Context","options: TokenExtractionOptions","options: JwtMiddlewareOptions<TClaims>","next: Next"],"sources":["../../src/hono/jwt.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport { readCookie } from '../cookies';\nimport {\n\ttype JwtClaims,\n\ttype JwtConfig,\n\tJwtVerifier,\n\ttype TokenExtractionOptions,\n} from '../jwt';\n\nexport type { JwtVerifier, JwtClaims, JwtConfig, TokenExtractionOptions };\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookie = readCookie(c.req.header('cookie'), cookieName);\n\t\tif (cookie) {\n\t\t\treturn cookie;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface JwtMiddlewareOptions<TClaims extends JwtClaims = JwtClaims> {\n\tconfig: JwtConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: JwtClaims) => TClaims;\n}\n\n/**\n * JWT Middleware for Hono\n *\n * @example\n * ```typescript\n * const jwt = new JwtMiddleware({\n *   config: { secret: process.env.JWT_SECRET! },\n * });\n *\n * app.use('/api/*', jwt.handler());\n *\n * // Or for optional auth\n * app.use('/public/*', jwt.optional());\n * ```\n */\nexport class JwtMiddleware<TClaims extends JwtClaims = JwtClaims> {\n\tprivate readonly verifier: JwtVerifier<TClaims>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (claims: JwtClaims) => TClaims;\n\n\tconstructor(options: JwtMiddlewareOptions<TClaims>) {\n\t\tthis.verifier = new JwtVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'jwtClaims';\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\t/**\n\t * Returns middleware that requires valid JWT\n\t */\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('jwtToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\t/**\n\t * Returns middleware that allows unauthenticated requests\n\t */\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst claims = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (claims) {\n\t\t\t\t\tconst transformed = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(claims)\n\t\t\t\t\t\t: claims;\n\t\t\t\t\tc.set(this.contextKey, transformed);\n\t\t\t\t\tc.set('jwtToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAWA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,SAAS,WAAW,EAAE,IAAI,OAAO,SAAS,EAAE,WAAW;AAC7D,MAAI,OACH,QAAO;CAER;AAED,QAAO;AACP;;;;;;;;;;;;;;;;AAyBD,IAAa,gBAAb,MAAkE;CACjE,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAEjB,YAAYC,SAAwC;AACnD,OAAK,WAAW,IAAI,YAAY,QAAQ;AACxC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;;;;CAKD,UAA6B;AAC5B,SAAO,OAAOF,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IACjD,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,QAAQ,GAC7B;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,YAAY,MAAM;AAExB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;;;;CAKD,WAA8B;AAC7B,SAAO,OAAOH,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,SAAS,MAAM,KAAK,SAAS,aAAa,MAAM;AACtD,QAAI,QAAQ;KACX,MAAM,cAAc,KAAK,kBACtB,KAAK,gBAAgB,OAAO,GAC5B;AACH,OAAE,IAAI,KAAK,YAAY,YAAY;AACnC,OAAE,IAAI,YAAY,MAAM;IACxB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}

package/dist/hono/oidc.cjs

@@ -1,4 +1,5 @@
-const require_oidc = require('../oidc-C0KyYaAK.cjs');
+const require_cookies = require('../cookies-Bc6gUjb6.cjs');
+const require_oidc = require('../oidc-jdMfVyyC.cjs');
 
 //#region src/hono/oidc.ts
 function extractToken(c, options = {}) {
@@ -9,11 +10,8 @@ function extractToken(c, options = {}) {
 		return headerValue;
 	}
 	if (cookieName) {
-		const cookieHeader = c.req.header("cookie");
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) return match[1];
-		}
+		const cookie = require_cookies.readCookie(c.req.header("cookie"), cookieName);
+		if (cookie) return cookie;
 	}
 	return null;
 }
@@ -100,5 +98,4 @@ var OidcMiddleware = class {
 
 //#endregion
 exports.OidcMiddleware = OidcMiddleware;
-exports.OidcVerifier = require_oidc.OidcVerifier;
 //# sourceMappingURL=oidc.cjs.map

package/dist/hono/oidc.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.cjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","OidcVerifier","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\ttype TokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookieHeader = c.req.header('cookie');\n\t\tif (cookieHeader) {\n\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\tif (match?.[1]) {\n\t\t\t\treturn match[1];\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GACjB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,QAAQ,GACX,QAAO,MAAM;EAEd;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC/D,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;CAED,UAA6B;AAC5B,SAAO,OAAOH,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACvB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAC/B;IAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;CAED,WAA8B;AAC7B,SAAO,OAAOL,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACZ,IAAIC;AACJ,SAAI,KAAK,eAAe;AACvB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAC/B;KAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IACzB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}
+{"version":3,"file":"oidc.cjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","OidcVerifier","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type {\n\tOidcVerifier,\n\tOidcClaims,\n\tOidcConfig,\n\tOidcUserInfo,\n\tTokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookie = readCookie(c.req.header('cookie'), cookieName);\n\t\tif (cookie) {\n\t\t\treturn cookie;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAkBA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,SAAS,2BAAW,EAAE,IAAI,OAAO,SAAS,EAAE,WAAW;AAC7D,MAAI,OACH,QAAO;CAER;AAED,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC/D,OAAK,WAAW,IAAIC,0BAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;CAED,UAA6B;AAC5B,SAAO,OAAOH,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACvB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAC/B;IAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;CAED,WAA8B;AAC7B,SAAO,OAAOL,GAAYI,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACZ,IAAIC;AACJ,SAAI,KAAK,eAAe;AACvB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAC/B;KAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IACzB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}

package/dist/hono/oidc.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAgDiB,sCACA,aAAa,8BACX,eAAe;UAEzB;EAJQ,UAAA,CAAA,EAKH,sBALwB;EAAA,UAAA,CAAA,EAAA,MAAA;EAAA,aACrB,CAAA,EAAA,OAAA;EAAU,OAAG,CAAA,EAAA,CAAA,CAAA,EAOf,OAPe,EAAA,KAAA,EAOC,KAPD,EAAA,GAOW,QAPX,GAOsB,OAPtB,CAO8B,QAP9B,CAAA;EAAU,eACrB,CAAA,EAAA,CAAA,MAAA,EAOS,UAPT,EAAA,QAAA,CAAA,EAOgC,SAPhC,EAAA,GAO8C,OAP9C;;;;;;;;;;;;AAOqD;AAwBxE;;;;;;;;;;AA+Da,cA/DA,cA+DA,CAAA,gBA9DI,UA8DJ,GA9DiB,UA8DjB,EAAA,kBA7DM,YA6DN,GA7DqB,YA6DrB,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;;uBA9CR,sBAAsB,SAAS;aASzC;cAqCC"}
+{"version":3,"file":"oidc.d.cts","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa,8BACX,eAAe;UAEzB;EAJQ,UAAA,CAAA,EAKH,sBALwB;EAAA,UAAA,CAAA,EAAA,MAAA;EAAA,aACrB,CAAA,EAAA,OAAA;EAAU,OAAG,CAAA,EAAA,CAAA,CAAA,EAOf,OAPe,EAAA,KAAA,EAOC,KAPD,EAAA,GAOW,QAPX,GAOsB,OAPtB,CAO8B,QAP9B,CAAA;EAAU,eACrB,CAAA,EAAA,CAAA,MAAA,EAOS,UAPT,EAAA,QAAA,CAAA,EAOgC,SAPhC,EAAA,GAO8C,OAP9C;;;;;;;;;;;;AAOqD;AAwBxE;;;;;;;;;;AA+Da,cA/DA,cA+DA,CAAA,gBA9DI,UA8DJ,GA9DiB,UA8DjB,EAAA,kBA7DM,YA6DN,GA7DqB,YA6DrB,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;;uBA9CR,sBAAsB,SAAS;aASzC;cAqCC"}

package/dist/hono/oidc.d.mts

@@ -1,5 +1,5 @@
-import { TokenExtractionOptions } from "../jwt-BqLlRkw-.mjs";
-import { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier } from "../oidc-DTRgBBl6.mjs";
+import { TokenExtractionOptions } from "../jwt-kejix7rd.mjs";
+import { OidcClaims, OidcConfig, OidcUserInfo, OidcVerifier } from "../oidc-Ca7GYwmM.mjs";
 import { Context, MiddlewareHandler } from "hono";
 
 //#region src/hono/oidc.d.ts

package/dist/hono/oidc.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UAgDiB,sCACA,aAAa,8BACX,eAAe;UAEzB;EAJQ,UAAA,CAAA,EAKH,sBALwB;EAAA,UAAA,CAAA,EAAA,MAAA;EAAA,aACrB,CAAA,EAAA,OAAA;EAAU,OAAG,CAAA,EAAA,CAAA,CAAA,EAOf,OAPe,EAAA,KAAA,EAOC,KAPD,EAAA,GAOW,QAPX,GAOsB,OAPtB,CAO8B,QAP9B,CAAA;EAAU,eACrB,CAAA,EAAA,CAAA,MAAA,EAOS,UAPT,EAAA,QAAA,CAAA,EAOgC,SAPhC,EAAA,GAO8C,OAP9C;;;;;;;;;;;;AAOqD;AAwBxE;;;;;;;;;;AA+Da,cA/DA,cA+DA,CAAA,gBA9DI,UA8DJ,GA9DiB,UA8DjB,EAAA,kBA7DM,YA6DN,GA7DqB,YA6DrB,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;;uBA9CR,sBAAsB,SAAS;aASzC;cAqCC"}
+{"version":3,"file":"oidc.d.mts","names":[],"sources":["../../src/hono/oidc.ts"],"sourcesContent":[],"mappings":";;;;;UA8CiB,sCACA,aAAa,8BACX,eAAe;UAEzB;EAJQ,UAAA,CAAA,EAKH,sBALwB;EAAA,UAAA,CAAA,EAAA,MAAA;EAAA,aACrB,CAAA,EAAA,OAAA;EAAU,OAAG,CAAA,EAAA,CAAA,CAAA,EAOf,OAPe,EAAA,KAAA,EAOC,KAPD,EAAA,GAOW,QAPX,GAOsB,OAPtB,CAO8B,QAP9B,CAAA;EAAU,eACrB,CAAA,EAAA,CAAA,MAAA,EAOS,UAPT,EAAA,QAAA,CAAA,EAOgC,SAPhC,EAAA,GAO8C,OAP9C;;;;;;;;;;;;AAOqD;AAwBxE;;;;;;;;;;AA+Da,cA/DA,cA+DA,CAAA,gBA9DI,UA8DJ,GA9DiB,UA8DjB,EAAA,kBA7DM,YA6DN,GA7DqB,YA6DrB,CAAA,CAAA;EAAiB,iBAAA,QAAA;;;;;;uBA9CR,sBAAsB,SAAS;aASzC;cAqCC"}

package/dist/hono/oidc.mjs

@@ -1,4 +1,5 @@
-import { OidcVerifier } from "../oidc-KA30gMlx.mjs";
+import { readCookie } from "../cookies-C80f8JtE.mjs";
+import { OidcVerifier } from "../oidc-BYHREHir.mjs";
 
 //#region src/hono/oidc.ts
 function extractToken(c, options = {}) {
@@ -9,11 +10,8 @@ function extractToken(c, options = {}) {
 		return headerValue;
 	}
 	if (cookieName) {
-		const cookieHeader = c.req.header("cookie");
-		if (cookieHeader) {
-			const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-			if (match?.[1]) return match[1];
-		}
+		const cookie = readCookie(c.req.header("cookie"), cookieName);
+		if (cookie) return cookie;
 	}
 	return null;
 }
@@ -99,5 +97,5 @@ var OidcMiddleware = class {
 };
 
 //#endregion
-export { OidcMiddleware, OidcVerifier };
+export { OidcMiddleware };
 //# sourceMappingURL=oidc.mjs.map

package/dist/hono/oidc.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"oidc.mjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport {\n\tOidcVerifier,\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\ttype TokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookieHeader = c.req.header('cookie');\n\t\tif (cookieHeader) {\n\t\t\tconst match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));\n\t\t\tif (match?.[1]) {\n\t\t\t\treturn match[1];\n\t\t\t}\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;AAiBA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,eAAe,EAAE,IAAI,OAAO,SAAS;AAC3C,MAAI,cAAc;GACjB,MAAM,QAAQ,aAAa,MAAM,IAAI,QAAQ,EAAE,WAAW,WAAW;AACrE,OAAI,QAAQ,GACX,QAAO,MAAM;EAEd;CACD;AAED,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC/D,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;CAED,UAA6B;AAC5B,SAAO,OAAOF,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACvB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAC/B;IAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;CAED,WAA8B;AAC7B,SAAO,OAAOJ,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACZ,IAAIC;AACJ,SAAI,KAAK,eAAe;AACvB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAC/B;KAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IACzB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}
+{"version":3,"file":"oidc.mjs","names":["c: Context","options: TokenExtractionOptions","options: OidcMiddlewareOptions<TClaims, TUserInfo>","next: Next","userInfo: TUserInfo | undefined"],"sources":["../../src/hono/oidc.ts"],"sourcesContent":["import type { Context, MiddlewareHandler, Next } from 'hono';\nimport { readCookie } from '../cookies';\nimport {\n\ttype OidcClaims,\n\ttype OidcConfig,\n\ttype OidcUserInfo,\n\tOidcVerifier,\n\ttype TokenExtractionOptions,\n} from '../oidc';\n\nexport type {\n\tOidcVerifier,\n\tOidcClaims,\n\tOidcConfig,\n\tOidcUserInfo,\n\tTokenExtractionOptions,\n};\n\nfunction extractToken(\n\tc: Context,\n\toptions: TokenExtractionOptions = {},\n): string | null {\n\tconst {\n\t\theaderName = 'authorization',\n\t\tcookieName,\n\t\ttokenPrefix = 'Bearer ',\n\t} = options;\n\n\tconst headerValue = c.req.header(headerName);\n\tif (headerValue) {\n\t\tif (tokenPrefix && headerValue.startsWith(tokenPrefix)) {\n\t\t\treturn headerValue.slice(tokenPrefix.length);\n\t\t}\n\t\treturn headerValue;\n\t}\n\n\tif (cookieName) {\n\t\tconst cookie = readCookie(c.req.header('cookie'), cookieName);\n\t\tif (cookie) {\n\t\t\treturn cookie;\n\t\t}\n\t}\n\n\treturn null;\n}\n\nexport interface OidcMiddlewareOptions<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tconfig: OidcConfig;\n\textraction?: TokenExtractionOptions;\n\tcontextKey?: string;\n\tfetchUserInfo?: boolean;\n\tonError?: (c: Context, error: Error) => Response | Promise<Response>;\n\ttransformClaims?: (claims: OidcClaims, userInfo?: TUserInfo) => TClaims;\n}\n\n/**\n * OIDC Middleware for Hono\n *\n * @example\n * ```typescript\n * const oidc = new OidcMiddleware({\n *   config: {\n *     issuer: 'https://auth.example.com',\n *     audience: 'my-client-id',\n *   },\n * });\n *\n * app.use('/api/*', oidc.handler());\n *\n * // With user info\n * const oidcWithUserInfo = new OidcMiddleware({\n *   config: { issuer: '...', audience: '...' },\n *   fetchUserInfo: true,\n * });\n * ```\n */\nexport class OidcMiddleware<\n\tTClaims extends OidcClaims = OidcClaims,\n\tTUserInfo extends OidcUserInfo = OidcUserInfo,\n> {\n\tprivate readonly verifier: OidcVerifier<TClaims, TUserInfo>;\n\tprivate readonly extraction: TokenExtractionOptions;\n\tprivate readonly contextKey: string;\n\tprivate readonly fetchUserInfo: boolean;\n\tprivate readonly onError?: (\n\t\tc: Context,\n\t\terror: Error,\n\t) => Response | Promise<Response>;\n\tprivate readonly transformClaims?: (\n\t\tclaims: OidcClaims,\n\t\tuserInfo?: TUserInfo,\n\t) => TClaims;\n\n\tconstructor(options: OidcMiddlewareOptions<TClaims, TUserInfo>) {\n\t\tthis.verifier = new OidcVerifier(options.config);\n\t\tthis.extraction = options.extraction ?? {};\n\t\tthis.contextKey = options.contextKey ?? 'oidcClaims';\n\t\tthis.fetchUserInfo = options.fetchUserInfo ?? false;\n\t\tthis.onError = options.onError;\n\t\tthis.transformClaims = options.transformClaims;\n\t}\n\n\thandler(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (!token) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, new Error('No token provided'));\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Unauthorized' }, 401);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst payload = await this.verifier.verify(token);\n\n\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t}\n\n\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t: payload;\n\n\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\tc.set('oidcToken', token);\n\n\t\t\t\tawait next();\n\t\t\t} catch (error) {\n\t\t\t\tif (this.onError) {\n\t\t\t\t\treturn this.onError(c, error as Error);\n\t\t\t\t}\n\t\t\t\treturn c.json({ error: 'Invalid token' }, 401);\n\t\t\t}\n\t\t};\n\t}\n\n\toptional(): MiddlewareHandler {\n\t\treturn async (c: Context, next: Next) => {\n\t\t\tconst token = extractToken(c, this.extraction);\n\n\t\t\tif (token) {\n\t\t\t\tconst payload = await this.verifier.verifyOrNull(token);\n\t\t\t\tif (payload) {\n\t\t\t\t\tlet userInfo: TUserInfo | undefined;\n\t\t\t\t\tif (this.fetchUserInfo) {\n\t\t\t\t\t\tuserInfo = (await this.verifier.fetchUserInfo(token)) ?? undefined;\n\t\t\t\t\t\tc.set('oidcUserInfo', userInfo);\n\t\t\t\t\t}\n\n\t\t\t\t\tconst claims = this.transformClaims\n\t\t\t\t\t\t? this.transformClaims(payload, userInfo)\n\t\t\t\t\t\t: payload;\n\n\t\t\t\t\tc.set(this.contextKey, claims);\n\t\t\t\t\tc.set('oidcToken', token);\n\t\t\t\t}\n\t\t\t}\n\n\t\t\tawait next();\n\t\t};\n\t}\n}\n"],"mappings":";;;;AAkBA,SAAS,aACRA,GACAC,UAAkC,CAAE,GACpB;CAChB,MAAM,EACL,aAAa,iBACb,YACA,cAAc,WACd,GAAG;CAEJ,MAAM,cAAc,EAAE,IAAI,OAAO,WAAW;AAC5C,KAAI,aAAa;AAChB,MAAI,eAAe,YAAY,WAAW,YAAY,CACrD,QAAO,YAAY,MAAM,YAAY,OAAO;AAE7C,SAAO;CACP;AAED,KAAI,YAAY;EACf,MAAM,SAAS,WAAW,EAAE,IAAI,OAAO,SAAS,EAAE,WAAW;AAC7D,MAAI,OACH,QAAO;CAER;AAED,QAAO;AACP;;;;;;;;;;;;;;;;;;;;;;AAmCD,IAAa,iBAAb,MAGE;CACD,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CACjB,AAAiB;CAIjB,AAAiB;CAKjB,YAAYC,SAAoD;AAC/D,OAAK,WAAW,IAAI,aAAa,QAAQ;AACzC,OAAK,aAAa,QAAQ,cAAc,CAAE;AAC1C,OAAK,aAAa,QAAQ,cAAc;AACxC,OAAK,gBAAgB,QAAQ,iBAAiB;AAC9C,OAAK,UAAU,QAAQ;AACvB,OAAK,kBAAkB,QAAQ;CAC/B;CAED,UAA6B;AAC5B,SAAO,OAAOF,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,QAAK,OAAO;AACX,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,IAAI,MAAM,qBAAqB;AAEvD,WAAO,EAAE,KAAK,EAAE,OAAO,eAAgB,GAAE,IAAI;GAC7C;AAED,OAAI;IACH,MAAM,UAAU,MAAM,KAAK,SAAS,OAAO,MAAM;IAEjD,IAAIC;AACJ,QAAI,KAAK,eAAe;AACvB,gBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,OAAE,IAAI,gBAAgB,SAAS;IAC/B;IAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,MAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,MAAE,IAAI,aAAa,MAAM;AAEzB,UAAM,MAAM;GACZ,SAAQ,OAAO;AACf,QAAI,KAAK,QACR,QAAO,KAAK,QAAQ,GAAG,MAAe;AAEvC,WAAO,EAAE,KAAK,EAAE,OAAO,gBAAiB,GAAE,IAAI;GAC9C;EACD;CACD;CAED,WAA8B;AAC7B,SAAO,OAAOJ,GAAYG,SAAe;GACxC,MAAM,QAAQ,aAAa,GAAG,KAAK,WAAW;AAE9C,OAAI,OAAO;IACV,MAAM,UAAU,MAAM,KAAK,SAAS,aAAa,MAAM;AACvD,QAAI,SAAS;KACZ,IAAIC;AACJ,SAAI,KAAK,eAAe;AACvB,iBAAY,MAAM,KAAK,SAAS,cAAc,MAAM;AACpD,QAAE,IAAI,gBAAgB,SAAS;KAC/B;KAED,MAAM,SAAS,KAAK,kBACjB,KAAK,gBAAgB,SAAS,SAAS,GACvC;AAEH,OAAE,IAAI,KAAK,YAAY,OAAO;AAC9B,OAAE,IAAI,aAAa,MAAM;IACzB;GACD;AAED,SAAM,MAAM;EACZ;CACD;AACD"}

package/dist/index.cjs

@@ -1,6 +1,6 @@
 const require_cacheTokenStorage = require('./cacheTokenStorage-CEpMniTi.cjs');
 const require_client = require('./client-BPl_mMvb.cjs');
-const require_tokenManager = require('./tokenManager-CvEMgxOp.cjs');
+const require_tokenManager = require('./tokenManager-PQ-OI_NU.cjs');
 
 exports.CacheTokenStorage = require_cacheTokenStorage.CacheTokenStorage;
 exports.LocalStorageTokenStorage = require_client.LocalStorageTokenStorage;

package/dist/index.d.mts

@@ -1,3 +1,3 @@
-import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-_tq4Kmhc.mjs";
-import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-RrwjL0y-.mjs";
+import { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenStorage } from "./cacheTokenStorage-DaqxdNxI.mjs";
+import { DecodedToken, TokenManager, TokenManagerOptions, TokenPair, TokenPayload } from "./tokenManager-CosB7J0i.mjs";
 export { CacheTokenStorage, DecodedToken, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenClientOptions, TokenManager, TokenManagerOptions, TokenPair, TokenPayload, TokenStorage };

package/dist/index.mjs

@@ -1,5 +1,5 @@
 import { CacheTokenStorage } from "./cacheTokenStorage-16NE8Cd9.mjs";
 import { LocalStorageTokenStorage, MemoryTokenStorage, TokenClient } from "./client-eidYNJSH.mjs";
-import { TokenManager } from "./tokenManager-Ci2Tgxp8.mjs";
+import { TokenManager } from "./tokenManager-BbylTW7F.mjs";
 
 export { CacheTokenStorage, LocalStorageTokenStorage, MemoryTokenStorage, TokenClient, TokenManager };

package/dist/{jwt-D88cPJyT.mjs → jwt-bZR2_t8F.mjs}

@@ -49,4 +49,4 @@ function decodeJwt(token) {
 
 //#endregion
 export { JwtVerifier, decodeJwt, isJwksConfig };
-//# sourceMappingURL=jwt-D88cPJyT.mjs.map
+//# sourceMappingURL=jwt-bZR2_t8F.mjs.map

package/dist/{jwt-D88cPJyT.mjs.map → jwt-bZR2_t8F.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"jwt-D88cPJyT.mjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}
+{"version":3,"file":"jwt-bZR2_t8F.mjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}

package/dist/{jwt-Bo_eACEi.cjs → jwt-clq6I6vG.cjs}

@@ -67,4 +67,4 @@ Object.defineProperty(exports, 'isJwksConfig', {
     return isJwksConfig;
   }
 });
-//# sourceMappingURL=jwt-Bo_eACEi.cjs.map
+//# sourceMappingURL=jwt-clq6I6vG.cjs.map

package/dist/{jwt-Bo_eACEi.cjs.map → jwt-clq6I6vG.cjs.map}

@@ -1 +1 @@
-{"version":3,"file":"jwt-Bo_eACEi.cjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}
+{"version":3,"file":"jwt-clq6I6vG.cjs","names":["config: JwtConfig","token: string","payload"],"sources":["../src/jwt.ts"],"sourcesContent":["import * as jose from 'jose';\n\n/**\n * Standard JWT claims\n */\nexport interface JwtClaims {\n\tsub?: string;\n\tiss?: string;\n\taud?: string | string[];\n\texp?: number;\n\tiat?: number;\n\tnbf?: number;\n\tjti?: string;\n}\n\n/**\n * Configuration for JWT verification with a symmetric secret\n */\nexport interface JwtSecretConfig {\n\tsecret: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\n/**\n * Configuration for JWT verification with JWKS\n */\nexport interface JwtJwksConfig {\n\tjwksUri: string;\n\tissuer?: string;\n\taudience?: string | string[];\n\talgorithms?: string[];\n}\n\nexport type JwtConfig = JwtSecretConfig | JwtJwksConfig;\n\n/**\n * Options for token extraction from requests\n */\nexport interface TokenExtractionOptions {\n\theaderName?: string;\n\tcookieName?: string;\n\ttokenPrefix?: string;\n}\n\nexport function isJwksConfig(config: JwtConfig): config is JwtJwksConfig {\n\treturn 'jwksUri' in config;\n}\n\n/**\n * JWT Verifier with JWKS caching\n */\nexport class JwtVerifier<TClaims extends JwtClaims = JwtClaims> {\n\tprivate jwks: jose.JWTVerifyGetKey | null = null;\n\tprivate readonly verifyOptions: jose.JWTVerifyOptions;\n\n\tconstructor(private readonly config: JwtConfig) {\n\t\tthis.verifyOptions = {\n\t\t\tissuer: config.issuer,\n\t\t\taudience: config.audience,\n\t\t\talgorithms:\n\t\t\t\tconfig.algorithms ?? (isJwksConfig(config) ? undefined : ['HS256']),\n\t\t};\n\t}\n\n\tasync verify(token: string): Promise<TClaims> {\n\t\tif (isJwksConfig(this.config)) {\n\t\t\tif (!this.jwks) {\n\t\t\t\tthis.jwks = jose.createRemoteJWKSet(new URL(this.config.jwksUri));\n\t\t\t}\n\t\t\tconst { payload } = await jose.jwtVerify(\n\t\t\t\ttoken,\n\t\t\t\tthis.jwks,\n\t\t\t\tthis.verifyOptions,\n\t\t\t);\n\t\t\treturn payload as unknown as TClaims;\n\t\t}\n\n\t\tconst secret = new TextEncoder().encode(this.config.secret);\n\t\tconst { payload } = await jose.jwtVerify(token, secret, this.verifyOptions);\n\t\treturn payload as unknown as TClaims;\n\t}\n\n\tasync verifyOrNull(token: string): Promise<TClaims | null> {\n\t\ttry {\n\t\t\treturn await this.verify(token);\n\t\t} catch {\n\t\t\treturn null;\n\t\t}\n\t}\n\n\tclearCache(): void {\n\t\tthis.jwks = null;\n\t}\n}\n\n/**\n * Decode a JWT without verification\n * WARNING: This does NOT verify the token signature!\n */\nexport function decodeJwt<TClaims extends JwtClaims = JwtClaims>(\n\ttoken: string,\n): TClaims {\n\treturn jose.decodeJwt(token) as unknown as TClaims;\n}\n"],"mappings":";;;;AA8CA,SAAgB,aAAaA,QAA4C;AACxE,QAAO,aAAa;AACpB;;;;AAKD,IAAa,cAAb,MAAgE;CAC/D,AAAQ,OAAoC;CAC5C,AAAiB;CAEjB,YAA6BA,QAAmB;EAAnB;AAC5B,OAAK,gBAAgB;GACpB,QAAQ,OAAO;GACf,UAAU,OAAO;GACjB,YACC,OAAO,eAAe,aAAa,OAAO,YAAe,CAAC,OAAQ;EACnE;CACD;CAED,MAAM,OAAOC,OAAiC;AAC7C,MAAI,aAAa,KAAK,OAAO,EAAE;AAC9B,QAAK,KAAK,KACT,MAAK,OAAO,KAAK,mBAAmB,IAAI,IAAI,KAAK,OAAO,SAAS;GAElE,MAAM,EAAE,oBAAS,GAAG,MAAM,KAAK,UAC9B,OACA,KAAK,MACL,KAAK,cACL;AACD,UAAOC;EACP;EAED,MAAM,SAAS,IAAI,cAAc,OAAO,KAAK,OAAO,OAAO;EAC3D,MAAM,EAAE,SAAS,GAAG,MAAM,KAAK,UAAU,OAAO,QAAQ,KAAK,cAAc;AAC3E,SAAO;CACP;CAED,MAAM,aAAaD,OAAwC;AAC1D,MAAI;AACH,UAAO,MAAM,KAAK,OAAO,MAAM;EAC/B,QAAO;AACP,UAAO;EACP;CACD;CAED,aAAmB;AAClB,OAAK,OAAO;CACZ;AACD;;;;;AAMD,SAAgB,UACfA,OACU;AACV,QAAO,KAAK,UAAU,MAAM;AAC5B"}

package/dist/{jwt-BqLlRkw-.d.mts → jwt-kejix7rd.d.mts}

@@ -59,4 +59,4 @@ declare function decodeJwt<TClaims extends JwtClaims = JwtClaims>(token: string)
 //# sourceMappingURL=jwt.d.ts.map
 //#endregion
 export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };
-//# sourceMappingURL=jwt-BqLlRkw-.d.mts.map
+//# sourceMappingURL=jwt-kejix7rd.d.mts.map

package/dist/{jwt-BqLlRkw-.d.mts.map → jwt-kejix7rd.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"jwt-BqLlRkw-.d.mts","names":[],"sources":["../src/jwt.ts"],"sourcesContent":[],"mappings":";;AAKA;AAaA;AAUiB,UAvBA,SAAA,CAuBa;EAOlB,GAAA,CAAA,EAAA,MAAS;EAAA,GAAA,CAAA,EAAA,MAAA;EAAA,GAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAe,GAAG,CAAA,EAAA,MAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EAKtC,GAAA,CAAA,EAAA,MAAA;EAMD,GAAA,CAAA,EAAA,MAAA;;;;AAAwD;AAO3D,UAnCI,eAAA,CAmCO;EAAA,MAAA,EAAA,MAAA;EAAA,MAAiB,CAAA,EAAA,MAAA;EAAS,QAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAIxB,CAAA,EAAA,MAAA,EAAA;;;;;AA2BK,UAxD1B,aAAA,CAwD0B;EAiB3B,OAAA,EAAA,MAAS;EAAA,MAAA,CAAA,EAAA,MAAA;EAAA,QAAiB,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAAG,CAAA,EAAA,MAAA,EAAA;;AAE5C,KApEE,SAAA,GAAY,eAoEd,GApEgC,aAoEhC;;;;UA/DO,sBAAA;;;;;iBAMD,YAAA,SAAqB,sBAAsB;;;;cAO9C,4BAA4B,YAAY;;;;sBAIf;yBASR,QAAQ;+BAkBF,QAAQ;;;;;;;iBAiB5B,0BAA0B,YAAY,2BAEnD"}
+{"version":3,"file":"jwt-kejix7rd.d.mts","names":[],"sources":["../src/jwt.ts"],"sourcesContent":[],"mappings":";;AAKA;AAaA;AAUiB,UAvBA,SAAA,CAuBa;EAOlB,GAAA,CAAA,EAAA,MAAS;EAAA,GAAA,CAAA,EAAA,MAAA;EAAA,GAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAe,GAAG,CAAA,EAAA,MAAA;EAAa,GAAA,CAAA,EAAA,MAAA;EAKtC,GAAA,CAAA,EAAA,MAAA;EAMD,GAAA,CAAA,EAAA,MAAA;;;;AAAwD;AAO3D,UAnCI,eAAA,CAmCO;EAAA,MAAA,EAAA,MAAA;EAAA,MAAiB,CAAA,EAAA,MAAA;EAAS,QAAG,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAIxB,CAAA,EAAA,MAAA,EAAA;;;;;AA2BK,UAxD1B,aAAA,CAwD0B;EAiB3B,OAAA,EAAA,MAAS;EAAA,MAAA,CAAA,EAAA,MAAA;EAAA,QAAiB,CAAA,EAAA,MAAA,GAAA,MAAA,EAAA;EAAS,UAAG,CAAA,EAAA,MAAA,EAAA;;AAE5C,KApEE,SAAA,GAAY,eAoEd,GApEgC,aAoEhC;;;;UA/DO,sBAAA;;;;;iBAMD,YAAA,SAAqB,sBAAsB;;;;cAO9C,4BAA4B,YAAY;;;;sBAIf;yBASR,QAAQ;+BAkBF,QAAQ;;;;;;;iBAiB5B,0BAA0B,YAAY,2BAEnD"}

package/dist/jwt.cjs

@@ -1,4 +1,4 @@
-const require_jwt = require('./jwt-Bo_eACEi.cjs');
+const require_jwt = require('./jwt-clq6I6vG.cjs');
 
 exports.JwtVerifier = require_jwt.JwtVerifier;
 exports.decodeJwt = require_jwt.decodeJwt;

package/dist/jwt.d.mts

@@ -1,2 +1,2 @@
-import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-BqLlRkw-.mjs";
+import { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig } from "./jwt-kejix7rd.mjs";
 export { JwtClaims, JwtConfig, JwtJwksConfig, JwtSecretConfig, JwtVerifier, TokenExtractionOptions, decodeJwt, isJwksConfig };

package/dist/jwt.mjs

@@ -1,3 +1,3 @@
-import { JwtVerifier, decodeJwt, isJwksConfig } from "./jwt-D88cPJyT.mjs";
+import { JwtVerifier, decodeJwt, isJwksConfig } from "./jwt-bZR2_t8F.mjs";
 
 export { JwtVerifier, decodeJwt, isJwksConfig };

package/dist/lambda/jwt.cjs

@@ -1,4 +1,5 @@
-const require_jwt = require('../jwt-Bo_eACEi.cjs');
+const require_cookies = require('../cookies-Bc6gUjb6.cjs');
+const require_jwt = require('../jwt-clq6I6vG.cjs');
 
 //#region src/lambda/jwt.ts
 function generatePolicy(principalId, effect, resource, context) {
@@ -93,9 +94,8 @@ var JwtAuthorizer = class {
 				}
 			}
 			if (cookieName) {
-				const cookieHeader = headers.cookie ?? headers.Cookie ?? "";
-				const match = cookieHeader.match(new RegExp(`${cookieName}=([^;]+)`));
-				if (match?.[1]) return match[1];
+				const cookie = require_cookies.readCookie(headers.cookie ?? headers.Cookie, cookieName);
+				if (cookie) return cookie;
 			}
 			return null;
 		};
@@ -122,5 +122,4 @@ var JwtAuthorizer = class {
 
 //#endregion
 exports.JwtAuthorizer = JwtAuthorizer;
-exports.JwtVerifier = require_jwt.JwtVerifier;
 //# sourceMappingURL=jwt.cjs.map