@godxjp/server-sdk 0.1.0

package/dist/chunk-DMXYEWYY.js

@@ -0,0 +1,132 @@
+// src/http.ts
+import { createRemoteJWKSet } from "jose";
+var GodxHttpError = class extends Error {
+  status;
+  body;
+  constructor(status, body, message) {
+    super(message ?? `GoDX platform request failed with ${status}`);
+    this.name = "GodxHttpError";
+    this.status = status;
+    this.body = body;
+  }
+};
+var issuerCache = /* @__PURE__ */ new Map();
+function loadIssuer(issuerUrl) {
+  let cached = issuerCache.get(issuerUrl);
+  if (!cached) {
+    cached = (async () => {
+      const res = await fetch(new URL("/.well-known/openid-configuration", issuerUrl));
+      if (!res.ok) {
+        issuerCache.delete(issuerUrl);
+        throw new GodxHttpError(res.status, await res.text(), "OIDC discovery failed");
+      }
+      const metadata = await res.json();
+      return { metadata, jwks: createRemoteJWKSet(new URL(metadata.jwks_uri)) };
+    })();
+    issuerCache.set(issuerUrl, cached);
+    cached.catch(() => issuerCache.delete(issuerUrl));
+  }
+  return cached;
+}
+var GodxSsoClient = class {
+  config;
+  constructor(config) {
+    this.config = config;
+  }
+  async authorizeUrl(params) {
+    const { metadata } = await loadIssuer(this.config.issuer);
+    const url = new URL(metadata.authorization_endpoint);
+    url.search = new URLSearchParams({
+      service_slug: this.config.serviceSlug,
+      client_id: this.config.clientId,
+      redirect_uri: this.config.redirectUri,
+      response_type: "code",
+      scope: params.scope ?? "openid profile email",
+      state: params.state,
+      nonce: params.nonce,
+      code_challenge: params.codeChallenge,
+      code_challenge_method: "S256",
+      ...params.organizationContextId ? { organization_context_id: params.organizationContextId } : {}
+    }).toString();
+    return url.toString();
+  }
+  async exchangeCode(params) {
+    return this.tokenRequest("token_endpoint", {
+      grant_type: "authorization_code",
+      redirect_uri: this.config.redirectUri,
+      code: params.code,
+      code_verifier: params.codeVerifier
+    });
+  }
+  async refresh(refreshToken) {
+    const { metadata } = await loadIssuer(this.config.issuer);
+    return this.postForm(new URL("/api/sso/refresh", metadata.issuer).toString(), {
+      grant_type: "refresh_token",
+      refresh_token: refreshToken
+    });
+  }
+  /** Best-effort revocation; failures are the caller's decision to ignore. */
+  async revoke(token) {
+    const { metadata } = await loadIssuer(this.config.issuer);
+    if (!metadata.revocation_endpoint) return;
+    await this.postForm(metadata.revocation_endpoint, { token });
+  }
+  async userinfo(accessToken) {
+    const { metadata } = await loadIssuer(this.config.issuer);
+    const res = await fetch(metadata.userinfo_endpoint, {
+      headers: { Authorization: `Bearer ${accessToken}` }
+    });
+    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), "userinfo failed");
+    return await res.json();
+  }
+  async tokenRequest(endpoint, fields) {
+    const { metadata } = await loadIssuer(this.config.issuer);
+    return this.postForm(metadata[endpoint], fields);
+  }
+  async postForm(url, fields) {
+    const body = new URLSearchParams({
+      service_slug: this.config.serviceSlug,
+      client_id: this.config.clientId,
+      ...this.config.clientSecret ? { client_secret: this.config.clientSecret } : {},
+      ...fields
+    });
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/x-www-form-urlencoded" },
+      body
+    });
+    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), "token request failed");
+    return await res.json();
+  }
+};
+function createServiceApi(config) {
+  const get = async (path, query) => {
+    const url = new URL(path, config.issuer);
+    url.search = new URLSearchParams(query).toString();
+    const res = await fetch(url, {
+      headers: {
+        "X-Service-Slug": config.serviceSlug,
+        "X-Service-Secret": config.serviceSecret
+      }
+    });
+    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), `service API ${path} failed`);
+    return await res.json();
+  };
+  return {
+    users: (q) => get("/api/sso/service/users", {
+      organization_slug: q.organizationSlug,
+      ...q.perPage ? { per_page: String(q.perPage) } : {},
+      ...q.page ? { page: String(q.page) } : {}
+    }),
+    branches: (q) => get("/api/sso/service/branches", { organization_slug: q.organizationSlug }),
+    brands: (q) => get("/api/sso/service/brands", { organization_slug: q.organizationSlug })
+  };
+}
+
+export {
+  GodxHttpError,
+  loadIssuer,
+  GodxSsoClient,
+  createServiceApi
+};
+//# sourceMappingURL=chunk-DMXYEWYY.js.map

package/dist/chunk-DMXYEWYY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/http.ts"],"sourcesContent":["/**\n * ./http — endpoint contract from OIDC discovery, the SSO client, and the\n * server-to-server service API. Runtime-agnostic: fetch + WebCrypto only.\n * Mirrors php-sdk's Http module boundary.\n */\nimport { createRemoteJWKSet } from \"jose\";\n\nexport interface IssuerMetadata {\n  issuer: string;\n  authorization_endpoint: string;\n  token_endpoint: string;\n  userinfo_endpoint: string;\n  jwks_uri: string;\n  end_session_endpoint?: string;\n  revocation_endpoint?: string;\n}\n\nexport interface Issuer {\n  metadata: IssuerMetadata;\n  jwks: ReturnType<typeof createRemoteJWKSet>;\n}\n\nexport class GodxHttpError extends Error {\n  readonly status: number;\n  readonly body: string;\n\n  constructor(status: number, body: string, message?: string) {\n    super(message ?? `GoDX platform request failed with ${status}`);\n    this.name = \"GodxHttpError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\n// Per-isolate cache; the platform docs require reading discovery, not hardcoding paths.\nconst issuerCache = new Map<string, Promise<Issuer>>();\n\nexport function loadIssuer(issuerUrl: string): Promise<Issuer> {\n  let cached = issuerCache.get(issuerUrl);\n  if (!cached) {\n    cached = (async () => {\n      const res = await fetch(new URL(\"/.well-known/openid-configuration\", issuerUrl));\n      if (!res.ok) {\n        issuerCache.delete(issuerUrl);\n        throw new GodxHttpError(res.status, await res.text(), \"OIDC discovery failed\");\n      }\n      const metadata = (await res.json()) as IssuerMetadata;\n      return { metadata, jwks: createRemoteJWKSet(new URL(metadata.jwks_uri)) };\n    })();\n    issuerCache.set(issuerUrl, cached);\n    cached.catch(() => issuerCache.delete(issuerUrl));\n  }\n  return cached;\n}\n\nexport interface SsoClientConfig {\n  issuer: string;\n  serviceSlug: string;\n  clientId: string;\n  /** Omit for a public (secretless) instance — PKCE alone then. */\n  clientSecret?: string;\n  redirectUri: string;\n}\n\nexport interface TokenResponse {\n  access_token: string;\n  token_type: string;\n  expires_in: number;\n  id_token?: string;\n  refresh_token?: string;\n  scope?: string;\n}\n\nexport interface UserinfoResponse {\n  sub: string;\n  email?: string;\n  email_verified?: boolean;\n  name?: string;\n  locale?: string;\n  timezone?: string;\n}\n\nexport class GodxSsoClient {\n  readonly config: SsoClientConfig;\n\n  constructor(config: SsoClientConfig) {\n    this.config = config;\n  }\n\n  async authorizeUrl(params: {\n    state: string;\n    nonce: string;\n    codeChallenge: string;\n    scope?: string;\n    /** console_organization_id — required by the launch gates; usually arrives on the launch URL. */\n    organizationContextId?: string;\n  }): Promise<string> {\n    const { metadata } = await loadIssuer(this.config.issuer);\n    const url = new URL(metadata.authorization_endpoint);\n    url.search = new URLSearchParams({\n      service_slug: this.config.serviceSlug,\n      client_id: this.config.clientId,\n      redirect_uri: this.config.redirectUri,\n      response_type: \"code\",\n      scope: params.scope ?? \"openid profile email\",\n      state: params.state,\n      nonce: params.nonce,\n      code_challenge: params.codeChallenge,\n      code_challenge_method: \"S256\",\n      ...(params.organizationContextId\n        ? { organization_context_id: params.organizationContextId }\n        : {}),\n    }).toString();\n    return url.toString();\n  }\n\n  async exchangeCode(params: { code: string; codeVerifier: string }): Promise<TokenResponse> {\n    return this.tokenRequest(\"token_endpoint\", {\n      grant_type: \"authorization_code\",\n      redirect_uri: this.config.redirectUri,\n      code: params.code,\n      code_verifier: params.codeVerifier,\n    });\n  }\n\n  async refresh(refreshToken: string): Promise<TokenResponse> {\n    const { metadata } = await loadIssuer(this.config.issuer);\n    return this.postForm(new URL(\"/api/sso/refresh\", metadata.issuer).toString(), {\n      grant_type: \"refresh_token\",\n      refresh_token: refreshToken,\n    });\n  }\n\n  /** Best-effort revocation; failures are the caller's decision to ignore. */\n  async revoke(token: string): Promise<void> {\n    const { metadata } = await loadIssuer(this.config.issuer);\n    if (!metadata.revocation_endpoint) return;\n    await this.postForm(metadata.revocation_endpoint, { token });\n  }\n\n  async userinfo(accessToken: string): Promise<UserinfoResponse> {\n    const { metadata } = await loadIssuer(this.config.issuer);\n    const res = await fetch(metadata.userinfo_endpoint, {\n      headers: { Authorization: `Bearer ${accessToken}` },\n    });\n    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), \"userinfo failed\");\n    return (await res.json()) as UserinfoResponse;\n  }\n\n  private async tokenRequest(\n    endpoint: \"token_endpoint\",\n    fields: Record<string, string>,\n  ): Promise<TokenResponse> {\n    const { metadata } = await loadIssuer(this.config.issuer);\n    return this.postForm(metadata[endpoint], fields);\n  }\n\n  private async postForm(url: string, fields: Record<string, string>): Promise<TokenResponse> {\n    const body = new URLSearchParams({\n      service_slug: this.config.serviceSlug,\n      client_id: this.config.clientId,\n      ...(this.config.clientSecret ? { client_secret: this.config.clientSecret } : {}),\n      ...fields,\n    });\n    const res = await fetch(url, {\n      method: \"POST\",\n      headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n      body,\n    });\n    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), \"token request failed\");\n    return (await res.json()) as TokenResponse;\n  }\n}\n\n/**\n * Server-to-server reads with service credentials (X-Service-Slug/X-Service-Secret).\n * Rate-limited by the platform (429) — cache results and back off; no auto-retry here.\n */\nexport function createServiceApi(config: {\n  issuer: string;\n  serviceSlug: string;\n  serviceSecret: string;\n}) {\n  const get = async <T>(path: string, query: Record<string, string>): Promise<T> => {\n    const url = new URL(path, config.issuer);\n    url.search = new URLSearchParams(query).toString();\n    const res = await fetch(url, {\n      headers: {\n        \"X-Service-Slug\": config.serviceSlug,\n        \"X-Service-Secret\": config.serviceSecret,\n      },\n    });\n    if (!res.ok) throw new GodxHttpError(res.status, await res.text(), `service API ${path} failed`);\n    return (await res.json()) as T;\n  };\n\n  return {\n    users: (q: { organizationSlug: string; perPage?: number; page?: number }) =>\n      get<unknown>(\"/api/sso/service/users\", {\n        organization_slug: q.organizationSlug,\n        ...(q.perPage ? { per_page: String(q.perPage) } : {}),\n        ...(q.page ? { page: String(q.page) } : {}),\n      }),\n    branches: (q: { organizationSlug: string }) =>\n      get<unknown>(\"/api/sso/service/branches\", { organization_slug: q.organizationSlug }),\n    brands: (q: { organizationSlug: string }) =>\n      get<unknown>(\"/api/sso/service/brands\", { organization_slug: q.organizationSlug }),\n  };\n}\n"],"mappings":";AAKA,SAAS,0BAA0B;AAiB5B,IAAM,gBAAN,cAA4B,MAAM;AAAA,EAC9B;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,MAAc,SAAkB;AAC1D,UAAM,WAAW,qCAAqC,MAAM,EAAE;AAC9D,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,cAAc,oBAAI,IAA6B;AAE9C,SAAS,WAAW,WAAoC;AAC7D,MAAI,SAAS,YAAY,IAAI,SAAS;AACtC,MAAI,CAAC,QAAQ;AACX,cAAU,YAAY;AACpB,YAAM,MAAM,MAAM,MAAM,IAAI,IAAI,qCAAqC,SAAS,CAAC;AAC/E,UAAI,CAAC,IAAI,IAAI;AACX,oBAAY,OAAO,SAAS;AAC5B,cAAM,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,KAAK,GAAG,uBAAuB;AAAA,MAC/E;AACA,YAAM,WAAY,MAAM,IAAI,KAAK;AACjC,aAAO,EAAE,UAAU,MAAM,mBAAmB,IAAI,IAAI,SAAS,QAAQ,CAAC,EAAE;AAAA,IAC1E,GAAG;AACH,gBAAY,IAAI,WAAW,MAAM;AACjC,WAAO,MAAM,MAAM,YAAY,OAAO,SAAS,CAAC;AAAA,EAClD;AACA,SAAO;AACT;AA6BO,IAAM,gBAAN,MAAoB;AAAA,EAChB;AAAA,EAET,YAAY,QAAyB;AACnC,SAAK,SAAS;AAAA,EAChB;AAAA,EAEA,MAAM,aAAa,QAOC;AAClB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,KAAK,OAAO,MAAM;AACxD,UAAM,MAAM,IAAI,IAAI,SAAS,sBAAsB;AACnD,QAAI,SAAS,IAAI,gBAAgB;AAAA,MAC/B,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO;AAAA,MACvB,cAAc,KAAK,OAAO;AAAA,MAC1B,eAAe;AAAA,MACf,OAAO,OAAO,SAAS;AAAA,MACvB,OAAO,OAAO;AAAA,MACd,OAAO,OAAO;AAAA,MACd,gBAAgB,OAAO;AAAA,MACvB,uBAAuB;AAAA,MACvB,GAAI,OAAO,wBACP,EAAE,yBAAyB,OAAO,sBAAsB,IACxD,CAAC;AAAA,IACP,CAAC,EAAE,SAAS;AACZ,WAAO,IAAI,SAAS;AAAA,EACtB;AAAA,EAEA,MAAM,aAAa,QAAwE;AACzF,WAAO,KAAK,aAAa,kBAAkB;AAAA,MACzC,YAAY;AAAA,MACZ,cAAc,KAAK,OAAO;AAAA,MAC1B,MAAM,OAAO;AAAA,MACb,eAAe,OAAO;AAAA,IACxB,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,QAAQ,cAA8C;AAC1D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,KAAK,OAAO,MAAM;AACxD,WAAO,KAAK,SAAS,IAAI,IAAI,oBAAoB,SAAS,MAAM,EAAE,SAAS,GAAG;AAAA,MAC5E,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,OAAO,OAA8B;AACzC,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,KAAK,OAAO,MAAM;AACxD,QAAI,CAAC,SAAS,oBAAqB;AACnC,UAAM,KAAK,SAAS,SAAS,qBAAqB,EAAE,MAAM,CAAC;AAAA,EAC7D;AAAA,EAEA,MAAM,SAAS,aAAgD;AAC7D,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,KAAK,OAAO,MAAM;AACxD,UAAM,MAAM,MAAM,MAAM,SAAS,mBAAmB;AAAA,MAClD,SAAS,EAAE,eAAe,UAAU,WAAW,GAAG;AAAA,IACpD,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,KAAK,GAAG,iBAAiB;AACpF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,MAAc,aACZ,UACA,QACwB;AACxB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,KAAK,OAAO,MAAM;AACxD,WAAO,KAAK,SAAS,SAAS,QAAQ,GAAG,MAAM;AAAA,EACjD;AAAA,EAEA,MAAc,SAAS,KAAa,QAAwD;AAC1F,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,cAAc,KAAK,OAAO;AAAA,MAC1B,WAAW,KAAK,OAAO;AAAA,MACvB,GAAI,KAAK,OAAO,eAAe,EAAE,eAAe,KAAK,OAAO,aAAa,IAAI,CAAC;AAAA,MAC9E,GAAG;AAAA,IACL,CAAC;AACD,UAAM,MAAM,MAAM,MAAM,KAAK;AAAA,MAC3B,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D;AAAA,IACF,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,KAAK,GAAG,sBAAsB;AACzF,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AACF;AAMO,SAAS,iBAAiB,QAI9B;AACD,QAAM,MAAM,OAAU,MAAc,UAA8C;AAChF,UAAM,MAAM,IAAI,IAAI,MAAM,OAAO,MAAM;AACvC,QAAI,SAAS,IAAI,gBAAgB,KAAK,EAAE,SAAS;AACjD,UAAM,MAAM,MAAM,MAAM,KAAK;AAAA,MAC3B,SAAS;AAAA,QACP,kBAAkB,OAAO;AAAA,QACzB,oBAAoB,OAAO;AAAA,MAC7B;AAAA,IACF,CAAC;AACD,QAAI,CAAC,IAAI,GAAI,OAAM,IAAI,cAAc,IAAI,QAAQ,MAAM,IAAI,KAAK,GAAG,eAAe,IAAI,SAAS;AAC/F,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,MACN,IAAa,0BAA0B;AAAA,MACrC,mBAAmB,EAAE;AAAA,MACrB,GAAI,EAAE,UAAU,EAAE,UAAU,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,MACnD,GAAI,EAAE,OAAO,EAAE,MAAM,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC;AAAA,IAC3C,CAAC;AAAA,IACH,UAAU,CAAC,MACT,IAAa,6BAA6B,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;AAAA,IACrF,QAAQ,CAAC,MACP,IAAa,2BAA2B,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;AAAA,EACrF;AACF;","names":[]}

package/dist/chunk-GPGSVZCR.js

@@ -0,0 +1,87 @@
+import {
+  loadIssuer
+} from "./chunk-DMXYEWYY.js";
+
+// src/auth.ts
+import { EncryptJWT, jwtDecrypt, jwtVerify } from "jose";
+async function verifyAccessToken(token, opts) {
+  const expectedAudience = opts.audience ?? opts.serviceSlug;
+  const { metadata, jwks } = await loadIssuer(opts.issuer);
+  let payload;
+  try {
+    ({ payload } = await jwtVerify(token, jwks, {
+      issuer: metadata.issuer,
+      audience: expectedAudience
+    }));
+  } catch (e) {
+    const actual = decodeUnverified(token);
+    throw new Error(
+      `${e instanceof Error ? e.message : String(e)} \u2014 expected iss="${metadata.issuer}" aud="${expectedAudience}", token carries iss="${String(actual?.iss ?? "?")}" aud=${JSON.stringify(actual?.aud ?? "?")}`,
+      { cause: e }
+    );
+  }
+  const organizationId = payload["organization_id"];
+  if (typeof organizationId !== "string" || organizationId === "") {
+    throw new Error("access token has no organization_id claim");
+  }
+  if (typeof payload.sub !== "string" || typeof payload.exp !== "number") {
+    throw new Error("access token is missing sub/exp");
+  }
+  return Object.freeze({
+    sub: payload.sub,
+    organizationId,
+    accessMode: payload["organization_access_mode"] === "full" ? "full" : "read_only",
+    scopes: Object.freeze(String(payload["scope"] ?? "").split(" ").filter(Boolean)),
+    serviceInstanceId: typeof payload["service_instance_id"] === "string" ? payload["service_instance_id"] : void 0,
+    clientId: typeof payload["client_id"] === "string" ? payload["client_id"] : void 0,
+    expiresAt: payload.exp
+  });
+}
+async function createPkce() {
+  const verifier = randomToken(32);
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return { verifier, challenge: base64url(new Uint8Array(digest)), method: "S256" };
+}
+function randomToken(bytes = 16) {
+  const buf = new Uint8Array(bytes);
+  crypto.getRandomValues(buf);
+  return base64url(buf);
+}
+function decodeUnverified(token) {
+  try {
+    const part = token.split(".")[1] ?? "";
+    const pad = part.replace(/-/g, "+").replace(/_/g, "/");
+    return JSON.parse(atob(pad));
+  } catch {
+    return null;
+  }
+}
+function base64url(bytes) {
+  let bin = "";
+  for (const b of bytes) bin += String.fromCharCode(b);
+  return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+async function sessionKey(secret) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(secret));
+  return new Uint8Array(digest);
+}
+async function sealData(payload, secret, ttlSeconds) {
+  return new EncryptJWT(payload).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(Math.floor(Date.now() / 1e3) + ttlSeconds).encrypt(await sessionKey(secret));
+}
+async function openData(token, secret) {
+  try {
+    const { payload } = await jwtDecrypt(token, await sessionKey(secret));
+    return payload;
+  } catch {
+    return null;
+  }
+}
+
+export {
+  verifyAccessToken,
+  createPkce,
+  randomToken,
+  sealData,
+  openData
+};
+//# sourceMappingURL=chunk-GPGSVZCR.js.map

package/dist/chunk-GPGSVZCR.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/auth.ts"],"sourcesContent":["/**\n * ./auth — verified immutable Principal, PKCE, and sealed session values.\n * Mirrors php-sdk's Auth module: the Principal only comes out of one parse\n * gate (verifyAccessToken) and is frozen after that.\n */\nimport { EncryptJWT, jwtDecrypt, jwtVerify } from \"jose\";\nimport { loadIssuer } from \"./http\";\n\nexport interface Principal {\n  readonly sub: string;\n  readonly organizationId: string;\n  /** Defaults to read_only unless the claim says full — fail closed. */\n  readonly accessMode: \"full\" | \"read_only\";\n  readonly scopes: readonly string[];\n  readonly serviceInstanceId?: string;\n  readonly clientId?: string;\n  /** Unix seconds, from the access token's exp. */\n  readonly expiresAt: number;\n  /** From userinfo, when the adapter fetched it at login. */\n  readonly name?: string;\n  readonly email?: string;\n}\n\n/**\n * The one parse gate. Validates signature (JWKS), iss (discovery issuer,\n * exact), aud (= service slug), exp — then requires organization_id.\n */\nexport async function verifyAccessToken(\n  token: string,\n  opts: {\n    issuer: string;\n    serviceSlug: string;\n    /** The token audience = your ServiceInstance slug. Defaults to serviceSlug. */\n    audience?: string;\n  },\n): Promise<Principal> {\n  const expectedAudience = opts.audience ?? opts.serviceSlug;\n  const { metadata, jwks } = await loadIssuer(opts.issuer);\n  let payload;\n  try {\n    ({ payload } = await jwtVerify(token, jwks, {\n      issuer: metadata.issuer,\n      audience: expectedAudience,\n    }));\n  } catch (e) {\n    // Say what was expected vs what the token actually carries — a bare\n    // \"unexpected claim\" costs whoever reads it a debugging session.\n    const actual = decodeUnverified(token);\n    throw new Error(\n      `${e instanceof Error ? e.message : String(e)} — expected iss=\"${metadata.issuer}\" aud=\"${expectedAudience}\", ` +\n        `token carries iss=\"${String(actual?.iss ?? \"?\")}\" aud=${JSON.stringify(actual?.aud ?? \"?\")}`,\n      { cause: e },\n    );\n  }\n\n  const organizationId = payload[\"organization_id\"];\n  if (typeof organizationId !== \"string\" || organizationId === \"\") {\n    throw new Error(\"access token has no organization_id claim\");\n  }\n  if (typeof payload.sub !== \"string\" || typeof payload.exp !== \"number\") {\n    throw new Error(\"access token is missing sub/exp\");\n  }\n\n  return Object.freeze({\n    sub: payload.sub,\n    organizationId,\n    accessMode: payload[\"organization_access_mode\"] === \"full\" ? \"full\" : \"read_only\",\n    scopes: Object.freeze(String(payload[\"scope\"] ?? \"\").split(\" \").filter(Boolean)),\n    serviceInstanceId: typeof payload[\"service_instance_id\"] === \"string\" ? payload[\"service_instance_id\"] : undefined,\n    clientId: typeof payload[\"client_id\"] === \"string\" ? payload[\"client_id\"] : undefined,\n    expiresAt: payload.exp,\n  } satisfies Principal);\n}\n\nexport interface Pkce {\n  verifier: string;\n  challenge: string;\n  method: \"S256\";\n}\n\nexport async function createPkce(): Promise<Pkce> {\n  const verifier = randomToken(32);\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(verifier));\n  return { verifier, challenge: base64url(new Uint8Array(digest)), method: \"S256\" };\n}\n\nexport function randomToken(bytes = 16): string {\n  const buf = new Uint8Array(bytes);\n  crypto.getRandomValues(buf);\n  return base64url(buf);\n}\n\n/** Diagnostics only — an UNVERIFIED read of the payload for error messages. */\nfunction decodeUnverified(token: string): Record<string, unknown> | null {\n  try {\n    const part = token.split(\".\")[1] ?? \"\";\n    const pad = part.replace(/-/g, \"+\").replace(/_/g, \"/\");\n    return JSON.parse(atob(pad)) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nfunction base64url(bytes: Uint8Array): string {\n  let bin = \"\";\n  for (const b of bytes) bin += String.fromCharCode(b);\n  return btoa(bin).replace(/\\+/g, \"-\").replace(/\\//g, \"_\").replace(/=+$/, \"\");\n}\n\nasync function sessionKey(secret: string): Promise<Uint8Array> {\n  const digest = await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(secret));\n  return new Uint8Array(digest);\n}\n\n/** Encrypt + sign an arbitrary payload into a compact cookie value (JWE dir/A256GCM). */\nexport async function sealData(\n  payload: Record<string, unknown>,\n  secret: string,\n  ttlSeconds: number,\n): Promise<string> {\n  return new EncryptJWT(payload)\n    .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n    .setIssuedAt()\n    .setExpirationTime(Math.floor(Date.now() / 1000) + ttlSeconds)\n    .encrypt(await sessionKey(secret));\n}\n\n/** Returns null for anything invalid or expired — never throws on bad input. */\nexport async function openData<T = Record<string, unknown>>(\n  token: string,\n  secret: string,\n): Promise<T | null> {\n  try {\n    const { payload } = await jwtDecrypt(token, await sessionKey(secret));\n    return payload as T;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;AAKA,SAAS,YAAY,YAAY,iBAAiB;AAsBlD,eAAsB,kBACpB,OACA,MAMoB;AACpB,QAAM,mBAAmB,KAAK,YAAY,KAAK;AAC/C,QAAM,EAAE,UAAU,KAAK,IAAI,MAAM,WAAW,KAAK,MAAM;AACvD,MAAI;AACJ,MAAI;AACF,KAAC,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,MAAM;AAAA,MAC1C,QAAQ,SAAS;AAAA,MACjB,UAAU;AAAA,IACZ,CAAC;AAAA,EACH,SAAS,GAAG;AAGV,UAAM,SAAS,iBAAiB,KAAK;AACrC,UAAM,IAAI;AAAA,MACR,GAAG,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,yBAAoB,SAAS,MAAM,UAAU,gBAAgB,yBAClF,OAAO,QAAQ,OAAO,GAAG,CAAC,SAAS,KAAK,UAAU,QAAQ,OAAO,GAAG,CAAC;AAAA,MAC7F,EAAE,OAAO,EAAE;AAAA,IACb;AAAA,EACF;AAEA,QAAM,iBAAiB,QAAQ,iBAAiB;AAChD,MAAI,OAAO,mBAAmB,YAAY,mBAAmB,IAAI;AAC/D,UAAM,IAAI,MAAM,2CAA2C;AAAA,EAC7D;AACA,MAAI,OAAO,QAAQ,QAAQ,YAAY,OAAO,QAAQ,QAAQ,UAAU;AACtE,UAAM,IAAI,MAAM,iCAAiC;AAAA,EACnD;AAEA,SAAO,OAAO,OAAO;AAAA,IACnB,KAAK,QAAQ;AAAA,IACb;AAAA,IACA,YAAY,QAAQ,0BAA0B,MAAM,SAAS,SAAS;AAAA,IACtE,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,KAAK,EAAE,EAAE,MAAM,GAAG,EAAE,OAAO,OAAO,CAAC;AAAA,IAC/E,mBAAmB,OAAO,QAAQ,qBAAqB,MAAM,WAAW,QAAQ,qBAAqB,IAAI;AAAA,IACzG,UAAU,OAAO,QAAQ,WAAW,MAAM,WAAW,QAAQ,WAAW,IAAI;AAAA,IAC5E,WAAW,QAAQ;AAAA,EACrB,CAAqB;AACvB;AAQA,eAAsB,aAA4B;AAChD,QAAM,WAAW,YAAY,EAAE;AAC/B,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,QAAQ,CAAC;AACvF,SAAO,EAAE,UAAU,WAAW,UAAU,IAAI,WAAW,MAAM,CAAC,GAAG,QAAQ,OAAO;AAClF;AAEO,SAAS,YAAY,QAAQ,IAAY;AAC9C,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,UAAU,GAAG;AACtB;AAGA,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,KAAK;AACpC,UAAM,MAAM,KAAK,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACrD,WAAO,KAAK,MAAM,KAAK,GAAG,CAAC;AAAA,EAC7B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,OAA2B;AAC5C,MAAI,MAAM;AACV,aAAW,KAAK,MAAO,QAAO,OAAO,aAAa,CAAC;AACnD,SAAO,KAAK,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,GAAG,EAAE,QAAQ,OAAO,EAAE;AAC5E;AAEA,eAAe,WAAW,QAAqC;AAC7D,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI,YAAY,EAAE,OAAO,MAAM,CAAC;AACrF,SAAO,IAAI,WAAW,MAAM;AAC9B;AAGA,eAAsB,SACpB,SACA,QACA,YACiB;AACjB,SAAO,IAAI,WAAW,OAAO,EAC1B,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,IAAI,UAAU,EAC5D,QAAQ,MAAM,WAAW,MAAM,CAAC;AACrC;AAGA,eAAsB,SACpB,OACA,QACmB;AACnB,MAAI;AACF,UAAM,EAAE,QAAQ,IAAI,MAAM,WAAW,OAAO,MAAM,WAAW,MAAM,CAAC;AACpE,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/hono.d.ts

@@ -0,0 +1,35 @@
+import * as hono_types from 'hono/types';
+import { Env, Hono, MiddlewareHandler } from 'hono';
+import { Principal } from './auth.js';
+
+interface GodxSsoConfig {
+    issuer: string;
+    serviceSlug: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    sessionSecret: string;
+    scope?: string;
+    /** Token audience = your ServiceInstance slug (defaults to serviceSlug). */
+    audience?: string;
+    /**
+     * console_organization_id to fall back on when the login was not started
+     * from a platform launch URL (which carries organization_context_id).
+     * Useful in local dev; leave unset in production multi-org setups.
+     */
+    defaultOrganizationContextId?: string;
+}
+type GodxVariables = {
+    principal: Principal;
+    accessToken: string;
+};
+declare function godxSso<E extends Env & {
+    Variables: GodxVariables;
+}>(getConfig: (env: E["Bindings"]) => GodxSsoConfig): {
+    routes: Hono<E, hono_types.BlankSchema, "/">;
+    requireAuth: MiddlewareHandler<E>;
+    requireWritable: MiddlewareHandler<E>;
+    dockProxy: MiddlewareHandler<E>;
+};
+
+export { type GodxSsoConfig, type GodxVariables, godxSso };

package/dist/hono.js

@@ -0,0 +1,159 @@
+import {
+  createPkce,
+  openData,
+  randomToken,
+  sealData,
+  verifyAccessToken
+} from "./chunk-GPGSVZCR.js";
+import {
+  GodxSsoClient,
+  loadIssuer
+} from "./chunk-DMXYEWYY.js";
+
+// src/hono.ts
+import { Hono } from "hono";
+import { deleteCookie, getCookie, setCookie } from "hono/cookie";
+var TXN_COOKIE = "gx_txn";
+var SESSION_COOKIE = "gx_sess";
+function godxSso(getConfig) {
+  const client = (c) => new GodxSsoClient(getConfig(c.env));
+  const cfg = (c) => getConfig(c.env);
+  const secure = (c) => c.req.url.startsWith("https:");
+  const routes = new Hono();
+  routes.get("/login", async (c) => {
+    const config = cfg(c);
+    const pkce = await createPkce();
+    const state = randomToken();
+    const nonce = randomToken();
+    const organizationContextId = c.req.query("organization_context_id") ?? config.defaultOrganizationContextId;
+    setCookie(c, TXN_COOKIE, await sealData({ v: pkce.verifier, s: state }, config.sessionSecret, 300), {
+      httpOnly: true,
+      secure: secure(c),
+      sameSite: "Lax",
+      path: "/",
+      maxAge: 300
+    });
+    return c.redirect(
+      await client(c).authorizeUrl({
+        state,
+        nonce,
+        codeChallenge: pkce.challenge,
+        scope: config.scope,
+        organizationContextId
+      })
+    );
+  });
+  const failRedirect = (c, error, description) => c.redirect(
+    `/?sso_error=${encodeURIComponent(error)}&sso_error_description=${encodeURIComponent(description)}`
+  );
+  routes.get("/callback", async (c) => {
+    const config = cfg(c);
+    const platformError = c.req.query("error");
+    if (platformError) {
+      return failRedirect(
+        c,
+        platformError,
+        c.req.query("error_description") ?? `\u30B5\u30A4\u30F3\u30A4\u30F3\u304C\u62D2\u5426\u3055\u308C\u307E\u3057\u305F\uFF08${platformError}\uFF09\u3002`
+      );
+    }
+    const code = c.req.query("code");
+    const state = c.req.query("state");
+    const txnCookie = getCookie(c, TXN_COOKIE);
+    deleteCookie(c, TXN_COOKIE, { path: "/" });
+    const txn = txnCookie ? await openData(txnCookie, config.sessionSecret) : null;
+    if (!code || !state || !txn || txn.s !== state) {
+      return failRedirect(
+        c,
+        "transaction_invalid",
+        "\u30ED\u30B0\u30A4\u30F3\u51E6\u7406\u306E\u6709\u52B9\u671F\u9650\u304C\u5207\u308C\u305F\u304B\u3001\u9014\u4E2D\u3067\u4E2D\u65AD\u3055\u308C\u307E\u3057\u305F\u3002\u3082\u3046\u4E00\u5EA6\u30B5\u30A4\u30F3\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044\u3002"
+      );
+    }
+    let tokens;
+    try {
+      tokens = await client(c).exchangeCode({ code, codeVerifier: txn.v });
+    } catch (e) {
+      return failRedirect(
+        c,
+        "token_exchange_failed",
+        `\u8A8D\u53EF\u30B3\u30FC\u30C9\u306E\u4EA4\u63DB\u306B\u5931\u6557\u3057\u307E\u3057\u305F\uFF08\u8A8D\u53EF\u30B3\u30FC\u30C9\u306F\u4E00\u5EA6\u3057\u304B\u4F7F\u3048\u307E\u305B\u3093\uFF09\u3002\u3082\u3046\u4E00\u5EA6\u30B5\u30A4\u30F3\u30A4\u30F3\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u8A73\u7D30: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    let verified;
+    try {
+      verified = await verifyAccessToken(tokens.access_token, config);
+    } catch (e) {
+      return failRedirect(
+        c,
+        "token_verification_failed",
+        `\u30C8\u30FC\u30AF\u30F3\u306E\u691C\u8A3C\u306B\u5931\u6557\u3057\u307E\u3057\u305F\u3002\u30B5\u30FC\u30D3\u30B9\u8A2D\u5B9A\uFF08issuer / service_slug\uFF09\u3092\u78BA\u8A8D\u3057\u3066\u304F\u3060\u3055\u3044\u3002\u8A73\u7D30: ${e instanceof Error ? e.message : String(e)}`
+      );
+    }
+    let principal = verified;
+    try {
+      const info = await client(c).userinfo(tokens.access_token);
+      principal = Object.freeze({ ...verified, name: info.name, email: info.email });
+    } catch {
+    }
+    const ttl = Math.max(0, principal.expiresAt - Math.floor(Date.now() / 1e3));
+    setCookie(
+      c,
+      SESSION_COOKIE,
+      await sealData({ p: principal, at: tokens.access_token }, config.sessionSecret, ttl),
+      { httpOnly: true, secure: secure(c), sameSite: "Lax", path: "/", maxAge: ttl }
+    );
+    return c.redirect("/");
+  });
+  routes.get("/logout", async (c) => {
+    const config = cfg(c);
+    const raw = getCookie(c, SESSION_COOKIE);
+    deleteCookie(c, SESSION_COOKIE, { path: "/" });
+    if (raw) {
+      const session = await openData(raw, config.sessionSecret);
+      if (session) await client(c).revoke(session.at).catch(() => {
+      });
+    }
+    const { metadata } = await loadIssuer(config.issuer);
+    return c.redirect(metadata.end_session_endpoint ?? "/");
+  });
+  const requireAuth = async (c, next) => {
+    const raw = getCookie(c, SESSION_COOKIE);
+    const session = raw ? await openData(raw, cfg(c).sessionSecret) : null;
+    if (!session || session.p.expiresAt <= Math.floor(Date.now() / 1e3)) {
+      return c.json({ error: "unauthenticated" }, 401);
+    }
+    c.set("principal", session.p);
+    c.set("accessToken", session.at);
+    await next();
+  };
+  const dockProxy = async (c) => {
+    const config = cfg(c);
+    const url = new URL(c.req.url);
+    const target = new URL(url.pathname + url.search, config.issuer);
+    const method = c.req.method;
+    const res = await fetch(target, {
+      method,
+      headers: {
+        Authorization: `Bearer ${c.get("accessToken")}`,
+        Accept: "application/json",
+        "Content-Type": c.req.header("Content-Type") ?? "application/json"
+      },
+      body: method === "GET" || method === "HEAD" ? void 0 : await c.req.arrayBuffer()
+    });
+    const headers = new Headers({ "Content-Type": res.headers.get("Content-Type") ?? "application/json" });
+    const requestId = res.headers.get("X-Request-Id");
+    if (requestId) headers.set("X-Request-Id", requestId);
+    return new Response(res.body, { status: res.status, headers });
+  };
+  const requireWritable = async (c, next) => {
+    const safe = c.req.method === "GET" || c.req.method === "HEAD" || c.req.method === "OPTIONS";
+    if (!safe && c.get("principal")?.accessMode !== "full") {
+      return c.json({ error: "organization is read-only" }, 403);
+    }
+    await next();
+  };
+  return { routes, requireAuth, requireWritable, dockProxy };
+}
+export {
+  godxSso
+};
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts"],"sourcesContent":["/**\n * ./hono — thin adapter over ./auth + ./http for Hono apps on Workers.\n * Mounts the browser SSO routes and exposes the auth middlewares.\n * Everything platform-shaped stays in the core modules.\n */\nimport { Hono } from \"hono\";\nimport type { Context, Env as HonoEnv, MiddlewareHandler } from \"hono\";\nimport { deleteCookie, getCookie, setCookie } from \"hono/cookie\";\nimport { createPkce, openData, randomToken, sealData, verifyAccessToken } from \"./auth\";\nimport type { Principal } from \"./auth\";\nimport { GodxSsoClient, loadIssuer } from \"./http\";\n\nexport interface GodxSsoConfig {\n  issuer: string;\n  serviceSlug: string;\n  clientId: string;\n  clientSecret?: string;\n  redirectUri: string;\n  sessionSecret: string;\n  scope?: string;\n  /** Token audience = your ServiceInstance slug (defaults to serviceSlug). */\n  audience?: string;\n  /**\n   * console_organization_id to fall back on when the login was not started\n   * from a platform launch URL (which carries organization_context_id).\n   * Useful in local dev; leave unset in production multi-org setups.\n   */\n  defaultOrganizationContextId?: string;\n}\n\ntype SessionData = { p: Principal; at: string };\n\nconst TXN_COOKIE = \"gx_txn\";\nconst SESSION_COOKIE = \"gx_sess\";\n\nexport type GodxVariables = { principal: Principal; accessToken: string };\n\nexport function godxSso<E extends HonoEnv & { Variables: GodxVariables }>(\n  getConfig: (env: E[\"Bindings\"]) => GodxSsoConfig,\n) {\n  const client = (c: Context<E>) => new GodxSsoClient(getConfig(c.env));\n  const cfg = (c: Context<E>) => getConfig(c.env);\n  const secure = (c: Context<E>) => c.req.url.startsWith(\"https:\");\n\n  const routes = new Hono<E>();\n\n  routes.get(\"/login\", async (c) => {\n    const config = cfg(c);\n    const pkce = await createPkce();\n    const state = randomToken();\n    const nonce = randomToken();\n    // The platform launch URL carries organization_context_id; forward it, or\n    // fall back to the configured default (single-org / local dev).\n    const organizationContextId =\n      c.req.query(\"organization_context_id\") ?? config.defaultOrganizationContextId;\n    setCookie(c, TXN_COOKIE, await sealData({ v: pkce.verifier, s: state }, config.sessionSecret, 300), {\n      httpOnly: true,\n      secure: secure(c),\n      sameSite: \"Lax\",\n      path: \"/\",\n      maxAge: 300,\n    });\n    return c.redirect(\n      await client(c).authorizeUrl({\n        state,\n        nonce,\n        codeChallenge: pkce.challenge,\n        scope: config.scope,\n        organizationContextId,\n      }),\n    );\n  });\n\n  // Every failure lands back on the app with a human-readable description —\n  // the SPA renders it; a bare 400 helps nobody.\n  const failRedirect = (c: Context<E>, error: string, description: string) =>\n    c.redirect(\n      `/?sso_error=${encodeURIComponent(error)}&sso_error_description=${encodeURIComponent(description)}`,\n    );\n\n  routes.get(\"/callback\", async (c) => {\n    const config = cfg(c);\n\n    // The platform denied the launch (access_denied etc.) and already wrote a\n    // localized, human-readable explanation into error_description. Show it.\n    const platformError = c.req.query(\"error\");\n    if (platformError) {\n      return failRedirect(\n        c,\n        platformError,\n        c.req.query(\"error_description\") ?? `サインインが拒否されました（${platformError}）。`,\n      );\n    }\n\n    const code = c.req.query(\"code\");\n    const state = c.req.query(\"state\");\n    const txnCookie = getCookie(c, TXN_COOKIE);\n    deleteCookie(c, TXN_COOKIE, { path: \"/\" });\n\n    const txn = txnCookie ? await openData<{ v: string; s: string }>(txnCookie, config.sessionSecret) : null;\n    if (!code || !state || !txn || txn.s !== state) {\n      return failRedirect(\n        c,\n        \"transaction_invalid\",\n        \"ログイン処理の有効期限が切れたか、途中で中断されました。もう一度サインインしてください。\",\n      );\n    }\n\n    let tokens;\n    try {\n      tokens = await client(c).exchangeCode({ code, codeVerifier: txn.v });\n    } catch (e) {\n      return failRedirect(\n        c,\n        \"token_exchange_failed\",\n        `認可コードの交換に失敗しました（認可コードは一度しか使えません）。もう一度サインインしてください。詳細: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    }\n\n    let verified;\n    try {\n      verified = await verifyAccessToken(tokens.access_token, config);\n    } catch (e) {\n      return failRedirect(\n        c,\n        \"token_verification_failed\",\n        `トークンの検証に失敗しました。サービス設定（issuer / service_slug）を確認してください。詳細: ${e instanceof Error ? e.message : String(e)}`,\n      );\n    }\n\n    // One userinfo call at login so the UI has a display name without further round-trips.\n    let principal = verified;\n    try {\n      const info = await client(c).userinfo(tokens.access_token);\n      principal = Object.freeze({ ...verified, name: info.name, email: info.email });\n    } catch {\n      // profile display data is optional; the verified principal stands on its own\n    }\n\n    const ttl = Math.max(0, principal.expiresAt - Math.floor(Date.now() / 1000));\n    setCookie(\n      c,\n      SESSION_COOKIE,\n      await sealData({ p: principal, at: tokens.access_token } satisfies SessionData, config.sessionSecret, ttl),\n      { httpOnly: true, secure: secure(c), sameSite: \"Lax\", path: \"/\", maxAge: ttl },\n    );\n    return c.redirect(\"/\");\n  });\n\n  routes.get(\"/logout\", async (c) => {\n    const config = cfg(c);\n    const raw = getCookie(c, SESSION_COOKIE);\n    deleteCookie(c, SESSION_COOKIE, { path: \"/\" });\n    if (raw) {\n      const session = await openData<SessionData>(raw, config.sessionSecret);\n      if (session) await client(c).revoke(session.at).catch(() => {});\n    }\n    const { metadata } = await loadIssuer(config.issuer);\n    return c.redirect(metadata.end_session_endpoint ?? \"/\");\n  });\n\n  const requireAuth: MiddlewareHandler<E> = async (c, next) => {\n    const raw = getCookie(c, SESSION_COOKIE);\n    const session = raw ? await openData<SessionData>(raw, cfg(c).sessionSecret) : null;\n    if (!session || session.p.expiresAt <= Math.floor(Date.now() / 1000)) {\n      return c.json({ error: \"unauthenticated\" }, 401);\n    }\n    c.set(\"principal\", session.p);\n    c.set(\"accessToken\", session.at);\n    await next();\n  };\n\n  /**\n   * Forwards /api/dock/v1/* to the platform with the session's Bearer token —\n   * the GoDX Dock's `apiBase` lane: no CORS, no token in the page. Mount it\n   * BEHIND requireAuth and BEFORE any requireWritable (Dock actions are the\n   * platform's calls to authorize, not this app's writes).\n   */\n  const dockProxy: MiddlewareHandler<E> = async (c) => {\n    const config = cfg(c);\n    const url = new URL(c.req.url);\n    const target = new URL(url.pathname + url.search, config.issuer);\n    const method = c.req.method;\n    const res = await fetch(target, {\n      method,\n      headers: {\n        Authorization: `Bearer ${c.get(\"accessToken\")}`,\n        Accept: \"application/json\",\n        \"Content-Type\": c.req.header(\"Content-Type\") ?? \"application/json\",\n      },\n      body: method === \"GET\" || method === \"HEAD\" ? undefined : await c.req.arrayBuffer(),\n    });\n    const headers = new Headers({ \"Content-Type\": res.headers.get(\"Content-Type\") ?? \"application/json\" });\n    const requestId = res.headers.get(\"X-Request-Id\");\n    if (requestId) headers.set(\"X-Request-Id\", requestId);\n    return new Response(res.body, { status: res.status, headers });\n  };\n\n  /** Enforces organization_access_mode: read-only orgs may not write. */\n  const requireWritable: MiddlewareHandler<E> = async (c, next) => {\n    const safe = c.req.method === \"GET\" || c.req.method === \"HEAD\" || c.req.method === \"OPTIONS\";\n    if (!safe && c.get(\"principal\")?.accessMode !== \"full\") {\n      return c.json({ error: \"organization is read-only\" }, 403);\n    }\n    await next();\n  };\n\n  return { routes, requireAuth, requireWritable, dockProxy };\n}\n"],"mappings":";;;;;;;;;;;;;AAKA,SAAS,YAAY;AAErB,SAAS,cAAc,WAAW,iBAAiB;AAyBnD,IAAM,aAAa;AACnB,IAAM,iBAAiB;AAIhB,SAAS,QACd,WACA;AACA,QAAM,SAAS,CAAC,MAAkB,IAAI,cAAc,UAAU,EAAE,GAAG,CAAC;AACpE,QAAM,MAAM,CAAC,MAAkB,UAAU,EAAE,GAAG;AAC9C,QAAM,SAAS,CAAC,MAAkB,EAAE,IAAI,IAAI,WAAW,QAAQ;AAE/D,QAAM,SAAS,IAAI,KAAQ;AAE3B,SAAO,IAAI,UAAU,OAAO,MAAM;AAChC,UAAM,SAAS,IAAI,CAAC;AACpB,UAAM,OAAO,MAAM,WAAW;AAC9B,UAAM,QAAQ,YAAY;AAC1B,UAAM,QAAQ,YAAY;AAG1B,UAAM,wBACJ,EAAE,IAAI,MAAM,yBAAyB,KAAK,OAAO;AACnD,cAAU,GAAG,YAAY,MAAM,SAAS,EAAE,GAAG,KAAK,UAAU,GAAG,MAAM,GAAG,OAAO,eAAe,GAAG,GAAG;AAAA,MAClG,UAAU;AAAA,MACV,QAAQ,OAAO,CAAC;AAAA,MAChB,UAAU;AAAA,MACV,MAAM;AAAA,MACN,QAAQ;AAAA,IACV,CAAC;AACD,WAAO,EAAE;AAAA,MACP,MAAM,OAAO,CAAC,EAAE,aAAa;AAAA,QAC3B;AAAA,QACA;AAAA,QACA,eAAe,KAAK;AAAA,QACpB,OAAO,OAAO;AAAA,QACd;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AAID,QAAM,eAAe,CAAC,GAAe,OAAe,gBAClD,EAAE;AAAA,IACA,eAAe,mBAAmB,KAAK,CAAC,0BAA0B,mBAAmB,WAAW,CAAC;AAAA,EACnG;AAEF,SAAO,IAAI,aAAa,OAAO,MAAM;AACnC,UAAM,SAAS,IAAI,CAAC;AAIpB,UAAM,gBAAgB,EAAE,IAAI,MAAM,OAAO;AACzC,QAAI,eAAe;AACjB,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,EAAE,IAAI,MAAM,mBAAmB,KAAK,uFAAiB,aAAa;AAAA,MACpE;AAAA,IACF;AAEA,UAAM,OAAO,EAAE,IAAI,MAAM,MAAM;AAC/B,UAAM,QAAQ,EAAE,IAAI,MAAM,OAAO;AACjC,UAAM,YAAY,UAAU,GAAG,UAAU;AACzC,iBAAa,GAAG,YAAY,EAAE,MAAM,IAAI,CAAC;AAEzC,UAAM,MAAM,YAAY,MAAM,SAAmC,WAAW,OAAO,aAAa,IAAI;AACpG,QAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,IAAI,MAAM,OAAO;AAC9C,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,CAAC,EAAE,aAAa,EAAE,MAAM,cAAc,IAAI,EAAE,CAAC;AAAA,IACrE,SAAS,GAAG;AACV,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,uTAAwD,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACpG;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,kBAAkB,OAAO,cAAc,MAAM;AAAA,IAChE,SAAS,GAAG;AACV,aAAO;AAAA,QACL;AAAA,QACA;AAAA,QACA,4OAA6D,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,MACzG;AAAA,IACF;AAGA,QAAI,YAAY;AAChB,QAAI;AACF,YAAM,OAAO,MAAM,OAAO,CAAC,EAAE,SAAS,OAAO,YAAY;AACzD,kBAAY,OAAO,OAAO,EAAE,GAAG,UAAU,MAAM,KAAK,MAAM,OAAO,KAAK,MAAM,CAAC;AAAA,IAC/E,QAAQ;AAAA,IAER;AAEA,UAAM,MAAM,KAAK,IAAI,GAAG,UAAU,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,CAAC;AAC3E;AAAA,MACE;AAAA,MACA;AAAA,MACA,MAAM,SAAS,EAAE,GAAG,WAAW,IAAI,OAAO,aAAa,GAAyB,OAAO,eAAe,GAAG;AAAA,MACzG,EAAE,UAAU,MAAM,QAAQ,OAAO,CAAC,GAAG,UAAU,OAAO,MAAM,KAAK,QAAQ,IAAI;AAAA,IAC/E;AACA,WAAO,EAAE,SAAS,GAAG;AAAA,EACvB,CAAC;AAED,SAAO,IAAI,WAAW,OAAO,MAAM;AACjC,UAAM,SAAS,IAAI,CAAC;AACpB,UAAM,MAAM,UAAU,GAAG,cAAc;AACvC,iBAAa,GAAG,gBAAgB,EAAE,MAAM,IAAI,CAAC;AAC7C,QAAI,KAAK;AACP,YAAM,UAAU,MAAM,SAAsB,KAAK,OAAO,aAAa;AACrE,UAAI,QAAS,OAAM,OAAO,CAAC,EAAE,OAAO,QAAQ,EAAE,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IAChE;AACA,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,OAAO,MAAM;AACnD,WAAO,EAAE,SAAS,SAAS,wBAAwB,GAAG;AAAA,EACxD,CAAC;AAED,QAAM,cAAoC,OAAO,GAAG,SAAS;AAC3D,UAAM,MAAM,UAAU,GAAG,cAAc;AACvC,UAAM,UAAU,MAAM,MAAM,SAAsB,KAAK,IAAI,CAAC,EAAE,aAAa,IAAI;AAC/E,QAAI,CAAC,WAAW,QAAQ,EAAE,aAAa,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,GAAG;AACpE,aAAO,EAAE,KAAK,EAAE,OAAO,kBAAkB,GAAG,GAAG;AAAA,IACjD;AACA,MAAE,IAAI,aAAa,QAAQ,CAAC;AAC5B,MAAE,IAAI,eAAe,QAAQ,EAAE;AAC/B,UAAM,KAAK;AAAA,EACb;AAQA,QAAM,YAAkC,OAAO,MAAM;AACnD,UAAM,SAAS,IAAI,CAAC;AACpB,UAAM,MAAM,IAAI,IAAI,EAAE,IAAI,GAAG;AAC7B,UAAM,SAAS,IAAI,IAAI,IAAI,WAAW,IAAI,QAAQ,OAAO,MAAM;AAC/D,UAAM,SAAS,EAAE,IAAI;AACrB,UAAM,MAAM,MAAM,MAAM,QAAQ;AAAA,MAC9B;AAAA,MACA,SAAS;AAAA,QACP,eAAe,UAAU,EAAE,IAAI,aAAa,CAAC;AAAA,QAC7C,QAAQ;AAAA,QACR,gBAAgB,EAAE,IAAI,OAAO,cAAc,KAAK;AAAA,MAClD;AAAA,MACA,MAAM,WAAW,SAAS,WAAW,SAAS,SAAY,MAAM,EAAE,IAAI,YAAY;AAAA,IACpF,CAAC;AACD,UAAM,UAAU,IAAI,QAAQ,EAAE,gBAAgB,IAAI,QAAQ,IAAI,cAAc,KAAK,mBAAmB,CAAC;AACrG,UAAM,YAAY,IAAI,QAAQ,IAAI,cAAc;AAChD,QAAI,UAAW,SAAQ,IAAI,gBAAgB,SAAS;AACpD,WAAO,IAAI,SAAS,IAAI,MAAM,EAAE,QAAQ,IAAI,QAAQ,QAAQ,CAAC;AAAA,EAC/D;AAGA,QAAM,kBAAwC,OAAO,GAAG,SAAS;AAC/D,UAAM,OAAO,EAAE,IAAI,WAAW,SAAS,EAAE,IAAI,WAAW,UAAU,EAAE,IAAI,WAAW;AACnF,QAAI,CAAC,QAAQ,EAAE,IAAI,WAAW,GAAG,eAAe,QAAQ;AACtD,aAAO,EAAE,KAAK,EAAE,OAAO,4BAA4B,GAAG,GAAG;AAAA,IAC3D;AACA,UAAM,KAAK;AAAA,EACb;AAEA,SAAO,EAAE,QAAQ,aAAa,iBAAiB,UAAU;AAC3D;","names":[]}

package/dist/http.d.ts

@@ -0,0 +1,96 @@
+import { createRemoteJWKSet } from 'jose';
+
+/**
+ * ./http — endpoint contract from OIDC discovery, the SSO client, and the
+ * server-to-server service API. Runtime-agnostic: fetch + WebCrypto only.
+ * Mirrors php-sdk's Http module boundary.
+ */
+
+interface IssuerMetadata {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    userinfo_endpoint: string;
+    jwks_uri: string;
+    end_session_endpoint?: string;
+    revocation_endpoint?: string;
+}
+interface Issuer {
+    metadata: IssuerMetadata;
+    jwks: ReturnType<typeof createRemoteJWKSet>;
+}
+declare class GodxHttpError extends Error {
+    readonly status: number;
+    readonly body: string;
+    constructor(status: number, body: string, message?: string);
+}
+declare function loadIssuer(issuerUrl: string): Promise<Issuer>;
+interface SsoClientConfig {
+    issuer: string;
+    serviceSlug: string;
+    clientId: string;
+    /** Omit for a public (secretless) instance — PKCE alone then. */
+    clientSecret?: string;
+    redirectUri: string;
+}
+interface TokenResponse {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    id_token?: string;
+    refresh_token?: string;
+    scope?: string;
+}
+interface UserinfoResponse {
+    sub: string;
+    email?: string;
+    email_verified?: boolean;
+    name?: string;
+    locale?: string;
+    timezone?: string;
+}
+declare class GodxSsoClient {
+    readonly config: SsoClientConfig;
+    constructor(config: SsoClientConfig);
+    authorizeUrl(params: {
+        state: string;
+        nonce: string;
+        codeChallenge: string;
+        scope?: string;
+        /** console_organization_id — required by the launch gates; usually arrives on the launch URL. */
+        organizationContextId?: string;
+    }): Promise<string>;
+    exchangeCode(params: {
+        code: string;
+        codeVerifier: string;
+    }): Promise<TokenResponse>;
+    refresh(refreshToken: string): Promise<TokenResponse>;
+    /** Best-effort revocation; failures are the caller's decision to ignore. */
+    revoke(token: string): Promise<void>;
+    userinfo(accessToken: string): Promise<UserinfoResponse>;
+    private tokenRequest;
+    private postForm;
+}
+/**
+ * Server-to-server reads with service credentials (X-Service-Slug/X-Service-Secret).
+ * Rate-limited by the platform (429) — cache results and back off; no auto-retry here.
+ */
+declare function createServiceApi(config: {
+    issuer: string;
+    serviceSlug: string;
+    serviceSecret: string;
+}): {
+    users: (q: {
+        organizationSlug: string;
+        perPage?: number;
+        page?: number;
+    }) => Promise<unknown>;
+    branches: (q: {
+        organizationSlug: string;
+    }) => Promise<unknown>;
+    brands: (q: {
+        organizationSlug: string;
+    }) => Promise<unknown>;
+};
+
+export { GodxHttpError, GodxSsoClient, type Issuer, type IssuerMetadata, type SsoClientConfig, type TokenResponse, type UserinfoResponse, createServiceApi, loadIssuer };

package/dist/http.js

@@ -0,0 +1,13 @@
+import {
+  GodxHttpError,
+  GodxSsoClient,
+  createServiceApi,
+  loadIssuer
+} from "./chunk-DMXYEWYY.js";
+export {
+  GodxHttpError,
+  GodxSsoClient,
+  createServiceApi,
+  loadIssuer
+};
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}