@gorth-io/structure 0.0.0-alpha.10

package/dist/modules/auth/client/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","names":["waitForAuthOperation","signal","abort","reject","resolve","operation","error","createAuthRetry","flight","controller","generation","disposed","reset","refresh","version","options","input","request"],"sources":["../../../../src/modules/auth/client/retry.ts"],"sourcesContent":["import type { AuthRetryInput, AuthRetryOptions } from \"@/utils/interface\";\n\n/** Waiter cancellation must not abort a refresh needed by other requests. */\nexport async function waitForAuthOperation<Value>(\n  operation: Promise<Value>,\n  signal?: AbortSignal,\n): Promise<Value> {\n  if (!signal) return await operation;\n  return await new Promise<Value>((resolve, reject) => {\n    const abort = () => {\n      signal.removeEventListener(\"abort\", abort);\n      reject(signal.reason);\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    if (signal.aborted) abort();\n    // Observe even a cancelled waiter's operation so a late rejection is handled.\n    void (async () => {\n      try {\n        resolve(await operation);\n      } catch (error) {\n        reject(error);\n      } finally {\n        signal.removeEventListener(\"abort\", abort);\n      }\n    })();\n  });\n}\n\n/** One refresh flight per factory, one retry per request. Reset on logout/account change. */\nexport function createAuthRetry(options: AuthRetryOptions) {\n  let flight: Promise<boolean> | undefined;\n  let controller: AbortController | undefined;\n  let generation = 0;\n  let disposed = false;\n\n  function reset() {\n    generation++;\n    controller?.abort();\n    flight = undefined;\n  }\n\n  function refresh() {\n    if (flight) return flight;\n    controller = new AbortController();\n    const signal = controller.signal;\n    const version = generation;\n    let operation!: Promise<boolean>;\n    operation = (async () => {\n      // Register the flight before invoking an adapter that may throw/re-enter.\n      await Promise.resolve();\n      try {\n        if (signal.aborted || disposed || version !== generation) return false;\n        const ok = await options.refresh(signal);\n        return ok && version === generation && !disposed && !signal.aborted;\n      } catch {\n        return false;\n      } finally {\n        if (flight === operation) flight = undefined;\n      }\n    })();\n    flight = operation;\n    return operation;\n  }\n\n  return {\n    async withAuthRetry<Value>(\n      request: () => Promise<Value>,\n      input: AuthRetryInput = {},\n    ): Promise<Value> {\n      input.signal?.throwIfAborted();\n      const version = generation;\n      try {\n        return await request();\n      } catch (error) {\n        input.signal?.throwIfAborted();\n        if (\n          disposed ||\n          version !== generation ||\n          input.enabled === false ||\n          options.getStatus(error) !== 401 ||\n          !(await waitForAuthOperation(refresh(), input.signal)) ||\n          version !== generation ||\n          disposed\n        )\n          throw error;\n        input.signal?.throwIfAborted();\n        return await request();\n      }\n    },\n    reset,\n    dispose() {\n      disposed = true;\n      reset();\n    },\n  };\n}\n\nexport type { AuthRetryInput, AuthRetryOptions } from \"@/utils/interface\";\n"],"mappings":"AAGA,eAAsBA,EACpB,EACA,EACgB,CAEhB,OADKC,EACE,MAAM,IAAI,SAAgB,EAAS,IAAW,CACnD,IAAMC,MAAc,CAClBD,EAAO,oBAAoB,QAASC,CAAK,EACzCC,EAAOF,EAAO,MAAM,CACtB,EACAA,EAAO,iBAAiB,QAASC,EAAO,CAAE,KAAM,EAAK,CAAC,EAClDD,EAAO,SAASC,EAAM,GAEpB,SAAY,CAChB,GAAI,CACFE,EAAQ,MAAMC,CAAS,CACzB,OAASC,EAAO,CACdH,EAAOG,CAAK,CACd,QAAU,CACRL,EAAO,oBAAoB,QAASC,CAAK,CAC3C,CACF,EAAA,CAAG,CACL,CAAC,EAlBmB,MAAMG,CAmB5B,CAGA,SAAgBE,EAAgB,EAA2B,CACzD,IAAIC,EACAC,EACAC,EAAa,EACbC,EAAW,GAEf,SAASC,GAAQ,CACf,IACAH,GAAY,MAAM,EAClB,EAAS,IAAA,EACX,CAEA,SAASI,GAAU,CACjB,GAAIL,EAAQ,OAAOA,EACnB,EAAa,IAAI,gBACjB,IAAMP,EAASQ,EAAW,OACpBK,EAAUJ,EACZL,EAeJ,MAdA,IAAa,SAAY,CAEvB,MAAM,QAAQ,QAAQ,EACtB,GAAI,CAGF,OAFIJ,EAAO,SAAWU,GAAYG,IAAYJ,EAAmB,GAE1D,MADUK,EAAQ,QAAQd,CAAM,GAC1Ba,IAAYJ,GAAc,CAACC,GAAY,CAACV,EAAO,OAC9D,MAAQ,CACN,MAAO,EACT,QAAU,CACJO,IAAWH,IAAW,EAAS,IAAA,GACrC,CACF,EAAA,CAAG,EACH,EAASA,EACFA,CACT,CAEA,MAAO,CACL,MAAM,cACJ,EACA,EAAwB,CAAC,EACT,CAChBW,EAAM,QAAQ,eAAe,EAC7B,IAAMF,EAAUJ,EAChB,GAAI,CACF,OAAO,MAAMO,EAAQ,CACvB,OAASX,EAAO,CAEd,GADAU,EAAM,QAAQ,eAAe,EAE3BL,GACAG,IAAYJ,GACZM,EAAM,UAAY,IAClBD,EAAQ,UAAUT,CAAK,IAAM,KAC7B,CAAE,MAAMN,EAAqBa,EAAQ,EAAGG,EAAM,MAAM,GACpDF,IAAYJ,GACZC,EAEA,MAAML,EAER,OADAU,EAAM,QAAQ,eAAe,EACtB,MAAMC,EAAQ,CACvB,CACF,EACA,QACA,SAAU,CACR,EAAW,GACXL,EAAM,CACR,CACF,CACF,C"}

package/dist/modules/auth/interface.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=class extends Error{code;constructor(e){super(`Authentication ${e.replaceAll(`_`,` `)}`),this.code=e,this.name=`AuthError`}};exports.AuthError=e;

package/dist/modules/auth/interface.d.cts

@@ -0,0 +1,8 @@
+import { a as AuthIdentity, n as AuthErrorCode, o as AuthPolicy } from "../../interface-ii8DV63k.cjs";
+/** Safe errors never include provider payloads, credentials or database causes. */
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  constructor(code: AuthErrorCode);
+}
+export type { AuthErrorCode, AuthIdentity, AuthPolicy };
+//# sourceMappingURL=interface.d.cts.map

package/dist/modules/auth/interface.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.cts","names":[],"sources":["../../../src/modules/auth/interface.ts"],"mappings":";;qBAGa,kBAAkB;WACD,MAAM;EAAN,YAAA,MAAM"}

package/dist/modules/auth/interface.d.ts

@@ -0,0 +1,8 @@
+import { a as AuthIdentity, n as AuthErrorCode, o as AuthPolicy } from "../../interface-ii8DV63k.js";
+/** Safe errors never include provider payloads, credentials or database causes. */
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  constructor(code: AuthErrorCode);
+}
+export type { AuthErrorCode, AuthIdentity, AuthPolicy };
+//# sourceMappingURL=interface.d.ts.map

package/dist/modules/auth/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","names":[],"sources":["../../../src/modules/auth/interface.ts"],"mappings":";;qBAGa,kBAAkB;WACD,MAAM;EAAN,YAAA,MAAM"}

package/dist/modules/auth/interface.js

@@ -0,0 +1,2 @@
+var e=class extends Error{code;constructor(e){super(`Authentication ${e.replaceAll(`_`,` `)}`),this.code=e,this.name=`AuthError`}};export{e as AuthError};
+//# sourceMappingURL=interface.js.map

package/dist/modules/auth/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","names":["AuthError","code"],"sources":["../../../src/modules/auth/interface.ts"],"sourcesContent":["import type { AuthErrorCode } from \"@/utils/interface\";\n\n/** Safe errors never include provider payloads, credentials or database causes. */\nexport class AuthError extends Error {\n  constructor(public readonly code: AuthErrorCode) {\n    super(`Authentication ${code.replaceAll(\"_\", \" \")}`);\n    this.name = \"AuthError\";\n  }\n}\nexport type {\n  AuthErrorCode,\n  AuthIdentity,\n  AuthPolicy,\n} from \"@/utils/interface\";\n"],"mappings":"AAGA,IAAaA,EAAb,cAA+B,KAAM,CACP,KAA5B,YAAY,EAAqC,CAC/C,MAAM,kBAAkBC,EAAK,WAAW,IAAK,GAAG,GAAG,EADzB,KAAA,KAAAA,EAE1B,KAAK,KAAO,WACd,CACF,E"}

package/dist/modules/auth/policy.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./interface.cjs");function t(t={},r=Date.now){let i=n(t);return function(t){let n=r();if(![n,t.accessExpiresAt,t.verifiedAt].every(Number.isFinite)||n<0||t.accessExpiresAt<0||t.verifiedAt<0)throw new e.AuthError(`rejected`);return{expired:t.accessExpiresAt<=n,refresh:t.accessExpiresAt<=n+i.refreshLeewayMs,verifyIdentity:t.fresh===!0||t.verifiedAt>n||t.verifiedAt+i.identityMaxAgeMs<=n}}}function n(t={}){let n={sessionMaxAgeMs:6048e5,transactionMaxAgeMs:12e4,identityMaxAgeMs:12e4,refreshLeewayMs:3e4,clockToleranceSeconds:5,logoutMaxAgeSeconds:120,revocationRetentionMs:60483e4,...t};if(Object.values(n).some(e=>!Number.isSafeInteger(e)||e<0)||!n.sessionMaxAgeMs||!n.transactionMaxAgeMs||!n.logoutMaxAgeSeconds||n.transactionMaxAgeMs>6e5||n.clockToleranceSeconds>60||n.identityMaxAgeMs>3e5||n.revocationRetentionMs<n.sessionMaxAgeMs+n.clockToleranceSeconds*1e3||n.revocationRetentionMs<(n.logoutMaxAgeSeconds+n.clockToleranceSeconds)*1e3)throw new e.AuthError(`invalid_configuration`);return Object.freeze(n)}function r(t=`/`){if(t.length>2048||!t.startsWith(`/`)||t.startsWith(`//`)||/[\\\u0000-\u0020\u007f]/.test(t))throw new e.AuthError(`rejected`);let n=new URL(t,`https://app.invalid`);if(n.origin!==`https://app.invalid`)throw new e.AuthError(`rejected`);return n.pathname+n.search+n.hash}function i(t,n){let r=t.get(`origin`);if(!r||!n.includes(r)||t.get(`sec-fetch-site`)===`cross-site`)throw new e.AuthError(`rejected`);for(let t of n)if(new URL(t).origin!==t)throw new e.AuthError(`invalid_configuration`)}function a(t){if(!Number.isSafeInteger(t.maxAgeSeconds)||t.maxAgeSeconds<0||!t.path?.startsWith(`/`)&&t.path!==void 0)throw new e.AuthError(`invalid_configuration`);return{httpOnly:!0,secure:t.secure,sameSite:`lax`,path:t.path??`/`,maxAge:t.maxAgeSeconds}}exports.assertMutationOrigin=i,exports.authCookieOptions=a,exports.createAuthFreshnessPolicy=t,exports.createAuthPolicy=n,exports.resolveReturnPath=r;

package/dist/modules/auth/policy.d.cts

@@ -0,0 +1,15 @@
+import "./interface.cjs";
+import { i as AuthFreshnessInput, o as AuthPolicy, r as AuthFreshness, t as AuthCookieInput } from "../../interface-ii8DV63k.cjs";
+/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */
+export declare function createAuthFreshnessPolicy(overrides?: Partial<AuthPolicy>, now?: () => number): (input: AuthFreshnessInput) => AuthFreshness;
+export declare function createAuthPolicy(overrides?: Partial<AuthPolicy>): Readonly<AuthPolicy>;
+export declare function resolveReturnPath(value?: string): string;
+export declare function assertMutationOrigin(headers: Headers, allowedOrigins: readonly string[]): void;
+export declare function authCookieOptions(options: AuthCookieInput): {
+  httpOnly: boolean;
+  secure: boolean;
+  sameSite: "lax";
+  path: string;
+  maxAge: number;
+};
+//# sourceMappingURL=policy.d.cts.map

package/dist/modules/auth/policy.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.cts","names":[],"sources":["../../../src/modules/auth/policy.ts"],"mappings":";;;wBAQgB,0BACd,YAAW,QAAQ,aACnB,sBAG8B,OAAO,uBAAqB;wBAoB5C,iBACd,YAAW,QAAQ,cAClB,SAAS;wBA+BI,kBAAkB;wBAclB,qBACd,SAAS,SACT;wBAgBc,kBAAkB,SAAS"}

package/dist/modules/auth/policy.d.ts

@@ -0,0 +1,15 @@
+import "./interface.js";
+import { i as AuthFreshnessInput, o as AuthPolicy, r as AuthFreshness, t as AuthCookieInput } from "../../interface-ii8DV63k.js";
+/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */
+export declare function createAuthFreshnessPolicy(overrides?: Partial<AuthPolicy>, now?: () => number): (input: AuthFreshnessInput) => AuthFreshness;
+export declare function createAuthPolicy(overrides?: Partial<AuthPolicy>): Readonly<AuthPolicy>;
+export declare function resolveReturnPath(value?: string): string;
+export declare function assertMutationOrigin(headers: Headers, allowedOrigins: readonly string[]): void;
+export declare function authCookieOptions(options: AuthCookieInput): {
+  httpOnly: boolean;
+  secure: boolean;
+  sameSite: "lax";
+  path: string;
+  maxAge: number;
+};
+//# sourceMappingURL=policy.d.ts.map

package/dist/modules/auth/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../../../src/modules/auth/policy.ts"],"mappings":";;;wBAQgB,0BACd,YAAW,QAAQ,aACnB,sBAG8B,OAAO,uBAAqB;wBAoB5C,iBACd,YAAW,QAAQ,cAClB,SAAS;wBA+BI,kBAAkB;wBAclB,qBACd,SAAS,SACT;wBAgBc,kBAAkB,SAAS"}

package/dist/modules/auth/policy.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"./interface.js";function t(t={},r=Date.now){let i=n(t);return function(t){let n=r();if(![n,t.accessExpiresAt,t.verifiedAt].every(Number.isFinite)||n<0||t.accessExpiresAt<0||t.verifiedAt<0)throw new e(`rejected`);return{expired:t.accessExpiresAt<=n,refresh:t.accessExpiresAt<=n+i.refreshLeewayMs,verifyIdentity:t.fresh===!0||t.verifiedAt>n||t.verifiedAt+i.identityMaxAgeMs<=n}}}function n(t={}){let n={sessionMaxAgeMs:6048e5,transactionMaxAgeMs:12e4,identityMaxAgeMs:12e4,refreshLeewayMs:3e4,clockToleranceSeconds:5,logoutMaxAgeSeconds:120,revocationRetentionMs:60483e4,...t};if(Object.values(n).some(e=>!Number.isSafeInteger(e)||e<0)||!n.sessionMaxAgeMs||!n.transactionMaxAgeMs||!n.logoutMaxAgeSeconds||n.transactionMaxAgeMs>6e5||n.clockToleranceSeconds>60||n.identityMaxAgeMs>3e5||n.revocationRetentionMs<n.sessionMaxAgeMs+n.clockToleranceSeconds*1e3||n.revocationRetentionMs<(n.logoutMaxAgeSeconds+n.clockToleranceSeconds)*1e3)throw new e(`invalid_configuration`);return Object.freeze(n)}function r(t=`/`){if(t.length>2048||!t.startsWith(`/`)||t.startsWith(`//`)||/[\\\u0000-\u0020\u007f]/.test(t))throw new e(`rejected`);let n=new URL(t,`https://app.invalid`);if(n.origin!==`https://app.invalid`)throw new e(`rejected`);return n.pathname+n.search+n.hash}function i(t,n){let r=t.get(`origin`);if(!r||!n.includes(r)||t.get(`sec-fetch-site`)===`cross-site`)throw new e(`rejected`);for(let t of n)if(new URL(t).origin!==t)throw new e(`invalid_configuration`)}function a(t){if(!Number.isSafeInteger(t.maxAgeSeconds)||t.maxAgeSeconds<0||!t.path?.startsWith(`/`)&&t.path!==void 0)throw new e(`invalid_configuration`);return{httpOnly:!0,secure:t.secure,sameSite:`lax`,path:t.path??`/`,maxAge:t.maxAgeSeconds}}export{i as assertMutationOrigin,a as authCookieOptions,t as createAuthFreshnessPolicy,n as createAuthPolicy,r as resolveReturnPath};
+//# sourceMappingURL=policy.js.map

package/dist/modules/auth/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":["createAuthFreshnessPolicy","policy","createAuthPolicy","overrides","time","now","input","AuthError","value","resolveReturnPath","url","assertMutationOrigin","origin","headers","allowedOrigins","allowed","authCookieOptions","options"],"sources":["../../../src/modules/auth/policy.ts"],"sourcesContent":["import { AuthError, type AuthPolicy } from \"@/modules/auth/interface\";\nimport type {\n  AuthCookieInput,\n  AuthFreshness,\n  AuthFreshnessInput,\n} from \"@/utils/interface\";\n\n/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */\nexport function createAuthFreshnessPolicy(\n  overrides: Partial<AuthPolicy> = {},\n  now: () => number = Date.now,\n) {\n  const policy = createAuthPolicy(overrides);\n  return function authFreshness(input: AuthFreshnessInput): AuthFreshness {\n    const time = now();\n    if (\n      ![time, input.accessExpiresAt, input.verifiedAt].every(Number.isFinite) ||\n      time < 0 ||\n      input.accessExpiresAt < 0 ||\n      input.verifiedAt < 0\n    )\n      throw new AuthError(\"rejected\");\n    return {\n      expired: input.accessExpiresAt <= time,\n      refresh: input.accessExpiresAt <= time + policy.refreshLeewayMs,\n      verifyIdentity:\n        input.fresh === true ||\n        input.verifiedAt > time ||\n        input.verifiedAt + policy.identityMaxAgeMs <= time,\n    };\n  };\n}\n\nexport function createAuthPolicy(\n  overrides: Partial<AuthPolicy> = {},\n): Readonly<AuthPolicy> {\n  const policy: AuthPolicy = {\n    sessionMaxAgeMs: 7 * 86_400_000,\n    transactionMaxAgeMs: 120_000,\n    identityMaxAgeMs: 120_000,\n    refreshLeewayMs: 30_000,\n    clockToleranceSeconds: 5,\n    logoutMaxAgeSeconds: 120,\n    revocationRetentionMs: 7 * 86_400_000 + 30_000,\n    ...overrides,\n  };\n  if (\n    Object.values(policy).some(\n      (value) => !Number.isSafeInteger(value) || value < 0,\n    ) ||\n    !policy.sessionMaxAgeMs ||\n    !policy.transactionMaxAgeMs ||\n    !policy.logoutMaxAgeSeconds ||\n    policy.transactionMaxAgeMs > 600_000 ||\n    policy.clockToleranceSeconds > 60 ||\n    policy.identityMaxAgeMs > 300_000 ||\n    policy.revocationRetentionMs <\n      policy.sessionMaxAgeMs + policy.clockToleranceSeconds * 1000 ||\n    policy.revocationRetentionMs <\n      (policy.logoutMaxAgeSeconds + policy.clockToleranceSeconds) * 1000\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  return Object.freeze(policy);\n}\n\nexport function resolveReturnPath(value: string = \"/\"): string {\n  // Also reject browser-normalized backslashes, controls, and protocol-relative URLs.\n  if (\n    value.length > 2048 ||\n    !value.startsWith(\"/\") ||\n    value.startsWith(\"//\") ||\n    /[\\\\\\u0000-\\u0020\\u007f]/.test(value)\n  )\n    throw new AuthError(\"rejected\");\n  const url = new URL(value, \"https://app.invalid\");\n  if (url.origin !== \"https://app.invalid\") throw new AuthError(\"rejected\");\n  return url.pathname + url.search + url.hash;\n}\n\nexport function assertMutationOrigin(\n  headers: Headers,\n  allowedOrigins: readonly string[],\n): void {\n  const origin = headers.get(\"origin\");\n  if (\n    !origin ||\n    !allowedOrigins.includes(origin) ||\n    headers.get(\"sec-fetch-site\") === \"cross-site\"\n  ) {\n    throw new AuthError(\"rejected\");\n  }\n  for (const allowed of allowedOrigins) {\n    if (new URL(allowed).origin !== allowed)\n      throw new AuthError(\"invalid_configuration\");\n  }\n}\n\nexport function authCookieOptions(options: AuthCookieInput) {\n  if (\n    !Number.isSafeInteger(options.maxAgeSeconds) ||\n    options.maxAgeSeconds < 0 ||\n    (!options.path?.startsWith(\"/\") && options.path !== undefined)\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  // Host-only; each app owns its cookie. Reuse these attributes when deleting it.\n  return {\n    httpOnly: true,\n    secure: options.secure,\n    sameSite: \"lax\" as const,\n    path: options.path ?? \"/\",\n    maxAge: options.maxAgeSeconds,\n  };\n}\n"],"mappings":"A,2CAQA,SAAgBA,EACd,EAAiC,CAAC,EAClC,EAAoB,KAAK,IACzB,CACA,IAAMC,EAASC,EAAiBC,CAAS,EACzC,OAAO,SAAuB,EAA0C,CACtE,IAAMC,EAAOC,EAAI,EACjB,GACE,CAAC,CAACD,EAAME,EAAM,gBAAiBA,EAAM,UAAU,CAAC,CAAC,MAAM,OAAO,QAAQ,GACtEF,EAAO,GACPE,EAAM,gBAAkB,GACxBA,EAAM,WAAa,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,MAAO,CACL,QAASD,EAAM,iBAAmBF,EAClC,QAASE,EAAM,iBAAmBF,EAAOH,EAAO,gBAChD,eACEK,EAAM,QAAU,IAChBA,EAAM,WAAaF,GACnBE,EAAM,WAAaL,EAAO,kBAAoBG,CAClD,CACF,CACF,CAEA,SAAgBF,EACd,EAAiC,CAAC,EACZ,CACtB,IAAMD,EAAqB,CACzB,gBAAiB,OACjB,oBAAqB,KACrB,iBAAkB,KAClB,gBAAiB,IACjB,sBAAuB,EACvB,oBAAqB,IACrB,sBAAuB,QACvB,GAAGE,CACL,EACA,GACE,OAAO,OAAOF,CAAM,CAAC,CAAC,KACnB,GAAU,CAAC,OAAO,cAAcO,CAAK,GAAKA,EAAQ,CACrD,GACA,CAACP,EAAO,iBACR,CAACA,EAAO,qBACR,CAACA,EAAO,qBACRA,EAAO,oBAAsB,KAC7BA,EAAO,sBAAwB,IAC/BA,EAAO,iBAAmB,KAC1BA,EAAO,sBACLA,EAAO,gBAAkBA,EAAO,sBAAwB,KAC1DA,EAAO,uBACJA,EAAO,oBAAsBA,EAAO,uBAAyB,IAEhE,MAAM,IAAIM,EAAU,uBAAuB,EAE7C,OAAO,OAAO,OAAON,CAAM,CAC7B,CAEA,SAAgBQ,EAAkB,EAAgB,IAAa,CAE7D,GACED,EAAM,OAAS,MACf,CAACA,EAAM,WAAW,GAAG,GACrBA,EAAM,WAAW,IAAI,GACrB,0BAA0B,KAAKA,CAAK,EAEpC,MAAM,IAAID,EAAU,UAAU,EAChC,IAAMG,EAAM,IAAI,IAAIF,EAAO,qBAAqB,EAChD,GAAIE,EAAI,SAAW,sBAAuB,MAAM,IAAIH,EAAU,UAAU,EACxE,OAAOG,EAAI,SAAWA,EAAI,OAASA,EAAI,IACzC,CAEA,SAAgBC,EACd,EACA,EACM,CACN,IAAMC,EAASC,EAAQ,IAAI,QAAQ,EACnC,GACE,CAACD,GACD,CAACE,EAAe,SAASF,CAAM,GAC/BC,EAAQ,IAAI,gBAAgB,IAAM,aAElC,MAAM,IAAIN,EAAU,UAAU,EAEhC,IAAK,IAAMQ,KAAWD,EACpB,GAAI,IAAI,IAAIC,CAAO,CAAC,CAAC,SAAWA,EAC9B,MAAM,IAAIR,EAAU,uBAAuB,CAEjD,CAEA,SAAgBS,EAAkB,EAA0B,CAC1D,GACE,CAAC,OAAO,cAAcC,EAAQ,aAAa,GAC3CA,EAAQ,cAAgB,GACvB,CAACA,EAAQ,MAAM,WAAW,GAAG,GAAKA,EAAQ,OAAS,IAAA,GAEpD,MAAM,IAAIV,EAAU,uBAAuB,EAG7C,MAAO,CACL,SAAU,GACV,OAAQU,EAAQ,OAChB,SAAU,MACV,KAAMA,EAAQ,MAAQ,IACtB,OAAQA,EAAQ,aAClB,CACF,C"}

package/dist/modules/auth/server/bearer.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs"),n=require("../../../utils/normalization.cjs");let r=require("better-auth/oauth2");function i(t){if(t instanceof e.AuthError)return t;if((0,r.isInsufficientScopeError)(t))return new e.AuthError(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e.AuthError(`rejected`):n?.statusCode===403?new e.AuthError(`forbidden`):new e.AuthError(`unavailable`)}function a(e){if((0,r.isInsufficientScopeError)(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=i(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function o(a){let{verification:o}=a;try{if(!o.jwksUrl||o.remoteVerify)throw Error();n.parseHttpEndpoint(o.jwksUrl,{allowLoopbackHttp:a.allowLoopbackHttp});for(let e of[o.verifyOptions.issuer,o.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e.AuthError(`invalid_configuration`)}let s={...o,requiredScopes:o.requiredScopes&&[...o.requiredScopes],verifyOptions:{...o.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(o.verifyOptions.issuer)?[...o.verifyOptions.issuer]:o.verifyOptions.issuer,audience:Array.isArray(o.verifyOptions.audience)?[...o.verifyOptions.audience]:o.verifyOptions.audience,algorithms:[...o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...o.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let i=(0,r.requestToResourceInput)(n),o=(0,r.parseAccessTokenAuthorization)(i.authorizationHeader);if(o?.scheme!==`Bearer`||!i.authorizationHeader||!/^Bearer [^\s]+$/i.test(i.authorizationHeader))throw new e.AuthError(`rejected`);i.authorizationHeader=`Bearer `+o.token;let c=await(0,r.verifyAccessTokenRequest)(i,s);return t.assertAccessTokenClaims(c,a.claims),await a.authorize?.(c,n),c}catch(e){throw(0,r.isInsufficientScopeError)(e)?e:i(e)}}}exports.authFailure=a,exports.createBearerVerifier=o,exports.normalizeAuthError=i;

package/dist/modules/auth/server/bearer.d.cts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.cjs";
+import { AccessTokenClaimPolicy } from "./claims.cjs";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.cts.map

package/dist/modules/auth/server/bearer.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.cts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAeiB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.d.ts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.js";
+import { AccessTokenClaimPolicy } from "./claims.js";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/modules/auth/server/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAeiB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{assertAccessTokenClaims as t}from"./claims.js";import{parseHttpEndpoint as n}from"../../../utils/normalization.js";import{isInsufficientScopeError as r,parseAccessTokenAuthorization as i,requestToResourceInput as a,verifyAccessTokenRequest as o}from"better-auth/oauth2";function s(t){if(t instanceof e)return t;if(r(t))return new e(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e(`rejected`):n?.statusCode===403?new e(`forbidden`):new e(`unavailable`)}function c(e){if(r(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=s(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function l(c){let{verification:l}=c;try{if(!l.jwksUrl||l.remoteVerify)throw Error();n(l.jwksUrl,{allowLoopbackHttp:c.allowLoopbackHttp});for(let e of[l.verifyOptions.issuer,l.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=l.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e(`invalid_configuration`)}let u={...l,requiredScopes:l.requiredScopes&&[...l.requiredScopes],verifyOptions:{...l.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(l.verifyOptions.issuer)?[...l.verifyOptions.issuer]:l.verifyOptions.issuer,audience:Array.isArray(l.verifyOptions.audience)?[...l.verifyOptions.audience]:l.verifyOptions.audience,algorithms:[...l.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...l.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let r=a(n),s=i(r.authorizationHeader);if(s?.scheme!==`Bearer`||!r.authorizationHeader||!/^Bearer [^\s]+$/i.test(r.authorizationHeader))throw new e(`rejected`);r.authorizationHeader=`Bearer `+s.token;let l=await o(r,u);return t(l,c.claims),await c.authorize?.(l,n),l}catch(e){throw r(e)?e:s(e)}}}export{c as authFailure,l as createBearerVerifier,s as normalizeAuthError};
+//# sourceMappingURL=bearer.js.map

package/dist/modules/auth/server/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","names":["normalizeAuthError","error","AuthError","isInsufficientScopeError","value","authFailure","failure","createBearerVerifier","options","verification","parseHttpEndpoint","values","v","algorithms","a","native","input","requestToResourceInput","request","authorization","parseAccessTokenAuthorization","claims","verifyAccessTokenRequest","assertAccessTokenClaims"],"sources":["../../../../src/modules/auth/server/bearer.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport {\n  assertAccessTokenClaims,\n  type AccessTokenClaimPolicy,\n} from \"@/modules/auth/server/claims\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport {\n  isInsufficientScopeError,\n  parseAccessTokenAuthorization,\n  requestToResourceInput,\n  verifyAccessTokenRequest,\n  type VerifyAccessTokenOptions,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport interface AuthFailure {\n  status: number;\n  code: string;\n  headers?: Record<string, string>;\n}\n\nexport function normalizeAuthError(error: unknown): AuthError {\n  if (error instanceof AuthError) return error;\n  if (isInsufficientScopeError(error)) return new AuthError(\"forbidden\");\n  const value = error as { statusCode?: unknown; code?: unknown } | null;\n  if (\n    value?.statusCode === 401 ||\n    (typeof value?.code === \"string\" &&\n      /^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(value.code))\n  )\n    return new AuthError(\"rejected\");\n  if (value?.statusCode === 403) return new AuthError(\"forbidden\");\n  return new AuthError(\"unavailable\");\n}\n\n/** Sanitized framework-neutral projection; never includes SDK/transport causes. */\nexport function authFailure(error: unknown): AuthFailure {\n  if (isInsufficientScopeError(error))\n    return {\n      status: 403,\n      code: \"insufficient_scope\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"insufficient_scope\"' },\n    };\n  const failure = normalizeAuthError(error);\n  if (failure.code === \"rejected\")\n    return {\n      status: 401,\n      code: \"invalid_access_token\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"' },\n    };\n  if (failure.code === \"forbidden\") return { status: 403, code: \"forbidden\" };\n  return { status: 503, code: \"auth_unavailable\" };\n}\n\nexport interface BearerVerifierOptions {\n  verification: VerifyAccessTokenOptions;\n  claims?: AccessTokenClaimPolicy;\n  allowLoopbackHttp?: boolean;\n  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;\n}\n\n/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */\nexport function createBearerVerifier(options: BearerVerifierOptions) {\n  const { verification } = options;\n  try {\n    if (!verification.jwksUrl || verification.remoteVerify) throw new Error();\n    parseHttpEndpoint(verification.jwksUrl, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    for (const value of [\n      verification.verifyOptions.issuer,\n      verification.verifyOptions.audience,\n    ]) {\n      const values = Array.isArray(value) ? value : [value];\n      if (!values.length || values.some((v) => typeof v !== \"string\" || !v))\n        throw new Error();\n    }\n    const algorithms = verification.verifyOptions.algorithms ?? [\n      \"RS256\",\n      \"ES256\",\n      \"EdDSA\",\n    ];\n    if (\n      !algorithms.length ||\n      algorithms.some((a) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(a))\n    )\n      throw new Error();\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  // Snapshot mutable host options so later changes cannot weaken verification.\n  const native: VerifyAccessTokenOptions = {\n    ...verification,\n    requiredScopes: verification.requiredScopes && [...verification.requiredScopes],\n    verifyOptions: {\n      ...verification.verifyOptions,\n      typ: \"at+jwt\",\n      issuer: Array.isArray(verification.verifyOptions.issuer)\n        ? [...verification.verifyOptions.issuer]\n        : verification.verifyOptions.issuer,\n      audience: Array.isArray(verification.verifyOptions.audience)\n        ? [...verification.verifyOptions.audience]\n        : verification.verifyOptions.audience,\n      algorithms: [\n        ...(verification.verifyOptions.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"]),\n      ],\n      requiredClaims: [\n        ...new Set([\n          ...(verification.verifyOptions.requiredClaims ?? []),\n          \"iss\",\n          \"aud\",\n          \"sub\",\n          \"iat\",\n          \"exp\",\n        ]),\n      ],\n    },\n  };\n  return async function verify(request: Request) {\n    try {\n      const input = requestToResourceInput(request);\n      const authorization = parseAccessTokenAuthorization(input.authorizationHeader);\n      if (\n        authorization?.scheme !== \"Bearer\" ||\n        !input.authorizationHeader ||\n        !/^Bearer [^\\s]+$/i.test(input.authorizationHeader)\n      )\n        throw new AuthError(\"rejected\");\n      input.authorizationHeader = \"Bearer \" + authorization.token;\n      const claims = await verifyAccessTokenRequest(input, native);\n      assertAccessTokenClaims(claims, options.claims);\n      await options.authorize?.(claims, request);\n      return claims;\n    } catch (error) {\n      // Keep the SDK's typed scope error so the adapter can issue RFC 6750's challenge.\n      if (isInsufficientScopeError(error)) throw error;\n      throw normalizeAuthError(error);\n    }\n  };\n}\n"],"mappings":"A,iUAqBA,SAAgBA,EAAmB,EAA2B,CAC5D,GAAIC,aAAiBC,EAAW,OAAOD,EACvC,GAAIE,EAAyBF,CAAK,EAAG,OAAO,IAAIC,EAAU,WAAW,EACrE,IAAME,EAAQH,EAQd,OANEG,GAAO,aAAe,KACrB,OAAOA,GAAO,MAAS,UACtB,uDAAuD,KAAKA,EAAM,IAAI,EAEjE,IAAIF,EAAU,UAAU,EAC7BE,GAAO,aAAe,IAAY,IAAIF,EAAU,WAAW,EACxD,IAAIA,EAAU,aAAa,CACpC,CAGA,SAAgBG,EAAY,EAA6B,CACvD,GAAIF,EAAyBF,CAAK,EAChC,MAAO,CACL,OAAQ,IACR,KAAM,qBACN,QAAS,CAAE,mBAAoB,mCAAoC,CACrE,EACF,IAAMK,EAAUN,EAAmBC,CAAK,EAQxC,OAPIK,EAAQ,OAAS,WACZ,CACL,OAAQ,IACR,KAAM,uBACN,QAAS,CAAE,mBAAoB,8BAA+B,CAChE,EACEA,EAAQ,OAAS,YAAoB,CAAE,OAAQ,IAAK,KAAM,WAAY,EACnE,CAAE,OAAQ,IAAK,KAAM,kBAAmB,CACjD,CAUA,SAAgBC,EAAqB,EAAgC,CACnE,GAAM,CAAE,gBAAiBC,EACzB,GAAI,CACF,GAAI,CAACC,EAAa,SAAWA,EAAa,aAAc,MAAU,MAAM,EACxEC,EAAkBD,EAAa,QAAS,CACtC,kBAAmBD,EAAQ,iBAC7B,CAAC,EACD,IAAK,IAAMJ,IAAS,CAClBK,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,EAAG,CACD,IAAME,EAAS,MAAM,QAAQP,CAAK,EAAIA,EAAQ,CAACA,CAAK,EACpD,GAAI,CAACO,EAAO,QAAUA,EAAO,KAAM,GAAM,OAAOC,GAAM,UAAY,CAACA,CAAC,EAClE,MAAU,MAAM,CACpB,CACA,IAAMC,EAAaJ,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACI,EAAW,QACZA,EAAW,KAAM,GAAM,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAC,CAAC,EAE/D,MAAU,MAAM,CACpB,MAAQ,CACN,MAAM,IAAIZ,EAAU,uBAAuB,CAC7C,CAEA,IAAMa,EAAmC,CACvC,GAAGN,EACH,eAAgBA,EAAa,gBAAkB,CAAC,GAAGA,EAAa,cAAc,EAC9E,cAAe,CACb,GAAGA,EAAa,cAChB,IAAK,SACL,OAAQ,MAAM,QAAQA,EAAa,cAAc,MAAM,EACnD,CAAC,GAAGA,EAAa,cAAc,MAAM,EACrCA,EAAa,cAAc,OAC/B,SAAU,MAAM,QAAQA,EAAa,cAAc,QAAQ,EACvD,CAAC,GAAGA,EAAa,cAAc,QAAQ,EACvCA,EAAa,cAAc,SAC/B,WAAY,CACV,GAAIA,EAAa,cAAc,YAAc,CAAC,QAAS,QAAS,OAAO,CACzE,EACA,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIA,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,CACF,CACF,EACA,OAAO,eAAsB,EAAkB,CAC7C,GAAI,CACF,IAAMO,EAAQC,EAAuBC,CAAO,EACtCC,EAAgBC,EAA8BJ,EAAM,mBAAmB,EAC7E,GACEG,GAAe,SAAW,UAC1B,CAACH,EAAM,qBACP,CAAC,mBAAmB,KAAKA,EAAM,mBAAmB,EAElD,MAAM,IAAId,EAAU,UAAU,EAChC,EAAM,oBAAsB,UAAYiB,EAAc,MACtD,IAAME,EAAS,MAAMC,EAAyBN,EAAOD,CAAM,EAG3D,OAFAQ,EAAwBF,EAAQb,EAAQ,MAAM,EAC9C,MAAMA,EAAQ,YAAYa,EAAQH,CAAO,EAClCG,CACT,OAASpB,EAAO,CAGd,MADIE,EAAyBF,CAAK,EAASA,EACrCD,EAAmBC,CAAK,CAChC,CACF,CACF,C"}

package/dist/modules/auth/server/claims.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");let t=require("zod");const n=t.z.string().min(1).max(255),r=t.z.looseObject({sub:n,email:t.z.string().optional(),name:t.z.string().nullable().optional(),email_verified:t.z.boolean().optional(),preferred_username:t.z.string().nullable().optional(),picture:t.z.string().nullable().optional(),status:t.z.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e.AuthError(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e.AuthError(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e.AuthError(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}exports.assertAccessTokenClaims=i,exports.assertSessionContinuity=o,exports.assertTokenContinuity=a,exports.authSubjectSchema=n,exports.mapOAuthUserProfile=s,exports.oauthUserInfoSchema=r;

package/dist/modules/auth/server/claims.d.cts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-ii8DV63k.cjs";
+import { z } from "zod";
+import { JWTPayload } from "jose";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.cts.map

package/dist/modules/auth/server/claims.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.cts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.d.ts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-ii8DV63k.js";
+import { z } from "zod";
+import { JWTPayload } from "jose";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.ts.map

package/dist/modules/auth/server/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{z as t}from"zod";const n=t.string().min(1).max(255),r=t.looseObject({sub:n,email:t.string().optional(),name:t.string().nullable().optional(),email_verified:t.boolean().optional(),preferred_username:t.string().nullable().optional(),picture:t.string().nullable().optional(),status:t.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}export{i as assertAccessTokenClaims,o as assertSessionContinuity,a as assertTokenContinuity,n as authSubjectSchema,s as mapOAuthUserProfile,r as oauthUserInfoSchema};
+//# sourceMappingURL=claims.js.map

package/dist/modules/auth/server/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","names":["authSubjectSchema","z","oauthUserInfoSchema","assertAccessTokenClaims","policy","AuthError","claims","assertTokenContinuity","binding","assertSessionContinuity","before","after","value","mapOAuthUserProfile","result","profile"],"sources":["../../../../src/modules/auth/server/claims.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { AuthSessionBinding } from \"@/utils/interface\";\nimport type { JWTPayload } from \"jose\";\nimport { z } from \"zod\";\n\nexport const authSubjectSchema = z.string().min(1).max(255);\n/** Profile shape only. Status/roles and admission policy belong to the application. */\nexport const oauthUserInfoSchema = z.looseObject({\n  sub: authSubjectSchema,\n  email: z.string().optional(),\n  name: z.string().nullable().optional(),\n  email_verified: z.boolean().optional(),\n  preferred_username: z.string().nullable().optional(),\n  picture: z.string().nullable().optional(),\n  status: z.string().optional(),\n});\nexport type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;\n\nexport interface AccessTokenClaimPolicy {\n  requireSid?: boolean;\n  maxLifetimeSeconds?: number;\n}\n\n/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */\nexport function assertAccessTokenClaims(\n  claims: JWTPayload,\n  policy: AccessTokenClaimPolicy = {},\n): asserts claims is JWTPayload & { sub: string; iat: number; exp: number } {\n  if (\n    policy.maxLifetimeSeconds !== undefined &&\n    (!Number.isSafeInteger(policy.maxLifetimeSeconds) || policy.maxLifetimeSeconds < 1)\n  )\n    throw new AuthError(\"invalid_configuration\");\n  if (\n    !authSubjectSchema.safeParse(claims.sub).success ||\n    !Number.isSafeInteger(claims.iat) ||\n    !Number.isSafeInteger(claims.exp) ||\n    claims.iat! < 0 ||\n    claims.exp! <= claims.iat! ||\n    (policy.maxLifetimeSeconds !== undefined &&\n      claims.exp! - claims.iat! > policy.maxLifetimeSeconds) ||\n    (policy.requireSid && claims.sid === undefined) ||\n    (claims.sid !== undefined && !authSubjectSchema.safeParse(claims.sid).success)\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertTokenContinuity(\n  claims: Pick<JWTPayload, \"sub\"> & { sid?: unknown },\n  binding: Pick<AuthSessionBinding, \"subject\" | \"sid\">,\n): void {\n  if (\n    !authSubjectSchema.safeParse(binding.subject).success ||\n    (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success) ||\n    claims.sub !== binding.subject ||\n    claims.sid !== binding.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertSessionContinuity(\n  before: Readonly<AuthSessionBinding>,\n  after: Readonly<AuthSessionBinding>,\n): void {\n  for (const binding of [before, after]) {\n    if (\n      [binding.id, binding.userId, binding.subject].some(\n        (value) => !authSubjectSchema.safeParse(value).success,\n      ) ||\n      (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success)\n    )\n      throw new AuthError(\"rejected\");\n  }\n  if (\n    before.id !== after.id ||\n    before.userId !== after.userId ||\n    before.subject !== after.subject ||\n    before.sid !== after.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function mapOAuthUserProfile(value: unknown) {\n  const result = oauthUserInfoSchema.safeParse(value);\n  if (!result.success) throw new AuthError(\"rejected\");\n  const profile = result.data;\n  return {\n    externalUserId: profile.sub,\n    emailVerified: profile.email_verified === true,\n    username: profile.preferred_username ?? null,\n    image: profile.picture ?? undefined,\n    ...(profile.status === undefined ? {} : { ssoStatus: profile.status }),\n  };\n}\n"],"mappings":"A,oEAKA,MAAaA,EAAoBC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAE7CC,EAAsBD,EAAE,YAAY,CAC/C,IAAKD,EACL,MAAOC,EAAE,OAAO,CAAC,CAAC,SAAS,EAC3B,KAAMA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACrC,eAAgBA,EAAE,QAAQ,CAAC,CAAC,SAAS,EACrC,mBAAoBA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACnD,QAASA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACxC,OAAQA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC9B,CAAC,EASD,SAAgBE,EACd,EACA,EAAiC,CAAC,EACwC,CAC1E,GACEC,EAAO,qBAAuB,IAAA,KAC7B,CAAC,OAAO,cAAcA,EAAO,kBAAkB,GAAKA,EAAO,mBAAqB,GAEjF,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACL,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,SACzC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChCA,EAAO,IAAO,GACdA,EAAO,KAAQA,EAAO,KACrBF,EAAO,qBAAuB,IAAA,IAC7BE,EAAO,IAAOA,EAAO,IAAOF,EAAO,oBACpCA,EAAO,YAAcE,EAAO,MAAQ,IAAA,IACpCA,EAAO,MAAQ,IAAA,IAAa,CAACN,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,QAEtE,MAAM,IAAID,EAAU,UAAU,CAClC,CAEA,SAAgBE,EACd,EACA,EACM,CACN,GACE,CAACP,EAAkB,UAAUQ,EAAQ,OAAO,CAAC,CAAC,SAC7CA,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,SACxEF,EAAO,MAAQE,EAAQ,SACvBF,EAAO,MAAQE,EAAQ,IAEvB,MAAM,IAAIH,EAAU,UAAU,CAClC,CAEA,SAAgBI,EACd,EACA,EACM,CACN,IAAK,IAAMD,IAAW,CAACE,EAAQC,CAAK,EAClC,GACE,CAACH,EAAQ,GAAIA,EAAQ,OAAQA,EAAQ,OAAO,CAAC,CAAC,KAC3C,GAAU,CAACR,EAAkB,UAAUY,CAAK,CAAC,CAAC,OACjD,GACCJ,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,QAExE,MAAM,IAAIH,EAAU,UAAU,EAElC,GACEK,EAAO,KAAOC,EAAM,IACpBD,EAAO,SAAWC,EAAM,QACxBD,EAAO,UAAYC,EAAM,SACzBD,EAAO,MAAQC,EAAM,IAErB,MAAM,IAAIN,EAAU,UAAU,CAClC,CAEA,SAAgBQ,EAAoB,EAAgB,CAClD,IAAMC,EAASZ,EAAoB,UAAUU,CAAK,EAClD,GAAI,CAACE,EAAO,QAAS,MAAM,IAAIT,EAAU,UAAU,EACnD,IAAMU,EAAUD,EAAO,KACvB,MAAO,CACL,eAAgBC,EAAQ,IACxB,cAAeA,EAAQ,iBAAmB,GAC1C,SAAUA,EAAQ,oBAAsB,KACxC,MAAOA,EAAQ,SAAW,IAAA,GAC1B,GAAIA,EAAQ,SAAW,IAAA,GAAY,CAAC,EAAI,CAAE,UAAWA,EAAQ,MAAO,CACtE,CACF,C"}

package/dist/modules/auth/server/crypto.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");let t=require("jose");async function n(n){try{return t.base64url.encode(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(n))))}catch{throw new e.AuthError(`unavailable`)}}exports.fingerprintAuthValue=n;

package/dist/modules/auth/server/crypto.d.cts

@@ -0,0 +1,3 @@
+/** Hash cache keys; never store bearer credentials as Map keys. */
+export declare function fingerprintAuthValue(value: string): Promise<string>;
+//# sourceMappingURL=crypto.d.cts.map

package/dist/modules/auth/server/crypto.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.cts","names":[],"sources":["../../../../src/modules/auth/server/crypto.ts"],"mappings":";wBAIsB,qBAAqB,gBAAgB"}

package/dist/modules/auth/server/crypto.d.ts

@@ -0,0 +1,3 @@
+/** Hash cache keys; never store bearer credentials as Map keys. */
+export declare function fingerprintAuthValue(value: string): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/modules/auth/server/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","names":[],"sources":["../../../../src/modules/auth/server/crypto.ts"],"mappings":";wBAIsB,qBAAqB,gBAAgB"}

package/dist/modules/auth/server/crypto.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{base64url as t}from"jose";async function n(n){try{return t.encode(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(n))))}catch{throw new e(`unavailable`)}}export{n as fingerprintAuthValue};
+//# sourceMappingURL=crypto.js.map

package/dist/modules/auth/server/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","names":["fingerprintAuthValue","base64url","value","AuthError"],"sources":["../../../../src/modules/auth/server/crypto.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { base64url } from \"jose\";\n\n/** Hash cache keys; never store bearer credentials as Map keys. */\nexport async function fingerprintAuthValue(value: string): Promise<string> {\n  try {\n    return base64url.encode(\n      new Uint8Array(\n        await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)),\n      ),\n    );\n  } catch {\n    throw new AuthError(\"unavailable\");\n  }\n}\n"],"mappings":"A,6EAIA,eAAsBA,EAAqB,EAAgC,CACzE,GAAI,CACF,OAAOC,EAAU,OACf,IAAI,WACF,MAAM,OAAO,OAAO,OAAO,UAAW,IAAI,YAAY,CAAC,CAAC,OAAOC,CAAK,CAAC,CACvE,CACF,CACF,MAAQ,CACN,MAAM,IAAIC,EAAU,aAAa,CACnC,CACF,C"}

package/dist/modules/auth/server/grant-guard.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs");function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t.assertSessionContinuity(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=n;

package/dist/modules/auth/server/grant-guard.d.cts

@@ -0,0 +1,6 @@
+import { I as SessionGrantGuardOptions, d as AuthSessionBinding } from "../../../interface-ii8DV63k.cjs";
+/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */
+export declare function createSessionGrantGuard(options: SessionGrantGuardOptions): {
+  run<Value>(operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>, signal?: AbortSignal): Promise<Value>;
+};
+//# sourceMappingURL=grant-guard.d.cts.map

package/dist/modules/auth/server/grant-guard.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.d.ts

@@ -0,0 +1,6 @@
+import { I as SessionGrantGuardOptions, d as AuthSessionBinding } from "../../../interface-ii8DV63k.js";
+/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */
+export declare function createSessionGrantGuard(options: SessionGrantGuardOptions): {
+  run<Value>(operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>, signal?: AbortSignal): Promise<Value>;
+};
+//# sourceMappingURL=grant-guard.d.ts.map

package/dist/modules/auth/server/grant-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{assertSessionContinuity as t}from"./claims.js";function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{n as createSessionGrantGuard};
+//# sourceMappingURL=grant-guard.js.map

package/dist/modules/auth/server/grant-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","assertSessionContinuity","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { assertSessionContinuity } from \"@/modules/auth/server/claims\";\nimport type { AuthSessionBinding, SessionGrantGuardOptions } from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" || !identifier || identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" || !value.sid || value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        assertSessionContinuity(before, after);\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,kGAKA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UAAY,CAACA,GAAcA,EAAW,OAAS,GACzE,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UAAY,CAACA,EAAM,KAAOA,EAAM,IAAI,OAAS,MACrE,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EAGzB,OAFAW,EAAwBJ,EAAQG,CAAK,EACrCJ,GAAQ,eAAe,EAChBE,CACT,OAASI,EAAO,CAGd,MAFIN,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDS,aAAiBT,EAAiBS,EAChC,IAAIT,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/identity-cache.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../client/retry.cjs"),t=require("../interface.cjs"),n=require("./crypto.cjs");function r(r){let i=r.now??Date.now,a=r.maxAgeMs??12e4,o=r.capacity??512,s=r.maxPending??o,c=r.key??n.fingerprintAuthValue;if(![a,o,s].every(Number.isSafeInteger)||a<0||o<1||s<1)throw new t.AuthError(`invalid_configuration`);let l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=/* @__PURE__ */ new Set,f=0;async function p(n,p={}){if(p.signal?.throwIfAborted(),!n||n.length>32768)throw new t.AuthError(`rejected`);let m=f,h=/* @__PURE__ */ new Set;d.add(h);let g;try{g=await c(n)}catch{throw new t.AuthError(`unavailable`)}finally{d.delete(h)}if(p.signal?.throwIfAborted(),m!==f||h.has(g))throw new t.AuthError(`rejected`);if(!g||g.length>2048)throw new t.AuthError(`invalid_configuration`);let _=u.get(g);if(_)return await e.waitForAuthOperation(_.promise,p.signal);let v=l.get(g);if(!p.fresh&&v&&v.expiresAt>i())return v.value;if(l.delete(g),u.size>=s)throw new t.AuthError(`unavailable`);let y=i(),b=Symbol(),x=(async()=>{await Promise.resolve();try{let e=await r.load(n);if(m!==f||u.get(g)?.marker!==b)throw new t.AuthError(`rejected`);let s=i();for(let[e,t]of l)t.expiresAt<=s&&l.delete(e);return y+a>s&&(l.size>=o&&l.delete(l.keys().next().value),l.set(g,{value:e,expiresAt:y+a})),e}catch(e){throw e instanceof t.AuthError?e:new t.AuthError(`unavailable`)}finally{u.get(g)?.marker===b&&u.delete(g)}})();return u.set(g,{promise:x,marker:b}),await e.waitForAuthOperation(x,p.signal)}return{get:p,async forget(e){try{let t=await c(e);for(let e of d)e.add(t);l.delete(t),u.delete(t)}catch{throw new t.AuthError(`unavailable`)}},clear(){f++,l.clear(),u.clear()}}}exports.createIdentityCache=r;

package/dist/modules/auth/server/identity-cache.d.cts

@@ -0,0 +1,8 @@
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-ii8DV63k.cjs";
+/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */
+export declare function createIdentityCache<Value>(options: IdentityCacheOptions<Value>): {
+  get: (credential: string, input?: IdentityCacheInput) => Promise<Value>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=identity-cache.d.cts.map

package/dist/modules/auth/server/identity-cache.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.d.cts","names":[],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"mappings":";;wBASgB,oBAAoB,OAClC,SAAS,qBAAqB;EAwBhB,MAAA,oBAAM,QACX,uBACN,QAAQ;EAwDgB,OAAA,qBAAM"}

package/dist/modules/auth/server/identity-cache.d.ts

@@ -0,0 +1,8 @@
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-ii8DV63k.js";
+/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */
+export declare function createIdentityCache<Value>(options: IdentityCacheOptions<Value>): {
+  get: (credential: string, input?: IdentityCacheInput) => Promise<Value>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=identity-cache.d.ts.map

package/dist/modules/auth/server/identity-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.d.ts","names":[],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"mappings":";;wBASgB,oBAAoB,OAClC,SAAS,qBAAqB;EAwBhB,MAAA,oBAAM,QACX,uBACN,QAAQ;EAwDgB,OAAA,qBAAM"}

package/dist/modules/auth/server/identity-cache.js

@@ -0,0 +1,2 @@
+import{waitForAuthOperation as e}from"../client/retry.js";import{AuthError as t}from"../interface.js";import{fingerprintAuthValue as n}from"./crypto.js";function r(r){let i=r.now??Date.now,a=r.maxAgeMs??12e4,o=r.capacity??512,s=r.maxPending??o,c=r.key??n;if(![a,o,s].every(Number.isSafeInteger)||a<0||o<1||s<1)throw new t(`invalid_configuration`);let l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=/* @__PURE__ */ new Set,f=0;async function p(n,p={}){if(p.signal?.throwIfAborted(),!n||n.length>32768)throw new t(`rejected`);let m=f,h=/* @__PURE__ */ new Set;d.add(h);let g;try{g=await c(n)}catch{throw new t(`unavailable`)}finally{d.delete(h)}if(p.signal?.throwIfAborted(),m!==f||h.has(g))throw new t(`rejected`);if(!g||g.length>2048)throw new t(`invalid_configuration`);let _=u.get(g);if(_)return await e(_.promise,p.signal);let v=l.get(g);if(!p.fresh&&v&&v.expiresAt>i())return v.value;if(l.delete(g),u.size>=s)throw new t(`unavailable`);let y=i(),b=Symbol(),x=(async()=>{await Promise.resolve();try{let e=await r.load(n);if(m!==f||u.get(g)?.marker!==b)throw new t(`rejected`);let s=i();for(let[e,t]of l)t.expiresAt<=s&&l.delete(e);return y+a>s&&(l.size>=o&&l.delete(l.keys().next().value),l.set(g,{value:e,expiresAt:y+a})),e}catch(e){throw e instanceof t?e:new t(`unavailable`)}finally{u.get(g)?.marker===b&&u.delete(g)}})();return u.set(g,{promise:x,marker:b}),await e(x,p.signal)}return{get:p,async forget(e){try{let t=await c(e);for(let e of d)e.add(t);l.delete(t),u.delete(t)}catch{throw new t(`unavailable`)}},clear(){f++,l.clear(),u.clear()}}}export{r as createIdentityCache};
+//# sourceMappingURL=identity-cache.js.map

package/dist/modules/auth/server/identity-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.js","names":["createIdentityCache","now","options","ttl","capacity","maxPending","fingerprint","fingerprintAuthValue","AuthError","cache","flights","derivations","generation","get","input","credential","version","invalidated","key","pending","waitForAuthOperation","cached","startedAt","marker","operation","value","time","previous","entry","error"],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"sourcesContent":["import { waitForAuthOperation } from \"@/modules/auth/client/retry\";\nimport { AuthError } from \"@/modules/auth/interface\";\nimport { fingerprintAuthValue } from \"@/modules/auth/server/crypto\";\nimport type {\n  IdentityCacheInput,\n  IdentityCacheOptions,\n} from \"@/utils/interface\";\n\n/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */\nexport function createIdentityCache<Value>(\n  options: IdentityCacheOptions<Value>,\n) {\n  const now = options.now ?? Date.now;\n  const ttl = options.maxAgeMs ?? 120_000;\n  const capacity = options.capacity ?? 512;\n  const maxPending = options.maxPending ?? capacity;\n  const fingerprint = options.key ?? fingerprintAuthValue;\n  if (\n    ![ttl, capacity, maxPending].every(Number.isSafeInteger) ||\n    ttl < 0 ||\n    capacity < 1 ||\n    maxPending < 1\n  )\n    throw new AuthError(\"invalid_configuration\");\n  const cache = new Map<string, { value: Value; expiresAt: number }>();\n  const flights = new Map<\n    string,\n    { promise: Promise<Value>; marker: symbol }\n  >();\n  // Pending key derivation must also observe per-credential invalidation.\n  const derivations = new Set<Set<string>>();\n  let generation = 0;\n\n  async function get(\n    credential: string,\n    input: IdentityCacheInput = {},\n  ): Promise<Value> {\n    input.signal?.throwIfAborted();\n    if (!credential || credential.length > 32768)\n      throw new AuthError(\"rejected\");\n    const version = generation;\n    const invalidated = new Set<string>();\n    derivations.add(invalidated);\n    let key: string;\n    try {\n      key = await fingerprint(credential);\n    } catch {\n      throw new AuthError(\"unavailable\");\n    } finally {\n      derivations.delete(invalidated);\n    }\n    input.signal?.throwIfAborted();\n    if (version !== generation || invalidated.has(key))\n      throw new AuthError(\"rejected\");\n    if (!key || key.length > 2048) throw new AuthError(\"invalid_configuration\");\n    const pending = flights.get(key);\n    if (pending)\n      return await waitForAuthOperation(pending.promise, input.signal);\n    const cached = cache.get(key);\n    if (!input.fresh && cached && cached.expiresAt > now()) return cached.value;\n    cache.delete(key);\n    if (flights.size >= maxPending) throw new AuthError(\"unavailable\");\n    const startedAt = now();\n    const marker = Symbol();\n    const operation = (async () => {\n      await Promise.resolve(); // Register before a throwing/reentrant adapter.\n      try {\n        const value = await options.load(credential);\n        if (version !== generation || flights.get(key)?.marker !== marker)\n          throw new AuthError(\"rejected\");\n        const time = now();\n        for (const [previous, entry] of cache)\n          if (entry.expiresAt <= time) cache.delete(previous);\n        // TTL starts before networking; never cache an already stale response.\n        if (startedAt + ttl > time) {\n          if (cache.size >= capacity) cache.delete(cache.keys().next().value!);\n          cache.set(key, { value, expiresAt: startedAt + ttl });\n        }\n        return value;\n      } catch (error) {\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      } finally {\n        if (flights.get(key)?.marker === marker) flights.delete(key);\n      }\n    })();\n    flights.set(key, { promise: operation, marker });\n    return await waitForAuthOperation(operation, input.signal);\n  }\n\n  return {\n    get,\n    async forget(credential: string) {\n      try {\n        const key = await fingerprint(credential);\n        for (const pending of derivations) pending.add(key);\n        cache.delete(key);\n        flights.delete(key); // Fence success/error from an earlier load.\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n    clear() {\n      generation++;\n      cache.clear();\n      flights.clear();\n    },\n  };\n}\n"],"mappings":"A,yJASA,SAAgBA,EACd,EACA,CACA,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAC1BC,EAAMD,EAAQ,UAAY,KAC1BE,EAAWF,EAAQ,UAAY,IAC/BG,EAAaH,EAAQ,YAAcE,EACnCE,EAAcJ,EAAQ,KAAOK,EACnC,GACE,CAAC,CAACJ,EAAKC,EAAUC,CAAU,CAAC,CAAC,MAAM,OAAO,aAAa,GACvDF,EAAM,GACNC,EAAW,GACXC,EAAa,EAEb,MAAM,IAAIG,EAAU,uBAAuB,EAC7C,IAAMC,kBAAQ,IAAI,IACZC,kBAAU,IAAI,IAKdC,kBAAc,IAAI,IACpBC,EAAa,EAEjB,eAAeC,EACb,EACA,EAA4B,CAAC,EACb,CAEhB,GADAC,EAAM,QAAQ,eAAe,EACzB,CAACC,GAAcA,EAAW,OAAS,MACrC,MAAM,IAAIP,EAAU,UAAU,EAChC,IAAMQ,EAAUJ,EACVK,kBAAc,IAAI,IACxBN,EAAY,IAAIM,CAAW,EAC3B,IAAIC,EACJ,GAAI,CACF,EAAM,MAAMZ,EAAYS,CAAU,CACpC,MAAQ,CACN,MAAM,IAAIP,EAAU,aAAa,CACnC,QAAU,CACRG,EAAY,OAAOM,CAAW,CAChC,CAEA,GADAH,EAAM,QAAQ,eAAe,EACzBE,IAAYJ,GAAcK,EAAY,IAAIC,CAAG,EAC/C,MAAM,IAAIV,EAAU,UAAU,EAChC,GAAI,CAACU,GAAOA,EAAI,OAAS,KAAM,MAAM,IAAIV,EAAU,uBAAuB,EAC1E,IAAMW,EAAUT,EAAQ,IAAIQ,CAAG,EAC/B,GAAIC,EACF,OAAO,MAAMC,EAAqBD,EAAQ,QAASL,EAAM,MAAM,EACjE,IAAMO,EAASZ,EAAM,IAAIS,CAAG,EAC5B,GAAI,CAACJ,EAAM,OAASO,GAAUA,EAAO,UAAYpB,EAAI,EAAG,OAAOoB,EAAO,MAEtE,GADAZ,EAAM,OAAOS,CAAG,EACZR,EAAQ,MAAQL,EAAY,MAAM,IAAIG,EAAU,aAAa,EACjE,IAAMc,EAAYrB,EAAI,EAChBsB,EAAS,OAAO,EAChBC,GAAa,SAAY,CAC7B,MAAM,QAAQ,QAAQ,EACtB,GAAI,CACF,IAAMC,EAAQ,MAAMvB,EAAQ,KAAKa,CAAU,EAC3C,GAAIC,IAAYJ,GAAcF,EAAQ,IAAIQ,CAAG,CAAC,EAAE,SAAWK,EACzD,MAAM,IAAIf,EAAU,UAAU,EAChC,IAAMkB,EAAOzB,EAAI,EACjB,IAAK,GAAM,CAAC0B,EAAUC,KAAUnB,EAC1BmB,EAAM,WAAaF,GAAMjB,EAAM,OAAOkB,CAAQ,EAMpD,OAJIL,EAAYnB,EAAMuB,IAChBjB,EAAM,MAAQL,GAAUK,EAAM,OAAOA,EAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAM,EACnEA,EAAM,IAAIS,EAAK,CAAE,QAAO,UAAWI,EAAYnB,CAAI,CAAC,GAE/CsB,CACT,OAASI,EAAO,CAEd,MADIA,aAAiBrB,EAAiBqB,EAChC,IAAIrB,EAAU,aAAa,CACnC,QAAU,CACJE,EAAQ,IAAIQ,CAAG,CAAC,EAAE,SAAWK,GAAQb,EAAQ,OAAOQ,CAAG,CAC7D,CACF,EAAA,CAAG,EAEH,OADAR,EAAQ,IAAIQ,EAAK,CAAE,QAASM,EAAW,QAAO,CAAC,EACxC,MAAMJ,EAAqBI,EAAWV,EAAM,MAAM,CAC3D,CAEA,MAAO,CACL,MACA,MAAM,OAAO,EAAoB,CAC/B,GAAI,CACF,IAAMI,EAAM,MAAMZ,EAAYS,CAAU,EACxC,IAAK,IAAMI,KAAWR,EAAaQ,EAAQ,IAAID,CAAG,EAClDT,EAAM,OAAOS,CAAG,EAChBR,EAAQ,OAAOQ,CAAG,CACpB,MAAQ,CACN,MAAM,IAAIV,EAAU,aAAa,CACnC,CACF,EACA,OAAQ,CACN,IACAC,EAAM,MAAM,EACZC,EAAQ,MAAM,CAChB,CACF,CACF,C"}

package/dist/modules/auth/server/identity.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){if(!t.providerId)throw new e.AuthError(`invalid_configuration`);return async({user:e,source:n})=>{try{let r=n.oauth?.profile;if(n.method!==`oauth`||n.oauth?.providerId!==t.providerId||typeof r?.sub!=`string`||!r.sub||r.sub.length>255||r.sub!==t.subject(e))return{error:`invalid_identity_source`};if(t.allowed&&!await t.allowed(r))return{error:`account_unavailable`}}catch{return{error:`account_unavailable`}}}}exports.createOAuthIdentityValidator=t;

package/dist/modules/auth/server/identity.d.cts

@@ -0,0 +1,5 @@
+import { M as OAuthIdentityValidatorOptions } from "../../../interface-ii8DV63k.cjs";
+import { BetterAuthOptions } from "better-auth";
+/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */
+export declare function createOAuthIdentityValidator(options: OAuthIdentityValidatorOptions): NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+//# sourceMappingURL=identity.d.cts.map

package/dist/modules/auth/server/identity.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.cts","names":[],"sources":["../../../../src/modules/auth/server/identity.ts"],"mappings":";;;wBAKgB,6BACd,SAAS,gCACR,YAAY,YAAY"}

package/dist/modules/auth/server/identity.d.ts

@@ -0,0 +1,5 @@
+import { M as OAuthIdentityValidatorOptions } from "../../../interface-ii8DV63k.js";
+import { BetterAuthOptions } from "better-auth";
+/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */
+export declare function createOAuthIdentityValidator(options: OAuthIdentityValidatorOptions): NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/modules/auth/server/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","names":[],"sources":["../../../../src/modules/auth/server/identity.ts"],"mappings":";;;wBAKgB,6BACd,SAAS,gCACR,YAAY,YAAY"}

package/dist/modules/auth/server/identity.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t){if(!t.providerId)throw new e(`invalid_configuration`);return async({user:e,source:n})=>{try{let r=n.oauth?.profile;if(n.method!==`oauth`||n.oauth?.providerId!==t.providerId||typeof r?.sub!=`string`||!r.sub||r.sub.length>255||r.sub!==t.subject(e))return{error:`invalid_identity_source`};if(t.allowed&&!await t.allowed(r))return{error:`account_unavailable`}}catch{return{error:`account_unavailable`}}}}export{t as createOAuthIdentityValidator};
+//# sourceMappingURL=identity.js.map

package/dist/modules/auth/server/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","names":["createOAuthIdentityValidator","options","AuthError","profile","source","user"],"sources":["../../../../src/modules/auth/server/identity.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { OAuthIdentityValidatorOptions } from \"@/utils/interface\";\nimport type { BetterAuthOptions } from \"better-auth\";\n\n/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */\nexport function createOAuthIdentityValidator(\n  options: OAuthIdentityValidatorOptions,\n): NonNullable<NonNullable<BetterAuthOptions[\"user\"]>[\"validateUserInfo\"]> {\n  if (!options.providerId) throw new AuthError(\"invalid_configuration\");\n  return async ({ user, source }) => {\n    try {\n      const profile = source.oauth?.profile;\n      if (\n        source.method !== \"oauth\" ||\n        source.oauth?.providerId !== options.providerId ||\n        typeof profile?.sub !== \"string\" ||\n        !profile.sub ||\n        profile.sub.length > 255 ||\n        profile.sub !== options.subject(user)\n      )\n        return { error: \"invalid_identity_source\" };\n      if (options.allowed && !(await options.allowed(profile)))\n        return { error: \"account_unavailable\" };\n    } catch {\n      return { error: \"account_unavailable\" };\n    }\n  };\n}\n"],"mappings":"A,4CAKA,SAAgBA,EACd,EACyE,CACzE,GAAI,CAACC,EAAQ,WAAY,MAAM,IAAIC,EAAU,uBAAuB,EACpE,OAAO,MAAO,CAAE,OAAM,YAAa,CACjC,GAAI,CACF,IAAMC,EAAUC,EAAO,OAAO,QAC9B,GACEA,EAAO,SAAW,SAClBA,EAAO,OAAO,aAAeH,EAAQ,YACrC,OAAOE,GAAS,KAAQ,UACxB,CAACA,EAAQ,KACTA,EAAQ,IAAI,OAAS,KACrBA,EAAQ,MAAQF,EAAQ,QAAQI,CAAI,EAEpC,MAAO,CAAE,MAAO,yBAA0B,EAC5C,GAAIJ,EAAQ,SAAW,CAAE,MAAMA,EAAQ,QAAQE,CAAO,EACpD,MAAO,CAAE,MAAO,qBAAsB,CAC1C,MAAQ,CACN,MAAO,CAAE,MAAO,qBAAsB,CACxC,CACF,CACF,C"}

package/dist/modules/auth/server/index.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs"),u=require("./bearer.cjs"),d=require("./claims.cjs"),f=require("./provider.cjs"),p=require("./user-info.cjs"),m=require("./machine.cjs");exports.AuthError=e.AuthError,exports.assertAccessTokenClaims=d.assertAccessTokenClaims,exports.assertMutationOrigin=t.assertMutationOrigin,exports.assertSessionContinuity=d.assertSessionContinuity,exports.assertTokenContinuity=d.assertTokenContinuity,exports.authCookieOptions=t.authCookieOptions,exports.authFailure=u.authFailure,exports.authSubjectSchema=d.authSubjectSchema,exports.createAtomicDpopReplayStore=i.createAtomicDpopReplayStore,exports.createAtomicProofStorage=i.createAtomicProofStorage,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createBearerVerifier=u.createBearerVerifier,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createMachineTokenRequest=m.createMachineTokenRequest,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createOAuthProviderConfig=f.createOAuthProviderConfig,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.createUserInfoCache=p.createUserInfoCache,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.machineTokenSchema=m.machineTokenSchema,exports.mapOAuthUserProfile=d.mapOAuthUserProfile,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.normalizeAuthError=u.normalizeAuthError,exports.oauthUserInfoSchema=d.oauthUserInfoSchema,exports.parseMachineToken=m.parseMachineToken,exports.resolveReturnPath=t.resolveReturnPath;

package/dist/modules/auth/server/index.d.cts

@@ -0,0 +1,17 @@
+import { AuthError } from "../interface.cjs";
+import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.cjs";
+import { fingerprintAuthValue } from "./crypto.cjs";
+import { createLogoutVerifier } from "./logout.cjs";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.cjs";
+import { createResourceAuth } from "./resource.cjs";
+import { createIdentityCache } from "./identity-cache.cjs";
+import { createOAuthIdentityValidator } from "./identity.cjs";
+import { createSessionGrantGuard } from "./grant-guard.cjs";
+import { matchesAuthRevocation } from "./revocation.cjs";
+import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.cjs";
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.cjs";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.cjs";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.cjs";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.cjs";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.cjs";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.d.ts

@@ -0,0 +1,17 @@
+import { AuthError } from "../interface.js";
+import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.js";
+import { fingerprintAuthValue } from "./crypto.js";
+import { createLogoutVerifier } from "./logout.js";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.js";
+import { createResourceAuth } from "./resource.js";
+import { createIdentityCache } from "./identity-cache.js";
+import { createOAuthIdentityValidator } from "./identity.js";
+import { createSessionGrantGuard } from "./grant-guard.js";
+import { matchesAuthRevocation } from "./revocation.js";
+import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.js";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.js";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.js";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.js";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.js";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.js

@@ -0,0 +1 @@
+import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createAtomicDpopReplayStore as c,createAtomicProofStorage as l,createProofReplayStore as u}from"./proof.js";import{createResourceAuth as d}from"./resource.js";import{createIdentityCache as f}from"./identity-cache.js";import{createOAuthIdentityValidator as p}from"./identity.js";import{createSessionGrantGuard as m}from"./grant-guard.js";import{matchesAuthRevocation as h}from"./revocation.js";import{authFailure as g,createBearerVerifier as _,normalizeAuthError as v}from"./bearer.js";import{assertAccessTokenClaims as y,assertSessionContinuity as b,assertTokenContinuity as x,authSubjectSchema as S,mapOAuthUserProfile as C,oauthUserInfoSchema as w}from"./claims.js";import{createOAuthProviderConfig as T}from"./provider.js";import{createUserInfoCache as E}from"./user-info.js";import{createMachineTokenRequest as D,machineTokenSchema as O,parseMachineToken as k}from"./machine.js";export{e as AuthError,y as assertAccessTokenClaims,t as assertMutationOrigin,b as assertSessionContinuity,x as assertTokenContinuity,n as authCookieOptions,g as authFailure,S as authSubjectSchema,c as createAtomicDpopReplayStore,l as createAtomicProofStorage,r as createAuthFreshnessPolicy,i as createAuthPolicy,_ as createBearerVerifier,f as createIdentityCache,s as createLogoutVerifier,D as createMachineTokenRequest,p as createOAuthIdentityValidator,T as createOAuthProviderConfig,u as createProofReplayStore,d as createResourceAuth,m as createSessionGrantGuard,E as createUserInfoCache,o as fingerprintAuthValue,O as machineTokenSchema,C as mapOAuthUserProfile,h as matchesAuthRevocation,v as normalizeAuthError,w as oauthUserInfoSchema,k as parseMachineToken,a as resolveReturnPath};