@gorth-io/structure 0.0.0-alpha.10

package/dist/modules/auth/server/interface.d.cts

@@ -0,0 +1,2 @@
+import { N as ProofStorage, U as VerifiedLogout, k as LogoutStorage } from "../../../interface-ii8DV63k.cjs";
+export type { LogoutStorage, ProofStorage, VerifiedLogout };

package/dist/modules/auth/server/interface.d.ts

@@ -0,0 +1,3 @@
+import { N as ProofStorage, U as VerifiedLogout, k as LogoutStorage } from "../../../interface-ii8DV63k.js";
+import "../../../interface-BFsLlmGy.js";
+export type { LogoutStorage, ProofStorage, VerifiedLogout };

package/dist/modules/auth/server/interface.js

@@ -0,0 +1 @@
+export{};

package/dist/modules/auth/server/logout.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs");let n=require("jose");function r(r){let i=t.createAuthPolicy(r.policy),a=r.now??Date.now,o=r.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!r.issuer||!r.clientId||!o.length||o.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e.AuthError(`invalid_configuration`);async function s(t){if(!t||t.length>32768)throw new e.AuthError(`rejected`);let s;try{s=await r.getVerificationKey()}catch{throw new e.AuthError(`unavailable`)}try{let{payload:c}=await(0,n.jwtVerify)(t,s,{issuer:r.issuer,audience:r.clientId,algorithms:[...o],typ:`logout+jwt`,requiredClaims:[`iss`,`aud`,`iat`,`exp`,`jti`,`events`],maxTokenAge:i.logoutMaxAgeSeconds,clockTolerance:i.clockToleranceSeconds,currentDate:new Date(a())}),l=c.events,u=l&&typeof l==`object`&&!Array.isArray(l)?l[`http://schemas.openid.net/event/backchannel-logout`]:void 0,d=e=>typeof e==`string`&&e.length>0&&e.length<=255;if(c.nonce!==void 0||!d(c.jti)||!d(c.sub)&&!d(c.sid)||c.sub!==void 0&&!d(c.sub)||c.sid!==void 0&&!d(c.sid)||r.requireSid&&!d(c.sid)||!u||typeof u!=`object`||Array.isArray(u)||Object.keys(u).length!==0||c.exp<=c.iat||c.exp-c.iat>i.logoutMaxAgeSeconds)throw new e.AuthError(`rejected`);return{jti:c.jti,subject:c.sub,sid:c.sid,issuedAt:c.iat*1e3,receiptExpiresAt:(c.exp+i.clockToleranceSeconds)*1e3,revokeUntil:a()+i.revocationRetentionMs}}catch{throw new e.AuthError(`rejected`)}}async function c(t){let n=await s(t);try{return{applied:await r.storage.apply(n)}}catch{throw new e.AuthError(`unavailable`)}}return{verify:s,handle:c}}exports.createLogoutVerifier=r;

package/dist/modules/auth/server/logout.d.cts

@@ -0,0 +1,10 @@
+import "./interface.cjs";
+import { A as LogoutVerifierOptions, U as VerifiedLogout } from "../../../interface-ii8DV63k.cjs";
+export declare function createLogoutVerifier(options: LogoutVerifierOptions): {
+  verify: (token: string) => Promise<VerifiedLogout>;
+  handle: (token: string) => Promise<{
+    applied: boolean;
+  }>;
+};
+export type { LogoutVerifierOptions };
+//# sourceMappingURL=logout.d.cts.map

package/dist/modules/auth/server/logout.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.cts","names":[],"sources":["../../../../src/modules/auth/server/logout.ts"],"mappings":";;wBAMgB,qBAAqB,SAAS;EAcf,SAAA,kBAAS,QAAQ;EAwDjB,SAAA,kBAAM"}

package/dist/modules/auth/server/logout.d.ts

@@ -0,0 +1,10 @@
+import "../../../interface-BFsLlmGy.js";
+import { A as LogoutVerifierOptions, U as VerifiedLogout } from "../../../interface-ii8DV63k.js";
+export declare function createLogoutVerifier(options: LogoutVerifierOptions): {
+  verify: (token: string) => Promise<VerifiedLogout>;
+  handle: (token: string) => Promise<{
+    applied: boolean;
+  }>;
+};
+export type { LogoutVerifierOptions };
+//# sourceMappingURL=logout.d.ts.map

package/dist/modules/auth/server/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","names":[],"sources":["../../../../src/modules/auth/server/logout.ts"],"mappings":";;wBAMgB,qBAAqB,SAAS;EAcf,SAAA,kBAAS,QAAQ;EAwDjB,SAAA,kBAAM"}

package/dist/modules/auth/server/logout.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{createAuthPolicy as t}from"../policy.js";import{jwtVerify as n}from"jose";function r(r){let i=t(r.policy),a=r.now??Date.now,o=r.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!r.issuer||!r.clientId||!o.length||o.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e(`invalid_configuration`);async function s(t){if(!t||t.length>32768)throw new e(`rejected`);let s;try{s=await r.getVerificationKey()}catch{throw new e(`unavailable`)}try{let{payload:c}=await n(t,s,{issuer:r.issuer,audience:r.clientId,algorithms:[...o],typ:`logout+jwt`,requiredClaims:[`iss`,`aud`,`iat`,`exp`,`jti`,`events`],maxTokenAge:i.logoutMaxAgeSeconds,clockTolerance:i.clockToleranceSeconds,currentDate:new Date(a())}),l=c.events,u=l&&typeof l==`object`&&!Array.isArray(l)?l[`http://schemas.openid.net/event/backchannel-logout`]:void 0,d=e=>typeof e==`string`&&e.length>0&&e.length<=255;if(c.nonce!==void 0||!d(c.jti)||!d(c.sub)&&!d(c.sid)||c.sub!==void 0&&!d(c.sub)||c.sid!==void 0&&!d(c.sid)||r.requireSid&&!d(c.sid)||!u||typeof u!=`object`||Array.isArray(u)||Object.keys(u).length!==0||c.exp<=c.iat||c.exp-c.iat>i.logoutMaxAgeSeconds)throw new e(`rejected`);return{jti:c.jti,subject:c.sub,sid:c.sid,issuedAt:c.iat*1e3,receiptExpiresAt:(c.exp+i.clockToleranceSeconds)*1e3,revokeUntil:a()+i.revocationRetentionMs}}catch{throw new e(`rejected`)}}async function c(t){let n=await s(t);try{return{applied:await r.storage.apply(n)}}catch{throw new e(`unavailable`)}}return{verify:s,handle:c}}export{r as createLogoutVerifier};
+//# sourceMappingURL=logout.js.map

package/dist/modules/auth/server/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","names":["createLogoutVerifier","policy","createAuthPolicy","options","now","algorithms","algorithm","AuthError","verify","token","key","jwtVerify","events","payload","event","identifier","value","handle","logout"],"sources":["../../../../src/modules/auth/server/logout.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { createAuthPolicy } from \"@/modules/auth/policy\";\nimport type { VerifiedLogout } from \"@/modules/auth/server/interface\";\nimport type { LogoutVerifierOptions } from \"@/utils/interface\";\nimport { jwtVerify, type JWTVerifyGetKey } from \"jose\";\n\nexport function createLogoutVerifier(options: LogoutVerifierOptions) {\n  const policy = createAuthPolicy(options.policy);\n  const now = options.now ?? Date.now;\n  const algorithms = options.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"];\n  if (\n    !options.issuer ||\n    !options.clientId ||\n    !algorithms.length ||\n    algorithms.some(\n      (algorithm) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(algorithm),\n    )\n  )\n    throw new AuthError(\"invalid_configuration\");\n\n  async function verify(token: string): Promise<VerifiedLogout> {\n    if (!token || token.length > 32_768) throw new AuthError(\"rejected\");\n    let key: JWTVerifyGetKey;\n    try {\n      key = await options.getVerificationKey();\n    } catch {\n      throw new AuthError(\"unavailable\");\n    }\n    try {\n      const { payload } = await jwtVerify(token, key, {\n        issuer: options.issuer,\n        audience: options.clientId,\n        algorithms: [...algorithms],\n        typ: \"logout+jwt\",\n        requiredClaims: [\"iss\", \"aud\", \"iat\", \"exp\", \"jti\", \"events\"],\n        maxTokenAge: policy.logoutMaxAgeSeconds,\n        clockTolerance: policy.clockToleranceSeconds,\n        currentDate: new Date(now()),\n      });\n      const events = payload.events;\n      const event =\n        events && typeof events === \"object\" && !Array.isArray(events)\n          ? (events as Record<string, unknown>)[\n              \"http://schemas.openid.net/event/backchannel-logout\"\n            ]\n          : undefined;\n      const identifier = (value: unknown) =>\n        typeof value === \"string\" && value.length > 0 && value.length <= 255;\n      if (\n        payload.nonce !== undefined ||\n        !identifier(payload.jti) ||\n        (!identifier(payload.sub) && !identifier(payload.sid)) ||\n        (payload.sub !== undefined && !identifier(payload.sub)) ||\n        (payload.sid !== undefined && !identifier(payload.sid)) ||\n        (options.requireSid && !identifier(payload.sid)) ||\n        !event ||\n        typeof event !== \"object\" ||\n        Array.isArray(event) ||\n        Object.keys(event).length !== 0 ||\n        payload.exp! <= payload.iat! ||\n        payload.exp! - payload.iat! > policy.logoutMaxAgeSeconds\n      )\n        throw new AuthError(\"rejected\");\n      return {\n        jti: payload.jti!,\n        subject: payload.sub,\n        sid: payload.sid as string | undefined,\n        issuedAt: payload.iat! * 1000,\n        receiptExpiresAt: (payload.exp! + policy.clockToleranceSeconds) * 1000,\n        revokeUntil: now() + policy.revocationRetentionMs,\n      };\n    } catch {\n      throw new AuthError(\"rejected\");\n    }\n  }\n\n  async function handle(token: string) {\n    const logout = await verify(token);\n    // Verification never consumes the receipt on its own. The adapter commits the\n    // receipt + revocation + session invalidation together, or rolls them all back.\n    try {\n      return { applied: await options.storage.apply(logout) };\n    } catch {\n      throw new AuthError(\"unavailable\");\n    }\n  }\n  return { verify, handle };\n}\n\nexport type { LogoutVerifierOptions } from \"@/utils/interface\";\n"],"mappings":"A,6HAMA,SAAgBA,EAAqB,EAAgC,CACnE,IAAMC,EAASC,EAAiBC,EAAQ,MAAM,EACxCC,EAAMD,EAAQ,KAAO,KAAK,IAC1BE,EAAaF,EAAQ,YAAc,CAAC,QAAS,QAAS,OAAO,EACnE,GACE,CAACA,EAAQ,QACT,CAACA,EAAQ,UACT,CAACE,EAAW,QACZA,EAAW,KACR,GAAc,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAS,CAChE,EAEA,MAAM,IAAIC,EAAU,uBAAuB,EAE7C,eAAeC,EAAO,EAAwC,CAC5D,GAAI,CAACC,GAASA,EAAM,OAAS,MAAQ,MAAM,IAAIF,EAAU,UAAU,EACnE,IAAIG,EACJ,GAAI,CACF,EAAM,MAAMP,EAAQ,mBAAmB,CACzC,MAAQ,CACN,MAAM,IAAII,EAAU,aAAa,CACnC,CACA,GAAI,CACF,GAAM,CAAE,WAAY,MAAMI,EAAUF,EAAOC,EAAK,CAC9C,OAAQP,EAAQ,OAChB,SAAUA,EAAQ,SAClB,WAAY,CAAC,GAAGE,CAAU,EAC1B,IAAK,aACL,eAAgB,CAAC,MAAO,MAAO,MAAO,MAAO,MAAO,QAAQ,EAC5D,YAAaJ,EAAO,oBACpB,eAAgBA,EAAO,sBACvB,YAAa,IAAI,KAAKG,EAAI,CAAC,CAC7B,CAAC,EACKQ,EAASC,EAAQ,OACjBC,EACJF,GAAU,OAAOA,GAAW,UAAY,CAAC,MAAM,QAAQA,CAAM,EACxDA,EACC,sDAEF,IAAA,GACAG,EAAc,GAClB,OAAOC,GAAU,UAAYA,EAAM,OAAS,GAAKA,EAAM,QAAU,IACnE,GACEH,EAAQ,QAAU,IAAA,IAClB,CAACE,EAAWF,EAAQ,GAAG,GACtB,CAACE,EAAWF,EAAQ,GAAG,GAAK,CAACE,EAAWF,EAAQ,GAAG,GACnDA,EAAQ,MAAQ,IAAA,IAAa,CAACE,EAAWF,EAAQ,GAAG,GACpDA,EAAQ,MAAQ,IAAA,IAAa,CAACE,EAAWF,EAAQ,GAAG,GACpDV,EAAQ,YAAc,CAACY,EAAWF,EAAQ,GAAG,GAC9C,CAACC,GACD,OAAOA,GAAU,UACjB,MAAM,QAAQA,CAAK,GACnB,OAAO,KAAKA,CAAK,CAAC,CAAC,SAAW,GAC9BD,EAAQ,KAAQA,EAAQ,KACxBA,EAAQ,IAAOA,EAAQ,IAAOZ,EAAO,oBAErC,MAAM,IAAIM,EAAU,UAAU,EAChC,MAAO,CACL,IAAKM,EAAQ,IACb,QAASA,EAAQ,IACjB,IAAKA,EAAQ,IACb,SAAUA,EAAQ,IAAO,IACzB,kBAAmBA,EAAQ,IAAOZ,EAAO,uBAAyB,IAClE,YAAaG,EAAI,EAAIH,EAAO,qBAC9B,CACF,MAAQ,CACN,MAAM,IAAIM,EAAU,UAAU,CAChC,CACF,CAEA,eAAeU,EAAO,EAAe,CACnC,IAAMC,EAAS,MAAMV,EAAOC,CAAK,EAGjC,GAAI,CACF,MAAO,CAAE,QAAS,MAAMN,EAAQ,QAAQ,MAAMe,CAAM,CAAE,CACxD,MAAQ,CACN,MAAM,IAAIX,EAAU,aAAa,CACnC,CACF,CACA,MAAO,CAAE,SAAQ,QAAO,CAC1B,C"}

package/dist/modules/auth/server/machine.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");let n=require("zod"),r=require("better-auth/oauth2");const i=n.z.object({access_token:n.z.string().min(1).max(32768),token_type:n.z.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.z.number().int().positive(),scope:n.z.string().optional()});async function a(n){try{if(t.parseHttpEndpoint(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t.parseHttpEndpoint(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await(0,r.clientCredentialsTokenRequest)({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:(0,r.mergeScopes)(void 0,[...n.scopes]),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e.AuthError(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);return n.data}exports.createMachineTokenRequest=a,exports.machineTokenSchema=i,exports.parseMachineToken=o;

package/dist/modules/auth/server/machine.d.cts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.cts.map

package/dist/modules/auth/server/machine.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.cts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.ts.map

package/dist/modules/auth/server/machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.ts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";import{z as n}from"zod";import{clientCredentialsTokenRequest as r,mergeScopes as i}from"better-auth/oauth2";const a=n.object({access_token:n.string().min(1).max(32768),token_type:n.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.number().int().positive(),scope:n.string().optional()});async function o(n){try{if(t(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await r({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:i(void 0,[...n.scopes]),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e(`invalid_configuration`)}}function s(t){let n=a.safeParse(t);if(!n.success)throw new e(`rejected`);return n.data}export{o as createMachineTokenRequest,a as machineTokenSchema,s as parseMachineToken};
+//# sourceMappingURL=machine.js.map

package/dist/modules/auth/server/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","names":["machineTokenSchema","z","value","createMachineTokenRequest","parseHttpEndpoint","options","scope","resource","request","clientCredentialsTokenRequest","mergeScopes","AuthError","parseMachineToken","parsed"],"sources":["../../../../src/modules/auth/server/machine.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport { clientCredentialsTokenRequest, mergeScopes } from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nexport const machineTokenSchema = z.object({\n  access_token: z.string().min(1).max(32768),\n  token_type: z.string().refine((value) => value.toLowerCase() === \"bearer\"),\n  expires_in: z.number().int().positive(),\n  scope: z.string().optional(),\n});\nexport type MachineToken = z.infer<typeof machineTokenSchema>;\n\nexport interface MachineTokenRequestOptions {\n  tokenEndpoint: string;\n  clientId: string;\n  clientSecret: string;\n  method: \"client_secret_basic\" | \"client_secret_post\";\n  scopes: readonly string[];\n  resources: readonly string[];\n  allowLoopbackHttp?: boolean;\n}\n\n/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */\nexport async function createMachineTokenRequest(options: MachineTokenRequestOptions) {\n  try {\n    parseHttpEndpoint(options.tokenEndpoint, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    if (\n      !options.clientId ||\n      !options.clientSecret ||\n      !options.scopes.length ||\n      !options.resources.length ||\n      ![\"client_secret_basic\", \"client_secret_post\"].includes(options.method) ||\n      options.scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n    )\n      throw new Error();\n    for (const resource of options.resources)\n      parseHttpEndpoint(resource, { allowLoopbackHttp: options.allowLoopbackHttp });\n    const request = await clientCredentialsTokenRequest({\n      options: { clientId: options.clientId, clientSecret: options.clientSecret },\n      tokenEndpoint: options.tokenEndpoint,\n      tokenEndpointAuth: { method: options.method },\n      scope: mergeScopes(undefined, [...options.scopes]),\n      resource: [...new Set(options.resources)],\n    });\n    return {\n      url: options.tokenEndpoint,\n      method: \"POST\" as const,\n      headers: request.headers,\n      body: request.body,\n      redirect: \"error\" as const,\n      cache: \"no-store\" as const,\n    };\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n}\n\nexport function parseMachineToken(value: unknown): MachineToken {\n  const parsed = machineTokenSchema.safeParse(value);\n  if (!parsed.success) throw new AuthError(\"rejected\");\n  return parsed.data;\n}\n"],"mappings":"A,4NAKA,MAAaA,EAAqBC,EAAE,OAAO,CACzC,aAAcA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EACzC,WAAYA,EAAE,OAAO,CAAC,CAAC,OAAQ,GAAUC,EAAM,YAAY,IAAM,QAAQ,EACzE,WAAYD,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EACtC,MAAOA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC7B,CAAC,EAcD,eAAsBE,EAA0B,EAAqC,CACnF,GAAI,CAIF,GAHAC,EAAkBC,EAAQ,cAAe,CACvC,kBAAmBA,EAAQ,iBAC7B,CAAC,EAEC,CAACA,EAAQ,UACT,CAACA,EAAQ,cACT,CAACA,EAAQ,OAAO,QAChB,CAACA,EAAQ,UAAU,QACnB,CAAC,CAAC,sBAAuB,oBAAoB,CAAC,CAAC,SAASA,EAAQ,MAAM,GACtEA,EAAQ,OAAO,KAAM,GAAU,CAAC,8BAA8B,KAAKC,CAAK,CAAC,EAEzE,MAAU,MAAM,EAClB,IAAK,IAAMC,KAAYF,EAAQ,UAC7BD,EAAkBG,EAAU,CAAE,kBAAmBF,EAAQ,iBAAkB,CAAC,EAC9E,IAAMG,EAAU,MAAMC,EAA8B,CAClD,QAAS,CAAE,SAAUJ,EAAQ,SAAU,aAAcA,EAAQ,YAAa,EAC1E,cAAeA,EAAQ,cACvB,kBAAmB,CAAE,OAAQA,EAAQ,MAAO,EAC5C,MAAOK,EAAY,IAAA,GAAW,CAAC,GAAGL,EAAQ,MAAM,CAAC,EACjD,SAAU,CAAC,GAAG,IAAI,IAAIA,EAAQ,SAAS,CAAC,CAC1C,CAAC,EACD,MAAO,CACL,IAAKA,EAAQ,cACb,OAAQ,OACR,QAASG,EAAQ,QACjB,KAAMA,EAAQ,KACd,SAAU,QACV,MAAO,UACT,CACF,MAAQ,CACN,MAAM,IAAIG,EAAU,uBAAuB,CAC7C,CACF,CAEA,SAAgBC,EAAkB,EAA8B,CAC9D,IAAMC,EAASb,EAAmB,UAAUE,CAAK,EACjD,GAAI,CAACW,EAAO,QAAS,MAAM,IAAIF,EAAU,UAAU,EACnD,OAAOE,EAAO,IAChB,C"}

package/dist/modules/auth/server/proof.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){return{async reserve(n){let r=n.now.getTime(),i=n.expiresAt.getTime();if(!n.key||n.key.length>2048||!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(i)||i<=r)throw new e.AuthError(`rejected`);try{let e=await t.reserve(n);if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function n(t){return{async consume(n,r){let i=(t.now??Date.now)();if(!n||n.length>2048||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(r)||r<=i)throw new e.AuthError(`rejected`);try{let e=await t.reserve({key:n,expiresAt:r,now:i});if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function r(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createAtomicDpopReplayStore=t,exports.createAtomicProofStorage=n,exports.createProofReplayStore=r;

package/dist/modules/auth/server/proof.d.cts

@@ -0,0 +1,23 @@
+import { N as ProofStorage } from "../../../interface-ii8DV63k.cjs";
+import "./interface.cjs";
+import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
+/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
+export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
+//# sourceMappingURL=proof.d.cts.map

package/dist/modules/auth/server/proof.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;iBAIiB;EACf;EACA;EACA;;iBAGe;;EAEf,SAAS;;;wBAIK,4BACd,SAAS,+BACR;iBAoBc;;EAEf,QAAQ,OAAO,yBAAyB;EACxC;;wBAGc,yBACd,SAAS,4BACR;;wBAyBa,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.d.ts

@@ -0,0 +1,23 @@
+import { N as ProofStorage } from "../../../interface-ii8DV63k.js";
+import "../../../interface-BFsLlmGy.js";
+import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
+/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
+export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
+//# sourceMappingURL=proof.d.ts.map

package/dist/modules/auth/server/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;iBAIiB;EACf;EACA;EACA;;iBAGe;;EAEf,SAAS;;;wBAIK,4BACd,SAAS,+BACR;iBAoBc;;EAEf,QAAQ,OAAO,yBAAyB;EACxC;;wBAGc,yBACd,SAAS,4BACR;;wBAyBa,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t){return{async reserve(n){let r=n.now.getTime(),i=n.expiresAt.getTime();if(!n.key||n.key.length>2048||!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(i)||i<=r)throw new e(`rejected`);try{let e=await t.reserve(n);if(typeof e!=`boolean`)throw Error();return e}catch{throw new e(`unavailable`)}}}}function n(t){return{async consume(n,r){let i=(t.now??Date.now)();if(!n||n.length>2048||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(r)||r<=i)throw new e(`rejected`);try{let e=await t.reserve({key:n,expiresAt:r,now:i});if(typeof e!=`boolean`)throw Error();return e}catch{throw new e(`unavailable`)}}}}function r(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e(`rejected`);try{return await t.consume(i,a)}catch{throw new e(`unavailable`)}}}}export{t as createAtomicDpopReplayStore,n as createAtomicProofStorage,r as createProofReplayStore};
+//# sourceMappingURL=proof.js.map

package/dist/modules/auth/server/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","names":["createAtomicDpopReplayStore","now","input","expiresAt","AuthError","reserved","options","createAtomicProofStorage","key","createProofReplayStore","reservation","storage"],"sources":["../../../../src/modules/auth/server/proof.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { ProofStorage } from \"@/modules/auth/server/interface\";\nimport type { DpopReplayStore } from \"better-auth/oauth2\";\n\nexport interface AtomicProofReservation {\n  key: string;\n  expiresAt: number;\n  now: number;\n}\n\nexport interface AtomicDpopReplayStoreOptions {\n  /** The host must reserve atomically in durable storage, including expiry cleanup. */\n  reserve: DpopReplayStore[\"reserve\"];\n}\n\n/** Preserve the native verifier's clock and Date parameters at the storage boundary. */\nexport function createAtomicDpopReplayStore(\n  options: AtomicDpopReplayStoreOptions,\n): DpopReplayStore {\n  return {\n    async reserve(input) {\n      const now = input.now.getTime();\n      const expiresAt = input.expiresAt.getTime();\n      if (!input.key || input.key.length > 2048 ||\n          !Number.isSafeInteger(now) || now < 0 ||\n          !Number.isSafeInteger(expiresAt) || expiresAt <= now)\n        throw new AuthError(\"rejected\");\n      try {\n        const reserved = await options.reserve(input);\n        if (typeof reserved !== \"boolean\") throw new Error();\n        return reserved;\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n\nexport interface AtomicProofStorageOptions {\n  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */\n  reserve(input: AtomicProofReservation): Promise<boolean>;\n  now?: () => number;\n}\n\nexport function createAtomicProofStorage(\n  options: AtomicProofStorageOptions,\n): ProofStorage {\n  return {\n    async consume(key, expiresAt) {\n      const now = (options.now ?? Date.now)();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isSafeInteger(now) ||\n        now < 0 ||\n        !Number.isSafeInteger(expiresAt) ||\n        expiresAt <= now\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        const reserved = await options.reserve({ key, expiresAt, now });\n        if (typeof reserved !== \"boolean\") throw new Error();\n        return reserved;\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n\n/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */\nexport function createProofReplayStore(\n  storage: ProofStorage,\n  now: () => number = Date.now,\n): DpopReplayStore {\n  return {\n    async reserve(reservation) {\n      const { key } = reservation;\n      const expiresAt = reservation.expiresAt.getTime();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isFinite(expiresAt) ||\n        expiresAt <= now()\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        return await storage.consume(key, expiresAt);\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAgBA,SAAgBA,EACd,EACiB,CACjB,MAAO,CACL,MAAM,QAAQ,EAAO,CACnB,IAAMC,EAAMC,EAAM,IAAI,QAAQ,EACxBC,EAAYD,EAAM,UAAU,QAAQ,EAC1C,GAAI,CAACA,EAAM,KAAOA,EAAM,IAAI,OAAS,MACjC,CAAC,OAAO,cAAcD,CAAG,GAAKA,EAAM,GACpC,CAAC,OAAO,cAAcE,CAAS,GAAKA,GAAaF,EACnD,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,IAAMC,EAAW,MAAMC,EAAQ,QAAQJ,CAAK,EAC5C,GAAI,OAAOG,GAAa,UAAW,MAAU,MAAM,EACnD,OAAOA,CACT,MAAQ,CACN,MAAM,IAAID,EAAU,aAAa,CACnC,CACF,CACF,CACF,CAQA,SAAgBG,EACd,EACc,CACd,MAAO,CACL,MAAM,QAAQ,EAAK,EAAW,CAC5B,IAAMN,GAAOK,EAAQ,KAAO,KAAK,IAAA,CAAK,EACtC,GACE,CAACE,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,cAAcP,CAAG,GACzBA,EAAM,GACN,CAAC,OAAO,cAAcE,CAAS,GAC/BA,GAAaF,EAEb,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,IAAMC,EAAW,MAAMC,EAAQ,QAAQ,CAAE,MAAK,YAAW,KAAI,CAAC,EAC9D,GAAI,OAAOD,GAAa,UAAW,MAAU,MAAM,EACnD,OAAOA,CACT,MAAQ,CACN,MAAM,IAAID,EAAU,aAAa,CACnC,CACF,CACF,CACF,CAGA,SAAgBK,EACd,EACA,EAAoB,KAAK,IACR,CACjB,MAAO,CACL,MAAM,QAAQ,EAAa,CACzB,GAAM,CAAE,OAAQC,EACVP,EAAYO,EAAY,UAAU,QAAQ,EAChD,GACE,CAACF,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,SAASL,CAAS,GAC1BA,GAAaF,EAAI,EAEjB,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,OAAO,MAAMO,EAAQ,QAAQH,EAAKL,CAAS,CAC7C,MAAQ,CACN,MAAM,IAAIC,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/provider.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");function n(n){let{resources:r=[],scopes:i,allowLoopbackHttp:a,...o}=n;try{if(!o.providerId||!o.clientId||!o.discoveryUrl||i.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();t.parseHttpEndpoint(o.discoveryUrl,{allowLoopbackHttp:a});for(let e of[o.tokenUrl,o.userInfoUrl,o.endSessionEndpoint])e&&t.parseHttpEndpoint(e,{allowLoopbackHttp:a});let e=o.authorizationUrl;if(e){let n=t.parseHttpEndpoint(e,{allowLoopbackHttp:a,allowQuery:!0}),i=/* @__PURE__ */ new Set([...n.searchParams.getAll(`resource`),...r]);n.searchParams.delete(`resource`);for(let e of i)t.parseHttpEndpoint(e,{allowLoopbackHttp:a}),n.searchParams.append(`resource`,e);e=n.href}else if(r.length)throw Error();return{...o,authorizationUrl:e,scopes:[...new Set(i)],pkce:!0,responseType:`code`,requireIdTokenVerification:!0}}catch{throw new e.AuthError(`invalid_configuration`)}}exports.createOAuthProviderConfig=n;

package/dist/modules/auth/server/provider.d.cts

@@ -0,0 +1,9 @@
+import { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+export interface OAuthProviderConfigOptions extends Omit<GenericOAuthConfig, "scopes" | "pkce" | "requireIdTokenVerification" | "responseType"> {
+  scopes: readonly string[];
+  resources?: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Returns native options, not a plugin/auth instance. The app calls genericOAuth. */
+export declare function createOAuthProviderConfig(options: OAuthProviderConfigOptions): GenericOAuthConfig;
+//# sourceMappingURL=provider.d.cts.map

package/dist/modules/auth/server/provider.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.cts","names":[],"sources":["../../../../src/modules/auth/server/provider.ts"],"mappings":";iBAIiB,mCAAmC,KAClD;EAGA;EACA;EACA;;;wBAIc,0BACd,SAAS,6BACR"}

package/dist/modules/auth/server/provider.d.ts

@@ -0,0 +1,9 @@
+import { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+export interface OAuthProviderConfigOptions extends Omit<GenericOAuthConfig, "scopes" | "pkce" | "requireIdTokenVerification" | "responseType"> {
+  scopes: readonly string[];
+  resources?: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Returns native options, not a plugin/auth instance. The app calls genericOAuth. */
+export declare function createOAuthProviderConfig(options: OAuthProviderConfigOptions): GenericOAuthConfig;
+//# sourceMappingURL=provider.d.ts.map

package/dist/modules/auth/server/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","names":[],"sources":["../../../../src/modules/auth/server/provider.ts"],"mappings":";iBAIiB,mCAAmC,KAClD;EAGA;EACA;EACA;;;wBAIc,0BACd,SAAS,6BACR"}

package/dist/modules/auth/server/provider.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";function n(n){let{resources:r=[],scopes:i,allowLoopbackHttp:a,...o}=n;try{if(!o.providerId||!o.clientId||!o.discoveryUrl||i.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();t(o.discoveryUrl,{allowLoopbackHttp:a});for(let e of[o.tokenUrl,o.userInfoUrl,o.endSessionEndpoint])e&&t(e,{allowLoopbackHttp:a});let e=o.authorizationUrl;if(e){let n=t(e,{allowLoopbackHttp:a,allowQuery:!0}),i=/* @__PURE__ */ new Set([...n.searchParams.getAll(`resource`),...r]);n.searchParams.delete(`resource`);for(let e of i)t(e,{allowLoopbackHttp:a}),n.searchParams.append(`resource`,e);e=n.href}else if(r.length)throw Error();return{...o,authorizationUrl:e,scopes:[...new Set(i)],pkce:!0,responseType:`code`,requireIdTokenVerification:!0}}catch{throw new e(`invalid_configuration`)}}export{n as createOAuthProviderConfig};
+//# sourceMappingURL=provider.js.map

package/dist/modules/auth/server/provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.js","names":["createOAuthProviderConfig","config","options","scopes","scope","parseHttpEndpoint","endpoint","authorizationUrl","url","all","resources","resource","AuthError"],"sources":["../../../../src/modules/auth/server/provider.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport type { GenericOAuthConfig } from \"better-auth/plugins/generic-oauth\";\n\nexport interface OAuthProviderConfigOptions extends Omit<\n  GenericOAuthConfig,\n  \"scopes\" | \"pkce\" | \"requireIdTokenVerification\" | \"responseType\"\n> {\n  scopes: readonly string[];\n  resources?: readonly string[];\n  allowLoopbackHttp?: boolean;\n}\n\n/** Returns native options, not a plugin/auth instance. The app calls genericOAuth. */\nexport function createOAuthProviderConfig(\n  options: OAuthProviderConfigOptions,\n): GenericOAuthConfig {\n  const { resources = [], scopes, allowLoopbackHttp, ...config } = options;\n  try {\n    if (\n      !config.providerId ||\n      !config.clientId ||\n      !config.discoveryUrl ||\n      scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n    )\n      throw new Error();\n    parseHttpEndpoint(config.discoveryUrl, { allowLoopbackHttp });\n    for (const endpoint of [\n      config.tokenUrl,\n      config.userInfoUrl,\n      config.endSessionEndpoint,\n    ])\n      if (endpoint) parseHttpEndpoint(endpoint, { allowLoopbackHttp });\n    let authorizationUrl = config.authorizationUrl;\n    if (authorizationUrl) {\n      const url = parseHttpEndpoint(authorizationUrl, {\n        allowLoopbackHttp,\n        allowQuery: true,\n      });\n      const all = new Set([...url.searchParams.getAll(\"resource\"), ...resources]);\n      url.searchParams.delete(\"resource\");\n      for (const resource of all) {\n        parseHttpEndpoint(resource, { allowLoopbackHttp });\n        url.searchParams.append(\"resource\", resource);\n      }\n      authorizationUrl = url.href;\n    } else if (resources.length) throw new Error();\n    return {\n      ...config,\n      authorizationUrl,\n      scopes: [...new Set(scopes)],\n      pkce: true,\n      responseType: \"code\",\n      requireIdTokenVerification: true,\n    };\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n}\n"],"mappings":"A,gHAcA,SAAgBA,EACd,EACoB,CACpB,GAAM,CAAE,YAAY,CAAC,EAAG,SAAQ,oBAAmB,GAAGC,GAAWC,EACjE,GAAI,CACF,GACE,CAACD,EAAO,YACR,CAACA,EAAO,UACR,CAACA,EAAO,cACRE,EAAO,KAAM,GAAU,CAAC,8BAA8B,KAAKC,CAAK,CAAC,EAEjE,MAAU,MAAM,EAClBC,EAAkBJ,EAAO,aAAc,CAAE,mBAAkB,CAAC,EAC5D,IAAK,IAAMK,IAAY,CACrBL,EAAO,SACPA,EAAO,YACPA,EAAO,kBACT,EACMK,GAAUD,EAAkBC,EAAU,CAAE,mBAAkB,CAAC,EACjE,IAAIC,EAAmBN,EAAO,iBAC9B,GAAIM,EAAkB,CACpB,IAAMC,EAAMH,EAAkBE,EAAkB,CAC9C,oBACA,WAAY,EACd,CAAC,EACKE,kBAAM,IAAI,IAAI,CAAC,GAAGD,EAAI,aAAa,OAAO,UAAU,EAAG,GAAGE,CAAS,CAAC,EAC1EF,EAAI,aAAa,OAAO,UAAU,EAClC,IAAK,IAAMG,KAAYF,EACrBJ,EAAkBM,EAAU,CAAE,mBAAkB,CAAC,EACjDH,EAAI,aAAa,OAAO,WAAYG,CAAQ,EAE9C,EAAmBH,EAAI,IACzB,MAAO,GAAIE,EAAU,OAAQ,MAAU,MAAM,EAC7C,MAAO,CACL,GAAGT,EACH,mBACA,OAAQ,CAAC,GAAG,IAAI,IAAIE,CAAM,CAAC,EAC3B,KAAM,GACN,aAAc,OACd,2BAA4B,EAC9B,CACF,MAAQ,CACN,MAAM,IAAIS,EAAU,uBAAuB,CAC7C,CACF,C"}

package/dist/modules/auth/server/resource.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./proof.cjs");let r=require("better-auth/oauth2");function i(i){let a=i.now??Date.now,o=t.createAuthPolicy(i.policy),{verification:s}=i;if(!s.verifyOptions.issuer||!s.verifyOptions.audience||!s.jwksUrl&&!s.remoteVerify||![`always`,`sensitive`].includes(i.onlineVerification)||i.requireSid===!1&&i.onlineVerification!==`always`)throw new e.AuthError(`invalid_configuration`);let c=s.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!c.length||c.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e.AuthError(`invalid_configuration`);let l=e=>typeof e==`string`&&e.length>0;if(![s.verifyOptions.issuer,s.verifyOptions.audience].every(e=>Array.isArray(e)?e.length>0&&e.every(l):l(e)))throw new e.AuthError(`invalid_configuration`);for(let t of[s.jwksUrl,s.remoteVerify?.introspectUrl]){if(!t)continue;let n;try{n=new URL(t)}catch{throw new e.AuthError(`invalid_configuration`)}if(n.username||n.password||n.hash||n.search||n.protocol!==`https:`&&!(i.allowLoopbackHttp&&n.protocol===`http:`&&[`localhost`,`127.0.0.1`,`[::1]`].includes(n.hostname)))throw new e.AuthError(`invalid_configuration`)}let u=n.createProofReplayStore(i.proof,a);return{async verify(t,n={}){let l;try{if(l=await(0,r.verifyAccessTokenRequest)(t,{...s,verifyOptions:{...s.verifyOptions,algorithms:[...c],clockTolerance:o.clockToleranceSeconds,requiredClaims:[.../* @__PURE__ */ new Set([...s.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`exp`,`iat`])],currentDate:new Date(a())},dpop:{replayStore:u}}),typeof l.sub!=`string`||!l.sub||l.sub.length>255||i.requireSid!==!1&&typeof l.sid!=`string`||l.iat>a()/1e3+o.clockToleranceSeconds||l.exp*1e3-a()>o.revocationRetentionMs-o.clockToleranceSeconds*1e3||l.sid!==void 0&&(typeof l.sid!=`string`||!l.sid||l.sid.length>255))throw new e.AuthError(`rejected`)}catch(t){if((0,r.isInsufficientScopeError)(t))throw new e.AuthError(`forbidden`);if(t instanceof e.AuthError)throw t;let n=t&&typeof t==`object`&&`statusCode`in t?t.statusCode:void 0;throw typeof n==`number`&&n>=400&&n<500?new e.AuthError(`rejected`):new e.AuthError(`unavailable`)}try{if(await i.revocation.isRevoked({subject:l.sub,sid:l.sid,issuedAt:l.iat*1e3,now:a()}))throw new e.AuthError(`rejected`)}catch(t){throw t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}if(i.onlineVerification===`always`||n.sensitive)try{await i.verifyActive(l,t)}catch(t){throw t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}return l}}}exports.createResourceAuth=i;

package/dist/modules/auth/server/resource.d.cts

@@ -0,0 +1,10 @@
+import { F as ResourceAuthOptions } from "../../../interface-ii8DV63k.cjs";
+import { JWTPayload } from "jose";
+import { ResourceRequestInput } from "better-auth/oauth2";
+export declare function createResourceAuth(options: ResourceAuthOptions): {
+  verify(request: ResourceRequestInput, input?: {
+    sensitive?: boolean;
+  }): Promise<JWTPayload>;
+};
+export type { ResourceAuthOptions };
+//# sourceMappingURL=resource.d.cts.map

package/dist/modules/auth/server/resource.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.cts","names":[],"sources":["../../../../src/modules/auth/server/resource.ts"],"mappings":";;;wBAWgB,mBAAmB,SAAS;EAkE7B,OAAA,SAAA,sBAAoB;IACpB;MAAqB,QAAA"}

package/dist/modules/auth/server/resource.d.ts

@@ -0,0 +1,10 @@
+import { F as ResourceAuthOptions } from "../../../interface-ii8DV63k.js";
+import { JWTPayload } from "jose";
+import { ResourceRequestInput } from "better-auth/oauth2";
+export declare function createResourceAuth(options: ResourceAuthOptions): {
+  verify(request: ResourceRequestInput, input?: {
+    sensitive?: boolean;
+  }): Promise<JWTPayload>;
+};
+export type { ResourceAuthOptions };
+//# sourceMappingURL=resource.d.ts.map

package/dist/modules/auth/server/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","names":[],"sources":["../../../../src/modules/auth/server/resource.ts"],"mappings":";;;wBAWgB,mBAAmB,SAAS;EAkE7B,OAAA,SAAA,sBAAoB;IACpB;MAAqB,QAAA"}

package/dist/modules/auth/server/resource.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{createAuthPolicy as t}from"../policy.js";import{createProofReplayStore as n}from"./proof.js";import{isInsufficientScopeError as r,verifyAccessTokenRequest as i}from"better-auth/oauth2";function a(a){let o=a.now??Date.now,s=t(a.policy),{verification:c}=a;if(!c.verifyOptions.issuer||!c.verifyOptions.audience||!c.jwksUrl&&!c.remoteVerify||![`always`,`sensitive`].includes(a.onlineVerification)||a.requireSid===!1&&a.onlineVerification!==`always`)throw new e(`invalid_configuration`);let l=c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!l.length||l.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e(`invalid_configuration`);let u=e=>typeof e==`string`&&e.length>0;if(![c.verifyOptions.issuer,c.verifyOptions.audience].every(e=>Array.isArray(e)?e.length>0&&e.every(u):u(e)))throw new e(`invalid_configuration`);for(let t of[c.jwksUrl,c.remoteVerify?.introspectUrl]){if(!t)continue;let n;try{n=new URL(t)}catch{throw new e(`invalid_configuration`)}if(n.username||n.password||n.hash||n.search||n.protocol!==`https:`&&!(a.allowLoopbackHttp&&n.protocol===`http:`&&[`localhost`,`127.0.0.1`,`[::1]`].includes(n.hostname)))throw new e(`invalid_configuration`)}let d=n(a.proof,o);return{async verify(t,n={}){let u;try{if(u=await i(t,{...c,verifyOptions:{...c.verifyOptions,algorithms:[...l],clockTolerance:s.clockToleranceSeconds,requiredClaims:[.../* @__PURE__ */ new Set([...c.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`exp`,`iat`])],currentDate:new Date(o())},dpop:{replayStore:d}}),typeof u.sub!=`string`||!u.sub||u.sub.length>255||a.requireSid!==!1&&typeof u.sid!=`string`||u.iat>o()/1e3+s.clockToleranceSeconds||u.exp*1e3-o()>s.revocationRetentionMs-s.clockToleranceSeconds*1e3||u.sid!==void 0&&(typeof u.sid!=`string`||!u.sid||u.sid.length>255))throw new e(`rejected`)}catch(t){if(r(t))throw new e(`forbidden`);if(t instanceof e)throw t;let n=t&&typeof t==`object`&&`statusCode`in t?t.statusCode:void 0;throw typeof n==`number`&&n>=400&&n<500?new e(`rejected`):new e(`unavailable`)}try{if(await a.revocation.isRevoked({subject:u.sub,sid:u.sid,issuedAt:u.iat*1e3,now:o()}))throw new e(`rejected`)}catch(t){throw t instanceof e?t:new e(`unavailable`)}if(a.onlineVerification===`always`||n.sensitive)try{await a.verifyActive(u,t)}catch(t){throw t instanceof e?t:new e(`unavailable`)}return u}}}export{a as createResourceAuth};
+//# sourceMappingURL=resource.js.map

package/dist/modules/auth/server/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","names":["createResourceAuth","now","options","policy","createAuthPolicy","verification","AuthError","algorithms","algorithm","exact","value","endpoint","url","replayStore","createProofReplayStore","claims","verifyAccessTokenRequest","request","error","isInsufficientScopeError","status","input"],"sources":["../../../../src/modules/auth/server/resource.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { createAuthPolicy } from \"@/modules/auth/policy\";\nimport { createProofReplayStore } from \"@/modules/auth/server/proof\";\nimport type { ResourceAuthOptions } from \"@/utils/interface\";\nimport {\n  isInsufficientScopeError,\n  verifyAccessTokenRequest,\n  type ResourceRequestInput,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport function createResourceAuth(options: ResourceAuthOptions) {\n  const now = options.now ?? Date.now;\n  const policy = createAuthPolicy(options.policy);\n  const { verification } = options;\n  if (\n    !verification.verifyOptions.issuer ||\n    !verification.verifyOptions.audience ||\n    (!verification.jwksUrl && !verification.remoteVerify) ||\n    ![\"always\", \"sensitive\"].includes(options.onlineVerification) ||\n    (options.requireSid === false && options.onlineVerification !== \"always\")\n  )\n    throw new AuthError(\"invalid_configuration\");\n  const algorithms = verification.verifyOptions.algorithms ?? [\n    \"RS256\",\n    \"ES256\",\n    \"EdDSA\",\n  ];\n  if (\n    !algorithms.length ||\n    algorithms.some(\n      (algorithm) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(algorithm),\n    )\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  const exact = (value: unknown): boolean =>\n    typeof value === \"string\" && value.length > 0;\n  if (\n    ![\n      verification.verifyOptions.issuer,\n      verification.verifyOptions.audience,\n    ].every((value) =>\n      Array.isArray(value)\n        ? value.length > 0 && value.every(exact)\n        : exact(value),\n    )\n  )\n    throw new AuthError(\"invalid_configuration\");\n  for (const endpoint of [\n    verification.jwksUrl,\n    verification.remoteVerify?.introspectUrl,\n  ]) {\n    if (!endpoint) continue;\n    let url: URL;\n    try {\n      url = new URL(endpoint);\n    } catch {\n      throw new AuthError(\"invalid_configuration\");\n    }\n    if (\n      url.username ||\n      url.password ||\n      url.hash ||\n      url.search ||\n      (url.protocol !== \"https:\" &&\n        !(\n          options.allowLoopbackHttp &&\n          url.protocol === \"http:\" &&\n          [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname)\n        ))\n    )\n      throw new AuthError(\"invalid_configuration\");\n  }\n  const replayStore = createProofReplayStore(options.proof, now);\n  return {\n    async verify(\n      request: ResourceRequestInput,\n      input: { sensitive?: boolean } = {},\n    ) {\n      let claims: JWTPayload;\n      try {\n        claims = await verifyAccessTokenRequest(request, {\n          ...verification,\n          verifyOptions: {\n            ...verification.verifyOptions,\n            algorithms: [...algorithms],\n            clockTolerance: policy.clockToleranceSeconds,\n            requiredClaims: [\n              ...new Set([\n                ...(verification.verifyOptions.requiredClaims ?? []),\n                \"iss\",\n                \"aud\",\n                \"sub\",\n                \"exp\",\n                \"iat\",\n              ]),\n            ],\n            currentDate: new Date(now()),\n          },\n          dpop: { replayStore },\n        });\n        if (\n          typeof claims.sub !== \"string\" ||\n          !claims.sub ||\n          claims.sub.length > 255 ||\n          (options.requireSid !== false && typeof claims.sid !== \"string\") ||\n          claims.iat! > now() / 1000 + policy.clockToleranceSeconds ||\n          claims.exp! * 1000 - now() >\n            policy.revocationRetentionMs -\n              policy.clockToleranceSeconds * 1000 ||\n          (claims.sid !== undefined &&\n            (typeof claims.sid !== \"string\" ||\n              !claims.sid ||\n              claims.sid.length > 255))\n        )\n          throw new AuthError(\"rejected\");\n      } catch (error) {\n        if (isInsufficientScopeError(error)) throw new AuthError(\"forbidden\");\n        if (error instanceof AuthError) throw error;\n        const status =\n          error && typeof error === \"object\" && \"statusCode\" in error\n            ? error.statusCode\n            : undefined;\n        if (typeof status === \"number\" && status >= 400 && status < 500)\n          throw new AuthError(\"rejected\");\n        // Unknown/JWKS/network failures are not a reason to log users out.\n        throw new AuthError(\"unavailable\");\n      }\n      try {\n        if (\n          await options.revocation.isRevoked({\n            subject: claims.sub!,\n            sid: claims.sid as string | undefined,\n            issuedAt: claims.iat! * 1000,\n            now: now(),\n          })\n        )\n          throw new AuthError(\"rejected\");\n      } catch (error) {\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n      if (options.onlineVerification === \"always\" || input.sensitive) {\n        try {\n          await options.verifyActive(claims, request);\n        } catch (error) {\n          if (error instanceof AuthError) throw error;\n          throw new AuthError(\"unavailable\");\n        }\n      }\n      return claims; // App still owns local status, permissions, and domain authorization.\n    },\n  };\n}\n\nexport type { ResourceAuthOptions } from \"@/utils/interface\";\n"],"mappings":"A,4OAWA,SAAgBA,EAAmB,EAA8B,CAC/D,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAC1BC,EAASC,EAAiBF,EAAQ,MAAM,EACxC,CAAE,gBAAiBA,EACzB,GACE,CAACG,EAAa,cAAc,QAC5B,CAACA,EAAa,cAAc,UAC3B,CAACA,EAAa,SAAW,CAACA,EAAa,cACxC,CAAC,CAAC,SAAU,WAAW,CAAC,CAAC,SAASH,EAAQ,kBAAkB,GAC3DA,EAAQ,aAAe,IAASA,EAAQ,qBAAuB,SAEhE,MAAM,IAAII,EAAU,uBAAuB,EAC7C,IAAMC,EAAaF,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACE,EAAW,QACZA,EAAW,KACR,GAAc,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAS,CAChE,EAEA,MAAM,IAAIF,EAAU,uBAAuB,EAE7C,IAAMG,EAAS,GACb,OAAOC,GAAU,UAAYA,EAAM,OAAS,EAC9C,GACE,CAAC,CACCL,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,CAAC,CAAC,MAAO,GACP,MAAM,QAAQK,CAAK,EACfA,EAAM,OAAS,GAAKA,EAAM,MAAMD,CAAK,EACrCA,EAAMC,CAAK,CACjB,EAEA,MAAM,IAAIJ,EAAU,uBAAuB,EAC7C,IAAK,IAAMK,IAAY,CACrBN,EAAa,QACbA,EAAa,cAAc,aAC7B,EAAG,CACD,GAAI,CAACM,EAAU,SACf,IAAIC,EACJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAQ,CACxB,MAAQ,CACN,MAAM,IAAIL,EAAU,uBAAuB,CAC7C,CACA,GACEM,EAAI,UACJA,EAAI,UACJA,EAAI,MACJA,EAAI,QACHA,EAAI,WAAa,UAChB,EACEV,EAAQ,mBACRU,EAAI,WAAa,SACjB,CAAC,YAAa,YAAa,OAAO,CAAC,CAAC,SAASA,EAAI,QAAQ,GAG7D,MAAM,IAAIN,EAAU,uBAAuB,CAC/C,CACA,IAAMO,EAAcC,EAAuBZ,EAAQ,MAAOD,CAAG,EAC7D,MAAO,CACL,MAAM,OACJ,EACA,EAAiC,CAAC,EAClC,CACA,IAAIc,EACJ,GAAI,CAqBF,GApBA,EAAS,MAAMC,EAAyBC,EAAS,CAC/C,GAAGZ,EACH,cAAe,CACb,GAAGA,EAAa,cAChB,WAAY,CAAC,GAAGE,CAAU,EAC1B,eAAgBJ,EAAO,sBACvB,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIE,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,EACA,YAAa,IAAI,KAAKJ,EAAI,CAAC,CAC7B,EACA,KAAM,CAAE,aAAY,CACtB,CAAC,EAEC,OAAOc,EAAO,KAAQ,UACtB,CAACA,EAAO,KACRA,EAAO,IAAI,OAAS,KACnBb,EAAQ,aAAe,IAAS,OAAOa,EAAO,KAAQ,UACvDA,EAAO,IAAOd,EAAI,EAAI,IAAOE,EAAO,uBACpCY,EAAO,IAAO,IAAOd,EAAI,EACvBE,EAAO,sBACLA,EAAO,sBAAwB,KAClCY,EAAO,MAAQ,IAAA,KACb,OAAOA,EAAO,KAAQ,UACrB,CAACA,EAAO,KACRA,EAAO,IAAI,OAAS,KAExB,MAAM,IAAIT,EAAU,UAAU,CAClC,OAASY,EAAO,CACd,GAAIC,EAAyBD,CAAK,EAAG,MAAM,IAAIZ,EAAU,WAAW,EACpE,GAAIY,aAAiBZ,EAAW,MAAMY,EACtC,IAAME,EACJF,GAAS,OAAOA,GAAU,UAAY,eAAgBA,EAClDA,EAAM,WACN,IAAA,GAIN,MAHI,OAAOE,GAAW,UAAYA,GAAU,KAAOA,EAAS,IACpD,IAAId,EAAU,UAAU,EAE1B,IAAIA,EAAU,aAAa,CACnC,CACA,GAAI,CACF,GACE,MAAMJ,EAAQ,WAAW,UAAU,CACjC,QAASa,EAAO,IAChB,IAAKA,EAAO,IACZ,SAAUA,EAAO,IAAO,IACxB,IAAKd,EAAI,CACX,CAAC,EAED,MAAM,IAAIK,EAAU,UAAU,CAClC,OAASY,EAAO,CAEd,MADIA,aAAiBZ,EAAiBY,EAChC,IAAIZ,EAAU,aAAa,CACnC,CACA,GAAIJ,EAAQ,qBAAuB,UAAYmB,EAAM,UACnD,GAAI,CACF,MAAMnB,EAAQ,aAAaa,EAAQE,CAAO,CAC5C,OAASC,EAAO,CAEd,MADIA,aAAiBZ,EAAiBY,EAChC,IAAIZ,EAAU,aAAa,CACnC,CAEF,OAAOS,CACT,CACF,CACF,C"}

package/dist/modules/auth/server/revocation.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t,n,r=Date.now()){if(!t.sid&&!t.subject||!n.subject||[t.issuedAt,t.expiresAt,n.issuedAt,r].some(e=>!Number.isSafeInteger(e)||e<0))throw new e.AuthError(`rejected`);return t.expiresAt>r&&(!t.subject||t.subject===n.subject)&&(!t.sid||t.sid===n.sid)&&(!!t.sid||Math.floor(n.issuedAt/1e3)<=Math.floor(t.issuedAt/1e3))}exports.matchesAuthRevocation=t;

package/dist/modules/auth/server/revocation.d.cts

@@ -0,0 +1,4 @@
+import { l as AuthRevocation, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.cjs";
+/** Both sid/sub must match when supplied. Subject-only events use iat's entire second. */
+export declare function matchesAuthRevocation(marker: AuthRevocation, identity: AuthRevocationIdentity, now?: number): boolean;
+//# sourceMappingURL=revocation.d.cts.map

package/dist/modules/auth/server/revocation.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.cts","names":[],"sources":["../../../../src/modules/auth/server/revocation.ts"],"mappings":";;wBAIgB,sBACd,QAAQ,gBACR,UAAU,wBACV"}

package/dist/modules/auth/server/revocation.d.ts

@@ -0,0 +1,4 @@
+import { l as AuthRevocation, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
+/** Both sid/sub must match when supplied. Subject-only events use iat's entire second. */
+export declare function matchesAuthRevocation(marker: AuthRevocation, identity: AuthRevocationIdentity, now?: number): boolean;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/modules/auth/server/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","names":[],"sources":["../../../../src/modules/auth/server/revocation.ts"],"mappings":";;wBAIgB,sBACd,QAAQ,gBACR,UAAU,wBACV"}

package/dist/modules/auth/server/revocation.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t,n,r=Date.now()){if(!t.sid&&!t.subject||!n.subject||[t.issuedAt,t.expiresAt,n.issuedAt,r].some(e=>!Number.isSafeInteger(e)||e<0))throw new e(`rejected`);return t.expiresAt>r&&(!t.subject||t.subject===n.subject)&&(!t.sid||t.sid===n.sid)&&(!!t.sid||Math.floor(n.issuedAt/1e3)<=Math.floor(t.issuedAt/1e3))}export{t as matchesAuthRevocation};
+//# sourceMappingURL=revocation.js.map

package/dist/modules/auth/server/revocation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.js","names":["matchesAuthRevocation","marker","identity","now","value","AuthError"],"sources":["../../../../src/modules/auth/server/revocation.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { AuthRevocation, AuthRevocationIdentity } from \"@/utils/interface\";\n\n/** Both sid/sub must match when supplied. Subject-only events use iat's entire second. */\nexport function matchesAuthRevocation(\n  marker: AuthRevocation,\n  identity: AuthRevocationIdentity,\n  now: number = Date.now(),\n): boolean {\n  if (\n    (!marker.sid && !marker.subject) ||\n    !identity.subject ||\n    [marker.issuedAt, marker.expiresAt, identity.issuedAt, now].some(\n      (value) => !Number.isSafeInteger(value) || value < 0,\n    )\n  )\n    throw new AuthError(\"rejected\");\n  return (\n    marker.expiresAt > now &&\n    (!marker.subject || marker.subject === identity.subject) &&\n    (!marker.sid || marker.sid === identity.sid) &&\n    (!!marker.sid ||\n      Math.floor(identity.issuedAt / 1000) <=\n        Math.floor(marker.issuedAt / 1000))\n  );\n}\n"],"mappings":"A,4CAIA,SAAgBA,EACd,EACA,EACA,EAAc,KAAK,IAAI,EACd,CACT,GACG,CAACC,EAAO,KAAO,CAACA,EAAO,SACxB,CAACC,EAAS,SACV,CAACD,EAAO,SAAUA,EAAO,UAAWC,EAAS,SAAUC,CAAG,CAAC,CAAC,KACzD,GAAU,CAAC,OAAO,cAAcC,CAAK,GAAKA,EAAQ,CACrD,EAEA,MAAM,IAAIC,EAAU,UAAU,EAChC,OACEJ,EAAO,UAAYE,IAClB,CAACF,EAAO,SAAWA,EAAO,UAAYC,EAAS,WAC/C,CAACD,EAAO,KAAOA,EAAO,MAAQC,EAAS,OACvC,CAAC,CAACD,EAAO,KACR,KAAK,MAAMC,EAAS,SAAW,GAAI,GACjC,KAAK,MAAMD,EAAO,SAAW,GAAI,EAEzC,C"}

package/dist/modules/auth/server/user-info.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./identity-cache.cjs"),n=require("./claims.cjs");function r(r){let i=t.createIdentityCache({...r,async load(t){let i=await r.load(t),a;try{if(a=r.parse(i),!n.oauthUserInfoSchema.shape.sub.safeParse(a.sub).success)throw Error()}catch{throw new e.AuthError(`rejected`)}if(r.allowed&&!await r.allowed(a))throw new e.AuthError(`forbidden`);return Object.freeze(a)}});return{...i,async get(t,n={}){let r=await i.get(t,n);if(n.subject!==void 0&&r.sub!==n.subject)throw new e.AuthError(`rejected`);return r}}}exports.createUserInfoCache=r;

package/dist/modules/auth/server/user-info.d.cts

@@ -0,0 +1,19 @@
+import { OAuthUserInfo } from "./claims.cjs";
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-ii8DV63k.cjs";
+export interface UserInfoCacheOptions<Profile extends {
+  sub: string;
+}> extends Omit<IdentityCacheOptions<Profile>, "load"> {
+  load(credential: string): Promise<unknown>;
+  parse(value: unknown): Profile;
+  allowed?(profile: Profile): boolean | Promise<boolean>;
+}
+export declare function createUserInfoCache<Profile extends {
+  sub: string;
+} = OAuthUserInfo>(options: UserInfoCacheOptions<Profile>): {
+  get(credential: string, input?: IdentityCacheInput & {
+    subject?: string;
+  }): Promise<Readonly<Profile>>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=user-info.d.cts.map

package/dist/modules/auth/server/user-info.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-info.d.cts","names":[],"sources":["../../../../src/modules/auth/server/user-info.ts"],"mappings":";;iBAKiB,qBAAqB;EAAkB;WAAuB,KAC7E,qBAAqB;EAGrB,KAAK,qBAAqB;EAC1B,MAAM,iBAAiB;EACvB,SAAS,SAAS,oBAAoB;;wBAGxB,oBAAoB;EAAkB;IAAgB,eACpE,SAAS,qBAAqB;EAsBd,IAAA,oBAAM,QACX;IAAuB;MAAkB,QAAA,SAAA"}

package/dist/modules/auth/server/user-info.d.ts

@@ -0,0 +1,19 @@
+import { OAuthUserInfo } from "./claims.js";
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-ii8DV63k.js";
+export interface UserInfoCacheOptions<Profile extends {
+  sub: string;
+}> extends Omit<IdentityCacheOptions<Profile>, "load"> {
+  load(credential: string): Promise<unknown>;
+  parse(value: unknown): Profile;
+  allowed?(profile: Profile): boolean | Promise<boolean>;
+}
+export declare function createUserInfoCache<Profile extends {
+  sub: string;
+} = OAuthUserInfo>(options: UserInfoCacheOptions<Profile>): {
+  get(credential: string, input?: IdentityCacheInput & {
+    subject?: string;
+  }): Promise<Readonly<Profile>>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=user-info.d.ts.map

package/dist/modules/auth/server/user-info.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-info.d.ts","names":[],"sources":["../../../../src/modules/auth/server/user-info.ts"],"mappings":";;iBAKiB,qBAAqB;EAAkB;WAAuB,KAC7E,qBAAqB;EAGrB,KAAK,qBAAqB;EAC1B,MAAM,iBAAiB;EACvB,SAAS,SAAS,oBAAoB;;wBAGxB,oBAAoB;EAAkB;IAAgB,eACpE,SAAS,qBAAqB;EAsBd,IAAA,oBAAM,QACX;IAAuB;MAAkB,QAAA,SAAA"}

package/dist/modules/auth/server/user-info.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{createIdentityCache as t}from"./identity-cache.js";import{oauthUserInfoSchema as n}from"./claims.js";function r(r){let i=t({...r,async load(t){let i=await r.load(t),a;try{if(a=r.parse(i),!n.shape.sub.safeParse(a.sub).success)throw Error()}catch{throw new e(`rejected`)}if(r.allowed&&!await r.allowed(a))throw new e(`forbidden`);return Object.freeze(a)}});return{...i,async get(t,n={}){let r=await i.get(t,n);if(n.subject!==void 0&&r.sub!==n.subject)throw new e(`rejected`);return r}}}export{r as createUserInfoCache};
+//# sourceMappingURL=user-info.js.map

package/dist/modules/auth/server/user-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"user-info.js","names":["createUserInfoCache","cache","createIdentityCache","options","raw","credential","profile","oauthUserInfoSchema","AuthError","input"],"sources":["../../../../src/modules/auth/server/user-info.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { createIdentityCache } from \"@/modules/auth/server/identity-cache\";\nimport { oauthUserInfoSchema, type OAuthUserInfo } from \"@/modules/auth/server/claims\";\nimport type { IdentityCacheOptions, IdentityCacheInput } from \"@/utils/interface\";\n\nexport interface UserInfoCacheOptions<Profile extends { sub: string }> extends Omit<\n  IdentityCacheOptions<Profile>,\n  \"load\"\n> {\n  load(credential: string): Promise<unknown>;\n  parse(value: unknown): Profile;\n  allowed?(profile: Profile): boolean | Promise<boolean>;\n}\n\nexport function createUserInfoCache<Profile extends { sub: string } = OAuthUserInfo>(\n  options: UserInfoCacheOptions<Profile>,\n) {\n  const cache = createIdentityCache<Readonly<Profile>>({\n    ...options,\n    async load(credential) {\n      const raw = await options.load(credential);\n      let profile: Profile;\n      try {\n        profile = options.parse(raw);\n        if (!oauthUserInfoSchema.shape.sub.safeParse(profile.sub).success)\n          throw new Error();\n      } catch {\n        throw new AuthError(\"rejected\");\n      }\n      if (options.allowed && !(await options.allowed(profile)))\n        throw new AuthError(\"forbidden\");\n      return Object.freeze(profile);\n    },\n  });\n  return {\n    ...cache,\n    async get(\n      credential: string,\n      input: IdentityCacheInput & { subject?: string } = {},\n    ) {\n      const profile = await cache.get(credential, input);\n      if (input.subject !== undefined && profile.sub !== input.subject)\n        throw new AuthError(\"rejected\");\n      return profile;\n    },\n  };\n}\n"],"mappings":"A,wJAcA,SAAgBA,EACd,EACA,CACA,IAAMC,EAAQC,EAAuC,CACnD,GAAGC,EACH,MAAM,KAAK,EAAY,CACrB,IAAMC,EAAM,MAAMD,EAAQ,KAAKE,CAAU,EACrCC,EACJ,GAAI,CAEF,GADA,EAAUH,EAAQ,MAAMC,CAAG,EACvB,CAACG,EAAoB,MAAM,IAAI,UAAUD,EAAQ,GAAG,CAAC,CAAC,QACxD,MAAU,MAAM,CACpB,MAAQ,CACN,MAAM,IAAIE,EAAU,UAAU,CAChC,CACA,GAAIL,EAAQ,SAAW,CAAE,MAAMA,EAAQ,QAAQG,CAAO,EACpD,MAAM,IAAIE,EAAU,WAAW,EACjC,OAAO,OAAO,OAAOF,CAAO,CAC9B,CACF,CAAC,EACD,MAAO,CACL,GAAGL,EACH,MAAM,IACJ,EACA,EAAmD,CAAC,EACpD,CACA,IAAMK,EAAU,MAAML,EAAM,IAAII,EAAYI,CAAK,EACjD,GAAIA,EAAM,UAAY,IAAA,IAAaH,EAAQ,MAAQG,EAAM,QACvD,MAAM,IAAID,EAAU,UAAU,EAChC,OAAOF,CACT,CACF,CACF,C"}

package/dist/modules/common/admin.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@supabase/supabase-js");function t(t,n,r){return(0,e.createClient)(t,n,r)}function n(t,n,r){return(0,e.createClient)(t,n,r)}exports.createCommonAdminClient=t,exports.createCommonPublicClient=n;

package/dist/modules/common/admin.d.cts

@@ -0,0 +1,4 @@
+import { SupabaseClientOptions } from "@supabase/supabase-js";
+export declare function createCommonAdminClient(url: string, serviceRoleKey: string, options?: SupabaseClientOptions<"public">): import("@supabase/supabase-js").SupabaseClient<any, "public", "public", any, any>;
+export declare function createCommonPublicClient(url: string, anonOrPublishableKey: string, options?: SupabaseClientOptions<"public">): import("@supabase/supabase-js").SupabaseClient<any, "public", "public", any, any>;
+//# sourceMappingURL=admin.d.cts.map

package/dist/modules/common/admin.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.cts","names":[],"sources":["../../../src/modules/common/admin.ts"],"mappings":";wBAGgB,wBACd,aACA,wBACA,UAAU,kEAA+B;wBAK3B,yBACd,aACA,8BACA,UAAU,kEAA+B"}

package/dist/modules/common/admin.d.ts

@@ -0,0 +1,4 @@
+import { SupabaseClientOptions } from "@supabase/supabase-js";
+export declare function createCommonAdminClient(url: string, serviceRoleKey: string, options?: SupabaseClientOptions<"public">): import("@supabase/supabase-js").SupabaseClient<any, "public", "public", any, any>;
+export declare function createCommonPublicClient(url: string, anonOrPublishableKey: string, options?: SupabaseClientOptions<"public">): import("@supabase/supabase-js").SupabaseClient<any, "public", "public", any, any>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/modules/common/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","names":[],"sources":["../../../src/modules/common/admin.ts"],"mappings":";wBAGgB,wBACd,aACA,wBACA,UAAU,kEAA+B;wBAK3B,yBACd,aACA,8BACA,UAAU,kEAA+B"}

package/dist/modules/common/admin.js

@@ -0,0 +1,2 @@
+import{createClient as e}from"@supabase/supabase-js";function t(t,n,r){return e(t,n,r)}function n(t,n,r){return e(t,n,r)}export{t as createCommonAdminClient,n as createCommonPublicClient};
+//# sourceMappingURL=admin.js.map

package/dist/modules/common/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","names":["createCommonAdminClient","createClient","url","serviceRoleKey","options","createCommonPublicClient","anonOrPublishableKey"],"sources":["../../../src/modules/common/admin.ts"],"sourcesContent":["import type { SupabaseClientOptions } from \"@supabase/supabase-js\";\nimport { createClient } from \"@supabase/supabase-js\";\n\nexport function createCommonAdminClient(\n  url: string,\n  serviceRoleKey: string,\n  options?: SupabaseClientOptions<\"public\">,\n) {\n  return createClient(url, serviceRoleKey, options);\n}\n\nexport function createCommonPublicClient(\n  url: string,\n  anonOrPublishableKey: string,\n  options?: SupabaseClientOptions<\"public\">,\n) {\n  return createClient(url, anonOrPublishableKey, options);\n}\n"],"mappings":"A,qDAGA,SAAgBA,EACd,EACA,EACA,EACA,CACA,OAAOC,EAAaC,EAAKC,EAAgBC,CAAO,CAClD,CAEA,SAAgBC,EACd,EACA,EACA,EACA,CACA,OAAOJ,EAAaC,EAAKI,EAAsBF,CAAO,CACxD,C"}

package/dist/modules/common/client.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});let e=require("@supabase/ssr");function t(t,n,r){return(0,e.createBrowserClient)(t,n,{...r??{}})}function n(t,n,r,i){return(0,e.createServerClient)(t,n,{...i,cookies:r})}exports.createCommonBrowserClient=t,exports.createCommonServerClient=n;