@gorth-io/structure 0.0.0-alpha.5

package/dist/modules/auth/client/retry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"retry.js","names":["waitForAuthOperation","signal","abort","reject","resolve","operation","error","createAuthRetry","flight","controller","generation","disposed","reset","refresh","version","options","input","request"],"sources":["../../../../src/modules/auth/client/retry.ts"],"sourcesContent":["import type { AuthRetryInput, AuthRetryOptions } from \"@/utils/interface\";\n\n/** Waiter cancellation must not abort a refresh needed by other requests. */\nexport async function waitForAuthOperation<Value>(\n  operation: Promise<Value>,\n  signal?: AbortSignal,\n): Promise<Value> {\n  if (!signal) return await operation;\n  return await new Promise<Value>((resolve, reject) => {\n    const abort = () => {\n      signal.removeEventListener(\"abort\", abort);\n      reject(signal.reason);\n    };\n    signal.addEventListener(\"abort\", abort, { once: true });\n    if (signal.aborted) abort();\n    // Observe even a cancelled waiter's operation so a late rejection is handled.\n    void (async () => {\n      try {\n        resolve(await operation);\n      } catch (error) {\n        reject(error);\n      } finally {\n        signal.removeEventListener(\"abort\", abort);\n      }\n    })();\n  });\n}\n\n/** One refresh flight per factory, one retry per request. Reset on logout/account change. */\nexport function createAuthRetry(options: AuthRetryOptions) {\n  let flight: Promise<boolean> | undefined;\n  let controller: AbortController | undefined;\n  let generation = 0;\n  let disposed = false;\n\n  function reset() {\n    generation++;\n    controller?.abort();\n    flight = undefined;\n  }\n\n  function refresh() {\n    if (flight) return flight;\n    controller = new AbortController();\n    const signal = controller.signal;\n    const version = generation;\n    let operation!: Promise<boolean>;\n    operation = (async () => {\n      // Register the flight before invoking an adapter that may throw/re-enter.\n      await Promise.resolve();\n      try {\n        if (signal.aborted || disposed || version !== generation) return false;\n        const ok = await options.refresh(signal);\n        return ok && version === generation && !disposed && !signal.aborted;\n      } catch {\n        return false;\n      } finally {\n        if (flight === operation) flight = undefined;\n      }\n    })();\n    flight = operation;\n    return operation;\n  }\n\n  return {\n    async withAuthRetry<Value>(\n      request: () => Promise<Value>,\n      input: AuthRetryInput = {},\n    ): Promise<Value> {\n      input.signal?.throwIfAborted();\n      const version = generation;\n      try {\n        return await request();\n      } catch (error) {\n        input.signal?.throwIfAborted();\n        if (\n          disposed ||\n          version !== generation ||\n          input.enabled === false ||\n          options.getStatus(error) !== 401 ||\n          !(await waitForAuthOperation(refresh(), input.signal)) ||\n          version !== generation ||\n          disposed\n        )\n          throw error;\n        input.signal?.throwIfAborted();\n        return await request();\n      }\n    },\n    reset,\n    dispose() {\n      disposed = true;\n      reset();\n    },\n  };\n}\n\nexport type { AuthRetryInput, AuthRetryOptions } from \"@/utils/interface\";\n"],"mappings":"AAGA,eAAsBA,EACpB,EACA,EACgB,CAEhB,OADKC,EACE,MAAM,IAAI,SAAgB,EAAS,IAAW,CACnD,IAAMC,MAAc,CAClBD,EAAO,oBAAoB,QAASC,CAAK,EACzCC,EAAOF,EAAO,MAAM,CACtB,EACAA,EAAO,iBAAiB,QAASC,EAAO,CAAE,KAAM,EAAK,CAAC,EAClDD,EAAO,SAASC,EAAM,GAEpB,SAAY,CAChB,GAAI,CACFE,EAAQ,MAAMC,CAAS,CACzB,OAASC,EAAO,CACdH,EAAOG,CAAK,CACd,QAAU,CACRL,EAAO,oBAAoB,QAASC,CAAK,CAC3C,CACF,EAAA,CAAG,CACL,CAAC,EAlBmB,MAAMG,CAmB5B,CAGA,SAAgBE,EAAgB,EAA2B,CACzD,IAAIC,EACAC,EACAC,EAAa,EACbC,EAAW,GAEf,SAASC,GAAQ,CACf,IACAH,GAAY,MAAM,EAClB,EAAS,IAAA,EACX,CAEA,SAASI,GAAU,CACjB,GAAIL,EAAQ,OAAOA,EACnB,EAAa,IAAI,gBACjB,IAAMP,EAASQ,EAAW,OACpBK,EAAUJ,EACZL,EAeJ,MAdA,IAAa,SAAY,CAEvB,MAAM,QAAQ,QAAQ,EACtB,GAAI,CAGF,OAFIJ,EAAO,SAAWU,GAAYG,IAAYJ,EAAmB,GAE1D,MADUK,EAAQ,QAAQd,CAAM,GAC1Ba,IAAYJ,GAAc,CAACC,GAAY,CAACV,EAAO,OAC9D,MAAQ,CACN,MAAO,EACT,QAAU,CACJO,IAAWH,IAAW,EAAS,IAAA,GACrC,CACF,EAAA,CAAG,EACH,EAASA,EACFA,CACT,CAEA,MAAO,CACL,MAAM,cACJ,EACA,EAAwB,CAAC,EACT,CAChBW,EAAM,QAAQ,eAAe,EAC7B,IAAMF,EAAUJ,EAChB,GAAI,CACF,OAAO,MAAMO,EAAQ,CACvB,OAASX,EAAO,CAEd,GADAU,EAAM,QAAQ,eAAe,EAE3BL,GACAG,IAAYJ,GACZM,EAAM,UAAY,IAClBD,EAAQ,UAAUT,CAAK,IAAM,KAC7B,CAAE,MAAMN,EAAqBa,EAAQ,EAAGG,EAAM,MAAM,GACpDF,IAAYJ,GACZC,EAEA,MAAML,EAER,OADAU,EAAM,QAAQ,eAAe,EACtB,MAAMC,EAAQ,CACvB,CACF,EACA,QACA,SAAU,CACR,EAAW,GACXL,EAAM,CACR,CACF,CACF,C"}

package/dist/modules/auth/interface.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});var e=class extends Error{code;constructor(e){super(`Authentication ${e.replaceAll(`_`,` `)}`),this.code=e,this.name=`AuthError`}};exports.AuthError=e;

package/dist/modules/auth/interface.d.cts

@@ -0,0 +1,8 @@
+import { a as AuthIdentity, n as AuthErrorCode, o as AuthPolicy } from "../../interface-BR9QNgXO.cjs";
+/** Safe errors never include provider payloads, credentials or database causes. */
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  constructor(code: AuthErrorCode);
+}
+export type { AuthErrorCode, AuthIdentity, AuthPolicy };
+//# sourceMappingURL=interface.d.cts.map

package/dist/modules/auth/interface.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.cts","names":[],"sources":["../../../src/modules/auth/interface.ts"],"mappings":";;qBAGa,kBAAkB;WACD,MAAM;EAAN,YAAA,MAAM"}

package/dist/modules/auth/interface.d.ts

@@ -0,0 +1,8 @@
+import { a as AuthIdentity, n as AuthErrorCode, o as AuthPolicy } from "../../interface-ii8DV63k.js";
+/** Safe errors never include provider payloads, credentials or database causes. */
+export declare class AuthError extends Error {
+  readonly code: AuthErrorCode;
+  constructor(code: AuthErrorCode);
+}
+export type { AuthErrorCode, AuthIdentity, AuthPolicy };
+//# sourceMappingURL=interface.d.ts.map

package/dist/modules/auth/interface.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.d.ts","names":[],"sources":["../../../src/modules/auth/interface.ts"],"mappings":";;qBAGa,kBAAkB;WACD,MAAM;EAAN,YAAA,MAAM"}

package/dist/modules/auth/interface.js

@@ -0,0 +1,2 @@
+var e=class extends Error{code;constructor(e){super(`Authentication ${e.replaceAll(`_`,` `)}`),this.code=e,this.name=`AuthError`}};export{e as AuthError};
+//# sourceMappingURL=interface.js.map

package/dist/modules/auth/interface.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interface.js","names":["AuthError","code"],"sources":["../../../src/modules/auth/interface.ts"],"sourcesContent":["import type { AuthErrorCode } from \"@/utils/interface\";\n\n/** Safe errors never include provider payloads, credentials or database causes. */\nexport class AuthError extends Error {\n  constructor(public readonly code: AuthErrorCode) {\n    super(`Authentication ${code.replaceAll(\"_\", \" \")}`);\n    this.name = \"AuthError\";\n  }\n}\nexport type {\n  AuthErrorCode,\n  AuthIdentity,\n  AuthPolicy,\n} from \"@/utils/interface\";\n"],"mappings":"AAGA,IAAaA,EAAb,cAA+B,KAAM,CACP,KAA5B,YAAY,EAAqC,CAC/C,MAAM,kBAAkBC,EAAK,WAAW,IAAK,GAAG,GAAG,EADzB,KAAA,KAAAA,EAE1B,KAAK,KAAO,WACd,CACF,E"}

package/dist/modules/auth/policy.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("./interface.cjs");function t(t={},r=Date.now){let i=n(t);return function(t){let n=r();if(![n,t.accessExpiresAt,t.verifiedAt].every(Number.isFinite)||n<0||t.accessExpiresAt<0||t.verifiedAt<0)throw new e.AuthError(`rejected`);return{expired:t.accessExpiresAt<=n,refresh:t.accessExpiresAt<=n+i.refreshLeewayMs,verifyIdentity:t.fresh===!0||t.verifiedAt>n||t.verifiedAt+i.identityMaxAgeMs<=n}}}function n(t={}){let n={sessionMaxAgeMs:6048e5,transactionMaxAgeMs:12e4,identityMaxAgeMs:12e4,refreshLeewayMs:3e4,clockToleranceSeconds:5,logoutMaxAgeSeconds:120,revocationRetentionMs:60483e4,...t};if(Object.values(n).some(e=>!Number.isSafeInteger(e)||e<0)||!n.sessionMaxAgeMs||!n.transactionMaxAgeMs||!n.logoutMaxAgeSeconds||n.transactionMaxAgeMs>6e5||n.clockToleranceSeconds>60||n.identityMaxAgeMs>3e5||n.revocationRetentionMs<n.sessionMaxAgeMs+n.clockToleranceSeconds*1e3||n.revocationRetentionMs<(n.logoutMaxAgeSeconds+n.clockToleranceSeconds)*1e3)throw new e.AuthError(`invalid_configuration`);return Object.freeze(n)}function r(t=`/`){if(t.length>2048||!t.startsWith(`/`)||t.startsWith(`//`)||/[\\\u0000-\u0020\u007f]/.test(t))throw new e.AuthError(`rejected`);let n=new URL(t,`https://app.invalid`);if(n.origin!==`https://app.invalid`)throw new e.AuthError(`rejected`);return n.pathname+n.search+n.hash}function i(t,n){let r=t.get(`origin`);if(!r||!n.includes(r)||t.get(`sec-fetch-site`)===`cross-site`)throw new e.AuthError(`rejected`);for(let t of n)if(new URL(t).origin!==t)throw new e.AuthError(`invalid_configuration`)}function a(t){if(!Number.isSafeInteger(t.maxAgeSeconds)||t.maxAgeSeconds<0||!t.path?.startsWith(`/`)&&t.path!==void 0)throw new e.AuthError(`invalid_configuration`);return{httpOnly:!0,secure:t.secure,sameSite:`lax`,path:t.path??`/`,maxAge:t.maxAgeSeconds}}exports.assertMutationOrigin=i,exports.authCookieOptions=a,exports.createAuthFreshnessPolicy=t,exports.createAuthPolicy=n,exports.resolveReturnPath=r;

package/dist/modules/auth/policy.d.cts

@@ -0,0 +1,15 @@
+import "./interface.cjs";
+import { i as AuthFreshnessInput, o as AuthPolicy, r as AuthFreshness, t as AuthCookieInput } from "../../interface-BR9QNgXO.cjs";
+/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */
+export declare function createAuthFreshnessPolicy(overrides?: Partial<AuthPolicy>, now?: () => number): (input: AuthFreshnessInput) => AuthFreshness;
+export declare function createAuthPolicy(overrides?: Partial<AuthPolicy>): Readonly<AuthPolicy>;
+export declare function resolveReturnPath(value?: string): string;
+export declare function assertMutationOrigin(headers: Headers, allowedOrigins: readonly string[]): void;
+export declare function authCookieOptions(options: AuthCookieInput): {
+  httpOnly: boolean;
+  secure: boolean;
+  sameSite: "lax";
+  path: string;
+  maxAge: number;
+};
+//# sourceMappingURL=policy.d.cts.map

package/dist/modules/auth/policy.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.cts","names":[],"sources":["../../../src/modules/auth/policy.ts"],"mappings":";;;wBAQgB,0BACd,YAAW,QAAQ,aACnB,sBAG8B,OAAO,uBAAqB;wBAoB5C,iBACd,YAAW,QAAQ,cAClB,SAAS;wBA+BI,kBAAkB;wBAclB,qBACd,SAAS,SACT;wBAgBc,kBAAkB,SAAS"}

package/dist/modules/auth/policy.d.ts

@@ -0,0 +1,15 @@
+import "./interface.js";
+import { i as AuthFreshnessInput, o as AuthPolicy, r as AuthFreshness, t as AuthCookieInput } from "../../interface-ii8DV63k.js";
+/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */
+export declare function createAuthFreshnessPolicy(overrides?: Partial<AuthPolicy>, now?: () => number): (input: AuthFreshnessInput) => AuthFreshness;
+export declare function createAuthPolicy(overrides?: Partial<AuthPolicy>): Readonly<AuthPolicy>;
+export declare function resolveReturnPath(value?: string): string;
+export declare function assertMutationOrigin(headers: Headers, allowedOrigins: readonly string[]): void;
+export declare function authCookieOptions(options: AuthCookieInput): {
+  httpOnly: boolean;
+  secure: boolean;
+  sameSite: "lax";
+  path: string;
+  maxAge: number;
+};
+//# sourceMappingURL=policy.d.ts.map

package/dist/modules/auth/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","names":[],"sources":["../../../src/modules/auth/policy.ts"],"mappings":";;;wBAQgB,0BACd,YAAW,QAAQ,aACnB,sBAG8B,OAAO,uBAAqB;wBAoB5C,iBACd,YAAW,QAAQ,cAClB,SAAS;wBA+BI,kBAAkB;wBAclB,qBACd,SAAS,SACT;wBAgBc,kBAAkB,SAAS"}

package/dist/modules/auth/policy.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"./interface.js";function t(t={},r=Date.now){let i=n(t);return function(t){let n=r();if(![n,t.accessExpiresAt,t.verifiedAt].every(Number.isFinite)||n<0||t.accessExpiresAt<0||t.verifiedAt<0)throw new e(`rejected`);return{expired:t.accessExpiresAt<=n,refresh:t.accessExpiresAt<=n+i.refreshLeewayMs,verifyIdentity:t.fresh===!0||t.verifiedAt>n||t.verifiedAt+i.identityMaxAgeMs<=n}}}function n(t={}){let n={sessionMaxAgeMs:6048e5,transactionMaxAgeMs:12e4,identityMaxAgeMs:12e4,refreshLeewayMs:3e4,clockToleranceSeconds:5,logoutMaxAgeSeconds:120,revocationRetentionMs:60483e4,...t};if(Object.values(n).some(e=>!Number.isSafeInteger(e)||e<0)||!n.sessionMaxAgeMs||!n.transactionMaxAgeMs||!n.logoutMaxAgeSeconds||n.transactionMaxAgeMs>6e5||n.clockToleranceSeconds>60||n.identityMaxAgeMs>3e5||n.revocationRetentionMs<n.sessionMaxAgeMs+n.clockToleranceSeconds*1e3||n.revocationRetentionMs<(n.logoutMaxAgeSeconds+n.clockToleranceSeconds)*1e3)throw new e(`invalid_configuration`);return Object.freeze(n)}function r(t=`/`){if(t.length>2048||!t.startsWith(`/`)||t.startsWith(`//`)||/[\\\u0000-\u0020\u007f]/.test(t))throw new e(`rejected`);let n=new URL(t,`https://app.invalid`);if(n.origin!==`https://app.invalid`)throw new e(`rejected`);return n.pathname+n.search+n.hash}function i(t,n){let r=t.get(`origin`);if(!r||!n.includes(r)||t.get(`sec-fetch-site`)===`cross-site`)throw new e(`rejected`);for(let t of n)if(new URL(t).origin!==t)throw new e(`invalid_configuration`)}function a(t){if(!Number.isSafeInteger(t.maxAgeSeconds)||t.maxAgeSeconds<0||!t.path?.startsWith(`/`)&&t.path!==void 0)throw new e(`invalid_configuration`);return{httpOnly:!0,secure:t.secure,sameSite:`lax`,path:t.path??`/`,maxAge:t.maxAgeSeconds}}export{i as assertMutationOrigin,a as authCookieOptions,t as createAuthFreshnessPolicy,n as createAuthPolicy,r as resolveReturnPath};
+//# sourceMappingURL=policy.js.map

package/dist/modules/auth/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","names":["createAuthFreshnessPolicy","policy","createAuthPolicy","overrides","time","now","input","AuthError","value","resolveReturnPath","url","assertMutationOrigin","origin","headers","allowedOrigins","allowed","authCookieOptions","options"],"sources":["../../../src/modules/auth/policy.ts"],"sourcesContent":["import { AuthError, type AuthPolicy } from \"@/modules/auth/interface\";\nimport type {\n  AuthCookieInput,\n  AuthFreshness,\n  AuthFreshnessInput,\n} from \"@/utils/interface\";\n\n/** Shared decisions only. Apps still perform authoritative storage/revocation checks. */\nexport function createAuthFreshnessPolicy(\n  overrides: Partial<AuthPolicy> = {},\n  now: () => number = Date.now,\n) {\n  const policy = createAuthPolicy(overrides);\n  return function authFreshness(input: AuthFreshnessInput): AuthFreshness {\n    const time = now();\n    if (\n      ![time, input.accessExpiresAt, input.verifiedAt].every(Number.isFinite) ||\n      time < 0 ||\n      input.accessExpiresAt < 0 ||\n      input.verifiedAt < 0\n    )\n      throw new AuthError(\"rejected\");\n    return {\n      expired: input.accessExpiresAt <= time,\n      refresh: input.accessExpiresAt <= time + policy.refreshLeewayMs,\n      verifyIdentity:\n        input.fresh === true ||\n        input.verifiedAt > time ||\n        input.verifiedAt + policy.identityMaxAgeMs <= time,\n    };\n  };\n}\n\nexport function createAuthPolicy(\n  overrides: Partial<AuthPolicy> = {},\n): Readonly<AuthPolicy> {\n  const policy: AuthPolicy = {\n    sessionMaxAgeMs: 7 * 86_400_000,\n    transactionMaxAgeMs: 120_000,\n    identityMaxAgeMs: 120_000,\n    refreshLeewayMs: 30_000,\n    clockToleranceSeconds: 5,\n    logoutMaxAgeSeconds: 120,\n    revocationRetentionMs: 7 * 86_400_000 + 30_000,\n    ...overrides,\n  };\n  if (\n    Object.values(policy).some(\n      (value) => !Number.isSafeInteger(value) || value < 0,\n    ) ||\n    !policy.sessionMaxAgeMs ||\n    !policy.transactionMaxAgeMs ||\n    !policy.logoutMaxAgeSeconds ||\n    policy.transactionMaxAgeMs > 600_000 ||\n    policy.clockToleranceSeconds > 60 ||\n    policy.identityMaxAgeMs > 300_000 ||\n    policy.revocationRetentionMs <\n      policy.sessionMaxAgeMs + policy.clockToleranceSeconds * 1000 ||\n    policy.revocationRetentionMs <\n      (policy.logoutMaxAgeSeconds + policy.clockToleranceSeconds) * 1000\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  return Object.freeze(policy);\n}\n\nexport function resolveReturnPath(value: string = \"/\"): string {\n  // Also reject browser-normalized backslashes, controls, and protocol-relative URLs.\n  if (\n    value.length > 2048 ||\n    !value.startsWith(\"/\") ||\n    value.startsWith(\"//\") ||\n    /[\\\\\\u0000-\\u0020\\u007f]/.test(value)\n  )\n    throw new AuthError(\"rejected\");\n  const url = new URL(value, \"https://app.invalid\");\n  if (url.origin !== \"https://app.invalid\") throw new AuthError(\"rejected\");\n  return url.pathname + url.search + url.hash;\n}\n\nexport function assertMutationOrigin(\n  headers: Headers,\n  allowedOrigins: readonly string[],\n): void {\n  const origin = headers.get(\"origin\");\n  if (\n    !origin ||\n    !allowedOrigins.includes(origin) ||\n    headers.get(\"sec-fetch-site\") === \"cross-site\"\n  ) {\n    throw new AuthError(\"rejected\");\n  }\n  for (const allowed of allowedOrigins) {\n    if (new URL(allowed).origin !== allowed)\n      throw new AuthError(\"invalid_configuration\");\n  }\n}\n\nexport function authCookieOptions(options: AuthCookieInput) {\n  if (\n    !Number.isSafeInteger(options.maxAgeSeconds) ||\n    options.maxAgeSeconds < 0 ||\n    (!options.path?.startsWith(\"/\") && options.path !== undefined)\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  // Host-only; each app owns its cookie. Reuse these attributes when deleting it.\n  return {\n    httpOnly: true,\n    secure: options.secure,\n    sameSite: \"lax\" as const,\n    path: options.path ?? \"/\",\n    maxAge: options.maxAgeSeconds,\n  };\n}\n"],"mappings":"A,2CAQA,SAAgBA,EACd,EAAiC,CAAC,EAClC,EAAoB,KAAK,IACzB,CACA,IAAMC,EAASC,EAAiBC,CAAS,EACzC,OAAO,SAAuB,EAA0C,CACtE,IAAMC,EAAOC,EAAI,EACjB,GACE,CAAC,CAACD,EAAME,EAAM,gBAAiBA,EAAM,UAAU,CAAC,CAAC,MAAM,OAAO,QAAQ,GACtEF,EAAO,GACPE,EAAM,gBAAkB,GACxBA,EAAM,WAAa,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,MAAO,CACL,QAASD,EAAM,iBAAmBF,EAClC,QAASE,EAAM,iBAAmBF,EAAOH,EAAO,gBAChD,eACEK,EAAM,QAAU,IAChBA,EAAM,WAAaF,GACnBE,EAAM,WAAaL,EAAO,kBAAoBG,CAClD,CACF,CACF,CAEA,SAAgBF,EACd,EAAiC,CAAC,EACZ,CACtB,IAAMD,EAAqB,CACzB,gBAAiB,OACjB,oBAAqB,KACrB,iBAAkB,KAClB,gBAAiB,IACjB,sBAAuB,EACvB,oBAAqB,IACrB,sBAAuB,QACvB,GAAGE,CACL,EACA,GACE,OAAO,OAAOF,CAAM,CAAC,CAAC,KACnB,GAAU,CAAC,OAAO,cAAcO,CAAK,GAAKA,EAAQ,CACrD,GACA,CAACP,EAAO,iBACR,CAACA,EAAO,qBACR,CAACA,EAAO,qBACRA,EAAO,oBAAsB,KAC7BA,EAAO,sBAAwB,IAC/BA,EAAO,iBAAmB,KAC1BA,EAAO,sBACLA,EAAO,gBAAkBA,EAAO,sBAAwB,KAC1DA,EAAO,uBACJA,EAAO,oBAAsBA,EAAO,uBAAyB,IAEhE,MAAM,IAAIM,EAAU,uBAAuB,EAE7C,OAAO,OAAO,OAAON,CAAM,CAC7B,CAEA,SAAgBQ,EAAkB,EAAgB,IAAa,CAE7D,GACED,EAAM,OAAS,MACf,CAACA,EAAM,WAAW,GAAG,GACrBA,EAAM,WAAW,IAAI,GACrB,0BAA0B,KAAKA,CAAK,EAEpC,MAAM,IAAID,EAAU,UAAU,EAChC,IAAMG,EAAM,IAAI,IAAIF,EAAO,qBAAqB,EAChD,GAAIE,EAAI,SAAW,sBAAuB,MAAM,IAAIH,EAAU,UAAU,EACxE,OAAOG,EAAI,SAAWA,EAAI,OAASA,EAAI,IACzC,CAEA,SAAgBC,EACd,EACA,EACM,CACN,IAAMC,EAASC,EAAQ,IAAI,QAAQ,EACnC,GACE,CAACD,GACD,CAACE,EAAe,SAASF,CAAM,GAC/BC,EAAQ,IAAI,gBAAgB,IAAM,aAElC,MAAM,IAAIN,EAAU,UAAU,EAEhC,IAAK,IAAMQ,KAAWD,EACpB,GAAI,IAAI,IAAIC,CAAO,CAAC,CAAC,SAAWA,EAC9B,MAAM,IAAIR,EAAU,uBAAuB,CAEjD,CAEA,SAAgBS,EAAkB,EAA0B,CAC1D,GACE,CAAC,OAAO,cAAcC,EAAQ,aAAa,GAC3CA,EAAQ,cAAgB,GACvB,CAACA,EAAQ,MAAM,WAAW,GAAG,GAAKA,EAAQ,OAAS,IAAA,GAEpD,MAAM,IAAIV,EAAU,uBAAuB,EAG7C,MAAO,CACL,SAAU,GACV,OAAQU,EAAQ,OAChB,SAAU,MACV,KAAMA,EAAQ,MAAQ,IACtB,OAAQA,EAAQ,aAClB,CACF,C"}

package/dist/modules/auth/server/crypto.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");let t=require("jose");async function n(n){try{return t.base64url.encode(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(n))))}catch{throw new e.AuthError(`unavailable`)}}exports.fingerprintAuthValue=n;

package/dist/modules/auth/server/crypto.d.cts

@@ -0,0 +1,3 @@
+/** Hash cache keys; never store bearer credentials as Map keys. */
+export declare function fingerprintAuthValue(value: string): Promise<string>;
+//# sourceMappingURL=crypto.d.cts.map

package/dist/modules/auth/server/crypto.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.cts","names":[],"sources":["../../../../src/modules/auth/server/crypto.ts"],"mappings":";wBAIsB,qBAAqB,gBAAgB"}

package/dist/modules/auth/server/crypto.d.ts

@@ -0,0 +1,3 @@
+/** Hash cache keys; never store bearer credentials as Map keys. */
+export declare function fingerprintAuthValue(value: string): Promise<string>;
+//# sourceMappingURL=crypto.d.ts.map

package/dist/modules/auth/server/crypto.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.d.ts","names":[],"sources":["../../../../src/modules/auth/server/crypto.ts"],"mappings":";wBAIsB,qBAAqB,gBAAgB"}

package/dist/modules/auth/server/crypto.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{base64url as t}from"jose";async function n(n){try{return t.encode(new Uint8Array(await crypto.subtle.digest(`SHA-256`,new TextEncoder().encode(n))))}catch{throw new e(`unavailable`)}}export{n as fingerprintAuthValue};
+//# sourceMappingURL=crypto.js.map

package/dist/modules/auth/server/crypto.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"crypto.js","names":["fingerprintAuthValue","base64url","value","AuthError"],"sources":["../../../../src/modules/auth/server/crypto.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { base64url } from \"jose\";\n\n/** Hash cache keys; never store bearer credentials as Map keys. */\nexport async function fingerprintAuthValue(value: string): Promise<string> {\n  try {\n    return base64url.encode(\n      new Uint8Array(\n        await crypto.subtle.digest(\"SHA-256\", new TextEncoder().encode(value)),\n      ),\n    );\n  } catch {\n    throw new AuthError(\"unavailable\");\n  }\n}\n"],"mappings":"A,6EAIA,eAAsBA,EAAqB,EAAgC,CACzE,GAAI,CACF,OAAOC,EAAU,OACf,IAAI,WACF,MAAM,OAAO,OAAO,OAAO,UAAW,IAAI,YAAY,CAAC,CAAC,OAAOC,CAAK,CAAC,CACvE,CACF,CACF,MAAQ,CACN,MAAM,IAAIC,EAAU,aAAa,CACnC,CACF,C"}

package/dist/modules/auth/server/grant-guard.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e.AuthError(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=t;

package/dist/modules/auth/server/grant-guard.d.cts

@@ -0,0 +1,6 @@
+import { I as SessionGrantGuardOptions, d as AuthSessionBinding } from "../../../interface-BR9QNgXO.cjs";
+/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */
+export declare function createSessionGrantGuard(options: SessionGrantGuardOptions): {
+  run<Value>(operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>, signal?: AbortSignal): Promise<Value>;
+};
+//# sourceMappingURL=grant-guard.d.cts.map

package/dist/modules/auth/server/grant-guard.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.d.ts

@@ -0,0 +1,6 @@
+import { I as SessionGrantGuardOptions, d as AuthSessionBinding } from "../../../interface-ii8DV63k.js";
+/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */
+export declare function createSessionGrantGuard(options: SessionGrantGuardOptions): {
+  run<Value>(operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>, signal?: AbortSignal): Promise<Value>;
+};
+//# sourceMappingURL=grant-guard.d.ts.map

package/dist/modules/auth/server/grant-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{t as createSessionGrantGuard};
+//# sourceMappingURL=grant-guard.js.map

package/dist/modules/auth/server/grant-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type {\n  AuthSessionBinding,\n  SessionGrantGuardOptions,\n} from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" ||\n          !identifier ||\n          identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" ||\n          !value.sid ||\n          value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        if (\n          before.id !== after.id ||\n          before.userId !== after.userId ||\n          before.subject !== after.subject ||\n          before.sid !== after.sid\n        )\n          throw new AuthError(\"rejected\");\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAOA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UACtB,CAACA,GACDA,EAAW,OAAS,GACxB,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UACpB,CAACA,EAAM,KACPA,EAAM,IAAI,OAAS,MACvB,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EACzB,GACEO,EAAO,KAAOG,EAAM,IACpBH,EAAO,SAAWG,EAAM,QACxBH,EAAO,UAAYG,EAAM,SACzBH,EAAO,MAAQG,EAAM,IAErB,MAAM,IAAIP,EAAU,UAAU,EAEhC,OADAG,GAAQ,eAAe,EAChBE,CACT,OAASG,EAAO,CAGd,MAFIL,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDQ,aAAiBR,EAAiBQ,EAChC,IAAIR,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/identity-cache.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../client/retry.cjs"),t=require("../interface.cjs"),n=require("./crypto.cjs");function r(r){let i=r.now??Date.now,a=r.maxAgeMs??12e4,o=r.capacity??512,s=r.maxPending??o,c=r.key??n.fingerprintAuthValue;if(![a,o,s].every(Number.isSafeInteger)||a<0||o<1||s<1)throw new t.AuthError(`invalid_configuration`);let l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=/* @__PURE__ */ new Set,f=0;async function p(n,p={}){if(p.signal?.throwIfAborted(),!n||n.length>32768)throw new t.AuthError(`rejected`);let m=f,h=/* @__PURE__ */ new Set;d.add(h);let g;try{g=await c(n)}catch{throw new t.AuthError(`unavailable`)}finally{d.delete(h)}if(p.signal?.throwIfAborted(),m!==f||h.has(g))throw new t.AuthError(`rejected`);if(!g||g.length>2048)throw new t.AuthError(`invalid_configuration`);let _=u.get(g);if(_)return await e.waitForAuthOperation(_.promise,p.signal);let v=l.get(g);if(!p.fresh&&v&&v.expiresAt>i())return v.value;if(l.delete(g),u.size>=s)throw new t.AuthError(`unavailable`);let y=i(),b=Symbol(),x=(async()=>{await Promise.resolve();try{let e=await r.load(n);if(m!==f||u.get(g)?.marker!==b)throw new t.AuthError(`rejected`);let s=i();for(let[e,t]of l)t.expiresAt<=s&&l.delete(e);return y+a>s&&(l.size>=o&&l.delete(l.keys().next().value),l.set(g,{value:e,expiresAt:y+a})),e}catch(e){throw e instanceof t.AuthError?e:new t.AuthError(`unavailable`)}finally{u.get(g)?.marker===b&&u.delete(g)}})();return u.set(g,{promise:x,marker:b}),await e.waitForAuthOperation(x,p.signal)}return{get:p,async forget(e){try{let t=await c(e);for(let e of d)e.add(t);l.delete(t),u.delete(t)}catch{throw new t.AuthError(`unavailable`)}},clear(){f++,l.clear(),u.clear()}}}exports.createIdentityCache=r;

package/dist/modules/auth/server/identity-cache.d.cts

@@ -0,0 +1,8 @@
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-BR9QNgXO.cjs";
+/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */
+export declare function createIdentityCache<Value>(options: IdentityCacheOptions<Value>): {
+  get: (credential: string, input?: IdentityCacheInput) => Promise<Value>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=identity-cache.d.cts.map

package/dist/modules/auth/server/identity-cache.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.d.cts","names":[],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"mappings":";;wBASgB,oBAAoB,OAClC,SAAS,qBAAqB;EAwBhB,MAAA,oBAAM,QACX,uBACN,QAAQ;EAwDgB,OAAA,qBAAM"}

package/dist/modules/auth/server/identity-cache.d.ts

@@ -0,0 +1,8 @@
+import { D as IdentityCacheInput, O as IdentityCacheOptions } from "../../../interface-ii8DV63k.js";
+/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */
+export declare function createIdentityCache<Value>(options: IdentityCacheOptions<Value>): {
+  get: (credential: string, input?: IdentityCacheInput) => Promise<Value>;
+  forget(credential: string): Promise<void>;
+  clear(): void;
+};
+//# sourceMappingURL=identity-cache.d.ts.map

package/dist/modules/auth/server/identity-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.d.ts","names":[],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"mappings":";;wBASgB,oBAAoB,OAClC,SAAS,qBAAqB;EAwBhB,MAAA,oBAAM,QACX,uBACN,QAAQ;EAwDgB,OAAA,qBAAM"}

package/dist/modules/auth/server/identity-cache.js

@@ -0,0 +1,2 @@
+import{waitForAuthOperation as e}from"../client/retry.js";import{AuthError as t}from"../interface.js";import{fingerprintAuthValue as n}from"./crypto.js";function r(r){let i=r.now??Date.now,a=r.maxAgeMs??12e4,o=r.capacity??512,s=r.maxPending??o,c=r.key??n;if(![a,o,s].every(Number.isSafeInteger)||a<0||o<1||s<1)throw new t(`invalid_configuration`);let l=/* @__PURE__ */ new Map,u=/* @__PURE__ */ new Map,d=/* @__PURE__ */ new Set,f=0;async function p(n,p={}){if(p.signal?.throwIfAborted(),!n||n.length>32768)throw new t(`rejected`);let m=f,h=/* @__PURE__ */ new Set;d.add(h);let g;try{g=await c(n)}catch{throw new t(`unavailable`)}finally{d.delete(h)}if(p.signal?.throwIfAborted(),m!==f||h.has(g))throw new t(`rejected`);if(!g||g.length>2048)throw new t(`invalid_configuration`);let _=u.get(g);if(_)return await e(_.promise,p.signal);let v=l.get(g);if(!p.fresh&&v&&v.expiresAt>i())return v.value;if(l.delete(g),u.size>=s)throw new t(`unavailable`);let y=i(),b=Symbol(),x=(async()=>{await Promise.resolve();try{let e=await r.load(n);if(m!==f||u.get(g)?.marker!==b)throw new t(`rejected`);let s=i();for(let[e,t]of l)t.expiresAt<=s&&l.delete(e);return y+a>s&&(l.size>=o&&l.delete(l.keys().next().value),l.set(g,{value:e,expiresAt:y+a})),e}catch(e){throw e instanceof t?e:new t(`unavailable`)}finally{u.get(g)?.marker===b&&u.delete(g)}})();return u.set(g,{promise:x,marker:b}),await e(x,p.signal)}return{get:p,async forget(e){try{let t=await c(e);for(let e of d)e.add(t);l.delete(t),u.delete(t)}catch{throw new t(`unavailable`)}},clear(){f++,l.clear(),u.clear()}}}export{r as createIdentityCache};
+//# sourceMappingURL=identity-cache.js.map

package/dist/modules/auth/server/identity-cache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-cache.js","names":["createIdentityCache","now","options","ttl","capacity","maxPending","fingerprint","fingerprintAuthValue","AuthError","cache","flights","derivations","generation","get","input","credential","version","invalidated","key","pending","waitForAuthOperation","cached","startedAt","marker","operation","value","time","previous","entry","error"],"sources":["../../../../src/modules/auth/server/identity-cache.ts"],"sourcesContent":["import { waitForAuthOperation } from \"@/modules/auth/client/retry\";\nimport { AuthError } from \"@/modules/auth/interface\";\nimport { fingerprintAuthValue } from \"@/modules/auth/server/crypto\";\nimport type {\n  IdentityCacheInput,\n  IdentityCacheOptions,\n} from \"@/utils/interface\";\n\n/** Identity freshness only. Each API still checks token/scopes, revocation and ACL. */\nexport function createIdentityCache<Value>(\n  options: IdentityCacheOptions<Value>,\n) {\n  const now = options.now ?? Date.now;\n  const ttl = options.maxAgeMs ?? 120_000;\n  const capacity = options.capacity ?? 512;\n  const maxPending = options.maxPending ?? capacity;\n  const fingerprint = options.key ?? fingerprintAuthValue;\n  if (\n    ![ttl, capacity, maxPending].every(Number.isSafeInteger) ||\n    ttl < 0 ||\n    capacity < 1 ||\n    maxPending < 1\n  )\n    throw new AuthError(\"invalid_configuration\");\n  const cache = new Map<string, { value: Value; expiresAt: number }>();\n  const flights = new Map<\n    string,\n    { promise: Promise<Value>; marker: symbol }\n  >();\n  // Pending key derivation must also observe per-credential invalidation.\n  const derivations = new Set<Set<string>>();\n  let generation = 0;\n\n  async function get(\n    credential: string,\n    input: IdentityCacheInput = {},\n  ): Promise<Value> {\n    input.signal?.throwIfAborted();\n    if (!credential || credential.length > 32768)\n      throw new AuthError(\"rejected\");\n    const version = generation;\n    const invalidated = new Set<string>();\n    derivations.add(invalidated);\n    let key: string;\n    try {\n      key = await fingerprint(credential);\n    } catch {\n      throw new AuthError(\"unavailable\");\n    } finally {\n      derivations.delete(invalidated);\n    }\n    input.signal?.throwIfAborted();\n    if (version !== generation || invalidated.has(key))\n      throw new AuthError(\"rejected\");\n    if (!key || key.length > 2048) throw new AuthError(\"invalid_configuration\");\n    const pending = flights.get(key);\n    if (pending)\n      return await waitForAuthOperation(pending.promise, input.signal);\n    const cached = cache.get(key);\n    if (!input.fresh && cached && cached.expiresAt > now()) return cached.value;\n    cache.delete(key);\n    if (flights.size >= maxPending) throw new AuthError(\"unavailable\");\n    const startedAt = now();\n    const marker = Symbol();\n    const operation = (async () => {\n      await Promise.resolve(); // Register before a throwing/reentrant adapter.\n      try {\n        const value = await options.load(credential);\n        if (version !== generation || flights.get(key)?.marker !== marker)\n          throw new AuthError(\"rejected\");\n        const time = now();\n        for (const [previous, entry] of cache)\n          if (entry.expiresAt <= time) cache.delete(previous);\n        // TTL starts before networking; never cache an already stale response.\n        if (startedAt + ttl > time) {\n          if (cache.size >= capacity) cache.delete(cache.keys().next().value!);\n          cache.set(key, { value, expiresAt: startedAt + ttl });\n        }\n        return value;\n      } catch (error) {\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      } finally {\n        if (flights.get(key)?.marker === marker) flights.delete(key);\n      }\n    })();\n    flights.set(key, { promise: operation, marker });\n    return await waitForAuthOperation(operation, input.signal);\n  }\n\n  return {\n    get,\n    async forget(credential: string) {\n      try {\n        const key = await fingerprint(credential);\n        for (const pending of derivations) pending.add(key);\n        cache.delete(key);\n        flights.delete(key); // Fence success/error from an earlier load.\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n    clear() {\n      generation++;\n      cache.clear();\n      flights.clear();\n    },\n  };\n}\n"],"mappings":"A,yJASA,SAAgBA,EACd,EACA,CACA,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAC1BC,EAAMD,EAAQ,UAAY,KAC1BE,EAAWF,EAAQ,UAAY,IAC/BG,EAAaH,EAAQ,YAAcE,EACnCE,EAAcJ,EAAQ,KAAOK,EACnC,GACE,CAAC,CAACJ,EAAKC,EAAUC,CAAU,CAAC,CAAC,MAAM,OAAO,aAAa,GACvDF,EAAM,GACNC,EAAW,GACXC,EAAa,EAEb,MAAM,IAAIG,EAAU,uBAAuB,EAC7C,IAAMC,kBAAQ,IAAI,IACZC,kBAAU,IAAI,IAKdC,kBAAc,IAAI,IACpBC,EAAa,EAEjB,eAAeC,EACb,EACA,EAA4B,CAAC,EACb,CAEhB,GADAC,EAAM,QAAQ,eAAe,EACzB,CAACC,GAAcA,EAAW,OAAS,MACrC,MAAM,IAAIP,EAAU,UAAU,EAChC,IAAMQ,EAAUJ,EACVK,kBAAc,IAAI,IACxBN,EAAY,IAAIM,CAAW,EAC3B,IAAIC,EACJ,GAAI,CACF,EAAM,MAAMZ,EAAYS,CAAU,CACpC,MAAQ,CACN,MAAM,IAAIP,EAAU,aAAa,CACnC,QAAU,CACRG,EAAY,OAAOM,CAAW,CAChC,CAEA,GADAH,EAAM,QAAQ,eAAe,EACzBE,IAAYJ,GAAcK,EAAY,IAAIC,CAAG,EAC/C,MAAM,IAAIV,EAAU,UAAU,EAChC,GAAI,CAACU,GAAOA,EAAI,OAAS,KAAM,MAAM,IAAIV,EAAU,uBAAuB,EAC1E,IAAMW,EAAUT,EAAQ,IAAIQ,CAAG,EAC/B,GAAIC,EACF,OAAO,MAAMC,EAAqBD,EAAQ,QAASL,EAAM,MAAM,EACjE,IAAMO,EAASZ,EAAM,IAAIS,CAAG,EAC5B,GAAI,CAACJ,EAAM,OAASO,GAAUA,EAAO,UAAYpB,EAAI,EAAG,OAAOoB,EAAO,MAEtE,GADAZ,EAAM,OAAOS,CAAG,EACZR,EAAQ,MAAQL,EAAY,MAAM,IAAIG,EAAU,aAAa,EACjE,IAAMc,EAAYrB,EAAI,EAChBsB,EAAS,OAAO,EAChBC,GAAa,SAAY,CAC7B,MAAM,QAAQ,QAAQ,EACtB,GAAI,CACF,IAAMC,EAAQ,MAAMvB,EAAQ,KAAKa,CAAU,EAC3C,GAAIC,IAAYJ,GAAcF,EAAQ,IAAIQ,CAAG,CAAC,EAAE,SAAWK,EACzD,MAAM,IAAIf,EAAU,UAAU,EAChC,IAAMkB,EAAOzB,EAAI,EACjB,IAAK,GAAM,CAAC0B,EAAUC,KAAUnB,EAC1BmB,EAAM,WAAaF,GAAMjB,EAAM,OAAOkB,CAAQ,EAMpD,OAJIL,EAAYnB,EAAMuB,IAChBjB,EAAM,MAAQL,GAAUK,EAAM,OAAOA,EAAM,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAM,EACnEA,EAAM,IAAIS,EAAK,CAAE,QAAO,UAAWI,EAAYnB,CAAI,CAAC,GAE/CsB,CACT,OAASI,EAAO,CAEd,MADIA,aAAiBrB,EAAiBqB,EAChC,IAAIrB,EAAU,aAAa,CACnC,QAAU,CACJE,EAAQ,IAAIQ,CAAG,CAAC,EAAE,SAAWK,GAAQb,EAAQ,OAAOQ,CAAG,CAC7D,CACF,EAAA,CAAG,EAEH,OADAR,EAAQ,IAAIQ,EAAK,CAAE,QAASM,EAAW,QAAO,CAAC,EACxC,MAAMJ,EAAqBI,EAAWV,EAAM,MAAM,CAC3D,CAEA,MAAO,CACL,MACA,MAAM,OAAO,EAAoB,CAC/B,GAAI,CACF,IAAMI,EAAM,MAAMZ,EAAYS,CAAU,EACxC,IAAK,IAAMI,KAAWR,EAAaQ,EAAQ,IAAID,CAAG,EAClDT,EAAM,OAAOS,CAAG,EAChBR,EAAQ,OAAOQ,CAAG,CACpB,MAAQ,CACN,MAAM,IAAIV,EAAU,aAAa,CACnC,CACF,EACA,OAAQ,CACN,IACAC,EAAM,MAAM,EACZC,EAAQ,MAAM,CAChB,CACF,CACF,C"}

package/dist/modules/auth/server/identity.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){if(!t.providerId)throw new e.AuthError(`invalid_configuration`);return async({user:e,source:n})=>{try{let r=n.oauth?.profile;if(n.method!==`oauth`||n.oauth?.providerId!==t.providerId||typeof r?.sub!=`string`||!r.sub||r.sub.length>255||r.sub!==t.subject(e))return{error:`invalid_identity_source`};if(t.allowed&&!await t.allowed(r))return{error:`account_unavailable`}}catch{return{error:`account_unavailable`}}}}exports.createOAuthIdentityValidator=t;

package/dist/modules/auth/server/identity.d.cts

@@ -0,0 +1,5 @@
+import { M as OAuthIdentityValidatorOptions } from "../../../interface-BR9QNgXO.cjs";
+import { BetterAuthOptions } from "better-auth";
+/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */
+export declare function createOAuthIdentityValidator(options: OAuthIdentityValidatorOptions): NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+//# sourceMappingURL=identity.d.cts.map

package/dist/modules/auth/server/identity.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.cts","names":[],"sources":["../../../../src/modules/auth/server/identity.ts"],"mappings":";;;wBAKgB,6BACd,SAAS,gCACR,YAAY,YAAY"}

package/dist/modules/auth/server/identity.d.ts

@@ -0,0 +1,5 @@
+import { M as OAuthIdentityValidatorOptions } from "../../../interface-ii8DV63k.js";
+import { BetterAuthOptions } from "better-auth";
+/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */
+export declare function createOAuthIdentityValidator(options: OAuthIdentityValidatorOptions): NonNullable<NonNullable<BetterAuthOptions["user"]>["validateUserInfo"]>;
+//# sourceMappingURL=identity.d.ts.map

package/dist/modules/auth/server/identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.d.ts","names":[],"sources":["../../../../src/modules/auth/server/identity.ts"],"mappings":";;;wBAKgB,6BACd,SAAS,gCACR,YAAY,YAAY"}

package/dist/modules/auth/server/identity.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t){if(!t.providerId)throw new e(`invalid_configuration`);return async({user:e,source:n})=>{try{let r=n.oauth?.profile;if(n.method!==`oauth`||n.oauth?.providerId!==t.providerId||typeof r?.sub!=`string`||!r.sub||r.sub.length>255||r.sub!==t.subject(e))return{error:`invalid_identity_source`};if(t.allowed&&!await t.allowed(r))return{error:`account_unavailable`}}catch{return{error:`account_unavailable`}}}}export{t as createOAuthIdentityValidator};
+//# sourceMappingURL=identity.js.map

package/dist/modules/auth/server/identity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity.js","names":["createOAuthIdentityValidator","options","AuthError","profile","source","user"],"sources":["../../../../src/modules/auth/server/identity.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { OAuthIdentityValidatorOptions } from \"@/utils/interface\";\nimport type { BetterAuthOptions } from \"better-auth\";\n\n/** Fits native user.validateUserInfo; the SDK verifies the OAuth response first. */\nexport function createOAuthIdentityValidator(\n  options: OAuthIdentityValidatorOptions,\n): NonNullable<NonNullable<BetterAuthOptions[\"user\"]>[\"validateUserInfo\"]> {\n  if (!options.providerId) throw new AuthError(\"invalid_configuration\");\n  return async ({ user, source }) => {\n    try {\n      const profile = source.oauth?.profile;\n      if (\n        source.method !== \"oauth\" ||\n        source.oauth?.providerId !== options.providerId ||\n        typeof profile?.sub !== \"string\" ||\n        !profile.sub ||\n        profile.sub.length > 255 ||\n        profile.sub !== options.subject(user)\n      )\n        return { error: \"invalid_identity_source\" };\n      if (options.allowed && !(await options.allowed(profile)))\n        return { error: \"account_unavailable\" };\n    } catch {\n      return { error: \"account_unavailable\" };\n    }\n  };\n}\n"],"mappings":"A,4CAKA,SAAgBA,EACd,EACyE,CACzE,GAAI,CAACC,EAAQ,WAAY,MAAM,IAAIC,EAAU,uBAAuB,EACpE,OAAO,MAAO,CAAE,OAAM,YAAa,CACjC,GAAI,CACF,IAAMC,EAAUC,EAAO,OAAO,QAC9B,GACEA,EAAO,SAAW,SAClBA,EAAO,OAAO,aAAeH,EAAQ,YACrC,OAAOE,GAAS,KAAQ,UACxB,CAACA,EAAQ,KACTA,EAAQ,IAAI,OAAS,KACrBA,EAAQ,MAAQF,EAAQ,QAAQI,CAAI,EAEpC,MAAO,CAAE,MAAO,yBAA0B,EAC5C,GAAIJ,EAAQ,SAAW,CAAE,MAAMA,EAAQ,QAAQE,CAAO,EACpD,MAAO,CAAE,MAAO,qBAAsB,CAC1C,MAAQ,CACN,MAAO,CAAE,MAAO,qBAAsB,CACxC,CACF,CACF,C"}

package/dist/modules/auth/server/index.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs");exports.AuthError=e.AuthError,exports.assertMutationOrigin=t.assertMutationOrigin,exports.authCookieOptions=t.authCookieOptions,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.resolveReturnPath=t.resolveReturnPath;

package/dist/modules/auth/server/index.d.cts

@@ -0,0 +1,12 @@
+import { AuthError } from "../interface.cjs";
+import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.cjs";
+import { fingerprintAuthValue } from "./crypto.cjs";
+import { createLogoutVerifier } from "./logout.cjs";
+import { createProofReplayStore } from "./proof.cjs";
+import { createResourceAuth } from "./resource.cjs";
+import { createIdentityCache } from "./identity-cache.cjs";
+import { createOAuthIdentityValidator } from "./identity.cjs";
+import { createSessionGrantGuard } from "./grant-guard.cjs";
+import { matchesAuthRevocation } from "./revocation.cjs";
+import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-BR9QNgXO.cjs";
+export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };

package/dist/modules/auth/server/index.d.ts

@@ -0,0 +1,12 @@
+import { AuthError } from "../interface.js";
+import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.js";
+import { fingerprintAuthValue } from "./crypto.js";
+import { createLogoutVerifier } from "./logout.js";
+import { createProofReplayStore } from "./proof.js";
+import { createResourceAuth } from "./resource.js";
+import { createIdentityCache } from "./identity-cache.js";
+import { createOAuthIdentityValidator } from "./identity.js";
+import { createSessionGrantGuard } from "./grant-guard.js";
+import { matchesAuthRevocation } from "./revocation.js";
+import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
+export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };

package/dist/modules/auth/server/index.js

@@ -0,0 +1 @@
+import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createProofReplayStore as c}from"./proof.js";import{createResourceAuth as l}from"./resource.js";import{createIdentityCache as u}from"./identity-cache.js";import{createOAuthIdentityValidator as d}from"./identity.js";import{createSessionGrantGuard as f}from"./grant-guard.js";import{matchesAuthRevocation as p}from"./revocation.js";export{e as AuthError,t as assertMutationOrigin,n as authCookieOptions,r as createAuthFreshnessPolicy,i as createAuthPolicy,u as createIdentityCache,s as createLogoutVerifier,d as createOAuthIdentityValidator,c as createProofReplayStore,l as createResourceAuth,f as createSessionGrantGuard,o as fingerprintAuthValue,p as matchesAuthRevocation,a as resolveReturnPath};

package/dist/modules/auth/server/interface.d.cts

@@ -0,0 +1,3 @@
+import { N as ProofStorage, U as VerifiedLogout, k as LogoutStorage } from "../../../interface-BR9QNgXO.cjs";
+import "../../../interface-weqBVeUf.cjs";
+export type { LogoutStorage, ProofStorage, VerifiedLogout };

package/dist/modules/auth/server/interface.d.ts

@@ -0,0 +1,3 @@
+import { N as ProofStorage, U as VerifiedLogout, k as LogoutStorage } from "../../../interface-ii8DV63k.js";
+import "../../../interface-BFsLlmGy.js";
+export type { LogoutStorage, ProofStorage, VerifiedLogout };

package/dist/modules/auth/server/interface.js

@@ -0,0 +1 @@
+export{};

package/dist/modules/auth/server/logout.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs");let n=require("jose");function r(r){let i=t.createAuthPolicy(r.policy),a=r.now??Date.now,o=r.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!r.issuer||!r.clientId||!o.length||o.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e.AuthError(`invalid_configuration`);async function s(t){if(!t||t.length>32768)throw new e.AuthError(`rejected`);let s;try{s=await r.getVerificationKey()}catch{throw new e.AuthError(`unavailable`)}try{let{payload:c}=await(0,n.jwtVerify)(t,s,{issuer:r.issuer,audience:r.clientId,algorithms:[...o],typ:`logout+jwt`,requiredClaims:[`iss`,`aud`,`iat`,`exp`,`jti`,`events`],maxTokenAge:i.logoutMaxAgeSeconds,clockTolerance:i.clockToleranceSeconds,currentDate:new Date(a())}),l=c.events,u=l&&typeof l==`object`&&!Array.isArray(l)?l[`http://schemas.openid.net/event/backchannel-logout`]:void 0,d=e=>typeof e==`string`&&e.length>0&&e.length<=255;if(c.nonce!==void 0||!d(c.jti)||!d(c.sub)&&!d(c.sid)||c.sub!==void 0&&!d(c.sub)||c.sid!==void 0&&!d(c.sid)||r.requireSid&&!d(c.sid)||!u||typeof u!=`object`||Array.isArray(u)||Object.keys(u).length!==0||c.exp<=c.iat||c.exp-c.iat>i.logoutMaxAgeSeconds)throw new e.AuthError(`rejected`);return{jti:c.jti,subject:c.sub,sid:c.sid,issuedAt:c.iat*1e3,receiptExpiresAt:(c.exp+i.clockToleranceSeconds)*1e3,revokeUntil:a()+i.revocationRetentionMs}}catch{throw new e.AuthError(`rejected`)}}async function c(t){let n=await s(t);try{return{applied:await r.storage.apply(n)}}catch{throw new e.AuthError(`unavailable`)}}return{verify:s,handle:c}}exports.createLogoutVerifier=r;

package/dist/modules/auth/server/logout.d.cts

@@ -0,0 +1,10 @@
+import "../../../interface-weqBVeUf.cjs";
+import { A as LogoutVerifierOptions, U as VerifiedLogout } from "../../../interface-BR9QNgXO.cjs";
+export declare function createLogoutVerifier(options: LogoutVerifierOptions): {
+  verify: (token: string) => Promise<VerifiedLogout>;
+  handle: (token: string) => Promise<{
+    applied: boolean;
+  }>;
+};
+export type { LogoutVerifierOptions };
+//# sourceMappingURL=logout.d.cts.map

package/dist/modules/auth/server/logout.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.cts","names":[],"sources":["../../../../src/modules/auth/server/logout.ts"],"mappings":";;wBAMgB,qBAAqB,SAAS;EAcf,SAAA,kBAAS,QAAQ;EAwDjB,SAAA,kBAAM"}

package/dist/modules/auth/server/logout.d.ts

@@ -0,0 +1,10 @@
+import "../../../interface-BFsLlmGy.js";
+import { A as LogoutVerifierOptions, U as VerifiedLogout } from "../../../interface-ii8DV63k.js";
+export declare function createLogoutVerifier(options: LogoutVerifierOptions): {
+  verify: (token: string) => Promise<VerifiedLogout>;
+  handle: (token: string) => Promise<{
+    applied: boolean;
+  }>;
+};
+export type { LogoutVerifierOptions };
+//# sourceMappingURL=logout.d.ts.map

package/dist/modules/auth/server/logout.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.d.ts","names":[],"sources":["../../../../src/modules/auth/server/logout.ts"],"mappings":";;wBAMgB,qBAAqB,SAAS;EAcf,SAAA,kBAAS,QAAQ;EAwDjB,SAAA,kBAAM"}

package/dist/modules/auth/server/logout.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{createAuthPolicy as t}from"../policy.js";import{jwtVerify as n}from"jose";function r(r){let i=t(r.policy),a=r.now??Date.now,o=r.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!r.issuer||!r.clientId||!o.length||o.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e(`invalid_configuration`);async function s(t){if(!t||t.length>32768)throw new e(`rejected`);let s;try{s=await r.getVerificationKey()}catch{throw new e(`unavailable`)}try{let{payload:c}=await n(t,s,{issuer:r.issuer,audience:r.clientId,algorithms:[...o],typ:`logout+jwt`,requiredClaims:[`iss`,`aud`,`iat`,`exp`,`jti`,`events`],maxTokenAge:i.logoutMaxAgeSeconds,clockTolerance:i.clockToleranceSeconds,currentDate:new Date(a())}),l=c.events,u=l&&typeof l==`object`&&!Array.isArray(l)?l[`http://schemas.openid.net/event/backchannel-logout`]:void 0,d=e=>typeof e==`string`&&e.length>0&&e.length<=255;if(c.nonce!==void 0||!d(c.jti)||!d(c.sub)&&!d(c.sid)||c.sub!==void 0&&!d(c.sub)||c.sid!==void 0&&!d(c.sid)||r.requireSid&&!d(c.sid)||!u||typeof u!=`object`||Array.isArray(u)||Object.keys(u).length!==0||c.exp<=c.iat||c.exp-c.iat>i.logoutMaxAgeSeconds)throw new e(`rejected`);return{jti:c.jti,subject:c.sub,sid:c.sid,issuedAt:c.iat*1e3,receiptExpiresAt:(c.exp+i.clockToleranceSeconds)*1e3,revokeUntil:a()+i.revocationRetentionMs}}catch{throw new e(`rejected`)}}async function c(t){let n=await s(t);try{return{applied:await r.storage.apply(n)}}catch{throw new e(`unavailable`)}}return{verify:s,handle:c}}export{r as createLogoutVerifier};
+//# sourceMappingURL=logout.js.map

package/dist/modules/auth/server/logout.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logout.js","names":["createLogoutVerifier","policy","createAuthPolicy","options","now","algorithms","algorithm","AuthError","verify","token","key","jwtVerify","events","payload","event","identifier","value","handle","logout"],"sources":["../../../../src/modules/auth/server/logout.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { createAuthPolicy } from \"@/modules/auth/policy\";\nimport type { VerifiedLogout } from \"@/modules/auth/server/interface\";\nimport type { LogoutVerifierOptions } from \"@/utils/interface\";\nimport { jwtVerify, type JWTVerifyGetKey } from \"jose\";\n\nexport function createLogoutVerifier(options: LogoutVerifierOptions) {\n  const policy = createAuthPolicy(options.policy);\n  const now = options.now ?? Date.now;\n  const algorithms = options.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"];\n  if (\n    !options.issuer ||\n    !options.clientId ||\n    !algorithms.length ||\n    algorithms.some(\n      (algorithm) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(algorithm),\n    )\n  )\n    throw new AuthError(\"invalid_configuration\");\n\n  async function verify(token: string): Promise<VerifiedLogout> {\n    if (!token || token.length > 32_768) throw new AuthError(\"rejected\");\n    let key: JWTVerifyGetKey;\n    try {\n      key = await options.getVerificationKey();\n    } catch {\n      throw new AuthError(\"unavailable\");\n    }\n    try {\n      const { payload } = await jwtVerify(token, key, {\n        issuer: options.issuer,\n        audience: options.clientId,\n        algorithms: [...algorithms],\n        typ: \"logout+jwt\",\n        requiredClaims: [\"iss\", \"aud\", \"iat\", \"exp\", \"jti\", \"events\"],\n        maxTokenAge: policy.logoutMaxAgeSeconds,\n        clockTolerance: policy.clockToleranceSeconds,\n        currentDate: new Date(now()),\n      });\n      const events = payload.events;\n      const event =\n        events && typeof events === \"object\" && !Array.isArray(events)\n          ? (events as Record<string, unknown>)[\n              \"http://schemas.openid.net/event/backchannel-logout\"\n            ]\n          : undefined;\n      const identifier = (value: unknown) =>\n        typeof value === \"string\" && value.length > 0 && value.length <= 255;\n      if (\n        payload.nonce !== undefined ||\n        !identifier(payload.jti) ||\n        (!identifier(payload.sub) && !identifier(payload.sid)) ||\n        (payload.sub !== undefined && !identifier(payload.sub)) ||\n        (payload.sid !== undefined && !identifier(payload.sid)) ||\n        (options.requireSid && !identifier(payload.sid)) ||\n        !event ||\n        typeof event !== \"object\" ||\n        Array.isArray(event) ||\n        Object.keys(event).length !== 0 ||\n        payload.exp! <= payload.iat! ||\n        payload.exp! - payload.iat! > policy.logoutMaxAgeSeconds\n      )\n        throw new AuthError(\"rejected\");\n      return {\n        jti: payload.jti!,\n        subject: payload.sub,\n        sid: payload.sid as string | undefined,\n        issuedAt: payload.iat! * 1000,\n        receiptExpiresAt: (payload.exp! + policy.clockToleranceSeconds) * 1000,\n        revokeUntil: now() + policy.revocationRetentionMs,\n      };\n    } catch {\n      throw new AuthError(\"rejected\");\n    }\n  }\n\n  async function handle(token: string) {\n    const logout = await verify(token);\n    // Verification never consumes the receipt on its own. The adapter commits the\n    // receipt + revocation + session invalidation together, or rolls them all back.\n    try {\n      return { applied: await options.storage.apply(logout) };\n    } catch {\n      throw new AuthError(\"unavailable\");\n    }\n  }\n  return { verify, handle };\n}\n\nexport type { LogoutVerifierOptions } from \"@/utils/interface\";\n"],"mappings":"A,6HAMA,SAAgBA,EAAqB,EAAgC,CACnE,IAAMC,EAASC,EAAiBC,EAAQ,MAAM,EACxCC,EAAMD,EAAQ,KAAO,KAAK,IAC1BE,EAAaF,EAAQ,YAAc,CAAC,QAAS,QAAS,OAAO,EACnE,GACE,CAACA,EAAQ,QACT,CAACA,EAAQ,UACT,CAACE,EAAW,QACZA,EAAW,KACR,GAAc,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAS,CAChE,EAEA,MAAM,IAAIC,EAAU,uBAAuB,EAE7C,eAAeC,EAAO,EAAwC,CAC5D,GAAI,CAACC,GAASA,EAAM,OAAS,MAAQ,MAAM,IAAIF,EAAU,UAAU,EACnE,IAAIG,EACJ,GAAI,CACF,EAAM,MAAMP,EAAQ,mBAAmB,CACzC,MAAQ,CACN,MAAM,IAAII,EAAU,aAAa,CACnC,CACA,GAAI,CACF,GAAM,CAAE,WAAY,MAAMI,EAAUF,EAAOC,EAAK,CAC9C,OAAQP,EAAQ,OAChB,SAAUA,EAAQ,SAClB,WAAY,CAAC,GAAGE,CAAU,EAC1B,IAAK,aACL,eAAgB,CAAC,MAAO,MAAO,MAAO,MAAO,MAAO,QAAQ,EAC5D,YAAaJ,EAAO,oBACpB,eAAgBA,EAAO,sBACvB,YAAa,IAAI,KAAKG,EAAI,CAAC,CAC7B,CAAC,EACKQ,EAASC,EAAQ,OACjBC,EACJF,GAAU,OAAOA,GAAW,UAAY,CAAC,MAAM,QAAQA,CAAM,EACxDA,EACC,sDAEF,IAAA,GACAG,EAAc,GAClB,OAAOC,GAAU,UAAYA,EAAM,OAAS,GAAKA,EAAM,QAAU,IACnE,GACEH,EAAQ,QAAU,IAAA,IAClB,CAACE,EAAWF,EAAQ,GAAG,GACtB,CAACE,EAAWF,EAAQ,GAAG,GAAK,CAACE,EAAWF,EAAQ,GAAG,GACnDA,EAAQ,MAAQ,IAAA,IAAa,CAACE,EAAWF,EAAQ,GAAG,GACpDA,EAAQ,MAAQ,IAAA,IAAa,CAACE,EAAWF,EAAQ,GAAG,GACpDV,EAAQ,YAAc,CAACY,EAAWF,EAAQ,GAAG,GAC9C,CAACC,GACD,OAAOA,GAAU,UACjB,MAAM,QAAQA,CAAK,GACnB,OAAO,KAAKA,CAAK,CAAC,CAAC,SAAW,GAC9BD,EAAQ,KAAQA,EAAQ,KACxBA,EAAQ,IAAOA,EAAQ,IAAOZ,EAAO,oBAErC,MAAM,IAAIM,EAAU,UAAU,EAChC,MAAO,CACL,IAAKM,EAAQ,IACb,QAASA,EAAQ,IACjB,IAAKA,EAAQ,IACb,SAAUA,EAAQ,IAAO,IACzB,kBAAmBA,EAAQ,IAAOZ,EAAO,uBAAyB,IAClE,YAAaG,EAAI,EAAIH,EAAO,qBAC9B,CACF,MAAQ,CACN,MAAM,IAAIM,EAAU,UAAU,CAChC,CACF,CAEA,eAAeU,EAAO,EAAe,CACnC,IAAMC,EAAS,MAAMV,EAAOC,CAAK,EAGjC,GAAI,CACF,MAAO,CAAE,QAAS,MAAMN,EAAQ,QAAQ,MAAMe,CAAM,CAAE,CACxD,MAAQ,CACN,MAAM,IAAIX,EAAU,aAAa,CACnC,CACF,CACA,MAAO,CAAE,SAAQ,QAAO,CAC1B,C"}

package/dist/modules/auth/server/proof.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createProofReplayStore=t;

package/dist/modules/auth/server/proof.d.cts

@@ -0,0 +1,6 @@
+import { N as ProofStorage } from "../../../interface-BR9QNgXO.cjs";
+import "../../../interface-weqBVeUf.cjs";
+import { DpopReplayStore } from "better-auth/oauth2";
+/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
+export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
+//# sourceMappingURL=proof.d.cts.map

package/dist/modules/auth/server/proof.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;;wBAKgB,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.d.ts

@@ -0,0 +1,6 @@
+import { N as ProofStorage } from "../../../interface-ii8DV63k.js";
+import "../../../interface-BFsLlmGy.js";
+import { DpopReplayStore } from "better-auth/oauth2";
+/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
+export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
+//# sourceMappingURL=proof.d.ts.map

package/dist/modules/auth/server/proof.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.d.ts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;;wBAKgB,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e(`rejected`);try{return await t.consume(i,a)}catch{throw new e(`unavailable`)}}}}export{t as createProofReplayStore};
+//# sourceMappingURL=proof.js.map

package/dist/modules/auth/server/proof.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proof.js","names":["createProofReplayStore","reservation","expiresAt","key","now","AuthError","storage"],"sources":["../../../../src/modules/auth/server/proof.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { ProofStorage } from \"@/modules/auth/server/interface\";\nimport type { DpopReplayStore } from \"better-auth/oauth2\";\n\n/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */\nexport function createProofReplayStore(\n  storage: ProofStorage,\n  now: () => number = Date.now,\n): DpopReplayStore {\n  return {\n    async reserve(reservation) {\n      const { key } = reservation;\n      const expiresAt = reservation.expiresAt.getTime();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isFinite(expiresAt) ||\n        expiresAt <= now()\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        return await storage.consume(key, expiresAt);\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAKA,SAAgBA,EACd,EACA,EAAoB,KAAK,IACR,CACjB,MAAO,CACL,MAAM,QAAQ,EAAa,CACzB,GAAM,CAAE,OAAQC,EACVC,EAAYD,EAAY,UAAU,QAAQ,EAChD,GACE,CAACE,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,SAASD,CAAS,GAC1BA,GAAaE,EAAI,EAEjB,MAAM,IAAIC,EAAU,UAAU,EAChC,GAAI,CACF,OAAO,MAAMC,EAAQ,QAAQH,EAAKD,CAAS,CAC7C,MAAQ,CACN,MAAM,IAAIG,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/resource.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./proof.cjs");let r=require("better-auth/oauth2");function i(i){let a=i.now??Date.now,o=t.createAuthPolicy(i.policy),{verification:s}=i;if(!s.verifyOptions.issuer||!s.verifyOptions.audience||!s.jwksUrl&&!s.remoteVerify||![`always`,`sensitive`].includes(i.onlineVerification)||i.requireSid===!1&&i.onlineVerification!==`always`)throw new e.AuthError(`invalid_configuration`);let c=s.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!c.length||c.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e.AuthError(`invalid_configuration`);let l=e=>typeof e==`string`&&e.length>0;if(![s.verifyOptions.issuer,s.verifyOptions.audience].every(e=>Array.isArray(e)?e.length>0&&e.every(l):l(e)))throw new e.AuthError(`invalid_configuration`);for(let t of[s.jwksUrl,s.remoteVerify?.introspectUrl]){if(!t)continue;let n;try{n=new URL(t)}catch{throw new e.AuthError(`invalid_configuration`)}if(n.username||n.password||n.hash||n.search||n.protocol!==`https:`&&!(i.allowLoopbackHttp&&n.protocol===`http:`&&[`localhost`,`127.0.0.1`,`[::1]`].includes(n.hostname)))throw new e.AuthError(`invalid_configuration`)}let u=n.createProofReplayStore(i.proof,a);return{async verify(t,n={}){let l;try{if(l=await(0,r.verifyAccessTokenRequest)(t,{...s,verifyOptions:{...s.verifyOptions,algorithms:[...c],clockTolerance:o.clockToleranceSeconds,requiredClaims:[.../* @__PURE__ */ new Set([...s.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`exp`,`iat`])],currentDate:new Date(a())},dpop:{replayStore:u}}),typeof l.sub!=`string`||!l.sub||l.sub.length>255||i.requireSid!==!1&&typeof l.sid!=`string`||l.iat>a()/1e3+o.clockToleranceSeconds||l.exp*1e3-a()>o.revocationRetentionMs-o.clockToleranceSeconds*1e3||l.sid!==void 0&&(typeof l.sid!=`string`||!l.sid||l.sid.length>255))throw new e.AuthError(`rejected`)}catch(t){if((0,r.isInsufficientScopeError)(t))throw new e.AuthError(`forbidden`);if(t instanceof e.AuthError)throw t;let n=t&&typeof t==`object`&&`statusCode`in t?t.statusCode:void 0;throw typeof n==`number`&&n>=400&&n<500?new e.AuthError(`rejected`):new e.AuthError(`unavailable`)}try{if(await i.revocation.isRevoked({subject:l.sub,sid:l.sid,issuedAt:l.iat*1e3,now:a()}))throw new e.AuthError(`rejected`)}catch(t){throw t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}if(i.onlineVerification===`always`||n.sensitive)try{await i.verifyActive(l,t)}catch(t){throw t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}return l}}}exports.createResourceAuth=i;

package/dist/modules/auth/server/resource.d.cts

@@ -0,0 +1,10 @@
+import { F as ResourceAuthOptions } from "../../../interface-BR9QNgXO.cjs";
+import { JWTPayload } from "jose";
+import { ResourceRequestInput } from "better-auth/oauth2";
+export declare function createResourceAuth(options: ResourceAuthOptions): {
+  verify(request: ResourceRequestInput, input?: {
+    sensitive?: boolean;
+  }): Promise<JWTPayload>;
+};
+export type { ResourceAuthOptions };
+//# sourceMappingURL=resource.d.cts.map

package/dist/modules/auth/server/resource.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.cts","names":[],"sources":["../../../../src/modules/auth/server/resource.ts"],"mappings":";;;wBAWgB,mBAAmB,SAAS;EAkE7B,OAAA,SAAA,sBAAoB;IACpB;MAAqB,QAAA"}

package/dist/modules/auth/server/resource.d.ts

@@ -0,0 +1,10 @@
+import { F as ResourceAuthOptions } from "../../../interface-ii8DV63k.js";
+import { JWTPayload } from "jose";
+import { ResourceRequestInput } from "better-auth/oauth2";
+export declare function createResourceAuth(options: ResourceAuthOptions): {
+  verify(request: ResourceRequestInput, input?: {
+    sensitive?: boolean;
+  }): Promise<JWTPayload>;
+};
+export type { ResourceAuthOptions };
+//# sourceMappingURL=resource.d.ts.map

package/dist/modules/auth/server/resource.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.d.ts","names":[],"sources":["../../../../src/modules/auth/server/resource.ts"],"mappings":";;;wBAWgB,mBAAmB,SAAS;EAkE7B,OAAA,SAAA,sBAAoB;IACpB;MAAqB,QAAA"}

package/dist/modules/auth/server/resource.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{createAuthPolicy as t}from"../policy.js";import{createProofReplayStore as n}from"./proof.js";import{isInsufficientScopeError as r,verifyAccessTokenRequest as i}from"better-auth/oauth2";function a(a){let o=a.now??Date.now,s=t(a.policy),{verification:c}=a;if(!c.verifyOptions.issuer||!c.verifyOptions.audience||!c.jwksUrl&&!c.remoteVerify||![`always`,`sensitive`].includes(a.onlineVerification)||a.requireSid===!1&&a.onlineVerification!==`always`)throw new e(`invalid_configuration`);let l=c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!l.length||l.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw new e(`invalid_configuration`);let u=e=>typeof e==`string`&&e.length>0;if(![c.verifyOptions.issuer,c.verifyOptions.audience].every(e=>Array.isArray(e)?e.length>0&&e.every(u):u(e)))throw new e(`invalid_configuration`);for(let t of[c.jwksUrl,c.remoteVerify?.introspectUrl]){if(!t)continue;let n;try{n=new URL(t)}catch{throw new e(`invalid_configuration`)}if(n.username||n.password||n.hash||n.search||n.protocol!==`https:`&&!(a.allowLoopbackHttp&&n.protocol===`http:`&&[`localhost`,`127.0.0.1`,`[::1]`].includes(n.hostname)))throw new e(`invalid_configuration`)}let d=n(a.proof,o);return{async verify(t,n={}){let u;try{if(u=await i(t,{...c,verifyOptions:{...c.verifyOptions,algorithms:[...l],clockTolerance:s.clockToleranceSeconds,requiredClaims:[.../* @__PURE__ */ new Set([...c.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`exp`,`iat`])],currentDate:new Date(o())},dpop:{replayStore:d}}),typeof u.sub!=`string`||!u.sub||u.sub.length>255||a.requireSid!==!1&&typeof u.sid!=`string`||u.iat>o()/1e3+s.clockToleranceSeconds||u.exp*1e3-o()>s.revocationRetentionMs-s.clockToleranceSeconds*1e3||u.sid!==void 0&&(typeof u.sid!=`string`||!u.sid||u.sid.length>255))throw new e(`rejected`)}catch(t){if(r(t))throw new e(`forbidden`);if(t instanceof e)throw t;let n=t&&typeof t==`object`&&`statusCode`in t?t.statusCode:void 0;throw typeof n==`number`&&n>=400&&n<500?new e(`rejected`):new e(`unavailable`)}try{if(await a.revocation.isRevoked({subject:u.sub,sid:u.sid,issuedAt:u.iat*1e3,now:o()}))throw new e(`rejected`)}catch(t){throw t instanceof e?t:new e(`unavailable`)}if(a.onlineVerification===`always`||n.sensitive)try{await a.verifyActive(u,t)}catch(t){throw t instanceof e?t:new e(`unavailable`)}return u}}}export{a as createResourceAuth};
+//# sourceMappingURL=resource.js.map

package/dist/modules/auth/server/resource.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"resource.js","names":["createResourceAuth","now","options","policy","createAuthPolicy","verification","AuthError","algorithms","algorithm","exact","value","endpoint","url","replayStore","createProofReplayStore","claims","verifyAccessTokenRequest","request","error","isInsufficientScopeError","status","input"],"sources":["../../../../src/modules/auth/server/resource.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { createAuthPolicy } from \"@/modules/auth/policy\";\nimport { createProofReplayStore } from \"@/modules/auth/server/proof\";\nimport type { ResourceAuthOptions } from \"@/utils/interface\";\nimport {\n  isInsufficientScopeError,\n  verifyAccessTokenRequest,\n  type ResourceRequestInput,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport function createResourceAuth(options: ResourceAuthOptions) {\n  const now = options.now ?? Date.now;\n  const policy = createAuthPolicy(options.policy);\n  const { verification } = options;\n  if (\n    !verification.verifyOptions.issuer ||\n    !verification.verifyOptions.audience ||\n    (!verification.jwksUrl && !verification.remoteVerify) ||\n    ![\"always\", \"sensitive\"].includes(options.onlineVerification) ||\n    (options.requireSid === false && options.onlineVerification !== \"always\")\n  )\n    throw new AuthError(\"invalid_configuration\");\n  const algorithms = verification.verifyOptions.algorithms ?? [\n    \"RS256\",\n    \"ES256\",\n    \"EdDSA\",\n  ];\n  if (\n    !algorithms.length ||\n    algorithms.some(\n      (algorithm) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(algorithm),\n    )\n  ) {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  const exact = (value: unknown): boolean =>\n    typeof value === \"string\" && value.length > 0;\n  if (\n    ![\n      verification.verifyOptions.issuer,\n      verification.verifyOptions.audience,\n    ].every((value) =>\n      Array.isArray(value)\n        ? value.length > 0 && value.every(exact)\n        : exact(value),\n    )\n  )\n    throw new AuthError(\"invalid_configuration\");\n  for (const endpoint of [\n    verification.jwksUrl,\n    verification.remoteVerify?.introspectUrl,\n  ]) {\n    if (!endpoint) continue;\n    let url: URL;\n    try {\n      url = new URL(endpoint);\n    } catch {\n      throw new AuthError(\"invalid_configuration\");\n    }\n    if (\n      url.username ||\n      url.password ||\n      url.hash ||\n      url.search ||\n      (url.protocol !== \"https:\" &&\n        !(\n          options.allowLoopbackHttp &&\n          url.protocol === \"http:\" &&\n          [\"localhost\", \"127.0.0.1\", \"[::1]\"].includes(url.hostname)\n        ))\n    )\n      throw new AuthError(\"invalid_configuration\");\n  }\n  const replayStore = createProofReplayStore(options.proof, now);\n  return {\n    async verify(\n      request: ResourceRequestInput,\n      input: { sensitive?: boolean } = {},\n    ) {\n      let claims: JWTPayload;\n      try {\n        claims = await verifyAccessTokenRequest(request, {\n          ...verification,\n          verifyOptions: {\n            ...verification.verifyOptions,\n            algorithms: [...algorithms],\n            clockTolerance: policy.clockToleranceSeconds,\n            requiredClaims: [\n              ...new Set([\n                ...(verification.verifyOptions.requiredClaims ?? []),\n                \"iss\",\n                \"aud\",\n                \"sub\",\n                \"exp\",\n                \"iat\",\n              ]),\n            ],\n            currentDate: new Date(now()),\n          },\n          dpop: { replayStore },\n        });\n        if (\n          typeof claims.sub !== \"string\" ||\n          !claims.sub ||\n          claims.sub.length > 255 ||\n          (options.requireSid !== false && typeof claims.sid !== \"string\") ||\n          claims.iat! > now() / 1000 + policy.clockToleranceSeconds ||\n          claims.exp! * 1000 - now() >\n            policy.revocationRetentionMs -\n              policy.clockToleranceSeconds * 1000 ||\n          (claims.sid !== undefined &&\n            (typeof claims.sid !== \"string\" ||\n              !claims.sid ||\n              claims.sid.length > 255))\n        )\n          throw new AuthError(\"rejected\");\n      } catch (error) {\n        if (isInsufficientScopeError(error)) throw new AuthError(\"forbidden\");\n        if (error instanceof AuthError) throw error;\n        const status =\n          error && typeof error === \"object\" && \"statusCode\" in error\n            ? error.statusCode\n            : undefined;\n        if (typeof status === \"number\" && status >= 400 && status < 500)\n          throw new AuthError(\"rejected\");\n        // Unknown/JWKS/network failures are not a reason to log users out.\n        throw new AuthError(\"unavailable\");\n      }\n      try {\n        if (\n          await options.revocation.isRevoked({\n            subject: claims.sub!,\n            sid: claims.sid as string | undefined,\n            issuedAt: claims.iat! * 1000,\n            now: now(),\n          })\n        )\n          throw new AuthError(\"rejected\");\n      } catch (error) {\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n      if (options.onlineVerification === \"always\" || input.sensitive) {\n        try {\n          await options.verifyActive(claims, request);\n        } catch (error) {\n          if (error instanceof AuthError) throw error;\n          throw new AuthError(\"unavailable\");\n        }\n      }\n      return claims; // App still owns local status, permissions, and domain authorization.\n    },\n  };\n}\n\nexport type { ResourceAuthOptions } from \"@/utils/interface\";\n"],"mappings":"A,4OAWA,SAAgBA,EAAmB,EAA8B,CAC/D,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAC1BC,EAASC,EAAiBF,EAAQ,MAAM,EACxC,CAAE,gBAAiBA,EACzB,GACE,CAACG,EAAa,cAAc,QAC5B,CAACA,EAAa,cAAc,UAC3B,CAACA,EAAa,SAAW,CAACA,EAAa,cACxC,CAAC,CAAC,SAAU,WAAW,CAAC,CAAC,SAASH,EAAQ,kBAAkB,GAC3DA,EAAQ,aAAe,IAASA,EAAQ,qBAAuB,SAEhE,MAAM,IAAII,EAAU,uBAAuB,EAC7C,IAAMC,EAAaF,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACE,EAAW,QACZA,EAAW,KACR,GAAc,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAS,CAChE,EAEA,MAAM,IAAIF,EAAU,uBAAuB,EAE7C,IAAMG,EAAS,GACb,OAAOC,GAAU,UAAYA,EAAM,OAAS,EAC9C,GACE,CAAC,CACCL,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,CAAC,CAAC,MAAO,GACP,MAAM,QAAQK,CAAK,EACfA,EAAM,OAAS,GAAKA,EAAM,MAAMD,CAAK,EACrCA,EAAMC,CAAK,CACjB,EAEA,MAAM,IAAIJ,EAAU,uBAAuB,EAC7C,IAAK,IAAMK,IAAY,CACrBN,EAAa,QACbA,EAAa,cAAc,aAC7B,EAAG,CACD,GAAI,CAACM,EAAU,SACf,IAAIC,EACJ,GAAI,CACF,EAAM,IAAI,IAAID,CAAQ,CACxB,MAAQ,CACN,MAAM,IAAIL,EAAU,uBAAuB,CAC7C,CACA,GACEM,EAAI,UACJA,EAAI,UACJA,EAAI,MACJA,EAAI,QACHA,EAAI,WAAa,UAChB,EACEV,EAAQ,mBACRU,EAAI,WAAa,SACjB,CAAC,YAAa,YAAa,OAAO,CAAC,CAAC,SAASA,EAAI,QAAQ,GAG7D,MAAM,IAAIN,EAAU,uBAAuB,CAC/C,CACA,IAAMO,EAAcC,EAAuBZ,EAAQ,MAAOD,CAAG,EAC7D,MAAO,CACL,MAAM,OACJ,EACA,EAAiC,CAAC,EAClC,CACA,IAAIc,EACJ,GAAI,CAqBF,GApBA,EAAS,MAAMC,EAAyBC,EAAS,CAC/C,GAAGZ,EACH,cAAe,CACb,GAAGA,EAAa,cAChB,WAAY,CAAC,GAAGE,CAAU,EAC1B,eAAgBJ,EAAO,sBACvB,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIE,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,EACA,YAAa,IAAI,KAAKJ,EAAI,CAAC,CAC7B,EACA,KAAM,CAAE,aAAY,CACtB,CAAC,EAEC,OAAOc,EAAO,KAAQ,UACtB,CAACA,EAAO,KACRA,EAAO,IAAI,OAAS,KACnBb,EAAQ,aAAe,IAAS,OAAOa,EAAO,KAAQ,UACvDA,EAAO,IAAOd,EAAI,EAAI,IAAOE,EAAO,uBACpCY,EAAO,IAAO,IAAOd,EAAI,EACvBE,EAAO,sBACLA,EAAO,sBAAwB,KAClCY,EAAO,MAAQ,IAAA,KACb,OAAOA,EAAO,KAAQ,UACrB,CAACA,EAAO,KACRA,EAAO,IAAI,OAAS,KAExB,MAAM,IAAIT,EAAU,UAAU,CAClC,OAASY,EAAO,CACd,GAAIC,EAAyBD,CAAK,EAAG,MAAM,IAAIZ,EAAU,WAAW,EACpE,GAAIY,aAAiBZ,EAAW,MAAMY,EACtC,IAAME,EACJF,GAAS,OAAOA,GAAU,UAAY,eAAgBA,EAClDA,EAAM,WACN,IAAA,GAIN,MAHI,OAAOE,GAAW,UAAYA,GAAU,KAAOA,EAAS,IACpD,IAAId,EAAU,UAAU,EAE1B,IAAIA,EAAU,aAAa,CACnC,CACA,GAAI,CACF,GACE,MAAMJ,EAAQ,WAAW,UAAU,CACjC,QAASa,EAAO,IAChB,IAAKA,EAAO,IACZ,SAAUA,EAAO,IAAO,IACxB,IAAKd,EAAI,CACX,CAAC,EAED,MAAM,IAAIK,EAAU,UAAU,CAClC,OAASY,EAAO,CAEd,MADIA,aAAiBZ,EAAiBY,EAChC,IAAIZ,EAAU,aAAa,CACnC,CACA,GAAIJ,EAAQ,qBAAuB,UAAYmB,EAAM,UACnD,GAAI,CACF,MAAMnB,EAAQ,aAAaa,EAAQE,CAAO,CAC5C,OAASC,EAAO,CAEd,MADIA,aAAiBZ,EAAiBY,EAChC,IAAIZ,EAAU,aAAa,CACnC,CAEF,OAAOS,CACT,CACF,CACF,C"}

package/dist/modules/auth/server/revocation.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t,n,r=Date.now()){if(!t.sid&&!t.subject||!n.subject||[t.issuedAt,t.expiresAt,n.issuedAt,r].some(e=>!Number.isSafeInteger(e)||e<0))throw new e.AuthError(`rejected`);return t.expiresAt>r&&(!t.subject||t.subject===n.subject)&&(!t.sid||t.sid===n.sid)&&(!!t.sid||Math.floor(n.issuedAt/1e3)<=Math.floor(t.issuedAt/1e3))}exports.matchesAuthRevocation=t;

package/dist/modules/auth/server/revocation.d.cts

@@ -0,0 +1,4 @@
+import { l as AuthRevocation, u as AuthRevocationIdentity } from "../../../interface-BR9QNgXO.cjs";
+/** Both sid/sub must match when supplied. Subject-only events use iat's entire second. */
+export declare function matchesAuthRevocation(marker: AuthRevocation, identity: AuthRevocationIdentity, now?: number): boolean;
+//# sourceMappingURL=revocation.d.cts.map

package/dist/modules/auth/server/revocation.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.cts","names":[],"sources":["../../../../src/modules/auth/server/revocation.ts"],"mappings":";;wBAIgB,sBACd,QAAQ,gBACR,UAAU,wBACV"}

package/dist/modules/auth/server/revocation.d.ts

@@ -0,0 +1,4 @@
+import { l as AuthRevocation, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
+/** Both sid/sub must match when supplied. Subject-only events use iat's entire second. */
+export declare function matchesAuthRevocation(marker: AuthRevocation, identity: AuthRevocationIdentity, now?: number): boolean;
+//# sourceMappingURL=revocation.d.ts.map

package/dist/modules/auth/server/revocation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"revocation.d.ts","names":[],"sources":["../../../../src/modules/auth/server/revocation.ts"],"mappings":";;wBAIgB,sBACd,QAAQ,gBACR,UAAU,wBACV"}

package/dist/modules/auth/server/revocation.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";function t(t,n,r=Date.now()){if(!t.sid&&!t.subject||!n.subject||[t.issuedAt,t.expiresAt,n.issuedAt,r].some(e=>!Number.isSafeInteger(e)||e<0))throw new e(`rejected`);return t.expiresAt>r&&(!t.subject||t.subject===n.subject)&&(!t.sid||t.sid===n.sid)&&(!!t.sid||Math.floor(n.issuedAt/1e3)<=Math.floor(t.issuedAt/1e3))}export{t as matchesAuthRevocation};
+//# sourceMappingURL=revocation.js.map