@gorth-io/structure 0.0.0-alpha.6 → 0.0.0-alpha.8

package/README.md

@@ -1,12 +1,83 @@
-# @gorth/structure
+# @gorth-io/structure
 
-Shared, configurable runtime infrastructure for the Gorth ecosystem.
-Better Auth owns login, OAuth, sessions, token encryption and renewal; Structure
-provides direct SDK exports and small reusable infrastructure helpers.
+TypeScript infrastructure for HTTP clients, authentication coordination,
+Supabase, and database integrations in the **gorth-io** ecosystem.
 
-See [auth](docs/auth.md) for the native SDK boundaries, new helpers and
-**breaking removal of the legacy custom auth engines**, and
-[modules](docs/modules.md) for the public module inventory and verification.
+| Includes | Public imports |
+| --- | --- |
+| HTTP callers, fetchers, and responses | `@gorth-io/structure/modules/http` |
+| Authentication retry and freshness policies | `@gorth-io/structure/modules/auth/client` |
+| Server authentication infrastructure | `@gorth-io/structure/modules/auth/server` |
+| Desktop infrastructure | `@gorth-io/structure/modules/desktop` |
+| Axios, Zod, Supabase, and database SDKs | `@gorth-io/structure/cores/*` |
+
+## Installation
+
+Use Node.js 24 and install from the npm registry with Bun:
+
+```bash
+bun add @gorth-io/structure
+```
+
+Example dependency declaration (`0.0.0` is a demo version; replace it with an available release):
+
+```json
+{
+  "dependencies": {
+    "@gorth-io/structure": "0.0.0"
+  }
+}
+```
+
+## Usage
+
+Import the public entrypoint for the integration you need:
+
+```ts
+import axios from "@gorth-io/structure/cores/axios";
+import { z } from "@gorth-io/structure/cores/zod";
+
+const User = z.object({
+  id: z.string(),
+  name: z.string(),
+});
+
+export async function getUser() {
+  const response = await axios.get("/user", { withCredentials: true });
+  return User.parse(response.data);
+}
+```
+
+Each application supplies its own URLs, credentials, database connections, and
+authentication configuration. Import only the entrypoints suitable for your
+runtime; keep server credentials and database operations outside browser code.
+
+## Authentication
+
+Better Auth owns login, OAuth, sessions, token encryption, and renewal. Structure
+provides SDK exports and small reusable infrastructure helpers, including
+request retry coordination and freshness policies. It does not replace the
+authentication provider or create a configured auth instance for your app.
+
+See the [authentication guide](https://github.com/gorth-io/base-structure/blob/main/docs/auth.md)
+and [public module inventory](https://github.com/gorth-io/base-structure/blob/main/docs/modules.md)
+for integration details and migration notes.
 
 No application configuration, env reads, API keys, database connection or
 configured auth instance belongs in this package.
+
+## Development
+
+```bash
+bun install --frozen-lockfile
+bun run build
+bun run typecheck
+bun run test
+bun run test:types
+bun run test:exports
+```
+
+## Related packages
+
+- [@gorth-io/primitive](https://www.npmjs.com/package/@gorth-io/primitive): React UI, themes, and application components.
+- [@gorth-io/principle](https://www.npmjs.com/package/@gorth-io/principle): backend middleware and server integrations.

package/dist/cores/ably/spaces/index.cjs

@@ -1 +1 @@
-const e=require("../../../rolldown-runtime-BocRIvOZ.cjs");let t=require("@ably/spaces");t=e.t(t,1),module.exports=t.default,Object.keys(t).forEach(function(e){e!=="default"&&!Object.prototype.hasOwnProperty.call(exports,e)&&Object.defineProperty(exports,e,{enumerable:!0,get:function(){return t[e]}})});
+var e=require("@ably/spaces");Object.keys(e).forEach(function(t){t!=="default"&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/cores/ably/spaces/index.d.cts

@@ -1,3 +1 @@
-import spaces_default from "@ably/spaces";
-export * from "@ably/spaces";
-export { spaces_default as default };
+export * from "@ably/spaces";

package/dist/cores/ably/spaces/index.d.ts

@@ -1,3 +1 @@
-import spaces_default from "@ably/spaces";
-export * from "@ably/spaces";
-export { spaces_default as default };
+export * from "@ably/spaces";

package/dist/cores/ably/spaces/index.js

@@ -1 +1 @@
-export{default}from"@ably/spaces";export*from"@ably/spaces";
+export*from"@ably/spaces";export{};

package/dist/modules/auth/server/bearer.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs"),n=require("../../../utils/normalization.cjs");let r=require("better-auth/oauth2");function i(t){if(t instanceof e.AuthError)return t;if((0,r.isInsufficientScopeError)(t))return new e.AuthError(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e.AuthError(`rejected`):n?.statusCode===403?new e.AuthError(`forbidden`):new e.AuthError(`unavailable`)}function a(e){if((0,r.isInsufficientScopeError)(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=i(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function o(a){let{verification:o}=a;try{if(!o.jwksUrl||o.remoteVerify)throw Error();n.parseHttpEndpoint(o.jwksUrl,{allowLoopbackHttp:a.allowLoopbackHttp});for(let e of[o.verifyOptions.issuer,o.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e.AuthError(`invalid_configuration`)}let s={...o,requiredScopes:o.requiredScopes&&[...o.requiredScopes],verifyOptions:{...o.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(o.verifyOptions.issuer)?[...o.verifyOptions.issuer]:o.verifyOptions.issuer,audience:Array.isArray(o.verifyOptions.audience)?[...o.verifyOptions.audience]:o.verifyOptions.audience,algorithms:[...o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...o.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let i=(0,r.requestToResourceInput)(n);if(!i.authorizationHeader||!/^Bearer [^\s]+$/i.test(i.authorizationHeader))throw new e.AuthError(`rejected`);i.authorizationHeader=`Bearer `+i.authorizationHeader.slice(7);let o=await(0,r.verifyAccessTokenRequest)(i,s);return t.assertAccessTokenClaims(o,a.claims),await a.authorize?.(o,n),o}catch(e){throw(0,r.isInsufficientScopeError)(e)?e:i(e)}}}exports.authFailure=a,exports.createBearerVerifier=o,exports.normalizeAuthError=i;

package/dist/modules/auth/server/bearer.d.cts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.cjs";
+import { AccessTokenClaimPolicy } from "./claims.cjs";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.cts.map

package/dist/modules/auth/server/bearer.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.cts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAciB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.d.ts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.js";
+import { AccessTokenClaimPolicy } from "./claims.js";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/modules/auth/server/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAciB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{assertAccessTokenClaims as t}from"./claims.js";import{parseHttpEndpoint as n}from"../../../utils/normalization.js";import{isInsufficientScopeError as r,requestToResourceInput as i,verifyAccessTokenRequest as a}from"better-auth/oauth2";function o(t){if(t instanceof e)return t;if(r(t))return new e(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e(`rejected`):n?.statusCode===403?new e(`forbidden`):new e(`unavailable`)}function s(e){if(r(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=o(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function c(s){let{verification:c}=s;try{if(!c.jwksUrl||c.remoteVerify)throw Error();n(c.jwksUrl,{allowLoopbackHttp:s.allowLoopbackHttp});for(let e of[c.verifyOptions.issuer,c.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e(`invalid_configuration`)}let l={...c,requiredScopes:c.requiredScopes&&[...c.requiredScopes],verifyOptions:{...c.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(c.verifyOptions.issuer)?[...c.verifyOptions.issuer]:c.verifyOptions.issuer,audience:Array.isArray(c.verifyOptions.audience)?[...c.verifyOptions.audience]:c.verifyOptions.audience,algorithms:[...c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...c.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let r=i(n);if(!r.authorizationHeader||!/^Bearer [^\s]+$/i.test(r.authorizationHeader))throw new e(`rejected`);r.authorizationHeader=`Bearer `+r.authorizationHeader.slice(7);let o=await a(r,l);return t(o,s.claims),await s.authorize?.(o,n),o}catch(e){throw r(e)?e:o(e)}}}export{s as authFailure,c as createBearerVerifier,o as normalizeAuthError};
+//# sourceMappingURL=bearer.js.map

package/dist/modules/auth/server/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","names":["normalizeAuthError","error","AuthError","isInsufficientScopeError","value","authFailure","failure","createBearerVerifier","options","verification","parseHttpEndpoint","values","v","algorithms","a","native","input","requestToResourceInput","request","claims","verifyAccessTokenRequest","assertAccessTokenClaims"],"sources":["../../../../src/modules/auth/server/bearer.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport {\n  assertAccessTokenClaims,\n  type AccessTokenClaimPolicy,\n} from \"@/modules/auth/server/claims\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport {\n  isInsufficientScopeError,\n  requestToResourceInput,\n  verifyAccessTokenRequest,\n  type VerifyAccessTokenOptions,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport interface AuthFailure {\n  status: number;\n  code: string;\n  headers?: Record<string, string>;\n}\n\nexport function normalizeAuthError(error: unknown): AuthError {\n  if (error instanceof AuthError) return error;\n  if (isInsufficientScopeError(error)) return new AuthError(\"forbidden\");\n  const value = error as { statusCode?: unknown; code?: unknown } | null;\n  if (\n    value?.statusCode === 401 ||\n    (typeof value?.code === \"string\" &&\n      /^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(value.code))\n  )\n    return new AuthError(\"rejected\");\n  if (value?.statusCode === 403) return new AuthError(\"forbidden\");\n  return new AuthError(\"unavailable\");\n}\n\n/** Sanitized framework-neutral projection; never includes SDK/transport causes. */\nexport function authFailure(error: unknown): AuthFailure {\n  if (isInsufficientScopeError(error))\n    return {\n      status: 403,\n      code: \"insufficient_scope\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"insufficient_scope\"' },\n    };\n  const failure = normalizeAuthError(error);\n  if (failure.code === \"rejected\")\n    return {\n      status: 401,\n      code: \"invalid_access_token\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"' },\n    };\n  if (failure.code === \"forbidden\") return { status: 403, code: \"forbidden\" };\n  return { status: 503, code: \"auth_unavailable\" };\n}\n\nexport interface BearerVerifierOptions {\n  verification: VerifyAccessTokenOptions;\n  claims?: AccessTokenClaimPolicy;\n  allowLoopbackHttp?: boolean;\n  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;\n}\n\n/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */\nexport function createBearerVerifier(options: BearerVerifierOptions) {\n  const { verification } = options;\n  try {\n    if (!verification.jwksUrl || verification.remoteVerify) throw new Error();\n    parseHttpEndpoint(verification.jwksUrl, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    for (const value of [\n      verification.verifyOptions.issuer,\n      verification.verifyOptions.audience,\n    ]) {\n      const values = Array.isArray(value) ? value : [value];\n      if (!values.length || values.some((v) => typeof v !== \"string\" || !v))\n        throw new Error();\n    }\n    const algorithms = verification.verifyOptions.algorithms ?? [\n      \"RS256\",\n      \"ES256\",\n      \"EdDSA\",\n    ];\n    if (\n      !algorithms.length ||\n      algorithms.some((a) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(a))\n    )\n      throw new Error();\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  // Snapshot mutable host options so later changes cannot weaken verification.\n  const native: VerifyAccessTokenOptions = {\n    ...verification,\n    requiredScopes: verification.requiredScopes && [...verification.requiredScopes],\n    verifyOptions: {\n      ...verification.verifyOptions,\n      typ: \"at+jwt\",\n      issuer: Array.isArray(verification.verifyOptions.issuer)\n        ? [...verification.verifyOptions.issuer]\n        : verification.verifyOptions.issuer,\n      audience: Array.isArray(verification.verifyOptions.audience)\n        ? [...verification.verifyOptions.audience]\n        : verification.verifyOptions.audience,\n      algorithms: [\n        ...(verification.verifyOptions.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"]),\n      ],\n      requiredClaims: [\n        ...new Set([\n          ...(verification.verifyOptions.requiredClaims ?? []),\n          \"iss\",\n          \"aud\",\n          \"sub\",\n          \"iat\",\n          \"exp\",\n        ]),\n      ],\n    },\n  };\n  return async function verify(request: Request) {\n    try {\n      const input = requestToResourceInput(request);\n      if (\n        !input.authorizationHeader ||\n        !/^Bearer [^\\s]+$/i.test(input.authorizationHeader)\n      )\n        throw new AuthError(\"rejected\");\n      input.authorizationHeader = \"Bearer \" + input.authorizationHeader.slice(7);\n      const claims = await verifyAccessTokenRequest(input, native);\n      assertAccessTokenClaims(claims, options.claims);\n      await options.authorize?.(claims, request);\n      return claims;\n    } catch (error) {\n      // Keep the SDK's typed scope error so the adapter can issue RFC 6750's challenge.\n      if (isInsufficientScopeError(error)) throw error;\n      throw normalizeAuthError(error);\n    }\n  };\n}\n"],"mappings":"A,8RAoBA,SAAgBA,EAAmB,EAA2B,CAC5D,GAAIC,aAAiBC,EAAW,OAAOD,EACvC,GAAIE,EAAyBF,CAAK,EAAG,OAAO,IAAIC,EAAU,WAAW,EACrE,IAAME,EAAQH,EAQd,OANEG,GAAO,aAAe,KACrB,OAAOA,GAAO,MAAS,UACtB,uDAAuD,KAAKA,EAAM,IAAI,EAEjE,IAAIF,EAAU,UAAU,EAC7BE,GAAO,aAAe,IAAY,IAAIF,EAAU,WAAW,EACxD,IAAIA,EAAU,aAAa,CACpC,CAGA,SAAgBG,EAAY,EAA6B,CACvD,GAAIF,EAAyBF,CAAK,EAChC,MAAO,CACL,OAAQ,IACR,KAAM,qBACN,QAAS,CAAE,mBAAoB,mCAAoC,CACrE,EACF,IAAMK,EAAUN,EAAmBC,CAAK,EAQxC,OAPIK,EAAQ,OAAS,WACZ,CACL,OAAQ,IACR,KAAM,uBACN,QAAS,CAAE,mBAAoB,8BAA+B,CAChE,EACEA,EAAQ,OAAS,YAAoB,CAAE,OAAQ,IAAK,KAAM,WAAY,EACnE,CAAE,OAAQ,IAAK,KAAM,kBAAmB,CACjD,CAUA,SAAgBC,EAAqB,EAAgC,CACnE,GAAM,CAAE,gBAAiBC,EACzB,GAAI,CACF,GAAI,CAACC,EAAa,SAAWA,EAAa,aAAc,MAAU,MAAM,EACxEC,EAAkBD,EAAa,QAAS,CACtC,kBAAmBD,EAAQ,iBAC7B,CAAC,EACD,IAAK,IAAMJ,IAAS,CAClBK,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,EAAG,CACD,IAAME,EAAS,MAAM,QAAQP,CAAK,EAAIA,EAAQ,CAACA,CAAK,EACpD,GAAI,CAACO,EAAO,QAAUA,EAAO,KAAM,GAAM,OAAOC,GAAM,UAAY,CAACA,CAAC,EAClE,MAAU,MAAM,CACpB,CACA,IAAMC,EAAaJ,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACI,EAAW,QACZA,EAAW,KAAM,GAAM,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAC,CAAC,EAE/D,MAAU,MAAM,CACpB,MAAQ,CACN,MAAM,IAAIZ,EAAU,uBAAuB,CAC7C,CAEA,IAAMa,EAAmC,CACvC,GAAGN,EACH,eAAgBA,EAAa,gBAAkB,CAAC,GAAGA,EAAa,cAAc,EAC9E,cAAe,CACb,GAAGA,EAAa,cAChB,IAAK,SACL,OAAQ,MAAM,QAAQA,EAAa,cAAc,MAAM,EACnD,CAAC,GAAGA,EAAa,cAAc,MAAM,EACrCA,EAAa,cAAc,OAC/B,SAAU,MAAM,QAAQA,EAAa,cAAc,QAAQ,EACvD,CAAC,GAAGA,EAAa,cAAc,QAAQ,EACvCA,EAAa,cAAc,SAC/B,WAAY,CACV,GAAIA,EAAa,cAAc,YAAc,CAAC,QAAS,QAAS,OAAO,CACzE,EACA,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIA,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,CACF,CACF,EACA,OAAO,eAAsB,EAAkB,CAC7C,GAAI,CACF,IAAMO,EAAQC,EAAuBC,CAAO,EAC5C,GACE,CAACF,EAAM,qBACP,CAAC,mBAAmB,KAAKA,EAAM,mBAAmB,EAElD,MAAM,IAAId,EAAU,UAAU,EAChC,EAAM,oBAAsB,UAAYc,EAAM,oBAAoB,MAAM,CAAC,EACzE,IAAMG,EAAS,MAAMC,EAAyBJ,EAAOD,CAAM,EAG3D,OAFAM,EAAwBF,EAAQX,EAAQ,MAAM,EAC9C,MAAMA,EAAQ,YAAYW,EAAQD,CAAO,EAClCC,CACT,OAASlB,EAAO,CAGd,MADIE,EAAyBF,CAAK,EAASA,EACrCD,EAAmBC,CAAK,CAChC,CACF,CACF,C"}

package/dist/modules/auth/server/claims.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");let t=require("zod");const n=t.z.string().min(1).max(255),r=t.z.looseObject({sub:n,email:t.z.string().optional(),name:t.z.string().nullable().optional(),email_verified:t.z.boolean().optional(),preferred_username:t.z.string().nullable().optional(),picture:t.z.string().nullable().optional(),status:t.z.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e.AuthError(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e.AuthError(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e.AuthError(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}exports.assertAccessTokenClaims=i,exports.assertSessionContinuity=o,exports.assertTokenContinuity=a,exports.authSubjectSchema=n,exports.mapOAuthUserProfile=s,exports.oauthUserInfoSchema=r;

package/dist/modules/auth/server/claims.d.cts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-BR9QNgXO.cjs";
+import { JWTPayload } from "jose";
+import { z } from "zod";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.cts.map

package/dist/modules/auth/server/claims.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.cts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.d.ts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-ii8DV63k.js";
+import { z } from "zod";
+import { JWTPayload } from "jose";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.ts.map

package/dist/modules/auth/server/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{z as t}from"zod";const n=t.string().min(1).max(255),r=t.looseObject({sub:n,email:t.string().optional(),name:t.string().nullable().optional(),email_verified:t.boolean().optional(),preferred_username:t.string().nullable().optional(),picture:t.string().nullable().optional(),status:t.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}export{i as assertAccessTokenClaims,o as assertSessionContinuity,a as assertTokenContinuity,n as authSubjectSchema,s as mapOAuthUserProfile,r as oauthUserInfoSchema};
+//# sourceMappingURL=claims.js.map

package/dist/modules/auth/server/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","names":["authSubjectSchema","z","oauthUserInfoSchema","assertAccessTokenClaims","policy","AuthError","claims","assertTokenContinuity","binding","assertSessionContinuity","before","after","value","mapOAuthUserProfile","result","profile"],"sources":["../../../../src/modules/auth/server/claims.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { AuthSessionBinding } from \"@/utils/interface\";\nimport type { JWTPayload } from \"jose\";\nimport { z } from \"zod\";\n\nexport const authSubjectSchema = z.string().min(1).max(255);\n/** Profile shape only. Status/roles and admission policy belong to the application. */\nexport const oauthUserInfoSchema = z.looseObject({\n  sub: authSubjectSchema,\n  email: z.string().optional(),\n  name: z.string().nullable().optional(),\n  email_verified: z.boolean().optional(),\n  preferred_username: z.string().nullable().optional(),\n  picture: z.string().nullable().optional(),\n  status: z.string().optional(),\n});\nexport type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;\n\nexport interface AccessTokenClaimPolicy {\n  requireSid?: boolean;\n  maxLifetimeSeconds?: number;\n}\n\n/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */\nexport function assertAccessTokenClaims(\n  claims: JWTPayload,\n  policy: AccessTokenClaimPolicy = {},\n): asserts claims is JWTPayload & { sub: string; iat: number; exp: number } {\n  if (\n    policy.maxLifetimeSeconds !== undefined &&\n    (!Number.isSafeInteger(policy.maxLifetimeSeconds) || policy.maxLifetimeSeconds < 1)\n  )\n    throw new AuthError(\"invalid_configuration\");\n  if (\n    !authSubjectSchema.safeParse(claims.sub).success ||\n    !Number.isSafeInteger(claims.iat) ||\n    !Number.isSafeInteger(claims.exp) ||\n    claims.iat! < 0 ||\n    claims.exp! <= claims.iat! ||\n    (policy.maxLifetimeSeconds !== undefined &&\n      claims.exp! - claims.iat! > policy.maxLifetimeSeconds) ||\n    (policy.requireSid && claims.sid === undefined) ||\n    (claims.sid !== undefined && !authSubjectSchema.safeParse(claims.sid).success)\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertTokenContinuity(\n  claims: Pick<JWTPayload, \"sub\"> & { sid?: unknown },\n  binding: Pick<AuthSessionBinding, \"subject\" | \"sid\">,\n): void {\n  if (\n    !authSubjectSchema.safeParse(binding.subject).success ||\n    (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success) ||\n    claims.sub !== binding.subject ||\n    claims.sid !== binding.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertSessionContinuity(\n  before: Readonly<AuthSessionBinding>,\n  after: Readonly<AuthSessionBinding>,\n): void {\n  for (const binding of [before, after]) {\n    if (\n      [binding.id, binding.userId, binding.subject].some(\n        (value) => !authSubjectSchema.safeParse(value).success,\n      ) ||\n      (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success)\n    )\n      throw new AuthError(\"rejected\");\n  }\n  if (\n    before.id !== after.id ||\n    before.userId !== after.userId ||\n    before.subject !== after.subject ||\n    before.sid !== after.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function mapOAuthUserProfile(value: unknown) {\n  const result = oauthUserInfoSchema.safeParse(value);\n  if (!result.success) throw new AuthError(\"rejected\");\n  const profile = result.data;\n  return {\n    externalUserId: profile.sub,\n    emailVerified: profile.email_verified === true,\n    username: profile.preferred_username ?? null,\n    image: profile.picture ?? undefined,\n    ...(profile.status === undefined ? {} : { ssoStatus: profile.status }),\n  };\n}\n"],"mappings":"A,oEAKA,MAAaA,EAAoBC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAE7CC,EAAsBD,EAAE,YAAY,CAC/C,IAAKD,EACL,MAAOC,EAAE,OAAO,CAAC,CAAC,SAAS,EAC3B,KAAMA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACrC,eAAgBA,EAAE,QAAQ,CAAC,CAAC,SAAS,EACrC,mBAAoBA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACnD,QAASA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACxC,OAAQA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC9B,CAAC,EASD,SAAgBE,EACd,EACA,EAAiC,CAAC,EACwC,CAC1E,GACEC,EAAO,qBAAuB,IAAA,KAC7B,CAAC,OAAO,cAAcA,EAAO,kBAAkB,GAAKA,EAAO,mBAAqB,GAEjF,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACL,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,SACzC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChCA,EAAO,IAAO,GACdA,EAAO,KAAQA,EAAO,KACrBF,EAAO,qBAAuB,IAAA,IAC7BE,EAAO,IAAOA,EAAO,IAAOF,EAAO,oBACpCA,EAAO,YAAcE,EAAO,MAAQ,IAAA,IACpCA,EAAO,MAAQ,IAAA,IAAa,CAACN,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,QAEtE,MAAM,IAAID,EAAU,UAAU,CAClC,CAEA,SAAgBE,EACd,EACA,EACM,CACN,GACE,CAACP,EAAkB,UAAUQ,EAAQ,OAAO,CAAC,CAAC,SAC7CA,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,SACxEF,EAAO,MAAQE,EAAQ,SACvBF,EAAO,MAAQE,EAAQ,IAEvB,MAAM,IAAIH,EAAU,UAAU,CAClC,CAEA,SAAgBI,EACd,EACA,EACM,CACN,IAAK,IAAMD,IAAW,CAACE,EAAQC,CAAK,EAClC,GACE,CAACH,EAAQ,GAAIA,EAAQ,OAAQA,EAAQ,OAAO,CAAC,CAAC,KAC3C,GAAU,CAACR,EAAkB,UAAUY,CAAK,CAAC,CAAC,OACjD,GACCJ,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,QAExE,MAAM,IAAIH,EAAU,UAAU,EAElC,GACEK,EAAO,KAAOC,EAAM,IACpBD,EAAO,SAAWC,EAAM,QACxBD,EAAO,UAAYC,EAAM,SACzBD,EAAO,MAAQC,EAAM,IAErB,MAAM,IAAIN,EAAU,UAAU,CAClC,CAEA,SAAgBQ,EAAoB,EAAgB,CAClD,IAAMC,EAASZ,EAAoB,UAAUU,CAAK,EAClD,GAAI,CAACE,EAAO,QAAS,MAAM,IAAIT,EAAU,UAAU,EACnD,IAAMU,EAAUD,EAAO,KACvB,MAAO,CACL,eAAgBC,EAAQ,IACxB,cAAeA,EAAQ,iBAAmB,GAC1C,SAAUA,EAAQ,oBAAsB,KACxC,MAAOA,EAAQ,SAAW,IAAA,GAC1B,GAAIA,EAAQ,SAAW,IAAA,GAAY,CAAC,EAAI,CAAE,UAAWA,EAAQ,MAAO,CACtE,CACF,C"}

package/dist/modules/auth/server/grant-guard.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e.AuthError(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs");function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t.assertSessionContinuity(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=n;

package/dist/modules/auth/server/grant-guard.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}
+{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}
+{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.js

@@ -1,2 +1,2 @@
-import{AuthError as e}from"../interface.js";function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{t as createSessionGrantGuard};
+import{AuthError as e}from"../interface.js";import{assertSessionContinuity as t}from"./claims.js";function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{n as createSessionGrantGuard};
 //# sourceMappingURL=grant-guard.js.map

package/dist/modules/auth/server/grant-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type {\n  AuthSessionBinding,\n  SessionGrantGuardOptions,\n} from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" ||\n          !identifier ||\n          identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" ||\n          !value.sid ||\n          value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        if (\n          before.id !== after.id ||\n          before.userId !== after.userId ||\n          before.subject !== after.subject ||\n          before.sid !== after.sid\n        )\n          throw new AuthError(\"rejected\");\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAOA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UACtB,CAACA,GACDA,EAAW,OAAS,GACxB,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UACpB,CAACA,EAAM,KACPA,EAAM,IAAI,OAAS,MACvB,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EACzB,GACEO,EAAO,KAAOG,EAAM,IACpBH,EAAO,SAAWG,EAAM,QACxBH,EAAO,UAAYG,EAAM,SACzBH,EAAO,MAAQG,EAAM,IAErB,MAAM,IAAIP,EAAU,UAAU,EAEhC,OADAG,GAAQ,eAAe,EAChBE,CACT,OAASG,EAAO,CAGd,MAFIL,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDQ,aAAiBR,EAAiBQ,EAChC,IAAIR,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}
+{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","assertSessionContinuity","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { assertSessionContinuity } from \"@/modules/auth/server/claims\";\nimport type { AuthSessionBinding, SessionGrantGuardOptions } from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" || !identifier || identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" || !value.sid || value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        assertSessionContinuity(before, after);\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,kGAKA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UAAY,CAACA,GAAcA,EAAW,OAAS,GACzE,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UAAY,CAACA,EAAM,KAAOA,EAAM,IAAI,OAAS,MACrE,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EAGzB,OAFAW,EAAwBJ,EAAQG,CAAK,EACrCJ,GAAQ,eAAe,EAChBE,CACT,OAASI,EAAO,CAGd,MAFIN,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDS,aAAiBT,EAAiBS,EAChC,IAAIT,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs");exports.AuthError=e.AuthError,exports.assertMutationOrigin=t.assertMutationOrigin,exports.authCookieOptions=t.authCookieOptions,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.resolveReturnPath=t.resolveReturnPath;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs"),u=require("./bearer.cjs"),d=require("./claims.cjs"),f=require("./provider.cjs"),p=require("./user-info.cjs"),m=require("./machine.cjs");exports.AuthError=e.AuthError,exports.assertAccessTokenClaims=d.assertAccessTokenClaims,exports.assertMutationOrigin=t.assertMutationOrigin,exports.assertSessionContinuity=d.assertSessionContinuity,exports.assertTokenContinuity=d.assertTokenContinuity,exports.authCookieOptions=t.authCookieOptions,exports.authFailure=u.authFailure,exports.authSubjectSchema=d.authSubjectSchema,exports.createAtomicDpopReplayStore=i.createAtomicDpopReplayStore,exports.createAtomicProofStorage=i.createAtomicProofStorage,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createBearerVerifier=u.createBearerVerifier,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createMachineTokenRequest=m.createMachineTokenRequest,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createOAuthProviderConfig=f.createOAuthProviderConfig,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.createUserInfoCache=p.createUserInfoCache,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.machineTokenSchema=m.machineTokenSchema,exports.mapOAuthUserProfile=d.mapOAuthUserProfile,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.normalizeAuthError=u.normalizeAuthError,exports.oauthUserInfoSchema=d.oauthUserInfoSchema,exports.parseMachineToken=m.parseMachineToken,exports.resolveReturnPath=t.resolveReturnPath;

package/dist/modules/auth/server/index.d.cts

@@ -2,11 +2,16 @@ import { AuthError } from "../interface.cjs";
 import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.cjs";
 import { fingerprintAuthValue } from "./crypto.cjs";
 import { createLogoutVerifier } from "./logout.cjs";
-import { createProofReplayStore } from "./proof.cjs";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.cjs";
 import { createResourceAuth } from "./resource.cjs";
 import { createIdentityCache } from "./identity-cache.cjs";
 import { createOAuthIdentityValidator } from "./identity.cjs";
 import { createSessionGrantGuard } from "./grant-guard.cjs";
 import { matchesAuthRevocation } from "./revocation.cjs";
 import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-BR9QNgXO.cjs";
-export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.cjs";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.cjs";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.cjs";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.cjs";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.cjs";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.d.ts

@@ -2,11 +2,16 @@ import { AuthError } from "../interface.js";
 import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.js";
 import { fingerprintAuthValue } from "./crypto.js";
 import { createLogoutVerifier } from "./logout.js";
-import { createProofReplayStore } from "./proof.js";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.js";
 import { createResourceAuth } from "./resource.js";
 import { createIdentityCache } from "./identity-cache.js";
 import { createOAuthIdentityValidator } from "./identity.js";
 import { createSessionGrantGuard } from "./grant-guard.js";
 import { matchesAuthRevocation } from "./revocation.js";
 import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
-export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.js";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.js";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.js";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.js";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.js";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.js

@@ -1 +1 @@
-import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createProofReplayStore as c}from"./proof.js";import{createResourceAuth as l}from"./resource.js";import{createIdentityCache as u}from"./identity-cache.js";import{createOAuthIdentityValidator as d}from"./identity.js";import{createSessionGrantGuard as f}from"./grant-guard.js";import{matchesAuthRevocation as p}from"./revocation.js";export{e as AuthError,t as assertMutationOrigin,n as authCookieOptions,r as createAuthFreshnessPolicy,i as createAuthPolicy,u as createIdentityCache,s as createLogoutVerifier,d as createOAuthIdentityValidator,c as createProofReplayStore,l as createResourceAuth,f as createSessionGrantGuard,o as fingerprintAuthValue,p as matchesAuthRevocation,a as resolveReturnPath};
+import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createAtomicDpopReplayStore as c,createAtomicProofStorage as l,createProofReplayStore as u}from"./proof.js";import{createResourceAuth as d}from"./resource.js";import{createIdentityCache as f}from"./identity-cache.js";import{createOAuthIdentityValidator as p}from"./identity.js";import{createSessionGrantGuard as m}from"./grant-guard.js";import{matchesAuthRevocation as h}from"./revocation.js";import{authFailure as g,createBearerVerifier as _,normalizeAuthError as v}from"./bearer.js";import{assertAccessTokenClaims as y,assertSessionContinuity as b,assertTokenContinuity as x,authSubjectSchema as S,mapOAuthUserProfile as C,oauthUserInfoSchema as w}from"./claims.js";import{createOAuthProviderConfig as T}from"./provider.js";import{createUserInfoCache as E}from"./user-info.js";import{createMachineTokenRequest as D,machineTokenSchema as O,parseMachineToken as k}from"./machine.js";export{e as AuthError,y as assertAccessTokenClaims,t as assertMutationOrigin,b as assertSessionContinuity,x as assertTokenContinuity,n as authCookieOptions,g as authFailure,S as authSubjectSchema,c as createAtomicDpopReplayStore,l as createAtomicProofStorage,r as createAuthFreshnessPolicy,i as createAuthPolicy,_ as createBearerVerifier,f as createIdentityCache,s as createLogoutVerifier,D as createMachineTokenRequest,p as createOAuthIdentityValidator,T as createOAuthProviderConfig,u as createProofReplayStore,d as createResourceAuth,m as createSessionGrantGuard,E as createUserInfoCache,o as fingerprintAuthValue,O as machineTokenSchema,C as mapOAuthUserProfile,h as matchesAuthRevocation,v as normalizeAuthError,w as oauthUserInfoSchema,k as parseMachineToken,a as resolveReturnPath};

package/dist/modules/auth/server/machine.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");let n=require("zod"),r=require("better-auth/oauth2");const i=n.z.object({access_token:n.z.string().min(1).max(32768),token_type:n.z.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.z.number().int().positive(),scope:n.z.string().optional()});async function a(n){try{if(t.parseHttpEndpoint(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t.parseHttpEndpoint(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await(0,r.clientCredentialsTokenRequest)({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:[...new Set(n.scopes)].join(` `),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e.AuthError(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);return n.data}exports.createMachineTokenRequest=a,exports.machineTokenSchema=i,exports.parseMachineToken=o;

package/dist/modules/auth/server/machine.d.cts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.cts.map

package/dist/modules/auth/server/machine.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.cts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.ts.map

package/dist/modules/auth/server/machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.ts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";import{z as n}from"zod";import{clientCredentialsTokenRequest as r}from"better-auth/oauth2";const i=n.object({access_token:n.string().min(1).max(32768),token_type:n.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.number().int().positive(),scope:n.string().optional()});async function a(n){try{if(t(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await r({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:[...new Set(n.scopes)].join(` `),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e(`rejected`);return n.data}export{a as createMachineTokenRequest,i as machineTokenSchema,o as parseMachineToken};
+//# sourceMappingURL=machine.js.map

package/dist/modules/auth/server/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","names":["machineTokenSchema","z","value","createMachineTokenRequest","parseHttpEndpoint","options","scope","resource","request","clientCredentialsTokenRequest","AuthError","parseMachineToken","parsed"],"sources":["../../../../src/modules/auth/server/machine.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport { clientCredentialsTokenRequest } from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nexport const machineTokenSchema = z.object({\n  access_token: z.string().min(1).max(32768),\n  token_type: z.string().refine((value) => value.toLowerCase() === \"bearer\"),\n  expires_in: z.number().int().positive(),\n  scope: z.string().optional(),\n});\nexport type MachineToken = z.infer<typeof machineTokenSchema>;\n\nexport interface MachineTokenRequestOptions {\n  tokenEndpoint: string;\n  clientId: string;\n  clientSecret: string;\n  method: \"client_secret_basic\" | \"client_secret_post\";\n  scopes: readonly string[];\n  resources: readonly string[];\n  allowLoopbackHttp?: boolean;\n}\n\n/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */\nexport async function createMachineTokenRequest(options: MachineTokenRequestOptions) {\n  try {\n    parseHttpEndpoint(options.tokenEndpoint, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    if (\n      !options.clientId ||\n      !options.clientSecret ||\n      !options.scopes.length ||\n      !options.resources.length ||\n      ![\"client_secret_basic\", \"client_secret_post\"].includes(options.method) ||\n      options.scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n    )\n      throw new Error();\n    for (const resource of options.resources)\n      parseHttpEndpoint(resource, { allowLoopbackHttp: options.allowLoopbackHttp });\n    const request = await clientCredentialsTokenRequest({\n      options: { clientId: options.clientId, clientSecret: options.clientSecret },\n      tokenEndpoint: options.tokenEndpoint,\n      tokenEndpointAuth: { method: options.method },\n      scope: [...new Set(options.scopes)].join(\" \"),\n      resource: [...new Set(options.resources)],\n    });\n    return {\n      url: options.tokenEndpoint,\n      method: \"POST\" as const,\n      headers: request.headers,\n      body: request.body,\n      redirect: \"error\" as const,\n      cache: \"no-store\" as const,\n    };\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n}\n\nexport function parseMachineToken(value: unknown): MachineToken {\n  const parsed = machineTokenSchema.safeParse(value);\n  if (!parsed.success) throw new AuthError(\"rejected\");\n  return parsed.data;\n}\n"],"mappings":"A,2MAKA,MAAaA,EAAqBC,EAAE,OAAO,CACzC,aAAcA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EACzC,WAAYA,EAAE,OAAO,CAAC,CAAC,OAAQ,GAAUC,EAAM,YAAY,IAAM,QAAQ,EACzE,WAAYD,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EACtC,MAAOA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC7B,CAAC,EAcD,eAAsBE,EAA0B,EAAqC,CACnF,GAAI,CAIF,GAHAC,EAAkBC,EAAQ,cAAe,CACvC,kBAAmBA,EAAQ,iBAC7B,CAAC,EAEC,CAACA,EAAQ,UACT,CAACA,EAAQ,cACT,CAACA,EAAQ,OAAO,QAChB,CAACA,EAAQ,UAAU,QACnB,CAAC,CAAC,sBAAuB,oBAAoB,CAAC,CAAC,SAASA,EAAQ,MAAM,GACtEA,EAAQ,OAAO,KAAM,GAAU,CAAC,8BAA8B,KAAKC,CAAK,CAAC,EAEzE,MAAU,MAAM,EAClB,IAAK,IAAMC,KAAYF,EAAQ,UAC7BD,EAAkBG,EAAU,CAAE,kBAAmBF,EAAQ,iBAAkB,CAAC,EAC9E,IAAMG,EAAU,MAAMC,EAA8B,CAClD,QAAS,CAAE,SAAUJ,EAAQ,SAAU,aAAcA,EAAQ,YAAa,EAC1E,cAAeA,EAAQ,cACvB,kBAAmB,CAAE,OAAQA,EAAQ,MAAO,EAC5C,MAAO,CAAC,GAAG,IAAI,IAAIA,EAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAC5C,SAAU,CAAC,GAAG,IAAI,IAAIA,EAAQ,SAAS,CAAC,CAC1C,CAAC,EACD,MAAO,CACL,IAAKA,EAAQ,cACb,OAAQ,OACR,QAASG,EAAQ,QACjB,KAAMA,EAAQ,KACd,SAAU,QACV,MAAO,UACT,CACF,MAAQ,CACN,MAAM,IAAIE,EAAU,uBAAuB,CAC7C,CACF,CAEA,SAAgBC,EAAkB,EAA8B,CAC9D,IAAMC,EAASZ,EAAmB,UAAUE,CAAK,EACjD,GAAI,CAACU,EAAO,QAAS,MAAM,IAAIF,EAAU,UAAU,EACnD,OAAOE,EAAO,IAChB,C"}

package/dist/modules/auth/server/proof.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createProofReplayStore=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){return{async reserve(n){let r=n.now.getTime(),i=n.expiresAt.getTime();if(!n.key||n.key.length>2048||!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(i)||i<=r)throw new e.AuthError(`rejected`);try{let e=await t.reserve(n);if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function n(t){return{async consume(n,r){let i=(t.now??Date.now)();if(!n||n.length>2048||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(r)||r<=i)throw new e.AuthError(`rejected`);try{let e=await t.reserve({key:n,expiresAt:r,now:i});if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function r(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createAtomicDpopReplayStore=t,exports.createAtomicProofStorage=n,exports.createProofReplayStore=r;

package/dist/modules/auth/server/proof.d.cts

@@ -1,6 +1,23 @@
 import { N as ProofStorage } from "../../../interface-BR9QNgXO.cjs";
 import "../../../interface-weqBVeUf.cjs";
 import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
 /** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
 export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
 //# sourceMappingURL=proof.d.cts.map

package/dist/modules/auth/server/proof.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;;wBAKgB,uBACd,SAAS,cACT,qBACC"}
+{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;iBAIiB;EACf;EACA;EACA;;iBAGe;;EAEf,SAAS;;;wBAIK,4BACd,SAAS,+BACR;iBAoBc;;EAEf,QAAQ,OAAO,yBAAyB;EACxC;;wBAGc,yBACd,SAAS,4BACR;;wBAyBa,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.d.ts

@@ -1,6 +1,23 @@
 import { N as ProofStorage } from "../../../interface-ii8DV63k.js";
 import "../../../interface-BFsLlmGy.js";
 import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
 /** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
 export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
 //# sourceMappingURL=proof.d.ts.map