@gorth-io/structure 0.0.0-alpha.7 → 0.0.0-alpha.8

package/dist/cores/ably/spaces/index.cjs

@@ -1 +1 @@
-const e=require("../../../rolldown-runtime-BocRIvOZ.cjs");let t=require("@ably/spaces");t=e.t(t,1),module.exports=t.default,Object.keys(t).forEach(function(e){e!=="default"&&!Object.prototype.hasOwnProperty.call(exports,e)&&Object.defineProperty(exports,e,{enumerable:!0,get:function(){return t[e]}})});
+var e=require("@ably/spaces");Object.keys(e).forEach(function(t){t!=="default"&&!Object.prototype.hasOwnProperty.call(exports,t)&&Object.defineProperty(exports,t,{enumerable:!0,get:function(){return e[t]}})});

package/dist/cores/ably/spaces/index.d.cts

@@ -1,3 +1 @@
-import spaces_default from "@ably/spaces";
-export * from "@ably/spaces";
-export { spaces_default as default };
+export * from "@ably/spaces";

package/dist/cores/ably/spaces/index.d.ts

@@ -1,3 +1 @@
-import spaces_default from "@ably/spaces";
-export * from "@ably/spaces";
-export { spaces_default as default };
+export * from "@ably/spaces";

package/dist/cores/ably/spaces/index.js

@@ -1 +1 @@
-export{default}from"@ably/spaces";export*from"@ably/spaces";
+export*from"@ably/spaces";export{};

package/dist/modules/auth/server/bearer.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs"),n=require("../../../utils/normalization.cjs");let r=require("better-auth/oauth2");function i(t){if(t instanceof e.AuthError)return t;if((0,r.isInsufficientScopeError)(t))return new e.AuthError(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e.AuthError(`rejected`):n?.statusCode===403?new e.AuthError(`forbidden`):new e.AuthError(`unavailable`)}function a(e){if((0,r.isInsufficientScopeError)(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=i(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function o(a){let{verification:o}=a;try{if(!o.jwksUrl||o.remoteVerify)throw Error();n.parseHttpEndpoint(o.jwksUrl,{allowLoopbackHttp:a.allowLoopbackHttp});for(let e of[o.verifyOptions.issuer,o.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e.AuthError(`invalid_configuration`)}let s={...o,requiredScopes:o.requiredScopes&&[...o.requiredScopes],verifyOptions:{...o.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(o.verifyOptions.issuer)?[...o.verifyOptions.issuer]:o.verifyOptions.issuer,audience:Array.isArray(o.verifyOptions.audience)?[...o.verifyOptions.audience]:o.verifyOptions.audience,algorithms:[...o.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...o.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let i=(0,r.requestToResourceInput)(n);if(!i.authorizationHeader||!/^Bearer [^\s]+$/i.test(i.authorizationHeader))throw new e.AuthError(`rejected`);i.authorizationHeader=`Bearer `+i.authorizationHeader.slice(7);let o=await(0,r.verifyAccessTokenRequest)(i,s);return t.assertAccessTokenClaims(o,a.claims),await a.authorize?.(o,n),o}catch(e){throw(0,r.isInsufficientScopeError)(e)?e:i(e)}}}exports.authFailure=a,exports.createBearerVerifier=o,exports.normalizeAuthError=i;

package/dist/modules/auth/server/bearer.d.cts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.cjs";
+import { AccessTokenClaimPolicy } from "./claims.cjs";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.cts.map

package/dist/modules/auth/server/bearer.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.cts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAciB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.d.ts

@@ -0,0 +1,25 @@
+import { AuthError } from "../interface.js";
+import { AccessTokenClaimPolicy } from "./claims.js";
+import { JWTPayload } from "jose";
+import { VerifyAccessTokenOptions } from "better-auth/oauth2";
+export interface AuthFailure {
+  status: number;
+  code: string;
+  headers?: Record<string, string>;
+}
+export declare function normalizeAuthError(error: unknown): AuthError;
+/** Sanitized framework-neutral projection; never includes SDK/transport causes. */
+export declare function authFailure(error: unknown): AuthFailure;
+export interface BearerVerifierOptions {
+  verification: VerifyAccessTokenOptions;
+  claims?: AccessTokenClaimPolicy;
+  allowLoopbackHttp?: boolean;
+  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;
+}
+/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */
+export declare function createBearerVerifier(options: BearerVerifierOptions): (request: Request) => Promise<JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+}>;
+//# sourceMappingURL=bearer.d.ts.map

package/dist/modules/auth/server/bearer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.d.ts","names":[],"sources":["../../../../src/modules/auth/server/bearer.ts"],"mappings":";;;;iBAciB;EACf;EACA;EACA,UAAU;;wBAGI,mBAAmB,iBAAiB;;wBAepC,YAAY,iBAAiB;iBAkB5B;EACf,cAAc;EACd,SAAS;EACT;EACA,WAAW,QAAQ,YAAY,SAAS,iBAAiB;;;wBAI3C,qBAAqB,SAAS,yBAwDf,SAAS,YAAO,QAAA"}

package/dist/modules/auth/server/bearer.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{assertAccessTokenClaims as t}from"./claims.js";import{parseHttpEndpoint as n}from"../../../utils/normalization.js";import{isInsufficientScopeError as r,requestToResourceInput as i,verifyAccessTokenRequest as a}from"better-auth/oauth2";function o(t){if(t instanceof e)return t;if(r(t))return new e(`forbidden`);let n=t;return n?.statusCode===401||typeof n?.code==`string`&&/^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(n.code)?new e(`rejected`):n?.statusCode===403?new e(`forbidden`):new e(`unavailable`)}function s(e){if(r(e))return{status:403,code:`insufficient_scope`,headers:{"WWW-Authenticate":`Bearer error="insufficient_scope"`}};let t=o(e);return t.code===`rejected`?{status:401,code:`invalid_access_token`,headers:{"WWW-Authenticate":`Bearer error="invalid_token"`}}:t.code===`forbidden`?{status:403,code:`forbidden`}:{status:503,code:`auth_unavailable`}}function c(s){let{verification:c}=s;try{if(!c.jwksUrl||c.remoteVerify)throw Error();n(c.jwksUrl,{allowLoopbackHttp:s.allowLoopbackHttp});for(let e of[c.verifyOptions.issuer,c.verifyOptions.audience]){let t=Array.isArray(e)?e:[e];if(!t.length||t.some(e=>typeof e!=`string`||!e))throw Error()}let e=c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`];if(!e.length||e.some(e=>![`RS256`,`ES256`,`EdDSA`].includes(e)))throw Error()}catch{throw new e(`invalid_configuration`)}let l={...c,requiredScopes:c.requiredScopes&&[...c.requiredScopes],verifyOptions:{...c.verifyOptions,typ:`at+jwt`,issuer:Array.isArray(c.verifyOptions.issuer)?[...c.verifyOptions.issuer]:c.verifyOptions.issuer,audience:Array.isArray(c.verifyOptions.audience)?[...c.verifyOptions.audience]:c.verifyOptions.audience,algorithms:[...c.verifyOptions.algorithms??[`RS256`,`ES256`,`EdDSA`]],requiredClaims:[.../* @__PURE__ */ new Set([...c.verifyOptions.requiredClaims??[],`iss`,`aud`,`sub`,`iat`,`exp`])]}};return async function(n){try{let r=i(n);if(!r.authorizationHeader||!/^Bearer [^\s]+$/i.test(r.authorizationHeader))throw new e(`rejected`);r.authorizationHeader=`Bearer `+r.authorizationHeader.slice(7);let o=await a(r,l);return t(o,s.claims),await s.authorize?.(o,n),o}catch(e){throw r(e)?e:o(e)}}}export{s as authFailure,c as createBearerVerifier,o as normalizeAuthError};
+//# sourceMappingURL=bearer.js.map

package/dist/modules/auth/server/bearer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bearer.js","names":["normalizeAuthError","error","AuthError","isInsufficientScopeError","value","authFailure","failure","createBearerVerifier","options","verification","parseHttpEndpoint","values","v","algorithms","a","native","input","requestToResourceInput","request","claims","verifyAccessTokenRequest","assertAccessTokenClaims"],"sources":["../../../../src/modules/auth/server/bearer.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport {\n  assertAccessTokenClaims,\n  type AccessTokenClaimPolicy,\n} from \"@/modules/auth/server/claims\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport {\n  isInsufficientScopeError,\n  requestToResourceInput,\n  verifyAccessTokenRequest,\n  type VerifyAccessTokenOptions,\n} from \"better-auth/oauth2\";\nimport type { JWTPayload } from \"jose\";\n\nexport interface AuthFailure {\n  status: number;\n  code: string;\n  headers?: Record<string, string>;\n}\n\nexport function normalizeAuthError(error: unknown): AuthError {\n  if (error instanceof AuthError) return error;\n  if (isInsufficientScopeError(error)) return new AuthError(\"forbidden\");\n  const value = error as { statusCode?: unknown; code?: unknown } | null;\n  if (\n    value?.statusCode === 401 ||\n    (typeof value?.code === \"string\" &&\n      /^(ERR_JWT|ERR_JWS|ERR_JOSE|ERR_JWKS_NO_MATCHING_KEY)/.test(value.code))\n  )\n    return new AuthError(\"rejected\");\n  if (value?.statusCode === 403) return new AuthError(\"forbidden\");\n  return new AuthError(\"unavailable\");\n}\n\n/** Sanitized framework-neutral projection; never includes SDK/transport causes. */\nexport function authFailure(error: unknown): AuthFailure {\n  if (isInsufficientScopeError(error))\n    return {\n      status: 403,\n      code: \"insufficient_scope\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"insufficient_scope\"' },\n    };\n  const failure = normalizeAuthError(error);\n  if (failure.code === \"rejected\")\n    return {\n      status: 401,\n      code: \"invalid_access_token\",\n      headers: { \"WWW-Authenticate\": 'Bearer error=\"invalid_token\"' },\n    };\n  if (failure.code === \"forbidden\") return { status: 403, code: \"forbidden\" };\n  return { status: 503, code: \"auth_unavailable\" };\n}\n\nexport interface BearerVerifierOptions {\n  verification: VerifyAccessTokenOptions;\n  claims?: AccessTokenClaimPolicy;\n  allowLoopbackHttp?: boolean;\n  authorize?(claims: JWTPayload, request: Request): void | Promise<void>;\n}\n\n/** JWT Bearer-only APIs. Use createResourceAuth with durable proof storage for DPoP. */\nexport function createBearerVerifier(options: BearerVerifierOptions) {\n  const { verification } = options;\n  try {\n    if (!verification.jwksUrl || verification.remoteVerify) throw new Error();\n    parseHttpEndpoint(verification.jwksUrl, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    for (const value of [\n      verification.verifyOptions.issuer,\n      verification.verifyOptions.audience,\n    ]) {\n      const values = Array.isArray(value) ? value : [value];\n      if (!values.length || values.some((v) => typeof v !== \"string\" || !v))\n        throw new Error();\n    }\n    const algorithms = verification.verifyOptions.algorithms ?? [\n      \"RS256\",\n      \"ES256\",\n      \"EdDSA\",\n    ];\n    if (\n      !algorithms.length ||\n      algorithms.some((a) => ![\"RS256\", \"ES256\", \"EdDSA\"].includes(a))\n    )\n      throw new Error();\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n  // Snapshot mutable host options so later changes cannot weaken verification.\n  const native: VerifyAccessTokenOptions = {\n    ...verification,\n    requiredScopes: verification.requiredScopes && [...verification.requiredScopes],\n    verifyOptions: {\n      ...verification.verifyOptions,\n      typ: \"at+jwt\",\n      issuer: Array.isArray(verification.verifyOptions.issuer)\n        ? [...verification.verifyOptions.issuer]\n        : verification.verifyOptions.issuer,\n      audience: Array.isArray(verification.verifyOptions.audience)\n        ? [...verification.verifyOptions.audience]\n        : verification.verifyOptions.audience,\n      algorithms: [\n        ...(verification.verifyOptions.algorithms ?? [\"RS256\", \"ES256\", \"EdDSA\"]),\n      ],\n      requiredClaims: [\n        ...new Set([\n          ...(verification.verifyOptions.requiredClaims ?? []),\n          \"iss\",\n          \"aud\",\n          \"sub\",\n          \"iat\",\n          \"exp\",\n        ]),\n      ],\n    },\n  };\n  return async function verify(request: Request) {\n    try {\n      const input = requestToResourceInput(request);\n      if (\n        !input.authorizationHeader ||\n        !/^Bearer [^\\s]+$/i.test(input.authorizationHeader)\n      )\n        throw new AuthError(\"rejected\");\n      input.authorizationHeader = \"Bearer \" + input.authorizationHeader.slice(7);\n      const claims = await verifyAccessTokenRequest(input, native);\n      assertAccessTokenClaims(claims, options.claims);\n      await options.authorize?.(claims, request);\n      return claims;\n    } catch (error) {\n      // Keep the SDK's typed scope error so the adapter can issue RFC 6750's challenge.\n      if (isInsufficientScopeError(error)) throw error;\n      throw normalizeAuthError(error);\n    }\n  };\n}\n"],"mappings":"A,8RAoBA,SAAgBA,EAAmB,EAA2B,CAC5D,GAAIC,aAAiBC,EAAW,OAAOD,EACvC,GAAIE,EAAyBF,CAAK,EAAG,OAAO,IAAIC,EAAU,WAAW,EACrE,IAAME,EAAQH,EAQd,OANEG,GAAO,aAAe,KACrB,OAAOA,GAAO,MAAS,UACtB,uDAAuD,KAAKA,EAAM,IAAI,EAEjE,IAAIF,EAAU,UAAU,EAC7BE,GAAO,aAAe,IAAY,IAAIF,EAAU,WAAW,EACxD,IAAIA,EAAU,aAAa,CACpC,CAGA,SAAgBG,EAAY,EAA6B,CACvD,GAAIF,EAAyBF,CAAK,EAChC,MAAO,CACL,OAAQ,IACR,KAAM,qBACN,QAAS,CAAE,mBAAoB,mCAAoC,CACrE,EACF,IAAMK,EAAUN,EAAmBC,CAAK,EAQxC,OAPIK,EAAQ,OAAS,WACZ,CACL,OAAQ,IACR,KAAM,uBACN,QAAS,CAAE,mBAAoB,8BAA+B,CAChE,EACEA,EAAQ,OAAS,YAAoB,CAAE,OAAQ,IAAK,KAAM,WAAY,EACnE,CAAE,OAAQ,IAAK,KAAM,kBAAmB,CACjD,CAUA,SAAgBC,EAAqB,EAAgC,CACnE,GAAM,CAAE,gBAAiBC,EACzB,GAAI,CACF,GAAI,CAACC,EAAa,SAAWA,EAAa,aAAc,MAAU,MAAM,EACxEC,EAAkBD,EAAa,QAAS,CACtC,kBAAmBD,EAAQ,iBAC7B,CAAC,EACD,IAAK,IAAMJ,IAAS,CAClBK,EAAa,cAAc,OAC3BA,EAAa,cAAc,QAC7B,EAAG,CACD,IAAME,EAAS,MAAM,QAAQP,CAAK,EAAIA,EAAQ,CAACA,CAAK,EACpD,GAAI,CAACO,EAAO,QAAUA,EAAO,KAAM,GAAM,OAAOC,GAAM,UAAY,CAACA,CAAC,EAClE,MAAU,MAAM,CACpB,CACA,IAAMC,EAAaJ,EAAa,cAAc,YAAc,CAC1D,QACA,QACA,OACF,EACA,GACE,CAACI,EAAW,QACZA,EAAW,KAAM,GAAM,CAAC,CAAC,QAAS,QAAS,OAAO,CAAC,CAAC,SAASC,CAAC,CAAC,EAE/D,MAAU,MAAM,CACpB,MAAQ,CACN,MAAM,IAAIZ,EAAU,uBAAuB,CAC7C,CAEA,IAAMa,EAAmC,CACvC,GAAGN,EACH,eAAgBA,EAAa,gBAAkB,CAAC,GAAGA,EAAa,cAAc,EAC9E,cAAe,CACb,GAAGA,EAAa,cAChB,IAAK,SACL,OAAQ,MAAM,QAAQA,EAAa,cAAc,MAAM,EACnD,CAAC,GAAGA,EAAa,cAAc,MAAM,EACrCA,EAAa,cAAc,OAC/B,SAAU,MAAM,QAAQA,EAAa,cAAc,QAAQ,EACvD,CAAC,GAAGA,EAAa,cAAc,QAAQ,EACvCA,EAAa,cAAc,SAC/B,WAAY,CACV,GAAIA,EAAa,cAAc,YAAc,CAAC,QAAS,QAAS,OAAO,CACzE,EACA,eAAgB,CACd,mBAAG,IAAI,IAAI,CACT,GAAIA,EAAa,cAAc,gBAAkB,CAAC,EAClD,MACA,MACA,MACA,MACA,KACF,CAAC,CACH,CACF,CACF,EACA,OAAO,eAAsB,EAAkB,CAC7C,GAAI,CACF,IAAMO,EAAQC,EAAuBC,CAAO,EAC5C,GACE,CAACF,EAAM,qBACP,CAAC,mBAAmB,KAAKA,EAAM,mBAAmB,EAElD,MAAM,IAAId,EAAU,UAAU,EAChC,EAAM,oBAAsB,UAAYc,EAAM,oBAAoB,MAAM,CAAC,EACzE,IAAMG,EAAS,MAAMC,EAAyBJ,EAAOD,CAAM,EAG3D,OAFAM,EAAwBF,EAAQX,EAAQ,MAAM,EAC9C,MAAMA,EAAQ,YAAYW,EAAQD,CAAO,EAClCC,CACT,OAASlB,EAAO,CAGd,MADIE,EAAyBF,CAAK,EAASA,EACrCD,EAAmBC,CAAK,CAChC,CACF,CACF,C"}

package/dist/modules/auth/server/claims.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");let t=require("zod");const n=t.z.string().min(1).max(255),r=t.z.looseObject({sub:n,email:t.z.string().optional(),name:t.z.string().nullable().optional(),email_verified:t.z.boolean().optional(),preferred_username:t.z.string().nullable().optional(),picture:t.z.string().nullable().optional(),status:t.z.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e.AuthError(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e.AuthError(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e.AuthError(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e.AuthError(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}exports.assertAccessTokenClaims=i,exports.assertSessionContinuity=o,exports.assertTokenContinuity=a,exports.authSubjectSchema=n,exports.mapOAuthUserProfile=s,exports.oauthUserInfoSchema=r;

package/dist/modules/auth/server/claims.d.cts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-BR9QNgXO.cjs";
+import { JWTPayload } from "jose";
+import { z } from "zod";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.cts.map

package/dist/modules/auth/server/claims.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.cts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.d.ts

@@ -0,0 +1,37 @@
+import { d as AuthSessionBinding } from "../../../interface-ii8DV63k.js";
+import { z } from "zod";
+import { JWTPayload } from "jose";
+export declare const authSubjectSchema: z.ZodString;
+/** Profile shape only. Status/roles and admission policy belong to the application. */
+export declare const oauthUserInfoSchema: z.ZodObject<{
+  sub: z.ZodString;
+  email: z.ZodOptional<z.ZodString>;
+  name: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  email_verified: z.ZodOptional<z.ZodBoolean>;
+  preferred_username: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  picture: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+  status: z.ZodOptional<z.ZodString>;
+}, z.core.$loose>;
+export type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;
+export interface AccessTokenClaimPolicy {
+  requireSid?: boolean;
+  maxLifetimeSeconds?: number;
+}
+/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */
+export declare function assertAccessTokenClaims(claims: JWTPayload, policy?: AccessTokenClaimPolicy): asserts claims is JWTPayload & {
+  sub: string;
+  iat: number;
+  exp: number;
+};
+export declare function assertTokenContinuity(claims: Pick<JWTPayload, "sub"> & {
+  sid?: unknown;
+}, binding: Pick<AuthSessionBinding, "subject" | "sid">): void;
+export declare function assertSessionContinuity(before: Readonly<AuthSessionBinding>, after: Readonly<AuthSessionBinding>): void;
+export declare function mapOAuthUserProfile(value: unknown): {
+  ssoStatus?: string | undefined;
+  externalUserId: string;
+  emailVerified: boolean;
+  username: string | null;
+  image: string | undefined;
+};
+//# sourceMappingURL=claims.d.ts.map

package/dist/modules/auth/server/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","names":[],"sources":["../../../../src/modules/auth/server/claims.ts"],"mappings":";;;qBAKa,mBAAiB,EAAA;;qBAEjB,qBAAmB,EAAA;;;;;;;;GAQ9B,EAAA,KAAA;YACU,gBAAgB,EAAE,aAAa;iBAE1B;EACf;EACA;;;wBAIc,wBACd,QAAQ,YACR,SAAQ,iCACC,UAAU;EAAe;EAAa;EAAa;;wBAoB9C,sBACd,QAAQ,KAAK;EAAuB;GACpC,SAAS,KAAK;wBAWA,wBACd,QAAQ,SAAS,qBACjB,OAAO,SAAS;wBAoBF,oBAAoB"}

package/dist/modules/auth/server/claims.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{z as t}from"zod";const n=t.string().min(1).max(255),r=t.looseObject({sub:n,email:t.string().optional(),name:t.string().nullable().optional(),email_verified:t.boolean().optional(),preferred_username:t.string().nullable().optional(),picture:t.string().nullable().optional(),status:t.string().optional()});function i(t,r={}){if(r.maxLifetimeSeconds!==void 0&&(!Number.isSafeInteger(r.maxLifetimeSeconds)||r.maxLifetimeSeconds<1))throw new e(`invalid_configuration`);if(!n.safeParse(t.sub).success||!Number.isSafeInteger(t.iat)||!Number.isSafeInteger(t.exp)||t.iat<0||t.exp<=t.iat||r.maxLifetimeSeconds!==void 0&&t.exp-t.iat>r.maxLifetimeSeconds||r.requireSid&&t.sid===void 0||t.sid!==void 0&&!n.safeParse(t.sid).success)throw new e(`rejected`)}function a(t,r){if(!n.safeParse(r.subject).success||r.sid!==void 0&&!n.safeParse(r.sid).success||t.sub!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function o(t,r){for(let i of[t,r])if([i.id,i.userId,i.subject].some(e=>!n.safeParse(e).success)||i.sid!==void 0&&!n.safeParse(i.sid).success)throw new e(`rejected`);if(t.id!==r.id||t.userId!==r.userId||t.subject!==r.subject||t.sid!==r.sid)throw new e(`rejected`)}function s(t){let n=r.safeParse(t);if(!n.success)throw new e(`rejected`);let i=n.data;return{externalUserId:i.sub,emailVerified:i.email_verified===!0,username:i.preferred_username??null,image:i.picture??void 0,...i.status===void 0?{}:{ssoStatus:i.status}}}export{i as assertAccessTokenClaims,o as assertSessionContinuity,a as assertTokenContinuity,n as authSubjectSchema,s as mapOAuthUserProfile,r as oauthUserInfoSchema};
+//# sourceMappingURL=claims.js.map

package/dist/modules/auth/server/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","names":["authSubjectSchema","z","oauthUserInfoSchema","assertAccessTokenClaims","policy","AuthError","claims","assertTokenContinuity","binding","assertSessionContinuity","before","after","value","mapOAuthUserProfile","result","profile"],"sources":["../../../../src/modules/auth/server/claims.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { AuthSessionBinding } from \"@/utils/interface\";\nimport type { JWTPayload } from \"jose\";\nimport { z } from \"zod\";\n\nexport const authSubjectSchema = z.string().min(1).max(255);\n/** Profile shape only. Status/roles and admission policy belong to the application. */\nexport const oauthUserInfoSchema = z.looseObject({\n  sub: authSubjectSchema,\n  email: z.string().optional(),\n  name: z.string().nullable().optional(),\n  email_verified: z.boolean().optional(),\n  preferred_username: z.string().nullable().optional(),\n  picture: z.string().nullable().optional(),\n  status: z.string().optional(),\n});\nexport type OAuthUserInfo = z.infer<typeof oauthUserInfoSchema>;\n\nexport interface AccessTokenClaimPolicy {\n  requireSid?: boolean;\n  maxLifetimeSeconds?: number;\n}\n\n/** Only call AFTER native SDK signature, issuer, audience, time and scope checks. */\nexport function assertAccessTokenClaims(\n  claims: JWTPayload,\n  policy: AccessTokenClaimPolicy = {},\n): asserts claims is JWTPayload & { sub: string; iat: number; exp: number } {\n  if (\n    policy.maxLifetimeSeconds !== undefined &&\n    (!Number.isSafeInteger(policy.maxLifetimeSeconds) || policy.maxLifetimeSeconds < 1)\n  )\n    throw new AuthError(\"invalid_configuration\");\n  if (\n    !authSubjectSchema.safeParse(claims.sub).success ||\n    !Number.isSafeInteger(claims.iat) ||\n    !Number.isSafeInteger(claims.exp) ||\n    claims.iat! < 0 ||\n    claims.exp! <= claims.iat! ||\n    (policy.maxLifetimeSeconds !== undefined &&\n      claims.exp! - claims.iat! > policy.maxLifetimeSeconds) ||\n    (policy.requireSid && claims.sid === undefined) ||\n    (claims.sid !== undefined && !authSubjectSchema.safeParse(claims.sid).success)\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertTokenContinuity(\n  claims: Pick<JWTPayload, \"sub\"> & { sid?: unknown },\n  binding: Pick<AuthSessionBinding, \"subject\" | \"sid\">,\n): void {\n  if (\n    !authSubjectSchema.safeParse(binding.subject).success ||\n    (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success) ||\n    claims.sub !== binding.subject ||\n    claims.sid !== binding.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function assertSessionContinuity(\n  before: Readonly<AuthSessionBinding>,\n  after: Readonly<AuthSessionBinding>,\n): void {\n  for (const binding of [before, after]) {\n    if (\n      [binding.id, binding.userId, binding.subject].some(\n        (value) => !authSubjectSchema.safeParse(value).success,\n      ) ||\n      (binding.sid !== undefined && !authSubjectSchema.safeParse(binding.sid).success)\n    )\n      throw new AuthError(\"rejected\");\n  }\n  if (\n    before.id !== after.id ||\n    before.userId !== after.userId ||\n    before.subject !== after.subject ||\n    before.sid !== after.sid\n  )\n    throw new AuthError(\"rejected\");\n}\n\nexport function mapOAuthUserProfile(value: unknown) {\n  const result = oauthUserInfoSchema.safeParse(value);\n  if (!result.success) throw new AuthError(\"rejected\");\n  const profile = result.data;\n  return {\n    externalUserId: profile.sub,\n    emailVerified: profile.email_verified === true,\n    username: profile.preferred_username ?? null,\n    image: profile.picture ?? undefined,\n    ...(profile.status === undefined ? {} : { ssoStatus: profile.status }),\n  };\n}\n"],"mappings":"A,oEAKA,MAAaA,EAAoBC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,EAE7CC,EAAsBD,EAAE,YAAY,CAC/C,IAAKD,EACL,MAAOC,EAAE,OAAO,CAAC,CAAC,SAAS,EAC3B,KAAMA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACrC,eAAgBA,EAAE,QAAQ,CAAC,CAAC,SAAS,EACrC,mBAAoBA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACnD,QAASA,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,SAAS,EACxC,OAAQA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC9B,CAAC,EASD,SAAgBE,EACd,EACA,EAAiC,CAAC,EACwC,CAC1E,GACEC,EAAO,qBAAuB,IAAA,KAC7B,CAAC,OAAO,cAAcA,EAAO,kBAAkB,GAAKA,EAAO,mBAAqB,GAEjF,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACL,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,SACzC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChC,CAAC,OAAO,cAAcA,EAAO,GAAG,GAChCA,EAAO,IAAO,GACdA,EAAO,KAAQA,EAAO,KACrBF,EAAO,qBAAuB,IAAA,IAC7BE,EAAO,IAAOA,EAAO,IAAOF,EAAO,oBACpCA,EAAO,YAAcE,EAAO,MAAQ,IAAA,IACpCA,EAAO,MAAQ,IAAA,IAAa,CAACN,EAAkB,UAAUM,EAAO,GAAG,CAAC,CAAC,QAEtE,MAAM,IAAID,EAAU,UAAU,CAClC,CAEA,SAAgBE,EACd,EACA,EACM,CACN,GACE,CAACP,EAAkB,UAAUQ,EAAQ,OAAO,CAAC,CAAC,SAC7CA,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,SACxEF,EAAO,MAAQE,EAAQ,SACvBF,EAAO,MAAQE,EAAQ,IAEvB,MAAM,IAAIH,EAAU,UAAU,CAClC,CAEA,SAAgBI,EACd,EACA,EACM,CACN,IAAK,IAAMD,IAAW,CAACE,EAAQC,CAAK,EAClC,GACE,CAACH,EAAQ,GAAIA,EAAQ,OAAQA,EAAQ,OAAO,CAAC,CAAC,KAC3C,GAAU,CAACR,EAAkB,UAAUY,CAAK,CAAC,CAAC,OACjD,GACCJ,EAAQ,MAAQ,IAAA,IAAa,CAACR,EAAkB,UAAUQ,EAAQ,GAAG,CAAC,CAAC,QAExE,MAAM,IAAIH,EAAU,UAAU,EAElC,GACEK,EAAO,KAAOC,EAAM,IACpBD,EAAO,SAAWC,EAAM,QACxBD,EAAO,UAAYC,EAAM,SACzBD,EAAO,MAAQC,EAAM,IAErB,MAAM,IAAIN,EAAU,UAAU,CAClC,CAEA,SAAgBQ,EAAoB,EAAgB,CAClD,IAAMC,EAASZ,EAAoB,UAAUU,CAAK,EAClD,GAAI,CAACE,EAAO,QAAS,MAAM,IAAIT,EAAU,UAAU,EACnD,IAAMU,EAAUD,EAAO,KACvB,MAAO,CACL,eAAgBC,EAAQ,IACxB,cAAeA,EAAQ,iBAAmB,GAC1C,SAAUA,EAAQ,oBAAsB,KACxC,MAAOA,EAAQ,SAAW,IAAA,GAC1B,GAAIA,EAAQ,SAAW,IAAA,GAAY,CAAC,EAAI,CAAE,UAAWA,EAAQ,MAAO,CACtE,CACF,C"}

package/dist/modules/auth/server/grant-guard.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e.AuthError(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("./claims.cjs");function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e.AuthError(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e.AuthError(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t.assertSessionContinuity(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e.AuthError(`cancelled`):t instanceof e.AuthError?t:new e.AuthError(`unavailable`)}}}}exports.createSessionGrantGuard=n;

package/dist/modules/auth/server/grant-guard.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}
+{"version":3,"file":"grant-guard.d.cts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAOgB,wBAAwB,SAAS;EA4BnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}
+{"version":3,"file":"grant-guard.d.ts","names":[],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"mappings":";;wBAKgB,wBAAwB,SAAS;EAwBnC,IAAA,OAAK,YACD,SAAS,SAAS,wBAAwB,QAAQ,QAAM,SAC3D,cACR,QAAQ"}

package/dist/modules/auth/server/grant-guard.js

@@ -1,2 +1,2 @@
-import{AuthError as e}from"../interface.js";function t(t){let n=t.now??Date.now;async function r(){let r=await t.read(),i=n();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!r||[r.id,r.userId,r.subject].some(e=>typeof e!=`string`||!e||e.length>255)||r.sid!==void 0&&(typeof r.sid!=`string`||!r.sid||r.sid.length>255)||!Number.isSafeInteger(r.expiresAt)||r.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...r});return await t.assertAllowed(a),a}return{async run(t,n){try{n?.throwIfAborted();let i=await r();n?.throwIfAborted();let a=await t(i);n?.throwIfAborted();let o=await r();if(i.id!==o.id||i.userId!==o.userId||i.subject!==o.subject||i.sid!==o.sid)throw new e(`rejected`);return n?.throwIfAborted(),a}catch(t){throw n?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{t as createSessionGrantGuard};
+import{AuthError as e}from"../interface.js";import{assertSessionContinuity as t}from"./claims.js";function n(n){let r=n.now??Date.now;async function i(){let t=await n.read(),i=r();if(!Number.isSafeInteger(i)||i<0)throw new e(`invalid_configuration`);if(!t||[t.id,t.userId,t.subject].some(e=>typeof e!=`string`||!e||e.length>255)||t.sid!==void 0&&(typeof t.sid!=`string`||!t.sid||t.sid.length>255)||!Number.isSafeInteger(t.expiresAt)||t.expiresAt<=i)throw new e(`rejected`);let a=Object.freeze({...t});return await n.assertAllowed(a),a}return{async run(n,r){try{r?.throwIfAborted();let e=await i();r?.throwIfAborted();let a=await n(e);r?.throwIfAborted();let o=await i();return t(e,o),r?.throwIfAborted(),a}catch(t){throw r?.aborted?new e(`cancelled`):t instanceof e?t:new e(`unavailable`)}}}}export{n as createSessionGrantGuard};
 //# sourceMappingURL=grant-guard.js.map

package/dist/modules/auth/server/grant-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type {\n  AuthSessionBinding,\n  SessionGrantGuardOptions,\n} from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" ||\n          !identifier ||\n          identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" ||\n          !value.sid ||\n          value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        if (\n          before.id !== after.id ||\n          before.userId !== after.userId ||\n          before.subject !== after.subject ||\n          before.sid !== after.sid\n        )\n          throw new AuthError(\"rejected\");\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAOA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UACtB,CAACA,GACDA,EAAW,OAAS,GACxB,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UACpB,CAACA,EAAM,KACPA,EAAM,IAAI,OAAS,MACvB,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EACzB,GACEO,EAAO,KAAOG,EAAM,IACpBH,EAAO,SAAWG,EAAM,QACxBH,EAAO,UAAYG,EAAM,SACzBH,EAAO,MAAQG,EAAM,IAErB,MAAM,IAAIP,EAAU,UAAU,EAEhC,OADAG,GAAQ,eAAe,EAChBE,CACT,OAASG,EAAO,CAGd,MAFIL,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDQ,aAAiBR,EAAiBQ,EAChC,IAAIR,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}
+{"version":3,"file":"grant-guard.js","names":["createSessionGrantGuard","now","options","read","value","time","AuthError","identifier","binding","signal","before","result","operation","after","assertSessionContinuity","error"],"sources":["../../../../src/modules/auth/server/grant-guard.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { assertSessionContinuity } from \"@/modules/auth/server/claims\";\nimport type { AuthSessionBinding, SessionGrantGuardOptions } from \"@/utils/interface\";\n\n/** Surround SDK getAccessToken/proxy operations; never implement token refresh here. */\nexport function createSessionGrantGuard(options: SessionGrantGuardOptions) {\n  const now = options.now ?? Date.now;\n  async function read(): Promise<Readonly<AuthSessionBinding>> {\n    const value = await options.read();\n    const time = now();\n    if (!Number.isSafeInteger(time) || time < 0)\n      throw new AuthError(\"invalid_configuration\");\n    if (\n      !value ||\n      [value.id, value.userId, value.subject].some(\n        (identifier) =>\n          typeof identifier !== \"string\" || !identifier || identifier.length > 255,\n      ) ||\n      (value.sid !== undefined &&\n        (typeof value.sid !== \"string\" || !value.sid || value.sid.length > 255)) ||\n      !Number.isSafeInteger(value.expiresAt) ||\n      value.expiresAt <= time\n    )\n      throw new AuthError(\"rejected\");\n    const binding = Object.freeze({ ...value });\n    await options.assertAllowed(binding);\n    return binding;\n  }\n  return {\n    async run<Value>(\n      operation: (binding: Readonly<AuthSessionBinding>) => Promise<Value>,\n      signal?: AbortSignal,\n    ): Promise<Value> {\n      try {\n        signal?.throwIfAborted();\n        const before = await read();\n        signal?.throwIfAborted();\n        const result = await operation(before);\n        signal?.throwIfAborted();\n        const after = await read();\n        assertSessionContinuity(before, after);\n        signal?.throwIfAborted();\n        return result;\n      } catch (error) {\n        if (signal?.aborted) throw new AuthError(\"cancelled\");\n        if (error instanceof AuthError) throw error;\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,kGAKA,SAAgBA,EAAwB,EAAmC,CACzE,IAAMC,EAAMC,EAAQ,KAAO,KAAK,IAChC,eAAeC,GAA8C,CAC3D,IAAMC,EAAQ,MAAMF,EAAQ,KAAK,EAC3BG,EAAOJ,EAAI,EACjB,GAAI,CAAC,OAAO,cAAcI,CAAI,GAAKA,EAAO,EACxC,MAAM,IAAIC,EAAU,uBAAuB,EAC7C,GACE,CAACF,GACD,CAACA,EAAM,GAAIA,EAAM,OAAQA,EAAM,OAAO,CAAC,CAAC,KACrC,GACC,OAAOG,GAAe,UAAY,CAACA,GAAcA,EAAW,OAAS,GACzE,GACCH,EAAM,MAAQ,IAAA,KACZ,OAAOA,EAAM,KAAQ,UAAY,CAACA,EAAM,KAAOA,EAAM,IAAI,OAAS,MACrE,CAAC,OAAO,cAAcA,EAAM,SAAS,GACrCA,EAAM,WAAaC,EAEnB,MAAM,IAAIC,EAAU,UAAU,EAChC,IAAME,EAAU,OAAO,OAAO,CAAE,GAAGJ,CAAM,CAAC,EAE1C,OADA,MAAMF,EAAQ,cAAcM,CAAO,EAC5BA,CACT,CACA,MAAO,CACL,MAAM,IACJ,EACA,EACgB,CAChB,GAAI,CACFC,GAAQ,eAAe,EACvB,IAAMC,EAAS,MAAMP,EAAK,EAC1BM,GAAQ,eAAe,EACvB,IAAME,EAAS,MAAMC,EAAUF,CAAM,EACrCD,GAAQ,eAAe,EACvB,IAAMI,EAAQ,MAAMV,EAAK,EAGzB,OAFAW,EAAwBJ,EAAQG,CAAK,EACrCJ,GAAQ,eAAe,EAChBE,CACT,OAASI,EAAO,CAGd,MAFIN,GAAQ,QAAe,IAAIH,EAAU,WAAW,EAChDS,aAAiBT,EAAiBS,EAChC,IAAIT,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/index.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs");exports.AuthError=e.AuthError,exports.assertMutationOrigin=t.assertMutationOrigin,exports.authCookieOptions=t.authCookieOptions,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.resolveReturnPath=t.resolveReturnPath;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../policy.cjs"),n=require("./crypto.cjs"),r=require("./logout.cjs"),i=require("./proof.cjs"),a=require("./resource.cjs"),o=require("./identity-cache.cjs"),s=require("./identity.cjs"),c=require("./grant-guard.cjs"),l=require("./revocation.cjs"),u=require("./bearer.cjs"),d=require("./claims.cjs"),f=require("./provider.cjs"),p=require("./user-info.cjs"),m=require("./machine.cjs");exports.AuthError=e.AuthError,exports.assertAccessTokenClaims=d.assertAccessTokenClaims,exports.assertMutationOrigin=t.assertMutationOrigin,exports.assertSessionContinuity=d.assertSessionContinuity,exports.assertTokenContinuity=d.assertTokenContinuity,exports.authCookieOptions=t.authCookieOptions,exports.authFailure=u.authFailure,exports.authSubjectSchema=d.authSubjectSchema,exports.createAtomicDpopReplayStore=i.createAtomicDpopReplayStore,exports.createAtomicProofStorage=i.createAtomicProofStorage,exports.createAuthFreshnessPolicy=t.createAuthFreshnessPolicy,exports.createAuthPolicy=t.createAuthPolicy,exports.createBearerVerifier=u.createBearerVerifier,exports.createIdentityCache=o.createIdentityCache,exports.createLogoutVerifier=r.createLogoutVerifier,exports.createMachineTokenRequest=m.createMachineTokenRequest,exports.createOAuthIdentityValidator=s.createOAuthIdentityValidator,exports.createOAuthProviderConfig=f.createOAuthProviderConfig,exports.createProofReplayStore=i.createProofReplayStore,exports.createResourceAuth=a.createResourceAuth,exports.createSessionGrantGuard=c.createSessionGrantGuard,exports.createUserInfoCache=p.createUserInfoCache,exports.fingerprintAuthValue=n.fingerprintAuthValue,exports.machineTokenSchema=m.machineTokenSchema,exports.mapOAuthUserProfile=d.mapOAuthUserProfile,exports.matchesAuthRevocation=l.matchesAuthRevocation,exports.normalizeAuthError=u.normalizeAuthError,exports.oauthUserInfoSchema=d.oauthUserInfoSchema,exports.parseMachineToken=m.parseMachineToken,exports.resolveReturnPath=t.resolveReturnPath;

package/dist/modules/auth/server/index.d.cts

@@ -2,11 +2,16 @@ import { AuthError } from "../interface.cjs";
 import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.cjs";
 import { fingerprintAuthValue } from "./crypto.cjs";
 import { createLogoutVerifier } from "./logout.cjs";
-import { createProofReplayStore } from "./proof.cjs";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.cjs";
 import { createResourceAuth } from "./resource.cjs";
 import { createIdentityCache } from "./identity-cache.cjs";
 import { createOAuthIdentityValidator } from "./identity.cjs";
 import { createSessionGrantGuard } from "./grant-guard.cjs";
 import { matchesAuthRevocation } from "./revocation.cjs";
 import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-BR9QNgXO.cjs";
-export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.cjs";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.cjs";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.cjs";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.cjs";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.cjs";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.d.ts

@@ -2,11 +2,16 @@ import { AuthError } from "../interface.js";
 import { assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, resolveReturnPath } from "../policy.js";
 import { fingerprintAuthValue } from "./crypto.js";
 import { createLogoutVerifier } from "./logout.js";
-import { createProofReplayStore } from "./proof.js";
+import { AtomicDpopReplayStoreOptions, AtomicProofReservation, AtomicProofStorageOptions, createAtomicDpopReplayStore, createAtomicProofStorage, createProofReplayStore } from "./proof.js";
 import { createResourceAuth } from "./resource.js";
 import { createIdentityCache } from "./identity-cache.js";
 import { createOAuthIdentityValidator } from "./identity.js";
 import { createSessionGrantGuard } from "./grant-guard.js";
 import { matchesAuthRevocation } from "./revocation.js";
 import { A as LogoutVerifierOptions, D as IdentityCacheInput, F as ResourceAuthOptions, I as SessionGrantGuardOptions, M as OAuthIdentityValidatorOptions, N as ProofStorage, O as IdentityCacheOptions, U as VerifiedLogout, a as AuthIdentity, d as AuthSessionBinding, i as AuthFreshnessInput, k as LogoutStorage, l as AuthRevocation, n as AuthErrorCode, o as AuthPolicy, r as AuthFreshness, u as AuthRevocationIdentity } from "../../../interface-ii8DV63k.js";
-export { AuthError, type AuthErrorCode, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type OAuthIdentityValidatorOptions, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type VerifiedLogout, assertMutationOrigin, authCookieOptions, createAuthFreshnessPolicy, createAuthPolicy, createIdentityCache, createLogoutVerifier, createOAuthIdentityValidator, createProofReplayStore, createResourceAuth, createSessionGrantGuard, fingerprintAuthValue, matchesAuthRevocation, resolveReturnPath };
+import { AuthFailure, BearerVerifierOptions, authFailure, createBearerVerifier, normalizeAuthError } from "./bearer.js";
+import { AccessTokenClaimPolicy, OAuthUserInfo, assertAccessTokenClaims, assertSessionContinuity, assertTokenContinuity, authSubjectSchema, mapOAuthUserProfile, oauthUserInfoSchema } from "./claims.js";
+import { OAuthProviderConfigOptions, createOAuthProviderConfig } from "./provider.js";
+import { UserInfoCacheOptions, createUserInfoCache } from "./user-info.js";
+import { MachineToken, MachineTokenRequestOptions, createMachineTokenRequest, machineTokenSchema, parseMachineToken } from "./machine.js";
+export { type AccessTokenClaimPolicy, type AtomicDpopReplayStoreOptions, type AtomicProofReservation, type AtomicProofStorageOptions, AuthError, type AuthErrorCode, type AuthFailure, type AuthFreshness, type AuthFreshnessInput, type AuthIdentity, type AuthPolicy, type AuthRevocation, type AuthRevocationIdentity, type AuthSessionBinding, type BearerVerifierOptions, type IdentityCacheInput, type IdentityCacheOptions, type LogoutStorage, type LogoutVerifierOptions, type MachineToken, type MachineTokenRequestOptions, type OAuthIdentityValidatorOptions, type OAuthProviderConfigOptions, type OAuthUserInfo, type ProofStorage, type ResourceAuthOptions, type SessionGrantGuardOptions, type UserInfoCacheOptions, type VerifiedLogout, assertAccessTokenClaims, assertMutationOrigin, assertSessionContinuity, assertTokenContinuity, authCookieOptions, authFailure, authSubjectSchema, createAtomicDpopReplayStore, createAtomicProofStorage, createAuthFreshnessPolicy, createAuthPolicy, createBearerVerifier, createIdentityCache, createLogoutVerifier, createMachineTokenRequest, createOAuthIdentityValidator, createOAuthProviderConfig, createProofReplayStore, createResourceAuth, createSessionGrantGuard, createUserInfoCache, fingerprintAuthValue, machineTokenSchema, mapOAuthUserProfile, matchesAuthRevocation, normalizeAuthError, oauthUserInfoSchema, parseMachineToken, resolveReturnPath };

package/dist/modules/auth/server/index.js

@@ -1 +1 @@
-import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createProofReplayStore as c}from"./proof.js";import{createResourceAuth as l}from"./resource.js";import{createIdentityCache as u}from"./identity-cache.js";import{createOAuthIdentityValidator as d}from"./identity.js";import{createSessionGrantGuard as f}from"./grant-guard.js";import{matchesAuthRevocation as p}from"./revocation.js";export{e as AuthError,t as assertMutationOrigin,n as authCookieOptions,r as createAuthFreshnessPolicy,i as createAuthPolicy,u as createIdentityCache,s as createLogoutVerifier,d as createOAuthIdentityValidator,c as createProofReplayStore,l as createResourceAuth,f as createSessionGrantGuard,o as fingerprintAuthValue,p as matchesAuthRevocation,a as resolveReturnPath};
+import{AuthError as e}from"../interface.js";import{assertMutationOrigin as t,authCookieOptions as n,createAuthFreshnessPolicy as r,createAuthPolicy as i,resolveReturnPath as a}from"../policy.js";import{fingerprintAuthValue as o}from"./crypto.js";import{createLogoutVerifier as s}from"./logout.js";import{createAtomicDpopReplayStore as c,createAtomicProofStorage as l,createProofReplayStore as u}from"./proof.js";import{createResourceAuth as d}from"./resource.js";import{createIdentityCache as f}from"./identity-cache.js";import{createOAuthIdentityValidator as p}from"./identity.js";import{createSessionGrantGuard as m}from"./grant-guard.js";import{matchesAuthRevocation as h}from"./revocation.js";import{authFailure as g,createBearerVerifier as _,normalizeAuthError as v}from"./bearer.js";import{assertAccessTokenClaims as y,assertSessionContinuity as b,assertTokenContinuity as x,authSubjectSchema as S,mapOAuthUserProfile as C,oauthUserInfoSchema as w}from"./claims.js";import{createOAuthProviderConfig as T}from"./provider.js";import{createUserInfoCache as E}from"./user-info.js";import{createMachineTokenRequest as D,machineTokenSchema as O,parseMachineToken as k}from"./machine.js";export{e as AuthError,y as assertAccessTokenClaims,t as assertMutationOrigin,b as assertSessionContinuity,x as assertTokenContinuity,n as authCookieOptions,g as authFailure,S as authSubjectSchema,c as createAtomicDpopReplayStore,l as createAtomicProofStorage,r as createAuthFreshnessPolicy,i as createAuthPolicy,_ as createBearerVerifier,f as createIdentityCache,s as createLogoutVerifier,D as createMachineTokenRequest,p as createOAuthIdentityValidator,T as createOAuthProviderConfig,u as createProofReplayStore,d as createResourceAuth,m as createSessionGrantGuard,E as createUserInfoCache,o as fingerprintAuthValue,O as machineTokenSchema,C as mapOAuthUserProfile,h as matchesAuthRevocation,v as normalizeAuthError,w as oauthUserInfoSchema,k as parseMachineToken,a as resolveReturnPath};

package/dist/modules/auth/server/machine.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");let n=require("zod"),r=require("better-auth/oauth2");const i=n.z.object({access_token:n.z.string().min(1).max(32768),token_type:n.z.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.z.number().int().positive(),scope:n.z.string().optional()});async function a(n){try{if(t.parseHttpEndpoint(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t.parseHttpEndpoint(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await(0,r.clientCredentialsTokenRequest)({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:[...new Set(n.scopes)].join(` `),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e.AuthError(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e.AuthError(`rejected`);return n.data}exports.createMachineTokenRequest=a,exports.machineTokenSchema=i,exports.parseMachineToken=o;

package/dist/modules/auth/server/machine.d.cts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.cts.map

package/dist/modules/auth/server/machine.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.cts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.d.ts

@@ -0,0 +1,28 @@
+import { z } from "zod";
+export declare const machineTokenSchema: z.ZodObject<{
+  access_token: z.ZodString;
+  token_type: z.ZodString;
+  expires_in: z.ZodNumber;
+  scope: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export type MachineToken = z.infer<typeof machineTokenSchema>;
+export interface MachineTokenRequestOptions {
+  tokenEndpoint: string;
+  clientId: string;
+  clientSecret: string;
+  method: "client_secret_basic" | "client_secret_post";
+  scopes: readonly string[];
+  resources: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */
+export declare function createMachineTokenRequest(options: MachineTokenRequestOptions): Promise<{
+  url: string;
+  method: "POST";
+  headers: Record<string, string>;
+  body: URLSearchParams;
+  redirect: "error";
+  cache: "no-store";
+}>;
+export declare function parseMachineToken(value: unknown): MachineToken;
+//# sourceMappingURL=machine.d.ts.map

package/dist/modules/auth/server/machine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.d.ts","names":[],"sources":["../../../../src/modules/auth/server/machine.ts"],"mappings":";qBAKa,oBAAkB,EAAA;;;;;GAK7B,EAAA,KAAA;YACU,eAAe,EAAE,aAAa;iBAEzB;EACf;EACA;EACA;EACA;EACA;EACA;EACA;;;wBAIoB,0BAA0B,SAAS,6BAA0B;;;;;;;;wBAoCnE,kBAAkB,iBAAiB"}

package/dist/modules/auth/server/machine.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";import{z as n}from"zod";import{clientCredentialsTokenRequest as r}from"better-auth/oauth2";const i=n.object({access_token:n.string().min(1).max(32768),token_type:n.string().refine(e=>e.toLowerCase()===`bearer`),expires_in:n.number().int().positive(),scope:n.string().optional()});async function a(n){try{if(t(n.tokenEndpoint,{allowLoopbackHttp:n.allowLoopbackHttp}),!n.clientId||!n.clientSecret||!n.scopes.length||!n.resources.length||![`client_secret_basic`,`client_secret_post`].includes(n.method)||n.scopes.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();for(let e of n.resources)t(e,{allowLoopbackHttp:n.allowLoopbackHttp});let e=await r({options:{clientId:n.clientId,clientSecret:n.clientSecret},tokenEndpoint:n.tokenEndpoint,tokenEndpointAuth:{method:n.method},scope:[...new Set(n.scopes)].join(` `),resource:[...new Set(n.resources)]});return{url:n.tokenEndpoint,method:`POST`,headers:e.headers,body:e.body,redirect:`error`,cache:`no-store`}}catch{throw new e(`invalid_configuration`)}}function o(t){let n=i.safeParse(t);if(!n.success)throw new e(`rejected`);return n.data}export{a as createMachineTokenRequest,i as machineTokenSchema,o as parseMachineToken};
+//# sourceMappingURL=machine.js.map

package/dist/modules/auth/server/machine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"machine.js","names":["machineTokenSchema","z","value","createMachineTokenRequest","parseHttpEndpoint","options","scope","resource","request","clientCredentialsTokenRequest","AuthError","parseMachineToken","parsed"],"sources":["../../../../src/modules/auth/server/machine.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport { parseHttpEndpoint } from \"@/utils/normalization\";\nimport { clientCredentialsTokenRequest } from \"better-auth/oauth2\";\nimport { z } from \"zod\";\n\nexport const machineTokenSchema = z.object({\n  access_token: z.string().min(1).max(32768),\n  token_type: z.string().refine((value) => value.toLowerCase() === \"bearer\"),\n  expires_in: z.number().int().positive(),\n  scope: z.string().optional(),\n});\nexport type MachineToken = z.infer<typeof machineTokenSchema>;\n\nexport interface MachineTokenRequestOptions {\n  tokenEndpoint: string;\n  clientId: string;\n  clientSecret: string;\n  method: \"client_secret_basic\" | \"client_secret_post\";\n  scopes: readonly string[];\n  resources: readonly string[];\n  allowLoopbackHttp?: boolean;\n}\n\n/** Native SDK builds client authentication; no refresh, global secret/token cache or env access. */\nexport async function createMachineTokenRequest(options: MachineTokenRequestOptions) {\n  try {\n    parseHttpEndpoint(options.tokenEndpoint, {\n      allowLoopbackHttp: options.allowLoopbackHttp,\n    });\n    if (\n      !options.clientId ||\n      !options.clientSecret ||\n      !options.scopes.length ||\n      !options.resources.length ||\n      ![\"client_secret_basic\", \"client_secret_post\"].includes(options.method) ||\n      options.scopes.some((scope) => !/^[\\x21\\x23-\\x5B\\x5D-\\x7E]+$/.test(scope))\n    )\n      throw new Error();\n    for (const resource of options.resources)\n      parseHttpEndpoint(resource, { allowLoopbackHttp: options.allowLoopbackHttp });\n    const request = await clientCredentialsTokenRequest({\n      options: { clientId: options.clientId, clientSecret: options.clientSecret },\n      tokenEndpoint: options.tokenEndpoint,\n      tokenEndpointAuth: { method: options.method },\n      scope: [...new Set(options.scopes)].join(\" \"),\n      resource: [...new Set(options.resources)],\n    });\n    return {\n      url: options.tokenEndpoint,\n      method: \"POST\" as const,\n      headers: request.headers,\n      body: request.body,\n      redirect: \"error\" as const,\n      cache: \"no-store\" as const,\n    };\n  } catch {\n    throw new AuthError(\"invalid_configuration\");\n  }\n}\n\nexport function parseMachineToken(value: unknown): MachineToken {\n  const parsed = machineTokenSchema.safeParse(value);\n  if (!parsed.success) throw new AuthError(\"rejected\");\n  return parsed.data;\n}\n"],"mappings":"A,2MAKA,MAAaA,EAAqBC,EAAE,OAAO,CACzC,aAAcA,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,EACzC,WAAYA,EAAE,OAAO,CAAC,CAAC,OAAQ,GAAUC,EAAM,YAAY,IAAM,QAAQ,EACzE,WAAYD,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EACtC,MAAOA,EAAE,OAAO,CAAC,CAAC,SAAS,CAC7B,CAAC,EAcD,eAAsBE,EAA0B,EAAqC,CACnF,GAAI,CAIF,GAHAC,EAAkBC,EAAQ,cAAe,CACvC,kBAAmBA,EAAQ,iBAC7B,CAAC,EAEC,CAACA,EAAQ,UACT,CAACA,EAAQ,cACT,CAACA,EAAQ,OAAO,QAChB,CAACA,EAAQ,UAAU,QACnB,CAAC,CAAC,sBAAuB,oBAAoB,CAAC,CAAC,SAASA,EAAQ,MAAM,GACtEA,EAAQ,OAAO,KAAM,GAAU,CAAC,8BAA8B,KAAKC,CAAK,CAAC,EAEzE,MAAU,MAAM,EAClB,IAAK,IAAMC,KAAYF,EAAQ,UAC7BD,EAAkBG,EAAU,CAAE,kBAAmBF,EAAQ,iBAAkB,CAAC,EAC9E,IAAMG,EAAU,MAAMC,EAA8B,CAClD,QAAS,CAAE,SAAUJ,EAAQ,SAAU,aAAcA,EAAQ,YAAa,EAC1E,cAAeA,EAAQ,cACvB,kBAAmB,CAAE,OAAQA,EAAQ,MAAO,EAC5C,MAAO,CAAC,GAAG,IAAI,IAAIA,EAAQ,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,EAC5C,SAAU,CAAC,GAAG,IAAI,IAAIA,EAAQ,SAAS,CAAC,CAC1C,CAAC,EACD,MAAO,CACL,IAAKA,EAAQ,cACb,OAAQ,OACR,QAASG,EAAQ,QACjB,KAAMA,EAAQ,KACd,SAAU,QACV,MAAO,UACT,CACF,MAAQ,CACN,MAAM,IAAIE,EAAU,uBAAuB,CAC7C,CACF,CAEA,SAAgBC,EAAkB,EAA8B,CAC9D,IAAMC,EAASZ,EAAmB,UAAUE,CAAK,EACjD,GAAI,CAACU,EAAO,QAAS,MAAM,IAAIF,EAAU,UAAU,EACnD,OAAOE,EAAO,IAChB,C"}

package/dist/modules/auth/server/proof.cjs

@@ -1 +1 @@
-Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createProofReplayStore=t;
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs");function t(t){return{async reserve(n){let r=n.now.getTime(),i=n.expiresAt.getTime();if(!n.key||n.key.length>2048||!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(i)||i<=r)throw new e.AuthError(`rejected`);try{let e=await t.reserve(n);if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function n(t){return{async consume(n,r){let i=(t.now??Date.now)();if(!n||n.length>2048||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(r)||r<=i)throw new e.AuthError(`rejected`);try{let e=await t.reserve({key:n,expiresAt:r,now:i});if(typeof e!=`boolean`)throw Error();return e}catch{throw new e.AuthError(`unavailable`)}}}}function r(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e.AuthError(`rejected`);try{return await t.consume(i,a)}catch{throw new e.AuthError(`unavailable`)}}}}exports.createAtomicDpopReplayStore=t,exports.createAtomicProofStorage=n,exports.createProofReplayStore=r;

package/dist/modules/auth/server/proof.d.cts

@@ -1,6 +1,23 @@
 import { N as ProofStorage } from "../../../interface-BR9QNgXO.cjs";
 import "../../../interface-weqBVeUf.cjs";
 import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
 /** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
 export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
 //# sourceMappingURL=proof.d.cts.map

package/dist/modules/auth/server/proof.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;;wBAKgB,uBACd,SAAS,cACT,qBACC"}
+{"version":3,"file":"proof.d.cts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;iBAIiB;EACf;EACA;EACA;;iBAGe;;EAEf,SAAS;;;wBAIK,4BACd,SAAS,+BACR;iBAoBc;;EAEf,QAAQ,OAAO,yBAAyB;EACxC;;wBAGc,yBACd,SAAS,4BACR;;wBAyBa,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.d.ts

@@ -1,6 +1,23 @@
 import { N as ProofStorage } from "../../../interface-ii8DV63k.js";
 import "../../../interface-BFsLlmGy.js";
 import { DpopReplayStore } from "better-auth/oauth2";
+export interface AtomicProofReservation {
+  key: string;
+  expiresAt: number;
+  now: number;
+}
+export interface AtomicDpopReplayStoreOptions {
+  /** The host must reserve atomically in durable storage, including expiry cleanup. */
+  reserve: DpopReplayStore["reserve"];
+}
+/** Preserve the native verifier's clock and Date parameters at the storage boundary. */
+export declare function createAtomicDpopReplayStore(options: AtomicDpopReplayStoreOptions): DpopReplayStore;
+export interface AtomicProofStorageOptions {
+  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */
+  reserve(input: AtomicProofReservation): Promise<boolean>;
+  now?: () => number;
+}
+export declare function createAtomicProofStorage(options: AtomicProofStorageOptions): ProofStorage;
 /** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */
 export declare function createProofReplayStore(storage: ProofStorage, now?: () => number): DpopReplayStore;
 //# sourceMappingURL=proof.d.ts.map

package/dist/modules/auth/server/proof.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proof.d.ts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;;wBAKgB,uBACd,SAAS,cACT,qBACC"}
+{"version":3,"file":"proof.d.ts","names":[],"sources":["../../../../src/modules/auth/server/proof.ts"],"mappings":";;;iBAIiB;EACf;EACA;EACA;;iBAGe;;EAEf,SAAS;;;wBAIK,4BACd,SAAS,+BACR;iBAoBc;;EAEf,QAAQ,OAAO,yBAAyB;EACxC;;wBAGc,yBACd,SAAS,4BACR;;wBAyBa,uBACd,SAAS,cACT,qBACC"}

package/dist/modules/auth/server/proof.js

@@ -1,2 +1,2 @@
-import{AuthError as e}from"../interface.js";function t(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e(`rejected`);try{return await t.consume(i,a)}catch{throw new e(`unavailable`)}}}}export{t as createProofReplayStore};
+import{AuthError as e}from"../interface.js";function t(t){return{async reserve(n){let r=n.now.getTime(),i=n.expiresAt.getTime();if(!n.key||n.key.length>2048||!Number.isSafeInteger(r)||r<0||!Number.isSafeInteger(i)||i<=r)throw new e(`rejected`);try{let e=await t.reserve(n);if(typeof e!=`boolean`)throw Error();return e}catch{throw new e(`unavailable`)}}}}function n(t){return{async consume(n,r){let i=(t.now??Date.now)();if(!n||n.length>2048||!Number.isSafeInteger(i)||i<0||!Number.isSafeInteger(r)||r<=i)throw new e(`rejected`);try{let e=await t.reserve({key:n,expiresAt:r,now:i});if(typeof e!=`boolean`)throw Error();return e}catch{throw new e(`unavailable`)}}}}function r(t,n=Date.now){return{async reserve(r){let{key:i}=r,a=r.expiresAt.getTime();if(!i||i.length>2048||!Number.isFinite(a)||a<=n())throw new e(`rejected`);try{return await t.consume(i,a)}catch{throw new e(`unavailable`)}}}}export{t as createAtomicDpopReplayStore,n as createAtomicProofStorage,r as createProofReplayStore};
 //# sourceMappingURL=proof.js.map

package/dist/modules/auth/server/proof.js.map

@@ -1 +1 @@
-{"version":3,"file":"proof.js","names":["createProofReplayStore","reservation","expiresAt","key","now","AuthError","storage"],"sources":["../../../../src/modules/auth/server/proof.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { ProofStorage } from \"@/modules/auth/server/interface\";\nimport type { DpopReplayStore } from \"better-auth/oauth2\";\n\n/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */\nexport function createProofReplayStore(\n  storage: ProofStorage,\n  now: () => number = Date.now,\n): DpopReplayStore {\n  return {\n    async reserve(reservation) {\n      const { key } = reservation;\n      const expiresAt = reservation.expiresAt.getTime();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isFinite(expiresAt) ||\n        expiresAt <= now()\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        return await storage.consume(key, expiresAt);\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAKA,SAAgBA,EACd,EACA,EAAoB,KAAK,IACR,CACjB,MAAO,CACL,MAAM,QAAQ,EAAa,CACzB,GAAM,CAAE,OAAQC,EACVC,EAAYD,EAAY,UAAU,QAAQ,EAChD,GACE,CAACE,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,SAASD,CAAS,GAC1BA,GAAaE,EAAI,EAEjB,MAAM,IAAIC,EAAU,UAAU,EAChC,GAAI,CACF,OAAO,MAAMC,EAAQ,QAAQH,EAAKD,CAAS,CAC7C,MAAQ,CACN,MAAM,IAAIG,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}
+{"version":3,"file":"proof.js","names":["createAtomicDpopReplayStore","now","input","expiresAt","AuthError","reserved","options","createAtomicProofStorage","key","createProofReplayStore","reservation","storage"],"sources":["../../../../src/modules/auth/server/proof.ts"],"sourcesContent":["import { AuthError } from \"@/modules/auth/interface\";\nimport type { ProofStorage } from \"@/modules/auth/server/interface\";\nimport type { DpopReplayStore } from \"better-auth/oauth2\";\n\nexport interface AtomicProofReservation {\n  key: string;\n  expiresAt: number;\n  now: number;\n}\n\nexport interface AtomicDpopReplayStoreOptions {\n  /** The host must reserve atomically in durable storage, including expiry cleanup. */\n  reserve: DpopReplayStore[\"reserve\"];\n}\n\n/** Preserve the native verifier's clock and Date parameters at the storage boundary. */\nexport function createAtomicDpopReplayStore(\n  options: AtomicDpopReplayStoreOptions,\n): DpopReplayStore {\n  return {\n    async reserve(input) {\n      const now = input.now.getTime();\n      const expiresAt = input.expiresAt.getTime();\n      if (!input.key || input.key.length > 2048 ||\n          !Number.isSafeInteger(now) || now < 0 ||\n          !Number.isSafeInteger(expiresAt) || expiresAt <= now)\n        throw new AuthError(\"rejected\");\n      try {\n        const reserved = await options.reserve(input);\n        if (typeof reserved !== \"boolean\") throw new Error();\n        return reserved;\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n\nexport interface AtomicProofStorageOptions {\n  /** Atomic expired-key replacement + insert-if-absent in app-owned durable storage. */\n  reserve(input: AtomicProofReservation): Promise<boolean>;\n  now?: () => number;\n}\n\nexport function createAtomicProofStorage(\n  options: AtomicProofStorageOptions,\n): ProofStorage {\n  return {\n    async consume(key, expiresAt) {\n      const now = (options.now ?? Date.now)();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isSafeInteger(now) ||\n        now < 0 ||\n        !Number.isSafeInteger(expiresAt) ||\n        expiresAt <= now\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        const reserved = await options.reserve({ key, expiresAt, now });\n        if (typeof reserved !== \"boolean\") throw new Error();\n        return reserved;\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n\n/** Feed this adapter to Better Auth's request verifier; it is NOT proof verification itself. */\nexport function createProofReplayStore(\n  storage: ProofStorage,\n  now: () => number = Date.now,\n): DpopReplayStore {\n  return {\n    async reserve(reservation) {\n      const { key } = reservation;\n      const expiresAt = reservation.expiresAt.getTime();\n      if (\n        !key ||\n        key.length > 2048 ||\n        !Number.isFinite(expiresAt) ||\n        expiresAt <= now()\n      )\n        throw new AuthError(\"rejected\");\n      try {\n        return await storage.consume(key, expiresAt);\n      } catch {\n        throw new AuthError(\"unavailable\");\n      }\n    },\n  };\n}\n"],"mappings":"A,4CAgBA,SAAgBA,EACd,EACiB,CACjB,MAAO,CACL,MAAM,QAAQ,EAAO,CACnB,IAAMC,EAAMC,EAAM,IAAI,QAAQ,EACxBC,EAAYD,EAAM,UAAU,QAAQ,EAC1C,GAAI,CAACA,EAAM,KAAOA,EAAM,IAAI,OAAS,MACjC,CAAC,OAAO,cAAcD,CAAG,GAAKA,EAAM,GACpC,CAAC,OAAO,cAAcE,CAAS,GAAKA,GAAaF,EACnD,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,IAAMC,EAAW,MAAMC,EAAQ,QAAQJ,CAAK,EAC5C,GAAI,OAAOG,GAAa,UAAW,MAAU,MAAM,EACnD,OAAOA,CACT,MAAQ,CACN,MAAM,IAAID,EAAU,aAAa,CACnC,CACF,CACF,CACF,CAQA,SAAgBG,EACd,EACc,CACd,MAAO,CACL,MAAM,QAAQ,EAAK,EAAW,CAC5B,IAAMN,GAAOK,EAAQ,KAAO,KAAK,IAAA,CAAK,EACtC,GACE,CAACE,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,cAAcP,CAAG,GACzBA,EAAM,GACN,CAAC,OAAO,cAAcE,CAAS,GAC/BA,GAAaF,EAEb,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,IAAMC,EAAW,MAAMC,EAAQ,QAAQ,CAAE,MAAK,YAAW,KAAI,CAAC,EAC9D,GAAI,OAAOD,GAAa,UAAW,MAAU,MAAM,EACnD,OAAOA,CACT,MAAQ,CACN,MAAM,IAAID,EAAU,aAAa,CACnC,CACF,CACF,CACF,CAGA,SAAgBK,EACd,EACA,EAAoB,KAAK,IACR,CACjB,MAAO,CACL,MAAM,QAAQ,EAAa,CACzB,GAAM,CAAE,OAAQC,EACVP,EAAYO,EAAY,UAAU,QAAQ,EAChD,GACE,CAACF,GACDA,EAAI,OAAS,MACb,CAAC,OAAO,SAASL,CAAS,GAC1BA,GAAaF,EAAI,EAEjB,MAAM,IAAIG,EAAU,UAAU,EAChC,GAAI,CACF,OAAO,MAAMO,EAAQ,QAAQH,EAAKL,CAAS,CAC7C,MAAQ,CACN,MAAM,IAAIC,EAAU,aAAa,CACnC,CACF,CACF,CACF,C"}

package/dist/modules/auth/server/provider.cjs

@@ -0,0 +1 @@
+Object.defineProperty(exports,Symbol.toStringTag,{value:`Module`});const e=require("../interface.cjs"),t=require("../../../utils/normalization.cjs");function n(n){let{resources:r=[],scopes:i,allowLoopbackHttp:a,...o}=n;try{if(!o.providerId||!o.clientId||!o.discoveryUrl||i.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();t.parseHttpEndpoint(o.discoveryUrl,{allowLoopbackHttp:a});for(let e of[o.tokenUrl,o.userInfoUrl,o.endSessionEndpoint])e&&t.parseHttpEndpoint(e,{allowLoopbackHttp:a});let e=o.authorizationUrl;if(e){let n=t.parseHttpEndpoint(e,{allowLoopbackHttp:a,allowQuery:!0}),i=/* @__PURE__ */ new Set([...n.searchParams.getAll(`resource`),...r]);n.searchParams.delete(`resource`);for(let e of i)t.parseHttpEndpoint(e,{allowLoopbackHttp:a}),n.searchParams.append(`resource`,e);e=n.href}else if(r.length)throw Error();return{...o,authorizationUrl:e,scopes:[...new Set(i)],pkce:!0,responseType:`code`,requireIdTokenVerification:!0}}catch{throw new e.AuthError(`invalid_configuration`)}}exports.createOAuthProviderConfig=n;

package/dist/modules/auth/server/provider.d.cts

@@ -0,0 +1,9 @@
+import { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+export interface OAuthProviderConfigOptions extends Omit<GenericOAuthConfig, "scopes" | "pkce" | "requireIdTokenVerification" | "responseType"> {
+  scopes: readonly string[];
+  resources?: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Returns native options, not a plugin/auth instance. The app calls genericOAuth. */
+export declare function createOAuthProviderConfig(options: OAuthProviderConfigOptions): GenericOAuthConfig;
+//# sourceMappingURL=provider.d.cts.map

package/dist/modules/auth/server/provider.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.cts","names":[],"sources":["../../../../src/modules/auth/server/provider.ts"],"mappings":";iBAIiB,mCAAmC,KAClD;EAGA;EACA;EACA;;;wBAIc,0BACd,SAAS,6BACR"}

package/dist/modules/auth/server/provider.d.ts

@@ -0,0 +1,9 @@
+import { GenericOAuthConfig } from "better-auth/plugins/generic-oauth";
+export interface OAuthProviderConfigOptions extends Omit<GenericOAuthConfig, "scopes" | "pkce" | "requireIdTokenVerification" | "responseType"> {
+  scopes: readonly string[];
+  resources?: readonly string[];
+  allowLoopbackHttp?: boolean;
+}
+/** Returns native options, not a plugin/auth instance. The app calls genericOAuth. */
+export declare function createOAuthProviderConfig(options: OAuthProviderConfigOptions): GenericOAuthConfig;
+//# sourceMappingURL=provider.d.ts.map

package/dist/modules/auth/server/provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider.d.ts","names":[],"sources":["../../../../src/modules/auth/server/provider.ts"],"mappings":";iBAIiB,mCAAmC,KAClD;EAGA;EACA;EACA;;;wBAIc,0BACd,SAAS,6BACR"}

package/dist/modules/auth/server/provider.js

@@ -0,0 +1,2 @@
+import{AuthError as e}from"../interface.js";import{parseHttpEndpoint as t}from"../../../utils/normalization.js";function n(n){let{resources:r=[],scopes:i,allowLoopbackHttp:a,...o}=n;try{if(!o.providerId||!o.clientId||!o.discoveryUrl||i.some(e=>!/^[\x21\x23-\x5B\x5D-\x7E]+$/.test(e)))throw Error();t(o.discoveryUrl,{allowLoopbackHttp:a});for(let e of[o.tokenUrl,o.userInfoUrl,o.endSessionEndpoint])e&&t(e,{allowLoopbackHttp:a});let e=o.authorizationUrl;if(e){let n=t(e,{allowLoopbackHttp:a,allowQuery:!0}),i=/* @__PURE__ */ new Set([...n.searchParams.getAll(`resource`),...r]);n.searchParams.delete(`resource`);for(let e of i)t(e,{allowLoopbackHttp:a}),n.searchParams.append(`resource`,e);e=n.href}else if(r.length)throw Error();return{...o,authorizationUrl:e,scopes:[...new Set(i)],pkce:!0,responseType:`code`,requireIdTokenVerification:!0}}catch{throw new e(`invalid_configuration`)}}export{n as createOAuthProviderConfig};
+//# sourceMappingURL=provider.js.map