@incorta/auth 1.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Incorta
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,61 @@
+# @incorta/auth
+
+Authenticate Incorta users in any Node.js app via Incorta's built-in OAuth
+2.0/OIDC authorization server. See the repository root README for the full
+guide; this is the API surface.
+
+## Entry points
+
+| Import                  | What's in it                                                        |
+| ----------------------- | ------------------------------------------------------------------- |
+| `@incorta/auth`         | `createIncortaAuth`, `registerClient`, types (`IncortaUser`, `AuthSession`, …) |
+| `@incorta/auth/react`   | `IncortaAuthProvider`, `useAuth`, `useUser`, `SignedIn`, `SignedOut`, `Protect`, `RedirectToLogin` |
+| `@incorta/auth/express` | `incortaAuth(auth)` middleware, `requireAuth(auth, options?)`        |
+| `@incorta/auth/node`    | `toNodeHandler(auth)`, `toWebRequest`, `sendWebResponse`, `getNodeSession` |
+
+## `createIncortaAuth(config?)`
+
+Returns `{ handler, getSession, config }`:
+
+- `handler(request: Request): Promise<Response>` — serves, under
+  `config.basePath` (default `/auth`):
+  - `GET /login?redirect_to=` — 302 into the Incorta authorize flow (or straight
+    back when already signed in). Sets a sealed state+nonce cookie (10 min).
+  - `GET /callback` — validates state, exchanges the code
+    (`client_secret_basic`), verifies the ID token against the tenant JWKS
+    (issuer, audience, nonce), seals the session cookie, 302 to the original page.
+    Failures 302 to `{redirect_to}?incorta_auth_error={code}`.
+  - `GET /session` — `{ user, session }` or `{ user: null }`. Refreshes the
+    access token (rotating refresh token) when <60s from expiry; slides the
+    session cookie past its half-life.
+  - `GET|POST /logout` — clears the session cookie (GET also redirects).
+  - `GET /token` — the raw Incorta access token; only with
+    `exposeAccessToken: true`, otherwise 404.
+- `getSession(request): Promise<AuthSession | null>` — read-only session lookup
+  for server code (`user`, `accessToken`, `accessTokenExpiresAt`, `expiresAt`).
+
+Config falls back to `INCORTA_URL`, `INCORTA_TENANT`, `INCORTA_CLIENT_ID`,
+`INCORTA_CLIENT_SECRET`, `INCORTA_AUTH_SECRET`, `INCORTA_APP_URL`.
+
+## Session model
+
+The cookie is an encrypted JWT (JWE `dir`/`A256GCM`, key derived from
+`secret`), HttpOnly, `SameSite=Lax`, `Secure` on HTTPS. Payload: verified user
+claims (`sub`, `name`, `email`, `roles`, `tenant`) + the Incorta access/refresh
+tokens. Nothing is stored server-side.
+
+## CLI
+
+```bash
+incorta-auth register --url http://localhost:8080/incorta --tenant demo \
+  --name "My App" --redirect https://myapp.example.com/auth/callback [--json]
+```
+
+Registers the OAuth client via RFC 7591 dynamic registration and prints the
+`.env` entries.
+
+## Testing
+
+`pnpm test` runs the suite against an in-process replica of Incorta's OAuth
+endpoints (`test/mock-incorta.ts`) — full login/callback/refresh/logout flows
+over real HTTP sockets, no Incorta needed.

package/dist/chunk-LNPECE7W.js

@@ -0,0 +1,62 @@
+// src/node.ts
+async function toWebRequest(req) {
+  const proto = req.headers["x-forwarded-proto"]?.split(",")[0]?.trim() ?? (req.socket.encrypted ? "https" : "http");
+  const host = req.headers.host ?? "localhost";
+  const path = req.originalUrl ?? req.url ?? "/";
+  const url = `${proto}://${host}${path}`;
+  const headers = new Headers();
+  for (let i = 0; i < req.rawHeaders.length; i += 2) {
+    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);
+  }
+  const method = req.method ?? "GET";
+  let body;
+  if (method !== "GET" && method !== "HEAD") {
+    const chunks = [];
+    for await (const chunk of req) {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+    }
+    if (chunks.length) {
+      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));
+      let offset = 0;
+      for (const chunk of chunks) {
+        bytes.set(chunk, offset);
+        offset += chunk.length;
+      }
+      body = bytes;
+    }
+  }
+  return new Request(url, { method, headers, body });
+}
+async function sendWebResponse(res, response) {
+  res.statusCode = response.status;
+  response.headers.forEach((value, name) => {
+    if (name.toLowerCase() === "set-cookie") return;
+    res.setHeader(name, value);
+  });
+  const setCookies = response.headers.getSetCookie();
+  if (setCookies.length) res.setHeader("set-cookie", setCookies);
+  if (response.body) {
+    const buffer = Buffer.from(await response.arrayBuffer());
+    res.end(buffer);
+  } else {
+    res.end();
+  }
+}
+function toNodeHandler(auth) {
+  return async (req, res) => {
+    const request = await toWebRequest(req);
+    const response = await auth.handler(request);
+    await sendWebResponse(res, response);
+  };
+}
+async function getNodeSession(auth, req) {
+  return auth.getSession(await toWebRequest(req));
+}
+
+export {
+  toWebRequest,
+  sendWebResponse,
+  toNodeHandler,
+  getNodeSession
+};
+//# sourceMappingURL=chunk-LNPECE7W.js.map

package/dist/chunk-LNPECE7W.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/node.ts"],"sourcesContent":["import type { IncomingMessage, ServerResponse } from \"node:http\";\nimport type { IncortaAuth } from \"./index.js\";\n\nexport type { IncortaAuth } from \"./index.js\";\n\n/**\n * Builds a web-standard `Request` from a Node request. Buffers the body (the\n * auth routes are GET/POST-without-body, so this stays tiny).\n */\nexport async function toWebRequest(req: IncomingMessage): Promise<Request> {\n  const proto =\n    (req.headers[\"x-forwarded-proto\"] as string | undefined)?.split(\",\")[0]?.trim() ??\n    ((req.socket as { encrypted?: boolean }).encrypted ? \"https\" : \"http\");\n  const host = req.headers.host ?? \"localhost\";\n  // Express rewrites req.url when routers are mounted — originalUrl keeps the full path.\n  const path = (req as { originalUrl?: string }).originalUrl ?? req.url ?? \"/\";\n  const url = `${proto}://${host}${path}`;\n\n  const headers = new Headers();\n  for (let i = 0; i < req.rawHeaders.length; i += 2) {\n    headers.append(req.rawHeaders[i], req.rawHeaders[i + 1]);\n  }\n\n  const method = req.method ?? \"GET\";\n  let body: BodyInit | undefined;\n  if (method !== \"GET\" && method !== \"HEAD\") {\n    const chunks: Buffer[] = [];\n    for await (const chunk of req) {\n      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));\n    }\n    if (chunks.length) {\n      const bytes = new Uint8Array(chunks.reduce((n, c) => n + c.length, 0));\n      let offset = 0;\n      for (const chunk of chunks) {\n        bytes.set(chunk, offset);\n        offset += chunk.length;\n      }\n      body = bytes;\n    }\n  }\n\n  return new Request(url, { method, headers, body });\n}\n\nexport async function sendWebResponse(\n  res: ServerResponse,\n  response: Response,\n): Promise<void> {\n  res.statusCode = response.status;\n  response.headers.forEach((value, name) => {\n    if (name.toLowerCase() === \"set-cookie\") return; // handled below, needs the un-joined list\n    res.setHeader(name, value);\n  });\n  const setCookies = response.headers.getSetCookie();\n  if (setCookies.length) res.setHeader(\"set-cookie\", setCookies);\n\n  if (response.body) {\n    const buffer = Buffer.from(await response.arrayBuffer());\n    res.end(buffer);\n  } else {\n    res.end();\n  }\n}\n\n/**\n * Adapts the auth handler to a plain Node `(req, res)` listener:\n *\n * ```ts\n * import http from \"node:http\";\n * const authListener = toNodeHandler(auth);\n * http.createServer((req, res) => {\n *   if (req.url?.startsWith(\"/auth\")) return authListener(req, res);\n *   // ... your app\n * });\n * ```\n */\nexport function toNodeHandler(auth: IncortaAuth) {\n  return async (req: IncomingMessage, res: ServerResponse): Promise<void> => {\n    const request = await toWebRequest(req);\n    const response = await auth.handler(request);\n    await sendWebResponse(res, response);\n  };\n}\n\n/** Reads the current session from a Node request (returns null when signed out). */\nexport async function getNodeSession(auth: IncortaAuth, req: IncomingMessage) {\n  return auth.getSession(await toWebRequest(req));\n}\n"],"mappings":";AASA,eAAsB,aAAa,KAAwC;AACzE,QAAM,QACH,IAAI,QAAQ,mBAAmB,GAA0B,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK,MAC5E,IAAI,OAAmC,YAAY,UAAU;AACjE,QAAM,OAAO,IAAI,QAAQ,QAAQ;AAEjC,QAAM,OAAQ,IAAiC,eAAe,IAAI,OAAO;AACzE,QAAM,MAAM,GAAG,KAAK,MAAM,IAAI,GAAG,IAAI;AAErC,QAAM,UAAU,IAAI,QAAQ;AAC5B,WAAS,IAAI,GAAG,IAAI,IAAI,WAAW,QAAQ,KAAK,GAAG;AACjD,YAAQ,OAAO,IAAI,WAAW,CAAC,GAAG,IAAI,WAAW,IAAI,CAAC,CAAC;AAAA,EACzD;AAEA,QAAM,SAAS,IAAI,UAAU;AAC7B,MAAI;AACJ,MAAI,WAAW,SAAS,WAAW,QAAQ;AACzC,UAAM,SAAmB,CAAC;AAC1B,qBAAiB,SAAS,KAAK;AAC7B,aAAO,KAAK,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK,CAAC;AAAA,IACjE;AACA,QAAI,OAAO,QAAQ;AACjB,YAAM,QAAQ,IAAI,WAAW,OAAO,OAAO,CAAC,GAAG,MAAM,IAAI,EAAE,QAAQ,CAAC,CAAC;AACrE,UAAI,SAAS;AACb,iBAAW,SAAS,QAAQ;AAC1B,cAAM,IAAI,OAAO,MAAM;AACvB,kBAAU,MAAM;AAAA,MAClB;AACA,aAAO;AAAA,IACT;AAAA,EACF;AAEA,SAAO,IAAI,QAAQ,KAAK,EAAE,QAAQ,SAAS,KAAK,CAAC;AACnD;AAEA,eAAsB,gBACpB,KACA,UACe;AACf,MAAI,aAAa,SAAS;AAC1B,WAAS,QAAQ,QAAQ,CAAC,OAAO,SAAS;AACxC,QAAI,KAAK,YAAY,MAAM,aAAc;AACzC,QAAI,UAAU,MAAM,KAAK;AAAA,EAC3B,CAAC;AACD,QAAM,aAAa,SAAS,QAAQ,aAAa;AACjD,MAAI,WAAW,OAAQ,KAAI,UAAU,cAAc,UAAU;AAE7D,MAAI,SAAS,MAAM;AACjB,UAAM,SAAS,OAAO,KAAK,MAAM,SAAS,YAAY,CAAC;AACvD,QAAI,IAAI,MAAM;AAAA,EAChB,OAAO;AACL,QAAI,IAAI;AAAA,EACV;AACF;AAcO,SAAS,cAAc,MAAmB;AAC/C,SAAO,OAAO,KAAsB,QAAuC;AACzE,UAAM,UAAU,MAAM,aAAa,GAAG;AACtC,UAAM,WAAW,MAAM,KAAK,QAAQ,OAAO;AAC3C,UAAM,gBAAgB,KAAK,QAAQ;AAAA,EACrC;AACF;AAGA,eAAsB,eAAe,MAAmB,KAAsB;AAC5E,SAAO,KAAK,WAAW,MAAM,aAAa,GAAG,CAAC;AAChD;","names":[]}

package/dist/cli.js

@@ -0,0 +1,170 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { randomBytes } from "crypto";
+
+// src/core/register.ts
+async function registerClient(options) {
+  const {
+    incortaUrl,
+    tenant,
+    name,
+    redirectUris,
+    scope = "openid profile email",
+    grantTypes = ["authorization_code", "refresh_token"],
+    fetchImpl = fetch
+  } = options;
+  if (!redirectUris.length) {
+    throw new Error("[incorta-auth] registerClient requires at least one redirect URI.");
+  }
+  const endpoint = `${incortaUrl.replace(/\/+$/, "")}/oauth/${tenant}/register`;
+  const response = await fetchImpl(endpoint, {
+    method: "POST",
+    headers: { "content-type": "application/json", accept: "application/json" },
+    body: JSON.stringify({
+      client_name: name,
+      redirect_uris: redirectUris,
+      grant_types: grantTypes,
+      scope,
+      token_endpoint_auth_method: "client_secret_basic"
+    })
+  });
+  let body;
+  try {
+    body = await response.json();
+  } catch {
+    throw new Error(
+      `[incorta-auth] Client registration returned a non-JSON response (HTTP ${response.status}). Is the OAuth authorization server enabled on this cluster?`
+    );
+  }
+  if (!response.ok || !body.client_id || !body.client_secret) {
+    throw new Error(
+      `[incorta-auth] Client registration failed (HTTP ${response.status}): ${body.error ?? "unknown_error"} \u2014 ${body.error_description ?? "no description"}`
+    );
+  }
+  return {
+    clientId: body.client_id,
+    clientSecret: body.client_secret,
+    registrationAccessToken: body.registration_access_token,
+    registrationClientUri: body.registration_client_uri
+  };
+}
+
+// src/cli.ts
+var HELP = `incorta-auth \u2014 IncortaAuth SDK helper
+
+Usage:
+  incorta-auth register --url <incortaUrl> --tenant <tenant> --name <name> \\
+                        --redirect <callbackUrl> [--redirect <callbackUrl> ...] \\
+                        [--scope "openid profile email"] [--json]
+
+Registers an OAuth client in Incorta (RFC 7591 dynamic registration) and prints
+the .env entries your app needs.
+
+Example:
+  incorta-auth register \\
+    --url http://localhost:8080/incorta \\
+    --tenant demo \\
+    --name "My App" \\
+    --redirect http://localhost:4000/auth/callback
+`;
+function parseArgs(argv) {
+  const args = { redirects: [], json: false };
+  for (let i = 0; i < argv.length; i++) {
+    const flag = argv[i];
+    const next = () => {
+      const value = argv[++i];
+      if (value === void 0) throw new Error(`Missing value for ${flag}`);
+      return value;
+    };
+    switch (flag) {
+      case "--url":
+        args.url = next();
+        break;
+      case "--tenant":
+        args.tenant = next();
+        break;
+      case "--name":
+        args.name = next();
+        break;
+      case "--scope":
+        args.scope = next();
+        break;
+      case "--redirect":
+        args.redirects.push(next());
+        break;
+      case "--json":
+        args.json = true;
+        break;
+      default:
+        throw new Error(`Unknown flag: ${flag}`);
+    }
+  }
+  return args;
+}
+async function main() {
+  const [command, ...rest] = process.argv.slice(2);
+  if (!command || command === "help" || command === "--help" || command === "-h") {
+    console.log(HELP);
+    return command ? 0 : 1;
+  }
+  if (command !== "register") {
+    console.error(`Unknown command: ${command}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  let args;
+  try {
+    args = parseArgs(rest);
+  } catch (error) {
+    console.error(`${error.message}
+`);
+    console.log(HELP);
+    return 1;
+  }
+  const missing = ["url", "tenant", "name"].filter((key) => !args[key]);
+  if (missing.length || !args.redirects.length) {
+    console.error(
+      `Missing required flag(s): ${[...missing.map((m) => `--${m}`), ...args.redirects.length ? [] : ["--redirect"]].join(", ")}
+`
+    );
+    console.log(HELP);
+    return 1;
+  }
+  const client = await registerClient({
+    incortaUrl: args.url,
+    tenant: args.tenant,
+    name: args.name,
+    redirectUris: args.redirects,
+    scope: args.scope
+  });
+  if (args.json) {
+    console.log(JSON.stringify(client, null, 2));
+    return 0;
+  }
+  const authSecret = randomBytes(32).toString("base64url");
+  console.log(`Client registered successfully.
+`);
+  console.log(`Add this to your app's .env:
+`);
+  console.log(`INCORTA_URL=${args.url}`);
+  console.log(`INCORTA_TENANT=${args.tenant}`);
+  console.log(`INCORTA_CLIENT_ID=${client.clientId}`);
+  console.log(`INCORTA_CLIENT_SECRET=${client.clientSecret}`);
+  console.log(`INCORTA_AUTH_SECRET=${authSecret}`);
+  if (client.registrationAccessToken) {
+    console.log(
+      `
+# Keep these to manage the registration later (PUT/DELETE ${client.registrationClientUri ?? "the registration endpoint"}):`
+    );
+    console.log(`# registration_access_token: ${client.registrationAccessToken}`);
+  }
+  return 0;
+}
+main().then((code) => {
+  process.exitCode = code;
+}).catch((error) => {
+  console.error(error.message);
+  process.exitCode = 1;
+});

package/dist/config-B-2cbZDV.d.cts

@@ -0,0 +1,116 @@
+import { JWTVerifyGetKey } from 'jose';
+
+/** The Incorta user identity carried by the session (claims from the ID token). */
+interface IncortaUser {
+    /** Incorta login name (`sub` claim). */
+    sub: string;
+    name?: string;
+    email?: string;
+    /** Incorta role names, as minted into the ID token. */
+    roles: string[];
+    /** Tenant the user authenticated against. */
+    tenant: string;
+}
+/** What the sealed session cookie holds. */
+interface SessionData {
+    user: IncortaUser;
+    /** Incorta-issued access token (RS256 JWT, aud = client_id). */
+    accessToken: string;
+    /** Epoch millis when the access token expires. */
+    accessTokenExpiresAt: number;
+    /** Rotating refresh token, present when the client has the refresh_token grant. */
+    refreshToken?: string;
+    /** Epoch millis when this session was first created (login time). */
+    createdAt: number;
+}
+interface SessionInfo {
+    user: IncortaUser;
+    /** Epoch millis when the session cookie expires (sliding). */
+    expiresAt: number;
+    /** Epoch millis when the access token expires. */
+    accessTokenExpiresAt: number;
+}
+interface IncortaAuthConfig {
+    /**
+     * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`
+     * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.
+     */
+    incortaUrl?: string;
+    /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */
+    tenant?: string;
+    /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
+    clientId?: string;
+    /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * Secret used to encrypt the session cookie (any long random string, >= 32 chars).
+     * Defaults to `INCORTA_AUTH_SECRET`.
+     */
+    secret?: string;
+    /**
+     * Path prefix the auth routes are mounted under. The SDK serves
+     * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,
+     * `{basePath}/logout` (and optionally `{basePath}/token`).
+     * @default "/auth"
+     */
+    basePath?: string;
+    /**
+     * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the
+     * OAuth callback URL and to validate `redirect_to` targets. When omitted it is
+     * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.
+     * Defaults to `INCORTA_APP_URL`.
+     */
+    appUrl?: string;
+    /** OAuth scopes to request. @default "openid profile email" */
+    scope?: string;
+    session?: {
+        /** @default "incorta_auth_session" */
+        cookieName?: string;
+        /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */
+        maxAge?: number;
+    };
+    cookies?: {
+        /**
+         * `Secure` attribute for cookies. `"auto"` sets it when the request is HTTPS.
+         * @default "auto"
+         */
+        secure?: boolean | "auto";
+    };
+    /**
+     * Expose `GET {basePath}/token` returning the raw Incorta access token to the
+     * browser (for calling Incorta public APIs directly from the frontend). Off by
+     * default — prefer proxying through your backend.
+     * @default false
+     */
+    exposeAccessToken?: boolean;
+    advanced?: {
+        /** Override the OIDC discovery document URL (rarely needed). */
+        discoveryUrl?: string;
+        /** Override JWKS resolution (used by tests to verify against a local key). */
+        jwks?: JWTVerifyGetKey;
+        /** Override fetch (used by tests). */
+        fetch?: typeof fetch;
+    };
+}
+interface ResolvedConfig {
+    incortaUrl: string;
+    tenant: string;
+    clientId: string;
+    clientSecret: string;
+    secret: string;
+    basePath: string;
+    appUrl?: string;
+    scope: string;
+    cookieName: string;
+    stateCookieName: string;
+    sessionMaxAge: number;
+    secureCookies: boolean | "auto";
+    exposeAccessToken: boolean;
+    /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
+    issuer: string;
+    discoveryUrl: string;
+    jwksOverride?: JWTVerifyGetKey;
+    fetch: typeof fetch;
+}
+
+export type { IncortaAuthConfig as I, ResolvedConfig as R, SessionInfo as S, IncortaUser as a, SessionData as b };

package/dist/config-B-2cbZDV.d.ts

@@ -0,0 +1,116 @@
+import { JWTVerifyGetKey } from 'jose';
+
+/** The Incorta user identity carried by the session (claims from the ID token). */
+interface IncortaUser {
+    /** Incorta login name (`sub` claim). */
+    sub: string;
+    name?: string;
+    email?: string;
+    /** Incorta role names, as minted into the ID token. */
+    roles: string[];
+    /** Tenant the user authenticated against. */
+    tenant: string;
+}
+/** What the sealed session cookie holds. */
+interface SessionData {
+    user: IncortaUser;
+    /** Incorta-issued access token (RS256 JWT, aud = client_id). */
+    accessToken: string;
+    /** Epoch millis when the access token expires. */
+    accessTokenExpiresAt: number;
+    /** Rotating refresh token, present when the client has the refresh_token grant. */
+    refreshToken?: string;
+    /** Epoch millis when this session was first created (login time). */
+    createdAt: number;
+}
+interface SessionInfo {
+    user: IncortaUser;
+    /** Epoch millis when the session cookie expires (sliding). */
+    expiresAt: number;
+    /** Epoch millis when the access token expires. */
+    accessTokenExpiresAt: number;
+}
+interface IncortaAuthConfig {
+    /**
+     * Base URL of the Incorta web application, e.g. `https://acme.cloud.incorta.com/incorta`
+     * or `http://localhost:8080/incorta`. Defaults to `INCORTA_URL`.
+     */
+    incortaUrl?: string;
+    /** Incorta tenant name, e.g. `demo`. Defaults to `INCORTA_TENANT`. */
+    tenant?: string;
+    /** OAuth client id (see `incorta-auth register`). Defaults to `INCORTA_CLIENT_ID`. */
+    clientId?: string;
+    /** OAuth client secret. Defaults to `INCORTA_CLIENT_SECRET`. */
+    clientSecret?: string;
+    /**
+     * Secret used to encrypt the session cookie (any long random string, >= 32 chars).
+     * Defaults to `INCORTA_AUTH_SECRET`.
+     */
+    secret?: string;
+    /**
+     * Path prefix the auth routes are mounted under. The SDK serves
+     * `{basePath}/login`, `{basePath}/callback`, `{basePath}/session`,
+     * `{basePath}/logout` (and optionally `{basePath}/token`).
+     * @default "/auth"
+     */
+    basePath?: string;
+    /**
+     * External origin of THIS app, e.g. `http://localhost:4000`. Used to build the
+     * OAuth callback URL and to validate `redirect_to` targets. When omitted it is
+     * derived per request from `x-forwarded-proto`/`x-forwarded-host`/`host`.
+     * Defaults to `INCORTA_APP_URL`.
+     */
+    appUrl?: string;
+    /** OAuth scopes to request. @default "openid profile email" */
+    scope?: string;
+    session?: {
+        /** @default "incorta_auth_session" */
+        cookieName?: string;
+        /** Session lifetime in seconds (sliding — renewed on activity). @default 43200 (12h) */
+        maxAge?: number;
+    };
+    cookies?: {
+        /**
+         * `Secure` attribute for cookies. `"auto"` sets it when the request is HTTPS.
+         * @default "auto"
+         */
+        secure?: boolean | "auto";
+    };
+    /**
+     * Expose `GET {basePath}/token` returning the raw Incorta access token to the
+     * browser (for calling Incorta public APIs directly from the frontend). Off by
+     * default — prefer proxying through your backend.
+     * @default false
+     */
+    exposeAccessToken?: boolean;
+    advanced?: {
+        /** Override the OIDC discovery document URL (rarely needed). */
+        discoveryUrl?: string;
+        /** Override JWKS resolution (used by tests to verify against a local key). */
+        jwks?: JWTVerifyGetKey;
+        /** Override fetch (used by tests). */
+        fetch?: typeof fetch;
+    };
+}
+interface ResolvedConfig {
+    incortaUrl: string;
+    tenant: string;
+    clientId: string;
+    clientSecret: string;
+    secret: string;
+    basePath: string;
+    appUrl?: string;
+    scope: string;
+    cookieName: string;
+    stateCookieName: string;
+    sessionMaxAge: number;
+    secureCookies: boolean | "auto";
+    exposeAccessToken: boolean;
+    /** `{incortaUrl}/oauth/{tenant}` — the OIDC issuer for this tenant. */
+    issuer: string;
+    discoveryUrl: string;
+    jwksOverride?: JWTVerifyGetKey;
+    fetch: typeof fetch;
+}
+
+export type { IncortaAuthConfig as I, ResolvedConfig as R, SessionInfo as S, IncortaUser as a, SessionData as b };