@kanzo-tech/auth 0.2.0

package/dist/can.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"can.d.ts","sourceRoot":"","sources":["../src/can.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAErD;;;;;;;GAOG;AAEH,6FAA6F;AAC7F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,KAAK,EAAE,MAAM,GACZ,YAAY,GAAG,SAAS,CAE1B;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,GAAG,CACjB,OAAO,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,EACnC,IAAI,EAAE,MAAM,EACZ,YAAY,CAAC,EAAE,MAAM,GACpB,OAAO,CAIT"}

package/dist/can.js

@@ -0,0 +1,12 @@
+function u(r, f) {
+  return r == null ? void 0 : r.organizations.find((n) => n.alias === f);
+}
+function a(r, f, n) {
+  var t;
+  return r ? n === void 0 ? r.roles.includes(f) : ((t = u(r, n)) == null ? void 0 : t.roles.includes(f)) ?? !1 : !1;
+}
+export {
+  a as can,
+  u as organizationOf
+};
+//# sourceMappingURL=can.js.map

package/dist/can.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"can.js","sources":["../src/can.ts"],"sourcesContent":["import type { Organization, Session } from \"./types\";\n\n/**\n * The role predicate, and the lookup underneath it.\n *\n * **What this decides is what to draw, never what to allow.** The roles a client holds are a copy,\n * and a copy is something an attacker controls the moment it reaches the browser: `can` hides a\n * button, and the resource server — validating the access token it was sent — is what actually\n * refuses the request behind it. A product that gates only here has not gated anything.\n */\n\n/** The organization by that alias, or `undefined` for one this person does not belong to. */\nexport function organizationOf(\n  session: Session | null | undefined,\n  alias: string,\n): Organization | undefined {\n  return session?.organizations.find((org) => org.alias === alias);\n}\n\n/**\n * Does this session hold `role`?\n *\n * With an `organization`, the question is asked *inside* it — the person's roles there, which is a\n * different set from their realm and client roles and is deliberately not merged with them. A role\n * held in one organization says nothing about another, and the day those two sets are unioned for\n * convenience is the day one organization's owner is every organization's owner.\n *\n * Closed by default: no session, or no membership of the named organization, is `false` rather than\n * an error. There is no hierarchy here either — that `owner` outranks `member` is a fact about a\n * product, so a product spells it out: `can(s, \"owner\", org) || can(s, \"member\", org)`.\n */\nexport function can(\n  session: Session | null | undefined,\n  role: string,\n  organization?: string,\n): boolean {\n  if (!session) return false;\n  if (organization === undefined) return session.roles.includes(role);\n  return organizationOf(session, organization)?.roles.includes(role) ?? false;\n}\n"],"names":["organizationOf","session","alias","org","can","role","organization","_a"],"mappings":"AAYO,SAASA,EACdC,GACAC,GAC0B;AAC1B,SAAOD,KAAA,gBAAAA,EAAS,cAAc,KAAK,CAACE,MAAQA,EAAI,UAAUD;AAC5D;AAcO,SAASE,EACdH,GACAI,GACAC,GACS;AAvBJ,MAAAC;AAwBL,SAAKN,IACDK,MAAiB,SAAkBL,EAAQ,MAAM,SAASI,CAAI,MAC3DE,IAAAP,EAAeC,GAASK,CAAY,MAApC,gBAAAC,EAAuC,MAAM,SAASF,OAAS,KAFjD;AAGvB;"}

package/dist/claims.d.ts

@@ -0,0 +1,50 @@
+import { Session } from './types';
+/**
+ * Keycloak's claim vocabulary, read into a {@link Session}. The only file in this package that
+ * knows what Keycloak calls things.
+ *
+ * It is pure on purpose: claims in, session out, no network, no storage, no React. That is what
+ * makes the vocabulary testable without a realm, and it is why every door can share one reading of
+ * it instead of each parsing the token its own way.
+ *
+ * **Nothing here is invented.** Roles are `realm_access.roles` and `resource_access.<clientId>.roles`
+ * — the claims Keycloak emits with no configuration — and membership is the `organization` claim
+ * from the organization scope. A deployment that renames these has made work for itself; a
+ * deployment that uses them gets this file for free.
+ */
+/** What the reader needs to know about the application doing the reading. */
+export interface ClaimsConfig {
+    /**
+     * This application's Keycloak client id. It selects two things: which entry of `resource_access`
+     * is ours, and which organization groups are ours — see {@link roleFromGroupPath}.
+     */
+    readonly clientId: string;
+}
+/**
+ * A group path, as the role it grants *this* application — or `null` when it grants nothing here.
+ *
+ * Keycloak writes group membership as a path: `/keasy/owner`. Organization Groups (26.6) give each
+ * organization its own hierarchy, so the convention this package reads is that **the first segment
+ * is the application** when there is more than one:
+ *
+ * - `/keasy/owner` under client `keasy` → `owner`
+ * - `/hub/reader` under client `keasy` → `null`, because it is another application's role
+ * - `/owner` → `owner`, a role the organization grants across every application
+ *
+ * The filtering is not a nicety. Without it, a role granted to someone in the hub would authorise
+ * them in keasy, which is the whole failure this separation exists to prevent.
+ */
+export declare function roleFromGroupPath(path: string, clientId: string): string | null;
+/**
+ * Read a decoded claim set into a {@link Session}.
+ *
+ * Throws only for a claim set with no `sub`, which is not a session at all but a misconfiguration,
+ * and is worth being loud about. Everything else degrades quietly to empty: holding no roles and
+ * belonging to no organization are legitimate states, and a token that merely omits a scope must
+ * not take the application down.
+ *
+ * The claims are **data, never instructions** — they came over the wire. Nothing here indexes into
+ * the application on a claim's say-so; it reads known names and ignores the rest.
+ */
+export declare function claims(raw: unknown, config: ClaimsConfig): Session;
+//# sourceMappingURL=claims.d.ts.map

package/dist/claims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.d.ts","sourceRoot":"","sources":["../src/claims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgC,KAAK,OAAO,EAAE,MAAM,SAAS,CAAC;AAErE;;;;;;;;;;;;GAYG;AAEH,6EAA6E;AAC7E,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAgBD;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAM/E;AA0CD;;;;;;;;;;GAUG;AACH,wBAAgB,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CA8BlE"}

package/dist/claims.js

@@ -0,0 +1,56 @@
+import { AuthError as d } from "./types.js";
+function a(r) {
+  return typeof r == "object" && r !== null && !Array.isArray(r) ? r : void 0;
+}
+function l(r) {
+  return Array.isArray(r) ? r.filter((t) => typeof t == "string") : [];
+}
+function o(r) {
+  return typeof r == "string" && r.length > 0 ? r : void 0;
+}
+function g(r, t) {
+  const e = r.split("/").filter((i) => i.length > 0), [n, ...s] = e;
+  return n === void 0 ? null : s.length === 0 ? n : n === t ? s.join("/") : null;
+}
+function y(r, t) {
+  if (Array.isArray(r))
+    return r.filter((n) => typeof n == "string").map((n) => ({ alias: n, roles: [] }));
+  const e = a(r);
+  return e === void 0 ? [] : Object.entries(e).map(([n, s]) => {
+    const i = a(s), c = l(i == null ? void 0 : i.groups).map((u) => g(u, t)).filter((u) => u !== null);
+    return { alias: n, id: o(i == null ? void 0 : i.id), roles: c };
+  });
+}
+function A(r) {
+  const t = o(r.name);
+  if (t !== void 0) return t;
+  const e = [o(r.given_name), o(r.family_name)].filter(
+    (n) => n !== void 0
+  );
+  return e.length > 0 ? e.join(" ") : void 0;
+}
+function b(r, t) {
+  var f, m, p;
+  const e = a(r) ?? {}, n = o(e.sub);
+  if (n === void 0)
+    throw new d("claims.no-subject", "the claim set carries no `sub`, so it names nobody");
+  const s = l((f = a(e.realm_access)) == null ? void 0 : f.roles), i = l(
+    (p = a((m = a(e.resource_access)) == null ? void 0 : m[t.clientId])) == null ? void 0 : p.roles
+  ), c = e.exp, u = typeof c == "number" && Number.isFinite(c) ? c * 1e3 : 0;
+  return {
+    user: {
+      id: n,
+      email: o(e.email),
+      name: A(e),
+      username: o(e.preferred_username)
+    },
+    roles: [.../* @__PURE__ */ new Set([...s, ...i])],
+    organizations: y(e.organization, t.clientId),
+    expiresAt: u
+  };
+}
+export {
+  b as claims,
+  g as roleFromGroupPath
+};
+//# sourceMappingURL=claims.js.map

package/dist/claims.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claims.js","sources":["../src/claims.ts"],"sourcesContent":["import { AuthError, type Organization, type Session } from \"./types\";\n\n/**\n * Keycloak's claim vocabulary, read into a {@link Session}. The only file in this package that\n * knows what Keycloak calls things.\n *\n * It is pure on purpose: claims in, session out, no network, no storage, no React. That is what\n * makes the vocabulary testable without a realm, and it is why every door can share one reading of\n * it instead of each parsing the token its own way.\n *\n * **Nothing here is invented.** Roles are `realm_access.roles` and `resource_access.<clientId>.roles`\n * — the claims Keycloak emits with no configuration — and membership is the `organization` claim\n * from the organization scope. A deployment that renames these has made work for itself; a\n * deployment that uses them gets this file for free.\n */\n\n/** What the reader needs to know about the application doing the reading. */\nexport interface ClaimsConfig {\n  /**\n   * This application's Keycloak client id. It selects two things: which entry of `resource_access`\n   * is ours, and which organization groups are ours — see {@link roleFromGroupPath}.\n   */\n  readonly clientId: string;\n}\n\nfunction asRecord(value: unknown): Record<string, unknown> | undefined {\n  return typeof value === \"object\" && value !== null && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n\nfunction asStrings(value: unknown): string[] {\n  return Array.isArray(value) ? value.filter((v): v is string => typeof v === \"string\") : [];\n}\n\nfunction asString(value: unknown): string | undefined {\n  return typeof value === \"string\" && value.length > 0 ? value : undefined;\n}\n\n/**\n * A group path, as the role it grants *this* application — or `null` when it grants nothing here.\n *\n * Keycloak writes group membership as a path: `/keasy/owner`. Organization Groups (26.6) give each\n * organization its own hierarchy, so the convention this package reads is that **the first segment\n * is the application** when there is more than one:\n *\n * - `/keasy/owner` under client `keasy` → `owner`\n * - `/hub/reader` under client `keasy` → `null`, because it is another application's role\n * - `/owner` → `owner`, a role the organization grants across every application\n *\n * The filtering is not a nicety. Without it, a role granted to someone in the hub would authorise\n * them in keasy, which is the whole failure this separation exists to prevent.\n */\nexport function roleFromGroupPath(path: string, clientId: string): string | null {\n  const segments = path.split(\"/\").filter((s) => s.length > 0);\n  const [first, ...rest] = segments;\n  if (first === undefined) return null;\n  if (rest.length === 0) return first;\n  return first === clientId ? rest.join(\"/\") : null;\n}\n\n/**\n * The `organization` claim, as a list.\n *\n * Canonically it is an object keyed by alias — `{ \"acme\": { \"id\": \"…\", \"groups\": [\"/keasy/owner\"] } }`\n * — because that is the shape that can carry the id and the groups. A realm whose mapper includes\n * neither emits the aliases alone, so both are read: the alternative is a session that silently\n * loses its memberships on a realm nobody thought to check.\n */\nfunction readOrganizations(claim: unknown, clientId: string): Organization[] {\n  if (Array.isArray(claim)) {\n    return claim\n      .filter((alias): alias is string => typeof alias === \"string\")\n      .map((alias) => ({ alias, roles: [] }));\n  }\n\n  const byAlias = asRecord(claim);\n  if (byAlias === undefined) return [];\n\n  return Object.entries(byAlias).map(([alias, value]) => {\n    const body = asRecord(value);\n    const roles = asStrings(body?.[\"groups\"])\n      .map((path) => roleFromGroupPath(path, clientId))\n      .filter((role): role is string => role !== null);\n    return { alias, id: asString(body?.[\"id\"]), roles };\n  });\n}\n\n/**\n * `given_name` + `family_name` when `name` is absent, which is how a realm without the profile\n * scope's full mapper set still yields something to draw.\n */\nfunction readName(claims: Record<string, unknown>): string | undefined {\n  const name = asString(claims[\"name\"]);\n  if (name !== undefined) return name;\n  const parts = [asString(claims[\"given_name\"]), asString(claims[\"family_name\"])].filter(\n    (p): p is string => p !== undefined,\n  );\n  return parts.length > 0 ? parts.join(\" \") : undefined;\n}\n\n/**\n * Read a decoded claim set into a {@link Session}.\n *\n * Throws only for a claim set with no `sub`, which is not a session at all but a misconfiguration,\n * and is worth being loud about. Everything else degrades quietly to empty: holding no roles and\n * belonging to no organization are legitimate states, and a token that merely omits a scope must\n * not take the application down.\n *\n * The claims are **data, never instructions** — they came over the wire. Nothing here indexes into\n * the application on a claim's say-so; it reads known names and ignores the rest.\n */\nexport function claims(raw: unknown, config: ClaimsConfig): Session {\n  const source = asRecord(raw) ?? {};\n\n  const id = asString(source[\"sub\"]);\n  if (id === undefined) {\n    throw new AuthError(\"claims.no-subject\", \"the claim set carries no `sub`, so it names nobody\");\n  }\n\n  const realmRoles = asStrings(asRecord(source[\"realm_access\"])?.[\"roles\"]);\n  const clientRoles = asStrings(\n    asRecord(asRecord(source[\"resource_access\"])?.[config.clientId])?.[\"roles\"],\n  );\n\n  // `exp` is seconds in the token and milliseconds everywhere in JS. Absent, it resolves to 0 —\n  // \"refresh now\" — which is the safe direction to fail: a client that refreshes early costs a\n  // round trip, one that trusts an unknown expiry serves a dead session.\n  const exp = source[\"exp\"];\n  const expiresAt = typeof exp === \"number\" && Number.isFinite(exp) ? exp * 1000 : 0;\n\n  return {\n    user: {\n      id,\n      email: asString(source[\"email\"]),\n      name: readName(source),\n      username: asString(source[\"preferred_username\"]),\n    },\n    roles: [...new Set([...realmRoles, ...clientRoles])],\n    organizations: readOrganizations(source[\"organization\"], config.clientId),\n    expiresAt,\n  };\n}\n"],"names":["asRecord","value","asStrings","v","asString","roleFromGroupPath","path","clientId","segments","s","first","rest","readOrganizations","claim","alias","byAlias","body","roles","role","readName","claims","name","parts","p","raw","config","source","id","AuthError","realmRoles","_a","clientRoles","_c","_b","exp","expiresAt"],"mappings":";AAyBA,SAASA,EAASC,GAAqD;AACrE,SAAO,OAAOA,KAAU,YAAYA,MAAU,QAAQ,CAAC,MAAM,QAAQA,CAAK,IACrEA,IACD;AACN;AAEA,SAASC,EAAUD,GAA0B;AAC3C,SAAO,MAAM,QAAQA,CAAK,IAAIA,EAAM,OAAO,CAACE,MAAmB,OAAOA,KAAM,QAAQ,IAAI,CAAA;AAC1F;AAEA,SAASC,EAASH,GAAoC;AACpD,SAAO,OAAOA,KAAU,YAAYA,EAAM,SAAS,IAAIA,IAAQ;AACjE;AAgBO,SAASI,EAAkBC,GAAcC,GAAiC;AAC/E,QAAMC,IAAWF,EAAK,MAAM,GAAG,EAAE,OAAO,CAACG,MAAMA,EAAE,SAAS,CAAC,GACrD,CAACC,GAAO,GAAGC,CAAI,IAAIH;AACzB,SAAIE,MAAU,SAAkB,OAC5BC,EAAK,WAAW,IAAUD,IACvBA,MAAUH,IAAWI,EAAK,KAAK,GAAG,IAAI;AAC/C;AAUA,SAASC,EAAkBC,GAAgBN,GAAkC;AAC3E,MAAI,MAAM,QAAQM,CAAK;AACrB,WAAOA,EACJ,OAAO,CAACC,MAA2B,OAAOA,KAAU,QAAQ,EAC5D,IAAI,CAACA,OAAW,EAAE,OAAAA,GAAO,OAAO,CAAA,IAAK;AAG1C,QAAMC,IAAUf,EAASa,CAAK;AAC9B,SAAIE,MAAY,SAAkB,CAAA,IAE3B,OAAO,QAAQA,CAAO,EAAE,IAAI,CAAC,CAACD,GAAOb,CAAK,MAAM;AACrD,UAAMe,IAAOhB,EAASC,CAAK,GACrBgB,IAAQf,EAAUc,KAAA,gBAAAA,EAAO,MAAS,EACrC,IAAI,CAACV,MAASD,EAAkBC,GAAMC,CAAQ,CAAC,EAC/C,OAAO,CAACW,MAAyBA,MAAS,IAAI;AACjD,WAAO,EAAE,OAAAJ,GAAO,IAAIV,EAASY,KAAA,gBAAAA,EAAO,EAAK,GAAG,OAAAC,EAAA;AAAA,EAC9C,CAAC;AACH;AAMA,SAASE,EAASC,GAAqD;AACrE,QAAMC,IAAOjB,EAASgB,EAAO,IAAO;AACpC,MAAIC,MAAS,OAAW,QAAOA;AAC/B,QAAMC,IAAQ,CAAClB,EAASgB,EAAO,UAAa,GAAGhB,EAASgB,EAAO,WAAc,CAAC,EAAE;AAAA,IAC9E,CAACG,MAAmBA,MAAM;AAAA,EAAA;AAE5B,SAAOD,EAAM,SAAS,IAAIA,EAAM,KAAK,GAAG,IAAI;AAC9C;AAaO,SAASF,EAAOI,GAAcC,GAA+B;;AAClE,QAAMC,IAAS1B,EAASwB,CAAG,KAAK,CAAA,GAE1BG,IAAKvB,EAASsB,EAAO,GAAM;AACjC,MAAIC,MAAO;AACT,UAAM,IAAIC,EAAU,qBAAqB,oDAAoD;AAG/F,QAAMC,IAAa3B,GAAU4B,IAAA9B,EAAS0B,EAAO,YAAe,MAA/B,gBAAAI,EAAmC,KAAQ,GAClEC,IAAc7B;AAAA,KAClB8B,IAAAhC,GAASiC,IAAAjC,EAAS0B,EAAO,eAAkB,MAAlC,gBAAAO,EAAsCR,EAAO,SAAS,MAA/D,gBAAAO,EAAmE;AAAA,EAAO,GAMtEE,IAAMR,EAAO,KACbS,IAAY,OAAOD,KAAQ,YAAY,OAAO,SAASA,CAAG,IAAIA,IAAM,MAAO;AAEjF,SAAO;AAAA,IACL,MAAM;AAAA,MACJ,IAAAP;AAAA,MACA,OAAOvB,EAASsB,EAAO,KAAQ;AAAA,MAC/B,MAAMP,EAASO,CAAM;AAAA,MACrB,UAAUtB,EAASsB,EAAO,kBAAqB;AAAA,IAAA;AAAA,IAEjD,OAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAGG,GAAY,GAAGE,CAAW,CAAC,CAAC;AAAA,IACnD,eAAenB,EAAkBc,EAAO,cAAiBD,EAAO,QAAQ;AAAA,IACxE,WAAAU;AAAA,EAAA;AAEJ;"}

package/dist/cookie-session.d.ts

@@ -0,0 +1,28 @@
+export interface SealedCookieConfig {
+    /**
+     * The name **after** the `__Host-` prefix, which this module adds. A caller cannot decline it:
+     * the prefix is the only cookie attribute a browser enforces on our behalf.
+     */
+    readonly name: string;
+    /**
+     * The sealing secret. Any length — it is hashed to the 256-bit key — but it is a *secret*, not a
+     * password: generate it, do not choose it.
+     */
+    readonly secret: string | Uint8Array;
+    /** Seconds. It is both the cookie's `Max-Age` and the JWE's `exp`, so neither can outlive the other. */
+    readonly maxAge: number;
+}
+export interface SealedCookie<T> {
+    /** The full cookie name, prefix included. */
+    readonly name: string;
+    /** The value of a `Set-Cookie` header carrying `value`. */
+    seal(value: T): Promise<string>;
+    /** Read from a request's `Cookie` header. `null` for absent, tampered, or expired — all one answer. */
+    read(header: string | null | undefined): Promise<T | null>;
+    /** The value of a `Set-Cookie` header that removes it. */
+    clear(): string;
+}
+/** One cookie value out of a request's `Cookie` header, or `undefined`. */
+export declare function cookieValue(header: string | null | undefined, name: string): string | undefined;
+export declare function sealedCookie<T>(config: SealedCookieConfig): SealedCookie<T>;
+//# sourceMappingURL=cookie-session.d.ts.map

package/dist/cookie-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-session.d.ts","sourceRoot":"","sources":["../src/cookie-session.ts"],"names":[],"mappings":"AAoCA,MAAM,WAAW,kBAAkB;IACjC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,wGAAwG;IACxG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,6CAA6C;IAC7C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,2DAA2D;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAChC,uGAAuG;IACvG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IAC3D,0DAA0D;IAC1D,KAAK,IAAI,MAAM,CAAC;CACjB;AAED,2EAA2E;AAC3E,wBAAgB,WAAW,CACzB,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EACjC,IAAI,EAAE,MAAM,GACX,MAAM,GAAG,SAAS,CAQpB;AAaD,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAAC,CAAC,CAAC,CAgD3E"}

package/dist/cookie-session.js

@@ -0,0 +1,51 @@
+import { jwtDecrypt as l, EncryptJWT as u } from "jose";
+const s = 4096;
+function y(e, t) {
+  if (!(e == null || e.length === 0))
+    for (const n of e.split(";")) {
+      const r = n.indexOf("=");
+      if (r !== -1 && n.slice(0, r).trim() === t)
+        return n.slice(r + 1).trim();
+    }
+}
+async function d(e) {
+  const t = typeof e == "string" ? new TextEncoder().encode(e) : e;
+  return new Uint8Array(await crypto.subtle.digest("SHA-256", t));
+}
+function c(e, t, n) {
+  return `${e}=${t}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${n}`;
+}
+function m(e) {
+  const t = `__Host-${e.name}`;
+  let n;
+  const r = () => n ?? (n = d(e.secret));
+  return {
+    name: t,
+    async seal(a) {
+      const i = await new u({ v: a }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${e.maxAge}s`).encrypt(await r()), o = c(t, i, e.maxAge);
+      if (o.length > s)
+        throw new Error(
+          `${t} is ${o.length} bytes and a browser is only required to keep ${s}; a cookie over the limit is dropped silently and the session simply never appears. Give relyingParty a SessionStore so the cookie carries a ticket instead of the tokens.`
+        );
+      return o;
+    },
+    async read(a) {
+      const i = y(a, t);
+      if (i === void 0) return null;
+      try {
+        const { payload: o } = await l(i, await r());
+        return o.v ?? null;
+      } catch {
+        return null;
+      }
+    },
+    clear() {
+      return c(t, "", 0);
+    }
+  };
+}
+export {
+  y as cookieValue,
+  m as sealedCookie
+};
+//# sourceMappingURL=cookie-session.js.map

package/dist/cookie-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-session.js","sources":["../src/cookie-session.ts"],"sourcesContent":["import { EncryptJWT, jwtDecrypt } from \"jose\";\n\n/**\n * A value sealed into a cookie, and read back out of one.\n *\n * There is **one** mechanism here and it is used twice: for the session that outlives a request,\n * and for the short-lived transaction that carries `state`, `nonce` and the PKCE verifier between\n * the two legs of the authorization code flow. Holding the transaction in a cookie rather than in\n * server memory is what makes the BFF stateless by default — keasy's Rust keeps those three in a\n * SQLite-backed server session, and pays for a session store before anyone has signed in.\n *\n * ## The attributes, and why each one\n *\n * - **`__Host-` prefix**, added here and not declinable. It forces `Secure` and `Path=/`, forbids\n *   `Domain`, and — the part that matters — a page on a sibling subdomain cannot write it. Without\n *   the prefix, anything that can serve `evil.example.test` can set a cookie that arrives at\n *   `app.example.test` looking exactly like ours.\n * - **`HttpOnly`**, so script cannot read it. In a BFF the browser is not supposed to hold the\n *   credential at all; this is the enforcement of that sentence.\n * - **`SameSite=Lax`**, not `Strict`. `Strict` withholds the cookie on the top-level navigation\n *   *back* from the identity provider, so the callback arrives without the transaction it needs\n *   and every sign-in fails. `Lax` sends it on exactly that navigation and on nothing else risky.\n * - **JWE, not a signature.** The payload is a refresh token: signing would authenticate it and\n *   leave it readable to anyone who can see the cookie. `dir` + `A256GCM` is authenticated\n *   encryption, so a tampered byte fails to decrypt rather than decrypting to something else.\n */\n\n/**\n * The 4 KB a browser is required to keep, and the reason this module has a size guard.\n *\n * A cookie over the limit is not rejected loudly — it is *dropped*, and the symptom is a sign-in\n * that appears to work and a session that is never there. A `SessionStore` is the way out, and the\n * error says so.\n */\nconst COOKIE_LIMIT = 4096;\n\nexport interface SealedCookieConfig {\n  /**\n   * The name **after** the `__Host-` prefix, which this module adds. A caller cannot decline it:\n   * the prefix is the only cookie attribute a browser enforces on our behalf.\n   */\n  readonly name: string;\n  /**\n   * The sealing secret. Any length — it is hashed to the 256-bit key — but it is a *secret*, not a\n   * password: generate it, do not choose it.\n   */\n  readonly secret: string | Uint8Array;\n  /** Seconds. It is both the cookie's `Max-Age` and the JWE's `exp`, so neither can outlive the other. */\n  readonly maxAge: number;\n}\n\nexport interface SealedCookie<T> {\n  /** The full cookie name, prefix included. */\n  readonly name: string;\n  /** The value of a `Set-Cookie` header carrying `value`. */\n  seal(value: T): Promise<string>;\n  /** Read from a request's `Cookie` header. `null` for absent, tampered, or expired — all one answer. */\n  read(header: string | null | undefined): Promise<T | null>;\n  /** The value of a `Set-Cookie` header that removes it. */\n  clear(): string;\n}\n\n/** One cookie value out of a request's `Cookie` header, or `undefined`. */\nexport function cookieValue(\n  header: string | null | undefined,\n  name: string,\n): string | undefined {\n  if (header === null || header === undefined || header.length === 0) return undefined;\n  for (const part of header.split(\";\")) {\n    const eq = part.indexOf(\"=\");\n    if (eq === -1) continue;\n    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();\n  }\n  return undefined;\n}\n\nasync function keyFrom(secret: string | Uint8Array): Promise<Uint8Array> {\n  const input = typeof secret === \"string\" ? new TextEncoder().encode(secret) : secret;\n  return new Uint8Array(await crypto.subtle.digest(\"SHA-256\", input as BufferSource));\n}\n\nfunction setCookie(name: string, value: string, maxAge: number): string {\n  // No `Domain`: `__Host-` forbids it, and forbidding it is the point — a cookie without a domain\n  // is the one a sibling host cannot reach.\n  return `${name}=${value}; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=${maxAge}`;\n}\n\nexport function sealedCookie<T>(config: SealedCookieConfig): SealedCookie<T> {\n  const name = `__Host-${config.name}`;\n  // Derived once, lazily: the digest is cheap but a request path should not pay for it per call.\n  let key: Promise<Uint8Array> | undefined;\n  const material = () => (key ??= keyFrom(config.secret));\n\n  return {\n    name,\n\n    async seal(value) {\n      // The payload is wrapped rather than spread, so a field named `exp` or `iss` in a `Session`\n      // could never come to mean the JWT claim of the same name.\n      const token = await new EncryptJWT({ v: value })\n        .setProtectedHeader({ alg: \"dir\", enc: \"A256GCM\" })\n        .setIssuedAt()\n        .setExpirationTime(`${config.maxAge}s`)\n        .encrypt(await material());\n\n      const header = setCookie(name, token, config.maxAge);\n      if (header.length > COOKIE_LIMIT) {\n        throw new Error(\n          `${name} is ${header.length} bytes and a browser is only required to keep ${COOKIE_LIMIT}; ` +\n            \"a cookie over the limit is dropped silently and the session simply never appears. \" +\n            \"Give relyingParty a SessionStore so the cookie carries a ticket instead of the tokens.\",\n        );\n      }\n      return header;\n    },\n\n    async read(header) {\n      const token = cookieValue(header, name);\n      if (token === undefined) return null;\n      try {\n        const { payload } = await jwtDecrypt(token, await material());\n        return (payload[\"v\"] ?? null) as T | null;\n      } catch {\n        // Forged, re-keyed, truncated by a proxy, or simply expired. None of them is a session,\n        // and none of them is worth a different answer to the caller — `bff-auth` reads the same\n        // endpoint the same way. A thrown error here would only ever be caught and turned into\n        // this.\n        return null;\n      }\n    },\n\n    clear() {\n      return setCookie(name, \"\", 0);\n    },\n  };\n}\n"],"names":["COOKIE_LIMIT","cookieValue","header","name","part","eq","keyFrom","secret","input","setCookie","value","maxAge","sealedCookie","config","key","material","token","EncryptJWT","payload","jwtDecrypt"],"mappings":";AAkCA,MAAMA,IAAe;AA6Bd,SAASC,EACdC,GACAC,GACoB;AACpB,MAAI,EAAAD,KAAW,QAAgCA,EAAO,WAAW;AACjE,eAAWE,KAAQF,EAAO,MAAM,GAAG,GAAG;AACpC,YAAMG,IAAKD,EAAK,QAAQ,GAAG;AAC3B,UAAIC,MAAO,MACPD,EAAK,MAAM,GAAGC,CAAE,EAAE,KAAA,MAAWF;AAAM,eAAOC,EAAK,MAAMC,IAAK,CAAC,EAAE,KAAA;AAAA,IACnE;AAEF;AAEA,eAAeC,EAAQC,GAAkD;AACvE,QAAMC,IAAQ,OAAOD,KAAW,WAAW,IAAI,cAAc,OAAOA,CAAM,IAAIA;AAC9E,SAAO,IAAI,WAAW,MAAM,OAAO,OAAO,OAAO,WAAWC,CAAqB,CAAC;AACpF;AAEA,SAASC,EAAUN,GAAcO,GAAeC,GAAwB;AAGtE,SAAO,GAAGR,CAAI,IAAIO,CAAK,qDAAqDC,CAAM;AACpF;AAEO,SAASC,EAAgBC,GAA6C;AAC3E,QAAMV,IAAO,UAAUU,EAAO,IAAI;AAElC,MAAIC;AACJ,QAAMC,IAAW,MAAOD,UAAQR,EAAQO,EAAO,MAAM;AAErD,SAAO;AAAA,IACL,MAAAV;AAAA,IAEA,MAAM,KAAKO,GAAO;AAGhB,YAAMM,IAAQ,MAAM,IAAIC,EAAW,EAAE,GAAGP,EAAA,CAAO,EAC5C,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAA,CAAW,EACjD,YAAA,EACA,kBAAkB,GAAGG,EAAO,MAAM,GAAG,EACrC,QAAQ,MAAME,EAAA,CAAU,GAErBb,IAASO,EAAUN,GAAMa,GAAOH,EAAO,MAAM;AACnD,UAAIX,EAAO,SAASF;AAClB,cAAM,IAAI;AAAA,UACR,GAAGG,CAAI,OAAOD,EAAO,MAAM,iDAAiDF,CAAY;AAAA,QAAA;AAK5F,aAAOE;AAAA,IACT;AAAA,IAEA,MAAM,KAAKA,GAAQ;AACjB,YAAMc,IAAQf,EAAYC,GAAQC,CAAI;AACtC,UAAIa,MAAU,OAAW,QAAO;AAChC,UAAI;AACF,cAAM,EAAE,SAAAE,MAAY,MAAMC,EAAWH,GAAO,MAAMD,GAAU;AAC5D,eAAQG,EAAQ,KAAQ;AAAA,MAC1B,QAAQ;AAKN,eAAO;AAAA,MACT;AAAA,IACF;AAAA,IAEA,QAAQ;AACN,aAAOT,EAAUN,GAAM,IAAI,CAAC;AAAA,IAC9B;AAAA,EAAA;AAEJ;"}

package/dist/gate.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Show `children` to someone who holds `role`, and `fallback` to everyone else.
+ *
+ * **This hides UI and protects nothing**, for the reason {@link can} carries: a product gated only
+ * here is ungated.
+ *
+ * `organization` asks the question inside that organization rather than against the realm roles,
+ * and {@link can} does not merge the two.
+ */
+export declare function Gate({ role, organization, fallback, children, }: {
+    readonly role: string;
+    readonly organization?: string;
+    readonly fallback?: React.ReactNode;
+    readonly children?: React.ReactNode;
+}): import("react").JSX.Element | null;
+//# sourceMappingURL=gate.d.ts.map

package/dist/gate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.d.ts","sourceRoot":"","sources":["../src/gate.tsx"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,wBAAgB,IAAI,CAAC,EACnB,IAAI,EACJ,YAAY,EACZ,QAAe,EACf,QAAQ,GACT,EAAE;IACD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;IACpC,QAAQ,CAAC,QAAQ,CAAC,EAAE,KAAK,CAAC,SAAS,CAAC;CACrC,sCAUA"}

package/dist/gate.js

@@ -0,0 +1,17 @@
+"use client";
+import { jsx as i, Fragment as m } from "react/jsx-runtime";
+import { can as u } from "./can.js";
+import { useSession as l } from "./use-session.js";
+function p({
+  role: n,
+  organization: r,
+  fallback: o = null,
+  children: t
+}) {
+  const { session: s, status: e } = l();
+  return e === "loading" ? null : /* @__PURE__ */ i(m, { children: u(s, n, r) ? t : o });
+}
+export {
+  p as Gate
+};
+//# sourceMappingURL=gate.js.map

package/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sources":["../src/gate.tsx"],"sourcesContent":["\"use client\";\n\nimport { can } from \"./can\";\nimport { useSession } from \"./use-session\";\n\n/**\n * Show `children` to someone who holds `role`, and `fallback` to everyone else.\n *\n * **This hides UI and protects nothing**, for the reason {@link can} carries: a product gated only\n * here is ungated.\n *\n * `organization` asks the question inside that organization rather than against the realm roles,\n * and {@link can} does not merge the two.\n */\nexport function Gate({\n  role,\n  organization,\n  fallback = null,\n  children,\n}: {\n  readonly role: string;\n  readonly organization?: string;\n  readonly fallback?: React.ReactNode;\n  readonly children?: React.ReactNode;\n}) {\n  const { session, status } = useSession();\n\n  // While the session is still being read, neither answer is known to be true, so neither is\n  // drawn. Rendering the fallback here is the flicker worth avoiding — \"you cannot do this\" shown\n  // to someone who can, for as long as the session endpoint takes — and rendering the children is\n  // worse, because it flashes a control and then retracts it.\n  if (status === \"loading\") return null;\n\n  return <>{can(session, role, organization) ? children : fallback}</>;\n}\n"],"names":[],"mappings":";;;;AAcO;AAAc;AACnB;AACA;AACW;AAEb;AAME;AAMA;AAGF;;;;"}

package/dist/host.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The organization a hostname addresses — a **hint**, never an authority.
+ *
+ * This file has no `"use client"` and takes no globals, and both are deliberate: it is a string
+ * function, so it is testable without a browser and readable on a server.
+ *
+ * The rule it must not be mistaken for: **the host is chosen by whoever made the request.** Anyone
+ * can send `Host: acme.kanzo.tech`. What makes an organization real for a session is the
+ * `organization` claim in a token Keycloak signed, so every consumer of this resolves the answer
+ * against `session.organizations` and treats a miss as "not a member" — which is what
+ * `useOrganization` does and what the server's own scope extractor must do before it opens a
+ * database.
+ */
+/**
+ * The leading label, when the hostname has one to spare.
+ *
+ * `acme.kanzo.tech` → `acme`, and `kanzo.tech` → `undefined`, because a two-label host is the site
+ * itself rather than a tenant of it. `acme.localhost` → `acme` as the one exception, since that is
+ * how a developer reaches a tenant without editing DNS. An IP address yields nothing.
+ */
+export declare function organizationFromHost(hostname: string | undefined): string | undefined;
+//# sourceMappingURL=host.d.ts.map

package/dist/host.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.d.ts","sourceRoot":"","sources":["../src/host.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAYrF"}

package/dist/host.js

@@ -0,0 +1,10 @@
+function o(t) {
+  if (t === void 0 || t.length === 0 || /^\[|^\d+\.\d+\.\d+\.\d+$/.test(t)) return;
+  const r = t.split("."), [i, n] = r;
+  if (!(i === void 0 || i.length === 0) && (r.length >= 3 || r.length === 2 && n === "localhost"))
+    return i;
+}
+export {
+  o as organizationFromHost
+};
+//# sourceMappingURL=host.js.map

package/dist/host.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"host.js","sources":["../src/host.ts"],"sourcesContent":["/**\n * The organization a hostname addresses — a **hint**, never an authority.\n *\n * This file has no `\"use client\"` and takes no globals, and both are deliberate: it is a string\n * function, so it is testable without a browser and readable on a server.\n *\n * The rule it must not be mistaken for: **the host is chosen by whoever made the request.** Anyone\n * can send `Host: acme.kanzo.tech`. What makes an organization real for a session is the\n * `organization` claim in a token Keycloak signed, so every consumer of this resolves the answer\n * against `session.organizations` and treats a miss as \"not a member\" — which is what\n * `useOrganization` does and what the server's own scope extractor must do before it opens a\n * database.\n */\n\n/**\n * The leading label, when the hostname has one to spare.\n *\n * `acme.kanzo.tech` → `acme`, and `kanzo.tech` → `undefined`, because a two-label host is the site\n * itself rather than a tenant of it. `acme.localhost` → `acme` as the one exception, since that is\n * how a developer reaches a tenant without editing DNS. An IP address yields nothing.\n */\nexport function organizationFromHost(hostname: string | undefined): string | undefined {\n  if (hostname === undefined || hostname.length === 0) return undefined;\n  // An IPv4 literal or a bracketed IPv6 has no labels to read.\n  if (/^\\[|^\\d+\\.\\d+\\.\\d+\\.\\d+$/.test(hostname)) return undefined;\n\n  const labels = hostname.split(\".\");\n  const [first, second] = labels;\n  if (first === undefined || first.length === 0) return undefined;\n\n  if (labels.length >= 3) return first;\n  if (labels.length === 2 && second === \"localhost\") return first;\n  return undefined;\n}\n"],"names":["organizationFromHost","hostname","labels","first","second"],"mappings":"AAqBO,SAASA,EAAqBC,GAAkD;AAGrF,MAFIA,MAAa,UAAaA,EAAS,WAAW,KAE9C,2BAA2B,KAAKA,CAAQ,EAAG;AAE/C,QAAMC,IAASD,EAAS,MAAM,GAAG,GAC3B,CAACE,GAAOC,CAAM,IAAIF;AACxB,MAAI,EAAAC,MAAU,UAAaA,EAAM,WAAW,OAExCD,EAAO,UAAU,KACjBA,EAAO,WAAW,KAAKE,MAAW;AAAa,WAAOD;AAE5D;"}

package/dist/index.d.ts

@@ -0,0 +1,64 @@
+/**
+ * `@kanzo-tech/auth` — authentication over Keycloak.
+ *
+ * ## Why a package, and not `@kanzo-tech/ui`
+ *
+ * The [first admission rule](/docs/philosophy#admission) is *domain-free — nothing about RDF /
+ * SHACL / fossil / graphs / **auth***. Auth is excluded by name, deliberately: `ui` is the generic
+ * vocabulary every product shares, and a library that knew about sessions once shipped a hard-coded
+ * log-out flow inside a sidebar composite. A sibling package is where this belongs.
+ *
+ * ## What it is not
+ *
+ * **There is no sign-in screen.** That is the shape of the package rather than a gap in it: a
+ * sign-in screen is a logo, a legal line, a privacy notice and a button, and every product answers
+ * those differently. What is genuinely shared sits underneath — reading Keycloak's claims into one
+ * session, evaluating a role inside an organization, and keeping a `fetch` authenticated.
+ *
+ * **There is no protocol in it either.** PKCE, silent renewal, storage and cross-tab coordination
+ * are `oidc-client-ts`'s, behind `./browser`; the confidential client is `openid-client`'s, behind
+ * `./server`. Writing either by hand is where mistakes become vulnerabilities.
+ *
+ * ## The one rule to read before using it
+ *
+ * **What a client knows about its roles is for drawing, never for deciding.** The resource server,
+ * validating the access token, is what refuses a request. `can` and `Gate` hide controls; they
+ * protect nothing.
+ *
+ * ## What a name means here
+ *
+ * Three families, and the shape of the name says which one a thing is. Written down because four
+ * of these were added in parallel and drifted into two conventions and one exception:
+ *
+ * - **`<pattern>Auth`** returns an {@link Auth} — `browserAuth`, `bffAuth`. Both patterns RFC 10017
+ *   names, one interface, which is what lets `useSession` and `Gate` be written once.
+ * - **`auth<Thing>`** returns an auth-flavoured *thing* — `authFetch` a `fetch`, and on `./next`
+ *   `authRoutes`, `authSession`, `authMiddleware`.
+ * - **Everything else is named for what it is**: `relyingParty`, `issuer`, `sealedCookie`, `claims`,
+ *   `can`. The first of those used to be `serverAuth`, which wore the suffix without returning an
+ *   `Auth` — the server half's job is `begin`/`complete`/`read`/`refresh`/`end`, not
+ *   `getSession`/`signIn`/`fetch`. A name that promises an interface it does not return is worse
+ *   than a long one, and *relying party* is the term the specification already uses for it.
+ *
+ * *What would reverse it:* a fourth family. Two exist because two patterns exist; a third convention
+ * would mean the vocabulary has outgrown the rule rather than that the rule needs an exception.
+ *
+ * ## This door carries no engine
+ *
+ * Everything here runs on `react` alone, which is why a SPA installs the package and nothing else.
+ * `bffAuth` lives here rather than behind a subpath for the same reason: with the token on the
+ * server there is no protocol left in the browser, only a `fetch` to a session endpoint.
+ */
+export { authFetch, type TokenSource } from './auth-fetch';
+export type { AuthContextValue, AuthStatus } from './auth-context';
+export { AuthProvider } from './auth-provider';
+export { bffAuth, readSession, type BffAuthConfig } from './bff-auth';
+export { can, organizationOf } from './can';
+export { claims, roleFromGroupPath, type ClaimsConfig } from './claims';
+export { Gate } from './gate';
+export { organizationFromHost } from './host';
+export { singleFlight } from './single-flight';
+export { AuthError, type Auth, type AuthErrorCode, type AuthUser, type Organization, type Session, type SignInOptions, } from './types';
+export { useOrganization } from './use-organization';
+export { useSession } from './use-session';
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkDG;AAEH,OAAO,EAAE,SAAS,EAAE,KAAK,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3D,YAAY,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,EAAE,GAAG,EAAE,cAAc,EAAE,MAAM,OAAO,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC;AAC9B,OAAO,EAAE,oBAAoB,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EACL,SAAS,EACT,KAAK,IAAI,EACT,KAAK,aAAa,EAClB,KAAK,QAAQ,EACb,KAAK,YAAY,EACjB,KAAK,OAAO,EACZ,KAAK,aAAa,GACnB,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,28 @@
+import { authFetch as t } from "./auth-fetch.js";
+import { AuthProvider as f } from "./auth-provider.js";
+import { bffAuth as a, readSession as i } from "./bff-auth.js";
+import { can as x, organizationOf as n } from "./can.js";
+import { claims as h, roleFromGroupPath as u } from "./claims.js";
+import { Gate as l } from "./gate.js";
+import { organizationFromHost as c } from "./host.js";
+import { singleFlight as A } from "./single-flight.js";
+import { AuthError as G } from "./types.js";
+import { useOrganization as P } from "./use-organization.js";
+import { useSession as b } from "./use-session.js";
+export {
+  G as AuthError,
+  f as AuthProvider,
+  l as Gate,
+  t as authFetch,
+  a as bffAuth,
+  x as can,
+  h as claims,
+  c as organizationFromHost,
+  n as organizationOf,
+  i as readSession,
+  u as roleFromGroupPath,
+  A as singleFlight,
+  P as useOrganization,
+  b as useSession
+};
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;;;;;;;;;"}

package/dist/issuer.d.ts

@@ -0,0 +1,92 @@
+import { Configuration, CryptoKey, CustomFetch, PrivateKey } from 'openid-client';
+/**
+ * Discovery and client configuration for the confidential client behind `./server`.
+ *
+ * Two things live here that a plain `discovery()` call does not give you, and both come from
+ * running this against Keycloak in anger:
+ *
+ * 1. **The issuer's origin can be rewritten for server→Keycloak traffic.** The browser must be
+ *    sent to the public issuer, and the server usually cannot reach it — in a cluster it reaches
+ *    `http://keycloak:8080`. Rewriting the *transport* rather than the issuer keeps the two
+ *    truthful at once: discovery still validates the `issuer` in the document against the public
+ *    URL, because that is what Keycloak puts there.
+ * 2. **Discovery is allowed to fail.** Keycloak is frequently not up when the application is, and
+ *    a library that hides a retry loop inside itself takes that decision away from the caller. A
+ *    failed discovery is simply not cached, so the *next* call tries again — the retry is the
+ *    caller's `await`, on the caller's schedule.
+ */
+export interface IssuerConfig {
+    /** The **public** issuer URL, exactly as Keycloak reports it: `https://id.example/realms/kanzo`. */
+    readonly issuer: string;
+    readonly clientId: string;
+    /** Client secret authentication. Used when {@link IssuerConfig.privateKey} is absent. */
+    readonly clientSecret?: string;
+    /**
+     * `private_key_jwt`, which is the stronger of the two: the secret never travels. Preferred
+     * wherever the deployment can hold a key, and it wins over `clientSecret` when both are given.
+     */
+    readonly privateKey?: CryptoKey | PrivateKey;
+    /**
+     * Where *this process* reaches Keycloak, when that is not where the browser reaches it —
+     * `http://keycloak:8080`. Only the origin is replaced; the path is the issuer's own.
+     */
+    readonly internalOrigin?: string;
+    /** Injectable for tests, and the seam the origin rewrite is built on. Defaults to the global. */
+    readonly fetch?: typeof globalThis.fetch;
+    /**
+     * Allow a plain-HTTP issuer. A compose file on a laptop serves `http://localhost:8080`, and
+     * without this nothing local can be configured at all. It is not needed for an HTTP
+     * {@link IssuerConfig.internalOrigin}: the rewrite happens below the protocol check.
+     */
+    readonly allowInsecureHttp?: boolean;
+    /**
+     * Verify the ID token's signature, and not only its claims.
+     *
+     * **Defaults to whether the token endpoint is actually reached over TLS**, rather than to a flat
+     * `false`. The specification lets a code grant skip this — an ID token arriving over a TLS
+     * connection to the token endpoint, from a request authenticated as this client, is vouched for
+     * by the channel (OpenID Connect Core §3.1.3.7 step 6) — and `openid-client` leaves it off for
+     * that reason, which is why a sign-in fetches no JWKS at all.
+     *
+     * But the exemption is a claim *about the channel*, and an {@link IssuerConfig.internalOrigin} of
+     * `http://keycloak:8080` withdraws it: the hop TLS was supposed to protect is plaintext inside
+     * the cluster, so nothing is vouching for anything. Inheriting the reference's default there
+     * would be inheriting its conclusion without its premise. So the default is derived from the
+     * effective origin's protocol, and it can still be set explicitly either way.
+     *
+     * On, it costs one JWKS fetch, cached — and it is what makes {@link Issuer.rediscover} reachable
+     * on a key rotation.
+     */
+    readonly verifySignatures?: boolean;
+    /** Seconds. Applies to discovery and to every request the resulting configuration makes. */
+    readonly timeout?: number;
+}
+/**
+ * A configuration that discovers on demand.
+ *
+ * Holding the handle rather than the {@link Configuration} is what makes rotation expressible:
+ * `rediscover()` throws the current one away, and with it the JWKS that openid-client cached
+ * inside it.
+ */
+export interface Issuer {
+    /** The configuration, discovering once and reusing it. Rejects — and caches nothing — on failure. */
+    configuration(): Promise<Configuration>;
+    /**
+     * Discard what was discovered and fetch it again.
+     *
+     * This is the answer to signing-key rotation, and it is deliberately *reactive*: the trigger is
+     * a verification that failed, never a timer. A timer refreshes when nothing is wrong and is
+     * still stale at the moment something is.
+     */
+    rediscover(): Promise<Configuration>;
+}
+/**
+ * A `fetch` that replaces one origin with another before sending.
+ *
+ * `from` may be any URL — its origin is what is taken — so the issuer URL itself can be passed
+ * without the caller splitting it first. When the two origins are equal this is a pass-through,
+ * which is why there is no second code path for "no rewrite configured".
+ */
+export declare function rewriteOrigin(from: string, to: string, base?: typeof globalThis.fetch): CustomFetch;
+export declare function issuer(config: IssuerConfig): Issuer;
+//# sourceMappingURL=issuer.d.ts.map

package/dist/issuer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.d.ts","sourceRoot":"","sources":["../src/issuer.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,WAAW,EAEhB,KAAK,UAAU,EAChB,MAAM,eAAe,CAAC;AAGvB;;;;;;;;;;;;;;;GAeG;AAEH,MAAM,WAAW,YAAY;IAC3B,oGAAoG;IACpG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC;IAC7C;;;OAGG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,iGAAiG;IACjG,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACzC;;;;OAIG;IACH,QAAQ,CAAC,iBAAiB,CAAC,EAAE,OAAO,CAAC;IACrC;;;;;;;;;;;;;;;;;OAiBG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,MAAM,WAAW,MAAM;IACrB,qGAAqG;IACrG,aAAa,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACxC;;;;;;OAMG;IACH,UAAU,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;CACtC;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,OAAO,UAAU,CAAC,KAAwB,GAC/C,WAAW,CAQb;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,CAuDnD"}

package/dist/issuer.js

@@ -0,0 +1,42 @@
+import { customFetch as d, allowInsecureRequests as p, enableNonRepudiationChecks as m, PrivateKeyJwt as w, ClientSecretPost as y, discovery as R } from "openid-client";
+import { singleFlight as S } from "./single-flight.js";
+function b(e, n, o = globalThis.fetch) {
+  const t = new URL(e).origin, r = n.replace(/\/+$/, "");
+  return (s, i) => o(
+    s.startsWith(t) ? `${r}${s.slice(t.length)}` : s,
+    i
+  );
+}
+function K(e) {
+  const n = new URL(e.issuer), o = e.fetch ?? ((c, v) => globalThis.fetch(c, v)), t = e.internalOrigin ?? n.origin, r = {
+    [d]: b(e.issuer, t, o)
+  };
+  e.timeout !== void 0 && (r.timeout = e.timeout);
+  const s = new URL(t).protocol === "https:", i = [
+    ...e.allowInsecureHttp === !0 ? [p] : [],
+    ...e.verifySignatures ?? !s ? [m] : []
+  ];
+  i.length > 0 && (r.execute = i);
+  const u = e.privateKey !== void 0 ? w(e.privateKey) : y(e.clientSecret), h = e.clientSecret !== void 0 ? { client_secret: e.clientSecret } : {};
+  let a;
+  const l = S(async () => {
+    const c = await R(n, e.clientId, h, u, r);
+    return a = c, c;
+  });
+  return {
+    async configuration() {
+      return a ?? l();
+    },
+    // A `rediscover()` that lands while a discovery is already running joins that one rather than
+    // starting a newer one. It is the narrow price of single-flight, and it is bounded: the call
+    // it joins is at most one request old, and a second failure rediscovers again.
+    async rediscover() {
+      return a = void 0, l();
+    }
+  };
+}
+export {
+  K as issuer,
+  b as rewriteOrigin
+};
+//# sourceMappingURL=issuer.js.map

package/dist/issuer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"issuer.js","sources":["../src/issuer.ts"],"sourcesContent":["import {\n  ClientSecretPost,\n  PrivateKeyJwt,\n  allowInsecureRequests,\n  customFetch,\n  enableNonRepudiationChecks,\n  discovery,\n  type ClientMetadata,\n  type Configuration,\n  type CryptoKey,\n  type CustomFetch,\n  type DiscoveryRequestOptions,\n  type PrivateKey,\n} from \"openid-client\";\nimport { singleFlight } from \"./single-flight\";\n\n/**\n * Discovery and client configuration for the confidential client behind `./server`.\n *\n * Two things live here that a plain `discovery()` call does not give you, and both come from\n * running this against Keycloak in anger:\n *\n * 1. **The issuer's origin can be rewritten for server→Keycloak traffic.** The browser must be\n *    sent to the public issuer, and the server usually cannot reach it — in a cluster it reaches\n *    `http://keycloak:8080`. Rewriting the *transport* rather than the issuer keeps the two\n *    truthful at once: discovery still validates the `issuer` in the document against the public\n *    URL, because that is what Keycloak puts there.\n * 2. **Discovery is allowed to fail.** Keycloak is frequently not up when the application is, and\n *    a library that hides a retry loop inside itself takes that decision away from the caller. A\n *    failed discovery is simply not cached, so the *next* call tries again — the retry is the\n *    caller's `await`, on the caller's schedule.\n */\n\nexport interface IssuerConfig {\n  /** The **public** issuer URL, exactly as Keycloak reports it: `https://id.example/realms/kanzo`. */\n  readonly issuer: string;\n  readonly clientId: string;\n  /** Client secret authentication. Used when {@link IssuerConfig.privateKey} is absent. */\n  readonly clientSecret?: string;\n  /**\n   * `private_key_jwt`, which is the stronger of the two: the secret never travels. Preferred\n   * wherever the deployment can hold a key, and it wins over `clientSecret` when both are given.\n   */\n  readonly privateKey?: CryptoKey | PrivateKey;\n  /**\n   * Where *this process* reaches Keycloak, when that is not where the browser reaches it —\n   * `http://keycloak:8080`. Only the origin is replaced; the path is the issuer's own.\n   */\n  readonly internalOrigin?: string;\n  /** Injectable for tests, and the seam the origin rewrite is built on. Defaults to the global. */\n  readonly fetch?: typeof globalThis.fetch;\n  /**\n   * Allow a plain-HTTP issuer. A compose file on a laptop serves `http://localhost:8080`, and\n   * without this nothing local can be configured at all. It is not needed for an HTTP\n   * {@link IssuerConfig.internalOrigin}: the rewrite happens below the protocol check.\n   */\n  readonly allowInsecureHttp?: boolean;\n  /**\n   * Verify the ID token's signature, and not only its claims.\n   *\n   * **Defaults to whether the token endpoint is actually reached over TLS**, rather than to a flat\n   * `false`. The specification lets a code grant skip this — an ID token arriving over a TLS\n   * connection to the token endpoint, from a request authenticated as this client, is vouched for\n   * by the channel (OpenID Connect Core §3.1.3.7 step 6) — and `openid-client` leaves it off for\n   * that reason, which is why a sign-in fetches no JWKS at all.\n   *\n   * But the exemption is a claim *about the channel*, and an {@link IssuerConfig.internalOrigin} of\n   * `http://keycloak:8080` withdraws it: the hop TLS was supposed to protect is plaintext inside\n   * the cluster, so nothing is vouching for anything. Inheriting the reference's default there\n   * would be inheriting its conclusion without its premise. So the default is derived from the\n   * effective origin's protocol, and it can still be set explicitly either way.\n   *\n   * On, it costs one JWKS fetch, cached — and it is what makes {@link Issuer.rediscover} reachable\n   * on a key rotation.\n   */\n  readonly verifySignatures?: boolean;\n  /** Seconds. Applies to discovery and to every request the resulting configuration makes. */\n  readonly timeout?: number;\n}\n\n/**\n * A configuration that discovers on demand.\n *\n * Holding the handle rather than the {@link Configuration} is what makes rotation expressible:\n * `rediscover()` throws the current one away, and with it the JWKS that openid-client cached\n * inside it.\n */\nexport interface Issuer {\n  /** The configuration, discovering once and reusing it. Rejects — and caches nothing — on failure. */\n  configuration(): Promise<Configuration>;\n  /**\n   * Discard what was discovered and fetch it again.\n   *\n   * This is the answer to signing-key rotation, and it is deliberately *reactive*: the trigger is\n   * a verification that failed, never a timer. A timer refreshes when nothing is wrong and is\n   * still stale at the moment something is.\n   */\n  rediscover(): Promise<Configuration>;\n}\n\n/**\n * A `fetch` that replaces one origin with another before sending.\n *\n * `from` may be any URL — its origin is what is taken — so the issuer URL itself can be passed\n * without the caller splitting it first. When the two origins are equal this is a pass-through,\n * which is why there is no second code path for \"no rewrite configured\".\n */\nexport function rewriteOrigin(\n  from: string,\n  to: string,\n  base: typeof globalThis.fetch = globalThis.fetch,\n): CustomFetch {\n  const source = new URL(from).origin;\n  const target = to.replace(/\\/+$/, \"\");\n  return (url, options) =>\n    base(\n      url.startsWith(source) ? `${target}${url.slice(source.length)}` : url,\n      options as unknown as RequestInit,\n    );\n}\n\nexport function issuer(config: IssuerConfig): Issuer {\n  const server = new URL(config.issuer);\n  const base: typeof globalThis.fetch =\n    config.fetch ?? ((input, init) => globalThis.fetch(input, init));\n\n  const reachedAt = config.internalOrigin ?? server.origin;\n\n  const options: DiscoveryRequestOptions = {\n    [customFetch]: rewriteOrigin(config.issuer, reachedAt, base),\n  };\n  if (config.timeout !== undefined) options.timeout = config.timeout;\n\n  // The channel is what the specification's exemption rests on, so the default asks whether there\n  // is one rather than assuming it. Explicit beats derived in both directions.\n  const overTls = new URL(reachedAt).protocol === \"https:\";\n  const execute = [\n    ...(config.allowInsecureHttp === true ? [allowInsecureRequests] : []),\n    ...((config.verifySignatures ?? !overTls) ? [enableNonRepudiationChecks] : []),\n  ];\n  if (execute.length > 0) options.execute = execute;\n\n  // `private_key_jwt` over a shared secret wherever the deployment can hold a key. `None()` is\n  // absent on purpose: this door is the confidential client, and a public one belongs behind\n  // `./browser` where PKCE alone is the protection.\n  const clientAuth =\n    config.privateKey !== undefined\n      ? PrivateKeyJwt(config.privateKey)\n      : ClientSecretPost(config.clientSecret);\n\n  const metadata: Partial<ClientMetadata> =\n    config.clientSecret !== undefined ? { client_secret: config.clientSecret } : {};\n\n  let current: Configuration | undefined;\n\n  // Single-flight for the reason it exists everywhere in this package: six requests arriving\n  // during a cold start would otherwise each fetch the discovery document. Here the slot is\n  // cleared on failure, which *is* the caller-driven retry — the next `await` starts a new attempt.\n  const fetchOnce = singleFlight(async () => {\n    const discovered = await discovery(server, config.clientId, metadata, clientAuth, options);\n    current = discovered;\n    return discovered;\n  });\n\n  return {\n    async configuration() {\n      return current ?? fetchOnce();\n    },\n    // A `rediscover()` that lands while a discovery is already running joins that one rather than\n    // starting a newer one. It is the narrow price of single-flight, and it is bounded: the call\n    // it joins is at most one request old, and a second failure rediscovers again.\n    async rediscover() {\n      current = undefined;\n      return fetchOnce();\n    },\n  };\n}\n"],"names":["rewriteOrigin","from","to","base","source","target","url","options","issuer","config","server","input","init","reachedAt","customFetch","overTls","execute","allowInsecureRequests","enableNonRepudiationChecks","clientAuth","PrivateKeyJwt","ClientSecretPost","metadata","current","fetchOnce","singleFlight","discovered","discovery"],"mappings":";;AA2GO,SAASA,EACdC,GACAC,GACAC,IAAgC,WAAW,OAC9B;AACb,QAAMC,IAAS,IAAI,IAAIH,CAAI,EAAE,QACvBI,IAASH,EAAG,QAAQ,QAAQ,EAAE;AACpC,SAAO,CAACI,GAAKC,MACXJ;AAAA,IACEG,EAAI,WAAWF,CAAM,IAAI,GAAGC,CAAM,GAAGC,EAAI,MAAMF,EAAO,MAAM,CAAC,KAAKE;AAAA,IAClEC;AAAA,EAAA;AAEN;AAEO,SAASC,EAAOC,GAA8B;AACnD,QAAMC,IAAS,IAAI,IAAID,EAAO,MAAM,GAC9BN,IACJM,EAAO,UAAU,CAACE,GAAOC,MAAS,WAAW,MAAMD,GAAOC,CAAI,IAE1DC,IAAYJ,EAAO,kBAAkBC,EAAO,QAE5CH,IAAmC;AAAA,IACvC,CAACO,CAAW,GAAGd,EAAcS,EAAO,QAAQI,GAAWV,CAAI;AAAA,EAAA;AAE7D,EAAIM,EAAO,YAAY,WAAWF,EAAQ,UAAUE,EAAO;AAI3D,QAAMM,IAAU,IAAI,IAAIF,CAAS,EAAE,aAAa,UAC1CG,IAAU;AAAA,IACd,GAAIP,EAAO,sBAAsB,KAAO,CAACQ,CAAqB,IAAI,CAAA;AAAA,IAClE,GAAKR,EAAO,oBAAoB,CAACM,IAAW,CAACG,CAA0B,IAAI,CAAA;AAAA,EAAC;AAE9E,EAAIF,EAAQ,SAAS,MAAGT,EAAQ,UAAUS;AAK1C,QAAMG,IACJV,EAAO,eAAe,SAClBW,EAAcX,EAAO,UAAU,IAC/BY,EAAiBZ,EAAO,YAAY,GAEpCa,IACJb,EAAO,iBAAiB,SAAY,EAAE,eAAeA,EAAO,aAAA,IAAiB,CAAA;AAE/E,MAAIc;AAKJ,QAAMC,IAAYC,EAAa,YAAY;AACzC,UAAMC,IAAa,MAAMC,EAAUjB,GAAQD,EAAO,UAAUa,GAAUH,GAAYZ,CAAO;AACzF,WAAAgB,IAAUG,GACHA;AAAA,EACT,CAAC;AAED,SAAO;AAAA,IACL,MAAM,gBAAgB;AACpB,aAAOH,KAAWC,EAAA;AAAA,IACpB;AAAA;AAAA;AAAA;AAAA,IAIA,MAAM,aAAa;AACjB,aAAAD,IAAU,QACHC,EAAA;AAAA,IACT;AAAA,EAAA;AAEJ;"}