@kanzo-tech/auth 0.2.0

package/dist/next-middleware.d.ts

@@ -0,0 +1,17 @@
+import { NextResponse, NextRequest } from 'next/server';
+export interface AuthMiddlewareConfig {
+    /**
+     * Path prefixes that need no session — a health probe, a marketing page, a legal notice.
+     *
+     * Matched on segment boundaries, so `/health` exempts `/health` and `/health/live` and does
+     * **not** exempt `/healthcare`. A plain `startsWith` is one keystroke away from opening a route
+     * nobody meant to open.
+     */
+    readonly public?: readonly string[];
+    /** Where `authRoutes` is mounted. Always public — it is how a person signs in. Default `/api/auth`. */
+    readonly basePath?: string;
+    /** Default `__Host-kanzo-session`. Set it only if `relyingParty` was given a different cookie. */
+    readonly cookieName?: string;
+}
+export declare function authMiddleware(config?: AuthMiddlewareConfig): (request: NextRequest) => NextResponse;
+//# sourceMappingURL=next-middleware.d.ts.map

package/dist/next-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-middleware.d.ts","sourceRoot":"","sources":["../src/next-middleware.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAiD7D,MAAM,WAAW,oBAAoB;IACnC;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,uGAAuG;IACvG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,kGAAkG;IAClG,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAOD,wBAAgB,cAAc,CAC5B,MAAM,GAAE,oBAAyB,GAChC,CAAC,OAAO,EAAE,WAAW,KAAK,YAAY,CAoBxC"}

package/dist/next-middleware.js

@@ -0,0 +1,21 @@
+import { NextResponse as s } from "next/server";
+const l = "__Host-kanzo-session";
+function p(e) {
+  return e.slice(e.lastIndexOf("/") + 1).includes(".");
+}
+function m(e = {}) {
+  const r = (e.basePath ?? "/api/auth").replace(/\/$/, ""), i = e.cookieName ?? l, c = [r, ...e.public ?? []].map((t) => t.replace(/\/$/, ""));
+  return (t) => {
+    const { pathname: n, search: u } = t.nextUrl;
+    if (p(n)) return s.next();
+    if (c.some((o) => n === o || n.startsWith(`${o}/`)))
+      return s.next();
+    if (t.cookies.has(i)) return s.next();
+    const a = new URL(`${r}/signin`, t.nextUrl);
+    return a.searchParams.set("returnTo", `${n}${u}`), s.redirect(a);
+  };
+}
+export {
+  m as authMiddleware
+};
+//# sourceMappingURL=next-middleware.js.map

package/dist/next-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-middleware.js","sources":["../src/next-middleware.ts"],"sourcesContent":["import { NextResponse, type NextRequest } from \"next/server\";\n\n/**\n * The edge middleware that sends an anonymous browser to the sign-in route.\n *\n * ```ts\n * // middleware.ts\n * export const middleware = authMiddleware({ public: [\"/health\"] });\n * ```\n *\n * ## It checks for presence, and nothing else\n *\n * The cookie is sealed with JWE, and this file never opens it — no key, no `jose`, no store. Two\n * reasons, and the second is the one that matters:\n *\n * 1. Middleware runs on every request, including the ones that are about to be answered from a\n *    cache. Decrypting there buys a redirect decision that a route handler and `authSession` are\n *    both going to make again, properly, a millisecond later.\n * 2. **A redirect is not an authorization.** Letting a request past here grants nothing: the page\n *    behind it reads the session itself, and the resource server behind *that* validates an access\n *    token. A forged cookie gets someone as far as a page that will find no session and say so.\n *    Treating this as the check is how a middleware becomes load-bearing and then gets edited by\n *    someone who does not know it is.\n *\n * So this module imports nothing from the package. That is deliberate and it has a cost: the\n * cookie's name is written here a second time, and `next-middleware.test.ts` ties the two together\n * by signing in through a fake realm and asserting the default is the name `relyingParty` actually\n * emitted. A transcribed constant with no test is how the number in a generated fixture goes stale.\n *\n * ## The matcher\n *\n * A `middleware.ts` also exports its own `config.matcher`, and keasy learned what belongs in it the\n * expensive way: a matcher that missed static files sent `/fossil/fossil_wasm_bg.wasm` to the\n * sign-in page, and the app loaded without its WebAssembly. The exemption is applied *here* as\n * well, on the path, so it holds whatever matcher a consumer writes — a fix for the class rather\n * than for the regexp. The matcher a product starts from:\n *\n * ```ts\n * export const config = { matcher: [\"/((?!_next/static|_next/image|favicon.ico|.*\\\\..*).*)\"] };\n * ```\n */\n\n/**\n * The cookie `relyingParty` issues: `sealedCookie` prefixes every name with `__Host-`.\n *\n * Held by \"defaults to the cookie name relyingParty actually issues\" in `next-middleware.test.ts`.\n */\nconst SESSION_COOKIE = \"__Host-kanzo-session\";\n\nexport interface AuthMiddlewareConfig {\n  /**\n   * Path prefixes that need no session — a health probe, a marketing page, a legal notice.\n   *\n   * Matched on segment boundaries, so `/health` exempts `/health` and `/health/live` and does\n   * **not** exempt `/healthcare`. A plain `startsWith` is one keystroke away from opening a route\n   * nobody meant to open.\n   */\n  readonly public?: readonly string[];\n  /** Where `authRoutes` is mounted. Always public — it is how a person signs in. Default `/api/auth`. */\n  readonly basePath?: string;\n  /** Default `__Host-kanzo-session`. Set it only if `relyingParty` was given a different cookie. */\n  readonly cookieName?: string;\n}\n\n/** A path whose last segment carries a dot: a static file, not a page. */\nfunction isFile(pathname: string): boolean {\n  return pathname.slice(pathname.lastIndexOf(\"/\") + 1).includes(\".\");\n}\n\nexport function authMiddleware(\n  config: AuthMiddlewareConfig = {},\n): (request: NextRequest) => NextResponse {\n  const base = (config.basePath ?? \"/api/auth\").replace(/\\/$/, \"\");\n  const cookieName = config.cookieName ?? SESSION_COOKIE;\n  const open = [base, ...(config.public ?? [])].map((prefix) => prefix.replace(/\\/$/, \"\"));\n\n  return (request) => {\n    const { pathname, search } = request.nextUrl;\n\n    if (isFile(pathname)) return NextResponse.next();\n    if (open.some((prefix) => pathname === prefix || pathname.startsWith(`${prefix}/`))) {\n      return NextResponse.next();\n    }\n    if (request.cookies.has(cookieName)) return NextResponse.next();\n\n    const away = new URL(`${base}/signin`, request.nextUrl);\n    // Where they were going, so the callback can put them back. `authRoutes` confines it to this\n    // origin before sealing it, which is the check this line is relying on rather than repeating.\n    away.searchParams.set(\"returnTo\", `${pathname}${search}`);\n    return NextResponse.redirect(away);\n  };\n}\n"],"names":["SESSION_COOKIE","isFile","pathname","authMiddleware","config","base","cookieName","open","prefix","request","search","NextResponse","away"],"mappings":";AA+CA,MAAMA,IAAiB;AAkBvB,SAASC,EAAOC,GAA2B;AACzC,SAAOA,EAAS,MAAMA,EAAS,YAAY,GAAG,IAAI,CAAC,EAAE,SAAS,GAAG;AACnE;AAEO,SAASC,EACdC,IAA+B,IACS;AACxC,QAAMC,KAAQD,EAAO,YAAY,aAAa,QAAQ,OAAO,EAAE,GACzDE,IAAaF,EAAO,cAAcJ,GAClCO,IAAO,CAACF,GAAM,GAAID,EAAO,UAAU,CAAA,CAAG,EAAE,IAAI,CAACI,MAAWA,EAAO,QAAQ,OAAO,EAAE,CAAC;AAEvF,SAAO,CAACC,MAAY;AAClB,UAAM,EAAE,UAAAP,GAAU,QAAAQ,EAAA,IAAWD,EAAQ;AAErC,QAAIR,EAAOC,CAAQ,EAAG,QAAOS,EAAa,KAAA;AAC1C,QAAIJ,EAAK,KAAK,CAACC,MAAWN,MAAaM,KAAUN,EAAS,WAAW,GAAGM,CAAM,GAAG,CAAC;AAChF,aAAOG,EAAa,KAAA;AAEtB,QAAIF,EAAQ,QAAQ,IAAIH,CAAU,EAAG,QAAOK,EAAa,KAAA;AAEzD,UAAMC,IAAO,IAAI,IAAI,GAAGP,CAAI,WAAWI,EAAQ,OAAO;AAGtD,WAAAG,EAAK,aAAa,IAAI,YAAY,GAAGV,CAAQ,GAAGQ,CAAM,EAAE,GACjDC,EAAa,SAASC,CAAI;AAAA,EACnC;AACF;"}

package/dist/next-routes.d.ts

@@ -0,0 +1,19 @@
+import { AuthSessionConfig } from './next-session';
+export interface AuthRoutesConfig extends AuthSessionConfig {
+    /**
+     * Override the callback URL. Absent, it is derived from the incoming request: the origin it
+     * arrived at, the path this route file sits on, and `/callback`.
+     *
+     * Deriving it trusts the `Host` header, which is chosen by whoever made the request. That is a
+     * bounded trust — a forged host produces a `redirect_uri` Keycloak has not registered, and
+     * Keycloak refuses it — but a deployment behind a proxy that rewrites the host should say the
+     * URL out loud here rather than discover this.
+     */
+    readonly redirectUri?: string;
+}
+export interface AuthRouteHandlers {
+    GET(request: Request): Promise<Response>;
+    POST(request: Request): Promise<Response>;
+}
+export declare function authRoutes(config: AuthRoutesConfig): AuthRouteHandlers;
+//# sourceMappingURL=next-routes.d.ts.map

package/dist/next-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-routes.d.ts","sourceRoot":"","sources":["../src/next-routes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAkCxD,MAAM,WAAW,gBAAiB,SAAQ,iBAAiB;IACzD;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC,IAAI,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CAC3C;AAwDD,wBAAgB,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,iBAAiB,CA+DtE"}

package/dist/next-routes.js

@@ -0,0 +1,65 @@
+import { relyingParty as p } from "./server.js";
+import { AuthError as w } from "./types.js";
+const d = { "content-type": "application/json", "cache-control": "no-store" };
+function m(e) {
+  const t = e.lastIndexOf("/");
+  return { action: e.slice(t + 1), base: t <= 0 ? "" : e.slice(0, t) };
+}
+function h(e, t) {
+  if (!(e === null || e.length === 0))
+    try {
+      const s = new URL(e, t);
+      return s.origin === t ? s.href : void 0;
+    } catch {
+      return;
+    }
+}
+function u(e, t) {
+  const s = new Headers({ location: e, "cache-control": "no-store" });
+  for (const a of t) s.append("set-cookie", a);
+  return new Response(null, { status: 302, headers: s });
+}
+function k(e) {
+  if (!(e instanceof w)) throw e;
+  return new Response(JSON.stringify({ error: e.code, message: e.message }), {
+    status: e.code === "session.absent" ? 401 : 400,
+    headers: d
+  });
+}
+function T(e) {
+  let t;
+  const s = (r) => ((t == null ? void 0 : t.redirectUri) !== r && (t = { redirectUri: r, auth: p({ ...e, redirectUri: r }) }), t.auth), a = async (r) => {
+    const o = new URL(r.url), { action: f, base: g } = m(o.pathname), i = r.headers.get("cookie"), c = s(e.redirectUri ?? `${o.origin}${g}/callback`);
+    switch (f) {
+      case "signin": {
+        const n = await c.begin({
+          returnTo: h(o.searchParams.get("returnTo"), o.origin) ?? "/",
+          organization: o.searchParams.get("organization") ?? void 0
+        });
+        return u(n.url, n.cookies);
+      }
+      case "callback":
+        try {
+          const n = await c.complete({ url: o, cookie: i });
+          return u(n.returnTo, n.cookies);
+        } catch (n) {
+          return k(n);
+        }
+      case "signout": {
+        const n = h(o.searchParams.get("returnTo"), o.origin), l = await c.end(i, { returnTo: n });
+        return u(l.url, l.cookies);
+      }
+      case "session": {
+        const n = await c.read(i);
+        return n === null ? new Response(null, { status: 401, headers: { "cache-control": "no-store" } }) : new Response(JSON.stringify(n), { status: 200, headers: d });
+      }
+      default:
+        return new Response(null, { status: 404 });
+    }
+  };
+  return { GET: a, POST: a };
+}
+export {
+  T as authRoutes
+};
+//# sourceMappingURL=next-routes.js.map

package/dist/next-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-routes.js","sources":["../src/next-routes.ts"],"sourcesContent":["import type { AuthSessionConfig } from \"./next-session\";\nimport { relyingParty, type RelyingParty } from \"./server\";\nimport { AuthError } from \"./types\";\n\n/**\n * The four routes a Backend For Frontend needs, as one App Router catch-all.\n *\n * ```ts\n * // app/api/auth/[...auth]/route.ts\n * export const { GET, POST } = authRoutes({ issuer, clientId, clientSecret, secret });\n * ```\n *\n * `relyingParty` already does the whole flow in strings — a URL and a `Cookie` header in, a URL and\n * `Set-Cookie` values out — so the only thing written here is the translation into `Request` and\n * `Response`, plus the two decisions that translation forces: what a route answers when there is\n * no session, and where it is willing to send a browser afterwards.\n *\n * **Nothing in this module imports `next`.** An App Router route handler is handed a standard\n * `Request` and may answer with a standard `Response`, so the framework's own types would buy\n * nothing and would make this half untestable without it. The door earns its subpath through\n * `next-session.ts` and `next-middleware.ts`, which genuinely cannot be written without `next`.\n *\n * ## The other end of the contract\n *\n * `bffAuth` in the root barrel is the browser half, and it is specific: it `GET`s\n * `${basePath}/session` and reads **401 as \"nobody is signed in\"**, not as a failure; it navigates\n * to `${basePath}/signin?returnTo=…&organization=…` and `${basePath}/signout?returnTo=…`. Those\n * four paths and that status code are the contract, and `next-routes.test.ts` drives a real\n * `bffAuth` against these handlers rather than trusting the two descriptions to agree.\n */\n\n/** The session endpoint answers about a person; no cache may ever hold that answer. */\nconst PRIVATE = { \"content-type\": \"application/json\", \"cache-control\": \"no-store\" } as const;\n\nexport interface AuthRoutesConfig extends AuthSessionConfig {\n  /**\n   * Override the callback URL. Absent, it is derived from the incoming request: the origin it\n   * arrived at, the path this route file sits on, and `/callback`.\n   *\n   * Deriving it trusts the `Host` header, which is chosen by whoever made the request. That is a\n   * bounded trust — a forged host produces a `redirect_uri` Keycloak has not registered, and\n   * Keycloak refuses it — but a deployment behind a proxy that rewrites the host should say the\n   * URL out loud here rather than discover this.\n   */\n  readonly redirectUri?: string;\n}\n\nexport interface AuthRouteHandlers {\n  GET(request: Request): Promise<Response>;\n  POST(request: Request): Promise<Response>;\n}\n\n/** The last path segment, and everything before it. `/api/auth/signin` → `signin`, `/api/auth`. */\nfunction split(pathname: string): { readonly action: string; readonly base: string } {\n  const cut = pathname.lastIndexOf(\"/\");\n  return { action: pathname.slice(cut + 1), base: cut <= 0 ? \"\" : pathname.slice(0, cut) };\n}\n\n/**\n * A `returnTo` confined to this origin, or `undefined`.\n *\n * Without this the sign-in route is an open redirect: `?returnTo=https://evil.test` is carried\n * through the whole flow and spent on a browser that has just proved who it is, which is the most\n * valuable moment to hijack. The check is here, where the string arrives from a query parameter,\n * and deliberately *not* repeated on the callback — what comes back out at the callback was\n * sealed into a cookie by us, so re-checking it would only make it unclear which check is the\n * real one.\n */\nfunction sameOrigin(candidate: string | null, origin: string): string | undefined {\n  if (candidate === null || candidate.length === 0) return undefined;\n  try {\n    const target = new URL(candidate, origin);\n    return target.origin === origin ? target.href : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * A redirect that can carry cookies.\n *\n * `Response.redirect()` cannot: its headers are immutable, and a callback that cannot set a cookie\n * is a sign-in that never completes. And `append`, never `set` — the callback answers with **two**\n * `Set-Cookie` values, the session it just issued and the transaction it just spent, and `set`\n * would silently keep only the last of them.\n */\nfunction redirect(url: string, cookies: readonly string[]): Response {\n  const headers = new Headers({ location: url, \"cache-control\": \"no-store\" });\n  for (const cookie of cookies) headers.append(\"set-cookie\", cookie);\n  return new Response(null, { status: 302, headers });\n}\n\n/**\n * An `AuthError` as a status and a code a product can route on.\n *\n * Anything else is rethrown: a failure this module has no reading of is Next's to report, and\n * flattening it into a 400 here would hide a misconfiguration behind a message about credentials.\n */\nfunction failure(error: unknown): Response {\n  if (!(error instanceof AuthError)) throw error;\n  return new Response(JSON.stringify({ error: error.code, message: error.message }), {\n    status: error.code === \"session.absent\" ? 401 : 400,\n    headers: PRIVATE,\n  });\n}\n\nexport function authRoutes(config: AuthRoutesConfig): AuthRouteHandlers {\n  // One instance, rebuilt only when the callback URL it was built for changes. A `Map` keyed by\n  // origin would grow without bound on a stream of forged `Host` headers; a single slot cannot,\n  // and it self-heals, because the next genuine request derives its own URL again. What it costs\n  // in that case is a re-discovery, which is the right price for a request that lied.\n  let current: { readonly redirectUri: string; readonly auth: RelyingParty } | undefined;\n  const authFor = (redirectUri: string): RelyingParty => {\n    if (current?.redirectUri !== redirectUri) {\n      current = { redirectUri, auth: relyingParty({ ...config, redirectUri }) };\n    }\n    return current.auth;\n  };\n\n  const handle = async (request: Request): Promise<Response> => {\n    const url = new URL(request.url);\n    const { action, base } = split(url.pathname);\n    const cookie = request.headers.get(\"cookie\");\n    const auth = authFor(config.redirectUri ?? `${url.origin}${base}/callback`);\n\n    switch (action) {\n      case \"signin\": {\n        const started = await auth.begin({\n          returnTo: sameOrigin(url.searchParams.get(\"returnTo\"), url.origin) ?? \"/\",\n          organization: url.searchParams.get(\"organization\") ?? undefined,\n        });\n        return redirect(started.url, started.cookies);\n      }\n\n      case \"callback\": {\n        try {\n          const done = await auth.complete({ url, cookie });\n          return redirect(done.returnTo, done.cookies);\n        } catch (error) {\n          return failure(error);\n        }\n      }\n\n      case \"signout\": {\n        const returnTo = sameOrigin(url.searchParams.get(\"returnTo\"), url.origin);\n        const ended = await auth.end(cookie, { returnTo });\n        return redirect(ended.url, ended.cookies);\n      }\n\n      case \"session\": {\n        const session = await auth.read(cookie);\n        // 401 and no body at all. `bffAuth` reads this status as \"nobody is signed in\" and stops;\n        // a body would be parsed by something eventually, and an error shape arriving where a\n        // `Session` is expected is the failure `readSession` exists to refuse.\n        if (session === null) {\n          return new Response(null, { status: 401, headers: { \"cache-control\": \"no-store\" } });\n        }\n        return new Response(JSON.stringify(session), { status: 200, headers: PRIVATE });\n      }\n\n      default:\n        return new Response(null, { status: 404 });\n    }\n  };\n\n  // One handler behind both verbs. Every route here is reached by navigation or by `fetch`, and\n  // which verb a product uses for sign-out — a link or a form — is its choice, not ours to\n  // constrain with a second table that could drift from this one.\n  return { GET: handle, POST: handle };\n}\n"],"names":["PRIVATE","split","pathname","cut","sameOrigin","candidate","origin","target","redirect","url","cookies","headers","cookie","failure","error","AuthError","authRoutes","config","current","authFor","redirectUri","relyingParty","handle","request","action","base","auth","started","done","returnTo","ended","session"],"mappings":";;AAgCA,MAAMA,IAAU,EAAE,gBAAgB,oBAAoB,iBAAiB,WAAA;AAqBvE,SAASC,EAAMC,GAAsE;AACnF,QAAMC,IAAMD,EAAS,YAAY,GAAG;AACpC,SAAO,EAAE,QAAQA,EAAS,MAAMC,IAAM,CAAC,GAAG,MAAMA,KAAO,IAAI,KAAKD,EAAS,MAAM,GAAGC,CAAG,EAAA;AACvF;AAYA,SAASC,EAAWC,GAA0BC,GAAoC;AAChF,MAAI,EAAAD,MAAc,QAAQA,EAAU,WAAW;AAC/C,QAAI;AACF,YAAME,IAAS,IAAI,IAAIF,GAAWC,CAAM;AACxC,aAAOC,EAAO,WAAWD,IAASC,EAAO,OAAO;AAAA,IAClD,QAAQ;AACN;AAAA,IACF;AACF;AAUA,SAASC,EAASC,GAAaC,GAAsC;AACnE,QAAMC,IAAU,IAAI,QAAQ,EAAE,UAAUF,GAAK,iBAAiB,YAAY;AAC1E,aAAWG,KAAUF,EAAS,CAAAC,EAAQ,OAAO,cAAcC,CAAM;AACjE,SAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAAD,GAAS;AACpD;AAQA,SAASE,EAAQC,GAA0B;AACzC,MAAI,EAAEA,aAAiBC,GAAY,OAAMD;AACzC,SAAO,IAAI,SAAS,KAAK,UAAU,EAAE,OAAOA,EAAM,MAAM,SAASA,EAAM,QAAA,CAAS,GAAG;AAAA,IACjF,QAAQA,EAAM,SAAS,mBAAmB,MAAM;AAAA,IAChD,SAASd;AAAA,EAAA,CACV;AACH;AAEO,SAASgB,EAAWC,GAA6C;AAKtE,MAAIC;AACJ,QAAMC,IAAU,CAACC,QACXF,KAAA,gBAAAA,EAAS,iBAAgBE,MAC3BF,IAAU,EAAE,aAAAE,GAAa,MAAMC,EAAa,EAAE,GAAGJ,GAAQ,aAAAG,EAAA,CAAa,EAAA,IAEjEF,EAAQ,OAGXI,IAAS,OAAOC,MAAwC;AAC5D,UAAMd,IAAM,IAAI,IAAIc,EAAQ,GAAG,GACzB,EAAE,QAAAC,GAAQ,MAAAC,EAAA,IAASxB,EAAMQ,EAAI,QAAQ,GACrCG,IAASW,EAAQ,QAAQ,IAAI,QAAQ,GACrCG,IAAOP,EAAQF,EAAO,eAAe,GAAGR,EAAI,MAAM,GAAGgB,CAAI,WAAW;AAE1E,YAAQD,GAAA;AAAA,MACN,KAAK,UAAU;AACb,cAAMG,IAAU,MAAMD,EAAK,MAAM;AAAA,UAC/B,UAAUtB,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM,KAAK;AAAA,UACtE,cAAcA,EAAI,aAAa,IAAI,cAAc,KAAK;AAAA,QAAA,CACvD;AACD,eAAOD,EAASmB,EAAQ,KAAKA,EAAQ,OAAO;AAAA,MAC9C;AAAA,MAEA,KAAK;AACH,YAAI;AACF,gBAAMC,IAAO,MAAMF,EAAK,SAAS,EAAE,KAAAjB,GAAK,QAAAG,GAAQ;AAChD,iBAAOJ,EAASoB,EAAK,UAAUA,EAAK,OAAO;AAAA,QAC7C,SAASd,GAAO;AACd,iBAAOD,EAAQC,CAAK;AAAA,QACtB;AAAA,MAGF,KAAK,WAAW;AACd,cAAMe,IAAWzB,EAAWK,EAAI,aAAa,IAAI,UAAU,GAAGA,EAAI,MAAM,GAClEqB,IAAQ,MAAMJ,EAAK,IAAId,GAAQ,EAAE,UAAAiB,GAAU;AACjD,eAAOrB,EAASsB,EAAM,KAAKA,EAAM,OAAO;AAAA,MAC1C;AAAA,MAEA,KAAK,WAAW;AACd,cAAMC,IAAU,MAAML,EAAK,KAAKd,CAAM;AAItC,eAAImB,MAAY,OACP,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK,SAAS,EAAE,iBAAiB,WAAA,GAAc,IAE9E,IAAI,SAAS,KAAK,UAAUA,CAAO,GAAG,EAAE,QAAQ,KAAK,SAAS/B,GAAS;AAAA,MAChF;AAAA,MAEA;AACE,eAAO,IAAI,SAAS,MAAM,EAAE,QAAQ,KAAK;AAAA,IAAA;AAAA,EAE/C;AAKA,SAAO,EAAE,KAAKsB,GAAQ,MAAMA,EAAA;AAC9B;"}

package/dist/next-session.d.ts

@@ -0,0 +1,44 @@
+import { RelyingPartyConfig } from './server';
+import { Session } from './types';
+/**
+ * The session a React Server Component can read, without a request object in hand.
+ *
+ * An RSC is handed no `Request`; `next/headers` is how it reaches the one it is rendering for, and
+ * that import is what makes this module — and only this module of the three — Node-only. It is
+ * also what earns the whole door its place on a subpath: *a part belongs on a subpath only if it
+ * imports that subpath's engine.*
+ *
+ * ## Why a factory, when the call site is `await getSession()`
+ *
+ * The call site is preserved exactly; what moved is where the binding is made. A
+ * zero-argument import would have to find its secret somewhere ambient — an environment variable
+ * this package would then be naming and documenting forever — and it could never be given a
+ * {@link SessionStore}, which is an object and not a string. So the consumer binds it once, in the
+ * same module that already holds the config it hands {@link authRoutes}:
+ *
+ * ```ts
+ * // auth.ts
+ * export const getSession = authSession({ issuer, clientId, clientSecret, secret });
+ * ```
+ *
+ * and every server component writes `await getSession()`. That also makes the three names of this
+ * door one shape — `authRoutes`, `authSession`, `authMiddleware` are all factories over a config —
+ * rather than two factories and an exception.
+ *
+ * ## `cache`, and what it is for
+ *
+ * React's `cache` scopes memoization to one request, so a page that asks in a layout, in a
+ * breadcrumb and in a menu unseals the cookie once. keasy's `web/src/lib/auth-check.ts` wraps its
+ * own reader for exactly this reason. **It is dormant outside a React request scope** — `cache`
+ * with no dispatcher simply calls through — which is why the test beside this file asserts the
+ * answers and not the number of reads.
+ */
+/**
+ * What reading a session needs, which is strictly less than signing one in.
+ *
+ * `redirectUri` is absent because no authorization request is built here: {@link RelyingParty.read}
+ * unseals a cookie and asks the store, and neither of those has a browser to send anywhere.
+ */
+export type AuthSessionConfig = Omit<RelyingPartyConfig, "redirectUri">;
+export declare function authSession(config: AuthSessionConfig): () => Promise<Session | null>;
+//# sourceMappingURL=next-session.d.ts.map

package/dist/next-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-session.d.ts","sourceRoot":"","sources":["../src/next-session.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,KAAK,kBAAkB,EAAE,MAAM,UAAU,CAAC;AACjE,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAEvC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH;;;;;GAKG;AACH,MAAM,MAAM,iBAAiB,GAAG,IAAI,CAAC,kBAAkB,EAAE,aAAa,CAAC,CAAC;AAExE,wBAAgB,WAAW,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAOpF"}

package/dist/next-session.js

@@ -0,0 +1,11 @@
+import { cookies as o } from "next/headers";
+import { cache as i } from "react";
+import { relyingParty as e } from "./server.js";
+function m(r) {
+  const t = e({ ...r, redirectUri: "" });
+  return i(async () => t.read((await o()).toString()));
+}
+export {
+  m as authSession
+};
+//# sourceMappingURL=next-session.js.map

package/dist/next-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next-session.js","sources":["../src/next-session.ts"],"sourcesContent":["import { cookies } from \"next/headers\";\nimport { cache } from \"react\";\nimport { relyingParty, type RelyingPartyConfig } from \"./server\";\nimport type { Session } from \"./types\";\n\n/**\n * The session a React Server Component can read, without a request object in hand.\n *\n * An RSC is handed no `Request`; `next/headers` is how it reaches the one it is rendering for, and\n * that import is what makes this module — and only this module of the three — Node-only. It is\n * also what earns the whole door its place on a subpath: *a part belongs on a subpath only if it\n * imports that subpath's engine.*\n *\n * ## Why a factory, when the call site is `await getSession()`\n *\n * The call site is preserved exactly; what moved is where the binding is made. A\n * zero-argument import would have to find its secret somewhere ambient — an environment variable\n * this package would then be naming and documenting forever — and it could never be given a\n * {@link SessionStore}, which is an object and not a string. So the consumer binds it once, in the\n * same module that already holds the config it hands {@link authRoutes}:\n *\n * ```ts\n * // auth.ts\n * export const getSession = authSession({ issuer, clientId, clientSecret, secret });\n * ```\n *\n * and every server component writes `await getSession()`. That also makes the three names of this\n * door one shape — `authRoutes`, `authSession`, `authMiddleware` are all factories over a config —\n * rather than two factories and an exception.\n *\n * ## `cache`, and what it is for\n *\n * React's `cache` scopes memoization to one request, so a page that asks in a layout, in a\n * breadcrumb and in a menu unseals the cookie once. keasy's `web/src/lib/auth-check.ts` wraps its\n * own reader for exactly this reason. **It is dormant outside a React request scope** — `cache`\n * with no dispatcher simply calls through — which is why the test beside this file asserts the\n * answers and not the number of reads.\n */\n\n/**\n * What reading a session needs, which is strictly less than signing one in.\n *\n * `redirectUri` is absent because no authorization request is built here: {@link RelyingParty.read}\n * unseals a cookie and asks the store, and neither of those has a browser to send anywhere.\n */\nexport type AuthSessionConfig = Omit<RelyingPartyConfig, \"redirectUri\">;\n\nexport function authSession(config: AuthSessionConfig): () => Promise<Session | null> {\n  // The redirect URI is a required field of the confidential client and an unused one on this\n  // path. Naming it here rather than making it optional on `RelyingPartyConfig` keeps the type that\n  // signs people in honest: a sign-in without a redirect URI is a configuration error.\n  const auth = relyingParty({ ...config, redirectUri: \"\" });\n\n  return cache(async () => auth.read((await cookies()).toString()));\n}\n"],"names":["authSession","config","auth","relyingParty","cache","cookies"],"mappings":";;;AA+CO,SAASA,EAAYC,GAA0D;AAIpF,QAAMC,IAAOC,EAAa,EAAE,GAAGF,GAAQ,aAAa,IAAI;AAExD,SAAOG,EAAM,YAAYF,EAAK,MAAM,MAAMG,EAAA,GAAW,SAAA,CAAU,CAAC;AAClE;"}

package/dist/next.d.ts

@@ -0,0 +1,42 @@
+/**
+ * `@kanzo-tech/auth/next` — the Backend For Frontend, in the three files an App Router product
+ * already has.
+ *
+ * ```ts
+ * // app/api/auth/[...auth]/route.ts
+ * export const { GET, POST } = authRoutes({ issuer, clientId, clientSecret, secret });
+ *
+ * // auth.ts
+ * export const getSession = authSession({ issuer, clientId, clientSecret, secret });
+ *
+ * // middleware.ts
+ * export const middleware = authMiddleware({ public: ["/health"] });
+ * ```
+ *
+ * Three names and no fourth concept — but **not one config**: `authRoutes` and `authSession` share
+ * the relying party's, while `authMiddleware` takes neither a secret nor an issuer, because an edge
+ * middleware only asks whether the cookie is *there*. Decrypting it at the edge would be the wrong
+ * place for the work and a secret in the wrong runtime. `can` and `organizationOf` on the root
+ * barrel are how a server component asks about a role, exactly as `Gate` asks in the browser.
+ * There is no `requireRole` here: it would have added no new evaluation of a role, only a *throw*,
+ * and which throw — `notFound()`, a redirect, a rendered explanation — is a product's answer and
+ * not a library's. `next.test.ts` holds the absence.
+ *
+ * ## This door must never reach React's client half
+ *
+ * The modules behind it import `./server` and `./claims` directly and never `./index`, for the
+ * reason `server.ts`'s own header gives. `next.test.ts` walks the relative imports from here, and
+ * `scripts/smoke-install.mjs` reads the built bytes.
+ *
+ * ## Why one barrel does not put `openid-client` on the edge
+ *
+ * `authMiddleware` runs in the edge runtime and must arrive with nothing behind it. It does:
+ * `next-middleware.ts` imports only `next/server`, the package is `sideEffects: false`, and the
+ * build writes one file per module (`preserveModules`), so a `middleware.ts` importing this barrel
+ * is left holding that one module. The three are kept in three files for exactly this reason
+ * rather than tidied into one.
+ */
+export { authMiddleware, type AuthMiddlewareConfig } from './next-middleware';
+export { authRoutes, type AuthRouteHandlers, type AuthRoutesConfig } from './next-routes';
+export { authSession, type AuthSessionConfig } from './next-session';
+//# sourceMappingURL=next.d.ts.map

package/dist/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAC1F,OAAO,EAAE,WAAW,EAAE,KAAK,iBAAiB,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/next.js

@@ -0,0 +1,9 @@
+import { authMiddleware as r } from "./next-middleware.js";
+import { authRoutes as a } from "./next-routes.js";
+import { authSession as f } from "./next-session.js";
+export {
+  r as authMiddleware,
+  a as authRoutes,
+  f as authSession
+};
+//# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sources":[],"sourcesContent":[],"names":[],"mappings":";;;"}

package/dist/server.d.ts

@@ -0,0 +1,53 @@
+import { IssuerConfig } from './issuer';
+import { SessionStore } from './store';
+import { Session, SignInOptions } from './types';
+/** What `begin` and `end` answer: where to send the browser, and what to set on the way. */
+export interface Redirect {
+    readonly url: string;
+    readonly cookies: readonly string[];
+}
+/** What `refresh` answers. */
+export interface Renewed {
+    readonly session: Session;
+    readonly cookies: readonly string[];
+}
+/** What `complete` answers: a renewal, plus where the person was going before they were asked who they are. */
+export interface SignedIn extends Renewed {
+    readonly returnTo: string;
+}
+export interface RelyingPartyConfig extends IssuerConfig {
+    /** Registered at Keycloak, and where `complete` expects to be called. */
+    readonly redirectUri: string;
+    /** Seals the cookies. Any length; generate it. See `sealedCookie`. */
+    readonly secret: string | Uint8Array;
+    /** Default `openid profile email`. A multi-tenant product adds `organization:*`. */
+    readonly scope?: string;
+    /** Default {@link statelessStore}. Supply one to invalidate a session before it expires. */
+    readonly store?: SessionStore;
+    /** Session cookie lifetime in seconds. Default eight hours. */
+    readonly maxAge?: number;
+    /** Where Keycloak sends the browser after sign-out. Must be registered as a post-logout URI. */
+    readonly postLogoutRedirectUri?: string;
+}
+export interface RelyingParty {
+    /** Leg one: the authorization URL, and the cookie that remembers this attempt. */
+    begin(options?: SignInOptions): Promise<Redirect>;
+    /** Leg two: the callback URL Keycloak returned to, and the `Cookie` header it arrived with. */
+    complete(request: {
+        readonly url: string | URL;
+        readonly cookie: string | null;
+    }): Promise<SignedIn>;
+    /** The session a request carries, or `null`. The read a route handler does on every request. */
+    read(cookie: string | null | undefined): Promise<Session | null>;
+    /** Spend the refresh token, take the new one, and reissue the cookie. */
+    refresh(cookie: string | null | undefined): Promise<Renewed>;
+    /** RP-initiated logout: forget the record here, clear the cookie, and end it at the IdP too. */
+    end(cookie: string | null | undefined, options?: {
+        readonly returnTo?: string;
+    }): Promise<Redirect>;
+}
+export declare function relyingParty(config: RelyingPartyConfig): RelyingParty;
+export { issuer, rewriteOrigin, type Issuer, type IssuerConfig } from './issuer';
+export { sealedCookie, cookieValue, type SealedCookie, type SealedCookieConfig } from './cookie-session';
+export { statelessStore, type SessionRecord, type SessionStore } from './store';
+//# sourceMappingURL=server.d.ts.map

package/dist/server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAaA,OAAO,EAAU,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACrD,OAAO,EAAsC,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC;AAChF,OAAO,EAAiC,KAAK,OAAO,EAAE,KAAK,aAAa,EAAE,MAAM,SAAS,CAAC;AAiG1F,4FAA4F;AAC5F,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,8BAA8B;AAC9B,MAAM,WAAW,OAAO;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED,+GAA+G;AAC/G,MAAM,WAAW,QAAS,SAAQ,OAAO;IACvC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,kBAAmB,SAAQ,YAAY;IACtD,yEAAyE;IACzE,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,sEAAsE;IACtE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,UAAU,CAAC;IACrC,oFAAoF;IACpF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC;IAC9B,+DAA+D;IAC/D,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,gGAAgG;IAChG,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CACzC;AAED,MAAM,WAAW,YAAY;IAC3B,kFAAkF;IAClF,KAAK,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAClD,+FAA+F;IAC/F,QAAQ,CAAC,OAAO,EAAE;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IACrG,gGAAgG;IAChG,IAAI,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACjE,yEAAyE;IACzE,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7D,gGAAgG;IAChG,GAAG,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;CACrG;AAkBD,wBAAgB,YAAY,CAAC,MAAM,EAAE,kBAAkB,GAAG,YAAY,CAqMrE;AAED,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,MAAM,EAAE,KAAK,YAAY,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,YAAY,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE,KAAK,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACzG,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,KAAK,YAAY,EAAE,MAAM,SAAS,CAAC"}

package/dist/server.js

@@ -0,0 +1,157 @@
+import { buildEndSessionUrl as A, refreshTokenGrant as E, randomPKCECodeVerifier as b, randomState as p, randomNonce as x, calculatePKCECodeChallenge as C, buildAuthorizationUrl as I, authorizationCodeGrant as S } from "openid-client";
+import { claims as O } from "./claims.js";
+import { sealedCookie as w } from "./cookie-session.js";
+import { cookieValue as X } from "./cookie-session.js";
+import { issuer as U } from "./issuer.js";
+import { rewriteOrigin as J } from "./issuer.js";
+import { statelessStore as D } from "./store.js";
+import { AuthError as L } from "./types.js";
+const g = "openid profile email", N = 480 * 60, z = 600;
+function l(t, i, r) {
+  const c = new L(t, i);
+  throw r !== void 0 && (c.cause = r), c;
+}
+function T(t) {
+  if (typeof t != "object" || t === null || !("code" in t)) return;
+  const i = t.code;
+  return typeof i == "string" ? i : void 0;
+}
+function _(t) {
+  const i = T(t);
+  if (i === "OAUTH_JWT_CLAIM_COMPARISON_FAILED") {
+    let r = t;
+    for (let c = 0; c < 4 && typeof r == "object" && r !== null; c++) {
+      if (r.claim === "nonce") return !0;
+      r = r.cause;
+    }
+    return !1;
+  }
+  return i === "OAUTH_INVALID_RESPONSE" && t instanceof Error && t.cause instanceof Error && t.cause.message.includes('"nonce"');
+}
+function P(t) {
+  return T(t) === "OAUTH_KEY_SELECTION_FAILED";
+}
+function v(t) {
+  const i = U(t), r = t.store ?? D(), c = w({
+    name: "kanzo-session",
+    secret: t.secret,
+    maxAge: t.maxAge ?? N
+  }), f = w({
+    name: "kanzo-auth",
+    secret: t.secret,
+    maxAge: z
+  }), y = async (n) => {
+    const e = await c.read(n);
+    return e === null ? null : r.get(e.ticket);
+  }, k = async (n, e) => {
+    const o = n.claims(), a = o === void 0 ? e == null ? void 0 : e.session : O(o, t);
+    a === void 0 && l("token.exchange-failed", "the token response carried no ID token, so it names nobody");
+    const s = await r.put({
+      session: a,
+      // RFC 10017 requires rotation, so the newly issued token is the only one still valid. An
+      // authorization server that did not rotate returns none, and the one we hold stays good.
+      refreshToken: n.refresh_token ?? (e == null ? void 0 : e.refreshToken),
+      idToken: n.id_token ?? (e == null ? void 0 : e.idToken)
+    });
+    return { session: a, cookies: [await c.seal({ ticket: s })] };
+  };
+  return {
+    async begin(n = {}) {
+      const e = await i.configuration(), o = b(), a = p(), s = x(), d = {
+        redirect_uri: t.redirectUri,
+        // `organization:<alias>` asks Keycloak for one; a product with many asks for
+        // `organization:*` through `scope`, because plain `organization` prompts for a choice.
+        scope: n.organization === void 0 ? t.scope ?? g : `${t.scope ?? g} organization:${n.organization}`,
+        code_challenge: await C(o),
+        code_challenge_method: "S256",
+        state: a,
+        nonce: s
+      };
+      return {
+        url: I(e, d).href,
+        cookies: [
+          await f.seal({ state: a, nonce: s, verifier: o, returnTo: n.returnTo ?? "/" })
+        ]
+      };
+    },
+    async complete(n) {
+      const e = await f.read(n.cookie);
+      e === null && l(
+        "callback.state-mismatch",
+        "the callback arrived with no transaction cookie, so there is nothing to match its `state` against"
+      );
+      const o = new URL(n.url);
+      o.searchParams.get("state") !== e.state && l(
+        "callback.state-mismatch",
+        "the callback's `state` is not the one this browser was sent with"
+      );
+      const a = {
+        pkceCodeVerifier: e.verifier,
+        expectedState: e.state,
+        expectedNonce: e.nonce
+      }, s = (h) => S(h, o, a);
+      let d;
+      try {
+        d = await s(await i.configuration());
+      } catch (h) {
+        _(h) && l(
+          "callback.nonce-mismatch",
+          "the ID token's `nonce` is not the one this transaction sent",
+          h
+        ), P(h) || l("token.exchange-failed", "the authorization code could not be exchanged", h);
+        try {
+          d = await s(await i.rediscover());
+        } catch (u) {
+          _(u) && l(
+            "callback.nonce-mismatch",
+            "the ID token's `nonce` is not the one this transaction sent",
+            u
+          ), l(
+            "token.exchange-failed",
+            "the ID token did not verify, and did not verify against freshly discovered keys either",
+            u
+          );
+        }
+      }
+      const m = await k(d, null);
+      return {
+        ...m,
+        cookies: [...m.cookies, f.clear()],
+        returnTo: e.returnTo
+      };
+    },
+    async read(n) {
+      var e;
+      return ((e = await y(n)) == null ? void 0 : e.session) ?? null;
+    },
+    async refresh(n) {
+      const e = await c.read(n), o = e === null ? null : await r.get(e.ticket);
+      (e === null || o === null) && l("session.absent", "there is no session cookie to refresh"), o.refreshToken === void 0 && l("session.absent", "the session holds no refresh token, so it cannot be renewed");
+      let a;
+      try {
+        a = await E(await i.configuration(), o.refreshToken);
+      } catch (s) {
+        l("token.exchange-failed", "the refresh token was refused", s);
+      }
+      return await r.drop(e.ticket), k(a, o);
+    },
+    async end(n, e = {}) {
+      const o = await c.read(n), a = o === null ? null : await r.get(o.ticket);
+      o !== null && await r.drop(o.ticket);
+      const s = {}, d = e.returnTo ?? t.postLogoutRedirectUri;
+      return d !== void 0 && (s.post_logout_redirect_uri = d), (a == null ? void 0 : a.idToken) !== void 0 && (s.id_token_hint = a.idToken), {
+        url: A(await i.configuration(), s).href,
+        cookies: [c.clear()]
+      };
+    }
+  };
+}
+export {
+  X as cookieValue,
+  U as issuer,
+  v as relyingParty,
+  J as rewriteOrigin,
+  w as sealedCookie,
+  D as statelessStore
+};
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sources":["../src/server.ts"],"sourcesContent":["import {\n  buildAuthorizationUrl,\n  buildEndSessionUrl,\n  calculatePKCECodeChallenge,\n  randomNonce,\n  randomPKCECodeVerifier,\n  randomState,\n  refreshTokenGrant,\n  authorizationCodeGrant,\n  type Configuration,\n} from \"openid-client\";\nimport { claims } from \"./claims\";\nimport { sealedCookie, type SealedCookie } from \"./cookie-session\";\nimport { issuer, type IssuerConfig } from \"./issuer\";\nimport { statelessStore, type SessionRecord, type SessionStore } from \"./store\";\nimport { AuthError, type AuthErrorCode, type Session, type SignInOptions } from \"./types\";\n\n/**\n * `@kanzo-tech/auth/server` — the confidential OAuth client.\n *\n * This is the server half of the Backend For Frontend, which RFC 10017 calls *\"strongly\n * recommended for business applications, sensitive applications, and applications that handle\n * personal data\"*. The tokens live here and the browser gets a cookie it cannot read.\n *\n * **Nothing in this file implements OAuth.** `openid-client` does the flow, the ID token\n * verification and the end-session URL; `jose` does the sealing. What is written here is the\n * three-line sequence a route handler needs, the cookie discipline around it, and the reading of\n * Keycloak's claims into our one `Session` — which is the only part no library could have.\n *\n * ## The one thing that must never change\n *\n * **This module must not reach React.** It imports its siblings directly — `./claims`, never\n * `./index` — because importing the root barrel would drag React into a Node process. That is not\n * a hypothetical: it is the exact defect that forced `@kanzo-tech/mosaic` out of\n * `@kanzo-tech/ui`, and `scripts/smoke-install.mjs` asserts the built bytes for it.\n *\n * ## Framework-agnostic on purpose\n *\n * Strings in, strings out: a URL and a `Cookie` header go in, a URL and `Set-Cookie` values come\n * out. `./next` is a thin wrapper over this, and so is anything else — there is no `Request` in\n * the signatures because a `Request` would make Next's flavour of it the one that fits.\n */\n\nconst DEFAULT_SCOPE = \"openid profile email\";\n/** Eight hours: a working day, after which the refresh token is the thing keeping you signed in. */\nconst DEFAULT_MAX_AGE = 8 * 60 * 60;\n/** Ten minutes is long enough to type a password and short enough that an abandoned leg expires. */\nconst TRANSACTION_MAX_AGE = 10 * 60;\n\nfunction refuse(code: AuthErrorCode, message: string, cause?: unknown): never {\n  const error = new AuthError(code, message);\n  if (cause !== undefined) error.cause = cause;\n  throw error;\n}\n\nfunction codeOf(error: unknown): string | undefined {\n  if (typeof error !== \"object\" || error === null || !(\"code\" in error)) return undefined;\n  const code = (error as { code: unknown }).code;\n  return typeof code === \"string\" ? code : undefined;\n}\n\n/**\n * A nonce mismatch, told apart from every other reason a grant can fail.\n *\n * `oauth4webapi` reports every failed claim comparison under one code and names the offending\n * claim on a `cause`, and `openid-client` re-wraps that in a `ClientError` — so the claim's name\n * is two `cause` hops down. Reading it is the only way to answer \"which check failed\", which is\n * the whole point of having codes rather than a 401. The walk is bounded because a cause chain is\n * data from a library, not something to trust to terminate.\n */\nfunction isNonceMismatch(error: unknown): boolean {\n  const code = codeOf(error);\n\n  // A *wrong* nonce is a claim comparison, and the claim's name is carried structurally.\n  if (code === \"OAUTH_JWT_CLAIM_COMPARISON_FAILED\") {\n    let node: unknown = error;\n    for (let depth = 0; depth < 4 && typeof node === \"object\" && node !== null; depth++) {\n      if ((node as { claim?: unknown }).claim === \"nonce\") return true;\n      node = (node as { cause?: unknown }).cause;\n    }\n    return false;\n  }\n\n  // A *missing* nonce is reported as a malformed response instead, and the claim's name appears\n  // only in the message. Matching on a library's prose is brittle, and the answer to that is the\n  // test that pins it rather than a quieter code: if `oauth4webapi` rewords this, a test fails\n  // here instead of production silently reclassifying a replay as a transport problem.\n  return (\n    code === \"OAUTH_INVALID_RESPONSE\" &&\n    error instanceof Error &&\n    error.cause instanceof Error &&\n    error.cause.message.includes('\"nonce\"')\n  );\n}\n\n/**\n * A failure that looks like the signing keys we hold are no longer the ones Keycloak signs with.\n *\n * Keycloak rotates its realm keys, and a client holding a cached JWKS sees a key id it has never\n * heard of. keasy's Rust learned this and answers it the same way: re-fetch the metadata *once, on\n * a failure*, and retry. Refreshing on a timer instead would be a request every few minutes that\n * is wrong exactly when it matters.\n *\n * **This path is only reachable with `verifySignatures`.** Without it no key material is consulted\n * during a code grant at all — the channel vouches for the ID token — so there is nothing to go\n * stale. The Rust needed the retry unconditionally because `openidconnect` verifies the signature\n * either way; that is a difference between the two libraries, not between the two designs.\n */\nfunction isStaleKeyMaterial(error: unknown): boolean {\n  return codeOf(error) === \"OAUTH_KEY_SELECTION_FAILED\";\n}\n\n/** What `begin` and `end` answer: where to send the browser, and what to set on the way. */\nexport interface Redirect {\n  readonly url: string;\n  readonly cookies: readonly string[];\n}\n\n/** What `refresh` answers. */\nexport interface Renewed {\n  readonly session: Session;\n  readonly cookies: readonly string[];\n}\n\n/** What `complete` answers: a renewal, plus where the person was going before they were asked who they are. */\nexport interface SignedIn extends Renewed {\n  readonly returnTo: string;\n}\n\nexport interface RelyingPartyConfig extends IssuerConfig {\n  /** Registered at Keycloak, and where `complete` expects to be called. */\n  readonly redirectUri: string;\n  /** Seals the cookies. Any length; generate it. See `sealedCookie`. */\n  readonly secret: string | Uint8Array;\n  /** Default `openid profile email`. A multi-tenant product adds `organization:*`. */\n  readonly scope?: string;\n  /** Default {@link statelessStore}. Supply one to invalidate a session before it expires. */\n  readonly store?: SessionStore;\n  /** Session cookie lifetime in seconds. Default eight hours. */\n  readonly maxAge?: number;\n  /** Where Keycloak sends the browser after sign-out. Must be registered as a post-logout URI. */\n  readonly postLogoutRedirectUri?: string;\n}\n\nexport interface RelyingParty {\n  /** Leg one: the authorization URL, and the cookie that remembers this attempt. */\n  begin(options?: SignInOptions): Promise<Redirect>;\n  /** Leg two: the callback URL Keycloak returned to, and the `Cookie` header it arrived with. */\n  complete(request: { readonly url: string | URL; readonly cookie: string | null }): Promise<SignedIn>;\n  /** The session a request carries, or `null`. The read a route handler does on every request. */\n  read(cookie: string | null | undefined): Promise<Session | null>;\n  /** Spend the refresh token, take the new one, and reissue the cookie. */\n  refresh(cookie: string | null | undefined): Promise<Renewed>;\n  /** RP-initiated logout: forget the record here, clear the cookie, and end it at the IdP too. */\n  end(cookie: string | null | undefined, options?: { readonly returnTo?: string }): Promise<Redirect>;\n}\n\n/** Everything either grant returns: one type, because both are answers from the token endpoint. */\ntype Tokens = Awaited<ReturnType<typeof refreshTokenGrant>>;\n\n/** What the session cookie carries: a ticket into the store, and nothing a browser could use. */\ninterface SessionTicket {\n  readonly ticket: string;\n}\n\n/** What the transaction cookie carries between the two legs. */\ninterface Transaction {\n  readonly state: string;\n  readonly nonce: string;\n  readonly verifier: string;\n  readonly returnTo: string;\n}\n\nexport function relyingParty(config: RelyingPartyConfig): RelyingParty {\n  const provider = issuer(config);\n  const store = config.store ?? statelessStore();\n\n  const session: SealedCookie<SessionTicket> = sealedCookie({\n    name: \"kanzo-session\",\n    secret: config.secret,\n    maxAge: config.maxAge ?? DEFAULT_MAX_AGE,\n  });\n\n  // A second cookie rather than a field on the first, because its lifetime is different by two\n  // orders of magnitude and it must be gone the moment the callback has used it.\n  const transaction: SealedCookie<Transaction> = sealedCookie({\n    name: \"kanzo-auth\",\n    secret: config.secret,\n    maxAge: TRANSACTION_MAX_AGE,\n  });\n\n  const recordFrom = async (cookie: string | null | undefined): Promise<SessionRecord | null> => {\n    const sealed = await session.read(cookie);\n    if (sealed === null) return null;\n    return store.get(sealed.ticket);\n  };\n\n  /** Everything a successful grant produces, in the one place both grants can use it. */\n  const adopt = async (tokens: Tokens, previous: SessionRecord | null): Promise<Renewed> => {\n    // A refresh that returns no new ID token leaves the identity as it was; only the tokens moved.\n    const idClaims = tokens.claims();\n    const next = idClaims === undefined ? previous?.session : claims(idClaims, config);\n    if (next === undefined) {\n      refuse(\"token.exchange-failed\", \"the token response carried no ID token, so it names nobody\");\n    }\n\n    const ticket = await store.put({\n      session: next,\n      // RFC 10017 requires rotation, so the newly issued token is the only one still valid. An\n      // authorization server that did not rotate returns none, and the one we hold stays good.\n      refreshToken: tokens.refresh_token ?? previous?.refreshToken,\n      idToken: tokens.id_token ?? previous?.idToken,\n    });\n\n    return { session: next, cookies: [await session.seal({ ticket })] };\n  };\n\n  return {\n    async begin(options = {}) {\n      const configuration = await provider.configuration();\n\n      const verifier = randomPKCECodeVerifier();\n      const state = randomState();\n      const nonce = randomNonce();\n\n      const parameters: Record<string, string> = {\n        redirect_uri: config.redirectUri,\n        // `organization:<alias>` asks Keycloak for one; a product with many asks for\n        // `organization:*` through `scope`, because plain `organization` prompts for a choice.\n        scope:\n          options.organization === undefined\n            ? (config.scope ?? DEFAULT_SCOPE)\n            : `${config.scope ?? DEFAULT_SCOPE} organization:${options.organization}`,\n        code_challenge: await calculatePKCECodeChallenge(verifier),\n        code_challenge_method: \"S256\",\n        state,\n        nonce,\n      };\n\n      return {\n        url: buildAuthorizationUrl(configuration, parameters).href,\n        cookies: [\n          await transaction.seal({ state, nonce, verifier, returnTo: options.returnTo ?? \"/\" }),\n        ],\n      };\n    },\n\n    async complete(request) {\n      const pending = await transaction.read(request.cookie);\n      if (pending === null) {\n        refuse(\n          \"callback.state-mismatch\",\n          \"the callback arrived with no transaction cookie, so there is nothing to match its `state` against\",\n        );\n      }\n\n      const current = new URL(request.url);\n      if (current.searchParams.get(\"state\") !== pending.state) {\n        refuse(\n          \"callback.state-mismatch\",\n          \"the callback's `state` is not the one this browser was sent with\",\n        );\n      }\n\n      const checks = {\n        pkceCodeVerifier: pending.verifier,\n        expectedState: pending.state,\n        expectedNonce: pending.nonce,\n      };\n\n      const grant = (configuration: Configuration) =>\n        authorizationCodeGrant(configuration, current, checks);\n\n      let tokens: Tokens;\n      try {\n        tokens = await grant(await provider.configuration());\n      } catch (error) {\n        if (isNonceMismatch(error)) {\n          refuse(\n            \"callback.nonce-mismatch\",\n            \"the ID token's `nonce` is not the one this transaction sent\",\n            error,\n          );\n        }\n        if (!isStaleKeyMaterial(error)) {\n          refuse(\"token.exchange-failed\", \"the authorization code could not be exchanged\", error);\n        }\n        // Keycloak rotated its signing key. One re-discovery, one retry, then give up — a loop\n        // here is a self-inflicted denial of service against the identity provider.\n        try {\n          tokens = await grant(await provider.rediscover());\n        } catch (retried) {\n          if (isNonceMismatch(retried)) {\n            refuse(\n              \"callback.nonce-mismatch\",\n              \"the ID token's `nonce` is not the one this transaction sent\",\n              retried,\n            );\n          }\n          refuse(\n            \"token.exchange-failed\",\n            \"the ID token did not verify, and did not verify against freshly discovered keys either\",\n            retried,\n          );\n        }\n      }\n\n      // Session fixation: the record is new, the ticket is new and the cookie is new, and any\n      // session cookie this callback happened to arrive with is not read. keasy's Rust calls\n      // `cycle_id()` here for the same reason — an attacker who planted a session before sign-in\n      // must not find themselves holding the one that sign-in produced.\n      const renewed = await adopt(tokens, null);\n\n      return {\n        ...renewed,\n        cookies: [...renewed.cookies, transaction.clear()],\n        returnTo: pending.returnTo,\n      };\n    },\n\n    async read(cookie) {\n      return (await recordFrom(cookie))?.session ?? null;\n    },\n\n    async refresh(cookie) {\n      const sealed = await session.read(cookie);\n      const record = sealed === null ? null : await store.get(sealed.ticket);\n      if (sealed === null || record === null) {\n        refuse(\"session.absent\", \"there is no session cookie to refresh\");\n      }\n      if (record.refreshToken === undefined) {\n        refuse(\"session.absent\", \"the session holds no refresh token, so it cannot be renewed\");\n      }\n\n      let tokens: Tokens;\n      try {\n        tokens = await refreshTokenGrant(await provider.configuration(), record.refreshToken);\n      } catch (error) {\n        // Under rotation a refused refresh is often a *replayed* token rather than an expired one,\n        // and the authorization server may have revoked the whole chain. Either way the session is\n        // over; `single-flight.ts` exists to keep us from causing it.\n        refuse(\"token.exchange-failed\", \"the refresh token was refused\", error);\n      }\n\n      // The superseded ticket goes first: a store that enforces one live session per person must\n      // not briefly hold two, and for the stateless default this is a no-op.\n      await store.drop(sealed.ticket);\n      return adopt(tokens, record);\n    },\n\n    async end(cookie, options = {}) {\n      const sealed = await session.read(cookie);\n      const record = sealed === null ? null : await store.get(sealed.ticket);\n      if (sealed !== null) await store.drop(sealed.ticket);\n\n      const parameters: Record<string, string> = {};\n      const returnTo = options.returnTo ?? config.postLogoutRedirectUri;\n      if (returnTo !== undefined) parameters[\"post_logout_redirect_uri\"] = returnTo;\n      // Without the hint Keycloak cannot tell which session is ending and asks the person to\n      // confirm — which reads as a bug to everyone who sees it.\n      if (record?.idToken !== undefined) parameters[\"id_token_hint\"] = record.idToken;\n\n      // `buildEndSessionUrl` rather than a hand-built URL: the endpoint comes from discovery, and\n      // the parameter names are the specification's rather than ours to remember.\n      return {\n        url: buildEndSessionUrl(await provider.configuration(), parameters).href,\n        cookies: [session.clear()],\n      };\n    },\n  };\n}\n\nexport { issuer, rewriteOrigin, type Issuer, type IssuerConfig } from \"./issuer\";\nexport { sealedCookie, cookieValue, type SealedCookie, type SealedCookieConfig } from \"./cookie-session\";\nexport { statelessStore, type SessionRecord, type SessionStore } from \"./store\";\n"],"names":["DEFAULT_SCOPE","DEFAULT_MAX_AGE","TRANSACTION_MAX_AGE","refuse","code","message","cause","error","AuthError","codeOf","isNonceMismatch","node","depth","isStaleKeyMaterial","relyingParty","config","provider","issuer","store","statelessStore","session","sealedCookie","transaction","recordFrom","cookie","sealed","adopt","tokens","previous","idClaims","next","claims","ticket","options","configuration","verifier","randomPKCECodeVerifier","state","randomState","nonce","randomNonce","parameters","calculatePKCECodeChallenge","buildAuthorizationUrl","request","pending","current","checks","grant","authorizationCodeGrant","retried","renewed","_a","record","refreshTokenGrant","returnTo","buildEndSessionUrl"],"mappings":";;;;;;;;AA2CA,MAAMA,IAAgB,wBAEhBC,IAAkB,MAAS,IAE3BC,IAAsB;AAE5B,SAASC,EAAOC,GAAqBC,GAAiBC,GAAwB;AAC5E,QAAMC,IAAQ,IAAIC,EAAUJ,GAAMC,CAAO;AACzC,QAAIC,MAAU,WAAWC,EAAM,QAAQD,IACjCC;AACR;AAEA,SAASE,EAAOF,GAAoC;AAClD,MAAI,OAAOA,KAAU,YAAYA,MAAU,QAAQ,EAAE,UAAUA,GAAQ;AACvE,QAAMH,IAAQG,EAA4B;AAC1C,SAAO,OAAOH,KAAS,WAAWA,IAAO;AAC3C;AAWA,SAASM,EAAgBH,GAAyB;AAChD,QAAMH,IAAOK,EAAOF,CAAK;AAGzB,MAAIH,MAAS,qCAAqC;AAChD,QAAIO,IAAgBJ;AACpB,aAASK,IAAQ,GAAGA,IAAQ,KAAK,OAAOD,KAAS,YAAYA,MAAS,MAAMC,KAAS;AACnF,UAAKD,EAA6B,UAAU,QAAS,QAAO;AAC5D,MAAAA,IAAQA,EAA6B;AAAA,IACvC;AACA,WAAO;AAAA,EACT;AAMA,SACEP,MAAS,4BACTG,aAAiB,SACjBA,EAAM,iBAAiB,SACvBA,EAAM,MAAM,QAAQ,SAAS,SAAS;AAE1C;AAeA,SAASM,EAAmBN,GAAyB;AACnD,SAAOE,EAAOF,CAAK,MAAM;AAC3B;AA+DO,SAASO,EAAaC,GAA0C;AACrE,QAAMC,IAAWC,EAAOF,CAAM,GACxBG,IAAQH,EAAO,SAASI,EAAA,GAExBC,IAAuCC,EAAa;AAAA,IACxD,MAAM;AAAA,IACN,QAAQN,EAAO;AAAA,IACf,QAAQA,EAAO,UAAUd;AAAA,EAAA,CAC1B,GAIKqB,IAAyCD,EAAa;AAAA,IAC1D,MAAM;AAAA,IACN,QAAQN,EAAO;AAAA,IACf,QAAQb;AAAA,EAAA,CACT,GAEKqB,IAAa,OAAOC,MAAqE;AAC7F,UAAMC,IAAS,MAAML,EAAQ,KAAKI,CAAM;AACxC,WAAIC,MAAW,OAAa,OACrBP,EAAM,IAAIO,EAAO,MAAM;AAAA,EAChC,GAGMC,IAAQ,OAAOC,GAAgBC,MAAqD;AAExF,UAAMC,IAAWF,EAAO,OAAA,GAClBG,IAAOD,MAAa,SAAYD,KAAA,gBAAAA,EAAU,UAAUG,EAAOF,GAAUd,CAAM;AACjF,IAAIe,MAAS,UACX3B,EAAO,yBAAyB,4DAA4D;AAG9F,UAAM6B,IAAS,MAAMd,EAAM,IAAI;AAAA,MAC7B,SAASY;AAAA;AAAA;AAAA,MAGT,cAAcH,EAAO,kBAAiBC,KAAA,gBAAAA,EAAU;AAAA,MAChD,SAASD,EAAO,aAAYC,KAAA,gBAAAA,EAAU;AAAA,IAAA,CACvC;AAED,WAAO,EAAE,SAASE,GAAM,SAAS,CAAC,MAAMV,EAAQ,KAAK,EAAE,QAAAY,EAAA,CAAQ,CAAC,EAAA;AAAA,EAClE;AAEA,SAAO;AAAA,IACL,MAAM,MAAMC,IAAU,IAAI;AACxB,YAAMC,IAAgB,MAAMlB,EAAS,cAAA,GAE/BmB,IAAWC,EAAA,GACXC,IAAQC,EAAA,GACRC,IAAQC,EAAA,GAERC,IAAqC;AAAA,QACzC,cAAc1B,EAAO;AAAA;AAAA;AAAA,QAGrB,OACEkB,EAAQ,iBAAiB,SACpBlB,EAAO,SAASf,IACjB,GAAGe,EAAO,SAASf,CAAa,iBAAiBiC,EAAQ,YAAY;AAAA,QAC3E,gBAAgB,MAAMS,EAA2BP,CAAQ;AAAA,QACzD,uBAAuB;AAAA,QACvB,OAAAE;AAAA,QACA,OAAAE;AAAA,MAAA;AAGF,aAAO;AAAA,QACL,KAAKI,EAAsBT,GAAeO,CAAU,EAAE;AAAA,QACtD,SAAS;AAAA,UACP,MAAMnB,EAAY,KAAK,EAAE,OAAAe,GAAO,OAAAE,GAAO,UAAAJ,GAAU,UAAUF,EAAQ,YAAY,IAAA,CAAK;AAAA,QAAA;AAAA,MACtF;AAAA,IAEJ;AAAA,IAEA,MAAM,SAASW,GAAS;AACtB,YAAMC,IAAU,MAAMvB,EAAY,KAAKsB,EAAQ,MAAM;AACrD,MAAIC,MAAY,QACd1C;AAAA,QACE;AAAA,QACA;AAAA,MAAA;AAIJ,YAAM2C,IAAU,IAAI,IAAIF,EAAQ,GAAG;AACnC,MAAIE,EAAQ,aAAa,IAAI,OAAO,MAAMD,EAAQ,SAChD1C;AAAA,QACE;AAAA,QACA;AAAA,MAAA;AAIJ,YAAM4C,IAAS;AAAA,QACb,kBAAkBF,EAAQ;AAAA,QAC1B,eAAeA,EAAQ;AAAA,QACvB,eAAeA,EAAQ;AAAA,MAAA,GAGnBG,IAAQ,CAACd,MACbe,EAAuBf,GAAeY,GAASC,CAAM;AAEvD,UAAIpB;AACJ,UAAI;AACF,QAAAA,IAAS,MAAMqB,EAAM,MAAMhC,EAAS,eAAe;AAAA,MACrD,SAAST,GAAO;AACd,QAAIG,EAAgBH,CAAK,KACvBJ;AAAA,UACE;AAAA,UACA;AAAA,UACAI;AAAA,QAAA,GAGCM,EAAmBN,CAAK,KAC3BJ,EAAO,yBAAyB,iDAAiDI,CAAK;AAIxF,YAAI;AACF,UAAAoB,IAAS,MAAMqB,EAAM,MAAMhC,EAAS,YAAY;AAAA,QAClD,SAASkC,GAAS;AAChB,UAAIxC,EAAgBwC,CAAO,KACzB/C;AAAA,YACE;AAAA,YACA;AAAA,YACA+C;AAAA,UAAA,GAGJ/C;AAAA,YACE;AAAA,YACA;AAAA,YACA+C;AAAA,UAAA;AAAA,QAEJ;AAAA,MACF;AAMA,YAAMC,IAAU,MAAMzB,EAAMC,GAAQ,IAAI;AAExC,aAAO;AAAA,QACL,GAAGwB;AAAA,QACH,SAAS,CAAC,GAAGA,EAAQ,SAAS7B,EAAY,OAAO;AAAA,QACjD,UAAUuB,EAAQ;AAAA,MAAA;AAAA,IAEtB;AAAA,IAEA,MAAM,KAAKrB,GAAQ;;AACjB,eAAQ4B,IAAA,MAAM7B,EAAWC,CAAM,MAAvB,gBAAA4B,EAA2B,YAAW;AAAA,IAChD;AAAA,IAEA,MAAM,QAAQ5B,GAAQ;AACpB,YAAMC,IAAS,MAAML,EAAQ,KAAKI,CAAM,GAClC6B,IAAS5B,MAAW,OAAO,OAAO,MAAMP,EAAM,IAAIO,EAAO,MAAM;AACrE,OAAIA,MAAW,QAAQ4B,MAAW,SAChClD,EAAO,kBAAkB,uCAAuC,GAE9DkD,EAAO,iBAAiB,UAC1BlD,EAAO,kBAAkB,6DAA6D;AAGxF,UAAIwB;AACJ,UAAI;AACF,QAAAA,IAAS,MAAM2B,EAAkB,MAAMtC,EAAS,cAAA,GAAiBqC,EAAO,YAAY;AAAA,MACtF,SAAS9C,GAAO;AAId,QAAAJ,EAAO,yBAAyB,iCAAiCI,CAAK;AAAA,MACxE;AAIA,mBAAMW,EAAM,KAAKO,EAAO,MAAM,GACvBC,EAAMC,GAAQ0B,CAAM;AAAA,IAC7B;AAAA,IAEA,MAAM,IAAI7B,GAAQS,IAAU,IAAI;AAC9B,YAAMR,IAAS,MAAML,EAAQ,KAAKI,CAAM,GAClC6B,IAAS5B,MAAW,OAAO,OAAO,MAAMP,EAAM,IAAIO,EAAO,MAAM;AACrE,MAAIA,MAAW,QAAM,MAAMP,EAAM,KAAKO,EAAO,MAAM;AAEnD,YAAMgB,IAAqC,CAAA,GACrCc,IAAWtB,EAAQ,YAAYlB,EAAO;AAC5C,aAAIwC,MAAa,WAAWd,EAAW,2BAA8Bc,KAGjEF,KAAA,gBAAAA,EAAQ,aAAY,WAAWZ,EAAW,gBAAmBY,EAAO,UAIjE;AAAA,QACL,KAAKG,EAAmB,MAAMxC,EAAS,cAAA,GAAiByB,CAAU,EAAE;AAAA,QACpE,SAAS,CAACrB,EAAQ,MAAA,CAAO;AAAA,MAAA;AAAA,IAE7B;AAAA,EAAA;AAEJ;"}

package/dist/single-flight.d.ts

@@ -0,0 +1,15 @@
+/**
+ * One in-flight call at a time, shared by every caller that asks while it runs.
+ *
+ * This exists for exactly one failure, and it is not a performance one. RFC 10017 requires refresh
+ * tokens for browser applications to **rotate on every use**, so a refresh both mints a new token
+ * and invalidates the one it was called with. Ten requests that notice an expiring token at the
+ * same moment therefore fire ten refreshes with the same token, and nine of them are replaying a
+ * token the first already spent — the authorization server is entitled to treat that as theft and
+ * revoke the whole chain. The session does not degrade; it dies, and it dies under load, which is
+ * the worst way to find out.
+ *
+ * So the rule is a rule rather than an optimisation: **the refresh path is single-flight.**
+ */
+export declare function singleFlight<T>(work: () => Promise<T>): () => Promise<T>;
+//# sourceMappingURL=single-flight.d.ts.map

package/dist/single-flight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight.d.ts","sourceRoot":"","sources":["../src/single-flight.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,OAAO,CAAC,CAAC,CAAC,CAiBxE"}

package/dist/single-flight.js

@@ -0,0 +1,10 @@
+function t(n) {
+  let i;
+  return () => (i !== void 0 || (i = n().finally(() => {
+    i = void 0;
+  })), i);
+}
+export {
+  t as singleFlight
+};
+//# sourceMappingURL=single-flight.js.map

package/dist/single-flight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"single-flight.js","sources":["../src/single-flight.ts"],"sourcesContent":["/**\n * One in-flight call at a time, shared by every caller that asks while it runs.\n *\n * This exists for exactly one failure, and it is not a performance one. RFC 10017 requires refresh\n * tokens for browser applications to **rotate on every use**, so a refresh both mints a new token\n * and invalidates the one it was called with. Ten requests that notice an expiring token at the\n * same moment therefore fire ten refreshes with the same token, and nine of them are replaying a\n * token the first already spent — the authorization server is entitled to treat that as theft and\n * revoke the whole chain. The session does not degrade; it dies, and it dies under load, which is\n * the worst way to find out.\n *\n * So the rule is a rule rather than an optimisation: **the refresh path is single-flight.**\n */\nexport function singleFlight<T>(work: () => Promise<T>): () => Promise<T> {\n  let inFlight: Promise<T> | undefined;\n\n  return () => {\n    // A call that arrives while one is running joins it instead of starting a second.\n    if (inFlight !== undefined) return inFlight;\n\n    // The slot is cleared in a `finally` so a rejection does not wedge every later call onto a\n    // failure that has already been reported. The next caller gets a fresh attempt — which is what\n    // you want when the failure was a dropped connection, and harmless when it was not, because\n    // the caller above is the one deciding whether to retry.\n    inFlight = work().finally(() => {\n      inFlight = undefined;\n    });\n\n    return inFlight;\n  };\n}\n"],"names":["singleFlight","work","inFlight"],"mappings":"AAaO,SAASA,EAAgBC,GAA0C;AACxE,MAAIC;AAEJ,SAAO,OAEDA,MAAa,WAMjBA,IAAWD,IAAO,QAAQ,MAAM;AAC9B,IAAAC,IAAW;AAAA,EACb,CAAC,IAEMA;AAEX;"}