@kortix/sdk 0.13.5 → 0.13.9

package/dist/node/app-viewer.d.ts

@@ -0,0 +1,41 @@
+import type { Kortix } from '../core/client/kortix.js';
+export declare const APP_VIEWER_HEADER = "x-kortix-app-viewer";
+export declare const APP_VIEWER_TOKEN_HEADER = "x-kortix-app-viewer-token";
+export declare const APP_VIEWER_SECRET_ENV = "KORTIX_APP_VIEWER_SECRET";
+export interface KortixAppViewer {
+    userId: string;
+    email: string | null;
+    groupIds: string[];
+    accountId: string;
+    appId: string;
+    /** The App's access mode when the gate authorized this request. */
+    accessMode: string;
+    /** The viewer's App-scoped Kortix bearer, or null for an identity-only App. */
+    token: string | null;
+    /** When the signed identity expires (the gate re-signs on every request). */
+    expiresAt: Date;
+}
+export interface ReadAppViewerOptions {
+    /** Defaults to `process.env.KORTIX_APP_VIEWER_SECRET`. */
+    secret?: string;
+}
+/**
+ * The verified Kortix viewer behind this request, or `null` when there is none
+ * (a public App, a signed-out visitor, or no secret configured).
+ */
+export declare function readAppViewer(request: Request, options?: ReadAppViewerOptions): Promise<KortixAppViewer | null>;
+export declare class AppViewerUnavailableError extends Error {
+    readonly code: 'no_viewer' | 'identity_only';
+    constructor(code: 'no_viewer' | 'identity_only', message: string);
+}
+/**
+ * A request-scoped Kortix client acting AS this App's viewer.
+ *
+ * Needs the App to be API-scoped (`viewer_token_scope: 'api'` — Kortix web:
+ * the App's Access panel). Throws `AppViewerUnavailableError` otherwise, so a
+ * misconfigured App fails loudly instead of quietly acting as nobody.
+ */
+export declare function createAppViewerKortix(request: Request, options: {
+    backendUrl: string;
+} & ReadAppViewerOptions): Promise<Kortix>;
+//# sourceMappingURL=app-viewer.d.ts.map

package/dist/node/app-viewer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-viewer.d.ts","sourceRoot":"","sources":["../../src/node/app-viewer.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAEpD,eAAO,MAAM,iBAAiB,wBAAwB,CAAC;AACvD,eAAO,MAAM,uBAAuB,8BAA8B,CAAC;AACnE,eAAO,MAAM,qBAAqB,6BAA6B,CAAC;AAEhE,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,mEAAmE;IACnE,UAAU,EAAE,MAAM,CAAC;IACnB,+EAA+E;IAC/E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,6EAA6E;IAC7E,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,0DAA0D;IAC1D,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAyCD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,oBAAyB,GACjC,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAwDjC;AAED,qBAAa,yBAA0B,SAAQ,KAAK;aAEhC,IAAI,EAAE,WAAW,GAAG,eAAe;gBAAnC,IAAI,EAAE,WAAW,GAAG,eAAe,EACnD,OAAO,EAAE,MAAM;CAKlB;AAED;;;;;;GAMG;AACH,wBAAsB,qBAAqB,CACzC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,oBAAoB,GACrD,OAAO,CAAC,MAAM,CAAC,CAiBjB"}

package/dist/node/app-viewer.js

@@ -0,0 +1,150 @@
+/**
+ * Kortix Apps — the viewer, on the App's server.
+ *
+ * The Apps gate signs an identity into every proxied request
+ * (`x-kortix-app-viewer`) and, for an API-scoped App, the viewer's token
+ * alongside it (`x-kortix-app-viewer-token`). An App verifies the first with
+ * the per-App secret Kortix injects at deploy (`KORTIX_APP_VIEWER_SECRET`) and
+ * knows exactly who is looking — with no login of its own and no round trip:
+ *
+ * ```ts
+ * const viewer = await readAppViewer(request);
+ * if (!viewer) return new Response('Not found', { status: 404 });
+ * const dashboards = await listFor(viewer.userId, viewer.groupIds);
+ * ```
+ *
+ * and, when the App may act as them on the Kortix API:
+ *
+ * ```ts
+ * const kortix = await createAppViewerKortix(request, { backendUrl });
+ * await kortix.projects.list();   // as the viewer, with the viewer's role
+ * ```
+ *
+ * A forged header cannot survive: the gate deletes any client-supplied copy
+ * before forwarding, and this function refuses anything the App's own secret
+ * does not sign. With no secret configured it returns `null` — an App never
+ * trusts an unverified identity.
+ */
+import { createScopedKortix } from './server.js';
+export const APP_VIEWER_HEADER = 'x-kortix-app-viewer';
+export const APP_VIEWER_TOKEN_HEADER = 'x-kortix-app-viewer-token';
+export const APP_VIEWER_SECRET_ENV = 'KORTIX_APP_VIEWER_SECRET';
+function envSecret() {
+    const env = globalThis.process?.env;
+    return env?.[APP_VIEWER_SECRET_ENV];
+}
+function fromB64url(value) {
+    const padded = value.replace(/-/g, '+').replace(/_/g, '/') + '='.repeat((4 - (value.length % 4)) % 4);
+    const bin = atob(padded);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i += 1)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+function b64url(bytes) {
+    let s = '';
+    for (const b of bytes)
+        s += String.fromCharCode(b);
+    return btoa(s).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/** Length-independent compare — never returns early on the first differing byte. */
+function equal(a, b) {
+    if (a.length !== b.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < a.length; i += 1)
+        diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+    return diff === 0;
+}
+/**
+ * The verified Kortix viewer behind this request, or `null` when there is none
+ * (a public App, a signed-out visitor, or no secret configured).
+ */
+export async function readAppViewer(request, options = {}) {
+    const secret = options.secret ?? envSecret();
+    if (!secret)
+        return null;
+    const raw = request.headers.get(APP_VIEWER_HEADER);
+    if (!raw)
+        return null;
+    const [payloadB64, sig, extra] = raw.split('.');
+    if (!payloadB64 || !sig || extra)
+        return null;
+    const key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['sign']);
+    const message = new TextEncoder().encode(`kortix-app-viewer:v1\0${payloadB64}`);
+    const expected = b64url(new Uint8Array(await crypto.subtle.sign('HMAC', key, message)));
+    if (!equal(sig, expected))
+        return null;
+    let payload;
+    try {
+        payload = JSON.parse(new TextDecoder().decode(fromB64url(payloadB64)));
+    }
+    catch {
+        return null;
+    }
+    if (payload.v !== 1 || typeof payload.userId !== 'string' || !payload.userId)
+        return null;
+    if (typeof payload.exp !== 'number' || payload.exp * 1000 <= Date.now())
+        return null;
+    /*
+     * A malformed field is refused, never coerced.
+     *
+     * Reading a non-array `groupIds` as `[]` would hand the App a viewer with
+     * their group memberships silently missing — which reads to the App as "this
+     * person is in no groups" and quietly removes whatever group grants gave
+     * them. No viewer at all is the honest answer, and the one an App is already
+     * written to handle. (Found from the consumer side: essentia-dashboards
+     * asserts that a signed payload which is not a statement about a person is
+     * refused.)
+     */
+    if (payload.groupIds !== undefined) {
+        if (!Array.isArray(payload.groupIds))
+            return null;
+        if (payload.groupIds.some((id) => typeof id !== 'string'))
+            return null;
+    }
+    if (payload.email !== undefined && payload.email !== null && typeof payload.email !== 'string') {
+        return null;
+    }
+    return {
+        userId: payload.userId,
+        email: payload.email ?? null,
+        groupIds: payload.groupIds ?? [],
+        accountId: payload.accountId,
+        appId: payload.appId,
+        accessMode: payload.accessMode,
+        token: request.headers.get(APP_VIEWER_TOKEN_HEADER),
+        expiresAt: new Date(payload.exp * 1000),
+    };
+}
+export class AppViewerUnavailableError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = 'AppViewerUnavailableError';
+    }
+}
+/**
+ * A request-scoped Kortix client acting AS this App's viewer.
+ *
+ * Needs the App to be API-scoped (`viewer_token_scope: 'api'` — Kortix web:
+ * the App's Access panel). Throws `AppViewerUnavailableError` otherwise, so a
+ * misconfigured App fails loudly instead of quietly acting as nobody.
+ */
+export async function createAppViewerKortix(request, options) {
+    const viewer = await readAppViewer(request, options);
+    if (!viewer) {
+        throw new AppViewerUnavailableError('no_viewer', 'No verified Kortix viewer on this request');
+    }
+    if (!viewer.token) {
+        throw new AppViewerUnavailableError('identity_only', "This App carries viewer identity but no API token — set its access policy to viewer_token_scope: 'api' to act as the viewer.");
+    }
+    const token = viewer.token;
+    return createScopedKortix({
+        backendUrl: options.backendUrl,
+        getToken: async () => token,
+        clientSource: 'web',
+    });
+}
+//# sourceMappingURL=app-viewer.js.map

package/dist/node/app-viewer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-viewer.js","sourceRoot":"","sources":["../../src/node/app-viewer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAG9C,MAAM,CAAC,MAAM,iBAAiB,GAAG,qBAAqB,CAAC;AACvD,MAAM,CAAC,MAAM,uBAAuB,GAAG,2BAA2B,CAAC;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC;AAqBhE,SAAS,SAAS;IAChB,MAAM,GAAG,GAAI,UAAyE,CAAC,OAAO,EAAE,GAAG,CAAC;IACpG,OAAO,GAAG,EAAE,CAAC,qBAAqB,CAAC,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtG,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IACnE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,MAAM,CAAC,KAAiB;IAC/B,IAAI,CAAC,GAAG,EAAE,CAAC;IACX,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,CAAC,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED,oFAAoF;AACpF,SAAS,KAAK,CAAC,CAAS,EAAE,CAAS;IACjC,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC;QAAE,IAAI,IAAI,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChF,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAcD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IACnD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,CAAC,UAAU,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,UAAU,IAAI,CAAC,GAAG,IAAI,KAAK;QAAE,OAAO,IAAI,CAAC;IAE9C,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAC;IACF,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,yBAAyB,UAAU,EAAE,CAAC,CAAC;IAChF,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,UAAU,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAEvC,IAAI,OAAsB,CAAC;IAC3B,IAAI,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAkB,CAAC;IAC1F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC1F,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,GAAG,IAAI,IAAI,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrF;;;;;;;;;;OAUG;IACH,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,EAAE,KAAK,QAAQ,CAAC;YAAE,OAAO,IAAI,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,KAAK,IAAI,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/F,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI;QAC5B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;QACnD,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEhC;IADlB,YACkB,IAAmC,EACnD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHC,SAAI,GAAJ,IAAI,CAA+B;QAInD,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,OAAgB,EAChB,OAAsD;IAEtD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACrD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,yBAAyB,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IAChG,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,yBAAyB,CACjC,eAAe,EACf,8HAA8H,CAC/H,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC;IAC3B,OAAO,kBAAkB,CAAC;QACxB,UAAU,EAAE,OAAO,CAAC,UAAU;QAC9B,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK;QAC3B,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;AACL,CAAC"}

package/dist/node/auth.d.ts

@@ -0,0 +1,84 @@
+import type { Kortix } from '../core/client/kortix.js';
+import type { AccountIdentity } from '../core/rest/projects-client/accounts.js';
+/** The subset of `fetch` the kit needs — assignable from any fetch-shaped function. */
+export type KortixFetch = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
+export interface KortixAuthOptions {
+    /** Kortix API base incl. version prefix, e.g. `https://api.kortix.com/v1`. */
+    backendUrl: string;
+    /** The OAuth client id from Account → Tokens → OAuth apps. */
+    clientId: string;
+    /** The client secret. Omit for a `public` client (PKCE only). */
+    clientSecret?: string;
+    /** Absolute callback URL, byte-identical to one registered on the client. */
+    redirectUri: string;
+    /** ≥ 32 characters. Encrypts the session cookie (AES-256-GCM, key = SHA-256 of this). */
+    cookieSecret: string;
+    /** Scopes to request. Default: `profile email kortix` (`kortix` = act as the user on the API). */
+    scopes?: string[];
+    /** Mount path of `handler()`. Default: the redirect URI's path minus `/callback`. */
+    basePath?: string;
+    /** How long a signed-in session may live without a fresh sign-in. Default 30 days (the refresh-token lifetime). */
+    sessionTtlSeconds?: number;
+    /** Custom `fetch` (tests, edge adapters). */
+    fetch?: KortixFetch;
+    /** Clock, for tests. */
+    now?: () => number;
+}
+export interface KortixViewer {
+    userId: string;
+    email: string;
+    accounts: AccountIdentity['accounts'];
+    /** Scopes the user granted this app. */
+    scopes: string[];
+    /** The viewer's access token — pass it to `createScopedKortix` or send it as a bearer. */
+    token: string;
+    /** Epoch milliseconds when `token` expires. */
+    expiresAt: number;
+}
+export type RequireViewerResult = {
+    viewer: KortixViewer;
+    response?: undefined;
+} | {
+    viewer?: undefined;
+    response: Response;
+};
+export interface KortixAuth {
+    /** The mount path every link and cookie assumes (e.g. `/api/kortix/auth`). */
+    readonly basePath: string;
+    /**
+     * The one route. Mount it as a catch-all under `basePath` for every method:
+     * `/signin`, `/callback`, `/refresh`, `/signout`, `/me`, `/proxy/*`.
+     */
+    handler(request: Request): Promise<Response>;
+    /** The signed-in viewer, or `null`. Read-only: never rotates a refresh token. */
+    viewer(request: Request): Promise<KortixViewer | null>;
+    /** The viewer, or the redirect (`/refresh` when refreshable, else `/signin`) to return from middleware. */
+    requireViewer(request: Request): Promise<RequireViewerResult>;
+    /** A request-scoped SDK client acting as the viewer. Throws `KortixAuthError` when signed out. */
+    kortix(request: Request): Promise<Kortix>;
+    /** Link target that starts sign-in and returns to `returnTo` (a same-origin path). */
+    signInUrl(returnTo?: string): string;
+    /** Link target that signs out and lands on `returnTo`. */
+    signOutUrl(returnTo?: string): string;
+    /**
+     * `createKortix` config for the browser: `backendUrl` is this app's
+     * `/proxy`, and `getToken` yields a sentinel the proxy swaps for the
+     * viewer's real token. `origin` defaults to `window.location.origin`.
+     */
+    clientConfig(origin?: string): {
+        backendUrl: string;
+        getToken: () => Promise<string>;
+    };
+    /** @internal test seam */
+    __setNow(now: () => number): void;
+}
+export declare class KortixAuthError extends Error {
+    readonly code: 'invalid_options' | 'unauthenticated' | 'state_mismatch' | 'token_exchange_failed' | 'refresh_failed';
+    constructor(code: 'invalid_options' | 'unauthenticated' | 'state_mismatch' | 'token_exchange_failed' | 'refresh_failed', message: string);
+}
+/** The bearer the browser sends; `/proxy` replaces it with the viewer's token. */
+export declare const KORTIX_SESSION_SENTINEL = "kortix-session";
+/** Only a same-origin path may be a post-auth destination. */
+export declare function safeReturnTo(value: string | null | undefined): string;
+export declare function createKortixAuth(options: KortixAuthOptions): KortixAuth;
+//# sourceMappingURL=auth.d.ts.map

package/dist/node/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/node/auth.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uCAAuC,CAAC;AAG7E,uFAAuF;AACvF,MAAM,MAAM,WAAW,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE9F,MAAM,WAAW,iBAAiB;IAChC,8EAA8E;IAC9E,UAAU,EAAE,MAAM,CAAC;IACnB,8DAA8D;IAC9D,QAAQ,EAAE,MAAM,CAAC;IACjB,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,6EAA6E;IAC7E,WAAW,EAAE,MAAM,CAAC;IACpB,yFAAyF;IACzF,YAAY,EAAE,MAAM,CAAC;IACrB,kGAAkG;IAClG,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,qFAAqF;IACrF,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,mHAAmH;IACnH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6CAA6C;IAC7C,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,wBAAwB;IACxB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,CAAC;IACtC,wCAAwC;IACxC,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,0FAA0F;IAC1F,KAAK,EAAE,MAAM,CAAC;IACd,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,QAAQ,CAAC,EAAE,SAAS,CAAA;CAAE,GAC9C;IAAE,MAAM,CAAC,EAAE,SAAS,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CAAC;AAE/C,MAAM,WAAW,UAAU;IACzB,8EAA8E;IAC9E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,OAAO,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC7C,iFAAiF;IACjF,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;IACvD,2GAA2G;IAC3G,aAAa,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAAC;IAC9D,kGAAkG;IAClG,MAAM,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,sFAAsF;IACtF,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACrC,0DAA0D;IAC1D,UAAU,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IACtC;;;;OAIG;IACH,YAAY,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC;IACvF,0BAA0B;IAC1B,QAAQ,CAAC,GAAG,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC;CACnC;AAED,qBAAa,eAAgB,SAAQ,KAAK;aAEtB,IAAI,EAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,uBAAuB,GACvB,gBAAgB;gBALJ,IAAI,EAChB,iBAAiB,GACjB,iBAAiB,GACjB,gBAAgB,GAChB,uBAAuB,GACvB,gBAAgB,EACpB,OAAO,EAAE,MAAM;CAKlB;AAED,kFAAkF;AAClF,eAAO,MAAM,uBAAuB,mBAAmB,CAAC;AAyExD,8DAA8D;AAC9D,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAIrE;AAuBD,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,iBAAiB,GAAG,UAAU,CAkUvE"}