@logickernel/bridge 0.12.9 → 0.13.1

package/dist/index.cjs

@@ -1,7 +1,6 @@
 'use strict';
 
-var jose = require('jose');
-var hkdf = require('@panva/hkdf');
+var jwt = require('next-auth/jwt');
 
 // src/jwt.ts
 function getBaseCookieName() {
@@ -20,22 +19,9 @@ var COOKIE_NAMES = {
 function getAuthUrl() {
   return process.env.AUTH_URL || process.env.BASE_URL || "http://localhost:3000";
 }
-function getSalt(_isSecure) {
-  return getBaseCookieName();
-}
 function getCookieName(isSecure) {
   return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev;
 }
-async function deriveKey(secret, salt) {
-  const info = `NextAuth.js Generated Encryption Key${salt ? ` (${salt})` : ""}`;
-  return await hkdf.hkdf(
-    "sha256",
-    secret,
-    salt,
-    info,
-    32
-  );
-}
 function isTokenExpired(decoded) {
   if (!decoded.exp) return false;
   return decoded.exp * 1e3 < Date.now();
@@ -52,7 +38,7 @@ function mapToSession(decoded) {
     // Default 30 days
   };
 }
-async function decodeSessionToken(token, secret, isSecure = false) {
+async function decodeSessionToken(token, secret, _isSecure = false) {
   if (!token) {
     return { success: false, error: "missing_token" };
   }
@@ -60,29 +46,16 @@ async function decodeSessionToken(token, secret, isSecure = false) {
     return { success: false, error: "missing_secret" };
   }
   try {
-    const salt = getSalt(isSecure);
-    console.debug("[bridge] Key derivation params:", {
-      salt,
-      isSecure,
-      secretLength: secret.length,
-      tokenLength: token.length,
-      tokenPrefix: token.substring(0, 20)
+    const decoded = await jwt.decode({
+      token,
+      secret,
+      salt: ""
+      // Empty salt means session token in NextAuth
     });
-    const keyBytes = await deriveKey(secret, salt);
-    const key = await jose.importJWK(
-      {
-        kty: "oct",
-        k: jose.base64url.encode(keyBytes),
-        alg: "A256GCM"
-      },
-      "A256GCM"
-    );
-    const { payload } = await jose.jwtDecrypt(token, key);
-    if (!payload) {
+    if (!decoded) {
       return { success: false, error: "decode_error" };
     }
-    const decoded = payload;
-    if (isTokenExpired(decoded)) {
+    if (decoded.exp && typeof decoded.exp === "number" && decoded.exp * 1e3 < Date.now()) {
       return { success: false, error: "expired" };
     }
     const session = mapToSession(decoded);
@@ -211,7 +184,6 @@ exports.extractSessionCookie = extractSessionCookie;
 exports.fetchUserRoles = fetchUserRoles;
 exports.findMatchingProtectedRoute = findMatchingProtectedRoute;
 exports.getCookieName = getCookieName;
-exports.getSalt = getSalt;
 exports.hasAllRoles = hasAllRoles;
 exports.hasAnyRole = hasAnyRole;
 exports.hasRole = hasRole;

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/jwt.ts","../src/roles.ts","../src/routes.ts"],"names":["hkdf","importJWK","base64url","jwtDecrypt"],"mappings":";;;;;;AAcA,SAAS,iBAAA,GAA4B;AACnC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,yBAAA;AAE9C,EAAA,OAAO,WAAW,UAAA,CAAW,WAAW,IAAI,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA,GAAI,UAAA;AACrE;AAMO,IAAM,YAAA,GAAe;AAAA,EAC1B,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,WAAW,iBAAA,EAAkB;AAEnC,IAAA,OAAO,YAAY,QAAQ,CAAA,CAAA;AAAA,EAC7B,CAAA;AAAA,EACA,IAAI,GAAA,GAAc;AAChB,IAAA,OAAO,iBAAA,EAAkB;AAAA,EAC3B;AACF;AAMO,SAAS,UAAA,GAAqB;AACnC,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA,CAAQ,IAAI,QAAA,IAAY,uBAAA;AACzD;AAOO,SAAS,QAAQ,SAAA,EAA4B;AAGlD,EAAA,OAAO,iBAAA,EAAkB;AAC3B;AAKO,SAAS,cAAc,QAAA,EAA2B;AACvD,EAAA,OAAO,QAAA,GAAW,YAAA,CAAa,MAAA,GAAS,YAAA,CAAa,GAAA;AACvD;AASA,eAAe,SAAA,CAAU,QAAgB,IAAA,EAAmC;AAG1E,EAAA,MAAM,OAAO,CAAA,oCAAA,EAAuC,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,MAAM,EAAE,CAAA,CAAA;AAC5E,EAAA,OAAO,MAAMA,SAAA;AAAA,IACX,QAAA;AAAA,IACA,MAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAKO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,KAAA;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI;AACvC;AAKO,SAAS,aAAa,OAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,OAAA,CAAQ,GAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,IAAA,EAAO,QAAQ,IAAA,IAAmB,IAAA;AAAA,MAClC,KAAA,EAAQ,QAAQ,OAAA,IAAsB;AAAA,KACxC;AAAA,IACA,OAAA,EAAS,QAAQ,GAAA,GACb,IAAI,KAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAY,GACzC,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA;AAAY;AAAA,GAClE;AACF;AAwBA,eAAsB,kBAAA,CACpB,KAAA,EACA,MAAA,EACA,QAAA,GAAoB,KAAA,EACG;AACvB,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,EAClD;AAEA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAiB;AAAA,EACnD;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,MAAM,iCAAA,EAAmC;AAAA,MAC/C,IAAA;AAAA,MACA,QAAA;AAAA,MACA,cAAc,MAAA,CAAO,MAAA;AAAA,MACrB,aAAa,KAAA,CAAM,MAAA;AAAA,MACnB,WAAA,EAAa,KAAA,CAAM,SAAA,CAAU,CAAA,EAAG,EAAE;AAAA,KACnC,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,MAAA,EAAQ,IAAI,CAAA;AAG7C,IAAA,MAAM,MAAM,MAAMC,cAAA;AAAA,MAChB;AAAA,QACE,GAAA,EAAK,KAAA;AAAA,QACL,CAAA,EAAGC,cAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,QAC5B,GAAA,EAAK;AAAA,OACP;AAAA,MACA;AAAA,KACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,eAAA,CAAW,OAAO,GAAG,CAAA;AAE/C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,IACjD;AAEA,IAAA,MAAM,OAAA,GAAU,OAAA;AAEhB,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG;AAC3B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,SAAA,EAAU;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC1E,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,YAAY,CAAA;AACxD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,EACjD;AACF;AAWO,SAAS,qBAAqB,OAAA,EAEP;AAE5B,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,CAAA;AACpD,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAA,EAAO,UAAU,IAAA,EAAK;AAAA,EACrD;AAGA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA;AAC9C,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;;;ACzJA,eAAsB,eACpB,OAAA,EAC2B;AAC3B,EAAA,MAAM,EAAE,cAAA,EAAgB,YAAA,EAAc,OAAA,GAAU,OAAM,GAAI,OAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAa,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAC/D,EAAA,MAAM,YAAY,UAAA,EAAW;AAC7B,EAAA,MAAM,UAAA,GAAa,cAAc,QAAQ,CAAA;AAEzC,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,OAAA;AAAA,MACrB,CAAA,EAAG,SAAS,CAAA,6BAAA,EAAgC,cAAc,CAAA,MAAA,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SACvC;AAAA,QACA,KAAA,EAAO;AAAA;AACT,KACF;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO,CAAA,uBAAA,EAA0B,QAAA,CAAS,MAAM,CAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAO,GAAA,CAAI,CAAC,CAAA,KAA4B,CAAA,CAAE,QAAQ,CAAA,IAAK,EAAC;AAE3E,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAM;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KAClD;AAAA,EACF;AACF;AAKO,SAAS,UAAA,CAAW,WAAqB,aAAA,EAAkC;AAChF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,IAAA,CAAK,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC9D;AAKO,SAAS,WAAA,CAAY,WAAqB,aAAA,EAAkC;AACjF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,KAAA,CAAM,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/D;AAKO,SAAS,OAAA,CAAQ,WAAqB,IAAA,EAAuB;AAClE,EAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAChC;;;AC/GO,SAAS,eAAA,CAAgB,UAAkB,MAAA,EAA2B;AAC3E,EAAA,OAAO,OAAO,IAAA,CAAK,CAAC,UAAU,QAAA,CAAS,UAAA,CAAW,KAAK,CAAC,CAAA;AAC1D;AAKO,SAAS,0BAAA,CACd,UACA,eAAA,EACwD;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC5D,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAM;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAkBO,SAAS,UAAA,CACd,UACA,MAAA,EACY;AAEZ,EAAA,IAAI,OAAO,YAAA,IAAgB,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,EAC1B;AAGA,EAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,QAAA,EAAU,MAAA,CAAO,eAAe,CAAA;AACzE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,aAAA,EAAe,MAAM,aAAA,EAAc;AAAA,EACjE;AAGA,EAAA,OAAO,EAAE,MAAM,aAAA,EAAc;AAC/B;AAKO,SAAS,aACd,OAAA,EACqB;AACrB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAA,EAAiB,QAAQ,eAAA,IAAmB;AAAA,MAC1C,cAAc,EAAC;AAAA,MACf,QAAA,EAAU,CAAC,oBAAoB;AAAA,KACjC;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB;AAAC,GACzC;AACF;AAQO,SAAS,eAAe,WAAA,EAA2B;AACxD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,mBAAA,EAAqB,OAAO,CAAA;AAChD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,gBAAgB,WAAA,EAA2B;AACzD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,CAAA;AACjD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Kernel Bridge JWT\n * Framework-agnostic JWT decoding for NextAuth v4 tokens\n * Uses jose library (same as NextAuth v4) for JWT operations\n */\n\nimport { jwtDecrypt, importJWK, base64url } from \"jose\"\nimport { hkdf } from \"@panva/hkdf\"\nimport type { Session, SessionCookie, DecodeResult, DecodedToken } from \"./types\"\n\n/**\n * Get the base cookie name from AUTH_COOKIE env var or default to next-auth.session-token\n * Strips __Secure- prefix if present, as it will be added automatically for secure cookies\n */\nfunction getBaseCookieName(): string {\n  const cookieName = process.env.AUTH_COOKIE || \"next-auth.session-token\"\n  // Remove __Secure- prefix if present, as we'll add it back for secure cookies\n  return cookieName.startsWith(\"__Secure-\") ? cookieName.slice(10) : cookieName\n}\n\n/**\n * Cookie names used by NextAuth v4\n * Defaults to next-auth.session-token, can be overridden via AUTH_COOKIE env var\n */\nexport const COOKIE_NAMES = {\n  get secure(): string {\n    const baseName = getBaseCookieName()\n    // Secure cookies must start with __Secure- prefix\n    return `__Secure-${baseName}`\n  },\n  get dev(): string {\n    return getBaseCookieName()\n  },\n} as const\n\n/**\n * Get the AUTH_URL from environment variables\n * This is used internally for API calls to the kernel\n */\nexport function getAuthUrl(): string {\n  return process.env.AUTH_URL || process.env.BASE_URL || \"http://localhost:3000\"\n}\n\n/**\n * Get the appropriate salt for JWT decoding based on cookie type\n * NextAuth v4 uses the BASE cookie name (without __Secure- prefix) as salt\n * The __Secure- prefix is only for cookie security, not for key derivation\n */\nexport function getSalt(_isSecure: boolean): string {\n  // NextAuth v4 uses the base cookie name for key derivation, regardless of secure flag\n  // The __Secure- prefix is only applied to the cookie name, not the salt\n  return getBaseCookieName()\n}\n\n/**\n * Get the cookie name based on security mode\n */\nexport function getCookieName(isSecure: boolean): string {\n  return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev\n}\n\n/**\n * Derive encryption key from secret and salt (NextAuth v4 method)\n * NextAuth v4 uses HKDF-SHA256 to derive the key from secret + salt\n * This matches NextAuth v4's internal key derivation using @panva/hkdf\n * \n * NextAuth v4 appends the salt to the info string: \"NextAuth.js Generated Encryption Key (salt)\"\n */\nasync function deriveKey(secret: string, salt: string): Promise<Uint8Array> {\n  // NextAuth v4 uses HKDF-SHA256 with info string that includes the salt\n  // Format: \"NextAuth.js Generated Encryption Key (salt)\"\n  const info = `NextAuth.js Generated Encryption Key${salt ? ` (${salt})` : \"\"}`\n  return await hkdf(\n    \"sha256\",\n    secret,\n    salt,\n    info,\n    32\n  )\n}\n\n/**\n * Check if a token is expired\n */\nexport function isTokenExpired(decoded: DecodedToken): boolean {\n  if (!decoded.exp) return false\n  return decoded.exp * 1000 < Date.now()\n}\n\n/**\n * Map decoded JWT payload to Session structure\n */\nexport function mapToSession(decoded: DecodedToken): Session {\n  return {\n    user: {\n      id: decoded.sub as string,\n      email: decoded.email as string,\n      name: (decoded.name as string) || null,\n      image: (decoded.picture as string) || null,\n    },\n    expires: decoded.exp\n      ? new Date(decoded.exp * 1000).toISOString()\n      : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(), // Default 30 days\n  }\n}\n\n/**\n * Decode and validate a session token\n *\n * This is the core function - framework-agnostic JWT decoding.\n * The caller is responsible for extracting the token from their framework's\n * cookie/header mechanism.\n *\n * @param token - The JWT session token\n * @param secret - The AUTH_SECRET used to sign the token\n * @param isSecure - Whether the token came from a secure cookie\n * @returns DecodeResult with session data or error\n *\n * @example\n * ```typescript\n * const result = await decodeSessionToken(token, process.env.AUTH_SECRET, isSecure)\n * if (result.success) {\n *   console.log(result.session.user.email)\n * } else {\n *   console.error(result.error)\n * }\n * ```\n */\nexport async function decodeSessionToken(\n  token: string | undefined,\n  secret: string | undefined,\n  isSecure: boolean = false\n): Promise<DecodeResult> {\n  if (!token) {\n    return { success: false, error: \"missing_token\" }\n  }\n\n  if (!secret) {\n    return { success: false, error: \"missing_secret\" }\n  }\n\n  try {\n    const salt = getSalt(isSecure)\n    console.debug(\"[bridge] Key derivation params:\", {\n      salt,\n      isSecure,\n      secretLength: secret.length,\n      tokenLength: token.length,\n      tokenPrefix: token.substring(0, 20),\n    })\n    \n    const keyBytes = await deriveKey(secret, salt)\n    \n    // Create a JWK from the derived key bytes\n    const key = await importJWK(\n      {\n        kty: \"oct\",\n        k: base64url.encode(keyBytes),\n        alg: \"A256GCM\",\n      },\n      \"A256GCM\"\n    )\n    \n    // Decrypt the JWT using jose (NextAuth v4 uses encrypted JWTs with A256GCM)\n    const { payload } = await jwtDecrypt(token, key)\n\n    if (!payload) {\n      return { success: false, error: \"decode_error\" }\n    }\n\n    const decoded = payload as DecodedToken\n\n    if (isTokenExpired(decoded)) {\n      return { success: false, error: \"expired\" }\n    }\n\n    const session = mapToSession(decoded)\n    return {\n      success: true,\n      session,\n      decoded,\n    }\n  } catch (error) {\n    // Log the actual error for debugging\n    const errorMessage = error instanceof Error ? error.message : String(error)\n    console.error(\"[bridge] JWT decode error:\", errorMessage)\n    return { success: false, error: \"decode_error\" }\n  }\n}\n\n/**\n * Extract session cookie from a cookies object (generic interface)\n *\n * This works with any object that has a `get(name)` method returning\n * `{ value: string } | undefined`, like Next.js cookies() or similar.\n *\n * @param cookies - Object with get(name) method\n * @returns SessionCookie or undefined if no session cookie found\n */\nexport function extractSessionCookie(cookies: {\n  get(name: string): { value: string } | undefined\n}): SessionCookie | undefined {\n  // Try secure cookie first (production with HTTPS)\n  const secureCookie = cookies.get(COOKIE_NAMES.secure)\n  if (secureCookie?.value) {\n    return { value: secureCookie.value, isSecure: true }\n  }\n\n  // Fall back to non-secure cookie (development)\n  const devCookie = cookies.get(COOKIE_NAMES.dev)\n  if (devCookie?.value) {\n    return { value: devCookie.value, isSecure: false }\n  }\n\n  return undefined\n}\n","/**\n * Kernel Bridge Roles\n * Role checking and permission utilities\n */\n\nimport { getCookieName, getAuthUrl } from \"./jwt\"\n\n/**\n * Options for fetching user roles from the kernel\n */\nexport interface FetchRolesOptions {\n  /**\n   * Organization ID to fetch roles in\n   */\n  organizationId: string\n\n  /**\n   * Session token for authentication (user ID is determined from the token)\n   */\n  sessionToken: string\n\n  /**\n   * Whether using secure cookie\n   * Defaults to NODE_ENV === \"production\" if not provided\n   */\n  isSecure?: boolean\n\n  /**\n   * Custom fetch function (optional, for testing or SSR)\n   */\n  fetchFn?: typeof fetch\n}\n\n/**\n * Result of role fetching operation\n */\nexport type FetchRolesResult =\n  | { success: true; roles: string[] }\n  | { success: false; error: string }\n\n/**\n * Fetch user roles from the kernel API\n *\n * This is a framework-agnostic function that makes a fetch request\n * to the kernel's roles endpoint. Uses AUTH_URL environment variable internally.\n * The user ID is determined from the session token.\n *\n * @param options - Configuration for fetching roles\n * @returns Promise with roles array or error\n *\n * @example\n * ```typescript\n * const result = await fetchUserRoles({\n *   organizationId: \"org-123\",\n *   sessionToken: token,\n *   // isSecure defaults to NODE_ENV === \"production\"\n * })\n * if (result.success) {\n *   console.log(result.roles)\n * }\n * ```\n */\nexport async function fetchUserRoles(\n  options: FetchRolesOptions\n): Promise<FetchRolesResult> {\n  const { organizationId, sessionToken, fetchFn = fetch } = options\n  // Default isSecure to production mode\n  const isSecure = options.isSecure ?? (process.env.NODE_ENV === \"production\")\n  const kernelUrl = getAuthUrl()\n  const cookieName = getCookieName(isSecure)\n\n  try {\n    const response = await fetchFn(\n      `${kernelUrl}/core/api/user/organizations/${organizationId}/roles`,\n      {\n        headers: {\n          Cookie: `${cookieName}=${sessionToken}`,\n        },\n        cache: \"no-store\",\n      }\n    )\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: `Failed to fetch roles: ${response.status}`,\n      }\n    }\n\n    const data = await response.json()\n    const roles = data.roles?.map((r: { roleName: string }) => r.roleName) || []\n\n    return { success: true, roles }\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Unknown error\",\n    }\n  }\n}\n\n/**\n * Check if user has at least one of the required roles\n */\nexport function hasAnyRole(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true // No roles required = any authenticated user\n  return requiredRoles.some((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has all of the required roles\n */\nexport function hasAllRoles(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true\n  return requiredRoles.every((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has a specific role\n */\nexport function hasRole(userRoles: string[], role: string): boolean {\n  return userRoles.includes(role)\n}\n\n","/**\n * Kernel Bridge Routes\n * Route matching and protection utilities\n */\n\nimport { getAuthUrl } from \"./jwt\"\nimport type { RouteConfig, RouteMatch, MicroFrontendConfig } from \"./types\"\n\n/**\n * Check if a pathname matches any route in the list\n */\nexport function matchesAnyRoute(pathname: string, routes: string[]): boolean {\n  return routes.some((route) => pathname.startsWith(route))\n}\n\n/**\n * Find the first matching protected route for a pathname\n */\nexport function findMatchingProtectedRoute(\n  pathname: string,\n  protectedRoutes: RouteConfig\n): { route: string; requiredRoles: string[] } | undefined {\n  for (const [route, roles] of Object.entries(protectedRoutes)) {\n    if (pathname.startsWith(route)) {\n      return { route, requiredRoles: roles }\n    }\n  }\n  return undefined\n}\n\n/**\n * Match a pathname against route configuration\n *\n * @param pathname - The URL pathname to match\n * @param config - Micro-frontend configuration\n * @returns RouteMatch indicating the type of route\n *\n * @example\n * ```typescript\n * const match = matchRoute(\"/dashboard\", {\n *   publicRoutes: [\"/\", \"/api/health\"],\n *   protectedRoutes: { \"/dashboard\": [], \"/admin\": [\"organization.owner\"] },\n * })\n * // Returns: { type: \"protected\", requiredRoles: [] }\n * ```\n */\nexport function matchRoute(\n  pathname: string,\n  config: Pick<MicroFrontendConfig, \"publicRoutes\" | \"protectedRoutes\">\n): RouteMatch {\n  // Check public routes first (if specified)\n  if (config.publicRoutes && matchesAnyRoute(pathname, config.publicRoutes)) {\n    return { type: \"public\" }\n  }\n\n  // Check protected routes\n  const match = findMatchingProtectedRoute(pathname, config.protectedRoutes)\n  if (match) {\n    return { type: \"protected\", requiredRoles: match.requiredRoles }\n  }\n\n  // Not explicitly configured = unprotected\n  return { type: \"unprotected\" }\n}\n\n/**\n * Create a default configuration for a micro-frontend\n */\nexport function createConfig(\n  options: Partial<MicroFrontendConfig> & Pick<MicroFrontendConfig, \"basePath\">\n): MicroFrontendConfig {\n  return {\n    basePath: options.basePath,\n    protectedRoutes: options.protectedRoutes || {\n      \"/dashboard\": [],\n      \"/admin\": [\"organization.owner\"],\n    },\n    publicRoutes: options.publicRoutes || [],\n  }\n}\n\n/**\n * Build a sign-in redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-in\n */\nexport function buildSignInUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signin\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n/**\n * Build a sign-out redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-out\n */\nexport function buildSignOutUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signout\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n"]}
+{"version":3,"sources":["../src/jwt.ts","../src/roles.ts","../src/routes.ts"],"names":["nextAuthDecode"],"mappings":";;;;;AAaA,SAAS,iBAAA,GAA4B;AACnC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,yBAAA;AAE9C,EAAA,OAAO,WAAW,UAAA,CAAW,WAAW,IAAI,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA,GAAI,UAAA;AACrE;AAMO,IAAM,YAAA,GAAe;AAAA,EAC1B,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,WAAW,iBAAA,EAAkB;AAEnC,IAAA,OAAO,YAAY,QAAQ,CAAA,CAAA;AAAA,EAC7B,CAAA;AAAA,EACA,IAAI,GAAA,GAAc;AAChB,IAAA,OAAO,iBAAA,EAAkB;AAAA,EAC3B;AACF;AAMO,SAAS,UAAA,GAAqB;AACnC,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA,CAAQ,IAAI,QAAA,IAAY,uBAAA;AACzD;AAKO,SAAS,cAAc,QAAA,EAA2B;AACvD,EAAA,OAAO,QAAA,GAAW,YAAA,CAAa,MAAA,GAAS,YAAA,CAAa,GAAA;AACvD;AAKO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,KAAA;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI;AACvC;AAKO,SAAS,aAAa,OAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,OAAA,CAAQ,GAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,IAAA,EAAO,QAAQ,IAAA,IAAmB,IAAA;AAAA,MAClC,KAAA,EAAQ,QAAQ,OAAA,IAAsB;AAAA,KACxC;AAAA,IACA,OAAA,EAAS,QAAQ,GAAA,GACb,IAAI,KAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAY,GACzC,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA;AAAY;AAAA,GAClE;AACF;AAwBA,eAAsB,kBAAA,CACpB,KAAA,EACA,MAAA,EACA,SAAA,GAAqB,KAAA,EACE;AACvB,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,EAClD;AAEA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAiB;AAAA,EACnD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,OAAA,GAAU,MAAMA,UAAA,CAAe;AAAA,MACnC,KAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,EAAM;AAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,IACjD;AAGA,IAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI,EAAG;AACrF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,SAAA,EAAU;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,aAAa,OAAuB,CAAA;AACpD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC1E,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,YAAY,CAAA;AACxD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,EACjD;AACF;AAWO,SAAS,qBAAqB,OAAA,EAEP;AAE5B,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,CAAA;AACpD,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAA,EAAO,UAAU,IAAA,EAAK;AAAA,EACrD;AAGA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA;AAC9C,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;;;ACxGA,eAAsB,eACpB,OAAA,EAC2B;AAC3B,EAAA,MAAM,EAAE,cAAA,EAAgB,YAAA,EAAc,OAAA,GAAU,OAAM,GAAI,OAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAa,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAC/D,EAAA,MAAM,YAAY,UAAA,EAAW;AAC7B,EAAA,MAAM,UAAA,GAAa,cAAc,QAAQ,CAAA;AAEzC,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,OAAA;AAAA,MACrB,CAAA,EAAG,SAAS,CAAA,6BAAA,EAAgC,cAAc,CAAA,MAAA,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SACvC;AAAA,QACA,KAAA,EAAO;AAAA;AACT,KACF;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO,CAAA,uBAAA,EAA0B,QAAA,CAAS,MAAM,CAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAO,GAAA,CAAI,CAAC,CAAA,KAA4B,CAAA,CAAE,QAAQ,CAAA,IAAK,EAAC;AAE3E,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAM;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KAClD;AAAA,EACF;AACF;AAKO,SAAS,UAAA,CAAW,WAAqB,aAAA,EAAkC;AAChF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,IAAA,CAAK,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC9D;AAKO,SAAS,WAAA,CAAY,WAAqB,aAAA,EAAkC;AACjF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,KAAA,CAAM,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/D;AAKO,SAAS,OAAA,CAAQ,WAAqB,IAAA,EAAuB;AAClE,EAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAChC;;;AC/GO,SAAS,eAAA,CAAgB,UAAkB,MAAA,EAA2B;AAC3E,EAAA,OAAO,OAAO,IAAA,CAAK,CAAC,UAAU,QAAA,CAAS,UAAA,CAAW,KAAK,CAAC,CAAA;AAC1D;AAKO,SAAS,0BAAA,CACd,UACA,eAAA,EACwD;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC5D,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAM;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAkBO,SAAS,UAAA,CACd,UACA,MAAA,EACY;AAEZ,EAAA,IAAI,OAAO,YAAA,IAAgB,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,EAC1B;AAGA,EAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,QAAA,EAAU,MAAA,CAAO,eAAe,CAAA;AACzE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,aAAA,EAAe,MAAM,aAAA,EAAc;AAAA,EACjE;AAGA,EAAA,OAAO,EAAE,MAAM,aAAA,EAAc;AAC/B;AAKO,SAAS,aACd,OAAA,EACqB;AACrB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAA,EAAiB,QAAQ,eAAA,IAAmB;AAAA,MAC1C,cAAc,EAAC;AAAA,MACf,QAAA,EAAU,CAAC,oBAAoB;AAAA,KACjC;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB;AAAC,GACzC;AACF;AAQO,SAAS,eAAe,WAAA,EAA2B;AACxD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,mBAAA,EAAqB,OAAO,CAAA;AAChD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,gBAAgB,WAAA,EAA2B;AACzD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,CAAA;AACjD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT","file":"index.cjs","sourcesContent":["/**\n * Kernel Bridge JWT\n * Framework-agnostic JWT decoding for NextAuth v4 tokens\n * Uses NextAuth's internal decode function for guaranteed compatibility\n */\n\nimport { decode as nextAuthDecode } from \"next-auth/jwt\"\nimport type { Session, SessionCookie, DecodeResult, DecodedToken } from \"./types\"\n\n/**\n * Get the base cookie name from AUTH_COOKIE env var or default to next-auth.session-token\n * Strips __Secure- prefix if present, as it will be added automatically for secure cookies\n */\nfunction getBaseCookieName(): string {\n  const cookieName = process.env.AUTH_COOKIE || \"next-auth.session-token\"\n  // Remove __Secure- prefix if present, as we'll add it back for secure cookies\n  return cookieName.startsWith(\"__Secure-\") ? cookieName.slice(10) : cookieName\n}\n\n/**\n * Cookie names used by NextAuth v4\n * Defaults to next-auth.session-token, can be overridden via AUTH_COOKIE env var\n */\nexport const COOKIE_NAMES = {\n  get secure(): string {\n    const baseName = getBaseCookieName()\n    // Secure cookies must start with __Secure- prefix\n    return `__Secure-${baseName}`\n  },\n  get dev(): string {\n    return getBaseCookieName()\n  },\n} as const\n\n/**\n * Get the AUTH_URL from environment variables\n * This is used internally for API calls to the kernel\n */\nexport function getAuthUrl(): string {\n  return process.env.AUTH_URL || process.env.BASE_URL || \"http://localhost:3000\"\n}\n\n/**\n * Get the cookie name based on security mode\n */\nexport function getCookieName(isSecure: boolean): string {\n  return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev\n}\n\n/**\n * Check if a token is expired\n */\nexport function isTokenExpired(decoded: DecodedToken): boolean {\n  if (!decoded.exp) return false\n  return decoded.exp * 1000 < Date.now()\n}\n\n/**\n * Map decoded JWT payload to Session structure\n */\nexport function mapToSession(decoded: DecodedToken): Session {\n  return {\n    user: {\n      id: decoded.sub as string,\n      email: decoded.email as string,\n      name: (decoded.name as string) || null,\n      image: (decoded.picture as string) || null,\n    },\n    expires: decoded.exp\n      ? new Date(decoded.exp * 1000).toISOString()\n      : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(), // Default 30 days\n  }\n}\n\n/**\n * Decode and validate a session token\n *\n * This is the core function - framework-agnostic JWT decoding.\n * The caller is responsible for extracting the token from their framework's\n * cookie/header mechanism.\n *\n * @param token - The JWT session token\n * @param secret - The AUTH_SECRET used to sign the token\n * @param isSecure - Whether the token came from a secure cookie\n * @returns DecodeResult with session data or error\n *\n * @example\n * ```typescript\n * const result = await decodeSessionToken(token, process.env.AUTH_SECRET, isSecure)\n * if (result.success) {\n *   console.log(result.session.user.email)\n * } else {\n *   console.error(result.error)\n * }\n * ```\n */\nexport async function decodeSessionToken(\n  token: string | undefined,\n  secret: string | undefined,\n  _isSecure: boolean = false\n): Promise<DecodeResult> {\n  if (!token) {\n    return { success: false, error: \"missing_token\" }\n  }\n\n  if (!secret) {\n    return { success: false, error: \"missing_secret\" }\n  }\n\n  try {\n    // Use NextAuth's decode function directly for session tokens\n    // For session tokens, NextAuth uses an empty salt (\"\")\n    const decoded = await nextAuthDecode({\n      token,\n      secret,\n      salt: \"\", // Empty salt means session token in NextAuth\n    })\n\n    if (!decoded) {\n      return { success: false, error: \"decode_error\" }\n    }\n\n    // Check if token is expired\n    if (decoded.exp && typeof decoded.exp === \"number\" && decoded.exp * 1000 < Date.now()) {\n      return { success: false, error: \"expired\" }\n    }\n\n    const session = mapToSession(decoded as DecodedToken)\n    return {\n      success: true,\n      session,\n      decoded: decoded as DecodedToken,\n    }\n  } catch (error) {\n    // Log the actual error for debugging\n    const errorMessage = error instanceof Error ? error.message : String(error)\n    console.error(\"[bridge] JWT decode error:\", errorMessage)\n    return { success: false, error: \"decode_error\" }\n  }\n}\n\n/**\n * Extract session cookie from a cookies object (generic interface)\n *\n * This works with any object that has a `get(name)` method returning\n * `{ value: string } | undefined`, like Next.js cookies() or similar.\n *\n * @param cookies - Object with get(name) method\n * @returns SessionCookie or undefined if no session cookie found\n */\nexport function extractSessionCookie(cookies: {\n  get(name: string): { value: string } | undefined\n}): SessionCookie | undefined {\n  // Try secure cookie first (production with HTTPS)\n  const secureCookie = cookies.get(COOKIE_NAMES.secure)\n  if (secureCookie?.value) {\n    return { value: secureCookie.value, isSecure: true }\n  }\n\n  // Fall back to non-secure cookie (development)\n  const devCookie = cookies.get(COOKIE_NAMES.dev)\n  if (devCookie?.value) {\n    return { value: devCookie.value, isSecure: false }\n  }\n\n  return undefined\n}\n","/**\n * Kernel Bridge Roles\n * Role checking and permission utilities\n */\n\nimport { getCookieName, getAuthUrl } from \"./jwt\"\n\n/**\n * Options for fetching user roles from the kernel\n */\nexport interface FetchRolesOptions {\n  /**\n   * Organization ID to fetch roles in\n   */\n  organizationId: string\n\n  /**\n   * Session token for authentication (user ID is determined from the token)\n   */\n  sessionToken: string\n\n  /**\n   * Whether using secure cookie\n   * Defaults to NODE_ENV === \"production\" if not provided\n   */\n  isSecure?: boolean\n\n  /**\n   * Custom fetch function (optional, for testing or SSR)\n   */\n  fetchFn?: typeof fetch\n}\n\n/**\n * Result of role fetching operation\n */\nexport type FetchRolesResult =\n  | { success: true; roles: string[] }\n  | { success: false; error: string }\n\n/**\n * Fetch user roles from the kernel API\n *\n * This is a framework-agnostic function that makes a fetch request\n * to the kernel's roles endpoint. Uses AUTH_URL environment variable internally.\n * The user ID is determined from the session token.\n *\n * @param options - Configuration for fetching roles\n * @returns Promise with roles array or error\n *\n * @example\n * ```typescript\n * const result = await fetchUserRoles({\n *   organizationId: \"org-123\",\n *   sessionToken: token,\n *   // isSecure defaults to NODE_ENV === \"production\"\n * })\n * if (result.success) {\n *   console.log(result.roles)\n * }\n * ```\n */\nexport async function fetchUserRoles(\n  options: FetchRolesOptions\n): Promise<FetchRolesResult> {\n  const { organizationId, sessionToken, fetchFn = fetch } = options\n  // Default isSecure to production mode\n  const isSecure = options.isSecure ?? (process.env.NODE_ENV === \"production\")\n  const kernelUrl = getAuthUrl()\n  const cookieName = getCookieName(isSecure)\n\n  try {\n    const response = await fetchFn(\n      `${kernelUrl}/core/api/user/organizations/${organizationId}/roles`,\n      {\n        headers: {\n          Cookie: `${cookieName}=${sessionToken}`,\n        },\n        cache: \"no-store\",\n      }\n    )\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: `Failed to fetch roles: ${response.status}`,\n      }\n    }\n\n    const data = await response.json()\n    const roles = data.roles?.map((r: { roleName: string }) => r.roleName) || []\n\n    return { success: true, roles }\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Unknown error\",\n    }\n  }\n}\n\n/**\n * Check if user has at least one of the required roles\n */\nexport function hasAnyRole(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true // No roles required = any authenticated user\n  return requiredRoles.some((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has all of the required roles\n */\nexport function hasAllRoles(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true\n  return requiredRoles.every((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has a specific role\n */\nexport function hasRole(userRoles: string[], role: string): boolean {\n  return userRoles.includes(role)\n}\n\n","/**\n * Kernel Bridge Routes\n * Route matching and protection utilities\n */\n\nimport { getAuthUrl } from \"./jwt\"\nimport type { RouteConfig, RouteMatch, MicroFrontendConfig } from \"./types\"\n\n/**\n * Check if a pathname matches any route in the list\n */\nexport function matchesAnyRoute(pathname: string, routes: string[]): boolean {\n  return routes.some((route) => pathname.startsWith(route))\n}\n\n/**\n * Find the first matching protected route for a pathname\n */\nexport function findMatchingProtectedRoute(\n  pathname: string,\n  protectedRoutes: RouteConfig\n): { route: string; requiredRoles: string[] } | undefined {\n  for (const [route, roles] of Object.entries(protectedRoutes)) {\n    if (pathname.startsWith(route)) {\n      return { route, requiredRoles: roles }\n    }\n  }\n  return undefined\n}\n\n/**\n * Match a pathname against route configuration\n *\n * @param pathname - The URL pathname to match\n * @param config - Micro-frontend configuration\n * @returns RouteMatch indicating the type of route\n *\n * @example\n * ```typescript\n * const match = matchRoute(\"/dashboard\", {\n *   publicRoutes: [\"/\", \"/api/health\"],\n *   protectedRoutes: { \"/dashboard\": [], \"/admin\": [\"organization.owner\"] },\n * })\n * // Returns: { type: \"protected\", requiredRoles: [] }\n * ```\n */\nexport function matchRoute(\n  pathname: string,\n  config: Pick<MicroFrontendConfig, \"publicRoutes\" | \"protectedRoutes\">\n): RouteMatch {\n  // Check public routes first (if specified)\n  if (config.publicRoutes && matchesAnyRoute(pathname, config.publicRoutes)) {\n    return { type: \"public\" }\n  }\n\n  // Check protected routes\n  const match = findMatchingProtectedRoute(pathname, config.protectedRoutes)\n  if (match) {\n    return { type: \"protected\", requiredRoles: match.requiredRoles }\n  }\n\n  // Not explicitly configured = unprotected\n  return { type: \"unprotected\" }\n}\n\n/**\n * Create a default configuration for a micro-frontend\n */\nexport function createConfig(\n  options: Partial<MicroFrontendConfig> & Pick<MicroFrontendConfig, \"basePath\">\n): MicroFrontendConfig {\n  return {\n    basePath: options.basePath,\n    protectedRoutes: options.protectedRoutes || {\n      \"/dashboard\": [],\n      \"/admin\": [\"organization.owner\"],\n    },\n    publicRoutes: options.publicRoutes || [],\n  }\n}\n\n/**\n * Build a sign-in redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-in\n */\nexport function buildSignInUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signin\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n/**\n * Build a sign-out redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-out\n */\nexport function buildSignOutUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signout\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n"]}

package/dist/index.d.cts

@@ -4,7 +4,7 @@ export { d as SessionUser } from './types-YvOY9KNP.cjs';
 /**
  * Kernel Bridge JWT
  * Framework-agnostic JWT decoding for NextAuth v4 tokens
- * Uses jose library (same as NextAuth v4) for JWT operations
+ * Uses NextAuth's internal decode function for guaranteed compatibility
  */
 
 /**
@@ -15,12 +15,6 @@ declare const COOKIE_NAMES: {
     readonly secure: string;
     readonly dev: string;
 };
-/**
- * Get the appropriate salt for JWT decoding based on cookie type
- * NextAuth v4 uses the BASE cookie name (without __Secure- prefix) as salt
- * The __Secure- prefix is only for cookie security, not for key derivation
- */
-declare function getSalt(_isSecure: boolean): string;
 /**
  * Get the cookie name based on security mode
  */
@@ -55,7 +49,7 @@ declare function mapToSession(decoded: DecodedToken): Session;
  * }
  * ```
  */
-declare function decodeSessionToken(token: string | undefined, secret: string | undefined, isSecure?: boolean): Promise<DecodeResult>;
+declare function decodeSessionToken(token: string | undefined, secret: string | undefined, _isSecure?: boolean): Promise<DecodeResult>;
 /**
  * Extract session cookie from a cookies object (generic interface)
  *
@@ -195,4 +189,4 @@ declare function buildSignInUrl(callbackUrl?: string): URL;
  */
 declare function buildSignOutUrl(callbackUrl?: string): URL;
 
-export { COOKIE_NAMES, DecodeResult, DecodedToken, type FetchRolesOptions, type FetchRolesResult, MicroFrontendConfig, RouteConfig, RouteMatch, Session, SessionCookie, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, getSalt, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };
+export { COOKIE_NAMES, DecodeResult, DecodedToken, type FetchRolesOptions, type FetchRolesResult, MicroFrontendConfig, RouteConfig, RouteMatch, Session, SessionCookie, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };

package/dist/index.d.ts

@@ -4,7 +4,7 @@ export { d as SessionUser } from './types-YvOY9KNP.js';
 /**
  * Kernel Bridge JWT
  * Framework-agnostic JWT decoding for NextAuth v4 tokens
- * Uses jose library (same as NextAuth v4) for JWT operations
+ * Uses NextAuth's internal decode function for guaranteed compatibility
  */
 
 /**
@@ -15,12 +15,6 @@ declare const COOKIE_NAMES: {
     readonly secure: string;
     readonly dev: string;
 };
-/**
- * Get the appropriate salt for JWT decoding based on cookie type
- * NextAuth v4 uses the BASE cookie name (without __Secure- prefix) as salt
- * The __Secure- prefix is only for cookie security, not for key derivation
- */
-declare function getSalt(_isSecure: boolean): string;
 /**
  * Get the cookie name based on security mode
  */
@@ -55,7 +49,7 @@ declare function mapToSession(decoded: DecodedToken): Session;
  * }
  * ```
  */
-declare function decodeSessionToken(token: string | undefined, secret: string | undefined, isSecure?: boolean): Promise<DecodeResult>;
+declare function decodeSessionToken(token: string | undefined, secret: string | undefined, _isSecure?: boolean): Promise<DecodeResult>;
 /**
  * Extract session cookie from a cookies object (generic interface)
  *
@@ -195,4 +189,4 @@ declare function buildSignInUrl(callbackUrl?: string): URL;
  */
 declare function buildSignOutUrl(callbackUrl?: string): URL;
 
-export { COOKIE_NAMES, DecodeResult, DecodedToken, type FetchRolesOptions, type FetchRolesResult, MicroFrontendConfig, RouteConfig, RouteMatch, Session, SessionCookie, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, getSalt, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };
+export { COOKIE_NAMES, DecodeResult, DecodedToken, type FetchRolesOptions, type FetchRolesResult, MicroFrontendConfig, RouteConfig, RouteMatch, Session, SessionCookie, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };

package/dist/index.js

@@ -1,5 +1,4 @@
-import { importJWK, base64url, jwtDecrypt } from 'jose';
-import { hkdf } from '@panva/hkdf';
+import { decode } from 'next-auth/jwt';
 
 // src/jwt.ts
 function getBaseCookieName() {
@@ -18,22 +17,9 @@ var COOKIE_NAMES = {
 function getAuthUrl() {
   return process.env.AUTH_URL || process.env.BASE_URL || "http://localhost:3000";
 }
-function getSalt(_isSecure) {
-  return getBaseCookieName();
-}
 function getCookieName(isSecure) {
   return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev;
 }
-async function deriveKey(secret, salt) {
-  const info = `NextAuth.js Generated Encryption Key${salt ? ` (${salt})` : ""}`;
-  return await hkdf(
-    "sha256",
-    secret,
-    salt,
-    info,
-    32
-  );
-}
 function isTokenExpired(decoded) {
   if (!decoded.exp) return false;
   return decoded.exp * 1e3 < Date.now();
@@ -50,7 +36,7 @@ function mapToSession(decoded) {
     // Default 30 days
   };
 }
-async function decodeSessionToken(token, secret, isSecure = false) {
+async function decodeSessionToken(token, secret, _isSecure = false) {
   if (!token) {
     return { success: false, error: "missing_token" };
   }
@@ -58,29 +44,16 @@ async function decodeSessionToken(token, secret, isSecure = false) {
     return { success: false, error: "missing_secret" };
   }
   try {
-    const salt = getSalt(isSecure);
-    console.debug("[bridge] Key derivation params:", {
-      salt,
-      isSecure,
-      secretLength: secret.length,
-      tokenLength: token.length,
-      tokenPrefix: token.substring(0, 20)
+    const decoded = await decode({
+      token,
+      secret,
+      salt: ""
+      // Empty salt means session token in NextAuth
     });
-    const keyBytes = await deriveKey(secret, salt);
-    const key = await importJWK(
-      {
-        kty: "oct",
-        k: base64url.encode(keyBytes),
-        alg: "A256GCM"
-      },
-      "A256GCM"
-    );
-    const { payload } = await jwtDecrypt(token, key);
-    if (!payload) {
+    if (!decoded) {
       return { success: false, error: "decode_error" };
     }
-    const decoded = payload;
-    if (isTokenExpired(decoded)) {
+    if (decoded.exp && typeof decoded.exp === "number" && decoded.exp * 1e3 < Date.now()) {
       return { success: false, error: "expired" };
     }
     const session = mapToSession(decoded);
@@ -200,6 +173,6 @@ function buildSignOutUrl(callbackUrl) {
   return url;
 }
 
-export { COOKIE_NAMES, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, getSalt, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };
+export { COOKIE_NAMES, buildSignInUrl, buildSignOutUrl, createConfig, decodeSessionToken, extractSessionCookie, fetchUserRoles, findMatchingProtectedRoute, getCookieName, hasAllRoles, hasAnyRole, hasRole, isTokenExpired, mapToSession, matchRoute, matchesAnyRoute };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/jwt.ts","../src/roles.ts","../src/routes.ts"],"names":[],"mappings":";;;;AAcA,SAAS,iBAAA,GAA4B;AACnC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,yBAAA;AAE9C,EAAA,OAAO,WAAW,UAAA,CAAW,WAAW,IAAI,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA,GAAI,UAAA;AACrE;AAMO,IAAM,YAAA,GAAe;AAAA,EAC1B,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,WAAW,iBAAA,EAAkB;AAEnC,IAAA,OAAO,YAAY,QAAQ,CAAA,CAAA;AAAA,EAC7B,CAAA;AAAA,EACA,IAAI,GAAA,GAAc;AAChB,IAAA,OAAO,iBAAA,EAAkB;AAAA,EAC3B;AACF;AAMO,SAAS,UAAA,GAAqB;AACnC,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA,CAAQ,IAAI,QAAA,IAAY,uBAAA;AACzD;AAOO,SAAS,QAAQ,SAAA,EAA4B;AAGlD,EAAA,OAAO,iBAAA,EAAkB;AAC3B;AAKO,SAAS,cAAc,QAAA,EAA2B;AACvD,EAAA,OAAO,QAAA,GAAW,YAAA,CAAa,MAAA,GAAS,YAAA,CAAa,GAAA;AACvD;AASA,eAAe,SAAA,CAAU,QAAgB,IAAA,EAAmC;AAG1E,EAAA,MAAM,OAAO,CAAA,oCAAA,EAAuC,IAAA,GAAO,CAAA,EAAA,EAAK,IAAI,MAAM,EAAE,CAAA,CAAA;AAC5E,EAAA,OAAO,MAAM,IAAA;AAAA,IACX,QAAA;AAAA,IACA,MAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACF;AACF;AAKO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,KAAA;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI;AACvC;AAKO,SAAS,aAAa,OAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,OAAA,CAAQ,GAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,IAAA,EAAO,QAAQ,IAAA,IAAmB,IAAA;AAAA,MAClC,KAAA,EAAQ,QAAQ,OAAA,IAAsB;AAAA,KACxC;AAAA,IACA,OAAA,EAAS,QAAQ,GAAA,GACb,IAAI,KAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAY,GACzC,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA;AAAY;AAAA,GAClE;AACF;AAwBA,eAAsB,kBAAA,CACpB,KAAA,EACA,MAAA,EACA,QAAA,GAAoB,KAAA,EACG;AACvB,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,EAClD;AAEA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAiB;AAAA,EACnD;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,QAAQ,QAAQ,CAAA;AAC7B,IAAA,OAAA,CAAQ,MAAM,iCAAA,EAAmC;AAAA,MAC/C,IAAA;AAAA,MACA,QAAA;AAAA,MACA,cAAc,MAAA,CAAO,MAAA;AAAA,MACrB,aAAa,KAAA,CAAM,MAAA;AAAA,MACnB,WAAA,EAAa,KAAA,CAAM,SAAA,CAAU,CAAA,EAAG,EAAE;AAAA,KACnC,CAAA;AAED,IAAA,MAAM,QAAA,GAAW,MAAM,SAAA,CAAU,MAAA,EAAQ,IAAI,CAAA;AAG7C,IAAA,MAAM,MAAM,MAAM,SAAA;AAAA,MAChB;AAAA,QACE,GAAA,EAAK,KAAA;AAAA,QACL,CAAA,EAAG,SAAA,CAAU,MAAA,CAAO,QAAQ,CAAA;AAAA,QAC5B,GAAA,EAAK;AAAA,OACP;AAAA,MACA;AAAA,KACF;AAGA,IAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,UAAA,CAAW,OAAO,GAAG,CAAA;AAE/C,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,IACjD;AAEA,IAAA,MAAM,OAAA,GAAU,OAAA;AAEhB,IAAA,IAAI,cAAA,CAAe,OAAO,CAAA,EAAG;AAC3B,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,SAAA,EAAU;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,aAAa,OAAO,CAAA;AACpC,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC1E,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,YAAY,CAAA;AACxD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,EACjD;AACF;AAWO,SAAS,qBAAqB,OAAA,EAEP;AAE5B,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,CAAA;AACpD,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAA,EAAO,UAAU,IAAA,EAAK;AAAA,EACrD;AAGA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA;AAC9C,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;;;ACzJA,eAAsB,eACpB,OAAA,EAC2B;AAC3B,EAAA,MAAM,EAAE,cAAA,EAAgB,YAAA,EAAc,OAAA,GAAU,OAAM,GAAI,OAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAa,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAC/D,EAAA,MAAM,YAAY,UAAA,EAAW;AAC7B,EAAA,MAAM,UAAA,GAAa,cAAc,QAAQ,CAAA;AAEzC,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,OAAA;AAAA,MACrB,CAAA,EAAG,SAAS,CAAA,6BAAA,EAAgC,cAAc,CAAA,MAAA,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SACvC;AAAA,QACA,KAAA,EAAO;AAAA;AACT,KACF;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO,CAAA,uBAAA,EAA0B,QAAA,CAAS,MAAM,CAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAO,GAAA,CAAI,CAAC,CAAA,KAA4B,CAAA,CAAE,QAAQ,CAAA,IAAK,EAAC;AAE3E,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAM;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KAClD;AAAA,EACF;AACF;AAKO,SAAS,UAAA,CAAW,WAAqB,aAAA,EAAkC;AAChF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,IAAA,CAAK,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC9D;AAKO,SAAS,WAAA,CAAY,WAAqB,aAAA,EAAkC;AACjF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,KAAA,CAAM,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/D;AAKO,SAAS,OAAA,CAAQ,WAAqB,IAAA,EAAuB;AAClE,EAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAChC;;;AC/GO,SAAS,eAAA,CAAgB,UAAkB,MAAA,EAA2B;AAC3E,EAAA,OAAO,OAAO,IAAA,CAAK,CAAC,UAAU,QAAA,CAAS,UAAA,CAAW,KAAK,CAAC,CAAA;AAC1D;AAKO,SAAS,0BAAA,CACd,UACA,eAAA,EACwD;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC5D,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAM;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAkBO,SAAS,UAAA,CACd,UACA,MAAA,EACY;AAEZ,EAAA,IAAI,OAAO,YAAA,IAAgB,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,EAC1B;AAGA,EAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,QAAA,EAAU,MAAA,CAAO,eAAe,CAAA;AACzE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,aAAA,EAAe,MAAM,aAAA,EAAc;AAAA,EACjE;AAGA,EAAA,OAAO,EAAE,MAAM,aAAA,EAAc;AAC/B;AAKO,SAAS,aACd,OAAA,EACqB;AACrB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAA,EAAiB,QAAQ,eAAA,IAAmB;AAAA,MAC1C,cAAc,EAAC;AAAA,MACf,QAAA,EAAU,CAAC,oBAAoB;AAAA,KACjC;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB;AAAC,GACzC;AACF;AAQO,SAAS,eAAe,WAAA,EAA2B;AACxD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,mBAAA,EAAqB,OAAO,CAAA;AAChD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,gBAAgB,WAAA,EAA2B;AACzD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,CAAA;AACjD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT","file":"index.js","sourcesContent":["/**\n * Kernel Bridge JWT\n * Framework-agnostic JWT decoding for NextAuth v4 tokens\n * Uses jose library (same as NextAuth v4) for JWT operations\n */\n\nimport { jwtDecrypt, importJWK, base64url } from \"jose\"\nimport { hkdf } from \"@panva/hkdf\"\nimport type { Session, SessionCookie, DecodeResult, DecodedToken } from \"./types\"\n\n/**\n * Get the base cookie name from AUTH_COOKIE env var or default to next-auth.session-token\n * Strips __Secure- prefix if present, as it will be added automatically for secure cookies\n */\nfunction getBaseCookieName(): string {\n  const cookieName = process.env.AUTH_COOKIE || \"next-auth.session-token\"\n  // Remove __Secure- prefix if present, as we'll add it back for secure cookies\n  return cookieName.startsWith(\"__Secure-\") ? cookieName.slice(10) : cookieName\n}\n\n/**\n * Cookie names used by NextAuth v4\n * Defaults to next-auth.session-token, can be overridden via AUTH_COOKIE env var\n */\nexport const COOKIE_NAMES = {\n  get secure(): string {\n    const baseName = getBaseCookieName()\n    // Secure cookies must start with __Secure- prefix\n    return `__Secure-${baseName}`\n  },\n  get dev(): string {\n    return getBaseCookieName()\n  },\n} as const\n\n/**\n * Get the AUTH_URL from environment variables\n * This is used internally for API calls to the kernel\n */\nexport function getAuthUrl(): string {\n  return process.env.AUTH_URL || process.env.BASE_URL || \"http://localhost:3000\"\n}\n\n/**\n * Get the appropriate salt for JWT decoding based on cookie type\n * NextAuth v4 uses the BASE cookie name (without __Secure- prefix) as salt\n * The __Secure- prefix is only for cookie security, not for key derivation\n */\nexport function getSalt(_isSecure: boolean): string {\n  // NextAuth v4 uses the base cookie name for key derivation, regardless of secure flag\n  // The __Secure- prefix is only applied to the cookie name, not the salt\n  return getBaseCookieName()\n}\n\n/**\n * Get the cookie name based on security mode\n */\nexport function getCookieName(isSecure: boolean): string {\n  return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev\n}\n\n/**\n * Derive encryption key from secret and salt (NextAuth v4 method)\n * NextAuth v4 uses HKDF-SHA256 to derive the key from secret + salt\n * This matches NextAuth v4's internal key derivation using @panva/hkdf\n * \n * NextAuth v4 appends the salt to the info string: \"NextAuth.js Generated Encryption Key (salt)\"\n */\nasync function deriveKey(secret: string, salt: string): Promise<Uint8Array> {\n  // NextAuth v4 uses HKDF-SHA256 with info string that includes the salt\n  // Format: \"NextAuth.js Generated Encryption Key (salt)\"\n  const info = `NextAuth.js Generated Encryption Key${salt ? ` (${salt})` : \"\"}`\n  return await hkdf(\n    \"sha256\",\n    secret,\n    salt,\n    info,\n    32\n  )\n}\n\n/**\n * Check if a token is expired\n */\nexport function isTokenExpired(decoded: DecodedToken): boolean {\n  if (!decoded.exp) return false\n  return decoded.exp * 1000 < Date.now()\n}\n\n/**\n * Map decoded JWT payload to Session structure\n */\nexport function mapToSession(decoded: DecodedToken): Session {\n  return {\n    user: {\n      id: decoded.sub as string,\n      email: decoded.email as string,\n      name: (decoded.name as string) || null,\n      image: (decoded.picture as string) || null,\n    },\n    expires: decoded.exp\n      ? new Date(decoded.exp * 1000).toISOString()\n      : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(), // Default 30 days\n  }\n}\n\n/**\n * Decode and validate a session token\n *\n * This is the core function - framework-agnostic JWT decoding.\n * The caller is responsible for extracting the token from their framework's\n * cookie/header mechanism.\n *\n * @param token - The JWT session token\n * @param secret - The AUTH_SECRET used to sign the token\n * @param isSecure - Whether the token came from a secure cookie\n * @returns DecodeResult with session data or error\n *\n * @example\n * ```typescript\n * const result = await decodeSessionToken(token, process.env.AUTH_SECRET, isSecure)\n * if (result.success) {\n *   console.log(result.session.user.email)\n * } else {\n *   console.error(result.error)\n * }\n * ```\n */\nexport async function decodeSessionToken(\n  token: string | undefined,\n  secret: string | undefined,\n  isSecure: boolean = false\n): Promise<DecodeResult> {\n  if (!token) {\n    return { success: false, error: \"missing_token\" }\n  }\n\n  if (!secret) {\n    return { success: false, error: \"missing_secret\" }\n  }\n\n  try {\n    const salt = getSalt(isSecure)\n    console.debug(\"[bridge] Key derivation params:\", {\n      salt,\n      isSecure,\n      secretLength: secret.length,\n      tokenLength: token.length,\n      tokenPrefix: token.substring(0, 20),\n    })\n    \n    const keyBytes = await deriveKey(secret, salt)\n    \n    // Create a JWK from the derived key bytes\n    const key = await importJWK(\n      {\n        kty: \"oct\",\n        k: base64url.encode(keyBytes),\n        alg: \"A256GCM\",\n      },\n      \"A256GCM\"\n    )\n    \n    // Decrypt the JWT using jose (NextAuth v4 uses encrypted JWTs with A256GCM)\n    const { payload } = await jwtDecrypt(token, key)\n\n    if (!payload) {\n      return { success: false, error: \"decode_error\" }\n    }\n\n    const decoded = payload as DecodedToken\n\n    if (isTokenExpired(decoded)) {\n      return { success: false, error: \"expired\" }\n    }\n\n    const session = mapToSession(decoded)\n    return {\n      success: true,\n      session,\n      decoded,\n    }\n  } catch (error) {\n    // Log the actual error for debugging\n    const errorMessage = error instanceof Error ? error.message : String(error)\n    console.error(\"[bridge] JWT decode error:\", errorMessage)\n    return { success: false, error: \"decode_error\" }\n  }\n}\n\n/**\n * Extract session cookie from a cookies object (generic interface)\n *\n * This works with any object that has a `get(name)` method returning\n * `{ value: string } | undefined`, like Next.js cookies() or similar.\n *\n * @param cookies - Object with get(name) method\n * @returns SessionCookie or undefined if no session cookie found\n */\nexport function extractSessionCookie(cookies: {\n  get(name: string): { value: string } | undefined\n}): SessionCookie | undefined {\n  // Try secure cookie first (production with HTTPS)\n  const secureCookie = cookies.get(COOKIE_NAMES.secure)\n  if (secureCookie?.value) {\n    return { value: secureCookie.value, isSecure: true }\n  }\n\n  // Fall back to non-secure cookie (development)\n  const devCookie = cookies.get(COOKIE_NAMES.dev)\n  if (devCookie?.value) {\n    return { value: devCookie.value, isSecure: false }\n  }\n\n  return undefined\n}\n","/**\n * Kernel Bridge Roles\n * Role checking and permission utilities\n */\n\nimport { getCookieName, getAuthUrl } from \"./jwt\"\n\n/**\n * Options for fetching user roles from the kernel\n */\nexport interface FetchRolesOptions {\n  /**\n   * Organization ID to fetch roles in\n   */\n  organizationId: string\n\n  /**\n   * Session token for authentication (user ID is determined from the token)\n   */\n  sessionToken: string\n\n  /**\n   * Whether using secure cookie\n   * Defaults to NODE_ENV === \"production\" if not provided\n   */\n  isSecure?: boolean\n\n  /**\n   * Custom fetch function (optional, for testing or SSR)\n   */\n  fetchFn?: typeof fetch\n}\n\n/**\n * Result of role fetching operation\n */\nexport type FetchRolesResult =\n  | { success: true; roles: string[] }\n  | { success: false; error: string }\n\n/**\n * Fetch user roles from the kernel API\n *\n * This is a framework-agnostic function that makes a fetch request\n * to the kernel's roles endpoint. Uses AUTH_URL environment variable internally.\n * The user ID is determined from the session token.\n *\n * @param options - Configuration for fetching roles\n * @returns Promise with roles array or error\n *\n * @example\n * ```typescript\n * const result = await fetchUserRoles({\n *   organizationId: \"org-123\",\n *   sessionToken: token,\n *   // isSecure defaults to NODE_ENV === \"production\"\n * })\n * if (result.success) {\n *   console.log(result.roles)\n * }\n * ```\n */\nexport async function fetchUserRoles(\n  options: FetchRolesOptions\n): Promise<FetchRolesResult> {\n  const { organizationId, sessionToken, fetchFn = fetch } = options\n  // Default isSecure to production mode\n  const isSecure = options.isSecure ?? (process.env.NODE_ENV === \"production\")\n  const kernelUrl = getAuthUrl()\n  const cookieName = getCookieName(isSecure)\n\n  try {\n    const response = await fetchFn(\n      `${kernelUrl}/core/api/user/organizations/${organizationId}/roles`,\n      {\n        headers: {\n          Cookie: `${cookieName}=${sessionToken}`,\n        },\n        cache: \"no-store\",\n      }\n    )\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: `Failed to fetch roles: ${response.status}`,\n      }\n    }\n\n    const data = await response.json()\n    const roles = data.roles?.map((r: { roleName: string }) => r.roleName) || []\n\n    return { success: true, roles }\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Unknown error\",\n    }\n  }\n}\n\n/**\n * Check if user has at least one of the required roles\n */\nexport function hasAnyRole(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true // No roles required = any authenticated user\n  return requiredRoles.some((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has all of the required roles\n */\nexport function hasAllRoles(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true\n  return requiredRoles.every((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has a specific role\n */\nexport function hasRole(userRoles: string[], role: string): boolean {\n  return userRoles.includes(role)\n}\n\n","/**\n * Kernel Bridge Routes\n * Route matching and protection utilities\n */\n\nimport { getAuthUrl } from \"./jwt\"\nimport type { RouteConfig, RouteMatch, MicroFrontendConfig } from \"./types\"\n\n/**\n * Check if a pathname matches any route in the list\n */\nexport function matchesAnyRoute(pathname: string, routes: string[]): boolean {\n  return routes.some((route) => pathname.startsWith(route))\n}\n\n/**\n * Find the first matching protected route for a pathname\n */\nexport function findMatchingProtectedRoute(\n  pathname: string,\n  protectedRoutes: RouteConfig\n): { route: string; requiredRoles: string[] } | undefined {\n  for (const [route, roles] of Object.entries(protectedRoutes)) {\n    if (pathname.startsWith(route)) {\n      return { route, requiredRoles: roles }\n    }\n  }\n  return undefined\n}\n\n/**\n * Match a pathname against route configuration\n *\n * @param pathname - The URL pathname to match\n * @param config - Micro-frontend configuration\n * @returns RouteMatch indicating the type of route\n *\n * @example\n * ```typescript\n * const match = matchRoute(\"/dashboard\", {\n *   publicRoutes: [\"/\", \"/api/health\"],\n *   protectedRoutes: { \"/dashboard\": [], \"/admin\": [\"organization.owner\"] },\n * })\n * // Returns: { type: \"protected\", requiredRoles: [] }\n * ```\n */\nexport function matchRoute(\n  pathname: string,\n  config: Pick<MicroFrontendConfig, \"publicRoutes\" | \"protectedRoutes\">\n): RouteMatch {\n  // Check public routes first (if specified)\n  if (config.publicRoutes && matchesAnyRoute(pathname, config.publicRoutes)) {\n    return { type: \"public\" }\n  }\n\n  // Check protected routes\n  const match = findMatchingProtectedRoute(pathname, config.protectedRoutes)\n  if (match) {\n    return { type: \"protected\", requiredRoles: match.requiredRoles }\n  }\n\n  // Not explicitly configured = unprotected\n  return { type: \"unprotected\" }\n}\n\n/**\n * Create a default configuration for a micro-frontend\n */\nexport function createConfig(\n  options: Partial<MicroFrontendConfig> & Pick<MicroFrontendConfig, \"basePath\">\n): MicroFrontendConfig {\n  return {\n    basePath: options.basePath,\n    protectedRoutes: options.protectedRoutes || {\n      \"/dashboard\": [],\n      \"/admin\": [\"organization.owner\"],\n    },\n    publicRoutes: options.publicRoutes || [],\n  }\n}\n\n/**\n * Build a sign-in redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-in\n */\nexport function buildSignInUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signin\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n/**\n * Build a sign-out redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-out\n */\nexport function buildSignOutUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signout\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n"]}
+{"version":3,"sources":["../src/jwt.ts","../src/roles.ts","../src/routes.ts"],"names":["nextAuthDecode"],"mappings":";;;AAaA,SAAS,iBAAA,GAA4B;AACnC,EAAA,MAAM,UAAA,GAAa,OAAA,CAAQ,GAAA,CAAI,WAAA,IAAe,yBAAA;AAE9C,EAAA,OAAO,WAAW,UAAA,CAAW,WAAW,IAAI,UAAA,CAAW,KAAA,CAAM,EAAE,CAAA,GAAI,UAAA;AACrE;AAMO,IAAM,YAAA,GAAe;AAAA,EAC1B,IAAI,MAAA,GAAiB;AACnB,IAAA,MAAM,WAAW,iBAAA,EAAkB;AAEnC,IAAA,OAAO,YAAY,QAAQ,CAAA,CAAA;AAAA,EAC7B,CAAA;AAAA,EACA,IAAI,GAAA,GAAc;AAChB,IAAA,OAAO,iBAAA,EAAkB;AAAA,EAC3B;AACF;AAMO,SAAS,UAAA,GAAqB;AACnC,EAAA,OAAO,OAAA,CAAQ,GAAA,CAAI,QAAA,IAAY,OAAA,CAAQ,IAAI,QAAA,IAAY,uBAAA;AACzD;AAKO,SAAS,cAAc,QAAA,EAA2B;AACvD,EAAA,OAAO,QAAA,GAAW,YAAA,CAAa,MAAA,GAAS,YAAA,CAAa,GAAA;AACvD;AAKO,SAAS,eAAe,OAAA,EAAgC;AAC7D,EAAA,IAAI,CAAC,OAAA,CAAQ,GAAA,EAAK,OAAO,KAAA;AACzB,EAAA,OAAO,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI;AACvC;AAKO,SAAS,aAAa,OAAA,EAAgC;AAC3D,EAAA,OAAO;AAAA,IACL,IAAA,EAAM;AAAA,MACJ,IAAI,OAAA,CAAQ,GAAA;AAAA,MACZ,OAAO,OAAA,CAAQ,KAAA;AAAA,MACf,IAAA,EAAO,QAAQ,IAAA,IAAmB,IAAA;AAAA,MAClC,KAAA,EAAQ,QAAQ,OAAA,IAAsB;AAAA,KACxC;AAAA,IACA,OAAA,EAAS,QAAQ,GAAA,GACb,IAAI,KAAK,OAAA,CAAQ,GAAA,GAAM,GAAI,CAAA,CAAE,WAAA,EAAY,GACzC,IAAI,IAAA,CAAK,IAAA,CAAK,KAAI,GAAI,EAAA,GAAK,KAAK,EAAA,GAAK,EAAA,GAAK,GAAI,CAAA,CAAE,WAAA;AAAY;AAAA,GAClE;AACF;AAwBA,eAAsB,kBAAA,CACpB,KAAA,EACA,MAAA,EACA,SAAA,GAAqB,KAAA,EACE;AACvB,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,eAAA,EAAgB;AAAA,EAClD;AAEA,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,gBAAA,EAAiB;AAAA,EACnD;AAEA,EAAA,IAAI;AAGF,IAAA,MAAM,OAAA,GAAU,MAAMA,MAAA,CAAe;AAAA,MACnC,KAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,EAAM;AAAA;AAAA,KACP,CAAA;AAED,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,IACjD;AAGA,IAAA,IAAI,OAAA,CAAQ,GAAA,IAAO,OAAO,OAAA,CAAQ,GAAA,KAAQ,QAAA,IAAY,OAAA,CAAQ,GAAA,GAAM,GAAA,GAAO,IAAA,CAAK,GAAA,EAAI,EAAG;AACrF,MAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,SAAA,EAAU;AAAA,IAC5C;AAEA,IAAA,MAAM,OAAA,GAAU,aAAa,OAAuB,CAAA;AACpD,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,IAAA;AAAA,MACT,OAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF,SAAS,KAAA,EAAO;AAEd,IAAA,MAAM,eAAe,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,OAAO,KAAK,CAAA;AAC1E,IAAA,OAAA,CAAQ,KAAA,CAAM,8BAA8B,YAAY,CAAA;AACxD,IAAA,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,KAAA,EAAO,cAAA,EAAe;AAAA,EACjD;AACF;AAWO,SAAS,qBAAqB,OAAA,EAEP;AAE5B,EAAA,MAAM,YAAA,GAAe,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,MAAM,CAAA;AACpD,EAAA,IAAI,cAAc,KAAA,EAAO;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,YAAA,CAAa,KAAA,EAAO,UAAU,IAAA,EAAK;AAAA,EACrD;AAGA,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,GAAA,CAAI,YAAA,CAAa,GAAG,CAAA;AAC9C,EAAA,IAAI,WAAW,KAAA,EAAO;AACpB,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,CAAU,KAAA,EAAO,UAAU,KAAA,EAAM;AAAA,EACnD;AAEA,EAAA,OAAO,MAAA;AACT;;;ACxGA,eAAsB,eACpB,OAAA,EAC2B;AAC3B,EAAA,MAAM,EAAE,cAAA,EAAgB,YAAA,EAAc,OAAA,GAAU,OAAM,GAAI,OAAA;AAE1D,EAAA,MAAM,QAAA,GAAW,OAAA,CAAQ,QAAA,IAAa,OAAA,CAAQ,IAAI,QAAA,KAAa,YAAA;AAC/D,EAAA,MAAM,YAAY,UAAA,EAAW;AAC7B,EAAA,MAAM,UAAA,GAAa,cAAc,QAAQ,CAAA;AAEzC,EAAA,IAAI;AACF,IAAA,MAAM,WAAW,MAAM,OAAA;AAAA,MACrB,CAAA,EAAG,SAAS,CAAA,6BAAA,EAAgC,cAAc,CAAA,MAAA,CAAA;AAAA,MAC1D;AAAA,QACE,OAAA,EAAS;AAAA,UACP,MAAA,EAAQ,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,YAAY,CAAA;AAAA,SACvC;AAAA,QACA,KAAA,EAAO;AAAA;AACT,KACF;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,OAAO;AAAA,QACL,OAAA,EAAS,KAAA;AAAA,QACT,KAAA,EAAO,CAAA,uBAAA,EAA0B,QAAA,CAAS,MAAM,CAAA;AAAA,OAClD;AAAA,IACF;AAEA,IAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,IAAA,MAAM,KAAA,GAAQ,KAAK,KAAA,EAAO,GAAA,CAAI,CAAC,CAAA,KAA4B,CAAA,CAAE,QAAQ,CAAA,IAAK,EAAC;AAE3E,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,KAAA,EAAM;AAAA,EAChC,SAAS,KAAA,EAAO;AACd,IAAA,OAAO;AAAA,MACL,OAAA,EAAS,KAAA;AAAA,MACT,KAAA,EAAO,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU;AAAA,KAClD;AAAA,EACF;AACF;AAKO,SAAS,UAAA,CAAW,WAAqB,aAAA,EAAkC;AAChF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,IAAA,CAAK,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC9D;AAKO,SAAS,WAAA,CAAY,WAAqB,aAAA,EAAkC;AACjF,EAAA,IAAI,aAAA,CAAc,MAAA,KAAW,CAAA,EAAG,OAAO,IAAA;AACvC,EAAA,OAAO,cAAc,KAAA,CAAM,CAAC,SAAS,SAAA,CAAU,QAAA,CAAS,IAAI,CAAC,CAAA;AAC/D;AAKO,SAAS,OAAA,CAAQ,WAAqB,IAAA,EAAuB;AAClE,EAAA,OAAO,SAAA,CAAU,SAAS,IAAI,CAAA;AAChC;;;AC/GO,SAAS,eAAA,CAAgB,UAAkB,MAAA,EAA2B;AAC3E,EAAA,OAAO,OAAO,IAAA,CAAK,CAAC,UAAU,QAAA,CAAS,UAAA,CAAW,KAAK,CAAC,CAAA;AAC1D;AAKO,SAAS,0BAAA,CACd,UACA,eAAA,EACwD;AACxD,EAAA,KAAA,MAAW,CAAC,KAAA,EAAO,KAAK,KAAK,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAG;AAC5D,IAAA,IAAI,QAAA,CAAS,UAAA,CAAW,KAAK,CAAA,EAAG;AAC9B,MAAA,OAAO,EAAE,KAAA,EAAO,aAAA,EAAe,KAAA,EAAM;AAAA,IACvC;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAkBO,SAAS,UAAA,CACd,UACA,MAAA,EACY;AAEZ,EAAA,IAAI,OAAO,YAAA,IAAgB,eAAA,CAAgB,QAAA,EAAU,MAAA,CAAO,YAAY,CAAA,EAAG;AACzE,IAAA,OAAO,EAAE,MAAM,QAAA,EAAS;AAAA,EAC1B;AAGA,EAAA,MAAM,KAAA,GAAQ,0BAAA,CAA2B,QAAA,EAAU,MAAA,CAAO,eAAe,CAAA;AACzE,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,aAAA,EAAe,MAAM,aAAA,EAAc;AAAA,EACjE;AAGA,EAAA,OAAO,EAAE,MAAM,aAAA,EAAc;AAC/B;AAKO,SAAS,aACd,OAAA,EACqB;AACrB,EAAA,OAAO;AAAA,IACL,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,eAAA,EAAiB,QAAQ,eAAA,IAAmB;AAAA,MAC1C,cAAc,EAAC;AAAA,MACf,QAAA,EAAU,CAAC,oBAAoB;AAAA,KACjC;AAAA,IACA,YAAA,EAAc,OAAA,CAAQ,YAAA,IAAgB;AAAC,GACzC;AACF;AAQO,SAAS,eAAe,WAAA,EAA2B;AACxD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,mBAAA,EAAqB,OAAO,CAAA;AAChD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT;AAQO,SAAS,gBAAgB,WAAA,EAA2B;AACzD,EAAA,MAAM,UAAU,UAAA,EAAW;AAC3B,EAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,oBAAA,EAAsB,OAAO,CAAA;AACjD,EAAA,IAAI,WAAA,EAAa;AACf,IAAA,GAAA,CAAI,YAAA,CAAa,GAAA,CAAI,aAAA,EAAe,WAAW,CAAA;AAAA,EACjD;AACA,EAAA,OAAO,GAAA;AACT","file":"index.js","sourcesContent":["/**\n * Kernel Bridge JWT\n * Framework-agnostic JWT decoding for NextAuth v4 tokens\n * Uses NextAuth's internal decode function for guaranteed compatibility\n */\n\nimport { decode as nextAuthDecode } from \"next-auth/jwt\"\nimport type { Session, SessionCookie, DecodeResult, DecodedToken } from \"./types\"\n\n/**\n * Get the base cookie name from AUTH_COOKIE env var or default to next-auth.session-token\n * Strips __Secure- prefix if present, as it will be added automatically for secure cookies\n */\nfunction getBaseCookieName(): string {\n  const cookieName = process.env.AUTH_COOKIE || \"next-auth.session-token\"\n  // Remove __Secure- prefix if present, as we'll add it back for secure cookies\n  return cookieName.startsWith(\"__Secure-\") ? cookieName.slice(10) : cookieName\n}\n\n/**\n * Cookie names used by NextAuth v4\n * Defaults to next-auth.session-token, can be overridden via AUTH_COOKIE env var\n */\nexport const COOKIE_NAMES = {\n  get secure(): string {\n    const baseName = getBaseCookieName()\n    // Secure cookies must start with __Secure- prefix\n    return `__Secure-${baseName}`\n  },\n  get dev(): string {\n    return getBaseCookieName()\n  },\n} as const\n\n/**\n * Get the AUTH_URL from environment variables\n * This is used internally for API calls to the kernel\n */\nexport function getAuthUrl(): string {\n  return process.env.AUTH_URL || process.env.BASE_URL || \"http://localhost:3000\"\n}\n\n/**\n * Get the cookie name based on security mode\n */\nexport function getCookieName(isSecure: boolean): string {\n  return isSecure ? COOKIE_NAMES.secure : COOKIE_NAMES.dev\n}\n\n/**\n * Check if a token is expired\n */\nexport function isTokenExpired(decoded: DecodedToken): boolean {\n  if (!decoded.exp) return false\n  return decoded.exp * 1000 < Date.now()\n}\n\n/**\n * Map decoded JWT payload to Session structure\n */\nexport function mapToSession(decoded: DecodedToken): Session {\n  return {\n    user: {\n      id: decoded.sub as string,\n      email: decoded.email as string,\n      name: (decoded.name as string) || null,\n      image: (decoded.picture as string) || null,\n    },\n    expires: decoded.exp\n      ? new Date(decoded.exp * 1000).toISOString()\n      : new Date(Date.now() + 30 * 24 * 60 * 60 * 1000).toISOString(), // Default 30 days\n  }\n}\n\n/**\n * Decode and validate a session token\n *\n * This is the core function - framework-agnostic JWT decoding.\n * The caller is responsible for extracting the token from their framework's\n * cookie/header mechanism.\n *\n * @param token - The JWT session token\n * @param secret - The AUTH_SECRET used to sign the token\n * @param isSecure - Whether the token came from a secure cookie\n * @returns DecodeResult with session data or error\n *\n * @example\n * ```typescript\n * const result = await decodeSessionToken(token, process.env.AUTH_SECRET, isSecure)\n * if (result.success) {\n *   console.log(result.session.user.email)\n * } else {\n *   console.error(result.error)\n * }\n * ```\n */\nexport async function decodeSessionToken(\n  token: string | undefined,\n  secret: string | undefined,\n  _isSecure: boolean = false\n): Promise<DecodeResult> {\n  if (!token) {\n    return { success: false, error: \"missing_token\" }\n  }\n\n  if (!secret) {\n    return { success: false, error: \"missing_secret\" }\n  }\n\n  try {\n    // Use NextAuth's decode function directly for session tokens\n    // For session tokens, NextAuth uses an empty salt (\"\")\n    const decoded = await nextAuthDecode({\n      token,\n      secret,\n      salt: \"\", // Empty salt means session token in NextAuth\n    })\n\n    if (!decoded) {\n      return { success: false, error: \"decode_error\" }\n    }\n\n    // Check if token is expired\n    if (decoded.exp && typeof decoded.exp === \"number\" && decoded.exp * 1000 < Date.now()) {\n      return { success: false, error: \"expired\" }\n    }\n\n    const session = mapToSession(decoded as DecodedToken)\n    return {\n      success: true,\n      session,\n      decoded: decoded as DecodedToken,\n    }\n  } catch (error) {\n    // Log the actual error for debugging\n    const errorMessage = error instanceof Error ? error.message : String(error)\n    console.error(\"[bridge] JWT decode error:\", errorMessage)\n    return { success: false, error: \"decode_error\" }\n  }\n}\n\n/**\n * Extract session cookie from a cookies object (generic interface)\n *\n * This works with any object that has a `get(name)` method returning\n * `{ value: string } | undefined`, like Next.js cookies() or similar.\n *\n * @param cookies - Object with get(name) method\n * @returns SessionCookie or undefined if no session cookie found\n */\nexport function extractSessionCookie(cookies: {\n  get(name: string): { value: string } | undefined\n}): SessionCookie | undefined {\n  // Try secure cookie first (production with HTTPS)\n  const secureCookie = cookies.get(COOKIE_NAMES.secure)\n  if (secureCookie?.value) {\n    return { value: secureCookie.value, isSecure: true }\n  }\n\n  // Fall back to non-secure cookie (development)\n  const devCookie = cookies.get(COOKIE_NAMES.dev)\n  if (devCookie?.value) {\n    return { value: devCookie.value, isSecure: false }\n  }\n\n  return undefined\n}\n","/**\n * Kernel Bridge Roles\n * Role checking and permission utilities\n */\n\nimport { getCookieName, getAuthUrl } from \"./jwt\"\n\n/**\n * Options for fetching user roles from the kernel\n */\nexport interface FetchRolesOptions {\n  /**\n   * Organization ID to fetch roles in\n   */\n  organizationId: string\n\n  /**\n   * Session token for authentication (user ID is determined from the token)\n   */\n  sessionToken: string\n\n  /**\n   * Whether using secure cookie\n   * Defaults to NODE_ENV === \"production\" if not provided\n   */\n  isSecure?: boolean\n\n  /**\n   * Custom fetch function (optional, for testing or SSR)\n   */\n  fetchFn?: typeof fetch\n}\n\n/**\n * Result of role fetching operation\n */\nexport type FetchRolesResult =\n  | { success: true; roles: string[] }\n  | { success: false; error: string }\n\n/**\n * Fetch user roles from the kernel API\n *\n * This is a framework-agnostic function that makes a fetch request\n * to the kernel's roles endpoint. Uses AUTH_URL environment variable internally.\n * The user ID is determined from the session token.\n *\n * @param options - Configuration for fetching roles\n * @returns Promise with roles array or error\n *\n * @example\n * ```typescript\n * const result = await fetchUserRoles({\n *   organizationId: \"org-123\",\n *   sessionToken: token,\n *   // isSecure defaults to NODE_ENV === \"production\"\n * })\n * if (result.success) {\n *   console.log(result.roles)\n * }\n * ```\n */\nexport async function fetchUserRoles(\n  options: FetchRolesOptions\n): Promise<FetchRolesResult> {\n  const { organizationId, sessionToken, fetchFn = fetch } = options\n  // Default isSecure to production mode\n  const isSecure = options.isSecure ?? (process.env.NODE_ENV === \"production\")\n  const kernelUrl = getAuthUrl()\n  const cookieName = getCookieName(isSecure)\n\n  try {\n    const response = await fetchFn(\n      `${kernelUrl}/core/api/user/organizations/${organizationId}/roles`,\n      {\n        headers: {\n          Cookie: `${cookieName}=${sessionToken}`,\n        },\n        cache: \"no-store\",\n      }\n    )\n\n    if (!response.ok) {\n      return {\n        success: false,\n        error: `Failed to fetch roles: ${response.status}`,\n      }\n    }\n\n    const data = await response.json()\n    const roles = data.roles?.map((r: { roleName: string }) => r.roleName) || []\n\n    return { success: true, roles }\n  } catch (error) {\n    return {\n      success: false,\n      error: error instanceof Error ? error.message : \"Unknown error\",\n    }\n  }\n}\n\n/**\n * Check if user has at least one of the required roles\n */\nexport function hasAnyRole(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true // No roles required = any authenticated user\n  return requiredRoles.some((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has all of the required roles\n */\nexport function hasAllRoles(userRoles: string[], requiredRoles: string[]): boolean {\n  if (requiredRoles.length === 0) return true\n  return requiredRoles.every((role) => userRoles.includes(role))\n}\n\n/**\n * Check if user has a specific role\n */\nexport function hasRole(userRoles: string[], role: string): boolean {\n  return userRoles.includes(role)\n}\n\n","/**\n * Kernel Bridge Routes\n * Route matching and protection utilities\n */\n\nimport { getAuthUrl } from \"./jwt\"\nimport type { RouteConfig, RouteMatch, MicroFrontendConfig } from \"./types\"\n\n/**\n * Check if a pathname matches any route in the list\n */\nexport function matchesAnyRoute(pathname: string, routes: string[]): boolean {\n  return routes.some((route) => pathname.startsWith(route))\n}\n\n/**\n * Find the first matching protected route for a pathname\n */\nexport function findMatchingProtectedRoute(\n  pathname: string,\n  protectedRoutes: RouteConfig\n): { route: string; requiredRoles: string[] } | undefined {\n  for (const [route, roles] of Object.entries(protectedRoutes)) {\n    if (pathname.startsWith(route)) {\n      return { route, requiredRoles: roles }\n    }\n  }\n  return undefined\n}\n\n/**\n * Match a pathname against route configuration\n *\n * @param pathname - The URL pathname to match\n * @param config - Micro-frontend configuration\n * @returns RouteMatch indicating the type of route\n *\n * @example\n * ```typescript\n * const match = matchRoute(\"/dashboard\", {\n *   publicRoutes: [\"/\", \"/api/health\"],\n *   protectedRoutes: { \"/dashboard\": [], \"/admin\": [\"organization.owner\"] },\n * })\n * // Returns: { type: \"protected\", requiredRoles: [] }\n * ```\n */\nexport function matchRoute(\n  pathname: string,\n  config: Pick<MicroFrontendConfig, \"publicRoutes\" | \"protectedRoutes\">\n): RouteMatch {\n  // Check public routes first (if specified)\n  if (config.publicRoutes && matchesAnyRoute(pathname, config.publicRoutes)) {\n    return { type: \"public\" }\n  }\n\n  // Check protected routes\n  const match = findMatchingProtectedRoute(pathname, config.protectedRoutes)\n  if (match) {\n    return { type: \"protected\", requiredRoles: match.requiredRoles }\n  }\n\n  // Not explicitly configured = unprotected\n  return { type: \"unprotected\" }\n}\n\n/**\n * Create a default configuration for a micro-frontend\n */\nexport function createConfig(\n  options: Partial<MicroFrontendConfig> & Pick<MicroFrontendConfig, \"basePath\">\n): MicroFrontendConfig {\n  return {\n    basePath: options.basePath,\n    protectedRoutes: options.protectedRoutes || {\n      \"/dashboard\": [],\n      \"/admin\": [\"organization.owner\"],\n    },\n    publicRoutes: options.publicRoutes || [],\n  }\n}\n\n/**\n * Build a sign-in redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-in\n */\nexport function buildSignInUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signin\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n/**\n * Build a sign-out redirect URL\n * Uses AUTH_URL environment variable internally.\n * \n * @param callbackUrl - Optional callback URL to return to after sign-out\n */\nexport function buildSignOutUrl(callbackUrl?: string): URL {\n  const authUrl = getAuthUrl()\n  const url = new URL(\"/core/auth/signout\", authUrl)\n  if (callbackUrl) {\n    url.searchParams.set(\"callbackUrl\", callbackUrl)\n  }\n  return url\n}\n\n"]}