@multiplatform.one/keycloak 7.90.6 → 8.1.0

package/README.md

@@ -27,8 +27,6 @@ Peers: `react`, `@multiplatform.one/logger`, `@multiplatform.one/platform`.
 - **Token helpers** — `isTokenExpired`, `validOrRefreshableToken`,
   `getKeycloakBearerToken`, wallet-claim readers (`getWalletsFromToken`,
   `getWalletAddresses`, `hasWallets`)
-- **`@multiplatform.one/keycloak/one`** — `createAuth()` Better Auth server
-  factory (stateless JWE sessions, Keycloak OAuth, Expo support)
 
 ## What it must not do
 

package/dist/cjs/index.cjs

@@ -365,6 +365,15 @@ function getAuthClient(baseURL) {
   return _client;
 }
 
+// ../auth/src/accessTokenRefresh.ts
+var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+var ACCESS_TOKEN_RETRY_DELAYS_MS = [0, 400, 1e3];
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+
 // src/betterAuth/accountSelection.ts
 var validationErrorCode = "VALIDATION_ERROR";
 var known;
@@ -399,13 +408,6 @@ var signedOutUntil = 0;
 var unavailableUntil = 0;
 var SIGNED_OUT_COOLDOWN_MS = 15e3;
 var TRANSIENT_COOLDOWN_MS = 3e3;
-var RETRY_DELAYS_MS = [0, 400, 1e3];
-var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
-function classifyAccessTokenResponse(status, body) {
-  if (status === 401 || status === 403) return "signed-out";
-  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
-  return "transient";
-}
 function notifySessionInvalidated() {
   try {
     const client = getAuthClient();
@@ -458,8 +460,8 @@ async function fetchTokenOnce() {
 }
 async function fetchToken() {
   let last = "transient";
-  for (let i = 0; i < RETRY_DELAYS_MS.length; i++) {
-    const wait = RETRY_DELAYS_MS[i];
+  for (let i = 0; i < ACCESS_TOKEN_RETRY_DELAYS_MS.length; i++) {
+    const wait = ACCESS_TOKEN_RETRY_DELAYS_MS[i];
     if (wait) await sleep(wait);
     const result = await fetchTokenOnce();
     if (result.ok) {

package/dist/esm/index.mjs

@@ -311,6 +311,15 @@ function getAuthClient(baseURL) {
   return _client;
 }
 
+// ../auth/src/accessTokenRefresh.ts
+var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
+var ACCESS_TOKEN_RETRY_DELAYS_MS = [0, 400, 1e3];
+function classifyAccessTokenResponse(status, body) {
+  if (status === 401 || status === 403) return "signed-out";
+  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
+  return "transient";
+}
+
 // src/betterAuth/accountSelection.ts
 var validationErrorCode = "VALIDATION_ERROR";
 var known;
@@ -345,13 +354,6 @@ var signedOutUntil = 0;
 var unavailableUntil = 0;
 var SIGNED_OUT_COOLDOWN_MS = 15e3;
 var TRANSIENT_COOLDOWN_MS = 3e3;
-var RETRY_DELAYS_MS = [0, 400, 1e3];
-var FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
-function classifyAccessTokenResponse(status, body) {
-  if (status === 401 || status === 403) return "signed-out";
-  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
-  return "transient";
-}
 function notifySessionInvalidated() {
   try {
     const client = getAuthClient();
@@ -404,8 +406,8 @@ async function fetchTokenOnce() {
 }
 async function fetchToken() {
   let last = "transient";
-  for (let i = 0; i < RETRY_DELAYS_MS.length; i++) {
-    const wait = RETRY_DELAYS_MS[i];
+  for (let i = 0; i < ACCESS_TOKEN_RETRY_DELAYS_MS.length; i++) {
+    const wait = ACCESS_TOKEN_RETRY_DELAYS_MS[i];
     if (wait) await sleep(wait);
     const result = await fetchTokenOnce();
     if (result.ok) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@multiplatform.one/keycloak",
-  "version": "7.90.6",
+  "version": "8.1.0",
   "description": "keycloak client for multiplatform.one ecosystem",
   "keywords": [
     "auth",
@@ -42,13 +42,6 @@
       "require": "./dist/cjs/index.cjs",
       "default": "./dist/esm/index.mjs"
     },
-    "./one": {
-      "source": "./src/one.ts",
-      "types": "./types/one.d.ts",
-      "import": "./dist/esm/one.mjs",
-      "require": "./dist/cjs/one.cjs",
-      "default": "./dist/esm/one.mjs"
-    },
     "./oauth": {
       "source": "./src/oauth/index.ts",
       "types": "./types/oauth/index.d.ts",
@@ -62,16 +55,17 @@
   },
   "dependencies": {
     "@better-auth/expo": "~1.6.33",
-    "@multiplatform.one/keycloak-js": "^7.90.6",
-    "@multiplatform.one/store": "^7.90.6",
+    "@multiplatform.one/auth": "^8.1.0",
+    "@multiplatform.one/keycloak-js": "^8.1.0",
+    "@multiplatform.one/store": "^8.1.0",
     "better-auth": "~1.6.33",
     "jwt-decode": "^4.0.0"
   },
   "devDependencies": {
-    "@multiplatform.one/config": "7.90.6",
-    "@multiplatform.one/logger": "7.90.6",
-    "@multiplatform.one/platform": "7.90.6",
-    "@multiplatform.one/test-utils": "7.90.6",
+    "@multiplatform.one/config": "8.1.0",
+    "@multiplatform.one/logger": "8.1.0",
+    "@multiplatform.one/platform": "8.1.0",
+    "@multiplatform.one/test-utils": "8.1.0",
     "@tamagui/build": "2.7.6",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",
@@ -85,8 +79,8 @@
     "vitest": "^4.1.12"
   },
   "peerDependencies": {
-    "@multiplatform.one/logger": "^7.90.6",
-    "@multiplatform.one/platform": "^7.90.6",
+    "@multiplatform.one/logger": "^8.1.0",
+    "@multiplatform.one/platform": "^8.1.0",
     "react": "^19.1.0",
     "react-native": ">=0.83.0"
   },

package/src/betterAuth/accountSelection.spec.ts

@@ -8,15 +8,16 @@
  * token fetch then 400'd at validation, the Frappe layer fell back to guest
  * cookies, and a signed-in user was told to sign in.
  *
- * The last case drives the REAL Better Auth router that `createAuth` builds,
+ * The last case drives the REAL Better Auth router,
  * so the shape is checked against the installed version rather than against a
  * hand-copied schema. A 400 VALIDATION_ERROR fails; 401 is the pass, because
  * the request is unauthenticated by design — the point is that the body
  * reached the auth check at all.
  */
 
+import { betterAuth } from "better-auth";
+import { genericOAuth, keycloak } from "better-auth/plugins";
 import { beforeEach, describe, expect, it, vi } from "vitest";
-import { createAuth } from "../one";
 import {
   currentSelection,
   isBodyRefusal,
@@ -99,16 +100,27 @@ describe("requestAccessToken negotiation", () => {
 });
 
 describe("against the installed Better Auth router", () => {
-  const auth = createAuth({
-    baseUrl,
+  const auth = betterAuth({
+    basePath: "/api/auth",
+    baseURL: baseUrl,
     secret: "test-secret-not-a-real-one-0123456789",
-    expoScheme: "test",
-    keycloak: {
-      baseUrl: "https://auth.example.test",
-      realm: "test",
-      clientId: "test-client",
-      clientSecret: "",
+    trustedOrigins: [baseUrl],
+    advanced: { disableOriginCheck: false },
+    session: {
+      cookieCache: { enabled: true, maxAge: 60, strategy: "jwe", refreshCache: true },
     },
+    account: { storeStateStrategy: "cookie", storeAccountCookie: true },
+    plugins: [
+      genericOAuth({
+        config: [
+          keycloak({
+            clientId: "test-client",
+            clientSecret: "",
+            issuer: "https://auth.example.test/realms/test",
+          }),
+        ],
+      }),
+    ],
   });
 
   it("negotiates a body this server validates", async () => {

package/src/frappeToken.ts

@@ -19,6 +19,11 @@
  *   backoff, keep the session. A Keycloak restart must not look like logout.
  */
 
+import {
+  ACCESS_TOKEN_RETRY_DELAYS_MS,
+  classifyAccessTokenResponse,
+  type AccessTokenFailureKind,
+} from "@multiplatform.one/auth/access-token";
 import { requestAccessToken } from "./betterAuth/accountSelection";
 import { getAuthClient } from "./betterAuth/client";
 
@@ -32,16 +37,6 @@ let unavailableUntil = 0;
 
 const SIGNED_OUT_COOLDOWN_MS = 15_000;
 const TRANSIENT_COOLDOWN_MS = 3_000;
-const RETRY_DELAYS_MS = [0, 400, 1000] as const;
-const FAILED_TO_GET_ACCESS_TOKEN = "FAILED_TO_GET_ACCESS_TOKEN";
-
-type FailureKind = "signed-out" | "transient";
-
-function classifyAccessTokenResponse(status: number, body?: { code?: string } | null): FailureKind {
-  if (status === 401 || status === 403) return "signed-out";
-  if (status === 400 && body?.code === FAILED_TO_GET_ACCESS_TOKEN) return "signed-out";
-  return "transient";
-}
 
 /**
  * A definitive refresh failure (Keycloak declared the refresh token dead —
@@ -90,7 +85,7 @@ export async function getKeycloakBearerToken(): Promise<string | undefined> {
 }
 
 async function fetchTokenOnce(): Promise<
-  { ok: true; token: string; expiresAt: number } | { ok: false; kind: FailureKind }
+  { ok: true; token: string; expiresAt: number } | { ok: false; kind: AccessTokenFailureKind }
 > {
   try {
     let payload: unknown = null;
@@ -127,9 +122,9 @@ async function fetchTokenOnce(): Promise<
 }
 
 async function fetchToken(): Promise<string | undefined> {
-  let last: FailureKind = "transient";
-  for (let i = 0; i < RETRY_DELAYS_MS.length; i++) {
-    const wait = RETRY_DELAYS_MS[i];
+  let last: AccessTokenFailureKind = "transient";
+  for (let i = 0; i < ACCESS_TOKEN_RETRY_DELAYS_MS.length; i++) {
+    const wait = ACCESS_TOKEN_RETRY_DELAYS_MS[i];
     if (wait) await sleep(wait);
     const result = await fetchTokenOnce();
     if (result.ok) {

package/types/frappeToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"frappeToken.d.ts","sourceRoot":"","sources":["../src/frappeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAiDH;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW1E;AAgED,wDAAwD;AACxD,wBAAgB,wBAAwB,SAKvC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,IAAI,CAiB/D"}
+{"version":3,"file":"frappeToken.d.ts","sourceRoot":"","sources":["../src/frappeToken.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AA4CH;;;;;;;;;GASG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAW1E;AAgED,wDAAwD;AACxD,wBAAgB,wBAAwB,SAKvC;AAED;;;;GAIG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,IAAI,CAiB/D"}

package/dist/cjs/one.cjs

@@ -1,82 +0,0 @@
-"use strict";
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
-
-// src/one.ts
-var one_exports = {};
-__export(one_exports, {
-  createAuth: () => createAuth
-});
-module.exports = __toCommonJS(one_exports);
-var import_better_auth = require("better-auth");
-var import_plugins = require("better-auth/plugins");
-var import_expo = require("@better-auth/expo");
-var _auth;
-function createAuth(config) {
-  if (_auth) return _auth;
-  const baseUrl = config.baseUrl || (typeof process !== "undefined" ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}` : "http://localhost:3000");
-  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
-  const realm = config.keycloak?.realm || "master";
-  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
-  const envTrustedOrigins = (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
-  _auth = (0, import_better_auth.betterAuth)({
-    basePath: "/api/auth",
-    baseURL: baseUrl,
-    secret: config.secret || "",
-    trustedOrigins: [
-      .../* @__PURE__ */ new Set([
-        baseUrl,
-        keycloakBaseUrl,
-        ...config.expoScheme ? [`${config.expoScheme}://`] : [],
-        ...envTrustedOrigins,
-        ...config.trustedOrigins || []
-      ])
-    ],
-    advanced: {
-      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
-      // check on so the trustedOrigins contract is enforced (and testable)
-      // regardless of environment.
-      disableOriginCheck: false
-    },
-    session: {
-      cookieCache: {
-        enabled: true,
-        maxAge: 7 * 24 * 60 * 60,
-        strategy: "jwe",
-        refreshCache: true
-      }
-    },
-    account: {
-      storeStateStrategy: "cookie",
-      storeAccountCookie: true
-    },
-    plugins: [
-      (0, import_expo.expo)(),
-      (0, import_plugins.genericOAuth)({
-        config: [
-          (0, import_plugins.keycloak)({
-            clientId: config.keycloak.clientId || "",
-            clientSecret: config.keycloak.clientSecret || "",
-            issuer
-          })
-        ]
-      })
-    ]
-  });
-  return _auth;
-}

package/dist/esm/one.mjs

@@ -1,61 +0,0 @@
-// src/one.ts
-import { betterAuth } from "better-auth";
-import { genericOAuth, keycloak } from "better-auth/plugins";
-import { expo } from "@better-auth/expo";
-var _auth;
-function createAuth(config) {
-  if (_auth) return _auth;
-  const baseUrl = config.baseUrl || (typeof process !== "undefined" ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}` : "http://localhost:3000");
-  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
-  const realm = config.keycloak?.realm || "master";
-  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
-  const envTrustedOrigins = (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS || "").split(",").map((origin) => origin.trim()).filter(Boolean);
-  _auth = betterAuth({
-    basePath: "/api/auth",
-    baseURL: baseUrl,
-    secret: config.secret || "",
-    trustedOrigins: [
-      .../* @__PURE__ */ new Set([
-        baseUrl,
-        keycloakBaseUrl,
-        ...config.expoScheme ? [`${config.expoScheme}://`] : [],
-        ...envTrustedOrigins,
-        ...config.trustedOrigins || []
-      ])
-    ],
-    advanced: {
-      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
-      // check on so the trustedOrigins contract is enforced (and testable)
-      // regardless of environment.
-      disableOriginCheck: false
-    },
-    session: {
-      cookieCache: {
-        enabled: true,
-        maxAge: 7 * 24 * 60 * 60,
-        strategy: "jwe",
-        refreshCache: true
-      }
-    },
-    account: {
-      storeStateStrategy: "cookie",
-      storeAccountCookie: true
-    },
-    plugins: [
-      expo(),
-      genericOAuth({
-        config: [
-          keycloak({
-            clientId: config.keycloak.clientId || "",
-            clientSecret: config.keycloak.clientSecret || "",
-            issuer
-          })
-        ]
-      })
-    ]
-  });
-  return _auth;
-}
-export {
-  createAuth
-};

package/src/one.expoCallback.spec.ts

@@ -1,107 +0,0 @@
-// @vitest-environment jsdom
-// jsdom, not the package's happy-dom: happy-dom's Request and Response drop
-// Cookie and Set-Cookie (forbidden headers in a browser), and the cookies are
-// the point here. jsdom leaves Node's own fetch classes in place.
-/**
- * FZ-8696: native sign-in through createAuth must come back signed in.
- *
- * createAuth wires Keycloak through Better Auth's genericOAuth, whose callback
- * is /oauth2/callback/keycloak. @better-auth/expo hands the session to the
- * app by appending ?cookie=<set-cookie> to the app-scheme redirect, but only
- * on the callback paths its after-hook matches. Under better-auth 1.6.30 that
- * was /callback* alone, so the genericOAuth callback came back as a bare
- * <scheme>:/// and the app stayed signed out with no error (Lookout FZ-8618).
- *
- * This drives the real sign-in and callback against a stubbed Keycloak, under
- * whatever better-auth version MPO pins, and checks the session rides the
- * redirect.
- */
-
-import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { createAuth } from "./one";
-
-const appUrl = "http://app.test";
-const keycloakUrl = "http://kc.test/auth";
-const realm = "mpo";
-const issuer = `${keycloakUrl}/realms/${realm}`;
-const scheme = "mpo-test";
-
-function stubKeycloak() {
-  const realFetch = globalThis.fetch;
-  vi.stubGlobal(
-    "fetch",
-    vi.fn(async (input: RequestInfo | URL, init?: RequestInit) => {
-      const url = typeof input === "string" ? input : input instanceof URL ? input.href : input.url;
-      const json = (body: unknown) =>
-        new Response(JSON.stringify(body), { headers: { "content-type": "application/json" } });
-      if (url === `${issuer}/.well-known/openid-configuration`) {
-        return json({
-          issuer,
-          authorization_endpoint: `${issuer}/protocol/openid-connect/auth`,
-          token_endpoint: `${issuer}/protocol/openid-connect/token`,
-          userinfo_endpoint: `${issuer}/protocol/openid-connect/userinfo`,
-        });
-      }
-      if (url === `${issuer}/protocol/openid-connect/token`) {
-        return json({ access_token: "access", token_type: "Bearer", expires_in: 300 });
-      }
-      if (url === `${issuer}/protocol/openid-connect/userinfo`) {
-        return json({
-          sub: "user-1",
-          email: "ada@example.test",
-          name: "Ada",
-          email_verified: true,
-        });
-      }
-      return realFetch(input, init);
-    }),
-  );
-}
-
-beforeEach(stubKeycloak);
-afterEach(() => {
-  vi.unstubAllGlobals();
-});
-
-describe("createAuth native sign-in (FZ-8696)", () => {
-  it("hands the session back on the genericOAuth callback's app-scheme redirect", async () => {
-    const auth = createAuth({
-      baseUrl: appUrl,
-      secret: "a-test-secret-that-is-long-enough-32",
-      expoScheme: scheme,
-      keycloak: { baseUrl: keycloakUrl, realm, clientId: "app", clientSecret: "secret" },
-    });
-
-    const signIn = await auth.handler(
-      new Request(`${appUrl}/api/auth/sign-in/oauth2`, {
-        method: "POST",
-        headers: { "content-type": "application/json", "expo-origin": `${scheme}://` },
-        body: JSON.stringify({
-          providerId: "keycloak",
-          callbackURL: `${scheme}://`,
-          disableRedirect: true,
-        }),
-      }),
-    );
-    expect(signIn.status).toBe(200);
-    const { url } = (await signIn.json()) as { url: string };
-    const state = new URL(url).searchParams.get("state");
-    expect(state).toBeTruthy();
-    const cookies = signIn.headers
-      .getSetCookie()
-      .map((cookie) => cookie.split(";")[0])
-      .join("; ");
-    expect(cookies).toMatch(/oauth_state=/);
-
-    const callback = await auth.handler(
-      new Request(`${appUrl}/api/auth/oauth2/callback/keycloak?code=abc&state=${state}`, {
-        headers: { cookie: cookies },
-      }),
-    );
-    expect(callback.status).toBe(302);
-    const location = new URL(callback.headers.get("location") ?? "");
-    expect(location.protocol).toBe(`${scheme}:`);
-    const handedBack = location.searchParams.get("cookie") ?? "";
-    expect(handedBack, `redirect was ${location.href}`).toMatch(/better-auth\.session_token=/);
-  });
-});

package/src/one.ts

@@ -1,111 +0,0 @@
-/**
- * File: /src/one.ts
- * Project: @multiplatform.one/keycloak
- *
- * Better Auth server configuration factory for apps using One.
- * Replaces the previous Auth.js (createAuthConfig) approach.
- * Stateless sessions — no database required.
- */
-
-import { betterAuth } from "better-auth";
-import { genericOAuth, keycloak } from "better-auth/plugins";
-import { expo } from "@better-auth/expo";
-
-let _auth: ReturnType<typeof betterAuth<any>> | undefined;
-
-export function createAuth(config: AuthHandlerConfig) {
-  if (_auth) return _auth;
-  const baseUrl =
-    config.baseUrl ||
-    (typeof process !== "undefined"
-      ? process.env?.BASE_URL || `http://localhost:${process.env?.ONE_PORT || "3000"}`
-      : "http://localhost:3000");
-  const keycloakBaseUrl = config.keycloak?.baseUrl || `${baseUrl}/auth`;
-  const realm = config.keycloak?.realm || "master";
-  const issuer = `${keycloakBaseUrl}/realms/${realm}`;
-  // Extra origins (e.g. LAN devices hitting the server by IP) come from the
-  // KEYCLOAK_TRUSTED_ORIGINS env var (comma-separated) and/or the
-  // trustedOrigins option; both extend the always-trusted defaults.
-  const envTrustedOrigins = (
-    (typeof process !== "undefined" && process.env?.KEYCLOAK_TRUSTED_ORIGINS) ||
-    ""
-  )
-    .split(",")
-    .map((origin) => origin.trim())
-    .filter(Boolean);
-
-  _auth = betterAuth({
-    basePath: "/api/auth",
-    baseURL: baseUrl,
-    secret: config.secret || "",
-    trustedOrigins: [
-      ...new Set([
-        baseUrl,
-        keycloakBaseUrl,
-        ...(config.expoScheme ? [`${config.expoScheme}://`] : []),
-        ...envTrustedOrigins,
-        ...(config.trustedOrigins || []),
-      ]),
-    ],
-    advanced: {
-      // better-auth skips origin checks entirely when NODE_ENV=test; pin the
-      // check on so the trustedOrigins contract is enforced (and testable)
-      // regardless of environment.
-      disableOriginCheck: false,
-    },
-    session: {
-      cookieCache: {
-        enabled: true,
-        maxAge: 7 * 24 * 60 * 60,
-        strategy: "jwe",
-        refreshCache: true,
-      },
-    },
-    account: {
-      storeStateStrategy: "cookie",
-      storeAccountCookie: true,
-    },
-    plugins: [
-      expo(),
-      genericOAuth({
-        config: [
-          keycloak({
-            clientId: config.keycloak.clientId || "",
-            clientSecret: config.keycloak.clientSecret || "",
-            issuer,
-          }),
-        ],
-      }),
-    ],
-  });
-
-  return _auth;
-}
-
-export interface KeycloakOptions {
-  adminPassword?: string;
-  adminUsername?: string;
-  baseUrl?: string;
-  clientId: string;
-  clientSecret: string;
-  realm?: string;
-  authorization?: Record<string, any>;
-}
-
-export interface AuthHandlerConfig {
-  baseUrl?: string;
-  keycloak: KeycloakOptions;
-  secret?: string;
-  scopes?: string[];
-  /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
-  expoScheme?: string;
-  /**
-   * Additional origins allowed to hit the auth route (e.g. LAN device
-   * origins). Extends — never replaces — the defaults (baseUrl, keycloak
-   * URL, expo scheme). Also readable from the KEYCLOAK_TRUSTED_ORIGINS env
-   * var as a comma-separated list.
-   */
-  trustedOrigins?: string[];
-}
-
-export type Auth = ReturnType<typeof createAuth>;

package/types/one.d.ts

@@ -1,35 +0,0 @@
-/**
- * File: /src/one.ts
- * Project: @multiplatform.one/keycloak
- *
- * Better Auth server configuration factory for apps using One.
- * Replaces the previous Auth.js (createAuthConfig) approach.
- * Stateless sessions — no database required.
- */
-export declare function createAuth(config: AuthHandlerConfig): import("better-auth").Auth<any>;
-export interface KeycloakOptions {
-    adminPassword?: string;
-    adminUsername?: string;
-    baseUrl?: string;
-    clientId: string;
-    clientSecret: string;
-    realm?: string;
-    authorization?: Record<string, any>;
-}
-export interface AuthHandlerConfig {
-    baseUrl?: string;
-    keycloak: KeycloakOptions;
-    secret?: string;
-    scopes?: string[];
-    /** Expo deep-link scheme (e.g. "multiplatform-one") — added to trustedOrigins. */
-    expoScheme?: string;
-    /**
-     * Additional origins allowed to hit the auth route (e.g. LAN device
-     * origins). Extends — never replaces — the defaults (baseUrl, keycloak
-     * URL, expo scheme). Also readable from the KEYCLOAK_TRUSTED_ORIGINS env
-     * var as a comma-separated list.
-     */
-    trustedOrigins?: string[];
-}
-export type Auth = ReturnType<typeof createAuth>;
-//# sourceMappingURL=one.d.ts.map

package/types/one.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"one.d.ts","sourceRoot":"","sources":["../src/one.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAQH,wBAAgB,UAAU,CAAC,MAAM,EAAE,iBAAiB,mCAmEnD;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACrC;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,eAAe,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,kFAAkF;IAClF,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAAC"}