@naylence/runtime 0.3.5-test.910 → 0.3.5-test.911

package/dist/types/naylence/fame/factory-manifest.d.ts

@@ -4,7 +4,7 @@
  *
  * Provides the list of runtime factory modules for registration.
  */
-export declare const MODULES: readonly ["./connector/broadcast-channel-connector-factory.js", "./connector/broadcast-channel-listener-factory.js", "./connector/http-listener-factory.js", "./connector/http-stateless-connector-factory.js", "./connector/inpage-connector-factory.js", "./connector/inpage-listener-factory.js", "./connector/websocket-connector-factory.js", "./connector/websocket-listener-factory.js", "./delivery/at-least-once-delivery-policy-factory.js", "./delivery/at-most-once-delivery-policy-factory.js", "./delivery/delivery-profile-factory.js", "./fabric/in-process-fame-fabric-factory.js", "./node/admission/admission-profile-factory.js", "./node/admission/direct-admission-client-factory.js", "./node/admission/noop-admission-client-factory.js", "./node/admission/welcome-service-client-factory.js", "./node/node-factory.js", "./placement/static-node-placement-strategy-factory.js", "./security/auth/bearer-token-header-auth-injection-strategy-factory.js", "./security/auth/default-authorizer-factory.js", "./security/auth/jwks-jwt-token-verifier-factory.js", "./security/auth/jwt-token-issuer-factory.js", "./security/auth/jwt-token-verifier-factory.js", "./security/auth/no-auth-injection-strategy-factory.js", "./security/auth/none-token-provider-factory.js", "./security/auth/noop-authorizer-factory.js", "./security/auth/noop-token-issuer-factory.js", "./security/auth/noop-token-verifier-factory.js", "./security/auth/oauth2-authorizer-factory.js", "./security/auth/oauth2-client-credentials-token-provider-factory.js", "./security/auth/query-param-auth-injection-strategy-factory.js", "./security/auth/shared-secret-authorizer-factory.js", "./security/auth/shared-secret-token-provider-factory.js", "./security/auth/shared-secret-token-verifier-factory.js", "./security/auth/static-token-provider-factory.js", "./security/auth/websocket-subprotocol-auth-injection-strategy-factory.js", "./security/credential/dev-fixed-key-credential-provider-factory.js", "./security/credential/env-credential-provider-factory.js", "./security/credential/none-credential-provider-factory.js", "./security/credential/prompt-credential-provider-factory.js", "./security/credential/secret-store-credential-provider-factory.js", "./security/credential/session-key-credential-provider-factory.js", "./security/credential/static-credential-provider-factory.js", "./security/default-security-manager-factory.js", "./security/encryption/noop-encryption-manager-factory.js", "./security/encryption/noop-secure-channel-manager-factory.js", "./security/keys/default-key-manager-factory.js", "./security/keys/in-memory-key-store-factory.js", "./security/keys/noop-key-validator-factory.js", "./security/node-security-profile-factory.js", "./security/policy/default-security-policy-factory.js", "./security/policy/no-security-policy-factory.js", "./security/signing/eddsa-envelope-signer-factory.js", "./security/signing/eddsa-envelope-verifier-factory.js", "./sentinel/capability-aware-routing-policy-factory.js", "./sentinel/composite-routing-policy-factory.js", "./sentinel/hybrid-path-routing-policy-factory.js", "./sentinel/load-balancing/composite-load-balancing-strategy-factory.js", "./sentinel/load-balancing/hrw-load-balancing-strategy-factory.js", "./sentinel/load-balancing/load-balancing-profile-factory.js", "./sentinel/load-balancing/random-load-balancing-strategy-factory.js", "./sentinel/load-balancing/round-robin-load-balancing-strategy-factory.js", "./sentinel/load-balancing/sticky-load-balancing-strategy-factory.js", "./sentinel/routing-profile-factory.js", "./sentinel/sentinel-factory.js", "./sentinel/store/route-store-factory.js", "./stickiness/simple-load-balancer-stickiness-manager-factory.js", "./telemetry/noop-trace-emitter-factory.js", "./telemetry/open-telemetry-trace-emitter-factory.js", "./telemetry/trace-emitter-profile-factory.js", "./welcome/default-welcome-service-factory.js"];
+export declare const MODULES: readonly ["./connector/broadcast-channel-connector-factory.js", "./connector/broadcast-channel-listener-factory.js", "./connector/http-listener-factory.js", "./connector/http-stateless-connector-factory.js", "./connector/inpage-connector-factory.js", "./connector/inpage-listener-factory.js", "./connector/websocket-connector-factory.js", "./connector/websocket-listener-factory.js", "./delivery/at-least-once-delivery-policy-factory.js", "./delivery/at-most-once-delivery-policy-factory.js", "./delivery/delivery-profile-factory.js", "./fabric/in-process-fame-fabric-factory.js", "./node/admission/admission-profile-factory.js", "./node/admission/direct-admission-client-factory.js", "./node/admission/noop-admission-client-factory.js", "./node/admission/welcome-service-client-factory.js", "./node/node-factory.js", "./placement/static-node-placement-strategy-factory.js", "./security/auth/bearer-token-header-auth-injection-strategy-factory.js", "./security/auth/default-authorizer-factory.js", "./security/auth/jwks-jwt-token-verifier-factory.js", "./security/auth/jwt-token-issuer-factory.js", "./security/auth/jwt-token-verifier-factory.js", "./security/auth/no-auth-injection-strategy-factory.js", "./security/auth/none-token-provider-factory.js", "./security/auth/noop-authorizer-factory.js", "./security/auth/noop-token-issuer-factory.js", "./security/auth/noop-token-verifier-factory.js", "./security/auth/oauth2-authorizer-factory.js", "./security/auth/oauth2-client-credentials-token-provider-factory.js", "./security/auth/oauth2-pkce-token-provider-factory.js", "./security/auth/query-param-auth-injection-strategy-factory.js", "./security/auth/shared-secret-authorizer-factory.js", "./security/auth/shared-secret-token-provider-factory.js", "./security/auth/shared-secret-token-verifier-factory.js", "./security/auth/static-token-provider-factory.js", "./security/auth/websocket-subprotocol-auth-injection-strategy-factory.js", "./security/credential/dev-fixed-key-credential-provider-factory.js", "./security/credential/env-credential-provider-factory.js", "./security/credential/none-credential-provider-factory.js", "./security/credential/prompt-credential-provider-factory.js", "./security/credential/secret-store-credential-provider-factory.js", "./security/credential/session-key-credential-provider-factory.js", "./security/credential/static-credential-provider-factory.js", "./security/default-security-manager-factory.js", "./security/encryption/noop-encryption-manager-factory.js", "./security/encryption/noop-secure-channel-manager-factory.js", "./security/keys/default-key-manager-factory.js", "./security/keys/in-memory-key-store-factory.js", "./security/keys/noop-key-validator-factory.js", "./security/node-security-profile-factory.js", "./security/policy/default-security-policy-factory.js", "./security/policy/no-security-policy-factory.js", "./security/signing/eddsa-envelope-signer-factory.js", "./security/signing/eddsa-envelope-verifier-factory.js", "./sentinel/capability-aware-routing-policy-factory.js", "./sentinel/composite-routing-policy-factory.js", "./sentinel/hybrid-path-routing-policy-factory.js", "./sentinel/load-balancing/composite-load-balancing-strategy-factory.js", "./sentinel/load-balancing/hrw-load-balancing-strategy-factory.js", "./sentinel/load-balancing/load-balancing-profile-factory.js", "./sentinel/load-balancing/random-load-balancing-strategy-factory.js", "./sentinel/load-balancing/round-robin-load-balancing-strategy-factory.js", "./sentinel/load-balancing/sticky-load-balancing-strategy-factory.js", "./sentinel/routing-profile-factory.js", "./sentinel/sentinel-factory.js", "./sentinel/store/route-store-factory.js", "./stickiness/simple-load-balancer-stickiness-manager-factory.js", "./telemetry/noop-trace-emitter-factory.js", "./telemetry/open-telemetry-trace-emitter-factory.js", "./telemetry/trace-emitter-profile-factory.js", "./welcome/default-welcome-service-factory.js"];
 export type FactoryModuleSpec = (typeof MODULES)[number];
 export type FactoryModuleLoader = () => Promise<Record<string, unknown>>;
 export declare const MODULE_LOADERS: Record<FactoryModuleSpec, FactoryModuleLoader>;

package/dist/types/naylence/fame/http/oauth2-token-router.d.ts

@@ -1,8 +1,9 @@
 /**
- * OAuth2 client credentials grant flow router for Express
+ * OAuth2 client credentials and authorization code (PKCE) grant router for Express
  *
- * Provides /oauth/token endpoint for local development and testing
- * Implements OAuth2 client credentials grant with JWT token issuance
+ * Provides /oauth/token and /oauth/authorize endpoints for local development and testing.
+ * Implements OAuth2 client credentials grant with JWT token issuance and
+ * OAuth2 authorization code grant with PKCE verification.
  */
 import { type Router } from 'express';
 import type { CryptoProvider } from '../security/crypto/providers/crypto-provider.js';
@@ -44,12 +45,76 @@ export interface CreateOAuth2TokenRouterOptions {
      * Default: EdDSA
      */
     algorithm?: string;
+    /**
+     * Enable PKCE authorization code grant (default: true)
+     */
+    enablePkce?: boolean;
+    /**
+     * Allow public clients (no client_secret) for PKCE exchange (default: true)
+     */
+    allowPublicClients?: boolean;
+    /**
+     * Authorization code TTL in seconds (default: 300)
+     */
+    authorizationCodeTtlSec?: number;
+    /**
+     * Enable developer login experience for authorization flows (default: false)
+     */
+    enableDevLogin?: boolean;
+    /**
+     * Developer login username (required if enableDevLogin is true and not set via env)
+     */
+    devLoginUsername?: string;
+    /**
+     * Developer login password (required if enableDevLogin is true and not set via env)
+     */
+    devLoginPassword?: string;
+    /**
+     * Developer login session TTL in seconds (default: 3600)
+     */
+    devLoginSessionTtlSec?: number;
+    /**
+     * Cookie name for developer login session (default: naylence_dev_session)
+      
+      if (devLoginEnabled) {
+        cleanupLoginSessions(loginSessions, Date.now());
+        const activeSession = getActiveSession(
+          req,
+          loginSessions,
+          devLoginCookieName,
+          devLoginSessionTtlMs
+        );
+        if (!activeSession) {
+          const returnTo = sanitizeReturnTo(
+            req.originalUrl,
+            sessionCookiePath,
+            authorizationRedirectPath
+          );
+          const loginLocation = `${prefix}/login?return_to=${encodeURIComponent(
+            returnTo
+          )}`;
+          setNoCacheHeaders(res);
+          res.redirect(302, loginLocation);
+          return;
+        }
+      }
+     */
+    devLoginCookieName?: string;
+    /**
+     * Whether to mark the developer login cookie as secure (default: false)
+     */
+    devLoginSecureCookie?: boolean;
+    /**
+     * Custom title for the developer login page (default: Developer Login)
+     */
+    devLoginTitle?: string;
 }
 /**
- * Create an Express router that implements OAuth2 client credentials grant
+ * Create an Express router that implements OAuth2 token and authorization endpoints
+ * with support for client credentials and authorization code (PKCE) grants.
  *
  * @param options - Router configuration options
- * @returns Express router with OAuth2 token endpoint
+ * @returns Express router with OAuth2 token and authorization endpoints
  *
  * Environment Variables:
  *   FAME_JWT_CLIENT_ID: OAuth2 client identifier
@@ -58,17 +123,8 @@ export interface CreateOAuth2TokenRouterOptions {
  *   FAME_JWT_AUDIENCE: JWT audience claim (optional)
  *   FAME_JWT_ALGORITHM: JWT signing algorithm (optional, default: EdDSA)
  *   FAME_JWT_ALLOWED_SCOPES: Allowed scopes (optional, default: node.connect)
- *
- * @example
- * ```typescript
- * import express from 'express';
- * import { createOAuth2TokenRouter } from '@naylence/runtime';
- *
- * const app = express();
- * app.use(express.urlencoded({ extended: true }));
- *
- * const cryptoProvider = new MyCryptoProvider();
- * app.use(createOAuth2TokenRouter({ cryptoProvider }));
- * ```
+ *   FAME_OAUTH_ENABLE_PKCE: Enable PKCE authorization endpoints (optional, default: true)
+ *   FAME_OAUTH_ALLOW_PUBLIC_CLIENTS: Allow PKCE exchanges without client_secret (optional, default: true)
+ *   FAME_OAUTH_CODE_TTL_SEC: Authorization code TTL in seconds (optional, default: 300)
  */
 export declare function createOAuth2TokenRouter(options: CreateOAuth2TokenRouterOptions): Router;

package/dist/types/naylence/fame/security/auth/oauth2-pkce-token-provider-factory.d.ts

@@ -0,0 +1,27 @@
+import { type SecretSourceType } from '../credential/secret-source.js';
+import type { TokenProvider } from './token-provider.js';
+import { TokenProviderFactory, type TokenProviderConfig } from './token-provider-factory.js';
+export interface OAuth2PkceTokenProviderConfig extends TokenProviderConfig {
+    type: 'OAuth2PkceTokenProvider';
+    authorizeUrl: string;
+    tokenUrl: string;
+    redirectUri: string;
+    clientId: string;
+    username?: SecretSourceType;
+    clientSecret?: SecretSourceType;
+    scopes?: string[];
+    audience?: string;
+    codeChallengeMethod?: string;
+    codeVerifierLength?: number;
+    clockSkewSeconds?: number;
+    loginHintParam?: string;
+}
+export declare const FACTORY_META: {
+    readonly base: "TokenProviderFactory";
+    readonly key: "OAuth2PkceTokenProvider";
+};
+export declare class OAuth2PkceTokenProviderFactory extends TokenProviderFactory<OAuth2PkceTokenProviderConfig> {
+    readonly type = "OAuth2PkceTokenProvider";
+    create(config?: OAuth2PkceTokenProviderConfig | Record<string, unknown> | null): Promise<TokenProvider>;
+}
+export default OAuth2PkceTokenProviderFactory;

package/dist/types/naylence/fame/security/auth/oauth2-pkce-token-provider.d.ts

@@ -0,0 +1,42 @@
+import { type CredentialProvider } from '../credential/credential-provider.js';
+import type { Token } from './token.js';
+import type { TokenProvider } from './token-provider.js';
+interface FetchLike {
+    (input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+type PkceMethod = 'S256' | 'PLAIN';
+export interface OAuth2PkceTokenProviderOptions {
+    authorizeUrl: string;
+    tokenUrl: string;
+    redirectUri: string;
+    clientId: string;
+    usernameProvider?: CredentialProvider;
+    clientSecretProvider?: CredentialProvider;
+    scopes?: string[];
+    audience?: string;
+    fetchImpl?: FetchLike;
+    clockSkewSeconds?: number;
+    codeVerifierLength?: number;
+    codeChallengeMethod?: PkceMethod;
+    loginHintParam?: string;
+}
+export declare class OAuth2PkceRedirectInitiatedError extends Error {
+    constructor(message?: string);
+}
+export declare class OAuth2PkceTokenProvider implements TokenProvider {
+    private cachedToken;
+    private readonly options;
+    constructor(rawOptions: OAuth2PkceTokenProviderOptions | Record<string, unknown>);
+    getToken(): Promise<Token>;
+    private isTokenFresh;
+    private beginBrowserAuthorization;
+    private navigate;
+    private tryCompletePendingAuthorization;
+    private isTokenCompatible;
+    private persistToken;
+    private buildAuthorizeUrl;
+    private resolveFetch;
+    private resolveOptionalSecret;
+    private exchangeToken;
+}
+export {};

package/dist/types/naylence/fame/telemetry/open-telemetry-trace-emitter.d.ts

@@ -3,8 +3,10 @@ import { BaseTraceEmitter } from './base-trace-emitter.js';
 import type { TraceSpanOptions, TraceSpanScope } from './trace-emitter.js';
 import type { OtelLifecycleControl } from './otel-setup.js';
 import type { AuthInjectionStrategy } from '../security/auth/auth-injection-strategy.js';
+type OtelApiBridge = Pick<typeof import('@opentelemetry/api'), 'trace' | 'SpanStatusCode'>;
 export declare class OpenTelemetryTraceEmitter extends BaseTraceEmitter {
     private readonly tracer;
+    private readonly otelApi;
     private lifecycle;
     private authStrategy;
     private shutdownInvoked;
@@ -19,6 +21,8 @@ type OpenTelemetryTraceEmitterOptionsInput = {
     serviceName?: string;
     service_name?: string;
     tracer?: Tracer;
+    otelApi?: OtelApiBridge;
+    otel_api?: OtelApiBridge;
     lifecycle?: OtelLifecycleControl | null;
     lifeCycle?: OtelLifecycleControl | null;
     life_cycle?: OtelLifecycleControl | null;

package/dist/types/version.d.ts

@@ -2,4 +2,4 @@
  * The package version, injected at build time.
  * @internal
  */
-export declare const VERSION = "0.3.5-test.910";
+export declare const VERSION = "0.3.5-test.911";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naylence/runtime",
-  "version": "0.3.5-test.910",
+  "version": "0.3.5-test.911",
   "type": "module",
   "description": "Naylence Runtime - Complete TypeScript runtime",
   "author": "Naylence Dev <naylencedev@gmail.com>",
@@ -217,6 +217,7 @@
     "@types/better-sqlite3": "^7.6.13",
     "@types/jest": "^29.5.14",
     "@types/node": "^24.6.0",
+  "@types/supertest": "^2.0.16",
     "@types/ws": "^8.5.10",
     "@typescript-eslint/eslint-plugin": "^8.45.0",
     "@typescript-eslint/parser": "^8.45.0",
@@ -233,6 +234,7 @@
     "rimraf": "^6.0.1",
     "rollup": "^4.52.3",
     "size-limit": "^11.1.5",
+  "supertest": "^7.1.3",
     "ts-jest": "^29.4.5",
     "tslib": "^2.6.2",
     "typescript": "^5.3.2",