@nebulr-group/bridge-auth-core 0.4.0-beta.0 → 0.4.0-beta.10

package/dist/auth-service.d.ts

@@ -7,6 +7,17 @@ export declare class AuthService {
     createLoginUrl(options?: {
         redirectUri?: string;
     }): string;
+    /**
+     * TBP-36 — hosted signup URL, mirroring {@link createLoginUrl}. Optional
+     * plan preselection (`signupPlan` + currency/interval) is carried as URL
+     * params that the hosted signup page applies at tenant creation.
+     */
+    createSignupUrl(options?: {
+        redirectUri?: string;
+        signupPlan?: string;
+        signupCurrency?: string;
+        signupRecurrenceInterval?: string;
+    }): string;
     createLogoutUrl(): string;
     exchangeCode(code: string): Promise<TokenSet>;
     /**

package/dist/auth-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAQ3D,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM;IAGjC,cAAc,CAAC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAQ9D,eAAe,IAAI,MAAM;IAInB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqBnD;;;;;;;OAOG;IACG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAc5D,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5E,YAAY,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAuBxE"}
+{"version":3,"file":"auth-service.d.ts","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,KAAK,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAQ3D,qBAAa,WAAW;IAEpB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBADN,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,MAAM;IAGjC,cAAc,CAAC,OAAO,GAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,MAAM;IAQ9D;;;;OAIG;IACH,eAAe,CAAC,OAAO,GAAE;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,wBAAwB,CAAC,EAAE,MAAM,CAAC;KAC9B,GAAG,MAAM;IAYf,eAAe,IAAI,MAAM;IAInB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAqBnD;;;;;;;OAOG;IACG,yBAAyB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC;IAc5D,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5E,YAAY,CAAC,iBAAiB,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;CAuBxE"}

package/dist/auth-service.js

@@ -13,6 +13,26 @@ export class AuthService {
             ? `${base}?redirectUri=${encodeURIComponent(redirectUri)}`
             : base;
     }
+    /**
+     * TBP-36 — hosted signup URL, mirroring {@link createLoginUrl}. Optional
+     * plan preselection (`signupPlan` + currency/interval) is carried as URL
+     * params that the hosted signup page applies at tenant creation.
+     */
+    createSignupUrl(options = {}) {
+        const redirectUri = options.redirectUri ?? this.config.callbackUrl;
+        const base = `${this.config.hostedUrl}/auth/signup/${this.config.appId}`;
+        const params = new URLSearchParams();
+        if (redirectUri)
+            params.set('redirectUri', redirectUri);
+        if (options.signupPlan)
+            params.set('signupPlan', options.signupPlan);
+        if (options.signupCurrency)
+            params.set('signupCurrency', options.signupCurrency);
+        if (options.signupRecurrenceInterval)
+            params.set('signupRecurrenceInterval', options.signupRecurrenceInterval);
+        const qs = params.toString();
+        return qs ? `${base}?${qs}` : base;
+    }
     createLogoutUrl() {
         return `${this.config.hostedUrl}/auth/login/${this.config.appId}`;
     }

package/dist/auth-service.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAUtC,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,MAAsB,EACtB,MAAc;QADd,WAAM,GAAN,MAAM,CAAgB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,cAAc,CAAC,UAAoC,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACnE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxE,OAAO,WAAW;YAChB,CAAC,CAAC,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YAC1D,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,eAAe;QACb,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,CAAC;QAE9C,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI;SACL,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,2BAA2B,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAoB;QAC9D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,GAA2B,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAmB,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,IAAI;SACL,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,iBAAyB;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,QAAQ,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;oBAC5B,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,iBAAiB;iBACjC;aACF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhB,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"auth-service.js","sourceRoot":"","sources":["../src/auth-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAUtC,MAAM,OAAO,WAAW;IAEH;IACA;IAFnB,YACmB,MAAsB,EACtB,MAAc;QADd,WAAM,GAAN,MAAM,CAAgB;QACtB,WAAM,GAAN,MAAM,CAAQ;IAC9B,CAAC;IAEJ,cAAc,CAAC,UAAoC,EAAE;QACnD,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACnE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACxE,OAAO,WAAW;YAChB,CAAC,CAAC,GAAG,IAAI,gBAAgB,kBAAkB,CAAC,WAAW,CAAC,EAAE;YAC1D,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED;;;;OAIG;IACH,eAAe,CAAC,UAKZ,EAAE;QACJ,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QACnE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,gBAAgB,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,WAAW;YAAE,MAAM,CAAC,GAAG,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,UAAU;YAAE,MAAM,CAAC,GAAG,CAAC,YAAY,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;QACrE,IAAI,OAAO,CAAC,cAAc;YAAE,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QACjF,IAAI,OAAO,CAAC,wBAAwB;YAAE,MAAM,CAAC,GAAG,CAAC,0BAA0B,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;QAC/G,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC7B,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACrC,CAAC;IAED,eAAe;QACb,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,SAAS,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACpE,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,eAAe,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACzE,MAAM,IAAI,GAA2B,EAAE,IAAI,EAAE,CAAC;QAE9C,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC5C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;QAC7C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI;SACL,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,yBAAyB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,2BAA2B,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;YAC/C,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE;SACjB,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAEhB,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,YAAY;YAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;YAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,WAAmB,EAAE,WAAoB;QAC9D,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,0BAA0B,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpF,MAAM,IAAI,GAA2B,EAAE,WAAW,EAAE,CAAC;QACrD,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,SAAS,CAAmB,GAAG,EAAE;YAClD,MAAM,EAAE,MAAM;YACd,IAAI;SACL,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QAChB,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,iBAAyB;QAC1C,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,QAAQ,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,SAAS,CAAgB,GAAG,EAAE;gBAC/C,MAAM,EAAE,MAAM;gBACd,IAAI,EAAE;oBACJ,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK;oBAC5B,UAAU,EAAE,eAAe;oBAC3B,aAAa,EAAE,iBAAiB;iBACjC;aACF,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAEhB,OAAO;gBACL,WAAW,EAAE,IAAI,CAAC,YAAY;gBAC9B,YAAY,EAAE,IAAI,CAAC,aAAa;gBAChC,OAAO,EAAE,IAAI,CAAC,QAAQ;aACvB,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,yBAAyB,EAAE,GAAG,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;CACF"}

package/dist/backend/index.d.ts

@@ -0,0 +1,12 @@
+/**
+ * @nebulr-group/bridge-auth-core/backend
+ *
+ * Framework-agnostic, Node-only auth surface for server-side Bridge plugins.
+ * No NestJS, no browser/storage APIs. Safe to import from any Node backend.
+ */
+export { JwksService, TokenVerificationError } from './jwks-service.js';
+export type { JwksServiceConfig, JwksLogger } from './jwks-service.js';
+export type { JwtClaims, BridgeUser, ApiTokenClaims } from './types.js';
+export { transformJwtToBridgeUser } from './types.js';
+export { decodeJwtPayload, getTokenExpiry, isTokenExpired, getTenantId, getTenantUserId, } from '../token-utils.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/backend/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAGH,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AACxE,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGvE,YAAY,EAAE,SAAS,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AACxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAGtD,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/backend/index.js

@@ -0,0 +1,12 @@
+/**
+ * @nebulr-group/bridge-auth-core/backend
+ *
+ * Framework-agnostic, Node-only auth surface for server-side Bridge plugins.
+ * No NestJS, no browser/storage APIs. Safe to import from any Node backend.
+ */
+// JWKS-based verification (plain class, not a DI provider)
+export { JwksService, TokenVerificationError } from './jwks-service.js';
+export { transformJwtToBridgeUser } from './types.js';
+// Token utilities (reused from the shared token-utils — no duplication)
+export { decodeJwtPayload, getTokenExpiry, isTokenExpired, getTenantId, getTenantUserId, } from '../token-utils.js';
+//# sourceMappingURL=index.js.map

package/dist/backend/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/backend/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,WAAW,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAC;AAKxE,OAAO,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAEtD,wEAAwE;AACxE,OAAO,EACL,gBAAgB,EAChB,cAAc,EACd,cAAc,EACd,WAAW,EACX,eAAe,GAChB,MAAM,mBAAmB,CAAC"}

package/dist/backend/jwks-service.d.ts

@@ -0,0 +1,119 @@
+import type { JwtClaims, ApiTokenClaims } from './types.js';
+/**
+ * Optional logger. Defaults to a no-op so the service is silent unless a
+ * consumer wires one in (e.g. NestJS forwards `BridgeConfigService.log`).
+ */
+export type JwksLogger = (message: string, ...args: unknown[]) => void;
+/**
+ * Construction config for the framework-agnostic JwksService.
+ *
+ * Everything the verification logic needs is injected — there is no hardcoded
+ * URL, issuer, audience, or TTL. Framework wrappers (NestJS, etc.) construct
+ * this from their own config service.
+ */
+export interface JwksServiceConfig {
+    /** JWKS endpoint for user-token verification. */
+    jwksUrl: string;
+    /**
+     * Token-introspection endpoint for API-token verification.
+     *
+     * API tokens are signed with the per-app HS256 secret, which a plugin never
+     * holds — so the plugin cannot verify them locally. Instead it POSTs the
+     * token here (`{ token }`) and the Bridge returns `{ active, sub, appId,
+     * tenantId, type, privileges, exp }`. This also gives instant revocation:
+     * the Bridge re-checks the backing record on every (uncached) call.
+     */
+    introspectionUrl: string;
+    /** Expected `iss` for user tokens. */
+    issuer: string;
+    /** Expected `aud` for user tokens (typically the appId). */
+    audience: string;
+    /** How long a remote JWKS client is reused before it is re-created. @default 3600000 (1h) */
+    cacheTtlMs?: number;
+    /**
+     * How long a successful introspection result is cached, keyed by token.
+     * Trades revocation latency for fewer network calls. `0` disables caching
+     * (every request introspects → instant revocation). @default 0
+     */
+    introspectionCacheTtlMs?: number;
+    /** Optional debug logger. @default no-op */
+    log?: JwksLogger;
+}
+/**
+ * Error thrown on token verification failure.
+ *
+ * `code` is a stable, framework-agnostic discriminator:
+ * `TOKEN_EXPIRED` | `TOKEN_INVALID` | `JWKS_NO_MATCH` | `CLAIM_VALIDATION_FAILED`
+ * | `APP_MISMATCH` | `UNKNOWN_ERROR`.
+ */
+export declare class TokenVerificationError extends Error {
+    readonly code: string;
+    constructor(message: string, code: string);
+}
+/**
+ * Framework-agnostic, Node-only Bridge token verification.
+ *
+ * Covers two paths:
+ *  - **User tokens** — verified locally via remote JWKS (asymmetric PS256;
+ *    issuer/audience validated). The verifier needs no secret, so offline
+ *    JWKS verification is the right tool.
+ *  - **API tokens** — verified via remote *introspection* (a POST to the
+ *    Bridge). API tokens are signed with the per-app HS256 secret which the
+ *    plugin never holds, so the secret-holder (the Bridge) is asked. This also
+ *    gives instant revocation. Successful results may be cached (off by
+ *    default; see `introspectionCacheTtlMs`).
+ *
+ * This is a plain class — NOT a DI provider. Framework plugins wrap it.
+ */
+export declare class JwksService {
+    private readonly config;
+    private jwks;
+    private jwksInitTime;
+    /** token → { result, expiresAt(ms) }. Only successful introspections are cached. */
+    private readonly introspectionCache;
+    private readonly cacheTtlMs;
+    private readonly introspectionCacheTtlMs;
+    private readonly log;
+    constructor(config: JwksServiceConfig);
+    /**
+     * Initialize or refresh the user-token JWKS client.
+     */
+    private ensureJwks;
+    /**
+     * Verify a user JWT and return its claims.
+     *
+     * @throws {TokenVerificationError} if the token is invalid or expired.
+     */
+    verifyToken(token: string): Promise<JwtClaims>;
+    /**
+     * Verify a Bridge API token by introspecting it against the Bridge.
+     *
+     * Unlike user tokens, API tokens are signed with the per-app HS256 secret
+     * which this verifier does not hold — so it asks the secret-holder. The
+     * Bridge returns whether the token is active (signature valid AND backing
+     * record live: not revoked, not expired) plus its claims.
+     *
+     * The returned `{ active: false }` covers every rejection (forged, tampered,
+     * wrong type, revoked, expired) without distinguishing them — no information
+     * leak. App-scoping is then enforced here: the introspected `appId` must
+     * equal `expectedAppId`.
+     *
+     * @throws {TokenVerificationError}
+     *   - `TOKEN_INVALID` if the token is inactive or not an API token
+     *   - `APP_MISMATCH` if the token belongs to a different app
+     *   - `UNKNOWN_ERROR` if the introspection request itself fails
+     */
+    verifyApiToken(token: string, expectedAppId: string): Promise<ApiTokenClaims>;
+    /**
+     * POST the token to the introspection endpoint, with optional short-lived
+     * caching of successful results (see `introspectionCacheTtlMs`).
+     */
+    private introspect;
+    private getCachedIntrospection;
+    private cacheIntrospection;
+    /**
+     * Map a jose verification error to a stable TokenVerificationError.
+     */
+    private mapVerificationError;
+}
+//# sourceMappingURL=jwks-service.d.ts.map

package/dist/backend/jwks-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-service.d.ts","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5D;;;GAGG;AACH,MAAM,MAAM,UAAU,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;AAEvE;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,iDAAiD;IACjD,OAAO,EAAE,MAAM,CAAC;IAChB;;;;;;;;OAQG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB,sCAAsC;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAC;IACjB,6FAA6F;IAC7F,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;OAIG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,4CAA4C;IAC5C,GAAG,CAAC,EAAE,UAAU,CAAC;CAClB;AAeD;;;;;;GAMG;AACH,qBAAa,sBAAuB,SAAQ,KAAK;aAG7B,IAAI,EAAE,MAAM;gBAD5B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,MAAM;CAK/B;AAKD;;;;;;;;;;;;;;GAcG;AACH,qBAAa,WAAW;IAcV,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbnC,OAAO,CAAC,IAAI,CAAsD;IAClE,OAAO,CAAC,YAAY,CAAK;IAEzB,oFAAoF;IACpF,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAG/B;IAEJ,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAAS;IACjD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAa;gBAEJ,MAAM,EAAE,iBAAiB;IAOtD;;OAEG;IACH,OAAO,CAAC,UAAU;IAYlB;;;;OAIG;IACG,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;IAqBpD;;;;;;;;;;;;;;;;;OAiBG;IACG,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IA+BnF;;;OAGG;YACW,UAAU;IAwCxB,OAAO,CAAC,sBAAsB;IAe9B,OAAO,CAAC,kBAAkB;IAU1B;;OAEG;IACH,OAAO,CAAC,oBAAoB;CAqB7B"}

package/dist/backend/jwks-service.js

@@ -0,0 +1,216 @@
+import { createRemoteJWKSet, jwtVerify, errors as joseErrors } from 'jose';
+/**
+ * Error thrown on token verification failure.
+ *
+ * `code` is a stable, framework-agnostic discriminator:
+ * `TOKEN_EXPIRED` | `TOKEN_INVALID` | `JWKS_NO_MATCH` | `CLAIM_VALIDATION_FAILED`
+ * | `APP_MISMATCH` | `UNKNOWN_ERROR`.
+ */
+export class TokenVerificationError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'TokenVerificationError';
+    }
+}
+const DEFAULT_CACHE_TTL_MS = 60 * 60 * 1000; // 1 hour
+const DEFAULT_INTROSPECTION_CACHE_TTL_MS = 0; // disabled → instant revocation
+/**
+ * Framework-agnostic, Node-only Bridge token verification.
+ *
+ * Covers two paths:
+ *  - **User tokens** — verified locally via remote JWKS (asymmetric PS256;
+ *    issuer/audience validated). The verifier needs no secret, so offline
+ *    JWKS verification is the right tool.
+ *  - **API tokens** — verified via remote *introspection* (a POST to the
+ *    Bridge). API tokens are signed with the per-app HS256 secret which the
+ *    plugin never holds, so the secret-holder (the Bridge) is asked. This also
+ *    gives instant revocation. Successful results may be cached (off by
+ *    default; see `introspectionCacheTtlMs`).
+ *
+ * This is a plain class — NOT a DI provider. Framework plugins wrap it.
+ */
+export class JwksService {
+    config;
+    jwks = null;
+    jwksInitTime = 0;
+    /** token → { result, expiresAt(ms) }. Only successful introspections are cached. */
+    introspectionCache = new Map();
+    cacheTtlMs;
+    introspectionCacheTtlMs;
+    log;
+    constructor(config) {
+        this.config = config;
+        this.cacheTtlMs = config.cacheTtlMs ?? DEFAULT_CACHE_TTL_MS;
+        this.introspectionCacheTtlMs =
+            config.introspectionCacheTtlMs ?? DEFAULT_INTROSPECTION_CACHE_TTL_MS;
+        this.log = config.log ?? (() => { });
+    }
+    /**
+     * Initialize or refresh the user-token JWKS client.
+     */
+    ensureJwks() {
+        const now = Date.now();
+        if (!this.jwks || now - this.jwksInitTime > this.cacheTtlMs) {
+            this.log('Initializing JWKS client', { url: this.config.jwksUrl });
+            this.jwks = createRemoteJWKSet(new URL(this.config.jwksUrl));
+            this.jwksInitTime = now;
+        }
+        return this.jwks;
+    }
+    /**
+     * Verify a user JWT and return its claims.
+     *
+     * @throws {TokenVerificationError} if the token is invalid or expired.
+     */
+    async verifyToken(token) {
+        const jwks = this.ensureJwks();
+        try {
+            const { payload } = await jwtVerify(token, jwks, {
+                issuer: this.config.issuer,
+                audience: this.config.audience,
+            });
+            this.log('Token verified successfully', {
+                sub: payload.sub,
+                iss: payload.iss,
+                aud: payload.aud,
+            });
+            return payload;
+        }
+        catch (error) {
+            throw this.mapVerificationError(error, 'Token');
+        }
+    }
+    /**
+     * Verify a Bridge API token by introspecting it against the Bridge.
+     *
+     * Unlike user tokens, API tokens are signed with the per-app HS256 secret
+     * which this verifier does not hold — so it asks the secret-holder. The
+     * Bridge returns whether the token is active (signature valid AND backing
+     * record live: not revoked, not expired) plus its claims.
+     *
+     * The returned `{ active: false }` covers every rejection (forged, tampered,
+     * wrong type, revoked, expired) without distinguishing them — no information
+     * leak. App-scoping is then enforced here: the introspected `appId` must
+     * equal `expectedAppId`.
+     *
+     * @throws {TokenVerificationError}
+     *   - `TOKEN_INVALID` if the token is inactive or not an API token
+     *   - `APP_MISMATCH` if the token belongs to a different app
+     *   - `UNKNOWN_ERROR` if the introspection request itself fails
+     */
+    async verifyApiToken(token, expectedAppId) {
+        const introspection = await this.introspect(token);
+        if (!introspection.active) {
+            // Bridge already collapsed forged/tampered/revoked/expired → inactive.
+            throw new TokenVerificationError('Invalid token', 'TOKEN_INVALID');
+        }
+        if (introspection.type !== 'api') {
+            throw new TokenVerificationError('Wrong token type', 'TOKEN_INVALID');
+        }
+        if (introspection.appId !== expectedAppId) {
+            throw new TokenVerificationError('Token issued for a different app', 'APP_MISMATCH');
+        }
+        this.log('API token verified via introspection', {
+            sub: introspection.sub,
+            appId: introspection.appId,
+        });
+        return {
+            sub: introspection.sub,
+            appId: introspection.appId,
+            tenantId: introspection.tenantId ?? null,
+            type: 'api',
+            privileges: introspection.privileges ?? [],
+            ...(introspection.exp != null ? { exp: introspection.exp } : {}),
+        };
+    }
+    /**
+     * POST the token to the introspection endpoint, with optional short-lived
+     * caching of successful results (see `introspectionCacheTtlMs`).
+     */
+    async introspect(token) {
+        const cached = this.getCachedIntrospection(token);
+        if (cached) {
+            this.log('API token introspection cache hit');
+            return cached;
+        }
+        let response;
+        try {
+            response = await fetch(this.config.introspectionUrl, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ token }),
+            });
+        }
+        catch (error) {
+            this.log('API token introspection request failed', error);
+            throw new TokenVerificationError('Introspection request failed', 'UNKNOWN_ERROR');
+        }
+        if (!response.ok) {
+            this.log('API token introspection returned a non-OK status', {
+                status: response.status,
+            });
+            throw new TokenVerificationError('Introspection endpoint error', 'UNKNOWN_ERROR');
+        }
+        let body;
+        try {
+            body = (await response.json());
+        }
+        catch (error) {
+            this.log('API token introspection returned invalid JSON', error);
+            throw new TokenVerificationError('Introspection response invalid', 'UNKNOWN_ERROR');
+        }
+        if (body.active) {
+            this.cacheIntrospection(token, body);
+        }
+        return body;
+    }
+    getCachedIntrospection(token) {
+        if (this.introspectionCacheTtlMs <= 0) {
+            return null;
+        }
+        const entry = this.introspectionCache.get(token);
+        if (!entry) {
+            return null;
+        }
+        if (Date.now() >= entry.expiresAt) {
+            this.introspectionCache.delete(token);
+            return null;
+        }
+        return entry.result;
+    }
+    cacheIntrospection(token, result) {
+        if (this.introspectionCacheTtlMs <= 0) {
+            return;
+        }
+        this.introspectionCache.set(token, {
+            result,
+            expiresAt: Date.now() + this.introspectionCacheTtlMs,
+        });
+    }
+    /**
+     * Map a jose verification error to a stable TokenVerificationError.
+     */
+    mapVerificationError(error, label) {
+        if (error instanceof joseErrors.JWTExpired) {
+            this.log(`${label} verification failed: Token expired`);
+            return new TokenVerificationError('Token expired', 'TOKEN_EXPIRED');
+        }
+        if (error instanceof joseErrors.JWTInvalid) {
+            this.log(`${label} verification failed: Invalid token`);
+            return new TokenVerificationError('Invalid token', 'TOKEN_INVALID');
+        }
+        if (error instanceof joseErrors.JWKSNoMatchingKey) {
+            this.log(`${label} verification failed: No matching key in JWKS`);
+            return new TokenVerificationError('Invalid token signature', 'JWKS_NO_MATCH');
+        }
+        if (error instanceof joseErrors.JWTClaimValidationFailed) {
+            this.log(`${label} verification failed: Claim validation failed`, error.message);
+            return new TokenVerificationError('Token claim validation failed', 'CLAIM_VALIDATION_FAILED');
+        }
+        this.log(`${label} verification failed: Unknown error`, error);
+        return new TokenVerificationError('Token verification failed', 'UNKNOWN_ERROR');
+    }
+}
+//# sourceMappingURL=jwks-service.js.map

package/dist/backend/jwks-service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks-service.js","sourceRoot":"","sources":["../../src/backend/jwks-service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,IAAI,UAAU,EAAE,MAAM,MAAM,CAAC;AA0D3E;;;;;;GAMG;AACH,MAAM,OAAO,sBAAuB,SAAQ,KAAK;IAG7B;IAFlB,YACE,OAAe,EACC,IAAY;QAE5B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,SAAI,GAAJ,IAAI,CAAQ;QAG5B,IAAI,CAAC,IAAI,GAAG,wBAAwB,CAAC;IACvC,CAAC;CACF;AAED,MAAM,oBAAoB,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,SAAS;AACtD,MAAM,kCAAkC,GAAG,CAAC,CAAC,CAAC,gCAAgC;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,WAAW;IAcO;IAbrB,IAAI,GAAiD,IAAI,CAAC;IAC1D,YAAY,GAAG,CAAC,CAAC;IAEzB,oFAAoF;IACnE,kBAAkB,GAAG,IAAI,GAAG,EAG1C,CAAC;IAEa,UAAU,CAAS;IACnB,uBAAuB,CAAS;IAChC,GAAG,CAAa;IAEjC,YAA6B,MAAyB;QAAzB,WAAM,GAAN,MAAM,CAAmB;QACpD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,oBAAoB,CAAC;QAC5D,IAAI,CAAC,uBAAuB;YAC1B,MAAM,CAAC,uBAAuB,IAAI,kCAAkC,CAAC;QACvE,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IACtC,CAAC;IAED;;OAEG;IACK,UAAU;QAChB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;YAC5D,IAAI,CAAC,GAAG,CAAC,0BAA0B,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,IAAI,CAAC,YAAY,GAAG,GAAG,CAAC;QAC1B,CAAC;QAED,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,KAAa;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;QAE/B,IAAI,CAAC;YACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;gBAC/C,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;gBAC1B,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;aAC/B,CAAC,CAAC;YAEH,IAAI,CAAC,GAAG,CAAC,6BAA6B,EAAE;gBACtC,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;aACjB,CAAC,CAAC;YAEH,OAAO,OAAoB,CAAC;QAC9B,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,aAAqB;QACvD,MAAM,aAAa,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAEnD,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;YAC1B,uEAAuE;YACvE,MAAM,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACrE,CAAC;QAED,IAAI,aAAa,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACjC,MAAM,IAAI,sBAAsB,CAAC,kBAAkB,EAAE,eAAe,CAAC,CAAC;QACxE,CAAC;QAED,IAAI,aAAa,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;YAC1C,MAAM,IAAI,sBAAsB,CAAC,kCAAkC,EAAE,cAAc,CAAC,CAAC;QACvF,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,sCAAsC,EAAE;YAC/C,GAAG,EAAE,aAAa,CAAC,GAAG;YACtB,KAAK,EAAE,aAAa,CAAC,KAAK;SAC3B,CAAC,CAAC;QAEH,OAAO;YACL,GAAG,EAAE,aAAa,CAAC,GAAa;YAChC,KAAK,EAAE,aAAa,CAAC,KAAe;YACpC,QAAQ,EAAE,aAAa,CAAC,QAAQ,IAAI,IAAI;YACxC,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,aAAa,CAAC,UAAU,IAAI,EAAE;YAC1C,GAAG,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,aAAa,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/C,CAAC;IACtB,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,UAAU,CAAC,KAAa;QACpC,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAClD,IAAI,MAAM,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC;YAC9C,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE;gBACnD,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;aAChC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,wCAAwC,EAAE,KAAK,CAAC,CAAC;YAC1D,MAAM,IAAI,sBAAsB,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,GAAG,CAAC,kDAAkD,EAAE;gBAC3D,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC,CAAC;YACH,MAAM,IAAI,sBAAsB,CAAC,8BAA8B,EAAE,eAAe,CAAC,CAAC;QACpF,CAAC;QAED,IAAI,IAA2B,CAAC;QAChC,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;QAC1D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,GAAG,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YACjE,MAAM,IAAI,sBAAsB,CAAC,gCAAgC,EAAE,eAAe,CAAC,CAAC;QACtF,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,IAAI,CAAC,kBAAkB,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,sBAAsB,CAAC,KAAa;QAC1C,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC,MAAM,CAAC;IACtB,CAAC;IAEO,kBAAkB,CAAC,KAAa,EAAE,MAA6B;QACrE,IAAI,IAAI,CAAC,uBAAuB,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO;QACT,CAAC;QACD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,KAAK,EAAE;YACjC,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,uBAAuB;SACrD,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACK,oBAAoB,CAAC,KAAc,EAAE,KAAa;QACxD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,UAAU,EAAE,CAAC;YAC3C,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,CAAC,CAAC;YACxD,OAAO,IAAI,sBAAsB,CAAC,eAAe,EAAE,eAAe,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,iBAAiB,EAAE,CAAC;YAClD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,CAAC,CAAC;YAClE,OAAO,IAAI,sBAAsB,CAAC,yBAAyB,EAAE,eAAe,CAAC,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,YAAY,UAAU,CAAC,wBAAwB,EAAE,CAAC;YACzD,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,+CAA+C,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;YAC5F,OAAO,IAAI,sBAAsB,CAAC,+BAA+B,EAAE,yBAAyB,CAAC,CAAC;QAChG,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,qCAAqC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,IAAI,sBAAsB,CAAC,2BAA2B,EAAE,eAAe,CAAC,CAAC;IAClF,CAAC;CACF"}

package/dist/backend/types.d.ts

@@ -0,0 +1,119 @@
+/**
+ * Backend (Node-only) auth types.
+ *
+ * Framework-agnostic. No NestJS, no browser/storage APIs. These are the shapes
+ * shared by every server-side Bridge plugin (bridge-nestjs today; others later)
+ * for JWT verification and user extraction.
+ *
+ * NOTE on `JwtClaims` vs `IDToken` (in ../types.ts): `IDToken` is the strict
+ * OIDC id_token payload used by the browser SDK to build a `Profile`. `JwtClaims`
+ * here is the permissive *access-token* claim set the server verifies via JWKS —
+ * it carries short-form tenant/app claims (`tid`/`aid`), `privileges`, `role`,
+ * and the registered JWT claims (`iss`/`aud`/`exp`/...). They intentionally stay
+ * separate: different tokens, different consumers.
+ */
+/**
+ * Raw JWT claims from a Bridge access/ID token (the verified payload).
+ */
+export interface JwtClaims {
+    /** Subject (user ID) */
+    sub: string;
+    /** Preferred username */
+    preferred_username?: string;
+    /** Email address */
+    email?: string;
+    /** Email verified flag */
+    email_verified?: boolean;
+    /** Full name */
+    name?: string;
+    /** Given name */
+    given_name?: string;
+    /** Family name */
+    family_name?: string;
+    /** Locale */
+    locale?: string;
+    /** User onboarded flag */
+    onboarded?: boolean;
+    /** Multi-tenant flag */
+    multi_tenant?: boolean;
+    /** Tenant ID (long form) */
+    tenant_id?: string;
+    /** Tenant ID (short form) */
+    tid?: string;
+    /** App ID (short form) */
+    aid?: string;
+    /** Scope */
+    scope?: string;
+    /** Tenant name */
+    tenant_name?: string;
+    /** Tenant locale */
+    tenant_locale?: string;
+    /** Tenant logo URL */
+    tenant_logo?: string;
+    /** Tenant onboarded flag */
+    tenant_onboarded?: boolean;
+    /** User's role */
+    role?: string;
+    /** User privilege strings (custom claim) */
+    privileges?: string[];
+    /** Token issuer */
+    iss?: string;
+    /** Token audience */
+    aud?: string | string[];
+    /** Expiration time */
+    exp?: number;
+    /** Not before time */
+    nbf?: number;
+    /** Issued at time */
+    iat?: number;
+}
+/**
+ * Authenticated user extracted from a verified JWT access token.
+ */
+export interface BridgeUser {
+    /** User ID (sub claim) */
+    id: string;
+    /** User's email address */
+    email: string;
+    /** Whether email is verified */
+    emailVerified: boolean;
+    /** Username (preferred_username claim) */
+    username: string;
+    /** Full display name */
+    fullName: string;
+    /** Given/first name */
+    givenName?: string;
+    /** Family/last name */
+    familyName?: string;
+    /** User's locale preference */
+    locale?: string;
+    /** Whether user has completed onboarding */
+    onboarded?: boolean;
+    /** Tenant/workspace ID the user is authenticated for */
+    tenantId: string;
+    /** App ID from the token (aid claim) */
+    appId?: string;
+    /** OAuth scopes granted to the token */
+    scope?: string;
+    /** User's role within the tenant */
+    role?: string;
+    /** Whether user has multi-tenant access */
+    multiTenantAccess?: boolean;
+    /** Privilege strings from the JWT `privileges` claim (e.g. ['AUTHENTICATED', 'USER_READ']) */
+    privileges?: string[];
+}
+/**
+ * Claims present in a Bridge API token JWT (the `x-api-key` machine credential).
+ */
+export interface ApiTokenClaims extends JwtClaims {
+    sub: string;
+    appId: string;
+    tenantId: string | null;
+    type: 'api';
+    privileges: string[];
+}
+/**
+ * Transform raw JWT claims into a BridgeUser.
+ */
+export declare function transformJwtToBridgeUser(claims: JwtClaims): BridgeUser;
+//# sourceMappingURL=types.d.ts.map

package/dist/backend/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/backend/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH;;GAEG;AACH,MAAM,WAAW,SAAS;IACxB,wBAAwB;IACxB,GAAG,EAAE,MAAM,CAAC;IACZ,yBAAyB;IACzB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,0BAA0B;IAC1B,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,gBAAgB;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iBAAiB;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,0BAA0B;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wBAAwB;IACxB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,4BAA4B;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,6BAA6B;IAC7B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,0BAA0B;IAC1B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kBAAkB;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,sBAAsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,4BAA4B;IAC5B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,kBAAkB;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,4CAA4C;IAC5C,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,mBAAmB;IACnB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IACxB,sBAAsB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,sBAAsB;IACtB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,qBAAqB;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,UAAU;IACzB,0BAA0B;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,2BAA2B;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,gCAAgC;IAChC,aAAa,EAAE,OAAO,CAAC;IACvB,0CAA0C;IAC1C,QAAQ,EAAE,MAAM,CAAC;IACjB,wBAAwB;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,uBAAuB;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,uBAAuB;IACvB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,+BAA+B;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,wDAAwD;IACxD,QAAQ,EAAE,MAAM,CAAC;IACjB,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wCAAwC;IACxC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oCAAoC;IACpC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,2CAA2C;IAC3C,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,8FAA8F;IAC9F,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,cAAe,SAAQ,SAAS;IAC/C,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,EAAE,KAAK,CAAC;IACZ,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED;;GAEG;AACH,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAkBtE"}

package/dist/backend/types.js

@@ -0,0 +1,37 @@
+/**
+ * Backend (Node-only) auth types.
+ *
+ * Framework-agnostic. No NestJS, no browser/storage APIs. These are the shapes
+ * shared by every server-side Bridge plugin (bridge-nestjs today; others later)
+ * for JWT verification and user extraction.
+ *
+ * NOTE on `JwtClaims` vs `IDToken` (in ../types.ts): `IDToken` is the strict
+ * OIDC id_token payload used by the browser SDK to build a `Profile`. `JwtClaims`
+ * here is the permissive *access-token* claim set the server verifies via JWKS —
+ * it carries short-form tenant/app claims (`tid`/`aid`), `privileges`, `role`,
+ * and the registered JWT claims (`iss`/`aud`/`exp`/...). They intentionally stay
+ * separate: different tokens, different consumers.
+ */
+/**
+ * Transform raw JWT claims into a BridgeUser.
+ */
+export function transformJwtToBridgeUser(claims) {
+    return {
+        id: claims.sub,
+        email: claims.email || '',
+        emailVerified: claims.email_verified || false,
+        username: claims.preferred_username || claims.email || '',
+        fullName: claims.name || '',
+        givenName: claims.given_name,
+        familyName: claims.family_name,
+        locale: claims.locale,
+        onboarded: claims.onboarded,
+        tenantId: claims.tid || claims.tenant_id || '',
+        appId: claims.aid,
+        scope: claims.scope,
+        role: claims.role,
+        multiTenantAccess: claims.multi_tenant,
+        privileges: claims.privileges,
+    };
+}
+//# sourceMappingURL=types.js.map

package/dist/backend/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/backend/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAyGH;;GAEG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAiB;IACxD,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,GAAG;QACd,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,aAAa,EAAE,MAAM,CAAC,cAAc,IAAI,KAAK;QAC7C,QAAQ,EAAE,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE;QACzD,QAAQ,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QAC3B,SAAS,EAAE,MAAM,CAAC,UAAU;QAC5B,UAAU,EAAE,MAAM,CAAC,WAAW;QAC9B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,SAAS,IAAI,EAAE;QAC9C,KAAK,EAAE,MAAM,CAAC,GAAG;QACjB,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,iBAAiB,EAAE,MAAM,CAAC,YAAY;QACtC,UAAU,EAAE,MAAM,CAAC,UAAU;KAC9B,CAAC;AACJ,CAAC"}

package/dist/billing/quota-store.d.ts

@@ -22,6 +22,26 @@ export interface QuotaSnapshot {
     warningLevel: null | 'approaching' | 'critical';
     /** Display label. US-11 uses the raw metric key; framework wrappers can override. */
     label: string;
+    /**
+     * TBP-275 — per-unit price for a metered quota (whole currency units, e.g.
+     * 0.002). Absent for `hard` quotas and for metered quotas with no price yet.
+     */
+    unitAmount?: number;
+    /** TBP-275 — currency of `unitAmount` / `overageEstimate` (ISO code). */
+    currency?: string;
+    /**
+     * TBP-275 — estimated overage cost accrued this period, in `currency` units.
+     * Server-computed: `max(0, used - limit) * unitAmount` (or `used * unitAmount`
+     * when `limit === 0`). Lets the UI show "~$1.00 estimated" without waiting for
+     * a Stripe invoice.
+     */
+    overageEstimate?: number;
+    /**
+     * TBP-275 — true once usage has passed the included allotment (metered billing
+     * engaged). Prefer this over a UI-derived `used > limit` so the server stays
+     * authoritative (handles `limit === 0` pure-per-unit correctly).
+     */
+    overcap?: boolean;
 }
 type Listener = (metric: string, snap: QuotaSnapshot | undefined) => void;
 interface MountOptions {