@nexartis/sentinel-sdk 1.9.2 → 1.10.0

package/README.md

@@ -1,7 +1,7 @@
 # @nexartis/sentinel-sdk
 
 [![npm version](https://img.shields.io/npm/v/@nexartis/sentinel-sdk.svg)](https://www.npmjs.com/package/@nexartis/sentinel-sdk)
-[![License: Apache 2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
+[![License: Apache-2.0](https://img.shields.io/badge/License-Apache_2.0-blue.svg)](./LICENSE)
 [![Node](https://img.shields.io/node/v/@nexartis/sentinel-sdk.svg)](https://nodejs.org)
 
 > **Passwordless, magic-link authentication for SvelteKit.** A batteries-included client SDK for the hosted Nexartis **Sentinel** auth backend — five lines in `hooks.server.ts`, three lines in your auth route, and you're done.
@@ -14,6 +14,7 @@ Sentinel is a passwordless authentication service: users sign in with a one-time
 
 - [What you get](#what-you-get)
 - [Security: signature verification](#security-signature-verification)
+- [Consumers](#consumers)
 - [Install](#install)
 - [Configure](#configure)
 - [Quickstart](#quickstart)
@@ -53,11 +54,14 @@ downstream authorization gates.
   rejected outright.
 - Since **1.9.2**, signed claims must match the backend's current exact
   `iss: "nexartis"`, `aud: "nexartis"` tuple. Subject, email and JTI must be
-  nonempty strings; roles must be an array of strings. `iat`, `exp`, and
+  nonempty strings. `roles` is now OPTIONAL: a post-TRUSTIP-147 identity token
+  omits the claim (the SDK defaults it to `[]`) and instead carries
+  `platform_admin` (boolean, surfaced as `platformAdmin`). `iat`, `exp`, and
   optional `nbf` must be finite nonnegative seconds (including fractional
   seconds) with bounded millisecond conversion. Expired tokens and tokens before `nbf` are rejected.
 - Valid verifier outcomes return only the qualified issuer, audience, subject,
-  email, roles, JTI and NumericDate claims. Unqualified additional claims do not
+  email, roles (defaulted to `[]` when the token omits the claim),
+  `platform_admin`, JTI and NumericDate claims. Unqualified additional claims do not
   acquire tenant, client, membership, or human-presence semantics.
   `DecodedToken` and `decodeTokenLocally` alone are **not** verification evidence.
 - Local JWKS verification **does not query backend JTI revocation**, current
@@ -85,6 +89,22 @@ release closes.
 
 ---
 
+## Consumers
+
+The downstream consumers of this SDK are enumerated in
+[`consumers.json`](./consumers.json) and [`docs/CONSUMERS.md`](./docs/CONSUMERS.md),
+together with the **`1.8.0` version floor** — the first line that verifies
+signatures, so no in-scope consumer may resolve below it.
+
+- `pnpm run gate:consumers` (also part of `pnpm run validate`) fails closed when
+  an in-scope consumer resolves below the floor; CI runs it across the fleet in
+  [`.github/workflows/consumer-version-floor.yml`](./.github/workflows/consumer-version-floor.yml).
+- Every consumer must ship a **fail-closed forged-cookie test** that drives the
+  real handle with a real Ed25519 signature — not a mock. See
+  [`docs/CONSUMERS.md#fail-closed-forged-cookie-test`](./docs/CONSUMERS.md#fail-closed-forged-cookie-test).
+
+---
+
 ## Install
 
 ```bash
@@ -114,9 +134,13 @@ The SDK does not bake in any backend URL. Every request is directed at the URL *
 
 Expose them via SvelteKit environment (`$env/static/private` for `apiUrl`, `$env/static/public` for the browser-visible base URL) and pass them into `createSentinelHandle` as top-level `apiUrl` / `baseUrl` options. `createAuthHandlers` reads `SENTINEL_API_URL` plus `VITE_BASE_URL` or `PUBLIC_BASE_URL` from `event.platform.env` (Workers) and falls back to the same process env names on Node / `adapter-node`.
 
+### Environment contract
+
+The fleet standardises on a **single** env name per environment: `SENTINEL_API_URL`, whose value carries the `/api` suffix (prod `https://sentinel.ocmeregistry.com/api`, dev `https://dev-sentinel.ocmeregistry.com/api`). The SDK reads only that name — the legacy `VITE_SENTINEL_API_URL` alias is **not** read — and there is **no** hardcoded fallback: a missing value fails loud with `SENTINEL_API_URL must be configured`.
+
 ```bash
 # .env
-SENTINEL_API_URL="https://auth.example.com"
+SENTINEL_API_URL="https://auth.example.com/api"
 PUBLIC_BASE_URL="https://app.example.com"
 ```
 
@@ -140,7 +164,7 @@ export const handle = createSentinelHandle({
 });
 ```
 
-After this hook runs, `event.locals.user` is populated on every request with `{ isAuthenticated, id, email, roles }`.
+After this hook runs, `event.locals.user` is populated on every request with `{ isAuthenticated, id, email, roles, platformAdmin }`.
 
 ### 2. Mount the auth API
 
@@ -247,7 +271,7 @@ Either way, this SDK is fully self-service and works against any Sentinel-compat
 | Framework-agnostic core | ✅ Use anywhere — Node, Bun, Cloudflare Workers, browsers |
 | Next.js / Remix / Nuxt / SolidStart | Roadmap — core is designed to make new adapters straightforward |
 
-Contributions of new adapters are welcome under the same Apache-2.0 license.
+Contributions of new adapters are welcome; see [`CONTRIBUTING.md`](./CONTRIBUTING.md) for the contribution terms.
 
 ---
 
@@ -259,6 +283,6 @@ This SDK follows [Semantic Versioning](https://semver.org/) and a strict **never
 
 ## License
 
-Licensed under the [Apache License 2.0](./LICENSE). Copyright © Nexartis LLC.
+Licensed under the Apache License, Version 2.0 — see [`LICENSE`](./LICENSE) and [`NOTICE`](./NOTICE). Copyright © Nexartis, LLC. All Rights Reserved.
 
-You may use, modify, and redistribute this SDK freely in commercial and non-commercial projects. The Sentinel hosted backend is a separate service governed by its own terms — see <https://cubicube.com>.
+This SDK is a deliberately public, permissively licensed package distributed under the Apache License, Version 2.0. The Sentinel hosted backend is a separate service governed by its own terms — see <https://cubicube.com>.

package/dist/core/auth-utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../../src/core/auth-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsBpF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,UAAU,CAAC,KAAK,EAChC,MAAM,EAAE,cAAc,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAwB9B;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAyBrE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,GAAE,MAAW,GAAG,OAAO,CAkBjF"}
+{"version":3,"file":"auth-utils.d.ts","sourceRoot":"","sources":["../../src/core/auth-utils.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAuB,YAAY,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAsCpF;;;;;;GAMG;AACH,wBAAsB,aAAa,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,OAAO,UAAU,CAAC,KAAK,EAChC,MAAM,EAAE,cAAc,GACpB,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC,CAwB9B;AAiBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CA8BrE;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,aAAa,GAAE,MAAW,GAAG,OAAO,CAkBjF"}

package/dist/core/auth-utils.js

@@ -11,7 +11,22 @@ function hydrateTokenFromCurrentUser(payload, profile) {
         ...payload,
         sub: typeof profile.id === 'string' && profile.id.length > 0 ? profile.id : payload.sub,
         email: typeof profile.email === 'string' && profile.email.length > 0 ? profile.email : payload.email,
-        roles: roles.length > 0 ? roles : payload.roles
+        roles: roles.length > 0 ? roles : Array.isArray(payload.roles) ? payload.roles : []
+    };
+}
+/**
+ * Normalize `roles` to a defined array on EVERY return path.
+ *
+ * TRUSTIP-147 removed the `roles` claim from the identity token, so a decoded
+ * payload may arrive without `roles`. Existing JavaScript consumers rely on the
+ * previous defined-array contract (e.g. `result.roles.includes(...)`), so an
+ * absent array must never leak out of `validateToken()` — it is normalized to
+ * `[]` rather than exposing `undefined`.
+ */
+function normalizeDecodedRoles(payload) {
+    return {
+        ...payload,
+        roles: Array.isArray(payload.roles) ? payload.roles : []
     };
 }
 /**
@@ -28,14 +43,14 @@ export async function validateToken(accessToken, fetchFn, config) {
         if (result.code === 0 && result.valid && result.payload) {
             const payload = result.payload;
             if (config.hydrateUserProfile !== true) {
-                return payload;
+                return normalizeDecodedRoles(payload);
             }
             try {
                 const currentUser = await sentinel.getCurrentUser(accessToken);
                 return hydrateTokenFromCurrentUser(payload, currentUser);
             }
             catch {
-                return payload;
+                return normalizeDecodedRoles(payload);
             }
         }
         return null;
@@ -92,7 +107,12 @@ export function decodeTokenLocally(token) {
         return {
             sub: payload.sub,
             email: payload.email,
+            // TRUSTIP-147: `roles` is optional on post-cutover tokens; surface a
+            // defined array either way.
             roles: Array.isArray(payload.roles) ? payload.roles.filter((r) => typeof r === 'string') : [],
+            // Carry the identity-only admin flag through the local-decode path so
+            // `platformAdmin` is populated wherever locals.user is built.
+            ...(typeof payload.platform_admin === 'boolean' ? { platform_admin: payload.platform_admin } : {}),
             exp: payload.exp,
             iat: payload.iat
         };

package/dist/core/auth-utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-utils.js","sourceRoot":"","sources":["../../src/core/auth-utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,cAAc,CAAC,OAA4B;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAqB,EAAE,OAA4B;IACvF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,OAAO;QACN,GAAG,OAAO;QACV,GAAG,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACvF,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QACpG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;KAC/C,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,WAAmB,EACnB,OAAgC,EAChC,MAAsB;IAEtB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuB,CAAC;YAC/C,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACxC,OAAO,OAAO,CAAC;YAChB,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAC/D,OAAO,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,OAAO,CAAC;YAChB,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAW;IACnC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG;QAAE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACvC,iEAAiE;IACjE,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,kFAAkF;QAClF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,8DAA8D;QAC9D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,OAAO;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACnH,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,gBAAwB,EAAE;IACvE,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QAEtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAClD,CAAC;AACF,CAAC","sourcesContent":["// src/core/auth-utils.ts\nimport type { CurrentUserResponse, DecodedToken, SentinelConfig } from './types.js';\nimport { SentinelClient } from './client.js';\n\nfunction normalizeRoles(profile: CurrentUserResponse): string[] {\n\tif (Array.isArray(profile.roles)) {\n\t\treturn profile.roles.filter((role): role is string => typeof role === 'string' && role.length > 0);\n\t}\n\n\treturn typeof profile.role === 'string' && profile.role.length > 0 ? [profile.role] : [];\n}\n\nfunction hydrateTokenFromCurrentUser(payload: DecodedToken, profile: CurrentUserResponse): DecodedToken {\n\tconst roles = normalizeRoles(profile);\n\n\treturn {\n\t\t...payload,\n\t\tsub: typeof profile.id === 'string' && profile.id.length > 0 ? profile.id : payload.sub,\n\t\temail: typeof profile.email === 'string' && profile.email.length > 0 ? profile.email : payload.email,\n\t\troles: roles.length > 0 ? roles : payload.roles\n\t};\n}\n\n/**\n * Validates a JWT access token using Sentinel API\n * @param accessToken - The JWT access token to validate\n * @param fetchFn - Fetch function (for server-side requests)\n * @param config - Sentinel configuration\n * @returns Decoded token data if valid, null if invalid\n */\nexport async function validateToken(\n\taccessToken: string,\n\tfetchFn: typeof globalThis.fetch,\n\tconfig: SentinelConfig\n): Promise<DecodedToken | null> {\n\ttry {\n\t\tconst sentinel = new SentinelClient(config, fetchFn);\n\t\tconst result = await sentinel.validateToken(accessToken);\n\n\t\tif (result.code === 0 && result.valid && result.payload) {\n\t\t\tconst payload = result.payload as DecodedToken;\n\t\t\tif (config.hydrateUserProfile !== true) {\n\t\t\t\treturn payload;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst currentUser = await sentinel.getCurrentUser(accessToken);\n\t\t\t\treturn hydrateTokenFromCurrentUser(payload, currentUser);\n\t\t\t} catch {\n\t\t\t\treturn payload;\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t} catch (error) {\n\t\tconsole.error('Token validation error:', error);\n\t\treturn null;\n\t}\n}\n\n/**\n * Decode a base64url-encoded string (JWT standard encoding).\n * Converts base64url → base64, adds padding, then decodes.\n */\nfunction base64UrlDecode(str: string): string {\n\tlet base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n\tconst pad = base64.length % 4;\n\tif (pad) base64 += '='.repeat(4 - pad);\n\t// Decode via Uint8Array + TextDecoder for proper UTF-8 handling.\n\t// atob() returns a binary string that corrupts multi-byte characters.\n\tconst binary = atob(base64);\n\tconst bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));\n\treturn new TextDecoder('utf-8').decode(bytes);\n}\n\n/**\n * Decode JWT payload locally without API validation.\n * Used for per-request user extraction after local expiry check passes.\n *\n * Security model: tokens live in httpOnly/secure cookies and are validated\n * by the Sentinel API at issuance (claim) and refresh. The per-request\n * decode simply extracts the already-validated user info. A structurally\n * invalid or expired token falls through to the refresh path which does\n * a full API-validated exchange.\n *\n * @param token - JWT access token\n * @returns Decoded token payload if structurally valid and has required fields, null otherwise\n */\nexport function decodeTokenLocally(token: string): DecodedToken | null {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 3) return null;\n\n\t\tconst payload = JSON.parse(base64UrlDecode(parts[1]));\n\n\t\t// Require sub and email to be strings (not just truthy) per DecodedToken contract\n\t\tif (typeof payload.sub !== 'string' || !payload.sub) return null;\n\t\tif (typeof payload.email !== 'string' || !payload.email) return null;\n\t\tif (typeof payload.exp !== 'number' || isNaN(payload.exp)) return null;\n\n\t\t// Validate iat is numeric (required by DecodedToken contract)\n\t\tif (typeof payload.iat !== 'number' || isNaN(payload.iat)) return null;\n\n\t\treturn {\n\t\t\tsub: payload.sub,\n\t\t\temail: payload.email,\n\t\t\troles: Array.isArray(payload.roles) ? payload.roles.filter((r: unknown): r is string => typeof r === 'string') : [],\n\t\t\texp: payload.exp,\n\t\t\tiat: payload.iat\n\t\t};\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Check token expiration locally (saves API call)\n * @param token - JWT token to check\n * @param bufferSeconds - Seconds before actual expiry to consider expired (default: 30)\n * @returns true if token is expired or will expire within buffer, false otherwise\n */\nexport function isTokenExpired(token: string, bufferSeconds: number = 30): boolean {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 3) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst payload = JSON.parse(base64UrlDecode(parts[1]));\n\t\tif (typeof payload.exp !== 'number' || isNaN(payload.exp)) {\n\t\t\treturn true;\n\t\t}\n\t\tconst expiresAt = payload.exp * 1000;\n\t\tconst bufferMs = bufferSeconds * 1000;\n\n\t\treturn Date.now() >= expiresAt - bufferMs;\n\t} catch {\n\t\treturn true; // Treat malformed tokens as expired\n\t}\n}\n\n"]}
+{"version":3,"file":"auth-utils.js","sourceRoot":"","sources":["../../src/core/auth-utils.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,SAAS,cAAc,CAAC,OAA4B;IACnD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpG,CAAC;IAED,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,2BAA2B,CAAC,OAAqB,EAAE,OAA4B;IACvF,MAAM,KAAK,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAEtC,OAAO;QACN,GAAG,OAAO;QACV,GAAG,EAAE,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG;QACvF,KAAK,EAAE,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK;QACpG,KAAK,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACnF,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAAC,OAAqB;IACnD,OAAO;QACN,GAAG,OAAO;QACV,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;KACxD,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAClC,WAAmB,EACnB,OAAgC,EAChC,MAAsB;IAEtB,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,IAAI,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;QAEzD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAuB,CAAC;YAC/C,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;gBACxC,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;gBAC/D,OAAO,2BAA2B,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1D,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,qBAAqB,CAAC,OAAO,CAAC,CAAC;YACvC,CAAC;QACF,CAAC;QAED,OAAO,IAAI,CAAC;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,KAAK,CAAC,CAAC;QAChD,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;GAGG;AACH,SAAS,eAAe,CAAC,GAAW;IACnC,IAAI,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC;IAC9B,IAAI,GAAG;QAAE,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;IACvC,iEAAiE;IACjE,sEAAsE;IACtE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9D,OAAO,IAAI,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC/C,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAEpC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEtD,kFAAkF;QAClF,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG;YAAE,OAAO,IAAI,CAAC;QACjE,IAAI,OAAO,OAAO,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC;QACrE,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,8DAA8D;QAC9D,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QAEvE,OAAO;YACN,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,qEAAqE;YACrE,4BAA4B;YAC5B,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE;YACnH,sEAAsE;YACtE,8DAA8D;YAC9D,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClG,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,GAAG,EAAE,OAAO,CAAC,GAAG;SAChB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,gBAAwB,EAAE;IACvE,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACxB,OAAO,IAAI,CAAC;QACb,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3D,OAAO,IAAI,CAAC;QACb,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC;QACrC,MAAM,QAAQ,GAAG,aAAa,GAAG,IAAI,CAAC;QAEtC,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC,CAAC,oCAAoC;IAClD,CAAC;AACF,CAAC","sourcesContent":["// src/core/auth-utils.ts\nimport type { CurrentUserResponse, DecodedToken, SentinelConfig } from './types.js';\nimport { SentinelClient } from './client.js';\n\nfunction normalizeRoles(profile: CurrentUserResponse): string[] {\n\tif (Array.isArray(profile.roles)) {\n\t\treturn profile.roles.filter((role): role is string => typeof role === 'string' && role.length > 0);\n\t}\n\n\treturn typeof profile.role === 'string' && profile.role.length > 0 ? [profile.role] : [];\n}\n\nfunction hydrateTokenFromCurrentUser(payload: DecodedToken, profile: CurrentUserResponse): DecodedToken {\n\tconst roles = normalizeRoles(profile);\n\n\treturn {\n\t\t...payload,\n\t\tsub: typeof profile.id === 'string' && profile.id.length > 0 ? profile.id : payload.sub,\n\t\temail: typeof profile.email === 'string' && profile.email.length > 0 ? profile.email : payload.email,\n\t\troles: roles.length > 0 ? roles : Array.isArray(payload.roles) ? payload.roles : []\n\t};\n}\n\n/**\n * Normalize `roles` to a defined array on EVERY return path.\n *\n * TRUSTIP-147 removed the `roles` claim from the identity token, so a decoded\n * payload may arrive without `roles`. Existing JavaScript consumers rely on the\n * previous defined-array contract (e.g. `result.roles.includes(...)`), so an\n * absent array must never leak out of `validateToken()` — it is normalized to\n * `[]` rather than exposing `undefined`.\n */\nfunction normalizeDecodedRoles(payload: DecodedToken): DecodedToken {\n\treturn {\n\t\t...payload,\n\t\troles: Array.isArray(payload.roles) ? payload.roles : []\n\t};\n}\n\n/**\n * Validates a JWT access token using Sentinel API\n * @param accessToken - The JWT access token to validate\n * @param fetchFn - Fetch function (for server-side requests)\n * @param config - Sentinel configuration\n * @returns Decoded token data if valid, null if invalid\n */\nexport async function validateToken(\n\taccessToken: string,\n\tfetchFn: typeof globalThis.fetch,\n\tconfig: SentinelConfig\n): Promise<DecodedToken | null> {\n\ttry {\n\t\tconst sentinel = new SentinelClient(config, fetchFn);\n\t\tconst result = await sentinel.validateToken(accessToken);\n\n\t\tif (result.code === 0 && result.valid && result.payload) {\n\t\t\tconst payload = result.payload as DecodedToken;\n\t\t\tif (config.hydrateUserProfile !== true) {\n\t\t\t\treturn normalizeDecodedRoles(payload);\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst currentUser = await sentinel.getCurrentUser(accessToken);\n\t\t\t\treturn hydrateTokenFromCurrentUser(payload, currentUser);\n\t\t\t} catch {\n\t\t\t\treturn normalizeDecodedRoles(payload);\n\t\t\t}\n\t\t}\n\n\t\treturn null;\n\t} catch (error) {\n\t\tconsole.error('Token validation error:', error);\n\t\treturn null;\n\t}\n}\n\n/**\n * Decode a base64url-encoded string (JWT standard encoding).\n * Converts base64url → base64, adds padding, then decodes.\n */\nfunction base64UrlDecode(str: string): string {\n\tlet base64 = str.replace(/-/g, '+').replace(/_/g, '/');\n\tconst pad = base64.length % 4;\n\tif (pad) base64 += '='.repeat(4 - pad);\n\t// Decode via Uint8Array + TextDecoder for proper UTF-8 handling.\n\t// atob() returns a binary string that corrupts multi-byte characters.\n\tconst binary = atob(base64);\n\tconst bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));\n\treturn new TextDecoder('utf-8').decode(bytes);\n}\n\n/**\n * Decode JWT payload locally without API validation.\n * Used for per-request user extraction after local expiry check passes.\n *\n * Security model: tokens live in httpOnly/secure cookies and are validated\n * by the Sentinel API at issuance (claim) and refresh. The per-request\n * decode simply extracts the already-validated user info. A structurally\n * invalid or expired token falls through to the refresh path which does\n * a full API-validated exchange.\n *\n * @param token - JWT access token\n * @returns Decoded token payload if structurally valid and has required fields, null otherwise\n */\nexport function decodeTokenLocally(token: string): DecodedToken | null {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 3) return null;\n\n\t\tconst payload = JSON.parse(base64UrlDecode(parts[1]));\n\n\t\t// Require sub and email to be strings (not just truthy) per DecodedToken contract\n\t\tif (typeof payload.sub !== 'string' || !payload.sub) return null;\n\t\tif (typeof payload.email !== 'string' || !payload.email) return null;\n\t\tif (typeof payload.exp !== 'number' || isNaN(payload.exp)) return null;\n\n\t\t// Validate iat is numeric (required by DecodedToken contract)\n\t\tif (typeof payload.iat !== 'number' || isNaN(payload.iat)) return null;\n\n\t\treturn {\n\t\t\tsub: payload.sub,\n\t\t\temail: payload.email,\n\t\t\t// TRUSTIP-147: `roles` is optional on post-cutover tokens; surface a\n\t\t\t// defined array either way.\n\t\t\troles: Array.isArray(payload.roles) ? payload.roles.filter((r: unknown): r is string => typeof r === 'string') : [],\n\t\t\t// Carry the identity-only admin flag through the local-decode path so\n\t\t\t// `platformAdmin` is populated wherever locals.user is built.\n\t\t\t...(typeof payload.platform_admin === 'boolean' ? { platform_admin: payload.platform_admin } : {}),\n\t\t\texp: payload.exp,\n\t\t\tiat: payload.iat\n\t\t};\n\t} catch {\n\t\treturn null;\n\t}\n}\n\n/**\n * Check token expiration locally (saves API call)\n * @param token - JWT token to check\n * @param bufferSeconds - Seconds before actual expiry to consider expired (default: 30)\n * @returns true if token is expired or will expire within buffer, false otherwise\n */\nexport function isTokenExpired(token: string, bufferSeconds: number = 30): boolean {\n\ttry {\n\t\tconst parts = token.split('.');\n\t\tif (parts.length !== 3) {\n\t\t\treturn true;\n\t\t}\n\n\t\tconst payload = JSON.parse(base64UrlDecode(parts[1]));\n\t\tif (typeof payload.exp !== 'number' || isNaN(payload.exp)) {\n\t\t\treturn true;\n\t\t}\n\t\tconst expiresAt = payload.exp * 1000;\n\t\tconst bufferMs = bufferSeconds * 1000;\n\n\t\treturn Date.now() >= expiresAt - bufferMs;\n\t} catch {\n\t\treturn true; // Treat malformed tokens as expired\n\t}\n}\n\n"]}

package/dist/core/client.d.ts

@@ -12,6 +12,10 @@ export declare class SentinelClient {
     startLogin(email: string, options?: {
         redirectContext?: string;
         rememberMe?: boolean;
+        /** FanCastle mint tier (site_owner | fan | admin). */
+        audience?: 'site_owner' | 'fan' | 'admin';
+        /** FanCastle tenant id — community access token aud. */
+        communityId?: string;
     }): Promise<StartLoginResponse>;
     pollStatus(transactionId: string, clientToken?: string): Promise<PollResponse>;
     claimTokens(transactionId: string, clientToken: string): Promise<ClaimResponse>;

package/dist/core/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,MAAM,YAAY,CAAC;AAOpB,qBAAa,cAAc;IAC1B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,GAAG,CAAiB;gBAEhB,MAAM,EAAE,cAAc,EAAE,OAAO,GAAE,OAAO,UAAU,CAAC,KAAa;YAQ9D,OAAO;IAkErB,2CAA2C;IAC3C,OAAO,CAAC,OAAO;IAKT,UAAU,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,GAC1D,OAAO,CAAC,kBAAkB,CAAC;IAiBxB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAW9E,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO/E,QAAQ,CACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;IActB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOnD,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAO/E,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAO5D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAS7D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAQvE"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,cAAc,EACd,kBAAkB,EAClB,YAAY,EACZ,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,4BAA4B,EAC5B,MAAM,YAAY,CAAC;AAOpB,qBAAa,cAAc;IAC1B,OAAO,CAAC,MAAM,CAAiB;IAC/B,OAAO,CAAC,KAAK,CAA0B;IACvC,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,GAAG,CAAiB;gBAEhB,MAAM,EAAE,cAAc,EAAE,OAAO,GAAE,OAAO,UAAU,CAAC,KAAa;YAQ9D,OAAO;IAkErB,2CAA2C;IAC3C,OAAO,CAAC,OAAO;IAKT,UAAU,CACf,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACT,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,OAAO,CAAC;QACrB,sDAAsD;QACtD,QAAQ,CAAC,EAAE,YAAY,GAAG,KAAK,GAAG,OAAO,CAAC;QAC1C,wDAAwD;QACxD,WAAW,CAAC,EAAE,MAAM,CAAC;KACrB,GACC,OAAO,CAAC,kBAAkB,CAAC;IAuBxB,UAAU,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAW9E,WAAW,CAAC,aAAa,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAO/E,QAAQ,CACb,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACpC,OAAO,CAAC,gBAAgB,CAAC;IActB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAOnD,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAO/E,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAO5D,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAS7D,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAQvE"}

package/dist/core/client.js

@@ -87,6 +87,12 @@ export class SentinelClient {
         if (options?.rememberMe !== undefined) {
             body.remember_me = options.rememberMe;
         }
+        if (options?.audience !== undefined) {
+            body.audience = options.audience;
+        }
+        if (options?.communityId !== undefined) {
+            body.community_id = options.communityId;
+        }
         return this.request('/auth/login-passwordless', {
             method: 'POST',
             body: JSON.stringify(body)

package/dist/core/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAuB,MAAM,aAAa,CAAC;AAEhE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,OAAO,cAAc;IAClB,MAAM,CAAiB;IACvB,KAAK,CAA0B;IAC/B,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,GAAG,CAAiB;IAE5B,YAAY,MAAsB,EAAE,UAAmC,KAAK;QAC3E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC3D,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,QAAgB,EAAE,UAAuB,EAAE;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG;YACf,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,CAAC,OAAO;SAClB,CAAC;QAEF,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACJ,gDAAgD;gBAChD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEvE,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;wBACtC,GAAG,OAAO;wBACV,OAAO;wBACP,MAAM,EAAE,UAAU,CAAC,MAAM;qBACzB,CAAC,CAAC;oBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;oBAExB,sEAAsE;oBACtE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrE,SAAS,GAAG,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;wBAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC5B,SAAS;oBACV,CAAC;oBAED,8DAA8D;oBAC9D,8DAA8D;oBAC9D,4DAA4D;oBAC5D,aAAa;oBACb,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAClB,MAAM,MAAM,gBAAgB,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAC1D,CAAC;oBAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC9B,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACrB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAExB,6CAA6C;oBAC7C,IAAI,UAAU,YAAY,YAAY,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC5E,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrD,CAAC;oBACD,MAAM,UAAU,CAAC;gBAClB,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,GAAG,KAAK,CAAC;gBAElB,8BAA8B;gBAC9B,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5B,SAAS;gBACV,CAAC;gBAED,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QAED,0CAA0C;QAC1C,MAAM,SAAS,CAAC;IACjB,CAAC;IAED,2CAA2C;IACnC,OAAO,CAAC,OAAe;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU,CACf,KAAa,EACb,OAA4D;QAE5D,MAAM,IAAI,GAA4B;YACrC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SACnC,CAAC;QACF,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAqB,0BAA0B,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,aAAqB,EAAE,WAAoB;QAC3D,MAAM,OAAO,GAAgB;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;SACvC,CAAC;QACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAe,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,WAAmB;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAgB,aAAa,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;SACpD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,KAAa,EACb,OAAsC;QAEtC,MAAM,IAAI,GAA4B;YACrC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SACnC,CAAC;QACF,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAmB,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAiB,cAAc,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SACnD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAA+B,6BAA6B,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAkB,eAAe,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAmB,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,WAAW,EAAE;aACxC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAsB,WAAW,EAAE;YACrD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,WAAW,EAAE;aACxC;SACD,CAAC,CAAC;IACJ,CAAC;CACD","sourcesContent":["// src/core/client.ts\nimport type {\n\tSentinelConfig,\n\tStartLoginResponse,\n\tPollResponse,\n\tClaimResponse,\n\tRefreshResponse,\n\tValidateResponse,\n\tCurrentUserResponse,\n\tRegisterResponse,\n\tVerifyResponse,\n\tCompletePasswordlessResponse\n} from './types.js';\nimport { SentinelApiError, SentinelTimeoutError, isRetryableError, isRetryableStatus } from './errors.js';\nimport { createLogger, type SentinelLogger } from './logger.js';\n\nconst DEFAULT_TIMEOUT_MS = 8_000;\nconst DEFAULT_MAX_RETRIES = 1;\n\nexport class SentinelClient {\n\tprivate config: SentinelConfig;\n\tprivate fetch: typeof globalThis.fetch;\n\tprivate timeoutMs: number;\n\tprivate maxRetries: number;\n\tprivate log: SentinelLogger;\n\n\tconstructor(config: SentinelConfig, fetchFn: typeof globalThis.fetch = fetch) {\n\t\tthis.config = config;\n\t\tthis.fetch = fetchFn;\n\t\tthis.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\t\tthis.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;\n\t\tthis.log = config.logger ?? createLogger('sentinel-client');\n\t}\n\n\tprivate async request<T>(endpoint: string, options: RequestInit = {}): Promise<T> {\n\t\tconst url = `${this.config.apiUrl}${endpoint}`;\n\t\tconst headers = {\n\t\t\t'Content-Type': 'application/json',\n\t\t\t...options.headers\n\t\t};\n\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n\t\t\ttry {\n\t\t\t\t// Apply per-request timeout via AbortController\n\t\t\t\tconst controller = new AbortController();\n\t\t\t\tconst timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await this.fetch(url, {\n\t\t\t\t\t\t...options,\n\t\t\t\t\t\theaders,\n\t\t\t\t\t\tsignal: controller.signal\n\t\t\t\t\t});\n\n\t\t\t\t\tclearTimeout(timeoutId);\n\n\t\t\t\t\t// If the response status is retryable and we have retries left, retry\n\t\t\t\t\tif (isRetryableStatus(response.status) && attempt < this.maxRetries) {\n\t\t\t\t\t\tlastError = new Error(`HTTP ${response.status} from ${url}`);\n\t\t\t\t\t\tawait this.backoff(attempt);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\t// Fail loud on any remaining non-2xx status. A non-ok body is\n\t\t\t\t\t// never returned as a resolved value; retryable statuses were\n\t\t\t\t\t// handled above and are only surfaced here once retries are\n\t\t\t\t\t// exhausted.\n\t\t\t\t\tif (!response.ok) {\n\t\t\t\t\t\tthrow await SentinelApiError.fromResponse(response, url);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn await response.json();\n\t\t\t\t} catch (fetchError) {\n\t\t\t\t\tclearTimeout(timeoutId);\n\n\t\t\t\t\t// Convert AbortError to SentinelTimeoutError\n\t\t\t\t\tif (fetchError instanceof DOMException && fetchError.name === 'AbortError') {\n\t\t\t\t\t\tthrow new SentinelTimeoutError(url, this.timeoutMs);\n\t\t\t\t\t}\n\t\t\t\t\tthrow fetchError;\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tlastError = error;\n\n\t\t\t\t// Only retry retryable errors\n\t\t\t\tif (attempt < this.maxRetries && isRetryableError(error)) {\n\t\t\t\t\tawait this.backoff(attempt);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\t// Should not reach here, but just in case\n\t\tthrow lastError;\n\t}\n\n\t/** Exponential backoff: 1s, 2s, 4s, ... */\n\tprivate backoff(attempt: number): Promise<void> {\n\t\tconst delay = Math.min(1000 * Math.pow(2, attempt), 8000);\n\t\treturn new Promise(resolve => setTimeout(resolve, delay));\n\t}\n\n\tasync startLogin(\n\t\temail: string,\n\t\toptions?: { redirectContext?: string; rememberMe?: boolean }\n\t): Promise<StartLoginResponse> {\n\t\tconst body: Record<string, unknown> = {\n\t\t\temail,\n\t\t\temail_endpoint: this.config.baseUrl\n\t\t};\n\t\tif (options?.redirectContext !== undefined) {\n\t\t\tbody.redirect_context = options.redirectContext;\n\t\t}\n\t\tif (options?.rememberMe !== undefined) {\n\t\t\tbody.remember_me = options.rememberMe;\n\t\t}\n\t\treturn this.request<StartLoginResponse>('/auth/login-passwordless', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify(body)\n\t\t});\n\t}\n\n\tasync pollStatus(transactionId: string, clientToken?: string): Promise<PollResponse> {\n\t\tconst options: RequestInit = {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ transactionId })\n\t\t};\n\t\tif (clientToken !== undefined) {\n\t\t\toptions.headers = { 'Authorization': `Bearer ${clientToken}` };\n\t\t}\n\t\treturn this.request<PollResponse>('/auth/poll', options);\n\t}\n\n\tasync claimTokens(transactionId: string, clientToken: string): Promise<ClaimResponse> {\n\t\treturn this.request<ClaimResponse>('/auth/claim', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ transactionId, clientToken })\n\t\t});\n\t}\n\n\tasync register(\n\t\temail: string,\n\t\toptions?: { redirectContext?: string }\n\t): Promise<RegisterResponse> {\n\t\tconst body: Record<string, unknown> = {\n\t\t\temail,\n\t\t\temail_endpoint: this.config.baseUrl\n\t\t};\n\t\tif (options?.redirectContext !== undefined) {\n\t\t\tbody.redirect_context = options.redirectContext;\n\t\t}\n\t\treturn this.request<RegisterResponse>('/auth/register', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify(body)\n\t\t});\n\t}\n\n\tasync verifyEmail(token: string): Promise<VerifyResponse> {\n\t\treturn this.request<VerifyResponse>('/auth/verify', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ verification_token: token })\n\t\t});\n\t}\n\n\tasync completePasswordless(magicToken: string): Promise<CompletePasswordlessResponse> {\n\t\treturn this.request<CompletePasswordlessResponse>('/auth/complete-passwordless', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ magic_token: magicToken })\n\t\t});\n\t}\n\n\tasync refreshToken(refreshToken: string): Promise<RefreshResponse> {\n\t\treturn this.request<RefreshResponse>('/auth/refresh', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken })\n\t\t});\n\t}\n\n\tasync validateToken(accessToken: string): Promise<ValidateResponse> {\n\t\treturn this.request<ValidateResponse>('/auth/validate', {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Authorization': `Bearer ${accessToken}`\n\t\t\t}\n\t\t});\n\t}\n\n\tasync getCurrentUser(accessToken: string): Promise<CurrentUserResponse> {\n\t\treturn this.request<CurrentUserResponse>('/users/me', {\n\t\t\tmethod: 'GET',\n\t\t\theaders: {\n\t\t\t\t'Authorization': `Bearer ${accessToken}`\n\t\t\t}\n\t\t});\n\t}\n}\n\n"]}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/core/client.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAC1G,OAAO,EAAE,YAAY,EAAuB,MAAM,aAAa,CAAC;AAEhE,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,mBAAmB,GAAG,CAAC,CAAC;AAE9B,MAAM,OAAO,cAAc;IAClB,MAAM,CAAiB;IACvB,KAAK,CAA0B;IAC/B,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,GAAG,CAAiB;IAE5B,YAAY,MAAsB,EAAE,UAAmC,KAAK;QAC3E,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;QACrB,IAAI,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,kBAAkB,CAAC;QACxD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,mBAAmB,CAAC;QAC3D,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,YAAY,CAAC,iBAAiB,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,QAAgB,EAAE,UAAuB,EAAE;QACnE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC/C,MAAM,OAAO,GAAG;YACf,cAAc,EAAE,kBAAkB;YAClC,GAAG,OAAO,CAAC,OAAO;SAClB,CAAC;QAEF,IAAI,SAAkB,CAAC;QAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;YAC7D,IAAI,CAAC;gBACJ,gDAAgD;gBAChD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;gBAEvE,IAAI,CAAC;oBACJ,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE;wBACtC,GAAG,OAAO;wBACV,OAAO;wBACP,MAAM,EAAE,UAAU,CAAC,MAAM;qBACzB,CAAC,CAAC;oBAEH,YAAY,CAAC,SAAS,CAAC,CAAC;oBAExB,sEAAsE;oBACtE,IAAI,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;wBACrE,SAAS,GAAG,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,CAAC;wBAC7D,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;wBAC5B,SAAS;oBACV,CAAC;oBAED,8DAA8D;oBAC9D,8DAA8D;oBAC9D,4DAA4D;oBAC5D,aAAa;oBACb,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;wBAClB,MAAM,MAAM,gBAAgB,CAAC,YAAY,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;oBAC1D,CAAC;oBAED,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC9B,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACrB,YAAY,CAAC,SAAS,CAAC,CAAC;oBAExB,6CAA6C;oBAC7C,IAAI,UAAU,YAAY,YAAY,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;wBAC5E,MAAM,IAAI,oBAAoB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;oBACrD,CAAC;oBACD,MAAM,UAAU,CAAC;gBAClB,CAAC;YACF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,SAAS,GAAG,KAAK,CAAC;gBAElB,8BAA8B;gBAC9B,IAAI,OAAO,GAAG,IAAI,CAAC,UAAU,IAAI,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAC1D,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;oBAC5B,SAAS;gBACV,CAAC;gBAED,MAAM,KAAK,CAAC;YACb,CAAC;QACF,CAAC;QAED,0CAA0C;QAC1C,MAAM,SAAS,CAAC;IACjB,CAAC;IAED,2CAA2C;IACnC,OAAO,CAAC,OAAe;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;IAC3D,CAAC;IAED,KAAK,CAAC,UAAU,CACf,KAAa,EACb,OAOC;QAED,MAAM,IAAI,GAA4B;YACrC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SACnC,CAAC;QACF,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,IAAI,OAAO,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;YACvC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,UAAU,CAAC;QACvC,CAAC;QACD,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;YACrC,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,EAAE,WAAW,KAAK,SAAS,EAAE,CAAC;YACxC,IAAI,CAAC,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC;QACzC,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAqB,0BAA0B,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,aAAqB,EAAE,WAAoB;QAC3D,MAAM,OAAO,GAAgB;YAC5B,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,CAAC;SACvC,CAAC;QACF,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;YAC/B,OAAO,CAAC,OAAO,GAAG,EAAE,eAAe,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC;QAChE,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAe,YAAY,EAAE,OAAO,CAAC,CAAC;IAC1D,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,aAAqB,EAAE,WAAmB;QAC3D,OAAO,IAAI,CAAC,OAAO,CAAgB,aAAa,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,WAAW,EAAE,CAAC;SACpD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,KAAa,EACb,OAAsC;QAEtC,MAAM,IAAI,GAA4B;YACrC,KAAK;YACL,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;SACnC,CAAC;QACF,IAAI,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;YAC5C,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;QACjD,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAmB,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,WAAW,CAAC,KAAa;QAC9B,OAAO,IAAI,CAAC,OAAO,CAAiB,cAAc,EAAE;YACnD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,KAAK,EAAE,CAAC;SACnD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,oBAAoB,CAAC,UAAkB;QAC5C,OAAO,IAAI,CAAC,OAAO,CAA+B,6BAA6B,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;SACjD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,YAAoB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAkB,eAAe,EAAE;YACrD,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;SACrD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,OAAO,CAAmB,gBAAgB,EAAE;YACvD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,WAAW,EAAE;aACxC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,WAAmB;QACvC,OAAO,IAAI,CAAC,OAAO,CAAsB,WAAW,EAAE;YACrD,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACR,eAAe,EAAE,UAAU,WAAW,EAAE;aACxC;SACD,CAAC,CAAC;IACJ,CAAC;CACD","sourcesContent":["// src/core/client.ts\nimport type {\n\tSentinelConfig,\n\tStartLoginResponse,\n\tPollResponse,\n\tClaimResponse,\n\tRefreshResponse,\n\tValidateResponse,\n\tCurrentUserResponse,\n\tRegisterResponse,\n\tVerifyResponse,\n\tCompletePasswordlessResponse\n} from './types.js';\nimport { SentinelApiError, SentinelTimeoutError, isRetryableError, isRetryableStatus } from './errors.js';\nimport { createLogger, type SentinelLogger } from './logger.js';\n\nconst DEFAULT_TIMEOUT_MS = 8_000;\nconst DEFAULT_MAX_RETRIES = 1;\n\nexport class SentinelClient {\n\tprivate config: SentinelConfig;\n\tprivate fetch: typeof globalThis.fetch;\n\tprivate timeoutMs: number;\n\tprivate maxRetries: number;\n\tprivate log: SentinelLogger;\n\n\tconstructor(config: SentinelConfig, fetchFn: typeof globalThis.fetch = fetch) {\n\t\tthis.config = config;\n\t\tthis.fetch = fetchFn;\n\t\tthis.timeoutMs = config.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n\t\tthis.maxRetries = config.maxRetries ?? DEFAULT_MAX_RETRIES;\n\t\tthis.log = config.logger ?? createLogger('sentinel-client');\n\t}\n\n\tprivate async request<T>(endpoint: string, options: RequestInit = {}): Promise<T> {\n\t\tconst url = `${this.config.apiUrl}${endpoint}`;\n\t\tconst headers = {\n\t\t\t'Content-Type': 'application/json',\n\t\t\t...options.headers\n\t\t};\n\n\t\tlet lastError: unknown;\n\n\t\tfor (let attempt = 0; attempt <= this.maxRetries; attempt++) {\n\t\t\ttry {\n\t\t\t\t// Apply per-request timeout via AbortController\n\t\t\t\tconst controller = new AbortController();\n\t\t\t\tconst timeoutId = setTimeout(() => controller.abort(), this.timeoutMs);\n\n\t\t\t\ttry {\n\t\t\t\t\tconst response = await this.fetch(url, {\n\t\t\t\t\t\t...options,\n\t\t\t\t\t\theaders,\n\t\t\t\t\t\tsignal: controller.signal\n\t\t\t\t\t});\n\n\t\t\t\t\tclearTimeout(timeoutId);\n\n\t\t\t\t\t// If the response status is retryable and we have retries left, retry\n\t\t\t\t\tif (isRetryableStatus(response.status) && attempt < this.maxRetries) {\n\t\t\t\t\t\tlastError = new Error(`HTTP ${response.status} from ${url}`);\n\t\t\t\t\t\tawait this.backoff(attempt);\n\t\t\t\t\t\tcontinue;\n\t\t\t\t\t}\n\n\t\t\t\t\t// Fail loud on any remaining non-2xx status. A non-ok body is\n\t\t\t\t\t// never returned as a resolved value; retryable statuses were\n\t\t\t\t\t// handled above and are only surfaced here once retries are\n\t\t\t\t\t// exhausted.\n\t\t\t\t\tif (!response.ok) {\n\t\t\t\t\t\tthrow await SentinelApiError.fromResponse(response, url);\n\t\t\t\t\t}\n\n\t\t\t\t\treturn await response.json();\n\t\t\t\t} catch (fetchError) {\n\t\t\t\t\tclearTimeout(timeoutId);\n\n\t\t\t\t\t// Convert AbortError to SentinelTimeoutError\n\t\t\t\t\tif (fetchError instanceof DOMException && fetchError.name === 'AbortError') {\n\t\t\t\t\t\tthrow new SentinelTimeoutError(url, this.timeoutMs);\n\t\t\t\t\t}\n\t\t\t\t\tthrow fetchError;\n\t\t\t\t}\n\t\t\t} catch (error) {\n\t\t\t\tlastError = error;\n\n\t\t\t\t// Only retry retryable errors\n\t\t\t\tif (attempt < this.maxRetries && isRetryableError(error)) {\n\t\t\t\t\tawait this.backoff(attempt);\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\n\t\t\t\tthrow error;\n\t\t\t}\n\t\t}\n\n\t\t// Should not reach here, but just in case\n\t\tthrow lastError;\n\t}\n\n\t/** Exponential backoff: 1s, 2s, 4s, ... */\n\tprivate backoff(attempt: number): Promise<void> {\n\t\tconst delay = Math.min(1000 * Math.pow(2, attempt), 8000);\n\t\treturn new Promise(resolve => setTimeout(resolve, delay));\n\t}\n\n\tasync startLogin(\n\t\temail: string,\n\t\toptions?: {\n\t\t\tredirectContext?: string;\n\t\t\trememberMe?: boolean;\n\t\t\t/** FanCastle mint tier (site_owner | fan | admin). */\n\t\t\taudience?: 'site_owner' | 'fan' | 'admin';\n\t\t\t/** FanCastle tenant id — community access token aud. */\n\t\t\tcommunityId?: string;\n\t\t}\n\t): Promise<StartLoginResponse> {\n\t\tconst body: Record<string, unknown> = {\n\t\t\temail,\n\t\t\temail_endpoint: this.config.baseUrl\n\t\t};\n\t\tif (options?.redirectContext !== undefined) {\n\t\t\tbody.redirect_context = options.redirectContext;\n\t\t}\n\t\tif (options?.rememberMe !== undefined) {\n\t\t\tbody.remember_me = options.rememberMe;\n\t\t}\n\t\tif (options?.audience !== undefined) {\n\t\t\tbody.audience = options.audience;\n\t\t}\n\t\tif (options?.communityId !== undefined) {\n\t\t\tbody.community_id = options.communityId;\n\t\t}\n\t\treturn this.request<StartLoginResponse>('/auth/login-passwordless', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify(body)\n\t\t});\n\t}\n\n\tasync pollStatus(transactionId: string, clientToken?: string): Promise<PollResponse> {\n\t\tconst options: RequestInit = {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ transactionId })\n\t\t};\n\t\tif (clientToken !== undefined) {\n\t\t\toptions.headers = { 'Authorization': `Bearer ${clientToken}` };\n\t\t}\n\t\treturn this.request<PollResponse>('/auth/poll', options);\n\t}\n\n\tasync claimTokens(transactionId: string, clientToken: string): Promise<ClaimResponse> {\n\t\treturn this.request<ClaimResponse>('/auth/claim', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ transactionId, clientToken })\n\t\t});\n\t}\n\n\tasync register(\n\t\temail: string,\n\t\toptions?: { redirectContext?: string }\n\t): Promise<RegisterResponse> {\n\t\tconst body: Record<string, unknown> = {\n\t\t\temail,\n\t\t\temail_endpoint: this.config.baseUrl\n\t\t};\n\t\tif (options?.redirectContext !== undefined) {\n\t\t\tbody.redirect_context = options.redirectContext;\n\t\t}\n\t\treturn this.request<RegisterResponse>('/auth/register', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify(body)\n\t\t});\n\t}\n\n\tasync verifyEmail(token: string): Promise<VerifyResponse> {\n\t\treturn this.request<VerifyResponse>('/auth/verify', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ verification_token: token })\n\t\t});\n\t}\n\n\tasync completePasswordless(magicToken: string): Promise<CompletePasswordlessResponse> {\n\t\treturn this.request<CompletePasswordlessResponse>('/auth/complete-passwordless', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ magic_token: magicToken })\n\t\t});\n\t}\n\n\tasync refreshToken(refreshToken: string): Promise<RefreshResponse> {\n\t\treturn this.request<RefreshResponse>('/auth/refresh', {\n\t\t\tmethod: 'POST',\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken })\n\t\t});\n\t}\n\n\tasync validateToken(accessToken: string): Promise<ValidateResponse> {\n\t\treturn this.request<ValidateResponse>('/auth/validate', {\n\t\t\tmethod: 'POST',\n\t\t\theaders: {\n\t\t\t\t'Authorization': `Bearer ${accessToken}`\n\t\t\t}\n\t\t});\n\t}\n\n\tasync getCurrentUser(accessToken: string): Promise<CurrentUserResponse> {\n\t\treturn this.request<CurrentUserResponse>('/users/me', {\n\t\t\tmethod: 'GET',\n\t\t\theaders: {\n\t\t\t\t'Authorization': `Bearer ${accessToken}`\n\t\t\t}\n\t\t});\n\t}\n}\n\n"]}

package/dist/core/consumer-version-floor.d.ts

@@ -0,0 +1,56 @@
+export declare const SENTINEL_SDK_PACKAGE = "@nexartis/sentinel-sdk";
+/** First sentinel-sdk line that verifies signatures against the JWKS. */
+export declare const SENTINEL_SDK_VERSION_FLOOR = "1.8.0";
+export type PinKind = 'exact' | 'range' | 'tarball' | 'alias' | 'unresolved';
+export interface ParsedPin {
+    kind: PinKind;
+    /** Lower-bound version the specifier guarantees, or null when unknown. */
+    version: string | null;
+    spec: string;
+    reason: string;
+}
+export type FloorStatus = 'ok' | 'below-floor' | 'unresolved' | 'absent';
+export interface FloorVerdict {
+    status: FloorStatus;
+    /** Version the specifier is guaranteed to resolve at or above, when known. */
+    pinnedVersion: string | null;
+    spec: string | null;
+    reason: string;
+}
+export interface ConsumerEntry {
+    repo: string;
+    /** The declared @nexartis/sentinel-sdk specifier, or null when not declared. */
+    dependencySpec?: string | null;
+}
+export interface ConsumerVerdict extends FloorVerdict {
+    repo: string;
+}
+export interface FloorReport {
+    floor: string;
+    consumers: ConsumerVerdict[];
+    /** Repos that resolve below the floor — the hard gate failures. */
+    violations: string[];
+    /** Repos whose specifier cannot prove a floor (strict mode fails these). */
+    unresolved: string[];
+    /** True when no consumer resolves below the floor. */
+    ok: boolean;
+    /** True when no consumer is below the floor AND none is unresolved. */
+    strictOk: boolean;
+}
+/** Compare two semver strings. Returns -1, 0, or 1. Unparseable input throws. */
+export declare function compareVersions(a: string, b: string): number;
+/**
+ * Parse a declared dependency specifier into the lower-bound version it
+ * guarantees. Anything that cannot prove a published floor (workspace/file/
+ * git sources, floating tags, upper-bounded ranges) is reported `unresolved`
+ * rather than guessed — the gate fails closed on those in strict mode.
+ */
+export declare function parsePinnedVersion(spec: string): ParsedPin;
+/**
+ * Evaluate one declared specifier against the floor. A missing specifier is
+ * `absent` (not a consumer); an unprovable specifier is `unresolved`.
+ */
+export declare function evaluatePin(spec: string | null | undefined, floor?: string): FloorVerdict;
+/** Evaluate a set of consumers and summarise the fleet verdict. */
+export declare function evaluateConsumers(entries: readonly ConsumerEntry[], floor?: string): FloorReport;
+//# sourceMappingURL=consumer-version-floor.d.ts.map

package/dist/core/consumer-version-floor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"consumer-version-floor.d.ts","sourceRoot":"","sources":["../../src/core/consumer-version-floor.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,oBAAoB,2BAA2B,CAAC;AAE7D,yEAAyE;AACzE,eAAO,MAAM,0BAA0B,UAAU,CAAC;AAElD,MAAM,MAAM,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,YAAY,CAAC;AAE7E,MAAM,WAAW,SAAS;IACzB,IAAI,EAAE,OAAO,CAAC;IACd,0EAA0E;IAC1E,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,WAAW,GAAG,IAAI,GAAG,aAAa,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEzE,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,WAAW,CAAC;IACpB,8EAA8E;IAC9E,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,gFAAgF;IAChF,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC/B;AAED,MAAM,WAAW,eAAgB,SAAQ,YAAY;IACpD,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,eAAe,EAAE,CAAC;IAC7B,mEAAmE;IACnE,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,sDAAsD;IACtD,EAAE,EAAE,OAAO,CAAC;IACZ,uEAAuE;IACvE,QAAQ,EAAE,OAAO,CAAC;CAClB;AAqDD,iFAAiF;AACjF,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,CAc5D;AAsCD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,CA+D1D;AAED;;;GAGG;AACH,wBAAgB,WAAW,CAC1B,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,KAAK,GAAE,MAAmC,GACxC,YAAY,CA4Bd;AAED,mEAAmE;AACnE,wBAAgB,iBAAiB,CAChC,OAAO,EAAE,SAAS,aAAa,EAAE,EACjC,KAAK,GAAE,MAAmC,GACxC,WAAW,CAeb"}

package/dist/core/consumer-version-floor.js

@@ -0,0 +1,233 @@
+// src/core/consumer-version-floor.ts
+//
+// Fleet consumer version-floor gate for @nexartis/sentinel-sdk.
+//
+// 1.8.0 is the first line that verifies every access-token signature against
+// the Sentinel JWKS on each request (the admin-gate audit fix). A consumer
+// pinned below that floor trusts unverified token payloads, so the fleet must
+// fail closed on any in-scope repo that resolves below it.
+//
+// This module is pure and dependency-free so the same logic backs the unit
+// tests, the `scripts/check-consumer-version-floor.mjs` CLI gate, and CI.
+export const SENTINEL_SDK_PACKAGE = '@nexartis/sentinel-sdk';
+/** First sentinel-sdk line that verifies signatures against the JWKS. */
+export const SENTINEL_SDK_VERSION_FLOOR = '1.8.0';
+const SEMVER_RE = /^v?(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?(?:\+[0-9A-Za-z.-]+)?$/;
+function toSemver(token) {
+    const match = SEMVER_RE.exec(token.trim());
+    if (!match)
+        return null;
+    return {
+        major: Number(match[1]),
+        minor: Number(match[2] ?? 0),
+        patch: Number(match[3] ?? 0),
+        prerelease: match[4] ?? null
+    };
+}
+/** Normalise a loose version token (`v1.9`, `1.9.2+build`) to `major.minor.patch[-pre]`. */
+function normalizeVersion(token) {
+    const parsed = toSemver(token);
+    if (!parsed)
+        return null;
+    const base = `${parsed.major}.${parsed.minor}.${parsed.patch}`;
+    return parsed.prerelease ? `${base}-${parsed.prerelease}` : base;
+}
+function comparePrerelease(a, b) {
+    const left = a.split('.');
+    const right = b.split('.');
+    for (let i = 0; i < Math.max(left.length, right.length); i += 1) {
+        const x = left[i];
+        const y = right[i];
+        if (x === undefined)
+            return -1;
+        if (y === undefined)
+            return 1;
+        const xn = /^\d+$/.test(x);
+        const yn = /^\d+$/.test(y);
+        if (xn && yn) {
+            const diff = Number(x) - Number(y);
+            if (diff !== 0)
+                return diff < 0 ? -1 : 1;
+        }
+        else if (xn !== yn) {
+            // Numeric identifiers always have lower precedence than alphanumeric ones.
+            return xn ? -1 : 1;
+        }
+        else if (x !== y) {
+            return x < y ? -1 : 1;
+        }
+    }
+    return 0;
+}
+/** Compare two semver strings. Returns -1, 0, or 1. Unparseable input throws. */
+export function compareVersions(a, b) {
+    const left = toSemver(a);
+    const right = toSemver(b);
+    if (!left || !right) {
+        throw new Error(`compareVersions: not a version: "${!left ? a : b}"`);
+    }
+    for (const key of ['major', 'minor', 'patch']) {
+        if (left[key] !== right[key])
+            return left[key] < right[key] ? -1 : 1;
+    }
+    if (!left.prerelease && !right.prerelease)
+        return 0;
+    // A release outranks its own prereleases (1.8.0 > 1.8.0-beta.1).
+    if (!left.prerelease)
+        return 1;
+    if (!right.prerelease)
+        return -1;
+    return comparePrerelease(left.prerelease, right.prerelease);
+}
+const TARBALL_SUFFIX = '.tgz';
+const TARBALL_MARKER = 'sentinel-sdk-';
+function isVersionTokenChar(ch) {
+    return ((ch >= '0' && ch <= '9') ||
+        (ch >= 'A' && ch <= 'Z') ||
+        (ch >= 'a' && ch <= 'z') ||
+        ch === '.' ||
+        ch === '+' ||
+        ch === '-');
+}
+/**
+ * Extract the `<version>` from a `sentinel-sdk-<version>.tgz` tarball name by
+ * index slicing (strictly linear, no regex). The previous backtracking pattern
+ * `/sentinel-sdk-([0-9][0-9A-Za-z.+-]*)\.tgz/` let the version class and the
+ * literal `.tgz` both consume `.`, a polynomial-regex (ReDoS) shape on
+ * uncontrolled specifier input. Returns null when the specifier is not a
+ * sentinel-sdk tarball name.
+ */
+function extractTarballVersion(raw) {
+    if (!raw.endsWith(TARBALL_SUFFIX))
+        return null;
+    const stem = raw.slice(0, raw.length - TARBALL_SUFFIX.length);
+    const markerAt = stem.lastIndexOf(TARBALL_MARKER);
+    if (markerAt < 0)
+        return null;
+    const candidate = stem.slice(markerAt + TARBALL_MARKER.length);
+    if (candidate.length === 0)
+        return null;
+    if (candidate[0] < '0' || candidate[0] > '9')
+        return null;
+    for (const ch of candidate) {
+        if (!isVersionTokenChar(ch))
+            return null;
+    }
+    return candidate;
+}
+/**
+ * Parse a declared dependency specifier into the lower-bound version it
+ * guarantees. Anything that cannot prove a published floor (workspace/file/
+ * git sources, floating tags, upper-bounded ranges) is reported `unresolved`
+ * rather than guessed — the gate fails closed on those in strict mode.
+ */
+export function parsePinnedVersion(spec) {
+    const raw = (spec ?? '').trim();
+    const unresolved = (reason) => ({
+        kind: 'unresolved',
+        version: null,
+        spec: raw,
+        reason
+    });
+    if (!raw)
+        return unresolved('empty specifier');
+    if (/^(workspace|file|link|portal):/i.test(raw)) {
+        return unresolved(`local source (${raw.split(':')[0]}:) — cannot prove a published floor`);
+    }
+    if (/^(git|github)(\+|:)/i.test(raw) || /\.git(#|$)/.test(raw)) {
+        return unresolved('git source — cannot prove a published floor');
+    }
+    // npm alias, e.g. `npm:@nexartis/sentinel-sdk@1.9.0`.
+    if (raw.startsWith('npm:')) {
+        const rest = raw.slice('npm:'.length);
+        const at = rest.lastIndexOf('@');
+        const range = at > 0 ? rest.slice(at + 1) : '';
+        const inner = parsePinnedVersion(range);
+        return {
+            ...inner,
+            kind: inner.kind === 'unresolved' ? 'unresolved' : 'alias',
+            spec: raw
+        };
+    }
+    // Tarball pin, e.g. `.../@nexartis/sentinel-sdk/-/sentinel-sdk-1.9.2.tgz`.
+    const tarballVersion = extractTarballVersion(raw);
+    if (tarballVersion !== null) {
+        const version = normalizeVersion(tarballVersion);
+        if (!version)
+            return unresolved(`unparseable tarball version in "${raw}"`);
+        return { kind: 'tarball', version, spec: raw, reason: `tarball pin ${version}` };
+    }
+    if (/^(https?:|file:)/i.test(raw)) {
+        return unresolved('tarball without a sentinel-sdk-<version>.tgz name');
+    }
+    if (raw === '*' || /^(latest|next|x)$/i.test(raw)) {
+        return unresolved(`floating specifier "${raw}" — cannot prove a floor`);
+    }
+    if (raw.includes('||')) {
+        return unresolved(`composite range "${raw}" — cannot prove a single floor`);
+    }
+    const operator = /^(\^|~|>=|<=|>|<|=)/.exec(raw)?.[1] ?? '';
+    const versionToken = /(\d+)(?:\.(\d+))?(?:\.(\d+))?(?:-([0-9A-Za-z.-]+))?/.exec(raw);
+    if (!versionToken)
+        return unresolved(`no semver version in "${raw}"`);
+    const version = normalizeVersion(versionToken[0]);
+    if (!version)
+        return unresolved(`unparseable version in "${raw}"`);
+    // `<`/`<=` cannot prove a lower bound at or above the floor.
+    if (operator === '<' || operator === '<=') {
+        return unresolved(`upper-bounded range "${raw}" — cannot prove a floor`);
+    }
+    const kind = operator === '' || operator === '=' ? 'exact' : 'range';
+    return { kind, version, spec: raw, reason: `${kind} ${operator || '='} ${version}` };
+}
+/**
+ * Evaluate one declared specifier against the floor. A missing specifier is
+ * `absent` (not a consumer); an unprovable specifier is `unresolved`.
+ */
+export function evaluatePin(spec, floor = SENTINEL_SDK_VERSION_FLOOR) {
+    if (spec == null || !String(spec).trim()) {
+        return {
+            status: 'absent',
+            pinnedVersion: null,
+            spec: spec ?? null,
+            reason: `no ${SENTINEL_SDK_PACKAGE} dependency declared`
+        };
+    }
+    const declared = String(spec);
+    const parsed = parsePinnedVersion(declared);
+    if (parsed.kind === 'unresolved' || !parsed.version) {
+        return { status: 'unresolved', pinnedVersion: null, spec: declared, reason: parsed.reason };
+    }
+    if (compareVersions(parsed.version, floor) < 0) {
+        return {
+            status: 'below-floor',
+            pinnedVersion: parsed.version,
+            spec: declared,
+            reason: `${parsed.version} resolves below the ${floor} floor`
+        };
+    }
+    return {
+        status: 'ok',
+        pinnedVersion: parsed.version,
+        spec: declared,
+        reason: `${parsed.version} is at or above the ${floor} floor`
+    };
+}
+/** Evaluate a set of consumers and summarise the fleet verdict. */
+export function evaluateConsumers(entries, floor = SENTINEL_SDK_VERSION_FLOOR) {
+    const consumers = entries.map((entry) => ({
+        repo: entry.repo,
+        ...evaluatePin(entry.dependencySpec, floor)
+    }));
+    const violations = consumers.filter((c) => c.status === 'below-floor').map((c) => c.repo);
+    const unresolved = consumers.filter((c) => c.status === 'unresolved').map((c) => c.repo);
+    return {
+        floor,
+        consumers,
+        violations,
+        unresolved,
+        ok: violations.length === 0,
+        strictOk: violations.length === 0 && unresolved.length === 0
+    };
+}
+//# sourceMappingURL=consumer-version-floor.js.map