@oathmesh/sdk 1.0.2

package/dist/next.js

@@ -0,0 +1,183 @@
+"use strict";
+/**
+ * OathMesh Next.js adapters.
+ *
+ * Provides verification for:
+ *   - App Router Route Handlers (GET, POST, etc.)
+ *   - Pages Router API Routes
+ *   - Next.js Edge Middleware
+ *
+ * All adapters use the same core verifier — no framework-specific crypto.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withOathMesh = withOathMesh;
+exports.withOathMeshApi = withOathMeshApi;
+exports.createEdgeVerifier = createEdgeVerifier;
+const types_1 = require("./types");
+const verify_1 = require("./verify");
+// ─── App Router (Route Handlers) ────────────────────────────────────────────
+/**
+ * Verify an OathMesh token inside a Next.js App Router Route Handler.
+ *
+ * Returns the verified caller context or throws an OathMeshError.
+ * Use with `NextRequest` in route handlers.
+ *
+ * @example
+ * ```typescript
+ * // app/api/inventory/route.ts
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { withOathMesh } from '@oathmesh/sdk/next';
+ *
+ * const oathmesh = withOathMesh({
+ *   audience: 'https://inventory.internal',
+ *   trustedIssuers: ['https://issuer.oathmesh.dev'],
+ * });
+ *
+ * export async function GET(request: NextRequest) {
+ *   const { caller, error } = await oathmesh(request);
+ *   if (error) return error;
+ *
+ *   return NextResponse.json({
+ *     subject: caller.principal.subject,
+ *     action: caller.action,
+ *   });
+ * }
+ * ```
+ */
+function withOathMesh(config) {
+    return async (request) => {
+        const token = (0, verify_1.extractToken)(request.headers.get('authorization'));
+        const headers = Object.fromEntries(request.headers.entries());
+        if (!token) {
+            const err = new types_1.OathMeshError('claim_missing:token', 'missing or invalid Authorization header', "provide a token in the format 'Authorization: OathMesh <token>'");
+            await config.onDenied?.(err, headers);
+            return {
+                caller: null,
+                error: Response.json(err.toJSON(), { status: 401 }),
+            };
+        }
+        try {
+            const caller = await (0, verify_1.verifyOathToken)(token, config);
+            await config.onVerified?.(caller, headers);
+            return { caller, error: null };
+        }
+        catch (e) {
+            const err = e instanceof types_1.OathMeshError
+                ? e
+                : new types_1.OathMeshError('verification_failed', e.message, 'check token format');
+            await config.onDenied?.(err, headers);
+            return {
+                caller: null,
+                error: Response.json(err.toJSON(), { status: 401 }),
+            };
+        }
+    };
+}
+/**
+ * Wrap a Next.js Pages Router API handler with OathMesh verification.
+ *
+ * The verified caller context is injected into `req.oathmeshContext`.
+ *
+ * @example
+ * ```typescript
+ * // pages/api/inventory.ts
+ * import { withOathMeshApi } from '@oathmesh/sdk/next';
+ *
+ * export default withOathMeshApi(
+ *   {
+ *     audience: 'https://inventory.internal',
+ *     trustedIssuers: ['https://issuer.oathmesh.dev'],
+ *   },
+ *   (req, res) => {
+ *     const caller = (req as any).oathmeshContext;
+ *     res.json({ subject: caller.principal.subject });
+ *   }
+ * );
+ * ```
+ */
+function withOathMeshApi(config, handler) {
+    return async (req, res) => {
+        const authHeader = Array.isArray(req.headers.authorization)
+            ? req.headers.authorization[0]
+            : req.headers.authorization;
+        const token = (0, verify_1.extractToken)(authHeader);
+        const headers = req.headers;
+        if (!token) {
+            const err = new types_1.OathMeshError('claim_missing:token', 'missing or invalid Authorization header', "provide a token in the format 'Authorization: OathMesh <token>'");
+            await config.onDenied?.(err, headers);
+            res.status(401).json(err.toJSON());
+            return;
+        }
+        try {
+            const caller = await (0, verify_1.verifyOathToken)(token, config);
+            req.oathmeshContext = caller;
+            await config.onVerified?.(caller, headers);
+            await handler(req, res);
+        }
+        catch (e) {
+            const err = e instanceof types_1.OathMeshError
+                ? e
+                : new types_1.OathMeshError('verification_failed', e.message, 'check token format');
+            await config.onDenied?.(err, headers);
+            res.status(401).json(err.toJSON());
+        }
+    };
+}
+// ─── Edge Middleware ────────────────────────────────────────────────────────
+/**
+ * Create a Next.js Edge Middleware verifier.
+ *
+ * Returns a function you call inside your `middleware.ts`. If verification
+ * fails it returns a `Response` you should return immediately. If it passes,
+ * it returns `null` and you should call `NextResponse.next()`.
+ *
+ * @example
+ * ```typescript
+ * // middleware.ts (project root)
+ * import { NextRequest, NextResponse } from 'next/server';
+ * import { createEdgeVerifier } from '@oathmesh/sdk/next';
+ *
+ * const verify = createEdgeVerifier({
+ *   audience: 'https://inventory.internal',
+ *   trustedIssuers: ['https://issuer.oathmesh.dev'],
+ * });
+ *
+ * export async function middleware(request: NextRequest) {
+ *   const denied = await verify(request);
+ *   if (denied) return denied;
+ *
+ *   // Verification passed — forward with injected headers
+ *   return NextResponse.next();
+ * }
+ *
+ * export const config = {
+ *   matcher: '/api/:path*',
+ * };
+ * ```
+ */
+function createEdgeVerifier(config) {
+    return async (request) => {
+        const token = (0, verify_1.extractToken)(request.headers.get('authorization'));
+        const headers = Object.fromEntries(request.headers.entries());
+        if (!token) {
+            const err = new types_1.OathMeshError('claim_missing:token', 'missing or invalid Authorization header', "provide a token in the format 'Authorization: OathMesh <token>'");
+            await config.onDenied?.(err, headers);
+            return Response.json(err.toJSON(), { status: 401 });
+        }
+        try {
+            const caller = await (0, verify_1.verifyOathToken)(token, config);
+            await config.onVerified?.(caller, headers);
+            // Verification passed — middleware.ts should call NextResponse.next()
+            // with injected X-OathMesh-* headers if desired
+            return null;
+        }
+        catch (e) {
+            const err = e instanceof types_1.OathMeshError
+                ? e
+                : new types_1.OathMeshError('verification_failed', e.message, 'check token format');
+            await config.onDenied?.(err, headers);
+            return Response.json(err.toJSON(), { status: 401 });
+        }
+    };
+}
+//# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAmCH,oCAsCC;AA2CD,0CAmCC;AAmCD,gDA6BC;AArND,mCAAiH;AACjH,qCAAyD;AAEzD,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,SAAgB,YAAY,CAAC,MAAsB;IACjD,OAAO,KAAK,EACV,OAAgB,EAIhB,EAAE;QACF,MAAM,KAAK,GAAG,IAAA,qBAAY,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,qBAAa,CAC3B,qBAAqB,EACrB,yCAAyC,EACzC,iEAAiE,CAClE,CAAC;YACF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;aACpD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACjC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,qBAAa;gBACpC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,qBAAa,CAAC,qBAAqB,EAAG,CAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACzF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;aACpD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAgB,eAAe,CAC7B,MAAsB,EACtB,OAAuB;IAEvB,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE;QACxB,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;YACzD,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC;YAC9B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,aAAa,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAA,qBAAY,EAAC,UAAU,CAAC,CAAC;QACvC,MAAM,OAAO,GAAG,GAAG,CAAC,OAA6C,CAAC;QAElE,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,qBAAa,CAC3B,qBAAqB,EACrB,yCAAyC,EACzC,iEAAiE,CAClE,CAAC;YACF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACnD,GAAW,CAAC,eAAe,GAAG,MAAM,CAAC;YACtC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,MAAM,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,qBAAa;gBACpC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,qBAAa,CAAC,qBAAqB,EAAG,CAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACzF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,SAAgB,kBAAkB,CAAC,MAAsB;IACvD,OAAO,KAAK,EAAE,OAAgB,EAA4B,EAAE;QAC1D,MAAM,KAAK,GAAG,IAAA,qBAAY,EAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC;QACjE,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;QAE9D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,IAAI,qBAAa,CAC3B,qBAAqB,EACrB,yCAAyC,EACzC,iEAAiE,CAClE,CAAC;YACF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAA,wBAAe,EAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACpD,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC3C,sEAAsE;YACtE,gDAAgD;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,GAAG,GAAG,CAAC,YAAY,qBAAa;gBACpC,CAAC,CAAC,CAAC;gBACH,CAAC,CAAC,IAAI,qBAAa,CAAC,qBAAqB,EAAG,CAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;YACzF,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;YACtC,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACtD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,174 @@
+/**
+ * OathMesh SDK Types
+ *
+ * These types mirror the Go VerifiedCallerContext from internal/core/context.go.
+ */
+/** Authenticated identity of the caller. */
+export interface Principal {
+    /** Canonical issuer URL (e.g., "https://issuer.oathmesh.dev") */
+    issuer: string;
+    /** Subject URI — always a scheme: svc://, agent://, job://, tool://, user:// */
+    subject: string;
+}
+/** Source provenance — where the call originated. */
+export interface Source {
+    type: string;
+    repo?: string;
+    workflow?: string;
+    runId?: string;
+    sha?: string;
+}
+/** The verified identity after successful token verification. */
+export interface VerifiedCallerContext {
+    principal: Principal;
+    action: string;
+    tokenId: string;
+    environment: string;
+    scope?: string[];
+    reason?: string;
+    source?: Source;
+}
+/** Machine-readable error code from the OathMesh error taxonomy. */
+export type ErrorCode = 'claim_missing:token' | 'claim_missing:iss' | 'claim_missing:sub' | 'claim_missing:aud' | 'claim_missing:act' | 'claim_missing:jti' | 'signature_invalid' | 'issuer_untrusted' | 'token_expired' | 'audience_mismatch' | 'algorithm_not_allowed' | 'replay_detected' | 'policy_denied' | 'binding_mismatch' | 'binding_required' | 'verification_failed';
+/** Structured error returned on verification failure. */
+export declare class OathMeshError extends Error {
+    readonly code: ErrorCode;
+    readonly fix?: string;
+    constructor(code: ErrorCode, message: string, fix?: string);
+    /** Serialize to the standard OathMesh error JSON shape. */
+    toJSON(): {
+        error: ErrorCode;
+        message: string;
+        fix: string | undefined;
+    };
+}
+/** Configuration for the OathMesh verifier. */
+export interface VerifierConfig {
+    /** The audience URL this receiver expects (exact match, no globs). */
+    audience: string;
+    /** Trusted issuer URLs (explicit allowlist — no wildcards, no auto-discovery). */
+    trustedIssuers: string[];
+    /**
+     * Enforces that tokens MUST include an rqh claim.
+     * When true, tokens without rqh are rejected with error "binding_required".
+     * Recommended for all write/mutate endpoints to prevent tampering.
+     * Default: false (for backward compatibility).
+     */
+    requireRequestBinding?: boolean;
+    /**
+     * Replay cache for preventing token reuse.
+     * If provided, tokens with duplicate jti within TTL are rejected.
+     * Use InMemoryReplayCache for development, or implement Redis-based cache for production.
+     * Default: undefined (no replay checking).
+     */
+    replayCache?: ReplayCache;
+    /**
+     * Policy evaluator for authorization decisions.
+     * If provided, token verification includes policy evaluation.
+     * Use JsonPolicyEvaluator with a JSON policy document.
+     * Default: undefined (no policy enforcement).
+     */
+    policyEvaluator?: PolicyEvaluator;
+    /**
+     * Called on every denied request. Use for logging, metrics, or alerting.
+     * Runs after the error response is determined but before it is sent.
+     */
+    onDenied?: (err: OathMeshError, headers: Record<string, string | undefined>) => void | Promise<void>;
+    /**
+     * Called on every successful verification. Use for logging or metrics.
+     */
+    onVerified?: (ctx: VerifiedCallerContext, headers: Record<string, string | undefined>) => void | Promise<void>;
+}
+/** The JSON body shape returned on verification failure. */
+export interface OathMeshErrorBody {
+    error: ErrorCode;
+    message: string;
+    fix?: string;
+    request_id?: string;
+}
+/**
+ * Replay cache interface for preventing token reuse attacks.
+ * Implementations can be in-memory (for single-instance) or Redis (for multi-instance).
+ */
+export interface ReplayCache {
+    /**
+     * Check if a token JTI has been seen before.
+     * Returns true if the token has been replayed (already used).
+     * Returns false if this is the first time seeing this JTI.
+     */
+    check(jti: string): boolean | Promise<boolean>;
+    /**
+     * Record a token JTI as seen.
+     * Should be called after successful verification.
+     */
+    add(jti: string): void | Promise<void>;
+}
+/**
+ * In-memory replay cache implementation for development/single-instance.
+ * Uses a Map with TTL to automatically expire old entries.
+ */
+export declare class InMemoryReplayCache implements ReplayCache {
+    private cache;
+    private defaultTTL;
+    constructor(defaultTTL?: number);
+    check(jti: string): boolean;
+    add(jti: string): void;
+}
+/**
+ * Policy input for evaluation.
+ */
+export interface PolicyInput {
+    iss: string;
+    sub: string;
+    aud: string;
+    act: string;
+    scope?: string[];
+    env?: string;
+}
+/**
+ * Policy decision result.
+ */
+export interface PolicyDecision {
+    outcome: 'allow' | 'deny';
+    ruleName?: string;
+    denyReason?: string;
+}
+/**
+ * Policy evaluator interface.
+ * Implementations evaluate token claims against policy rules.
+ */
+export interface PolicyEvaluator {
+    evaluate(input: PolicyInput): PolicyDecision | Promise<PolicyDecision>;
+}
+/**
+ * JSON policy rule format.
+ */
+export interface JsonPolicyRule {
+    match?: {
+        sub?: string;
+        aud?: string;
+        act?: string;
+        scope?: string[];
+        env?: string;
+    };
+    allow: boolean;
+    ruleName?: string;
+    denyReason?: string;
+}
+/**
+ * JSON policy document format.
+ */
+export interface JsonPolicyDocument {
+    rules: JsonPolicyRule[];
+}
+/**
+ * JSON policy evaluator that loads and evaluates simple JSON policies.
+ */
+export declare class JsonPolicyEvaluator implements PolicyEvaluator {
+    private policy;
+    constructor(policy: JsonPolicyDocument);
+    evaluate(input: PolicyInput): PolicyDecision;
+    private matchesRule;
+    private matchPattern;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,4CAA4C;AAC5C,MAAM,WAAW,SAAS;IACxB,iEAAiE;IACjE,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qDAAqD;AACrD,MAAM,WAAW,MAAM;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iEAAiE;AACjE,MAAM,WAAW,qBAAqB;IACpC,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,oEAAoE;AACpE,MAAM,MAAM,SAAS,GACjB,qBAAqB,GACrB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,mBAAmB,GACnB,kBAAkB,GAClB,eAAe,GACf,mBAAmB,GACnB,uBAAuB,GACvB,iBAAiB,GACjB,eAAe,GACf,kBAAkB,GAClB,kBAAkB,GAClB,qBAAqB,CAAC;AAE1B,yDAAyD;AACzD,qBAAa,aAAc,SAAQ,KAAK;IACtC,SAAgB,IAAI,EAAE,SAAS,CAAC;IAChC,SAAgB,GAAG,CAAC,EAAE,MAAM,CAAC;gBAEjB,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,MAAM;IAO1D,2DAA2D;IAC3D,MAAM;;;;;CAOP;AAED,+CAA+C;AAC/C,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,QAAQ,EAAE,MAAM,CAAC;IACjB,kFAAkF;IAClF,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;OAKG;IACH,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC;;;OAGG;IACH,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrG;;OAEG;IACH,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE,qBAAqB,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAChH;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,SAAS,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,WAAW;IAC1B;;;;OAIG;IACH,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC/C;;;OAGG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACxC;AAED;;;GAGG;AACH,qBAAa,mBAAoB,YAAW,WAAW;IACrD,OAAO,CAAC,KAAK,CAAkC;IAC/C,OAAO,CAAC,UAAU,CAAS;gBAEf,UAAU,GAAE,MAAY;IAIpC,KAAK,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO;IAY3B,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI;CAGvB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACxE;AAED;;GAEG;AACH,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE;QACN,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,GAAG,CAAC,EAAE,MAAM,CAAC;KACd,CAAC;IACF,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,cAAc,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,qBAAa,mBAAoB,YAAW,eAAe;IACzD,OAAO,CAAC,MAAM,CAAqB;gBAEvB,MAAM,EAAE,kBAAkB;IAItC,QAAQ,CAAC,KAAK,EAAE,WAAW,GAAG,cAAc;IAiB5C,OAAO,CAAC,WAAW;IAYnB,OAAO,CAAC,YAAY;CAOrB"}

package/dist/types.js

@@ -0,0 +1,98 @@
+"use strict";
+/**
+ * OathMesh SDK Types
+ *
+ * These types mirror the Go VerifiedCallerContext from internal/core/context.go.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JsonPolicyEvaluator = exports.InMemoryReplayCache = exports.OathMeshError = void 0;
+/** Structured error returned on verification failure. */
+class OathMeshError extends Error {
+    constructor(code, message, fix) {
+        super(message);
+        this.name = 'OathMeshError';
+        this.code = code;
+        this.fix = fix;
+    }
+    /** Serialize to the standard OathMesh error JSON shape. */
+    toJSON() {
+        return {
+            error: this.code,
+            message: this.message,
+            fix: this.fix,
+        };
+    }
+}
+exports.OathMeshError = OathMeshError;
+/**
+ * In-memory replay cache implementation for development/single-instance.
+ * Uses a Map with TTL to automatically expire old entries.
+ */
+class InMemoryReplayCache {
+    constructor(defaultTTL = 300) {
+        this.cache = new Map();
+        this.defaultTTL = defaultTTL;
+    }
+    check(jti) {
+        const expiresAt = this.cache.get(jti);
+        if (expiresAt === undefined) {
+            return false;
+        }
+        if (Date.now() > expiresAt) {
+            this.cache.delete(jti);
+            return false;
+        }
+        return true;
+    }
+    add(jti) {
+        this.cache.set(jti, Date.now() + this.defaultTTL * 1000);
+    }
+}
+exports.InMemoryReplayCache = InMemoryReplayCache;
+/**
+ * JSON policy evaluator that loads and evaluates simple JSON policies.
+ */
+class JsonPolicyEvaluator {
+    constructor(policy) {
+        this.policy = policy;
+    }
+    evaluate(input) {
+        for (const rule of this.policy.rules) {
+            if (this.matchesRule(input, rule)) {
+                return {
+                    outcome: rule.allow ? 'allow' : 'deny',
+                    ruleName: rule.ruleName,
+                    denyReason: rule.denyReason,
+                };
+            }
+        }
+        // Default deny if no rules match
+        return {
+            outcome: 'deny',
+            denyReason: 'no matching policy rule',
+        };
+    }
+    matchesRule(input, rule) {
+        if (!rule.match)
+            return false;
+        const match = rule.match;
+        if (match.sub && !this.matchPattern(input.sub, match.sub))
+            return false;
+        if (match.aud && !this.matchPattern(input.aud, match.aud))
+            return false;
+        if (match.act && !this.matchPattern(input.act, match.act))
+            return false;
+        if (match.env && input.env !== match.env)
+            return false;
+        return true;
+    }
+    matchPattern(value, pattern) {
+        if (pattern.includes('*')) {
+            const regex = new RegExp('^' + pattern.replace(/\*/g, '.*') + '$');
+            return regex.test(value);
+        }
+        return value === pattern;
+    }
+}
+exports.JsonPolicyEvaluator = JsonPolicyEvaluator;
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA;;;;GAIG;;;AAiDH,yDAAyD;AACzD,MAAa,aAAc,SAAQ,KAAK;IAItC,YAAY,IAAe,EAAE,OAAe,EAAE,GAAY;QACxD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACjB,CAAC;IAED,2DAA2D;IAC3D,MAAM;QACJ,OAAO;YACL,KAAK,EAAE,IAAI,CAAC,IAAI;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,GAAG,EAAE,IAAI,CAAC,GAAG;SACd,CAAC;IACJ,CAAC;CACF;AAnBD,sCAmBC;AAkED;;;GAGG;AACH,MAAa,mBAAmB;IAI9B,YAAY,aAAqB,GAAG;QAH5B,UAAK,GAAwB,IAAI,GAAG,EAAE,CAAC;QAI7C,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAW;QACf,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,KAAK,CAAC;QACf,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,EAAE,CAAC;YAC3B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACvB,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,GAAG,CAAC,GAAW;QACb,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC;CACF;AAvBD,kDAuBC;AAsDD;;GAEG;AACH,MAAa,mBAAmB;IAG9B,YAAY,MAA0B;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;IAED,QAAQ,CAAC,KAAkB;QACzB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;gBAClC,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;oBACtC,QAAQ,EAAE,IAAI,CAAC,QAAQ;oBACvB,UAAU,EAAE,IAAI,CAAC,UAAU;iBAC5B,CAAC;YACJ,CAAC;QACH,CAAC;QACD,iCAAiC;QACjC,OAAO;YACL,OAAO,EAAE,MAAM;YACf,UAAU,EAAE,yBAAyB;SACtC,CAAC;IACJ,CAAC;IAEO,WAAW,CAAC,KAAkB,EAAE,IAAoB;QAC1D,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAEzB,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACxE,IAAI,KAAK,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG;YAAE,OAAO,KAAK,CAAC;QAEvD,OAAO,IAAI,CAAC;IACd,CAAC;IAEO,YAAY,CAAC,KAAa,EAAE,OAAe;QACjD,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC;YACnE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,KAAK,KAAK,OAAO,CAAC;IAC3B,CAAC;CACF;AA3CD,kDA2CC"}

package/dist/verify.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Core OathMesh token verification — framework-agnostic.
+ *
+ * This module contains the pure verification logic shared by all framework
+ * adapters (Express, Next.js App Router, Next.js Pages Router, Edge Middleware).
+ * It has no dependency on any HTTP framework.
+ */
+import { type VerifierConfig, type VerifiedCallerContext } from './types';
+/**
+ * Extract the raw token string from an Authorization header value.
+ *
+ * Accepts:
+ *   - `OathMesh <token>` (canonical)
+ *   - `Bearer <token>` (compatibility — only when the token contains om+jwt typ)
+ *
+ * @returns The raw token string, or null if the header is missing/invalid.
+ */
+export declare function extractToken(authHeader: string | null | undefined): string | null;
+/**
+ * Verify an OathMesh token string and return the verified caller context.
+ *
+ * This is the core verification function. Framework adapters call this
+ * and handle HTTP responses themselves.
+ *
+ * @param token - Raw token string (without "OathMesh " prefix)
+ * @param config - Verifier configuration
+ * @returns Verified caller context on success
+ * @throws OathMeshError on any verification failure
+ */
+export declare function verifyOathToken(token: string, config: VerifierConfig): Promise<VerifiedCallerContext>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAiB,KAAK,cAAc,EAAE,KAAK,qBAAqB,EAAoB,MAAM,SAAS,CAAC;AAoB3G;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAKjF;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,cAAc,GACrB,OAAO,CAAC,qBAAqB,CAAC,CAgIhC"}