@passflow/core 0.20.0 → 0.21.0

package/dist/lib/interceptors/fetch-registry.d.ts

@@ -1,96 +0,0 @@
-/**
- * One `fetch` patch point, many middlewares.
- *
- * This module exists because of a bug, not a requirement (architecture §4.3,
- * reaffirmed by §13.5's "what survives supersession"). Two features that each do
- * `globalThis.fetch = wrapper` in an effect and restore their captured original
- * in cleanup compose as `A(B(native))`, and whichever cleanup runs first assigns
- * a fetch that predates the other patch. React guarantees no cleanup ordering
- * across sibling effects, nor across a parent/child boundary under Strict Mode
- * double-invocation, so one of the two interceptors silently disappears —
- * non-deterministically, and only in composed mounts.
- *
- * The fix is to make the patch a shared resource with reference-counted
- * ownership: the registry installs exactly one wrapper on the first
- * registration, composes the registered middlewares by priority on every call,
- * and removes the wrapper on the last removal. **Teardown is the registry's
- * responsibility, not any caller's** — no caller captures or restores
- * `globalThis.fetch` itself, which is precisely the ownership mistake being
- * retired.
- *
- * Composition is a Decorator chain, not a Chain of Responsibility: every
- * middleware MUST delegate to `next`. A link that may legitimately swallow a
- * request would mean a stranger's `fetch` call can vanish inside our wrapper, so
- * non-delegation is detected per invocation and reported as a named error rather
- * than left to surface as a hung promise (§9.4/R7).
- *
- * SSR safety is a stated non-functional requirement and is structural here:
- * `globalThis` is read only inside `install()` and inside the state reader,
- * never at module scope. Importing this module on a server touches no global and
- * throws nothing; `registerFetchMiddleware` returns a no-op unregister when
- * there is no `fetch` to patch (§9.4/R6).
- *
- * The module is generic. It knows nothing about upgrades, OIDC or Passflow
- * endpoints — only about ordering, ownership and delegation.
- */
-/** A `fetch`-shaped function: the platform `fetch`, or the next link in the chain. */
-export type FetchLike = (input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-/**
- * A registered interception layer.
- *
- * It receives the next link explicitly rather than closing over a captured
- * global, which is what lets the chain be rebuilt per call and reordered by
- * priority without any middleware knowing its neighbours.
- */
-export type FetchMiddleware = (next: FetchLike, input: RequestInfo | URL, init?: RequestInit) => Promise<Response>;
-export type RegisterOptions = {
-    /** Lower runs OUTER (further from the network). Ties break by registration order. */
-    priority: number;
-    /** Diagnostic label, surfaced in the error thrown when a middleware fails to delegate. */
-    name: string;
-};
-/**
- * Outer layer. The OIDC AuthFlow interceptor must observe the response the
- * caller will actually receive — including a replayed one — because it follows a
- * `redirect_url` out of that body. Placed inside the upgrade middleware it would
- * inspect the raw 401, do nothing, and the page would then navigate on a
- * response the caller never saw.
- */
-export declare const FETCH_PRIORITY_OIDC = 10;
-/**
- * Inner layer. The upgrade middleware must see the raw 401 and replace it before
- * anything upstream forms an opinion about it.
- */
-export declare const FETCH_PRIORITY_UPGRADE = 20;
-/** Thrown when a registered middleware resolves without ever calling `next`. */
-export declare class FetchMiddlewareContractError extends Error {
-    /** The `name` the offending middleware was registered under. */
-    readonly middlewareName: string;
-    constructor(middlewareName: string);
-}
-/**
- * Registers a middleware, installing the one global patch on the FIRST
- * registration, and returns an idempotent unregister that removes the patch on
- * the LAST removal.
- *
- * Safe in both directions and under Strict Mode's double-invoke: ownership is by
- * reference count over entry identity, so register/unregister/register of the
- * same middleware, and removals in any order relative to other registrations,
- * all converge. The returned function is bound to this one registration — a
- * second call does nothing, and registering the same middleware twice yields two
- * independent entries and two independent unregisters (§9.4/R8).
- */
-export declare const registerFetchMiddleware: (middleware: FetchMiddleware, opts: RegisterOptions) => (() => void);
-/**
- * Test and diagnostic read of the registry.
- *
- * `names` is in execution order, outermost first. `foreignPatch` is computed
- * live rather than remembered, so it reports a stranger's patch as soon as it
- * lands, not only once a teardown has declined to restore over it.
- */
-export declare const fetchRegistryState: () => {
-    installed: boolean;
-    names: string[];
-    foreignPatch: boolean;
-};
-//# sourceMappingURL=fetch-registry.d.ts.map

package/dist/lib/interceptors/fetch-registry.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fetch-registry.d.ts","sourceRoot":"","sources":["../../../lib/interceptors/fetch-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH,sFAAsF;AACtF,MAAM,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAE5F;;;;;;GAMG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,WAAW,GAAG,GAAG,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAEnH,MAAM,MAAM,eAAe,GAAG;IAC5B,qFAAqF;IACrF,QAAQ,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,KAAK,CAAC;AAEtC;;;GAGG;AACH,eAAO,MAAM,sBAAsB,KAAK,CAAC;AAEzC,gFAAgF;AAChF,qBAAa,4BAA6B,SAAQ,KAAK;IACrD,gEAAgE;IAChE,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAEhC,YAAY,cAAc,EAAE,MAAM,EAQjC;CACF;AAiID;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,uBAAuB,eAAgB,eAAe,QAAQ,eAAe,KAAG,CAAC,MAAM,IAAI,CA4BvG,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,QAAO;IAAE,SAAS,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,YAAY,EAAE,OAAO,CAAA;CAOjG,CAAC"}

package/dist/lib/m2m/client.d.ts

@@ -1,196 +0,0 @@
-/**
- * M2M (Machine-to-Machine) Authentication Client
- *
- * OAuth 2.0 Client Credentials Grant implementation for server-to-server
- * authentication without user involvement.
- *
- * @example
- * ```typescript
- * const m2m = new M2MClient({
- *   url: 'https://auth.yourapp.com',
- *   clientId: 'your-client-id',
- *   clientSecret: 'your-client-secret',
- *   scopes: ['users:read', 'orders:write'],
- * });
- *
- * const token = await m2m.getToken();
- * ```
- */
-import type { M2MClientConfig, M2MTokenClaims, M2MTokenRequestOptions, M2MTokenResponse } from './types';
-/**
- * M2M Authentication Client
- *
- * Implements OAuth 2.0 Client Credentials Grant for machine-to-machine
- * authentication. Provides automatic token caching, refresh, and retry logic.
- */
-export declare class M2MClient {
-    private readonly config;
-    private readonly cache;
-    private readonly retryStrategy;
-    private readonly tokenEndpoint;
-    /**
-     * Create a new M2M client
-     *
-     * @param config - Client configuration
-     * @throws {M2MConfigError} If required configuration is missing
-     *
-     * @example
-     * ```typescript
-     * const m2m = new M2MClient({
-     *   url: 'https://auth.yourapp.com',
-     *   clientId: 'your-client-id',
-     *   clientSecret: 'your-client-secret',
-     * });
-     * ```
-     */
-    constructor(config: M2MClientConfig);
-    /**
-     * Get the cache key for this client
-     */
-    private getCacheKey;
-    /**
-     * Request an access token from the authorization server
-     *
-     * @param options - Optional request overrides
-     * @returns Token response
-     * @throws {M2MError} On authentication failure
-     *
-     * @example
-     * ```typescript
-     * // Basic usage
-     * const token = await m2m.getToken();
-     *
-     * // With options
-     * const token = await m2m.getToken({
-     *   scopes: ['users:read'],
-     *   forceRefresh: true,
-     * });
-     * ```
-     */
-    getToken(options?: M2MTokenRequestOptions): Promise<M2MTokenResponse>;
-    /**
-     * Get a valid token, automatically refreshing if needed
-     *
-     * When autoRefresh is enabled, this will proactively refresh tokens
-     * that are about to expire (within refreshThreshold seconds).
-     *
-     * @returns Valid token response
-     * @throws {M2MError} On authentication failure
-     *
-     * @example
-     * ```typescript
-     * // Always returns a valid, non-expired token
-     * const token = await m2m.getValidToken();
-     * ```
-     */
-    getValidToken(): Promise<M2MTokenResponse>;
-    /**
-     * Request a new token from the authorization server
-     */
-    private requestToken;
-    /**
-     * Execute the actual HTTP request to the token endpoint
-     */
-    private doTokenRequest;
-    /**
-     * Execute a request with retry logic
-     */
-    private executeWithRetry;
-    /**
-     * Sleep for a given duration
-     */
-    private sleep;
-    /**
-     * Get the currently cached token without making a request
-     *
-     * @returns Cached token or null if not cached
-     *
-     * @example
-     * ```typescript
-     * const token = m2m.getCachedToken();
-     * if (token && !m2m.isTokenExpired(token)) {
-     *   console.log('Using cached token');
-     * }
-     * ```
-     */
-    getCachedToken(): M2MTokenResponse | null;
-    /**
-     * Check if a token is expired or about to expire
-     *
-     * @param token - Token to check (uses issued_at + expires_in if available)
-     * @param threshold - Seconds before actual expiry to consider expired (default: 0)
-     * @returns true if expired or about to expire
-     *
-     * @example
-     * ```typescript
-     * if (m2m.isTokenExpired(token)) {
-     *   console.log('Token is expired');
-     * }
-     *
-     * // Check if expiring within 5 minutes
-     * if (m2m.isTokenExpired(token, 300)) {
-     *   console.log('Token expires soon');
-     * }
-     * ```
-     */
-    isTokenExpired(token?: M2MTokenResponse | null, threshold?: number): boolean;
-    /**
-     * Parse token claims from a JWT access token
-     *
-     * @param token - JWT access token string
-     * @returns Decoded token claims
-     * @throws {M2MTokenParseError} If token format is invalid
-     *
-     * @example
-     * ```typescript
-     * const token = await m2m.getToken();
-     * const claims = m2m.parseToken(token.access_token);
-     * console.log('Client ID:', claims.client_id);
-     * console.log('Scopes:', claims.scopes);
-     * ```
-     */
-    parseToken(token: string): M2MTokenClaims;
-    /**
-     * Clear the token cache, forcing a new request on next getToken()
-     *
-     * @example
-     * ```typescript
-     * m2m.clearCache();
-     * // Next getToken() will request a new token
-     * const token = await m2m.getToken();
-     * ```
-     */
-    clearCache(): void;
-    /**
-     * Revoke the current token
-     *
-     * Note: Requires the server to support token revocation (RFC 7009).
-     * Not all Passflow deployments may support this endpoint.
-     *
-     * @throws {M2MError} If revocation fails
-     *
-     * @example
-     * ```typescript
-     * await m2m.revokeToken();
-     * console.log('Token revoked');
-     * ```
-     */
-    revokeToken(): Promise<void>;
-    /**
-     * Get the configured URL
-     */
-    get url(): string;
-    /**
-     * Get the configured client ID
-     */
-    get clientId(): string;
-    /**
-     * Get the configured scopes
-     */
-    get scopes(): string[] | undefined;
-    /**
-     * Get the configured audience
-     */
-    get audience(): string[] | undefined;
-}
-//# sourceMappingURL=client.d.ts.map

package/dist/lib/m2m/client.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../lib/m2m/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAGH,OAAO,KAAK,EACV,eAAe,EAGf,cAAc,EACd,sBAAsB,EAEtB,gBAAgB,EAEjB,MAAM,SAAS,CAAC;AA0DjB;;;;;GAKG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAMnB;IAEJ,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAgB;IAC9C,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAS;IAEvC;;;;;;;;;;;;;;OAcG;IACH,YAAY,MAAM,EAAE,eAAe,EAoClC;IAED;;OAEG;IACH,OAAO,CAAC,WAAW;IAMnB;;;;;;;;;;;;;;;;;;OAkBG;IACG,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAe1E;IAED;;;;;;;;;;;;;;OAcG;IACG,aAAa,IAAI,OAAO,CAAC,gBAAgB,CAAC,CAsB/C;IAED;;OAEG;YACW,YAAY;IA6C1B;;OAEG;YACW,cAAc;IAqF5B;;OAEG;YACW,gBAAgB;IA8B9B;;OAEG;IACH,OAAO,CAAC,KAAK;IAIb;;;;;;;;;;;;OAYG;IACH,cAAc,IAAI,gBAAgB,GAAG,IAAI,CAYxC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,cAAc,CAAC,KAAK,CAAC,EAAE,gBAAgB,GAAG,IAAI,EAAE,SAAS,SAAI,GAAG,OAAO,CAQtE;IAED;;;;;;;;;;;;;;OAcG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CA8BxC;IAED;;;;;;;;;OASG;IACH,UAAU,IAAI,IAAI,CAGjB;IAED;;;;;;;;;;;;;OAaG;IACG,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CA0CjC;IAED;;OAEG;IACH,IAAI,GAAG,IAAI,MAAM,CAEhB;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,CAErB;IAED;;OAEG;IACH,IAAI,MAAM,IAAI,MAAM,EAAE,GAAG,SAAS,CAEjC;IAED;;OAEG;IACH,IAAI,QAAQ,IAAI,MAAM,EAAE,GAAG,SAAS,CAEnC;CACF"}

package/dist/lib/m2m/errors.d.ts

@@ -1,107 +0,0 @@
-/**
- * M2M Authentication Error Classes
- *
- * Custom error classes for M2M authentication failures with
- * OAuth 2.0 compliant error codes and detailed information.
- */
-import type { M2MErrorCode, M2MRateLimitInfo } from './types';
-/**
- * M2M Authentication Error
- *
- * Thrown when M2M authentication fails. Contains OAuth 2.0 compliant
- * error codes and additional debugging information.
- *
- * @example
- * ```typescript
- * try {
- *   const token = await m2m.getToken();
- * } catch (error) {
- *   if (error instanceof M2MError) {
- *     console.error(`Error: ${error.code} - ${error.message}`);
- *     if (error.code === 'rate_limit_exceeded') {
- *       console.log(`Retry after: ${error.rateLimitInfo?.reset}`);
- *     }
- *   }
- * }
- * ```
- */
-export declare class M2MError extends Error {
-    /** OAuth 2.0 error code */
-    readonly code: M2MErrorCode;
-    /** HTTP status code from the response */
-    readonly status: number;
-    /** URI with more information about the error (if provided) */
-    readonly errorUri?: string;
-    /** Rate limit information (if rate limited) */
-    readonly rateLimitInfo?: M2MRateLimitInfo;
-    /** Response headers from the server */
-    readonly headers?: Record<string, string>;
-    /** Original error (if this wraps another error) */
-    readonly cause?: Error;
-    /** Timestamp when the error occurred */
-    readonly timestamp: string;
-    constructor(options: {
-        code: M2MErrorCode;
-        message: string;
-        status?: number;
-        errorUri?: string;
-        rateLimitInfo?: M2MRateLimitInfo;
-        headers?: Record<string, string>;
-        cause?: Error;
-    });
-    /**
-     * Create an M2MError from an OAuth 2.0 error response
-     */
-    static fromOAuthError(errorResponse: {
-        error: M2MErrorCode;
-        error_description?: string;
-        error_uri?: string;
-    }, status: number, headers?: Record<string, string>): M2MError;
-    /**
-     * Create an M2MError from a network or other error
-     */
-    static fromError(error: Error, code?: M2MErrorCode): M2MError;
-    /**
-     * Parse rate limit headers from response
-     */
-    static parseRateLimitHeaders(headers: Record<string, string>): M2MRateLimitInfo | undefined;
-    /**
-     * Get default error message for an error code
-     */
-    static getDefaultMessage(code: M2MErrorCode): string;
-    /**
-     * Check if the error is retryable
-     */
-    isRetryable(): boolean;
-    /**
-     * Get suggested wait time before retry (in milliseconds)
-     */
-    getRetryAfter(): number;
-    /**
-     * Convert to JSON-serializable object
-     */
-    toJSON(): Record<string, unknown>;
-    /**
-     * Create a human-readable string representation
-     */
-    toString(): string;
-}
-/**
- * Network error (connection failed, timeout, etc.)
- */
-export declare class M2MNetworkError extends M2MError {
-    constructor(message: string, cause?: Error);
-}
-/**
- * Token parsing error (invalid JWT format)
- */
-export declare class M2MTokenParseError extends M2MError {
-    constructor(message: string, cause?: Error);
-}
-/**
- * Configuration error (missing or invalid config)
- */
-export declare class M2MConfigError extends M2MError {
-    constructor(message: string);
-}
-//# sourceMappingURL=errors.d.ts.map

package/dist/lib/m2m/errors.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../lib/m2m/errors.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAE9D;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,QAAS,SAAQ,KAAK;IACjC,2BAA2B;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAE5B,yCAAyC;IACzC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAExB,8DAA8D;IAC9D,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAE3B,+CAA+C;IAC/C,QAAQ,CAAC,aAAa,CAAC,EAAE,gBAAgB,CAAC;IAE1C,uCAAuC;IACvC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAE1C,mDAAmD;IACnD,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IAEvB,wCAAwC;IACxC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAE3B,YAAY,OAAO,EAAE;QACnB,IAAI,EAAE,YAAY,CAAC;QACnB,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,aAAa,CAAC,EAAE,gBAAgB,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,KAAK,CAAC,EAAE,KAAK,CAAC;KACf,EAeA;IAED;;OAEG;IACH,MAAM,CAAC,cAAc,CACnB,aAAa,EAAE;QACb,KAAK,EAAE,YAAY,CAAC;QACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,SAAS,CAAC,EAAE,MAAM,CAAC;KACpB,EACD,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,QAAQ,CAWV;IAED;;OAEG;IACH,MAAM,CAAC,SAAS,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,GAAE,YAA6B,GAAG,QAAQ,CAO5E;IAED;;OAEG;IACH,MAAM,CAAC,qBAAqB,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,gBAAgB,GAAG,SAAS,CAc1F;IAED;;OAEG;IACH,MAAM,CAAC,iBAAiB,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAcnD;IAED;;OAEG;IACH,WAAW,IAAI,OAAO,CAOrB;IAED;;OAEG;IACH,aAAa,IAAI,MAAM,CAStB;IAED;;OAEG;IACH,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUhC;IAED;;OAEG;IACH,QAAQ,IAAI,MAAM,CAMjB;CACF;AAED;;GAEG;AACH,qBAAa,eAAgB,SAAQ,QAAQ;IAC3C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAQzC;CACF;AAED;;GAEG;AACH,qBAAa,kBAAmB,SAAQ,QAAQ;IAC9C,YAAY,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,KAAK,EAQzC;CACF;AAED;;GAEG;AACH,qBAAa,cAAe,SAAQ,QAAQ;IAC1C,YAAY,OAAO,EAAE,MAAM,EAO1B;CACF"}

package/dist/lib/m2m/index.d.ts

@@ -1,27 +0,0 @@
-/**
- * M2M (Machine-to-Machine) Authentication Module
- *
- * OAuth 2.0 Client Credentials Grant implementation for server-to-server
- * authentication without user involvement.
- *
- * @example
- * ```typescript
- * import { M2MClient } from '@passflow/core';
- *
- * const m2m = new M2MClient({
- *   url: 'https://auth.yourapp.com',
- *   clientId: 'your-client-id',
- *   clientSecret: 'your-client-secret',
- *   scopes: ['users:read', 'orders:write'],
- * });
- *
- * const token = await m2m.getToken();
- * ```
- *
- * @packageDocumentation
- */
-export { M2MClient } from './client';
-export { M2MConfigError, M2MError, M2MNetworkError, M2MTokenParseError } from './errors';
-export type { M2MClientConfig, M2MErrorCode, M2MErrorResponse, M2MRateLimitInfo, M2MTokenCache, M2MTokenClaims, M2MTokenRequestInfo, M2MTokenRequestOptions, M2MTokenResponse, RetryStrategy, } from './types';
-export { M2M_DEFAULTS, M2MErrorCodes } from './types';
-//# sourceMappingURL=index.d.ts.map

package/dist/lib/m2m/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../lib/m2m/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAGrC,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAGzF,YAAY,EACV,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,gBAAgB,EAChB,aAAa,GACd,MAAM,SAAS,CAAC;AAGjB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC"}

package/dist/lib/m2m/types.d.ts

@@ -1,217 +0,0 @@
-/**
- * M2M (Machine-to-Machine) Authentication Types
- *
- * OAuth 2.0 Client Credentials Grant implementation for server-to-server
- * authentication without user involvement.
- */
-/**
- * M2M Client configuration options
- */
-export type M2MClientConfig = {
-    /** Passflow server URL */
-    url: string;
-    /** M2M application client ID */
-    clientId: string;
-    /** M2M application client secret */
-    clientSecret: string;
-    /** Scopes to request (default: []) */
-    scopes?: string[];
-    /** Target audiences for the token */
-    audience?: string[];
-    /** Automatically refresh tokens before expiry (default: false) */
-    autoRefresh?: boolean;
-    /** Seconds before expiry to trigger refresh (default: 30) */
-    refreshThreshold?: number;
-    /** Request timeout in milliseconds (default: 10000) */
-    timeout?: number;
-    /** Number of retry attempts on failure (default: 3) */
-    retries?: number;
-    /** Delay between retries in milliseconds (default: 1000) */
-    retryDelay?: number;
-    /** Custom retry strategy */
-    retryStrategy?: RetryStrategy;
-    /** Custom token cache implementation */
-    cache?: M2MTokenCache;
-    /** Callback for token requests (for logging/metrics) */
-    onTokenRequest?: (request: M2MTokenRequestInfo) => void;
-    /** Callback for token responses (for logging/metrics) */
-    onTokenResponse?: (response: M2MTokenResponse) => void;
-    /** Callback for errors (for logging/metrics) */
-    onError?: (error: M2MErrorResponse) => void;
-};
-/**
- * Token request options (can override defaults per-request)
- */
-export type M2MTokenRequestOptions = {
-    /** Override default scopes for this request */
-    scopes?: string[];
-    /** Override default audience for this request */
-    audience?: string[];
-    /** Force a new token request, ignoring cache */
-    forceRefresh?: boolean;
-};
-/**
- * Token request info (for logging callbacks)
- */
-export type M2MTokenRequestInfo = {
-    /** Client ID being used */
-    clientId: string;
-    /** Scopes being requested */
-    scopes: string[];
-    /** Audiences being requested */
-    audience: string[];
-    /** Request timestamp */
-    timestamp: string;
-};
-/**
- * OAuth 2.0 token response from the authorization server
- */
-export type M2MTokenResponse = {
-    /** The access token (JWT) */
-    access_token: string;
-    /** Token type (always "Bearer") */
-    token_type: 'Bearer';
-    /** Token lifetime in seconds */
-    expires_in: number;
-    /** Granted scopes (space-separated string) */
-    scope?: string;
-    /** Timestamp when token was issued (added by client) */
-    issued_at?: number;
-};
-/**
- * OAuth 2.0 error response from the authorization server
- */
-export type M2MErrorResponse = {
-    /** OAuth 2.0 error code */
-    error: M2MErrorCode;
-    /** Human-readable error description */
-    error_description?: string;
-    /** URI with more information about the error */
-    error_uri?: string;
-};
-/**
- * Parsed M2M JWT token claims
- */
-export type M2MTokenClaims = {
-    /** Issuer (Passflow server URL) */
-    iss: string;
-    /** Subject (client_id) */
-    sub: string;
-    /** Audience (target APIs) */
-    aud: string | string[];
-    /** Issued at timestamp (Unix epoch seconds) */
-    iat: number;
-    /** Expiration timestamp (Unix epoch seconds) */
-    exp: number;
-    /** JWT ID (unique token identifier) */
-    jti?: string;
-    /** Token type ("m2m") */
-    type: 'm2m';
-    /** Client ID */
-    client_id: string;
-    /** Tenant ID (for tenant-scoped M2M apps) */
-    tenant_id?: string;
-    /** Granted scopes */
-    scopes: string[];
-};
-/**
- * M2M error codes (OAuth 2.0 compliant)
- */
-export type M2MErrorCode = 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'invalid_scope' | 'unauthorized_client' | 'unsupported_grant_type' | 'rate_limit_exceeded' | 'server_error' | 'temporarily_unavailable';
-/**
- * M2M error code enum for convenience
- */
-export declare const M2MErrorCodes: {
-    InvalidRequest: 'invalid_request';
-    InvalidClient: 'invalid_client';
-    InvalidGrant: 'invalid_grant';
-    InvalidScope: 'invalid_scope';
-    UnauthorizedClient: 'unauthorized_client';
-    UnsupportedGrantType: 'unsupported_grant_type';
-    RateLimitExceeded: 'rate_limit_exceeded';
-    ServerError: 'server_error';
-    TemporarilyUnavailable: 'temporarily_unavailable';
-};
-/**
- * Custom token cache interface for external cache implementations
- */
-export interface M2MTokenCache {
-    /**
-     * Get cached token by key
-     * @param key Cache key (typically clientId)
-     * @returns Cached token or null if not found/expired
-     */
-    get(key: string): Promise<M2MTokenResponse | null>;
-    /**
-     * Cache a token with TTL
-     * @param key Cache key (typically clientId)
-     * @param token Token to cache
-     * @param ttl Time-to-live in seconds
-     */
-    set(key: string, token: M2MTokenResponse, ttl: number): Promise<void>;
-    /**
-     * Delete cached token
-     * @param key Cache key (typically clientId)
-     */
-    delete(key: string): Promise<void>;
-}
-/**
- * Custom retry strategy interface
- */
-export interface RetryStrategy {
-    /**
-     * Determine if the request should be retried
-     * @param error The error that occurred
-     * @param attempt Current attempt number (1-based)
-     * @returns true if request should be retried
-     */
-    shouldRetry(error: {
-        code: M2MErrorCode;
-        status?: number;
-    }, attempt: number): boolean;
-    /**
-     * Get delay before next retry
-     * @param attempt Current attempt number (1-based)
-     * @returns Delay in milliseconds
-     */
-    getDelay(attempt: number): number;
-}
-/**
- * Internal token request payload sent to the authorization server
- */
-export type M2MTokenRequestPayload = {
-    grant_type: 'client_credentials';
-    client_id: string;
-    client_secret: string;
-    scope?: string;
-    audience?: string;
-};
-/**
- * Rate limit information from response headers
- */
-export type M2MRateLimitInfo = {
-    /** Maximum requests allowed in the window */
-    limit: number;
-    /** Remaining requests in the current window */
-    remaining: number;
-    /** Unix timestamp when the window resets */
-    reset: number;
-};
-/**
- * Default configuration values
- */
-export declare const M2M_DEFAULTS: {
-    /** Default token endpoint path */
-    readonly TOKEN_ENDPOINT: '/oauth2/token';
-    /** Default request timeout in milliseconds */
-    readonly TIMEOUT: 10000;
-    /** Default number of retry attempts */
-    readonly RETRIES: 3;
-    /** Default delay between retries in milliseconds */
-    readonly RETRY_DELAY: 1000;
-    /** Default refresh threshold in seconds */
-    readonly REFRESH_THRESHOLD: 30;
-    /** Content-Type for token requests */
-    readonly CONTENT_TYPE: 'application/x-www-form-urlencoded';
-};
-//# sourceMappingURL=types.d.ts.map

package/dist/lib/m2m/types.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../lib/m2m/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH;;GAEG;AACH,MAAM,MAAM,eAAe,GAAG;IAC5B,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IAEZ,gCAAgC;IAChC,QAAQ,EAAE,MAAM,CAAC;IAEjB,oCAAoC;IACpC,YAAY,EAAE,MAAM,CAAC;IAErB,sCAAsC;IACtC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,qCAAqC;IACrC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,kEAAkE;IAClE,WAAW,CAAC,EAAE,OAAO,CAAC;IAEtB,6DAA6D;IAC7D,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,uDAAuD;IACvD,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,4DAA4D;IAC5D,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,4BAA4B;IAC5B,aAAa,CAAC,EAAE,aAAa,CAAC;IAE9B,wCAAwC;IACxC,KAAK,CAAC,EAAE,aAAa,CAAC;IAEtB,wDAAwD;IACxD,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,IAAI,CAAC;IAExD,yDAAyD;IACzD,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAEvD,gDAAgD;IAChD,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,KAAK,IAAI,CAAC;CAC7C,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,+CAA+C;IAC/C,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAElB,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IAEpB,gDAAgD;IAChD,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,mBAAmB,GAAG;IAChC,2BAA2B;IAC3B,QAAQ,EAAE,MAAM,CAAC;IAEjB,6BAA6B;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IAEjB,gCAAgC;IAChC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAEnB,wBAAwB;IACxB,SAAS,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6BAA6B;IAC7B,YAAY,EAAE,MAAM,CAAC;IAErB,mCAAmC;IACnC,UAAU,EAAE,QAAQ,CAAC;IAErB,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IAEnB,8CAA8C;IAC9C,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,wDAAwD;IACxD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,2BAA2B;IAC3B,KAAK,EAAE,YAAY,CAAC;IAEpB,uCAAuC;IACvC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAE3B,gDAAgD;IAChD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,cAAc,GAAG;IAC3B,mCAAmC;IACnC,GAAG,EAAE,MAAM,CAAC;IAEZ,0BAA0B;IAC1B,GAAG,EAAE,MAAM,CAAC;IAEZ,6BAA6B;IAC7B,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAAC;IAEvB,+CAA+C;IAC/C,GAAG,EAAE,MAAM,CAAC;IAEZ,gDAAgD;IAChD,GAAG,EAAE,MAAM,CAAC;IAEZ,uCAAuC;IACvC,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,yBAAyB;IACzB,IAAI,EAAE,KAAK,CAAC;IAEZ,gBAAgB;IAChB,SAAS,EAAE,MAAM,CAAC;IAElB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,qBAAqB;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,YAAY,GACpB,iBAAiB,GACjB,gBAAgB,GAChB,eAAe,GACf,eAAe,GACf,qBAAqB,GACrB,wBAAwB,GACxB,qBAAqB,GACrB,cAAc,GACd,yBAAyB,CAAC;AAE9B;;GAEG;AACH,eAAO,MAAM,aAAa;IACxB,cAAc,EAAE,iBAAiB;IACjC,aAAa,EAAE,gBAAgB;IAC/B,YAAY,EAAE,eAAe;IAC7B,YAAY,EAAE,eAAe;IAC7B,kBAAkB,EAAE,qBAAqB;IACzC,oBAAoB,EAAE,wBAAwB;IAC9C,iBAAiB,EAAE,qBAAqB;IACxC,WAAW,EAAE,cAAc;IAC3B,sBAAsB,EAAE,yBAAyB;CAClD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CAAC;IAEnD;;;;;OAKG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAEtE;;;OAGG;IACH,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACpC;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;IAEtF;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC;CACnC;AAED;;GAEG;AACH,MAAM,MAAM,sBAAsB,GAAG;IACnC,UAAU,EAAE,oBAAoB,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF;;GAEG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IAEd,+CAA+C;IAC/C,SAAS,EAAE,MAAM,CAAC;IAElB,4CAA4C;IAC5C,KAAK,EAAE,MAAM,CAAC;CACf,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,YAAY;IACvB,kCAAkC;aAClC,cAAc,EAAE,eAAe;IAE/B,8CAA8C;aAC9C,OAAO,EAAE,KAAK;IAEd,uCAAuC;aACvC,OAAO,EAAE,CAAC;IAEV,oDAAoD;aACpD,WAAW,EAAE,IAAI;IAEjB,2CAA2C;aAC3C,iBAAiB,EAAE,EAAE;IAErB,sCAAsC;aACtC,YAAY,EAAE,mCAAmC;CACzC,CAAC"}