@passflow/node 0.0.0-bootstrap.0 → 0.0.0-stage

package/dist/fastify.cjs

@@ -1,67 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_evaluate = require("./evaluate-C20MecTf.cjs");
-// src/fastify.ts
-function send(reply, decision) {
-	if (decision.kind === "reject") reply.code(decision.status).headers(decision.headers).send();
-}
-/**
-* Hooks for one verifier, with no plugin and no decoration, callable any number of times: the way to use a second
-* verifier on an instance. Each is a `preHandler`-shaped async function. `authenticate` always verifies the presented
-* token and replaces `request.passflow`. `requireACR` and `requireFresh` reuse claims only when this verifier produced
-* that exact object, and otherwise verify the presented token themselves, so a broad instance-level hook followed by
-* a narrow route-level one enforces the narrow verifier's policy. Both throw `TypeError` at construction on an invalid
-* level or limit.
-*/
-function createFastifyHooks(verifier) {
-	require_evaluate.assertVerifier(verifier);
-	const hook = (reuse, requirement) => async (request, reply) => {
-		const existing = reuse ? request.passflow ?? void 0 : void 0;
-		const result = await require_evaluate.guard(verifier, request.headers.authorization, existing, requirement);
-		if ("reject" in result) {
-			send(reply, result.reject);
-			return reply;
-		}
-		request.passflow = result.claims;
-	};
-	return {
-		authenticate: hook(false),
-		requireACR: (min) => hook(true, require_evaluate.assertRequirement({
-			kind: "acr",
-			min
-		})),
-		requireFresh: (maxAgeSeconds) => hook(true, require_evaluate.assertRequirement({
-			kind: "fresh",
-			maxAgeSeconds
-		}))
-	};
-}
-const plugin = async (fastify, opts) => {
-	const hooks = createFastifyHooks(opts.verifier);
-	fastify.decorate("passflow", hooks);
-	fastify.decorateRequest("passflow", null);
-};
-/**
-* Decorates the instance with `fastify.passflow` and `request.passflow`, and registers no hook, so routes opt in one
-* at a time and public routes are untouched. Register it at most once per instance: a second registration throws
-* Fastify's own `FST_ERR_DEC_ALREADY_PRESENT`. Use {@link createFastifyHooks} for every further verifier.
-*/
-const passflowFastify = Object.assign(plugin, {
-	[Symbol.for("skip-override")]: true,
-	[Symbol.for("fastify.display-name")]: "@passflow/node"
-});
-/** The claims a Passflow hook put on this request. Throws `PassflowUsageError` if none ran. */
-function getAuth(request) {
-	if (request.passflow === null || request.passflow === void 0) throw new require_evaluate.PassflowUsageError("[passflow] getAuth called before a Passflow hook ran on this request");
-	return request.passflow;
-}
-/** Names `WWW-Authenticate` in `@fastify/cors`'s `exposedHeaders`, keeping what is already there. */
-function exposeChallengeHeader(cors) {
-	return {
-		...cors,
-		exposedHeaders: require_evaluate.withChallengeHeader(cors?.exposedHeaders)
-	};
-}
-exports.createFastifyHooks = createFastifyHooks;
-exports.exposeChallengeHeader = exposeChallengeHeader;
-exports.getAuth = getAuth;
-exports.passflowFastify = passflowFastify;

package/dist/fastify.d.cts

@@ -1,40 +0,0 @@
-import { r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.cjs";
-import { FastifyPluginAsync, FastifyRequest, preHandlerAsyncHookHandler } from "fastify";
-export type PassflowFastifyHooks = {
-  authenticate: preHandlerAsyncHookHandler;
-  requireACR(min: string): preHandlerAsyncHookHandler;
-  requireFresh(maxAgeSeconds: number): preHandlerAsyncHookHandler;
-};
-declare module 'fastify' {
-  interface FastifyInstance {
-    passflow: PassflowFastifyHooks;
-  }
-  interface FastifyRequest {
-    passflow: PassflowClaims | null;
-  }
-}
-/**
- * Hooks for one verifier, with no plugin and no decoration, callable any number of times: the way to use a second
- * verifier on an instance. Each is a `preHandler`-shaped async function. `authenticate` always verifies the presented
- * token and replaces `request.passflow`. `requireACR` and `requireFresh` reuse claims only when this verifier produced
- * that exact object, and otherwise verify the presented token themselves, so a broad instance-level hook followed by
- * a narrow route-level one enforces the narrow verifier's policy. Both throw `TypeError` at construction on an invalid
- * level or limit.
- */
-export declare function createFastifyHooks(verifier: Verifier): PassflowFastifyHooks;
-/**
- * Decorates the instance with `fastify.passflow` and `request.passflow`, and registers no hook, so routes opt in one
- * at a time and public routes are untouched. Register it at most once per instance: a second registration throws
- * Fastify's own `FST_ERR_DEC_ALREADY_PRESENT`. Use {@link createFastifyHooks} for every further verifier.
- */
-export declare const passflowFastify: FastifyPluginAsync<{
-  verifier: Verifier;
-}>;
-/** The claims a Passflow hook put on this request. Throws `PassflowUsageError` if none ran. */
-export declare function getAuth(request: Pick<FastifyRequest, 'passflow'>): PassflowClaims;
-/** Names `WWW-Authenticate` in `@fastify/cors`'s `exposedHeaders`, keeping what is already there. */
-export declare function exposeChallengeHeader<T extends object>(cors: T & {
-  exposedHeaders?: string | string[];
-}): Omit<T, 'exposedHeaders'> & {
-  exposedHeaders: string[];
-};

package/dist/fastify.d.mts

@@ -1,40 +0,0 @@
-import { r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.mjs";
-import { FastifyPluginAsync, FastifyRequest, preHandlerAsyncHookHandler } from "fastify";
-export type PassflowFastifyHooks = {
-  authenticate: preHandlerAsyncHookHandler;
-  requireACR(min: string): preHandlerAsyncHookHandler;
-  requireFresh(maxAgeSeconds: number): preHandlerAsyncHookHandler;
-};
-declare module 'fastify' {
-  interface FastifyInstance {
-    passflow: PassflowFastifyHooks;
-  }
-  interface FastifyRequest {
-    passflow: PassflowClaims | null;
-  }
-}
-/**
- * Hooks for one verifier, with no plugin and no decoration, callable any number of times: the way to use a second
- * verifier on an instance. Each is a `preHandler`-shaped async function. `authenticate` always verifies the presented
- * token and replaces `request.passflow`. `requireACR` and `requireFresh` reuse claims only when this verifier produced
- * that exact object, and otherwise verify the presented token themselves, so a broad instance-level hook followed by
- * a narrow route-level one enforces the narrow verifier's policy. Both throw `TypeError` at construction on an invalid
- * level or limit.
- */
-export declare function createFastifyHooks(verifier: Verifier): PassflowFastifyHooks;
-/**
- * Decorates the instance with `fastify.passflow` and `request.passflow`, and registers no hook, so routes opt in one
- * at a time and public routes are untouched. Register it at most once per instance: a second registration throws
- * Fastify's own `FST_ERR_DEC_ALREADY_PRESENT`. Use {@link createFastifyHooks} for every further verifier.
- */
-export declare const passflowFastify: FastifyPluginAsync<{
-  verifier: Verifier;
-}>;
-/** The claims a Passflow hook put on this request. Throws `PassflowUsageError` if none ran. */
-export declare function getAuth(request: Pick<FastifyRequest, 'passflow'>): PassflowClaims;
-/** Names `WWW-Authenticate` in `@fastify/cors`'s `exposedHeaders`, keeping what is already there. */
-export declare function exposeChallengeHeader<T extends object>(cors: T & {
-  exposedHeaders?: string | string[];
-}): Omit<T, 'exposedHeaders'> & {
-  exposedHeaders: string[];
-};

package/dist/fastify.mjs

@@ -1,63 +0,0 @@
-import { a as guard, d as withChallengeHeader, n as assertVerifier, s as PassflowUsageError, t as assertRequirement } from "./evaluate-BTuol-Oa.mjs";
-// src/fastify.ts
-function send(reply, decision) {
-	if (decision.kind === "reject") reply.code(decision.status).headers(decision.headers).send();
-}
-/**
-* Hooks for one verifier, with no plugin and no decoration, callable any number of times: the way to use a second
-* verifier on an instance. Each is a `preHandler`-shaped async function. `authenticate` always verifies the presented
-* token and replaces `request.passflow`. `requireACR` and `requireFresh` reuse claims only when this verifier produced
-* that exact object, and otherwise verify the presented token themselves, so a broad instance-level hook followed by
-* a narrow route-level one enforces the narrow verifier's policy. Both throw `TypeError` at construction on an invalid
-* level or limit.
-*/
-function createFastifyHooks(verifier) {
-	assertVerifier(verifier);
-	const hook = (reuse, requirement) => async (request, reply) => {
-		const existing = reuse ? request.passflow ?? void 0 : void 0;
-		const result = await guard(verifier, request.headers.authorization, existing, requirement);
-		if ("reject" in result) {
-			send(reply, result.reject);
-			return reply;
-		}
-		request.passflow = result.claims;
-	};
-	return {
-		authenticate: hook(false),
-		requireACR: (min) => hook(true, assertRequirement({
-			kind: "acr",
-			min
-		})),
-		requireFresh: (maxAgeSeconds) => hook(true, assertRequirement({
-			kind: "fresh",
-			maxAgeSeconds
-		}))
-	};
-}
-const plugin = async (fastify, opts) => {
-	const hooks = createFastifyHooks(opts.verifier);
-	fastify.decorate("passflow", hooks);
-	fastify.decorateRequest("passflow", null);
-};
-/**
-* Decorates the instance with `fastify.passflow` and `request.passflow`, and registers no hook, so routes opt in one
-* at a time and public routes are untouched. Register it at most once per instance: a second registration throws
-* Fastify's own `FST_ERR_DEC_ALREADY_PRESENT`. Use {@link createFastifyHooks} for every further verifier.
-*/
-const passflowFastify = Object.assign(plugin, {
-	[Symbol.for("skip-override")]: true,
-	[Symbol.for("fastify.display-name")]: "@passflow/node"
-});
-/** The claims a Passflow hook put on this request. Throws `PassflowUsageError` if none ran. */
-function getAuth(request) {
-	if (request.passflow === null || request.passflow === void 0) throw new PassflowUsageError("[passflow] getAuth called before a Passflow hook ran on this request");
-	return request.passflow;
-}
-/** Names `WWW-Authenticate` in `@fastify/cors`'s `exposedHeaders`, keeping what is already there. */
-function exposeChallengeHeader(cors) {
-	return {
-		...cors,
-		exposedHeaders: withChallengeHeader(cors?.exposedHeaders)
-	};
-}
-export { createFastifyHooks, exposeChallengeHeader, getAuth, passflowFastify };

package/dist/hono.cjs

@@ -1,51 +0,0 @@
-Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_evaluate = require("./evaluate-C20MecTf.cjs");
-// src/hono.ts
-/** `c.body` rather than a thrown HTTPException, so headers `hono/cors` already set survive the rejection. */
-function send(c, decision) {
-	const { status, headers } = decision;
-	return c.body(null, status, headers);
-}
-/**
-* Hono middleware, for any runtime with WebCrypto and fetch. `authenticate` always verifies the presented token and
-* replaces the `passflow` variable. `requireACR` and `requireFresh` work alone: they reuse claims only when this verifier
-* produced that exact object, and otherwise verify the presented token themselves. Both throw `TypeError` at construction
-* on an invalid level or limit.
-*/
-function passflowHono(verifier) {
-	require_evaluate.assertVerifier(verifier);
-	const middleware = (reuse, requirement) => async (c, next) => {
-		const existing = reuse ? c.get("passflow") : void 0;
-		const result = await require_evaluate.guard(verifier, c.req.header("authorization"), existing, requirement);
-		if ("reject" in result) return send(c, result.reject);
-		c.set("passflow", result.claims);
-		await next();
-	};
-	return {
-		authenticate: middleware(false),
-		requireACR: (min) => middleware(true, require_evaluate.assertRequirement({
-			kind: "acr",
-			min
-		})),
-		requireFresh: (maxAgeSeconds) => middleware(true, require_evaluate.assertRequirement({
-			kind: "fresh",
-			maxAgeSeconds
-		}))
-	};
-}
-/** The claims a Passflow middleware put on this context. Throws `PassflowUsageError` if none ran. */
-function getAuth(c) {
-	const claims = c.get("passflow");
-	if (claims === void 0 || claims === null) throw new require_evaluate.PassflowUsageError("[passflow] getAuth called before a Passflow middleware ran on this request");
-	return claims;
-}
-/** Names `WWW-Authenticate` in `hono/cors`'s `exposeHeaders`, keeping what is already there. */
-function exposeChallengeHeader(cors) {
-	return {
-		...cors,
-		exposeHeaders: require_evaluate.withChallengeHeader(cors?.exposeHeaders)
-	};
-}
-exports.exposeChallengeHeader = exposeChallengeHeader;
-exports.getAuth = getAuth;
-exports.passflowHono = passflowHono;

package/dist/hono.d.cts

@@ -1,24 +0,0 @@
-import { r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.cjs";
-import { Context, MiddlewareHandler } from "hono";
-export type PassflowVariables = {
-  passflow: PassflowClaims;
-};
-/**
- * Hono middleware, for any runtime with WebCrypto and fetch. `authenticate` always verifies the presented token and
- * replaces the `passflow` variable. `requireACR` and `requireFresh` work alone: they reuse claims only when this verifier
- * produced that exact object, and otherwise verify the presented token themselves. Both throw `TypeError` at construction
- * on an invalid level or limit.
- */
-export declare function passflowHono(verifier: Verifier): {
-  authenticate: MiddlewareHandler;
-  requireACR(min: string): MiddlewareHandler;
-  requireFresh(maxAgeSeconds: number): MiddlewareHandler;
-};
-/** The claims a Passflow middleware put on this context. Throws `PassflowUsageError` if none ran. */
-export declare function getAuth(c: Context): PassflowClaims;
-/** Names `WWW-Authenticate` in `hono/cors`'s `exposeHeaders`, keeping what is already there. */
-export declare function exposeChallengeHeader<T extends object>(cors: T & {
-  exposeHeaders?: string[];
-}): Omit<T, 'exposeHeaders'> & {
-  exposeHeaders: string[];
-};

package/dist/hono.d.mts

@@ -1,24 +0,0 @@
-import { r as Verifier, t as PassflowClaims } from "./claims-BHJhnzch.mjs";
-import { Context, MiddlewareHandler } from "hono";
-export type PassflowVariables = {
-  passflow: PassflowClaims;
-};
-/**
- * Hono middleware, for any runtime with WebCrypto and fetch. `authenticate` always verifies the presented token and
- * replaces the `passflow` variable. `requireACR` and `requireFresh` work alone: they reuse claims only when this verifier
- * produced that exact object, and otherwise verify the presented token themselves. Both throw `TypeError` at construction
- * on an invalid level or limit.
- */
-export declare function passflowHono(verifier: Verifier): {
-  authenticate: MiddlewareHandler;
-  requireACR(min: string): MiddlewareHandler;
-  requireFresh(maxAgeSeconds: number): MiddlewareHandler;
-};
-/** The claims a Passflow middleware put on this context. Throws `PassflowUsageError` if none ran. */
-export declare function getAuth(c: Context): PassflowClaims;
-/** Names `WWW-Authenticate` in `hono/cors`'s `exposeHeaders`, keeping what is already there. */
-export declare function exposeChallengeHeader<T extends object>(cors: T & {
-  exposeHeaders?: string[];
-}): Omit<T, 'exposeHeaders'> & {
-  exposeHeaders: string[];
-};

package/dist/hono.mjs

@@ -1,48 +0,0 @@
-import { a as guard, d as withChallengeHeader, n as assertVerifier, s as PassflowUsageError, t as assertRequirement } from "./evaluate-BTuol-Oa.mjs";
-// src/hono.ts
-/** `c.body` rather than a thrown HTTPException, so headers `hono/cors` already set survive the rejection. */
-function send(c, decision) {
-	const { status, headers } = decision;
-	return c.body(null, status, headers);
-}
-/**
-* Hono middleware, for any runtime with WebCrypto and fetch. `authenticate` always verifies the presented token and
-* replaces the `passflow` variable. `requireACR` and `requireFresh` work alone: they reuse claims only when this verifier
-* produced that exact object, and otherwise verify the presented token themselves. Both throw `TypeError` at construction
-* on an invalid level or limit.
-*/
-function passflowHono(verifier) {
-	assertVerifier(verifier);
-	const middleware = (reuse, requirement) => async (c, next) => {
-		const existing = reuse ? c.get("passflow") : void 0;
-		const result = await guard(verifier, c.req.header("authorization"), existing, requirement);
-		if ("reject" in result) return send(c, result.reject);
-		c.set("passflow", result.claims);
-		await next();
-	};
-	return {
-		authenticate: middleware(false),
-		requireACR: (min) => middleware(true, assertRequirement({
-			kind: "acr",
-			min
-		})),
-		requireFresh: (maxAgeSeconds) => middleware(true, assertRequirement({
-			kind: "fresh",
-			maxAgeSeconds
-		}))
-	};
-}
-/** The claims a Passflow middleware put on this context. Throws `PassflowUsageError` if none ran. */
-function getAuth(c) {
-	const claims = c.get("passflow");
-	if (claims === void 0 || claims === null) throw new PassflowUsageError("[passflow] getAuth called before a Passflow middleware ran on this request");
-	return claims;
-}
-/** Names `WWW-Authenticate` in `hono/cors`'s `exposeHeaders`, keeping what is already there. */
-function exposeChallengeHeader(cors) {
-	return {
-		...cors,
-		exposeHeaders: withChallengeHeader(cors?.exposeHeaders)
-	};
-}
-export { exposeChallengeHeader, getAuth, passflowHono };