@seamless-auth/core 0.10.0 → 0.11.0

package/README.md

@@ -82,21 +82,65 @@ Core helpers enforce transitions between these states.
 
 ## Public API (Overview)
 
-Key exports include:
+Everything below is available from the package root. The `./handlers/*` subpaths
+remain for direct imports.
+
+**Sessions and cookies**
 
 - `ensureCookies(...)` – validates and refreshes session cookies
 - `refreshAccessToken(...)` – rotates expired access sessions
 - `verifyCookieJwt(...)` – verifies signed cookie payloads
-- `createServiceToken(...)` – creates short-lived M2M assertions
+- `verifyRefreshCookie(...)` – verifies a refresh cookie, returning `null` on failure
+- `verifySignedAuthResponse(...)` – verifies an auth API response signature against its JWKS
 - `getSeamlessUser(...)` – resolves the hydrated user, typed as `SeamlessUser | null`
 - `hasScopedRole(...)` – checks scoped role grants such as `admin:read`
+
+**Building an adapter**
+
+- `applyResult(result, adapter, opts)` – turns a handler result into a response
+- `applyCookies(result, adapter, opts)` – cookie instructions only, for middleware
+- `ResponseAdapter` – the three methods an adapter provides: `setCookie`, `clearCookie`, `send`
+- `proxyRequest(...)` – forwards a request to the auth API and returns its status and body
+- `checkProxyIdentity(...)` – checks a request carries the session a proxied route requires
+- `buildQueryString(...)` / `buildUpstreamUrl(...)` – build an upstream URL
+- `signSessionCookie(...)` / `resolveCookieSameSite(...)` – cookie format and policy
+- `authFetch(...)` – calls the auth API with the adapter's headers and a tolerant `json()`
+
+**Auth flow handlers**
+
+`loginHandler`, `finishLoginHandler`, `registerHandler`, `finishRegisterHandler`,
+`logoutHandler`, `meHandler`, `requestOtpHandler`, `verifyLoginOtpHandler`,
+`verifyRegistrationOtpHandler`, `requestMagicLinkHandler`, `verifyMagicLinkHandler`,
+`pollMagicLinkConfirmationHandler`, `switchOrganizationHandler`,
+`listOAuthProvidersHandler`, `startOAuthLoginHandler`, `finishOAuthLoginHandler`.
+
+**Admin and operations handlers**
+
+User, session, auth-event, metrics, and system-config handlers, for example
+`getUsersHandler`, `updateUserHandler`, `listSessionsHandler`,
+`getAuthEventsHandler`, `getDashboardMetricsHandler`, and
+`getAvailableRolesHandler`.
+
+**Message delivery**
+
+- `deliverAuthMessage(...)` – delivers an auth message through the configured transports
+- `applyExternalDelivery(...)` – delivers the payload on a response body and strips it
+- `stripDelivery(...)` – removes the delivery payload from a body
+
+**Auth API contract**
+
+- `SERVICE_TOKEN_ISSUER` / `SERVICE_TOKEN_AUDIENCE` – the fixed identity for M2M service tokens
+- `AUTH_DELIVERY_MODE_HEADER` / `EXTERNAL_DELIVERY_MODE` / `EXTERNAL_DELIVERY_HEADERS`
+- `DEV_JWKS_KID` – the fallback key id, which is a misconfiguration to deploy on
+- `createServiceToken(...)` / `buildExternalDeliveryAuthorization(...)` – mint service tokens
+
+**Utilities**
+
 - `assertSecretStrength(...)` / `assertSecrets(...)` – enforce the minimum secret length
 - `redactSensitiveText(...)` – masks tokens, bearer values, and secrets before logging
-- `listOAuthProvidersHandler(...)` – retrieves public OAuth provider metadata
-- `startOAuthLoginHandler(...)` – starts an OAuth authorization-code login
-- `finishOAuthLoginHandler(...)` – finishes OAuth login and returns cookie instructions
 
-These functions return **descriptive results**, not HTTP responses.
+Handlers return **descriptive results**, not HTTP responses. `applyResult` is what
+turns one into a response, and it is the only place that decides how.
 
 ### Secret strength
 

package/dist/apiContract.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Values the auth API defines. Changing one of these is a coordinated change
+ * with `seamless-auth-api`, so they live here rather than being written out at
+ * each call site, and every adapter reads the same value.
+ */
+/**
+ * Asks the auth API to return a delivery payload instead of sending the message
+ * itself, so the adopter's own transports deliver it.
+ */
+export declare const AUTH_DELIVERY_MODE_HEADER = "x-seamless-auth-delivery-mode";
+export declare const EXTERNAL_DELIVERY_MODE = "external";
+/** Headers that request external delivery, spreadable into an `authFetch` call. */
+export declare const EXTERNAL_DELIVERY_HEADERS: Readonly<Record<string, string>>;
+/**
+ * The auth API validates machine-to-machine service tokens against a fixed
+ * issuer and audience. These are not the adopter's configured audience, which
+ * applies to user tokens: a service token signed with the adopter's audience is
+ * rejected.
+ */
+export declare const SERVICE_TOKEN_ISSUER = "seamless-portal-api";
+export declare const SERVICE_TOKEN_AUDIENCE = "seamless-auth";
+/**
+ * Fallback JWKS key id. Deploying on it is a misconfiguration, and adapters
+ * warn when it is in use.
+ */
+export declare const DEV_JWKS_KID = "dev-main";
+/**
+ * Subject for the token that authorizes an external-delivery request. It names
+ * the caller's role rather than a browser user, because no user is involved:
+ * the adapter is telling the API to hand back a payload instead of sending it.
+ */
+export declare const EXTERNAL_DELIVERY_TOKEN_SUBJECT = "seamless-auth-external-delivery";
+export interface ServiceIdentityOptions {
+    serviceSecret: string;
+    jwksKid?: string;
+}
+/**
+ * Mints the `Authorization` value for an external-delivery request.
+ */
+export declare function buildExternalDeliveryAuthorization(opts: ServiceIdentityOptions): string;
+//# sourceMappingURL=apiContract.d.ts.map

package/dist/apiContract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContract.d.ts","sourceRoot":"","sources":["../src/apiContract.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAEH;;;GAGG;AACH,eAAO,MAAM,yBAAyB,kCAAkC,CAAC;AACzE,eAAO,MAAM,sBAAsB,aAAa,CAAC;AAEjD,mFAAmF;AACnF,eAAO,MAAM,yBAAyB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAGnE,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAC1D,eAAO,MAAM,sBAAsB,kBAAkB,CAAC;AAEtD;;;GAGG;AACH,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC;;;;GAIG;AACH,eAAO,MAAM,+BAA+B,oCACT,CAAC;AAEpC,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,wBAAgB,kCAAkC,CAChD,IAAI,EAAE,sBAAsB,GAC3B,MAAM,CAQR"}

package/dist/apiContract.js

@@ -0,0 +1,48 @@
+import { createServiceToken } from "./createServiceToken.js";
+/**
+ * Values the auth API defines. Changing one of these is a coordinated change
+ * with `seamless-auth-api`, so they live here rather than being written out at
+ * each call site, and every adapter reads the same value.
+ */
+/**
+ * Asks the auth API to return a delivery payload instead of sending the message
+ * itself, so the adopter's own transports deliver it.
+ */
+export const AUTH_DELIVERY_MODE_HEADER = "x-seamless-auth-delivery-mode";
+export const EXTERNAL_DELIVERY_MODE = "external";
+/** Headers that request external delivery, spreadable into an `authFetch` call. */
+export const EXTERNAL_DELIVERY_HEADERS = Object.freeze({
+    [AUTH_DELIVERY_MODE_HEADER]: EXTERNAL_DELIVERY_MODE,
+});
+/**
+ * The auth API validates machine-to-machine service tokens against a fixed
+ * issuer and audience. These are not the adopter's configured audience, which
+ * applies to user tokens: a service token signed with the adopter's audience is
+ * rejected.
+ */
+export const SERVICE_TOKEN_ISSUER = "seamless-portal-api";
+export const SERVICE_TOKEN_AUDIENCE = "seamless-auth";
+/**
+ * Fallback JWKS key id. Deploying on it is a misconfiguration, and adapters
+ * warn when it is in use.
+ */
+export const DEV_JWKS_KID = "dev-main";
+/**
+ * Subject for the token that authorizes an external-delivery request. It names
+ * the caller's role rather than a browser user, because no user is involved:
+ * the adapter is telling the API to hand back a payload instead of sending it.
+ */
+export const EXTERNAL_DELIVERY_TOKEN_SUBJECT = "seamless-auth-external-delivery";
+/**
+ * Mints the `Authorization` value for an external-delivery request.
+ */
+export function buildExternalDeliveryAuthorization(opts) {
+    return `Bearer ${createServiceToken({
+        subject: EXTERNAL_DELIVERY_TOKEN_SUBJECT,
+        issuer: SERVICE_TOKEN_ISSUER,
+        audience: SERVICE_TOKEN_AUDIENCE,
+        serviceSecret: opts.serviceSecret,
+        keyId: opts.jwksKid || DEV_JWKS_KID,
+    })}`;
+}
+//# sourceMappingURL=apiContract.js.map

package/dist/apiContract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apiContract.js","sourceRoot":"","sources":["../src/apiContract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAE7D;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,+BAA+B,CAAC;AACzE,MAAM,CAAC,MAAM,sBAAsB,GAAG,UAAU,CAAC;AAEjD,mFAAmF;AACnF,MAAM,CAAC,MAAM,yBAAyB,GACpC,MAAM,CAAC,MAAM,CAAC;IACZ,CAAC,yBAAyB,CAAC,EAAE,sBAAsB;CACpD,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAC1D,MAAM,CAAC,MAAM,sBAAsB,GAAG,eAAe,CAAC;AAEtD;;;GAGG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC;;;;GAIG;AACH,MAAM,CAAC,MAAM,+BAA+B,GAC1C,iCAAiC,CAAC;AAOpC;;GAEG;AACH,MAAM,UAAU,kCAAkC,CAChD,IAA4B;IAE5B,OAAO,UAAU,kBAAkB,CAAC;QAClC,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,KAAK,EAAE,IAAI,CAAC,OAAO,IAAI,YAAY;KACpC,CAAC,EAAE,CAAC;AACP,CAAC"}

package/dist/applyResult.d.ts

@@ -0,0 +1,100 @@
+import type { CookiePayload } from "./ensureCookies.js";
+import type { ResultFailure } from "./result.js";
+export type CookieSameSite = "lax" | "none" | "strict";
+export interface CookieSecurityOptions {
+    cookieSecret: string;
+    cookieDomain?: string;
+    cookieSecure?: boolean;
+    cookieSameSite?: CookieSameSite;
+}
+/**
+ * Resolves the effective `SameSite` policy. Shared so the cookie attributes and
+ * any policy that keys off `SameSite=None` cannot drift. Browsers reject
+ * `SameSite=None` without `Secure`, so the default tracks `secure`.
+ */
+export declare function resolveCookieSameSite(opts: Pick<CookieSecurityOptions, "cookieSecure" | "cookieSameSite">): CookieSameSite;
+export interface SetCookieCommand {
+    name: string;
+    /** Already signed. Adapters emit it as-is. */
+    value: string;
+    domain?: string;
+    maxAgeSeconds: number;
+    /**
+     * The same lifetime as `maxAgeSeconds`, as an absolute time.
+     *
+     * Both are specified so every adapter emits the same header. `Max-Age` wins
+     * wherever it is understood; `Expires` is the fallback for clients that do
+     * not, which would otherwise treat the cookie as a session cookie. Leaving
+     * this to the adapter is how two adapters end up issuing different cookies for
+     * the same session.
+     */
+    expires: Date;
+    httpOnly: boolean;
+    secure: boolean;
+    sameSite: CookieSameSite;
+    path: string;
+}
+export interface ClearCookieCommand {
+    name: string;
+    domain?: string;
+    /**
+     * The epoch, which is what tells the browser to drop the cookie. Specified
+     * here for the same reason as on the set path: so every adapter emits the
+     * same header rather than each picking its own expression of "delete this".
+     */
+    expires: Date;
+    secure: boolean;
+    sameSite: CookieSameSite;
+    path: string;
+}
+/**
+ * The three things an adapter has to be able to do with its framework's
+ * response. Everything else about turning a handler result into a response,
+ * including cookie format and attribute policy, is decided here so adapters do
+ * not each reimplement it.
+ */
+export interface ResponseAdapter {
+    setCookie(command: SetCookieCommand): void;
+    clearCookie(command: ClearCookieCommand): void;
+    /** `body` is `undefined` when the response carries none. */
+    send(status: number, body: unknown): void;
+}
+export interface SessionCookie {
+    name: string;
+    value: CookiePayload;
+    ttl: number;
+    domain?: string;
+}
+export interface AppliableResult extends ResultFailure {
+    status: number;
+    body?: unknown;
+    setCookies?: SessionCookie[];
+    clearCookies?: string[];
+}
+/**
+ * Signs a session cookie payload. The cookie format is core's, not the
+ * adapter's: an adapter that signed differently would mint sessions this
+ * package cannot read back.
+ */
+export declare function signSessionCookie(payload: CookiePayload, secret: string, ttlSeconds: number): string;
+/**
+ * Writes a result's cookie instructions, without touching the body.
+ *
+ * Separate from {@link applyResult} for middleware, which has to apply cookies
+ * on a request that then continues rather than one that is being answered.
+ *
+ * Clears run before sets, because a result that does both is replacing a
+ * session rather than ending one.
+ */
+export declare function applyCookies(result: Pick<AppliableResult, "setCookies" | "clearCookies">, adapter: Pick<ResponseAdapter, "setCookie" | "clearCookie">, opts: CookieSecurityOptions): void;
+/**
+ * Applies a handler result to a response.
+ *
+ * Cookies are written before the body.
+ *
+ * A failure carrying `errorBody` is the auth API's own body and goes out
+ * untouched; callers read fields off it. A failure carrying `errorCode` is this
+ * package's own and is rendered as `{ error, details }`.
+ */
+export declare function applyResult(result: AppliableResult, adapter: ResponseAdapter, opts: CookieSecurityOptions): void;
+//# sourceMappingURL=applyResult.d.ts.map

package/dist/applyResult.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyResult.d.ts","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC;AAEvD,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,cAAc,CAAC,EAAE,cAAc,CAAC;CACjC;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,cAAc,GAAG,gBAAgB,CAAC,GACnE,cAAc,CAGhB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,MAAM,CAAC;IACtB;;;;;;;;OAQG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,OAAO,EAAE,IAAI,CAAC;IACd,MAAM,EAAE,OAAO,CAAC;IAChB,QAAQ,EAAE,cAAc,CAAC;IACzB,IAAI,EAAE,MAAM,CAAC;CACd;AAKD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAC;IAC3C,WAAW,CAAC,OAAO,EAAE,kBAAkB,GAAG,IAAI,CAAC;IAC/C,4DAA4D;IAC5D,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,aAAa,CAAC;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;IAC7B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,aAAa,EACtB,MAAM,EAAE,MAAM,EACd,UAAU,EAAE,MAAM,GACjB,MAAM,CAKR;AAUD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAC1B,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,YAAY,GAAG,cAAc,CAAC,EAC5D,OAAO,EAAE,IAAI,CAAC,eAAe,EAAE,WAAW,GAAG,aAAa,CAAC,EAC3D,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAoCN;AAED;;;;;;;;GAQG;AACH,wBAAgB,WAAW,CACzB,MAAM,EAAE,eAAe,EACvB,OAAO,EAAE,eAAe,EACxB,IAAI,EAAE,qBAAqB,GAC1B,IAAI,CAmBN"}

package/dist/applyResult.js

@@ -0,0 +1,95 @@
+import jwt from "jsonwebtoken";
+/**
+ * Resolves the effective `SameSite` policy. Shared so the cookie attributes and
+ * any policy that keys off `SameSite=None` cannot drift. Browsers reject
+ * `SameSite=None` without `Secure`, so the default tracks `secure`.
+ */
+export function resolveCookieSameSite(opts) {
+    const secure = opts.cookieSecure ?? true;
+    return opts.cookieSameSite ?? (secure ? "none" : "lax");
+}
+/** Any time in the past drops the cookie; the epoch is the conventional one. */
+const COOKIE_EPOCH = new Date(0);
+/**
+ * Signs a session cookie payload. The cookie format is core's, not the
+ * adapter's: an adapter that signed differently would mint sessions this
+ * package cannot read back.
+ */
+export function signSessionCookie(payload, secret, ttlSeconds) {
+    return jwt.sign(payload, secret, {
+        algorithm: "HS256",
+        expiresIn: `${ttlSeconds}s`,
+    });
+}
+function requireSecret(opts) {
+    if (!opts.cookieSecret) {
+        throw new Error("Missing cookieSecret");
+    }
+    return opts.cookieSecret;
+}
+/**
+ * Writes a result's cookie instructions, without touching the body.
+ *
+ * Separate from {@link applyResult} for middleware, which has to apply cookies
+ * on a request that then continues rather than one that is being answered.
+ *
+ * Clears run before sets, because a result that does both is replacing a
+ * session rather than ending one.
+ */
+export function applyCookies(result, adapter, opts) {
+    const secure = opts.cookieSecure ?? true;
+    const sameSite = resolveCookieSameSite(opts);
+    if (result.clearCookies?.length) {
+        for (const name of result.clearCookies) {
+            adapter.clearCookie({
+                name,
+                domain: opts.cookieDomain,
+                expires: COOKIE_EPOCH,
+                secure,
+                sameSite,
+                path: "/",
+            });
+        }
+    }
+    if (result.setCookies?.length) {
+        const secret = requireSecret(opts);
+        const now = Date.now();
+        for (const cookie of result.setCookies) {
+            adapter.setCookie({
+                name: cookie.name,
+                value: signSessionCookie(cookie.value, secret, cookie.ttl),
+                domain: cookie.domain,
+                maxAgeSeconds: cookie.ttl,
+                expires: new Date(now + cookie.ttl * 1000),
+                httpOnly: true,
+                secure,
+                sameSite,
+                path: "/",
+            });
+        }
+    }
+}
+/**
+ * Applies a handler result to a response.
+ *
+ * Cookies are written before the body.
+ *
+ * A failure carrying `errorBody` is the auth API's own body and goes out
+ * untouched; callers read fields off it. A failure carrying `errorCode` is this
+ * package's own and is rendered as `{ error, details }`.
+ */
+export function applyResult(result, adapter, opts) {
+    applyCookies(result, adapter, opts);
+    if (result.errorBody !== undefined) {
+        adapter.send(result.status, result.errorBody);
+        return;
+    }
+    if (result.errorCode !== undefined) {
+        adapter.send(result.status, result.details === undefined
+            ? { error: result.errorCode }
+            : { error: result.errorCode, details: result.details });
+        return;
+    }
+    adapter.send(result.status, result.body);
+}
+//# sourceMappingURL=applyResult.js.map

package/dist/applyResult.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"applyResult.js","sourceRoot":"","sources":["../src/applyResult.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAC;AAc/B;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CACnC,IAAoE;IAEpE,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,cAAc,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAsCD,gFAAgF;AAChF,MAAM,YAAY,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;AA6BjC;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAsB,EACtB,MAAc,EACd,UAAkB;IAElB,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE;QAC/B,SAAS,EAAE,OAAO;QAClB,SAAS,EAAE,GAAG,UAAU,GAAG;KAC5B,CAAC,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAA2B;IAChD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC1C,CAAC;IAED,OAAO,IAAI,CAAC,YAAY,CAAC;AAC3B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAC1B,MAA4D,EAC5D,OAA2D,EAC3D,IAA2B;IAE3B,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC;IACzC,MAAM,QAAQ,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;IAE7C,IAAI,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QAChC,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,CAAC,WAAW,CAAC;gBAClB,IAAI;gBACJ,MAAM,EAAE,IAAI,CAAC,YAAY;gBACzB,OAAO,EAAE,YAAY;gBACrB,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;QAEnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,UAAU,EAAE,CAAC;YACvC,OAAO,CAAC,SAAS,CAAC;gBAChB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,KAAK,EAAE,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC;gBAC1D,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,aAAa,EAAE,MAAM,CAAC,GAAG;gBACzB,OAAO,EAAE,IAAI,IAAI,CAAC,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC;gBAC1C,QAAQ,EAAE,IAAI;gBACd,MAAM;gBACN,QAAQ;gBACR,IAAI,EAAE,GAAG;aACV,CAAC,CAAC;QACL,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CACzB,MAAuB,EACvB,OAAwB,EACxB,IAA2B;IAE3B,YAAY,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,OAAO,CAAC,IAAI,CACV,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,KAAK,SAAS;YAC1B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE;YAC7B,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CACzD,CAAC;QACF,OAAO;IACT,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;AAC3C,CAAC"}

package/dist/authMessaging.d.ts

@@ -1,23 +1,17 @@
-export type MessagingChannel = "email" | "sms";
-export interface DeliveryResult {
-    accepted: boolean;
-    provider: string;
-    channel: MessagingChannel;
-    messageId?: string;
-    raw?: unknown;
-}
-export interface EmailMessage {
-    to: string;
-    from?: string;
-    subject: string;
-    text: string;
-    html?: string;
-}
-export interface SmsMessage {
-    to: string;
-    from?: string;
-    body: string;
-}
+/**
+ * The messaging contract.
+ *
+ * The wire shapes belong to `@seamless-auth/types`, so they are re-exported rather
+ * than declared again: the auth API sends the delivery instruction and this
+ * package consumes it, and two definitions of that could drift. The re-export is
+ * type-only, so it is erased at compile time and neither zod nor the schema
+ * barrel enters the runtime module graph.
+ *
+ * What stays here is what is genuinely this package's: the transport interfaces,
+ * which carry provider implementations, and the adopter-facing configuration.
+ */
+export type { AuthDeliveryInstruction, DeliveryResult, EmailMessage, MessagingChannel, SendMagicLinkEmailInput, SendOtpEmailInput, SendOtpSmsInput, SmsMessage, } from "@seamless-auth/types";
+import type { DeliveryResult, EmailMessage, SendMagicLinkEmailInput, SendOtpEmailInput, SendOtpSmsInput, SmsMessage } from "@seamless-auth/types";
 export interface EmailTransport {
     readonly name: string;
     send(message: EmailMessage): Promise<DeliveryResult>;
@@ -26,24 +20,6 @@ export interface SmsTransport {
     readonly name: string;
     send(message: SmsMessage): Promise<DeliveryResult>;
 }
-export interface SendOtpEmailInput {
-    to: string;
-    token: string;
-    from?: string;
-    subject?: string;
-}
-export interface SendOtpSmsInput {
-    to: string;
-    token: string | number;
-    from?: string;
-}
-export interface SendMagicLinkEmailInput {
-    to: string;
-    magicLinkUrl: string;
-    token?: string;
-    from?: string;
-    subject?: string;
-}
 export interface AuthMessageOverrideContext {
     appName?: string;
 }
@@ -68,18 +44,4 @@ export interface SeamlessAuthMessagingOptions {
         smsFrom?: string;
     };
 }
-export type AuthDeliveryInstruction = {
-    kind: "otp_email";
-    to: string;
-    token: string;
-} | {
-    kind: "otp_sms";
-    to: string;
-    token: string | number;
-} | {
-    kind: "magic_link_email";
-    to: string;
-    token?: string;
-    magicLinkUrl: string;
-};
 //# sourceMappingURL=authMessaging.d.ts.map

package/dist/authMessaging.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authMessaging.d.ts","sourceRoot":"","sources":["../src/authMessaging.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,gBAAgB,GAAG,OAAO,GAAG,KAAK,CAAC;AAE/C,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,OAAO,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,gBAAgB,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,GAAG,CAAC,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,UAAU;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,uBAAuB;IACtC,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;IAClB,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,0BAA0B,KAChC,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,kBAAkB,CAChB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAAC;CAC5B;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AAED,MAAM,MAAM,uBAAuB,GAC/B;IACE,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IACE,IAAI,EAAE,SAAS,CAAC;IAChB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC;CACxB,GACD;IACE,IAAI,EAAE,kBAAkB,CAAC;IACzB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;CACtB,CAAC"}
+{"version":3,"file":"authMessaging.d.ts","sourceRoot":"","sources":["../src/authMessaging.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,YAAY,EACV,uBAAuB,EACvB,cAAc,EACd,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,UAAU,GACX,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EACV,cAAc,EACd,YAAY,EACZ,uBAAuB,EACvB,iBAAiB,EACjB,eAAe,EACf,UAAU,EACX,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,OAAO,EAAE,UAAU,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,CACT,KAAK,EAAE,iBAAiB,EACxB,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;IAClB,MAAM,CAAC,EAAE,CACP,KAAK,EAAE,eAAe,EACtB,QAAQ,EAAE,UAAU,EACpB,OAAO,EAAE,0BAA0B,KAChC,UAAU,CAAC;IAChB,cAAc,CAAC,EAAE,CACf,KAAK,EAAE,uBAAuB,EAC9B,QAAQ,EAAE,YAAY,EACtB,OAAO,EAAE,0BAA0B,KAChC,YAAY,CAAC;CACnB;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAChE,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC5D,kBAAkB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;CAC7E;AAED,MAAM,WAAW,4BAA4B;IAC3C,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,GAAG,CAAC,EAAE,YAAY,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;IAC1C,SAAS,CAAC,EAAE,oBAAoB,CAAC;IACjC,QAAQ,CAAC,EAAE;QACT,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;CACH"}

package/dist/deliverAuthMessage.d.ts

@@ -0,0 +1,15 @@
+import type { AuthDeliveryInstruction, SeamlessAuthMessagingOptions } from "./authMessaging.js";
+export declare function deliverAuthMessage(messaging: SeamlessAuthMessagingOptions | undefined, delivery: AuthDeliveryInstruction | undefined): Promise<void>;
+export declare function stripDelivery<T extends {
+    delivery?: unknown;
+}>(body: T): Omit<T, "delivery">;
+/**
+ * Applies external delivery to an upstream response body and returns the body to send on.
+ *
+ * When messaging is configured the adapter asks the auth API for a delivery payload instead of
+ * having the API send the message itself. A missing payload means nobody sent anything, so it is
+ * surfaced here: the four endpoints that route through this helper always include `delivery` when
+ * the API accepts the request as externally delivered.
+ */
+export declare function applyExternalDelivery(messaging: SeamlessAuthMessagingOptions | undefined, body: unknown): Promise<unknown>;
+//# sourceMappingURL=deliverAuthMessage.d.ts.map

package/dist/deliverAuthMessage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliverAuthMessage.d.ts","sourceRoot":"","sources":["../src/deliverAuthMessage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,uBAAuB,EAEvB,4BAA4B,EAE7B,MAAM,oBAAoB,CAAC;AA0G5B,wBAAsB,kBAAkB,CACtC,SAAS,EAAE,4BAA4B,GAAG,SAAS,EACnD,QAAQ,EAAE,uBAAuB,GAAG,SAAS,GAC5C,OAAO,CAAC,IAAI,CAAC,CA0Df;AAED,wBAAgB,aAAa,CAAC,CAAC,SAAS;IAAE,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,EAC5D,IAAI,EAAE,CAAC,GACN,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAGrB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,4BAA4B,GAAG,SAAS,EACnD,IAAI,EAAE,OAAO,GACZ,OAAO,CAAC,OAAO,CAAC,CAgBlB"}

package/dist/deliverAuthMessage.js

@@ -0,0 +1,123 @@
+import { getSeamlessLogger } from "./logger.js";
+function applyEmailOverride(override, input, defaults, appName) {
+    return override ? override(input, defaults, { appName }) : defaults;
+}
+function applySmsOverride(override, input, defaults, appName) {
+    return override ? override(input, defaults, { appName }) : defaults;
+}
+function buildOtpEmailMessage(input, messaging) {
+    const appName = messaging.defaults?.appName ?? "Seamless Auth";
+    return applyEmailOverride(messaging.overrides?.otpEmail, {
+        to: input.to,
+        token: input.token,
+        from: messaging.defaults?.emailFrom,
+        subject: `${appName} - Verify your email`,
+    }, {
+        to: input.to,
+        from: messaging.defaults?.emailFrom,
+        subject: `${appName} - Verify your email`,
+        text: `Verify your account with ${appName}.\n\nYour verification code is: ${input.token}\n\nIf you did not request this code, you can safely ignore this message.`,
+        html: `<div><h1>Verify your account with ${appName}</h1><p>Please use the verification code below:</p><p><strong>${input.token}</strong></p><p>If you did not request this code, you can safely ignore this message.</p></div>`,
+    }, appName);
+}
+function buildOtpSmsMessage(input, messaging) {
+    const appName = messaging.defaults?.appName ?? "Seamless Auth";
+    return applySmsOverride(messaging.overrides?.otpSms, {
+        to: input.to,
+        token: input.token,
+        from: messaging.defaults?.smsFrom,
+    }, {
+        to: input.to,
+        from: messaging.defaults?.smsFrom,
+        body: `Your ${appName} verification code is: ${input.token}. No one will ever ask you for this code. Do not share it.`,
+    }, appName);
+}
+function buildMagicLinkMessage(input, messaging) {
+    const appName = messaging.defaults?.appName ?? "Seamless Auth";
+    return applyEmailOverride(messaging.overrides?.magicLinkEmail, {
+        to: input.to,
+        magicLinkUrl: input.magicLinkUrl,
+        token: input.token,
+        from: messaging.defaults?.emailFrom,
+        subject: `${appName} - Your sign-in link`,
+    }, {
+        to: input.to,
+        from: messaging.defaults?.emailFrom,
+        subject: `${appName} - Your sign-in link`,
+        text: `Use the link below to sign in to ${appName}:\n\n${input.magicLinkUrl}\n\nIf you did not request this email, you can safely ignore it.`,
+        html: `<div><h1>Sign in to ${appName}</h1><p>Use the link below to complete sign-in:</p><p><a href="${input.magicLinkUrl}">${input.magicLinkUrl}</a></p><p>If you did not request this email, you can safely ignore it.</p></div>`,
+    }, appName);
+}
+export async function deliverAuthMessage(messaging, delivery) {
+    if (!messaging || !delivery) {
+        return;
+    }
+    switch (delivery.kind) {
+        case "otp_email":
+            if (messaging.handlers?.sendOtpEmail) {
+                await messaging.handlers.sendOtpEmail({
+                    to: delivery.to,
+                    token: delivery.token,
+                    from: messaging.defaults?.emailFrom,
+                });
+                return;
+            }
+            if (!messaging.email) {
+                throw new Error("Missing email transport for OTP email delivery.");
+            }
+            await messaging.email.send(buildOtpEmailMessage(delivery, messaging));
+            return;
+        case "otp_sms":
+            if (messaging.handlers?.sendOtpSms) {
+                await messaging.handlers.sendOtpSms({
+                    to: delivery.to,
+                    token: delivery.token,
+                    from: messaging.defaults?.smsFrom,
+                });
+                return;
+            }
+            if (!messaging.sms) {
+                throw new Error("Missing SMS transport for OTP SMS delivery.");
+            }
+            await messaging.sms.send(buildOtpSmsMessage(delivery, messaging));
+            return;
+        case "magic_link_email":
+            if (messaging.handlers?.sendMagicLinkEmail) {
+                await messaging.handlers.sendMagicLinkEmail({
+                    to: delivery.to,
+                    token: delivery.token,
+                    magicLinkUrl: delivery.magicLinkUrl,
+                    from: messaging.defaults?.emailFrom,
+                });
+                return;
+            }
+            if (!messaging.email) {
+                throw new Error("Missing email transport for magic link delivery.");
+            }
+            await messaging.email.send(buildMagicLinkMessage(delivery, messaging));
+            return;
+    }
+}
+export function stripDelivery(body) {
+    const { delivery: _delivery, ...rest } = body;
+    return rest;
+}
+/**
+ * Applies external delivery to an upstream response body and returns the body to send on.
+ *
+ * When messaging is configured the adapter asks the auth API for a delivery payload instead of
+ * having the API send the message itself. A missing payload means nobody sent anything, so it is
+ * surfaced here: the four endpoints that route through this helper always include `delivery` when
+ * the API accepts the request as externally delivered.
+ */
+export async function applyExternalDelivery(messaging, body) {
+    if (body && typeof body === "object" && "delivery" in body) {
+        await deliverAuthMessage(messaging, body.delivery);
+        return stripDelivery(body);
+    }
+    if (messaging) {
+        getSeamlessLogger().warn("[SeamlessAuth] External delivery was requested but the auth API returned no delivery payload, so no message was sent. Verify that serviceSecret matches the auth API's API_SERVICE_TOKEN.");
+    }
+    return body;
+}
+//# sourceMappingURL=deliverAuthMessage.js.map

package/dist/deliverAuthMessage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"deliverAuthMessage.js","sourceRoot":"","sources":["../src/deliverAuthMessage.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,SAAS,kBAAkB,CACzB,QAMa,EACb,KAAa,EACb,QAAsB,EACtB,OAAgB;IAEhB,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,gBAAgB,CACvB,QAMa,EACb,KAAa,EACb,QAAoB,EACpB,OAAgB;IAEhB,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtE,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA8D,EAC9D,SAAuC;IAEvC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,IAAI,eAAe,CAAC;IAE/D,OAAO,kBAAkB,CACvB,SAAS,CAAC,SAAS,EAAE,QAAQ,EAC7B;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;QACnC,OAAO,EAAE,GAAG,OAAO,sBAAsB;KAC1C,EACD;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;QACnC,OAAO,EAAE,GAAG,OAAO,sBAAsB;QACzC,IAAI,EAAE,4BAA4B,OAAO,mCAAmC,KAAK,CAAC,KAAK,2EAA2E;QAClK,IAAI,EAAE,qCAAqC,OAAO,iEAAiE,KAAK,CAAC,KAAK,iGAAiG;KAChO,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,KAA4D,EAC5D,SAAuC;IAEvC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,IAAI,eAAe,CAAC;IAE/D,OAAO,gBAAgB,CACrB,SAAS,CAAC,SAAS,EAAE,MAAM,EAC3B;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO;KAClC,EACD;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO;QACjC,IAAI,EAAE,QAAQ,OAAO,0BAA0B,KAAK,CAAC,KAAK,4DAA4D;KACvH,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAqE,EACrE,SAAuC;IAEvC,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,EAAE,OAAO,IAAI,eAAe,CAAC;IAE/D,OAAO,kBAAkB,CACvB,SAAS,CAAC,SAAS,EAAE,cAAc,EACnC;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;QACnC,OAAO,EAAE,GAAG,OAAO,sBAAsB;KAC1C,EACD;QACE,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;QACnC,OAAO,EAAE,GAAG,OAAO,sBAAsB;QACzC,IAAI,EAAE,oCAAoC,OAAO,QAAQ,KAAK,CAAC,YAAY,kEAAkE;QAC7I,IAAI,EAAE,uBAAuB,OAAO,kEAAkE,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY,mFAAmF;KACnO,EACD,OAAO,CACR,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,SAAmD,EACnD,QAA6C;IAE7C,IAAI,CAAC,SAAS,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,QAAQ,QAAQ,CAAC,IAAI,EAAE,CAAC;QACtB,KAAK,WAAW;YACd,IAAI,SAAS,CAAC,QAAQ,EAAE,YAAY,EAAE,CAAC;gBACrC,MAAM,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC;oBACpC,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;iBACpC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,oBAAoB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACtE,OAAO;QAET,KAAK,SAAS;YACZ,IAAI,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,CAAC;gBACnC,MAAM,SAAS,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAClC,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,OAAO;iBAClC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC;gBACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;YACjE,CAAC;YAED,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YAClE,OAAO;QAET,KAAK,kBAAkB;YACrB,IAAI,SAAS,CAAC,QAAQ,EAAE,kBAAkB,EAAE,CAAC;gBAC3C,MAAM,SAAS,CAAC,QAAQ,CAAC,kBAAkB,CAAC;oBAC1C,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,YAAY,EAAE,QAAQ,CAAC,YAAY;oBACnC,IAAI,EAAE,SAAS,CAAC,QAAQ,EAAE,SAAS;iBACpC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YAED,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;YACtE,CAAC;YAED,MAAM,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;YACvE,OAAO;IACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,IAAO;IAEP,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAmD,EACnD,IAAa;IAEb,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,IAAI,EAAE,CAAC;QAC3D,MAAM,kBAAkB,CACtB,SAAS,EACR,IAA+C,CAAC,QAAQ,CAC1D,CAAC;QACF,OAAO,aAAa,CAAC,IAA8B,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,iBAAiB,EAAE,CAAC,IAAI,CACtB,2LAA2L,CAC5L,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/ensureCookies.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "./result.js";
 export interface EnsureCookiesInput {
     path: string;
     cookies: Record<string, string | undefined>;
@@ -18,10 +19,9 @@ export interface CookieInstruction {
     ttl: number;
     domain?: string;
 }
-export interface EnsureCookiesResult {
+export interface EnsureCookiesResult extends ResultFailure {
     type: "ok" | "error";
     status?: number;
-    error?: string;
     user?: {
         sub: string;
         sessionId?: string;