@seamless-auth/core 0.10.0 → 0.11.0

package/dist/handlers/sessions.d.ts

@@ -1,13 +1,13 @@
+import type { ResultFailure } from "../result.js";
 type BaseOpts = {
     authServerUrl: string;
     authorization?: string;
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 };
-type Result = {
+type Result = ResultFailure & {
     status: number;
     body?: any;
-    error?: string;
 };
 export declare const listSessionsHandler: (opts: BaseOpts) => Promise<Result>;
 export declare const revokeSessionHandler: (id: string, opts: BaseOpts) => Promise<Result>;

package/dist/handlers/sessions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAEA,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,MAAM,GAAG;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AA6BF,eAAO,MAAM,mBAAmB,GAAI,MAAM,QAAQ,oBACf,CAAC;AAEpC,eAAO,MAAM,oBAAoB,GAAI,IAAI,MAAM,EAAE,MAAM,QAAQ,oBACC,CAAC;AAEjE,eAAO,MAAM,wBAAwB,GAAI,MAAM,QAAQ,oBACjB,CAAC"}
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,KAAK,QAAQ,GAAG;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,KAAK,MAAM,GAAG,aAAa,GAAG;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ,CAAC;AA6BF,eAAO,MAAM,mBAAmB,GAAI,MAAM,QAAQ,oBACf,CAAC;AAEpC,eAAO,MAAM,oBAAoB,GAAI,IAAI,MAAM,EAAE,MAAM,QAAQ,oBACC,CAAC;AAEjE,eAAO,MAAM,wBAAwB,GAAI,MAAM,QAAQ,oBACjB,CAAC"}

package/dist/handlers/sessions.js

@@ -1,4 +1,5 @@
 import { authFetch } from "../authFetch.js";
+import { readUpstreamFailure } from "../upstreamError.js";
 async function request(method, path, opts) {
     const up = await authFetch(`${opts.authServerUrl}${path}`, {
         method,
@@ -10,7 +11,7 @@ async function request(method, path, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data?.error || "session_request_failed",
+            ...readUpstreamFailure(data, "session_request_failed"),
         };
     }
     return {

package/dist/handlers/sessions.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAe5C,KAAK,UAAU,OAAO,CACpB,MAAwB,EACxB,IAAY,EACZ,IAAc;IAEd,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,wBAAwB;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAc,EAAE,EAAE,CACpD,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACjE,OAAO,CAAC,QAAQ,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAc,EAAE,EAAE,CACzD,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC"}
+{"version":3,"file":"sessions.js","sourceRoot":"","sources":["../../src/handlers/sessions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAc1D,KAAK,UAAU,OAAO,CACpB,MAAwB,EACxB,IAAY,EACZ,IAAc;IAEd,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,GAAG,IAAI,EAAE,EAAE;QACzD,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,mBAAmB,CAAC,IAAI,EAAE,wBAAwB,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,IAAc,EAAE,EAAE,CACpD,OAAO,CAAC,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC;AAEpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,EAAU,EAAE,IAAc,EAAE,EAAE,CACjE,OAAO,CAAC,QAAQ,EAAE,aAAa,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;AAEjE,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,IAAc,EAAE,EAAE,CACzD,OAAO,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,CAAC"}

package/dist/handlers/switchOrganizationHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface SwitchOrganizationInput {
     organizationId: string;
@@ -11,10 +12,9 @@ export interface SwitchOrganizationOptions {
     cookieDomain?: string;
     accessCookieName: string;
 }
-export interface SwitchOrganizationResult {
+export interface SwitchOrganizationResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/switchOrganizationHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAkEnC"}
+{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAqCnC"}

package/dist/handlers/switchOrganizationHandler.js

@@ -1,5 +1,6 @@
 import { authFetch } from "../authFetch.js";
-import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
+import { issueSessionCookies } from "../upstreamSession.js";
+import { readPassthroughFailure } from "../upstreamError.js";
 export async function switchOrganizationHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/organizations/${encodeURIComponent(input.organizationId)}/switch`, {
         method: "POST",
@@ -11,7 +12,7 @@ export async function switchOrganizationHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     if (!data?.token || !data?.sub) {
@@ -20,35 +21,15 @@ export async function switchOrganizationHandler(input, opts) {
             body: data,
         };
     }
-    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
-    if (!verifiedAccessToken) {
-        throw new Error("Invalid signed response from Auth Server");
-    }
-    if (verifiedAccessToken.sub !== data.sub) {
-        throw new Error("Signature mismatch with data payload");
-    }
-    const sessionId = typeof verifiedAccessToken.sid === "string"
-        ? verifiedAccessToken.sid
-        : undefined;
     return {
         status: up.status,
         body: data,
-        setCookies: [
-            {
-                name: opts.accessCookieName,
-                value: {
-                    sub: data.sub,
-                    ...(sessionId === undefined ? {} : { sessionId }),
-                    token: data.token,
-                    roles: data.roles,
-                    email: data.email,
-                    phone: data.phone,
-                    organizationId: data.organizationId ?? null,
-                },
-                ttl: data.ttl,
-                domain: opts.cookieDomain,
-            },
-        ],
+        setCookies: await issueSessionCookies(data, {
+            authServerUrl: opts.authServerUrl,
+            audience: opts.audience,
+            accessCookieName: opts.accessCookieName,
+            cookieDomain: opts.cookieDomain,
+        }),
     };
 }
 //# sourceMappingURL=switchOrganizationHandler.js.map

package/dist/handlers/switchOrganizationHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA4B1E,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B,EAC9B,IAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EACxF;QACE,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA6B7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B,EAC9B,IAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EACxF;QACE,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}

package/dist/handlers/systemConfig.d.ts

@@ -1,13 +1,13 @@
+import type { ResultFailure } from "../result.js";
 export interface SystemConfigOptions {
     authServerUrl: string;
     authorization?: string;
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
-export interface SystemConfigResult {
+export interface SystemConfigResult extends ResultFailure {
     status: number;
     body?: any;
-    error?: string;
 }
 export declare function getAvailableRolesHandler(opts: SystemConfigOptions): Promise<SystemConfigResult>;
 export declare function getSystemConfigAdminHandler(opts: SystemConfigOptions): Promise<SystemConfigResult>;

package/dist/handlers/systemConfig.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"systemConfig.d.ts","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;IACX,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,GAAG;IAAE,OAAO,EAAE,GAAG,CAAA;CAAE,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAsB7B"}
+{"version":3,"file":"systemConfig.d.ts","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAGlD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,GAAG,CAAC;CACZ;AAED,wBAAsB,wBAAwB,CAC5C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,2BAA2B,CAC/C,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAqB7B;AAED,wBAAsB,yBAAyB,CAC7C,IAAI,EAAE,mBAAmB,GAAG;IAAE,OAAO,EAAE,GAAG,CAAA;CAAE,GAC3C,OAAO,CAAC,kBAAkB,CAAC,CAsB7B"}

package/dist/handlers/systemConfig.js

@@ -1,4 +1,5 @@
 import { authFetch } from "../authFetch.js";
+import { readUpstreamFailure } from "../upstreamError.js";
 export async function getAvailableRolesHandler(opts) {
     const up = await authFetch(`${opts.authServerUrl}/system-config/roles`, {
         method: "GET",
@@ -10,7 +11,7 @@ export async function getAvailableRolesHandler(opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data?.error || "failed_to_fetch_roles",
+            ...readUpstreamFailure(data, "failed_to_fetch_roles"),
         };
     }
     return {
@@ -29,7 +30,7 @@ export async function getSystemConfigAdminHandler(opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data?.error || "failed_to_fetch_config",
+            ...readUpstreamFailure(data, "failed_to_fetch_config"),
         };
     }
     return {
@@ -49,7 +50,7 @@ export async function updateSystemConfigHandler(opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data?.error || "failed_to_update_config",
+            ...readUpstreamFailure(data, "failed_to_update_config"),
         };
     }
     return {

package/dist/handlers/systemConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"systemConfig.js","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAe5C,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,uBAAuB;SAC9C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,wBAAwB;SAC/C,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA4C;IAE5C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,OAAO;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI,EAAE,KAAK,IAAI,yBAAyB;SAChD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"systemConfig.js","sourceRoot":"","sources":["../../src/handlers/systemConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAc1D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,mBAAmB,CAAC,IAAI,EAAE,uBAAuB,CAAC;SACtD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,IAAyB;IAEzB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,KAAK;QACb,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,mBAAmB,CAAC,IAAI,EAAE,wBAAwB,CAAC;SACvD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,IAA4C;IAE5C,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,sBAAsB,EAAE;QACtE,MAAM,EAAE,OAAO;QACf,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,IAAI,EAAE,IAAI,CAAC,OAAO;QAClB,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,mBAAmB,CAAC,IAAI,EAAE,yBAAyB,CAAC;SACxD,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}

package/dist/handlers/verifyLoginOtpHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface VerifyLoginOtpInput {
     body: unknown;
@@ -13,10 +14,9 @@ export interface VerifyLoginOtpOptions {
     accessCookieName: string;
     refreshCookieName: string;
 }
-export interface VerifyLoginOtpResult {
+export interface VerifyLoginOtpResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
     setCookies?: {
         name: string;
         value: CookiePayload;

package/dist/handlers/verifyLoginOtpHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAsFD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAK/B"}
+{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAiDD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAK/B"}

package/dist/handlers/verifyLoginOtpHandler.js

@@ -1,5 +1,6 @@
 import { authFetch } from "../authFetch.js";
-import { verifySignedAuthResponse } from "../verifySignedAuthResponse.js";
+import { issueSessionCookies } from "../upstreamSession.js";
+import { readPassthroughFailure } from "../upstreamError.js";
 // Shared by the login and registration OTP verify handlers: POST to the given
 // auth-server path and, when the response carries a session, validate the signed
 // access token and build the session cookies. Registration can complete without
@@ -17,7 +18,7 @@ async function verifyOtp(path, input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     if (!data?.token) {
@@ -26,44 +27,16 @@ async function verifyOtp(path, input, opts) {
             body: data,
         };
     }
-    const verifiedAccessToken = await verifySignedAuthResponse(data.token, opts.authServerUrl, opts.audience);
-    if (!verifiedAccessToken) {
-        throw new Error("Invalid signed response from Auth Server");
-    }
-    if (verifiedAccessToken.sub !== data.sub) {
-        throw new Error("Signature mismatch with data payload");
-    }
-    const sessionId = typeof verifiedAccessToken.sid === "string"
-        ? verifiedAccessToken.sid
-        : undefined;
     return {
         status: up.status,
         body: data,
-        setCookies: [
-            {
-                name: opts.accessCookieName,
-                value: {
-                    sub: data.sub,
-                    ...(sessionId === undefined ? {} : { sessionId }),
-                    token: data.token,
-                    roles: data.roles,
-                    email: data.email,
-                    phone: data.phone,
-                    organizationId: data.organizationId ?? null,
-                },
-                ttl: data.ttl,
-                domain: opts.cookieDomain,
-            },
-            {
-                name: opts.refreshCookieName,
-                value: {
-                    sub: data.sub,
-                    refreshToken: data.refreshToken,
-                },
-                ttl: data.refreshTtl,
-                domain: opts.cookieDomain,
-            },
-        ],
+        setCookies: await issueSessionCookies(data, {
+            authServerUrl: opts.authServerUrl,
+            audience: opts.audience,
+            accessCookieName: opts.accessCookieName,
+            refreshCookieName: opts.refreshCookieName,
+            cookieDomain: opts.cookieDomain,
+        }),
     };
 }
 export async function verifyLoginOtpHandler(input, opts) {

package/dist/handlers/verifyLoginOtpHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAE5C,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AA8B1E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,wBAAwB,CACxD,IAAI,CAAC,KAAK,EACV,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,IAAI,CAAC,mBAAmB,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,mBAAmB,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,MAAM,SAAS,GACb,OAAO,mBAAmB,CAAC,GAAG,KAAK,QAAQ;QACzC,CAAC,CAAC,mBAAmB,CAAC,GAAG;QACzB,CAAC,CAAC,SAAS,CAAC;IAEhB,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;gBAC3B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;oBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;iBAC5C;gBACD,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;YACD;gBACE,IAAI,EAAE,IAAI,CAAC,iBAAiB;gBAC5B,KAAK,EAAE;oBACL,GAAG,EAAE,IAAI,CAAC,GAAG;oBACb,YAAY,EAAE,IAAI,CAAC,YAAY;iBAChC;gBACD,GAAG,EAAE,IAAI,CAAC,UAAU;gBACpB,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,4BAA4B,CAAC;IAEnC,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE3E,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA+B7D,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;KAC3C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;QACV,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,4BAA4B,CAAC;IAEnC,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE3E,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/handlers/verifyMagicLinkHandler.d.ts

@@ -1,3 +1,4 @@
+import type { ResultFailure } from "../result.js";
 export interface VerifyMagicLinkInput {
     token: string;
 }
@@ -6,10 +7,9 @@ export interface VerifyMagicLinkOptions {
     serviceAuthorization?: string;
     forwardedClientIp?: string;
 }
-export interface VerifyMagicLinkResult {
+export interface VerifyMagicLinkResult extends ResultFailure {
     status: number;
     body?: unknown;
-    error?: unknown;
 }
 export declare function verifyMagicLinkHandler(input: VerifyMagicLinkInput, opts: VerifyMagicLinkOptions): Promise<VerifyMagicLinkResult>;
 //# sourceMappingURL=verifyMagicLinkHandler.d.ts.map

package/dist/handlers/verifyMagicLinkHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAuBhC"}
+{"version":3,"file":"verifyMagicLinkHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAElD,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAsB,SAAQ,aAAa;IAC1D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,oBAAoB,EAC3B,IAAI,EAAE,sBAAsB,GAC3B,OAAO,CAAC,qBAAqB,CAAC,CAuBhC"}

package/dist/handlers/verifyMagicLinkHandler.js

@@ -1,4 +1,5 @@
 import { authFetch } from "../authFetch.js";
+import { readPassthroughFailure } from "../upstreamError.js";
 export async function verifyMagicLinkHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/magic-link/verify/${encodeURIComponent(input.token)}`, {
         method: "GET",
@@ -9,7 +10,7 @@ export async function verifyMagicLinkHandler(input, opts) {
     if (!up.ok) {
         return {
             status: up.status,
-            error: data,
+            ...readPassthroughFailure(data),
         };
     }
     return {

package/dist/handlers/verifyMagicLinkHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAkB5C,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2B,EAC3B,IAA4B;IAE5B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAC5E;QACE,MAAM,EAAE,KAAK;QACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,KAAK,EAAE,IAAI;SACZ,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"verifyMagicLinkHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyMagicLinkHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAkB7D,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,KAA2B,EAC3B,IAA4B;IAE5B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,sBAAsB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,EAC5E;QACE,MAAM,EAAE,KAAK;QACb,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;KAC1C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,IAAI;KACX,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,22 @@
 export * from "./authFetch.js";
 export * from "./authMessaging.js";
+export * from "./deliverAuthMessage.js";
 export * from "./ensureCookies.js";
 export * from "./verifyCookieJwt.js";
+export * from "./verifyRefreshCookie.js";
+export * from "./verifySignedAuthResponse.js";
 export * from "./refreshAccessToken.js";
 export * from "./getSeamlessUser.js";
+export * from "./logger.js";
+export * from "./guards.js";
 export * from "./createServiceToken.js";
 export * from "./validateSecrets.js";
-export * from "./scopedRoles.js";
+export { hasScopedRole, roleGrantsAccess, } from "@seamless-auth/types/role/matching";
+export * from "./apiContract.js";
+export * from "./applyResult.js";
+export * from "./proxyRequest.js";
+export * from "./result.js";
+export * from "./upstreamSession.js";
 export * from "./redaction.js";
 export * from "./handlers/login.js";
 export * from "./handlers/finishLogin.js";
@@ -21,4 +31,8 @@ export * from "./handlers/requestMagicLinkHandler.js";
 export * from "./handlers/pollMagicLinkConfirmationHandler.js";
 export * from "./handlers/switchOrganizationHandler.js";
 export * from "./handlers/oauthHandlers.js";
+export * from "./handlers/admin.js";
+export * from "./handlers/sessions.js";
+export * from "./handlers/internalMetrics.js";
+export * from "./handlers/systemConfig.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AAKrC,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}

package/dist/index.js

@@ -1,12 +1,26 @@
 export * from "./authFetch.js";
 export * from "./authMessaging.js";
+export * from "./deliverAuthMessage.js";
 export * from "./ensureCookies.js";
 export * from "./verifyCookieJwt.js";
+export * from "./verifyRefreshCookie.js";
+export * from "./verifySignedAuthResponse.js";
 export * from "./refreshAccessToken.js";
 export * from "./getSeamlessUser.js";
+export * from "./logger.js";
+export * from "./guards.js";
 export * from "./createServiceToken.js";
 export * from "./validateSecrets.js";
-export * from "./scopedRoles.js";
+// Role matching decides whether a request is authorized, and the auth API runs
+// the same check on its side. Both take it from @seamless-auth/types so the two
+// cannot drift into disagreeing about who can do what. The /role/matching entry
+// is the zod-free one, so importing core does not pull zod or the schema barrel.
+export { hasScopedRole, roleGrantsAccess, } from "@seamless-auth/types/role/matching";
+export * from "./apiContract.js";
+export * from "./applyResult.js";
+export * from "./proxyRequest.js";
+export * from "./result.js";
+export * from "./upstreamSession.js";
 export * from "./redaction.js";
 export * from "./handlers/login.js";
 export * from "./handlers/finishLogin.js";
@@ -21,4 +35,8 @@ export * from "./handlers/requestMagicLinkHandler.js";
 export * from "./handlers/pollMagicLinkConfirmationHandler.js";
 export * from "./handlers/switchOrganizationHandler.js";
 export * from "./handlers/oauthHandlers.js";
+export * from "./handlers/admin.js";
+export * from "./handlers/sessions.js";
+export * from "./handlers/internalMetrics.js";
+export * from "./handlers/systemConfig.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}

package/dist/logger.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Where this package writes its diagnostics.
+ *
+ * Only the two levels it actually uses. Keeping the interface at what is needed
+ * means an adopter can satisfy it with an object literal, and a platform logger
+ * (`pino`, `console`, a Fastify `request.log`) already does.
+ */
+export interface SeamlessLogger {
+    warn(message: string): void;
+    error(message: string): void;
+}
+/**
+ * Routes this package's diagnostics somewhere other than `console`.
+ *
+ * Serverless and edge runtimes often ship logs through a platform logger, and a
+ * structured setup wants these as events rather than strings. Without this an
+ * adopter cannot capture, level, or silence them: an adapter that logs through
+ * its own logger still leaks core's lines to `console`, so one request produces
+ * output in two places.
+ *
+ * Pass nothing to go back to `console`.
+ */
+export declare function setSeamlessLogger(logger?: SeamlessLogger): void;
+/** The logger in effect. Read per call, so a later swap takes effect. */
+export declare function getSeamlessLogger(): SeamlessLogger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,KAAK,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AASD;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,CAAC,EAAE,cAAc,GAAG,IAAI,CAE/D;AAED,yEAAyE;AACzE,wBAAgB,iBAAiB,IAAI,cAAc,CAElD"}

package/dist/logger.js

@@ -0,0 +1,24 @@
+const consoleLogger = {
+    warn: (message) => console.warn(message),
+    error: (message) => console.error(message),
+};
+let activeLogger = consoleLogger;
+/**
+ * Routes this package's diagnostics somewhere other than `console`.
+ *
+ * Serverless and edge runtimes often ship logs through a platform logger, and a
+ * structured setup wants these as events rather than strings. Without this an
+ * adopter cannot capture, level, or silence them: an adapter that logs through
+ * its own logger still leaks core's lines to `console`, so one request produces
+ * output in two places.
+ *
+ * Pass nothing to go back to `console`.
+ */
+export function setSeamlessLogger(logger) {
+    activeLogger = logger ?? consoleLogger;
+}
+/** The logger in effect. Read per call, so a later swap takes effect. */
+export function getSeamlessLogger() {
+    return activeLogger;
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAYA,MAAM,aAAa,GAAmB;IACpC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;IACxC,KAAK,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC;CAC3C,CAAC;AAEF,IAAI,YAAY,GAAmB,aAAa,CAAC;AAEjD;;;;;;;;;;GAUG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,YAAY,GAAG,MAAM,IAAI,aAAa,CAAC;AACzC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,YAAY,CAAC;AACtB,CAAC"}

package/dist/proxyRequest.d.ts

@@ -0,0 +1,62 @@
+import type { AppliableResult } from "./applyResult.js";
+import { type AuthFetchOptions } from "./authFetch.js";
+/**
+ * Query parameters to forward upstream.
+ *
+ * Values are deliberately `unknown`: adapters hand over whatever their
+ * framework parsed, and Express's `ParsedQs` can nest objects. Scalars and
+ * arrays of scalars are forwarded, everything else is dropped, so a nested
+ * object cannot reach the auth API as `[object Object]`.
+ */
+export type QueryInput = Record<string, unknown>;
+/**
+ * Builds a querystring for an upstream call.
+ *
+ * An array becomes repeated parameters (`?type=login&type=logout`), which is
+ * what the auth API's schemas accept. Joining them into one comma-separated
+ * value produces a parameter that matches nothing upstream.
+ */
+export declare function buildQueryString(query?: QueryInput): string;
+export declare function buildUpstreamUrl(authServerUrl: string, path: string, query?: QueryInput): string;
+export type ProxyIdentity = "preAuth" | "access" | "register";
+export interface ProxyIdentityInput {
+    /** `sub` from the verified cookie payload, if the request carried one. */
+    subject?: string;
+    cookies: Record<string, unknown>;
+    identity: ProxyIdentity;
+    accessCookieName: string;
+    preAuthCookieName: string;
+    registrationCookieName: string;
+}
+export interface ProxyIdentityRejection {
+    status: number;
+    errorCode: string;
+    /** Set when the caller should log the rejection rather than only return it. */
+    warn?: string;
+}
+/**
+ * Checks that a request carries the session a proxied route requires.
+ *
+ * Returns the rejection to send, or `undefined` when the request may proceed.
+ * The cookie payload alone is not enough: it survives a refresh, so the route
+ * also has to see the specific cookie for the identity it needs.
+ */
+export declare function checkProxyIdentity(input: ProxyIdentityInput): ProxyIdentityRejection | undefined;
+export interface ProxyRequestOptions {
+    authServerUrl: string;
+    path: string;
+    method?: AuthFetchOptions["method"];
+    authorization?: string;
+    serviceAuthorization?: string;
+    forwardedClientIp?: string;
+    query?: QueryInput;
+    body?: unknown;
+}
+/**
+ * Forwards a request to the auth API and returns its status and body unchanged.
+ *
+ * Transparent on purpose: a proxied route has no view into what the response
+ * means, so a failure body is returned as-is rather than reshaped into a code.
+ */
+export declare function proxyRequest(opts: ProxyRequestOptions): Promise<AppliableResult>;
+//# sourceMappingURL=proxyRequest.d.ts.map

package/dist/proxyRequest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyRequest.d.ts","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAiB3D;AAED,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAKR;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,kBAAkB,GACxB,sBAAsB,GAAG,SAAS,CAwBpC;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAe1B"}