@seamless-auth/core 0.10.0 → 0.12.0

package/dist/proxyRequest.js

@@ -0,0 +1,82 @@
+import { authFetch } from "./authFetch.js";
+function isScalar(value) {
+    return (typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean");
+}
+/**
+ * Builds a querystring for an upstream call.
+ *
+ * An array becomes repeated parameters (`?type=login&type=logout`), which is
+ * what the auth API's schemas accept. Joining them into one comma-separated
+ * value produces a parameter that matches nothing upstream.
+ */
+export function buildQueryString(query) {
+    if (!query)
+        return "";
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query)) {
+        if (Array.isArray(value)) {
+            for (const item of value) {
+                if (isScalar(item))
+                    params.append(key, String(item));
+            }
+            continue;
+        }
+        if (isScalar(value))
+            params.append(key, String(value));
+    }
+    return params.toString();
+}
+export function buildUpstreamUrl(authServerUrl, path, query) {
+    const base = `${authServerUrl}${path.startsWith("/") ? "" : "/"}${path}`;
+    const qs = buildQueryString(query);
+    return qs ? `${base}?${qs}` : base;
+}
+/**
+ * Checks that a request carries the session a proxied route requires.
+ *
+ * Returns the rejection to send, or `undefined` when the request may proceed.
+ * The cookie payload alone is not enough: it survives a refresh, so the route
+ * also has to see the specific cookie for the identity it needs.
+ */
+export function checkProxyIdentity(input) {
+    if (!input.subject) {
+        return {
+            status: 401,
+            errorCode: "Unauthenticated request",
+            warn: "Missing expected cookie payload/sub.",
+        };
+    }
+    const required = {
+        access: { name: input.accessCookieName, error: "access session required" },
+        preAuth: {
+            name: input.preAuthCookieName,
+            error: "pre-auth session required",
+        },
+        register: {
+            name: input.registrationCookieName,
+            error: "registration session required",
+        },
+    };
+    const { name, error } = required[input.identity];
+    return input.cookies[name] ? undefined : { status: 401, errorCode: error };
+}
+/**
+ * Forwards a request to the auth API and returns its status and body unchanged.
+ *
+ * Transparent on purpose: a proxied route has no view into what the response
+ * means, so a failure body is returned as-is rather than reshaped into a code.
+ */
+export async function proxyRequest(opts) {
+    const method = opts.method ?? "POST";
+    const upstream = await authFetch(buildUpstreamUrl(opts.authServerUrl, opts.path, opts.query), {
+        method,
+        authorization: opts.authorization,
+        serviceAuthorization: opts.serviceAuthorization,
+        forwardedClientIp: opts.forwardedClientIp,
+        ...(method === "GET" ? {} : { body: opts.body }),
+    });
+    return { status: upstream.status, body: await upstream.json() };
+}
+//# sourceMappingURL=proxyRequest.js.map

package/dist/proxyRequest.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxyRequest.js","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAYlE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,IAAY,EACZ,KAAkB;IAElB,MAAM,IAAI,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,yBAAyB;YACpC,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAA2D;QACvE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,EAAE;QAC1E,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,iBAAiB;YAC7B,KAAK,EAAE,2BAA2B;SACnC;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,sBAAsB;YAClC,KAAK,EAAE,+BAA+B;SACvC;KACF,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAaD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAC3D;QACE,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACjD,CACF,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC"}

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAWA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,UAKhD"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAiBA,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,UAKhD"}

package/dist/redaction.js

@@ -3,8 +3,14 @@ const SENSITIVE_TEXT_PATTERNS = [
     [/\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi, REDACTED],
     [/\b(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, `$1${REDACTED}`],
     [/(\/magic-link\/verify\/)[^/?#\s]+/gi, `$1${REDACTED}`],
-    [/([?&](?:token|bootstrapToken|state|code|salt)=)[^&#\s]+/gi, `$1${REDACTED}`],
-    [/\b((?:token|bootstrapToken|verificationToken|identifier|phone|state|code|secret|salt)\s*[:=]\s*)[^,&\s}]+/gi, `$1${REDACTED}`],
+    [
+        /([?&](?:token|bootstrapToken|state|code|salt)=)[^&#\s]+/gi,
+        `$1${REDACTED}`,
+    ],
+    [
+        /\b((?:token|bootstrapToken|verificationToken|identifier|phone|state|code|secret|salt)\s*[:=]\s*)[^,&\s}]+/gi,
+        `$1${REDACTED}`,
+    ],
     [/\b(client_secret=)[^&\s]+/gi, `$1${REDACTED}`],
 ];
 export function redactSensitiveText(value) {

package/dist/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,uBAAuB,GAA4B;IACvD,CAAC,6CAA6C,EAAE,QAAQ,CAAC;IACzD,CAAC,oCAAoC,EAAE,KAAK,QAAQ,EAAE,CAAC;IACvD,CAAC,qCAAqC,EAAE,KAAK,QAAQ,EAAE,CAAC;IACxD,CAAC,2DAA2D,EAAE,KAAK,QAAQ,EAAE,CAAC;IAC9E,CAAC,6GAA6G,EAAE,KAAK,QAAQ,EAAE,CAAC;IAChI,CAAC,6BAA6B,EAAE,KAAK,QAAQ,EAAE,CAAC;CACjD,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,uBAAuB,CAAC,MAAM,CACnC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAC1E,KAAK,CACN,CAAC;AACJ,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B,MAAM,uBAAuB,GAA4B;IACvD,CAAC,6CAA6C,EAAE,QAAQ,CAAC;IACzD,CAAC,oCAAoC,EAAE,KAAK,QAAQ,EAAE,CAAC;IACvD,CAAC,qCAAqC,EAAE,KAAK,QAAQ,EAAE,CAAC;IACxD;QACE,2DAA2D;QAC3D,KAAK,QAAQ,EAAE;KAChB;IACD;QACE,6GAA6G;QAC7G,KAAK,QAAQ,EAAE;KAChB;IACD,CAAC,6BAA6B,EAAE,KAAK,QAAQ,EAAE,CAAC;CACjD,CAAC;AAEF,MAAM,UAAU,mBAAmB,CAAC,KAAa;IAC/C,OAAO,uBAAuB,CAAC,MAAM,CACnC,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,EAC1E,KAAK,CACN,CAAC;AACJ,CAAC"}

package/dist/refreshAccessToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA+BF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAyD1C"}
+{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAkCF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CAyD1C"}

package/dist/refreshAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyBrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAoD,CAAC;AACtF,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,GAAG,GAAG,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,IAA+B;IAE/B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;YAC/C,oBAAoB,EAAE,UAAU,YAAY,EAAE;YAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACtC,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE;gBACtC,MAAM;gBACN,SAAS,EAAE,UAAU,GAAG,4BAA4B;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}
+{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAyBrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;AACJ,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,GAAG,GAAG,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,IAA+B;IAE/B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;YAC/C,oBAAoB,EAAE,UAAU,YAAY,EAAE;YAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;SAC1C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACtC,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE;gBACtC,MAAM;gBACN,SAAS,EAAE,UAAU,GAAG,4BAA4B;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}

package/dist/result.d.ts

@@ -0,0 +1,23 @@
+/**
+ * How a handler reports a failure.
+ *
+ * At most one of the two is set, and they are rendered differently, which is
+ * why they are separate fields rather than one `error`:
+ *
+ * - `errorCode` is a code this package chose. The adapter renders it as
+ *   `{ error, details }`.
+ * - `errorBody` is the auth API's own failure body, which the adapter forwards
+ *   unchanged. Callers read fields off it directly, so it must not be reshaped:
+ *   the React SDK reads a top-level `code` to tell OAuth failures apart, and a
+ *   top-level `error` or `message` for the message it shows.
+ *
+ * Before this split both meanings shared one `error` field, so its type could
+ * not be honest about either and an adapter could not render it without knowing
+ * which handler produced it.
+ */
+export interface ResultFailure {
+    errorCode?: string;
+    errorBody?: unknown;
+    details?: unknown;
+}
+//# sourceMappingURL=result.d.ts.map

package/dist/result.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.d.ts","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}

package/dist/result.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=result.js.map

package/dist/result.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"result.js","sourceRoot":"","sources":["../src/result.ts"],"names":[],"mappings":""}

package/dist/upstreamError.d.ts

@@ -0,0 +1,31 @@
+import type { ResultFailure } from "./result.js";
+/**
+ * Last-resort code for a failure the auth API sent with no body at all.
+ *
+ * A passthrough route has nothing else to say: it does not interpret the
+ * response, so when there is no body there is no detail to forward.
+ */
+export declare const UPSTREAM_ERROR_CODE = "upstream_error";
+/**
+ * Reads an upstream failure for a route that forwards the auth API's response
+ * rather than interpreting it.
+ *
+ * The body goes through verbatim whenever there is one, because callers read
+ * fields off it directly and reshaping it breaks them. An empty body has nothing
+ * to forward, and returning it as-is produced a bare status with no body, which
+ * left the caller with nothing to act on and the SDK falling back to a generic
+ * message (#125). That case becomes a code instead.
+ */
+export declare function readPassthroughFailure(data: unknown, fallback?: string): ResultFailure;
+/**
+ * Reads an upstream error body into the `{ error, details }` pair the proxy
+ * handlers return.
+ *
+ * The auth API answers a validation failure with a Zod body shaped
+ * `{ name, message }` and no `error` key, so keying only off `error` collapsed
+ * every one of them to the caller-opaque fallback code and dropped the name of
+ * the rejected field (#115). `details` carries the upstream body whenever it
+ * holds more than the derived error string.
+ */
+export declare function readUpstreamFailure(data: unknown, fallback: string): ResultFailure;
+//# sourceMappingURL=upstreamError.d.ts.map

package/dist/upstreamError.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreamError.d.ts","sourceRoot":"","sources":["../src/upstreamError.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAMjD;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,OAAO,EACb,QAAQ,GAAE,MAA4B,GACrC,aAAa,CAEf;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,OAAO,EACb,QAAQ,EAAE,MAAM,GACf,aAAa,CAkBf"}

package/dist/upstreamError.js

@@ -0,0 +1,49 @@
+function isObject(value) {
+    return typeof value === "object" && value !== null;
+}
+/**
+ * Last-resort code for a failure the auth API sent with no body at all.
+ *
+ * A passthrough route has nothing else to say: it does not interpret the
+ * response, so when there is no body there is no detail to forward.
+ */
+export const UPSTREAM_ERROR_CODE = "upstream_error";
+/**
+ * Reads an upstream failure for a route that forwards the auth API's response
+ * rather than interpreting it.
+ *
+ * The body goes through verbatim whenever there is one, because callers read
+ * fields off it directly and reshaping it breaks them. An empty body has nothing
+ * to forward, and returning it as-is produced a bare status with no body, which
+ * left the caller with nothing to act on and the SDK falling back to a generic
+ * message (#125). That case becomes a code instead.
+ */
+export function readPassthroughFailure(data, fallback = UPSTREAM_ERROR_CODE) {
+    return isObject(data) ? { errorBody: data } : { errorCode: fallback };
+}
+/**
+ * Reads an upstream error body into the `{ error, details }` pair the proxy
+ * handlers return.
+ *
+ * The auth API answers a validation failure with a Zod body shaped
+ * `{ name, message }` and no `error` key, so keying only off `error` collapsed
+ * every one of them to the caller-opaque fallback code and dropped the name of
+ * the rejected field (#115). `details` carries the upstream body whenever it
+ * holds more than the derived error string.
+ */
+export function readUpstreamFailure(data, fallback) {
+    if (!isObject(data)) {
+        return { errorCode: fallback };
+    }
+    const errorCode = typeof data.error === "string"
+        ? data.error
+        : typeof data.message === "string"
+            ? data.message
+            : fallback;
+    const keys = Object.keys(data);
+    if (keys.length === 1 && data[keys[0]] === errorCode) {
+        return { errorCode };
+    }
+    return { errorCode, details: data };
+}
+//# sourceMappingURL=upstreamError.js.map

package/dist/upstreamError.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreamError.js","sourceRoot":"","sources":["../src/upstreamError.ts"],"names":[],"mappings":"AAEA,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACrD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB,CACpC,IAAa,EACb,WAAmB,mBAAmB;IAEtC,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB,CACjC,IAAa,EACb,QAAgB;IAEhB,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC;IACjC,CAAC;IAED,MAAM,SAAS,GACb,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ;QAC5B,CAAC,CAAC,IAAI,CAAC,KAAK;QACZ,CAAC,CAAC,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,CAAC,CAAC,IAAI,CAAC,OAAO;YACd,CAAC,CAAC,QAAQ,CAAC;IAEjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,EAAE,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACtC,CAAC"}

package/dist/upstreamSession.d.ts

@@ -0,0 +1,53 @@
+import type { SessionCookie } from "./applyResult.js";
+/**
+ * What the auth API returns when it issues a session.
+ *
+ * The handlers read these fields off the parsed response, which was untyped
+ * before: a rename upstream showed up as an undefined cookie field at runtime
+ * rather than a type error here.
+ *
+ * The index signature is deliberate. Several handlers forward the whole body to
+ * the caller, so it carries more than the fields this package reads, and the
+ * type should not claim otherwise.
+ */
+export interface UpstreamSessionResponse {
+    sub: string;
+    token: string;
+    refreshToken?: string;
+    roles?: string[];
+    email?: string;
+    phone?: string | null;
+    organizationId?: string | null;
+    ttl: number;
+    refreshTtl?: number;
+    [key: string]: unknown;
+}
+export interface VerifiedUpstreamSession {
+    /** The `sid` claim, when the access token carries one. */
+    sessionId?: string;
+}
+/**
+ * Verifies the access token the auth API signed and confirms it describes the
+ * same subject as the response body.
+ *
+ * Throws rather than returning a failure: a response that fails either check is
+ * not a rejected login, it is a response this package cannot trust, and
+ * continuing would mint a session from it.
+ */
+export declare function verifyUpstreamSession(data: UpstreamSessionResponse, authServerUrl: string, audience: string): Promise<VerifiedUpstreamSession>;
+export interface IssueSessionCookiesOptions {
+    authServerUrl: string;
+    audience: string;
+    accessCookieName: string;
+    /** Omit for a flow that reissues the access cookie without rotating refresh. */
+    refreshCookieName?: string;
+    cookieDomain?: string;
+}
+/**
+ * Verifies an upstream session response and builds the cookies for it.
+ *
+ * One place decides what a session cookie holds, so the flows that issue one
+ * cannot disagree about it.
+ */
+export declare function issueSessionCookies(data: UpstreamSessionResponse, opts: IssueSessionCookiesOptions): Promise<SessionCookie[]>;
+//# sourceMappingURL=upstreamSession.d.ts.map

package/dist/upstreamSession.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreamSession.d.ts","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,uBAAuB,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,CAAC,CAkBlC;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,aAAa,EAAE,CAAC,CAkC1B"}

package/dist/upstreamSession.js

@@ -0,0 +1,56 @@
+import { verifySignedAuthResponse } from "./verifySignedAuthResponse.js";
+/**
+ * Verifies the access token the auth API signed and confirms it describes the
+ * same subject as the response body.
+ *
+ * Throws rather than returning a failure: a response that fails either check is
+ * not a rejected login, it is a response this package cannot trust, and
+ * continuing would mint a session from it.
+ */
+export async function verifyUpstreamSession(data, authServerUrl, audience) {
+    const verified = await verifySignedAuthResponse(data.token, authServerUrl, audience);
+    if (!verified) {
+        throw new Error("Invalid signed response from Auth Server");
+    }
+    if (verified.sub !== data.sub) {
+        throw new Error("Signature mismatch with data payload");
+    }
+    return {
+        sessionId: typeof verified.sid === "string" ? verified.sid : undefined,
+    };
+}
+/**
+ * Verifies an upstream session response and builds the cookies for it.
+ *
+ * One place decides what a session cookie holds, so the flows that issue one
+ * cannot disagree about it.
+ */
+export async function issueSessionCookies(data, opts) {
+    const { sessionId } = await verifyUpstreamSession(data, opts.authServerUrl, opts.audience);
+    const cookies = [
+        {
+            name: opts.accessCookieName,
+            value: {
+                sub: data.sub,
+                ...(sessionId === undefined ? {} : { sessionId }),
+                token: data.token,
+                roles: data.roles,
+                email: data.email,
+                phone: data.phone,
+                organizationId: data.organizationId ?? null,
+            },
+            ttl: data.ttl,
+            domain: opts.cookieDomain,
+        },
+    ];
+    if (opts.refreshCookieName) {
+        cookies.push({
+            name: opts.refreshCookieName,
+            value: { sub: data.sub, refreshToken: data.refreshToken },
+            ttl: data.refreshTtl,
+            domain: opts.cookieDomain,
+        });
+    }
+    return cookies;
+}
+//# sourceMappingURL=upstreamSession.js.map

package/dist/upstreamSession.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstreamSession.js","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AA+BzE;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA6B,EAC7B,aAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,aAAa,EACb,QAAQ,CACT,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA6B,EAC7B,IAAgC;IAEhC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAC/C,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,MAAM,OAAO,GAAoB;QAC/B;YACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;YAC3B,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;aAC5C;YACD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,iBAAiB;YAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACzD,GAAG,EAAE,IAAI,CAAC,UAAoB;YAC9B,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/verifySignedAuthResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAgBA,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,GAAG,EACpD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAgBnB"}
+{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAiBA,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,GAAG,EACpD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAkBnB"}

package/dist/verifySignedAuthResponse.js

@@ -1,4 +1,5 @@
 import { createRemoteJWKSet, jwtVerify } from "jose";
+import { getSeamlessLogger } from "./logger.js";
 // jose caches keys and applies a refetch cooldown per JWKS instance, so the instance
 // must outlive a single call. Memoize per JWKS URL (one per auth server, so the map
 // stays tiny) instead of building a fresh, empty-cache instance on every verification.
@@ -23,7 +24,7 @@ export async function verifySignedAuthResponse(token, authServerUrl, audience) {
         return payload;
     }
     catch {
-        console.error("[SeamlessAuth] Failed to verify signed auth response.");
+        getSeamlessLogger().error("[SeamlessAuth] Failed to verify signed auth response.");
         return null;
     }
 }

package/dist/verifySignedAuthResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifySignedAuthResponse.js","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAErD,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,aAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,aAAa;YACrB,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"verifySignedAuthResponse.js","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,aAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,aAAa;YACrB,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,EAAE,CAAC,KAAK,CACvB,uDAAuD,CACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/core",
-  "version": "0.10.0",
+  "version": "0.12.0",
   "description": "Framework-agnostic core authentication logic for SeamlessAuth",
   "keywords": [
     "authentication",
@@ -45,6 +45,7 @@
     "node": ">=24 <25"
   },
   "dependencies": {
+    "@seamless-auth/types": "^0.4.0",
     "jose": "^6.1.3",
     "jsonwebtoken": "^9.0.2"
   },

package/dist/scopedRoles.d.ts

@@ -1,3 +0,0 @@
-export declare function roleGrantsAccess(grantedRole: string, requiredRole: string): boolean;
-export declare function hasScopedRole(grantedRoles: unknown, requiredRoles: string | string[]): boolean;
-//# sourceMappingURL=scopedRoles.d.ts.map

package/dist/scopedRoles.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scopedRoles.d.ts","sourceRoot":"","sources":["../src/scopedRoles.ts"],"names":[],"mappings":"AAAA,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAsCnF;AAED,wBAAgB,aAAa,CAC3B,YAAY,EAAE,OAAO,EACrB,aAAa,EAAE,MAAM,GAAG,MAAM,EAAE,GAC/B,OAAO,CAaT"}

package/dist/scopedRoles.js

@@ -1,39 +0,0 @@
-export function roleGrantsAccess(grantedRole, requiredRole) {
-    const granted = grantedRole.trim();
-    const required = requiredRole.trim();
-    if (!granted || !required) {
-        return false;
-    }
-    if (granted === required) {
-        return true;
-    }
-    if (granted.endsWith(":*")) {
-        const prefix = granted.slice(0, -2);
-        return required === prefix || required.startsWith(`${prefix}:`);
-    }
-    if (!required.includes(":")) {
-        return false;
-    }
-    if (!granted.includes(":")) {
-        return required.startsWith(`${granted}:`);
-    }
-    const grantedParts = granted.split(":");
-    const requiredParts = required.split(":");
-    const grantedAction = grantedParts.at(-1);
-    const requiredAction = requiredParts.at(-1);
-    const grantedPrefix = grantedParts.slice(0, -1);
-    const requiredPrefix = requiredParts.slice(0, -1);
-    return (grantedAction === "write" &&
-        requiredAction === "read" &&
-        grantedPrefix.length === requiredPrefix.length &&
-        grantedPrefix.every((part, index) => part === requiredPrefix[index]));
-}
-export function hasScopedRole(grantedRoles, requiredRoles) {
-    if (!Array.isArray(grantedRoles)) {
-        return false;
-    }
-    const granted = grantedRoles.filter((role) => typeof role === "string");
-    const required = Array.isArray(requiredRoles) ? requiredRoles : [requiredRoles];
-    return required.some((requiredRole) => granted.some((grantedRole) => roleGrantsAccess(grantedRole, requiredRole)));
-}
-//# sourceMappingURL=scopedRoles.js.map

package/dist/scopedRoles.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"scopedRoles.js","sourceRoot":"","sources":["../src/scopedRoles.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,gBAAgB,CAAC,WAAmB,EAAE,YAAoB;IACxE,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IAErC,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC1B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC;IAClE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,QAAQ,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,YAAY,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1C,MAAM,cAAc,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChD,MAAM,cAAc,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAElD,OAAO,CACL,aAAa,KAAK,OAAO;QACzB,cAAc,KAAK,MAAM;QACzB,aAAa,CAAC,MAAM,KAAK,cAAc,CAAC,MAAM;QAC9C,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,KAAK,cAAc,CAAC,KAAK,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,aAAa,CAC3B,YAAqB,EACrB,aAAgC;IAEhC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACjC,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CACjC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CACnD,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;IAEhF,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,EAAE,CACpC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,gBAAgB,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAC3E,CAAC;AACJ,CAAC"}