@seamless-auth/core 0.15.0 → 0.16.0

package/dist/handlers/refresh.d.ts

@@ -0,0 +1,44 @@
+import type { AuthTransport } from "../transport.js";
+import type { ResultFailure } from "../result.js";
+import type { CookiePayload } from "../ensureCookies.js";
+export interface RefreshInput {
+    transport: AuthTransport;
+    /** The raw `Authorization` header. Bearer transport carries the refresh token here. */
+    authorization?: string;
+    /** The signed refresh cookie. Cookie transport carries the refresh token here. */
+    refreshCookie?: string;
+    serviceAuthorization?: string;
+    forwardedClientIp?: string;
+    forwardedUserAgent?: string;
+}
+export interface RefreshOptions {
+    authServerUrl: string;
+    audience: string;
+    cookieSecret: string;
+    serviceSecret: string;
+    keyId: string;
+    cookieDomain?: string;
+    accessCookieName: string;
+    refreshCookieName: string;
+}
+export interface RefreshResult extends ResultFailure {
+    status: number;
+    body?: unknown;
+    setCookies?: {
+        name: string;
+        value: CookiePayload;
+        ttl: number;
+        domain?: string;
+    }[];
+    clearCookies?: string[];
+}
+/**
+ * Rotates the session on request.
+ *
+ * Cookie clients rarely need this, since `ensureCookies` refreshes silently on
+ * the auth routes, but it gives them an explicit way to do it. Bearer clients
+ * depend on it: nothing refreshes for them, so when the access token expires
+ * they present the refresh token here and store the pair that comes back.
+ */
+export declare function refreshHandler(input: RefreshInput, opts: RefreshOptions): Promise<RefreshResult>;
+//# sourceMappingURL=refresh.d.ts.map

package/dist/handlers/refresh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.d.ts","sourceRoot":"","sources":["../../src/handlers/refresh.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,aAAa,CAAC;IACzB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kFAAkF;IAClF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,cAAc;IAC7B,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,aAAc,SAAQ,aAAa;IAClD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;IACJ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,KAAK,EAAE,YAAY,EACnB,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,aAAa,CAAC,CAkExB"}

package/dist/handlers/refresh.js

@@ -0,0 +1,70 @@
+import { extractBearerToken } from "../verifyAccessToken.js";
+import { refreshAccessToken, refreshBearerSession, } from "../refreshAccessToken.js";
+import { SERVICE_TOKEN_AUDIENCE, SERVICE_TOKEN_ISSUER } from "../apiContract.js";
+import { sessionResult } from "../upstreamSession.js";
+/**
+ * Rotates the session on request.
+ *
+ * Cookie clients rarely need this, since `ensureCookies` refreshes silently on
+ * the auth routes, but it gives them an explicit way to do it. Bearer clients
+ * depend on it: nothing refreshes for them, so when the access token expires
+ * they present the refresh token here and store the pair that comes back.
+ */
+export async function refreshHandler(input, opts) {
+    const forwarding = {
+        forwardedClientIp: input.forwardedClientIp,
+        forwardedUserAgent: input.forwardedUserAgent,
+    };
+    const session = {
+        authServerUrl: opts.authServerUrl,
+        audience: opts.audience,
+        accessCookieName: opts.accessCookieName,
+        refreshCookieName: opts.refreshCookieName,
+        cookieDomain: opts.cookieDomain,
+        transport: input.transport,
+    };
+    if (input.transport === "bearer") {
+        const refreshToken = extractBearerToken(input.authorization);
+        if (!refreshToken) {
+            return { status: 401, errorCode: "refresh token required" };
+        }
+        const rotated = await refreshBearerSession(refreshToken, {
+            authServerUrl: opts.authServerUrl,
+            serviceAuthorization: input.serviceAuthorization,
+            ...forwarding,
+        });
+        if (rotated.status !== 200) {
+            return { status: rotated.status, errorBody: rotated.body };
+        }
+        return {
+            status: 200,
+            ...(await sessionResult(rotated.body, session)),
+        };
+    }
+    if (!input.refreshCookie) {
+        return { status: 401, errorCode: "refresh token required" };
+    }
+    const rotated = await refreshAccessToken(input.refreshCookie, {
+        authServerUrl: opts.authServerUrl,
+        cookieSecret: opts.cookieSecret,
+        serviceSecret: opts.serviceSecret,
+        // The refresh path mints an M2M service token, which the auth API validates
+        // against a fixed issuer and audience rather than the adopter-configured one.
+        issuer: SERVICE_TOKEN_ISSUER,
+        audience: SERVICE_TOKEN_AUDIENCE,
+        keyId: opts.keyId,
+        ...forwarding,
+    });
+    if (!rotated) {
+        return {
+            status: 401,
+            errorCode: "invalid_refresh_token",
+            clearCookies: [opts.accessCookieName, opts.refreshCookieName],
+        };
+    }
+    return {
+        status: 200,
+        ...(await sessionResult(rotated, session)),
+    };
+}
+//# sourceMappingURL=refresh.js.map

package/dist/handlers/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../../src/handlers/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AACjF,OAAO,EAAE,aAAa,EAAgC,MAAM,uBAAuB,CAAC;AAuCpF;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAmB,EACnB,IAAoB;IAEpB,MAAM,UAAU,GAAG;QACjB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC;IAEF,MAAM,OAAO,GAAG;QACd,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;QACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAE7D,IAAI,CAAC,YAAY,EAAE,CAAC;YAClB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;QAC9D,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,YAAY,EAAE;YACvD,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;YAChD,GAAG,UAAU;SACd,CAAC,CAAC;QAEH,IAAI,OAAO,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YAC3B,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,GAAG,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,IAA+B,EAAE,OAAO,CAAC,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;QACzB,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,CAAC;IAC9D,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,kBAAkB,CAAC,KAAK,CAAC,aAAa,EAAE;QAC5D,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,4EAA4E;QAC5E,8EAA8E;QAC9E,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,sBAAsB;QAChC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,GAAG,UAAU;KACd,CAAC,CAAC;IAEH,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,uBAAuB;YAClC,YAAY,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,iBAAiB,CAAC;SAC9D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,GAAG,CAAC,MAAM,aAAa,CAAC,OAAkC,EAAE,OAAO,CAAC,CAAC;KACtE,CAAC;AACJ,CAAC"}

package/dist/handlers/register.d.ts

@@ -1,5 +1,6 @@
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
+import type { AuthTransport } from "../transport.js";
 export interface RegisterInput {
     body: unknown;
 }
@@ -11,6 +12,7 @@ export interface RegisterOptions {
     forwardedClientIp?: string;
     forwardedUserAgent?: string;
     serviceAuthorization?: string;
+    transport?: AuthTransport;
 }
 export interface RegisterResult extends ResultFailure {
     status: number;

package/dist/handlers/register.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAmCzB"}
+{"version":3,"file":"register.d.ts","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,cAAe,SAAQ,aAAa;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,aAAa,EACpB,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,cAAc,CAAC,CAuCzB"}

package/dist/handlers/register.js

@@ -21,6 +21,9 @@ export async function registerHandler(input, opts) {
             ...readPassthroughFailure(data),
         };
     }
+    if (opts.transport === "bearer") {
+        return { status: 200, body: data };
+    }
     return {
         status: 200,
         body: data,

package/dist/handlers/register.js.map

@@ -1 +1 @@
-{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA6B9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE,yBAAyB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,sBAAsB;gBACjC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"register.js","sourceRoot":"","sources":["../../src/handlers/register.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,yBAAyB,EAAE,MAAM,mBAAmB,CAAC;AA+B9D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAoB,EACpB,IAAqB;IAErB,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,wBAAwB,EAAE;QACxE,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,GAAG,CAAC,IAAI,CAAC,gBAAgB;YACvB,CAAC,CAAC;gBACE,OAAO,EAAE,yBAAyB;aACnC;YACH,CAAC,CAAC,EAAE,CAAC;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACrC,CAAC;IAED,OAAO;QACL,MAAM,EAAE,GAAG;QACX,IAAI,EAAE,IAAI;QACV,UAAU,EAAE;YACV;gBACE,IAAI,EAAE,IAAI,CAAC,sBAAsB;gBACjC,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE;gBAC3C,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B;SACF;KACF,CAAC;AACJ,CAAC"}

package/dist/handlers/switchOrganizationHandler.d.ts

@@ -1,3 +1,4 @@
+import type { AuthTransport } from "../transport.js";
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface SwitchOrganizationInput {
@@ -12,6 +13,7 @@ export interface SwitchOrganizationOptions {
     audience: string;
     cookieDomain?: string;
     accessCookieName: string;
+    transport?: AuthTransport;
 }
 export interface SwitchOrganizationResult extends ResultFailure {
     status: number;

package/dist/handlers/switchOrganizationHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAsCnC"}
+{"version":3,"file":"switchOrganizationHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,uBAAuB;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,wBAAyB,SAAQ,aAAa;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAED,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,uBAAuB,EAC9B,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,CAAC,CAsCnC"}

package/dist/handlers/switchOrganizationHandler.js

@@ -1,5 +1,5 @@
 import { authFetch } from "../authFetch.js";
-import { issueSessionCookies, withoutSessionMaterial, } from "../upstreamSession.js";
+import { sessionResult } from "../upstreamSession.js";
 import { readPassthroughFailure } from "../upstreamError.js";
 export async function switchOrganizationHandler(input, opts) {
     const up = await authFetch(`${opts.authServerUrl}/organizations/${encodeURIComponent(input.organizationId)}/switch`, {
@@ -24,13 +24,13 @@ export async function switchOrganizationHandler(input, opts) {
     }
     return {
         status: up.status,
-        body: withoutSessionMaterial(data),
-        setCookies: await issueSessionCookies(data, {
+        ...(await sessionResult(data, {
             authServerUrl: opts.authServerUrl,
             audience: opts.audience,
             accessCookieName: opts.accessCookieName,
             cookieDomain: opts.cookieDomain,
-        }),
+            transport: opts.transport,
+        })),
     };
 }
 //# sourceMappingURL=switchOrganizationHandler.js.map

package/dist/handlers/switchOrganizationHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA8B7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B,EAC9B,IAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EACxF;QACE,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC"}
+{"version":3,"file":"switchOrganizationHandler.js","sourceRoot":"","sources":["../../src/handlers/switchOrganizationHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AA+B7D,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAA8B,EAC9B,IAA+B;IAE/B,MAAM,EAAE,GAAG,MAAM,SAAS,CACxB,GAAG,IAAI,CAAC,aAAa,kBAAkB,kBAAkB,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,EACxF;QACE,MAAM,EAAE,MAAM;QACd,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CACF,CAAC;IAEF,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC"}

package/dist/handlers/verifyLoginOtpHandler.d.ts

@@ -1,3 +1,4 @@
+import type { AuthTransport } from "../transport.js";
 import type { ResultFailure } from "../result.js";
 import type { CookiePayload } from "../ensureCookies.js";
 export interface VerifyLoginOtpInput {
@@ -14,6 +15,7 @@ export interface VerifyLoginOtpOptions {
     cookieDomain?: string;
     accessCookieName: string;
     refreshCookieName: string;
+    transport?: AuthTransport;
 }
 export interface VerifyLoginOtpResult extends ResultFailure {
     status: number;

package/dist/handlers/verifyLoginOtpHandler.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAkDD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAK/B"}
+{"version":3,"file":"verifyLoginOtpHandler.d.ts","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAErD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzD,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAC;IACd,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,qBAAqB;IACpC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,oBAAqB,SAAQ,aAAa;IACzD,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,UAAU,CAAC,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,aAAa,CAAC;QACrB,GAAG,EAAE,MAAM,CAAC;QACZ,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,EAAE,CAAC;CACL;AAkDD,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAO/B;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,mBAAmB,EAC1B,IAAI,EAAE,qBAAqB,GAC1B,OAAO,CAAC,oBAAoB,CAAC,CAK/B"}

package/dist/handlers/verifyLoginOtpHandler.js

@@ -1,5 +1,5 @@
 import { authFetch } from "../authFetch.js";
-import { issueSessionCookies, withoutSessionMaterial, } from "../upstreamSession.js";
+import { sessionResult } from "../upstreamSession.js";
 import { readPassthroughFailure } from "../upstreamError.js";
 // Shared by the login and registration OTP verify handlers: POST to the given
 // auth-server path and, when the response carries a session, validate the signed
@@ -30,14 +30,14 @@ async function verifyOtp(path, input, opts) {
     }
     return {
         status: up.status,
-        body: withoutSessionMaterial(data),
-        setCookies: await issueSessionCookies(data, {
+        ...(await sessionResult(data, {
             authServerUrl: opts.authServerUrl,
             audience: opts.audience,
             accessCookieName: opts.accessCookieName,
             refreshCookieName: opts.refreshCookieName,
             cookieDomain: opts.cookieDomain,
-        }),
+            transport: opts.transport,
+        })),
     };
 }
 export async function verifyLoginOtpHandler(input, opts) {

package/dist/handlers/verifyLoginOtpHandler.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EACL,mBAAmB,EACnB,sBAAsB,GACvB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAgC7D,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE;YAC1C,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC;KACH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,4BAA4B,CAAC;IAEnC,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE3E,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"verifyLoginOtpHandler.js","sourceRoot":"","sources":["../../src/handlers/verifyLoginOtpHandler.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAiC7D,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,kFAAkF;AAClF,yEAAyE;AACzE,KAAK,UAAU,SAAS,CACtB,IAAY,EACZ,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,EAAE,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,IAAI,EAAE,EAAE;QAC1D,MAAM,EAAE,MAAM;QACd,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,oBAAoB,EAAE,KAAK,CAAC,oBAAoB;QAChD,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;QAC1C,kBAAkB,EAAE,KAAK,CAAC,kBAAkB;KAC7C,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC;IAE7B,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACX,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,GAAG,sBAAsB,CAAC,IAAI,CAAC;SAChC,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACjB,OAAO;YACL,MAAM,EAAE,EAAE,CAAC,MAAM;YACjB,IAAI,EAAE,IAAI;SACX,CAAC;IACJ,CAAC;IAED,OAAO;QACL,MAAM,EAAE,EAAE,CAAC,MAAM;QACjB,GAAG,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE;YAC5B,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,YAAY,EAAE,IAAI,CAAC,YAAY;YAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;SAC1B,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO;QACpB,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,4BAA4B,CAAC;IAEnC,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAA0B,EAC1B,IAA2B;IAE3B,MAAM,IAAI,GACR,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,CAAC,sBAAsB,CAAC;IAE3E,OAAO,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AACtC,CAAC"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ export * from "./ensureCookies.js";
 export * from "./verifyCookieJwt.js";
 export * from "./verifyRefreshCookie.js";
 export * from "./verifySignedAuthResponse.js";
+export * from "./verifyAccessToken.js";
 export * from "./refreshAccessToken.js";
 export * from "./getSeamlessUser.js";
 export * from "./logger.js";
@@ -13,6 +14,7 @@ export * from "./createServiceToken.js";
 export * from "./validateSecrets.js";
 export { hasScopedRole, roleGrantsAccess, } from "@seamless-auth/types/role/matching";
 export * from "./apiContract.js";
+export * from "./transport.js";
 export * from "./applyResult.js";
 export * from "./proxyRequest.js";
 export * from "./result.js";
@@ -23,6 +25,7 @@ export * from "./handlers/finishLogin.js";
 export * from "./handlers/register.js";
 export * from "./handlers/finishRegister.js";
 export * from "./handlers/logout.js";
+export * from "./handlers/refresh.js";
 export * from "./handlers/me.js";
 export * from "./handlers/requestOtpHandler.js";
 export * from "./handlers/verifyLoginOtpHandler.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AAKrC,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AAKrC,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}

package/dist/index.js

@@ -5,6 +5,7 @@ export * from "./ensureCookies.js";
 export * from "./verifyCookieJwt.js";
 export * from "./verifyRefreshCookie.js";
 export * from "./verifySignedAuthResponse.js";
+export * from "./verifyAccessToken.js";
 export * from "./refreshAccessToken.js";
 export * from "./getSeamlessUser.js";
 export * from "./logger.js";
@@ -17,6 +18,7 @@ export * from "./validateSecrets.js";
 // is the zod-free one, so importing core does not pull zod or the schema barrel.
 export { hasScopedRole, roleGrantsAccess, } from "@seamless-auth/types/role/matching";
 export * from "./apiContract.js";
+export * from "./transport.js";
 export * from "./applyResult.js";
 export * from "./proxyRequest.js";
 export * from "./result.js";
@@ -27,6 +29,7 @@ export * from "./handlers/finishLogin.js";
 export * from "./handlers/register.js";
 export * from "./handlers/finishRegister.js";
 export * from "./handlers/logout.js";
+export * from "./handlers/refresh.js";
 export * from "./handlers/me.js";
 export * from "./handlers/requestOtpHandler.js";
 export * from "./handlers/verifyLoginOtpHandler.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,oBAAoB,CAAC;AACnC,cAAc,yBAAyB,CAAC;AACxC,cAAc,oBAAoB,CAAC;AACnC,cAAc,sBAAsB,CAAC;AACrC,cAAc,0BAA0B,CAAC;AACzC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,yBAAyB,CAAC;AACxC,cAAc,sBAAsB,CAAC;AACrC,+EAA+E;AAC/E,gFAAgF;AAChF,gFAAgF;AAChF,iFAAiF;AACjF,OAAO,EACL,aAAa,EACb,gBAAgB,GACjB,MAAM,oCAAoC,CAAC;AAC5C,cAAc,kBAAkB,CAAC;AACjC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC;AAC5B,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAE/B,cAAc,qBAAqB,CAAC;AACpC,cAAc,2BAA2B,CAAC;AAC1C,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,sBAAsB,CAAC;AACrC,cAAc,uBAAuB,CAAC;AACtC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iCAAiC,CAAC;AAChD,cAAc,qCAAqC,CAAC;AACpD,cAAc,sCAAsC,CAAC;AACrD,cAAc,uCAAuC,CAAC;AACtD,cAAc,gDAAgD,CAAC;AAC/D,cAAc,yCAAyC,CAAC;AACxD,cAAc,6BAA6B,CAAC;AAC5C,cAAc,qBAAqB,CAAC;AACpC,cAAc,wBAAwB,CAAC;AACvC,cAAc,+BAA+B,CAAC;AAC9C,cAAc,4BAA4B,CAAC"}

package/dist/jwks.d.ts

@@ -0,0 +1,3 @@
+import { createRemoteJWKSet } from "jose";
+export declare function getAuthServerJwks(authServerUrl: string): ReturnType<typeof createRemoteJWKSet>;
+//# sourceMappingURL=jwks.d.ts.map

package/dist/jwks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.d.ts","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAO1C,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,MAAM,GACpB,UAAU,CAAC,OAAO,kBAAkB,CAAC,CASvC"}

package/dist/jwks.js

@@ -0,0 +1,15 @@
+import { createRemoteJWKSet } from "jose";
+// jose caches keys and applies a refetch cooldown per JWKS instance, so the instance
+// must outlive a single call. Memoize per JWKS URL (one per auth server, so the map
+// stays tiny) instead of building a fresh, empty-cache instance on every verification.
+const jwksByUrl = new Map();
+export function getAuthServerJwks(authServerUrl) {
+    const jwksUrl = new URL("/.well-known/jwks.json", authServerUrl).toString();
+    let jwks = jwksByUrl.get(jwksUrl);
+    if (!jwks) {
+        jwks = createRemoteJWKSet(new URL(jwksUrl));
+        jwksByUrl.set(jwksUrl, jwks);
+    }
+    return jwks;
+}
+//# sourceMappingURL=jwks.js.map

package/dist/jwks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwks.js","sourceRoot":"","sources":["../src/jwks.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,MAAM,CAAC;AAE1C,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,MAAM,UAAU,iBAAiB,CAC/B,aAAqB;IAErB,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IAE5E,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/proxyRequest.d.ts

@@ -1,5 +1,6 @@
 import type { AppliableResult } from "./applyResult.js";
 import { type AuthFetchOptions } from "./authFetch.js";
+import type { AuthTransport } from "./transport.js";
 /**
  * Query parameters to forward upstream.
  *
@@ -27,6 +28,9 @@ export interface ProxyIdentityInput {
     accessCookieName: string;
     preAuthCookieName: string;
     registrationCookieName: string;
+    transport?: AuthTransport;
+    /** The raw `Authorization` header, read in bearer transport. */
+    authorization?: string;
 }
 export interface ProxyIdentityRejection {
     status: number;
@@ -38,8 +42,11 @@ export interface ProxyIdentityRejection {
  * Checks that a request carries the session a proxied route requires.
  *
  * Returns the rejection to send, or `undefined` when the request may proceed.
- * The cookie payload alone is not enough: it survives a refresh, so the route
- * also has to see the specific cookie for the identity it needs.
+ * In cookie transport the cookie payload alone is not enough: it survives a
+ * refresh, so the route also has to see the specific cookie for the identity it
+ * needs. In bearer transport the client presents the token for the identity
+ * itself, and the auth API is the one that checks which kind it is, so the
+ * adapter only insists that one was sent.
  */
 export declare function checkProxyIdentity(input: ProxyIdentityInput): ProxyIdentityRejection | undefined;
 export interface ProxyRequestOptions {

package/dist/proxyRequest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"proxyRequest.d.ts","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElE;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAiB3D;AAED,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAKR;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,kBAAkB,GACxB,sBAAsB,GAAG,SAAS,CAwBpC;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgB1B"}
+{"version":3,"file":"proxyRequest.d.ts","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD;;;;;;;GAOG;AACH,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAUjD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,CAAC,EAAE,UAAU,GAAG,MAAM,CAiB3D;AAED,wBAAgB,gBAAgB,CAC9B,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,UAAU,GACjB,MAAM,CAKR;AAED,MAAM,MAAM,aAAa,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;AAE9D,MAAM,WAAW,kBAAkB;IACjC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,aAAa,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,sBAAsB,EAAE,MAAM,CAAC;IAC/B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,+EAA+E;IAC/E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAQD;;;;;;;;;GASG;AACH,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,kBAAkB,GACxB,sBAAsB,GAAG,SAAS,CA0BpC;AAED,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,KAAK,CAAC,EAAE,UAAU,CAAC;IACnB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,IAAI,EAAE,mBAAmB,GACxB,OAAO,CAAC,eAAe,CAAC,CAgB1B"}

package/dist/proxyRequest.js

@@ -1,4 +1,5 @@
 import { authFetch } from "./authFetch.js";
+import { extractBearerToken } from "./verifyAccessToken.js";
 function isScalar(value) {
     return (typeof value === "string" ||
         typeof value === "number" ||
@@ -33,14 +34,28 @@ export function buildUpstreamUrl(authServerUrl, path, query) {
     const qs = buildQueryString(query);
     return qs ? `${base}?${qs}` : base;
 }
+const IDENTITY_REQUIRED = {
+    access: "access session required",
+    preAuth: "pre-auth session required",
+    register: "registration session required",
+};
 /**
  * Checks that a request carries the session a proxied route requires.
  *
  * Returns the rejection to send, or `undefined` when the request may proceed.
- * The cookie payload alone is not enough: it survives a refresh, so the route
- * also has to see the specific cookie for the identity it needs.
+ * In cookie transport the cookie payload alone is not enough: it survives a
+ * refresh, so the route also has to see the specific cookie for the identity it
+ * needs. In bearer transport the client presents the token for the identity
+ * itself, and the auth API is the one that checks which kind it is, so the
+ * adapter only insists that one was sent.
  */
 export function checkProxyIdentity(input) {
+    const error = IDENTITY_REQUIRED[input.identity];
+    if (input.transport === "bearer") {
+        return extractBearerToken(input.authorization)
+            ? undefined
+            : { status: 401, errorCode: error };
+    }
     if (!input.subject) {
         return {
             status: 401,
@@ -48,19 +63,14 @@ export function checkProxyIdentity(input) {
             warn: "Missing expected cookie payload/sub.",
         };
     }
-    const required = {
-        access: { name: input.accessCookieName, error: "access session required" },
-        preAuth: {
-            name: input.preAuthCookieName,
-            error: "pre-auth session required",
-        },
-        register: {
-            name: input.registrationCookieName,
-            error: "registration session required",
-        },
+    const cookieName = {
+        access: input.accessCookieName,
+        preAuth: input.preAuthCookieName,
+        register: input.registrationCookieName,
     };
-    const { name, error } = required[input.identity];
-    return input.cookies[name] ? undefined : { status: 401, errorCode: error };
+    return input.cookies[cookieName[input.identity]]
+        ? undefined
+        : { status: 401, errorCode: error };
 }
 /**
  * Forwards a request to the auth API and returns its status and body unchanged.

package/dist/proxyRequest.js.map

@@ -1 +1 @@
-{"version":3,"file":"proxyRequest.js","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAYlE,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,IAAY,EACZ,KAAkB;IAElB,MAAM,IAAI,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,yBAAyB;YACpC,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAA2D;QACvE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,EAAE,yBAAyB,EAAE;QAC1E,OAAO,EAAE;YACP,IAAI,EAAE,KAAK,CAAC,iBAAiB;YAC7B,KAAK,EAAE,2BAA2B;SACnC;QACD,QAAQ,EAAE;YACR,IAAI,EAAE,KAAK,CAAC,sBAAsB;YAClC,KAAK,EAAE,+BAA+B;SACvC;KACF,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC7E,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAC3D;QACE,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACjD,CACF,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"proxyRequest.js","sourceRoot":"","sources":["../src/proxyRequest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,SAAS,EAAyB,MAAM,gBAAgB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAY5D,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,QAAQ;QACzB,OAAO,KAAK,KAAK,SAAS,CAC3B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAkB;IACjD,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IAEtB,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IAErC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,QAAQ,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC;YACvD,CAAC;YACD,SAAS;QACX,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACzD,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,aAAqB,EACrB,IAAY,EACZ,KAAkB;IAElB,MAAM,IAAI,GAAG,GAAG,aAAa,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,EAAE,CAAC;IACzE,MAAM,EAAE,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAEnC,OAAO,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;AACrC,CAAC;AAwBD,MAAM,iBAAiB,GAAkC;IACvD,MAAM,EAAE,yBAAyB;IACjC,OAAO,EAAE,2BAA2B;IACpC,QAAQ,EAAE,+BAA+B;CAC1C,CAAC;AAEF;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAChC,KAAyB;IAEzB,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAEhD,IAAI,KAAK,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QACjC,OAAO,kBAAkB,CAAC,KAAK,CAAC,aAAa,CAAC;YAC5C,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,GAAG;YACX,SAAS,EAAE,yBAAyB;YACpC,IAAI,EAAE,sCAAsC;SAC7C,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAkC;QAChD,MAAM,EAAE,KAAK,CAAC,gBAAgB;QAC9B,OAAO,EAAE,KAAK,CAAC,iBAAiB;QAChC,QAAQ,EAAE,KAAK,CAAC,sBAAsB;KACvC,CAAC;IAEF,OAAO,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC9C,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AACxC,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,IAAyB;IAEzB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC;IAErC,MAAM,QAAQ,GAAG,MAAM,SAAS,CAC9B,gBAAgB,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,EAC3D;QACE,MAAM;QACN,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;QAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;QACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;QAC3C,GAAG,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;KACjD,CACF,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;AAClE,CAAC"}

package/dist/refreshAccessToken.d.ts

@@ -21,5 +21,24 @@ type RefreshAccessTokenResult = {
     refreshTtl: number;
 };
 export declare function refreshAccessToken(refreshCookie: string, opts: RefreshAccessTokenOptions): Promise<RefreshAccessTokenResult | null>;
+export interface RefreshBearerSessionOptions {
+    authServerUrl: string;
+    serviceAuthorization?: string;
+    forwardedClientIp?: string;
+    forwardedUserAgent?: string;
+}
+export interface RefreshBearerSessionResult {
+    status: number;
+    /** The auth API's body: the rotated session on success, its error otherwise. */
+    body: unknown;
+}
+/**
+ * Rotates a session for a bearer client, which holds the raw refresh token.
+ *
+ * Unlike the cookie path this returns the auth API's failure as-is, because the
+ * client reads it: `refresh_token_reused` means the chain is gone and the user
+ * must sign in again, which is a different outcome from a transient failure.
+ */
+export declare function refreshBearerSession(refreshToken: string, opts: RefreshBearerSessionOptions): Promise<RefreshBearerSessionResult>;
 export {};
 //# sourceMappingURL=refreshAccessToken.d.ts.map

package/dist/refreshAccessToken.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAkCF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CA0D1C"}
+{"version":3,"file":"refreshAccessToken.d.ts","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,yBAAyB;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,KAAK,wBAAwB,GAAG;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AA6EF,wBAAsB,kBAAkB,CACtC,aAAa,EAAE,MAAM,EACrB,IAAI,EAAE,yBAAyB,GAC9B,OAAO,CAAC,wBAAwB,GAAG,IAAI,CAAC,CA2B1C;AAWD,MAAM,WAAW,2BAA2B;IAC1C,aAAa,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,MAAM,EAAE,MAAM,CAAC;IACf,gFAAgF;IAChF,IAAI,EAAE,OAAO,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAsB,oBAAoB,CACxC,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,2BAA2B,GAChC,OAAO,CAAC,0BAA0B,CAAC,CA8BrC"}