@seamless-auth/core 0.15.0 → 0.16.0

package/dist/refreshAccessToken.js

@@ -26,21 +26,46 @@ function pruneRecentRefreshResults(now) {
         recentRefreshResults.delete(oldest);
     }
 }
-export async function refreshAccessToken(refreshCookie, opts) {
-    assertSecrets(opts);
+/**
+ * Runs one refresh per key at a time and replays a recent success to callers
+ * arriving just after it. The auth API rotates refresh tokens and treats a
+ * replay as theft, revoking the whole chain, so two requests that race the same
+ * token must be collapsed here rather than both reach it.
+ */
+async function dedupeRefresh(key, run) {
     const now = Date.now();
-    const recentRefresh = recentRefreshResults.get(refreshCookie);
+    const recentRefresh = recentRefreshResults.get(key);
     if (recentRefresh && recentRefresh.expiresAt > now) {
         return recentRefresh.result;
     }
     if (recentRefresh) {
-        recentRefreshResults.delete(refreshCookie);
+        recentRefreshResults.delete(key);
     }
-    const existingRefresh = inFlightRefreshes.get(refreshCookie);
+    const existingRefresh = inFlightRefreshes.get(key);
     if (existingRefresh) {
         return existingRefresh;
     }
-    const refreshPromise = (async () => {
+    const refreshPromise = run();
+    inFlightRefreshes.set(key, refreshPromise);
+    try {
+        const result = await refreshPromise;
+        if (result) {
+            const insertedAt = Date.now();
+            pruneRecentRefreshResults(insertedAt);
+            recentRefreshResults.set(key, {
+                result,
+                expiresAt: insertedAt + RECENT_REFRESH_RESULT_TTL_MS,
+            });
+        }
+        return result;
+    }
+    finally {
+        inFlightRefreshes.delete(key);
+    }
+}
+export async function refreshAccessToken(refreshCookie, opts) {
+    assertSecrets(opts);
+    return dedupeRefresh(`cookie:${refreshCookie}`, async () => {
         const payload = verifyRefreshCookie(refreshCookie, opts.cookieSecret);
         if (!payload)
             return null;
@@ -62,22 +87,47 @@ export async function refreshAccessToken(refreshCookie, opts) {
         if (!response.ok)
             return null;
         return response.json();
-    })();
-    inFlightRefreshes.set(refreshCookie, refreshPromise);
-    try {
-        const result = await refreshPromise;
-        if (result) {
-            const insertedAt = Date.now();
-            pruneRecentRefreshResults(insertedAt);
-            recentRefreshResults.set(refreshCookie, {
-                result,
-                expiresAt: insertedAt + RECENT_REFRESH_RESULT_TTL_MS,
-            });
-        }
-        return result;
+    });
+}
+class UpstreamRefreshFailure extends Error {
+    status;
+    body;
+    constructor(status, body) {
+        super(`Upstream refresh failed with ${status}`);
+        this.status = status;
+        this.body = body;
     }
-    finally {
-        inFlightRefreshes.delete(refreshCookie);
+}
+/**
+ * Rotates a session for a bearer client, which holds the raw refresh token.
+ *
+ * Unlike the cookie path this returns the auth API's failure as-is, because the
+ * client reads it: `refresh_token_reused` means the chain is gone and the user
+ * must sign in again, which is a different outcome from a transient failure.
+ */
+export async function refreshBearerSession(refreshToken, opts) {
+    const rotated = await dedupeRefresh(`bearer:${refreshToken}`, async () => {
+        const response = await authFetch(`${opts.authServerUrl}/refresh`, {
+            method: "POST",
+            authorization: `Bearer ${refreshToken}`,
+            serviceAuthorization: opts.serviceAuthorization,
+            forwardedClientIp: opts.forwardedClientIp,
+            forwardedUserAgent: opts.forwardedUserAgent,
+        });
+        if (!response.ok) {
+            // Not cached, so a failed rotation is reported to every caller that
+            // asked for it rather than replayed as a success.
+            throw new UpstreamRefreshFailure(response.status, await response.json());
+        }
+        return response.json();
+    }).catch((error) => {
+        if (error instanceof UpstreamRefreshFailure)
+            return error;
+        throw error;
+    });
+    if (rotated instanceof UpstreamRefreshFailure) {
+        return { status: rotated.status, body: rotated.body };
     }
+    return { status: 200, body: rotated };
 }
 //# sourceMappingURL=refreshAccessToken.js.map

package/dist/refreshAccessToken.js.map

@@ -1 +1 @@
-{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA0BrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;AACJ,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,GAAG,GAAG,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,IAA+B;IAE/B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC9D,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAM,CAAC;IAC9B,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC7C,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC7D,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAe,CAAC;IACzB,CAAC;IAED,MAAM,cAAc,GAAG,CAAC,KAAK,IAAI,EAAE;QACjC,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;YAC/C,oBAAoB,EAAE,UAAU,YAAY,EAAE;YAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,EAAE,CAAC;IAEL,iBAAiB,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC;IAErD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACtC,oBAAoB,CAAC,GAAG,CAAC,aAAa,EAAE;gBACtC,MAAM;gBACN,SAAS,EAAE,UAAU,GAAG,4BAA4B;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC"}
+{"version":3,"file":"refreshAccessToken.js","sourceRoot":"","sources":["../src/refreshAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAC7D,OAAO,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AA0BrD,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAG9B,CAAC;AACJ,MAAM,oBAAoB,GAAG,IAAI,GAAG,EAGjC,CAAC;AACJ,MAAM,4BAA4B,GAAG,IAAI,CAAC;AAC1C,kFAAkF;AAClF,oFAAoF;AACpF,sFAAsF;AACtF,MAAM,0BAA0B,GAAG,MAAM,CAAC;AAC1C,IAAI,WAAW,GAAG,CAAC,CAAC;AAEpB,SAAS,yBAAyB,CAAC,GAAW;IAC5C,IAAI,GAAG,GAAG,WAAW,IAAI,4BAA4B,EAAE,CAAC;QACtD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,oBAAoB,EAAE,CAAC;YAChD,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBAC3B,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACnC,CAAC;QACH,CAAC;QACD,WAAW,GAAG,GAAG,CAAC;IACpB,CAAC;IAED,OAAO,oBAAoB,CAAC,IAAI,GAAG,0BAA0B,EAAE,CAAC;QAC9D,MAAM,MAAM,GAAG,oBAAoB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;QACxD,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM;QAChC,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,GAAW,EACX,GAA4B;IAE5B,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACvB,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpD,IAAI,aAAa,IAAI,aAAa,CAAC,SAAS,GAAG,GAAG,EAAE,CAAC;QACnD,OAAO,aAAa,CAAC,MAAW,CAAC;IACnC,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,eAAe,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACnD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO,eAAoC,CAAC;IAC9C,CAAC;IAED,MAAM,cAAc,GAAG,GAAG,EAAE,CAAC;IAC7B,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAE3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC;QACpC,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YAC9B,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACtC,oBAAoB,CAAC,GAAG,CAAC,GAAG,EAAE;gBAC5B,MAAM;gBACN,SAAS,EAAE,UAAU,GAAG,4BAA4B;aACrD,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,iBAAiB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,aAAqB,EACrB,IAA+B;IAE/B,aAAa,CAAC,IAAI,CAAC,CAAC;IAEpB,OAAO,aAAa,CAAC,UAAU,aAAa,EAAE,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,OAAO,GAAG,mBAAmB,CAAC,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;QACtE,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,YAAY,GAAG,kBAAkB,CAAC;YACtC,OAAO,EAAE,OAAO,CAAC,GAAG;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,OAAO,CAAC,YAAY;SACnC,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,OAAO,CAAC,YAAY,EAAE;YAC/C,oBAAoB,EAAE,UAAU,YAAY,EAAE;YAC9C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAE9B,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,sBAAuB,SAAQ,KAAK;IAE7B;IACA;IAFX,YACW,MAAc,EACd,IAAa;QAEtB,KAAK,CAAC,gCAAgC,MAAM,EAAE,CAAC,CAAC;QAHvC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAS;IAGxB,CAAC;CACF;AAeD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,YAAoB,EACpB,IAAiC;IAEjC,MAAM,OAAO,GAAG,MAAM,aAAa,CACjC,UAAU,YAAY,EAAE,EACxB,KAAK,IAAI,EAAE;QACT,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,UAAU,EAAE;YAChE,MAAM,EAAE,MAAM;YACd,aAAa,EAAE,UAAU,YAAY,EAAE;YACvC,oBAAoB,EAAE,IAAI,CAAC,oBAAoB;YAC/C,iBAAiB,EAAE,IAAI,CAAC,iBAAiB;YACzC,kBAAkB,EAAE,IAAI,CAAC,kBAAkB;SAC5C,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,oEAAoE;YACpE,kDAAkD;YAClD,MAAM,IAAI,sBAAsB,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC;QAED,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC,CACF,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;QACzB,IAAI,KAAK,YAAY,sBAAsB;YAAE,OAAO,KAAK,CAAC;QAC1D,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,IAAI,OAAO,YAAY,sBAAsB,EAAE,CAAC;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AACxC,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,20 @@
+/**
+ * How a client carries its session through the adapter.
+ *
+ * `cookie` is the browser contract: the adapter holds the auth API's tokens in
+ * signed `httpOnly` cookies and the client never sees them. `bearer` is the
+ * native-client contract: the client holds the auth API's own tokens, presents
+ * the one a route needs in `Authorization`, and receives new ones in the
+ * response body. The adapter still sits in front of the auth API for both, so
+ * message delivery, client IP forwarding and the service token work the same.
+ */
+export type AuthTransport = "cookie" | "bearer";
+/**
+ * Selects bearer transport for a request. The header rather than the presence
+ * of `Authorization` decides, because the first request of a flow (`/login`,
+ * `/registration/register`) carries no token in either transport.
+ */
+export declare const AUTH_TRANSPORT_HEADER = "x-seamless-auth-transport";
+export declare const BEARER_TRANSPORT = "bearer";
+export declare function resolveAuthTransport(headerValue: string | string[] | undefined): AuthTransport;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,MAAM,MAAM,aAAa,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,8BAA8B,CAAC;AACjE,eAAO,MAAM,gBAAgB,WAAW,CAAC;AAEzC,wBAAgB,oBAAoB,CAClC,WAAW,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,GACzC,aAAa,CAIf"}

package/dist/transport.js

@@ -0,0 +1,12 @@
+/**
+ * Selects bearer transport for a request. The header rather than the presence
+ * of `Authorization` decides, because the first request of a flow (`/login`,
+ * `/registration/register`) carries no token in either transport.
+ */
+export const AUTH_TRANSPORT_HEADER = "x-seamless-auth-transport";
+export const BEARER_TRANSPORT = "bearer";
+export function resolveAuthTransport(headerValue) {
+    const value = Array.isArray(headerValue) ? headerValue[0] : headerValue;
+    return value?.trim().toLowerCase() === BEARER_TRANSPORT ? "bearer" : "cookie";
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAYA;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,2BAA2B,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAEzC,MAAM,UAAU,oBAAoB,CAClC,WAA0C;IAE1C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAExE,OAAO,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AAChF,CAAC"}

package/dist/upstreamSession.d.ts

@@ -1,4 +1,5 @@
 import type { SessionCookie } from "./applyResult.js";
+import type { AuthTransport } from "./transport.js";
 /**
  * What the auth API returns when it issues a session.
  *
@@ -65,4 +66,22 @@ export interface IssueSessionCookiesOptions {
  * cannot disagree about it.
  */
 export declare function issueSessionCookies(data: UpstreamSessionResponse, opts: IssueSessionCookiesOptions): Promise<SessionCookie[]>;
+export interface SessionResultOptions extends IssueSessionCookiesOptions {
+    transport?: AuthTransport;
+}
+export interface SessionResult {
+    body: unknown;
+    setCookies?: SessionCookie[];
+}
+/**
+ * Turns an upstream session response into what a handler returns for it, in
+ * whichever transport the request arrived on.
+ *
+ * Cookie transport strips the tokens out of the body and carries them in
+ * cookies. Bearer transport hands the body back whole, tokens included, because
+ * the client is the one holding them. The upstream token is verified either
+ * way: a body this package is about to vouch for is checked before it goes out,
+ * whether or not a cookie is minted from it.
+ */
+export declare function sessionResult(data: UpstreamSessionResponse, opts: SessionResultOptions): Promise<SessionResult>;
 //# sourceMappingURL=upstreamSession.d.ts.map

package/dist/upstreamSession.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"upstreamSession.d.ts","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,EAAE,IAAI,EAAE,CAAC,qCAIhF;AAED,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,uBAAuB,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,CAAC,CAkBlC;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,aAAa,EAAE,CAAC,CAkC1B"}
+{"version":3,"file":"upstreamSession.d.ts","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGpD;;;;;;;;;;GAUG;AACH,MAAM,WAAW,uBAAuB;IACtC,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,GAAG,EAAE,MAAM,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,SAAS,uBAAuB,EAAE,IAAI,EAAE,CAAC,qCAIhF;AAED,MAAM,WAAW,uBAAuB;IACtC,0DAA0D;IAC1D,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;;GAOG;AACH,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,uBAAuB,EAC7B,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,uBAAuB,CAAC,CAkBlC;AAED,MAAM,WAAW,0BAA0B;IACzC,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,uBAAuB,EAC7B,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,aAAa,EAAE,CAAC,CAkC1B;AAED,MAAM,WAAW,oBAAqB,SAAQ,0BAA0B;IACtE,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,OAAO,CAAC;IACd,UAAU,CAAC,EAAE,aAAa,EAAE,CAAC;CAC9B;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,IAAI,EAAE,uBAAuB,EAC7B,IAAI,EAAE,oBAAoB,GACzB,OAAO,CAAC,aAAa,CAAC,CAUxB"}

package/dist/upstreamSession.js

@@ -71,4 +71,24 @@ export async function issueSessionCookies(data, opts) {
     }
     return cookies;
 }
+/**
+ * Turns an upstream session response into what a handler returns for it, in
+ * whichever transport the request arrived on.
+ *
+ * Cookie transport strips the tokens out of the body and carries them in
+ * cookies. Bearer transport hands the body back whole, tokens included, because
+ * the client is the one holding them. The upstream token is verified either
+ * way: a body this package is about to vouch for is checked before it goes out,
+ * whether or not a cookie is minted from it.
+ */
+export async function sessionResult(data, opts) {
+    if (opts.transport === "bearer") {
+        await verifyUpstreamSession(data, opts.authServerUrl, opts.audience);
+        return { body: data };
+    }
+    return {
+        body: withoutSessionMaterial(data),
+        setCookies: await issueSessionCookies(data, opts),
+    };
+}
 //# sourceMappingURL=upstreamSession.js.map

package/dist/upstreamSession.js.map

@@ -1 +1 @@
-{"version":3,"file":"upstreamSession.js","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AA0BzE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAoC,IAAO;IAC/E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAErE,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA6B,EAC7B,aAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,aAAa,EACb,QAAQ,CACT,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA6B,EAC7B,IAAgC;IAEhC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAC/C,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,MAAM,OAAO,GAAoB;QAC/B;YACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;YAC3B,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;aAC5C;YACD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,iBAAiB;YAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACzD,GAAG,EAAE,IAAI,CAAC,UAAoB;YAC9B,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"upstreamSession.js","sourceRoot":"","sources":["../src/upstreamSession.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AA0BzE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,sBAAsB,CAAoC,IAAO;IAC/E,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC;IAErE,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAA6B,EAC7B,aAAqB,EACrB,QAAgB;IAEhB,MAAM,QAAQ,GAAG,MAAM,wBAAwB,CAC7C,IAAI,CAAC,KAAK,EACV,aAAa,EACb,QAAQ,CACT,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAC9D,CAAC;IAED,IAAI,QAAQ,CAAC,GAAG,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC;QAC9B,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC1D,CAAC;IAED,OAAO;QACL,SAAS,EAAE,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;KACvE,CAAC;AACJ,CAAC;AAWD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA6B,EAC7B,IAAgC;IAEhC,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,qBAAqB,CAC/C,IAAI,EACJ,IAAI,CAAC,aAAa,EAClB,IAAI,CAAC,QAAQ,CACd,CAAC;IAEF,MAAM,OAAO,GAAoB;QAC/B;YACE,IAAI,EAAE,IAAI,CAAC,gBAAgB;YAC3B,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;gBACjD,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,IAAI;aAC5C;YACD,GAAG,EAAE,IAAI,CAAC,GAAG;YACb,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B;KACF,CAAC;IAEF,IAAI,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,IAAI,CAAC,iBAAiB;YAC5B,KAAK,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE;YACzD,GAAG,EAAE,IAAI,CAAC,UAAoB;YAC9B,MAAM,EAAE,IAAI,CAAC,YAAY;SAC1B,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAWD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAA6B,EAC7B,IAA0B;IAE1B,IAAI,IAAI,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAChC,MAAM,qBAAqB,CAAC,IAAI,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACxB,CAAC;IAED,OAAO;QACL,IAAI,EAAE,sBAAsB,CAAC,IAAI,CAAC;QAClC,UAAU,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC;KAClD,CAAC;AACJ,CAAC"}

package/dist/verifyAccessToken.d.ts

@@ -0,0 +1,30 @@
+import { type JWTPayload } from "jose";
+/**
+ * The claims the auth API signs into an access token.
+ *
+ * `typ` is what separates a session from the ephemeral token a sign-in flow
+ * carries between steps. Both are RS256, both have the same issuer and
+ * audience, so a verifier that only checks the signature would accept a
+ * registration-in-progress as a signed-in user.
+ */
+export interface AccessTokenClaims extends JWTPayload {
+    sub: string;
+    typ: "access";
+    sid?: string;
+    roles?: string[];
+    org_id?: string;
+}
+/**
+ * Returns a bearer token's value, or `undefined` when the header is absent or
+ * uses another scheme.
+ */
+export declare function extractBearerToken(authorization: string | undefined): string | undefined;
+/**
+ * Verifies an access token the auth API issued, against its JWKS.
+ *
+ * Silent on failure: a guard turns `null` into a 401 and has nothing useful to
+ * add from the reason, while logging the reason for every bad token a client
+ * sends is a log-flooding vector.
+ */
+export declare function verifyAccessToken(token: string, authServerUrl: string, audience: string): Promise<AccessTokenClaims | null>;
+//# sourceMappingURL=verifyAccessToken.d.ts.map

package/dist/verifyAccessToken.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAccessToken.d.ts","sourceRoot":"","sources":["../src/verifyAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AAGlD;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAkB,SAAQ,UAAU;IACnD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC;IACd,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,aAAa,EAAE,MAAM,GAAG,SAAS,GAChC,MAAM,GAAG,SAAS,CASpB;AAED;;;;;;GAMG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CA0BnC"}

package/dist/verifyAccessToken.js

@@ -0,0 +1,44 @@
+import { jwtVerify } from "jose";
+import { getAuthServerJwks } from "./jwks.js";
+/**
+ * Returns a bearer token's value, or `undefined` when the header is absent or
+ * uses another scheme.
+ */
+export function extractBearerToken(authorization) {
+    if (!authorization)
+        return undefined;
+    const [scheme, ...rest] = authorization.trim().split(/\s+/);
+    if (scheme?.toLowerCase() !== "bearer" || rest.length !== 1) {
+        return undefined;
+    }
+    return rest[0] || undefined;
+}
+/**
+ * Verifies an access token the auth API issued, against its JWKS.
+ *
+ * Silent on failure: a guard turns `null` into a 401 and has nothing useful to
+ * add from the reason, while logging the reason for every bad token a client
+ * sends is a log-flooding vector.
+ */
+export async function verifyAccessToken(token, authServerUrl, audience) {
+    // jose skips the claim check for an empty expected value, which would turn a
+    // blank audience into "any audience". Refuse rather than verify loosely.
+    if (!authServerUrl || !audience) {
+        return null;
+    }
+    try {
+        const { payload } = await jwtVerify(token, getAuthServerJwks(authServerUrl), {
+            algorithms: ["RS256"],
+            issuer: authServerUrl,
+            audience,
+        });
+        if (payload.typ !== "access" || typeof payload.sub !== "string") {
+            return null;
+        }
+        return payload;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=verifyAccessToken.js.map

package/dist/verifyAccessToken.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifyAccessToken.js","sourceRoot":"","sources":["../src/verifyAccessToken.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAmB,MAAM,MAAM,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAkB9C;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,aAAiC;IAEjC,IAAI,CAAC,aAAa;QAAE,OAAO,SAAS,CAAC;IAErC,MAAM,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,aAAa,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5D,IAAI,MAAM,EAAE,WAAW,EAAE,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,IAAI,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;AAC9B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAAa,EACb,aAAqB,EACrB,QAAgB;IAEhB,6EAA6E;IAC7E,yEAAyE;IACzE,IAAI,CAAC,aAAa,IAAI,CAAC,QAAQ,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CACjC,KAAK,EACL,iBAAiB,CAAC,aAAa,CAAC,EAChC;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,aAAa;YACrB,QAAQ;SACT,CACF,CAAC;QAEF,IAAI,OAAO,CAAC,GAAG,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;QAED,OAAO,OAA4B,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/verifySignedAuthResponse.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAiBA,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,GAAG,EACpD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAkBnB"}
+{"version":3,"file":"verifySignedAuthResponse.d.ts","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAIA,wBAAsB,wBAAwB,CAAC,CAAC,GAAG,GAAG,EACpD,KAAK,EAAE,MAAM,EACb,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,CAAC,GAAG,IAAI,CAAC,CAmBnB"}

package/dist/verifySignedAuthResponse.js

@@ -1,22 +1,9 @@
-import { createRemoteJWKSet, jwtVerify } from "jose";
+import { jwtVerify } from "jose";
+import { getAuthServerJwks } from "./jwks.js";
 import { getSeamlessLogger } from "./logger.js";
-// jose caches keys and applies a refetch cooldown per JWKS instance, so the instance
-// must outlive a single call. Memoize per JWKS URL (one per auth server, so the map
-// stays tiny) instead of building a fresh, empty-cache instance on every verification.
-const jwksByUrl = new Map();
-function getJwks(jwksUrl) {
-    let jwks = jwksByUrl.get(jwksUrl);
-    if (!jwks) {
-        jwks = createRemoteJWKSet(new URL(jwksUrl));
-        jwksByUrl.set(jwksUrl, jwks);
-    }
-    return jwks;
-}
 export async function verifySignedAuthResponse(token, authServerUrl, audience) {
     try {
-        const jwksUrl = new URL("/.well-known/jwks.json", authServerUrl).toString();
-        const JWKS = getJwks(jwksUrl);
-        const { payload } = await jwtVerify(token, JWKS, {
+        const { payload } = await jwtVerify(token, getAuthServerJwks(authServerUrl), {
             algorithms: ["RS256"],
             issuer: authServerUrl,
             audience,

package/dist/verifySignedAuthResponse.js.map

@@ -1 +1 @@
-{"version":3,"file":"verifySignedAuthResponse.js","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACrD,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,qFAAqF;AACrF,oFAAoF;AACpF,uFAAuF;AACvF,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,OAAO,CAAC,OAAe;IAC9B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC/B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,aAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,wBAAwB,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC5E,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9B,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE;YAC/C,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,aAAa;YACrB,QAAQ;SACT,CAAC,CAAC;QAEH,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,EAAE,CAAC,KAAK,CACvB,uDAAuD,CACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"verifySignedAuthResponse.js","sourceRoot":"","sources":["../src/verifySignedAuthResponse.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,KAAa,EACb,aAAqB,EACrB,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CACjC,KAAK,EACL,iBAAiB,CAAC,aAAa,CAAC,EAChC;YACE,UAAU,EAAE,CAAC,OAAO,CAAC;YACrB,MAAM,EAAE,aAAa;YACrB,QAAQ;SACT,CACF,CAAC;QAEF,OAAO,OAAY,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,iBAAiB,EAAE,CAAC,KAAK,CACvB,uDAAuD,CACxD,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seamless-auth/core",
-  "version": "0.15.0",
+  "version": "0.16.0",
   "description": "Framework-agnostic core authentication logic for SeamlessAuth",
   "keywords": [
     "authentication",