@shware/security 2.5.3 → 3.0.0

package/dist/utils/valid.mjs

@@ -1,51 +1,54 @@
-// src/utils/valid.ts
+//#region src/utils/valid.ts
 function invalidArgument(reason) {
-  return {
-    error: {
-      code: 400,
-      status: "INVALID_ARGUMENT",
-      message: "Invalid verification code",
-      details: [{ "@type": "type.googleapis.com/google.rpc.ErrorInfo", reason }]
-    }
-  };
+	return { error: {
+		code: 400,
+		status: "INVALID_ARGUMENT",
+		message: "Invalid verification code",
+		details: [{
+			"@type": "type.googleapis.com/google.rpc.ErrorInfo",
+			reason
+		}]
+	} };
 }
 function valid(schema, json) {
-  const result = schema.safeParse(json);
-  if (result.success) {
-    return {
-      error: null,
-      data: result.data
-    };
-  }
-  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({
-    field: path.join("."),
-    description: message,
-    reason: code?.toUpperCase() ?? "INVALID_ARGUMENT",
-    localizedMessage: { locale: "en-US", message }
-  }));
-  const error = {
-    error: {
-      code: 400,
-      status: "INVALID_ARGUMENT",
-      message: "Invalid request",
-      details: [{ "@type": "type.googleapis.com/google.rpc.BadRequest", fieldViolations }]
-    }
-  };
-  return { error, data: null };
+	const result = schema.safeParse(json);
+	if (result.success) return {
+		error: null,
+		data: result.data
+	};
+	return {
+		error: { error: {
+			code: 400,
+			status: "INVALID_ARGUMENT",
+			message: "Invalid request",
+			details: [{
+				"@type": "type.googleapis.com/google.rpc.BadRequest",
+				fieldViolations: result.error.issues.map(({ code, path, message }) => ({
+					field: path.join("."),
+					description: message,
+					reason: code?.toUpperCase() ?? "INVALID_ARGUMENT",
+					localizedMessage: {
+						locale: "en-US",
+						message
+					}
+				}))
+			}]
+		} },
+		data: null
+	};
 }
 async function verifyTurnstileToken(secret, token) {
-  const response = await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
-    method: "POST",
-    headers: { "Content-Type": "application/x-www-form-urlencoded" },
-    body: new URLSearchParams({ secret, response: token })
-  });
-  const data = await response.json();
-  if (data.success) return { error: null };
-  return { error: invalidArgument("TURNSTILE_VERIFICATION_FAILED") };
+	if ((await (await fetch("https://challenges.cloudflare.com/turnstile/v0/siteverify", {
+		method: "POST",
+		headers: { "Content-Type": "application/x-www-form-urlencoded" },
+		body: new URLSearchParams({
+			secret,
+			response: token
+		})
+	})).json()).success) return { error: null };
+	return { error: invalidArgument("TURNSTILE_VERIFICATION_FAILED") };
 }
-export {
-  invalidArgument,
-  valid,
-  verifyTurnstileToken
-};
+//#endregion
+export { invalidArgument, valid, verifyTurnstileToken };
+
 //# sourceMappingURL=valid.mjs.map

package/dist/utils/valid.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code?.toUpperCase() ?? 'INVALID_ARGUMENT',\n    localizedMessage: { locale: 'en-US', message: message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";AAYO,SAAS,gBAAgB,QAA2B;AACzD,SAAO;AAAA,IACL,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,SAAS,4CAA4C,OAAO,CAAC;AAAA,IAC3E;AAAA,EACF;AACF;AAMO,SAAS,MAAuC,QAAW,MAA0B;AAC1F,QAAM,SAAS,OAAO,UAAU,IAAI;AACpC,MAAI,OAAO,SAAS;AAClB,WAAO;AAAA,MACL,OAAO;AAAA,MACP,MAAM,OAAO;AAAA,IACf;AAAA,EACF;AAEA,QAAM,kBAAkB,OAAO,MAAM,OAAO,IAAI,CAAC,EAAE,MAAM,MAAM,QAAQ,OAAO;AAAA,IAC5E,OAAO,KAAK,KAAK,GAAG;AAAA,IACpB,aAAa;AAAA,IACb,QAAQ,MAAM,YAAY,KAAK;AAAA,IAC/B,kBAAkB,EAAE,QAAQ,SAAS,QAAiB;AAAA,EACxD,EAAE;AAEF,QAAM,QAAQ;AAAA,IACZ,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,SAAS,CAAC,EAAE,SAAS,6CAA6C,gBAAgB,CAAC;AAAA,IACrF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,MAAM,KAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;AACxE,QAAM,WAAW,MAAM,MAAM,6DAA6D;AAAA,IACxF,QAAQ;AAAA,IACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,IAC/D,MAAM,IAAI,gBAAgB,EAAE,QAAQ,UAAU,MAAM,CAAC;AAAA,EACvD,CAAC;AAED,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,MAAI,KAAK,QAAS,QAAO,EAAE,OAAO,KAAK;AACvC,SAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE;","names":[]}
+{"version":3,"file":"valid.mjs","names":[],"sources":["../../src/utils/valid.ts"],"sourcesContent":["import type { ZodType, output } from 'zod';\nimport type { ZodMiniType, output as outputMini } from 'zod/mini';\n\ntype ErrorBody = {\n  error: {\n    code: number;\n    status: string;\n    message: string;\n    details: unknown[];\n  };\n};\n\nexport function invalidArgument(reason: string): ErrorBody {\n  return {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid verification code',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.ErrorInfo', reason }],\n    },\n  };\n}\n\ntype Result<S extends ZodType | ZodMiniType> =\n  | { error: null; data: S extends ZodType ? output<S> : outputMini<S> }\n  | { error: ErrorBody; data: null };\n\nexport function valid<S extends ZodType | ZodMiniType>(schema: S, json: unknown): Result<S> {\n  const result = schema.safeParse(json);\n  if (result.success) {\n    return {\n      error: null,\n      data: result.data as S extends ZodType ? output<S> : outputMini<S>,\n    };\n  }\n\n  const fieldViolations = result.error.issues.map(({ code, path, message }) => ({\n    field: path.join('.'),\n    description: message,\n    reason: code?.toUpperCase() ?? 'INVALID_ARGUMENT',\n    localizedMessage: { locale: 'en-US', message: message },\n  }));\n\n  const error = {\n    error: {\n      code: 400,\n      status: 'INVALID_ARGUMENT',\n      message: 'Invalid request',\n      details: [{ '@type': 'type.googleapis.com/google.rpc.BadRequest', fieldViolations }],\n    },\n  };\n\n  return { error, data: null };\n}\n\nexport async function verifyTurnstileToken(secret: string, token: string) {\n  const response = await fetch('https://challenges.cloudflare.com/turnstile/v0/siteverify', {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({ secret, response: token }),\n  });\n\n  const data = (await response.json()) as { success: boolean };\n  if (data.success) return { error: null };\n  return { error: invalidArgument('TURNSTILE_VERIFICATION_FAILED') };\n}\n"],"mappings":";AAYA,SAAgB,gBAAgB,QAA2B;CACzD,OAAO,EACL,OAAO;EACL,MAAM;EACN,QAAQ;EACR,SAAS;EACT,SAAS,CAAC;GAAE,SAAS;GAA4C;EAAO,CAAC;CAC3E,EACF;AACF;AAMA,SAAgB,MAAuC,QAAW,MAA0B;CAC1F,MAAM,SAAS,OAAO,UAAU,IAAI;CACpC,IAAI,OAAO,SACT,OAAO;EACL,OAAO;EACP,MAAM,OAAO;CACf;CAmBF,OAAO;EAAE,OAAA,EARP,OAAO;GACL,MAAM;GACN,QAAQ;GACR,SAAS;GACT,SAAS,CAAC;IAAE,SAAS;IAA6C,iBAZ9C,OAAO,MAAM,OAAO,KAAK,EAAE,MAAM,MAAM,eAAe;KAC5E,OAAO,KAAK,KAAK,GAAG;KACpB,aAAa;KACb,QAAQ,MAAM,YAAY,KAAK;KAC/B,kBAAkB;MAAE,QAAQ;MAAkB;KAAQ;IACxD,EAOoF;GAAE,CAAC;EACrF,EAGW;EAAG,MAAM;CAAK;AAC7B;AAEA,eAAsB,qBAAqB,QAAgB,OAAe;CAQxE,KAAI,OADgB,MANG,MAAM,6DAA6D;EACxF,QAAQ;EACR,SAAS,EAAE,gBAAgB,oCAAoC;EAC/D,MAAM,IAAI,gBAAgB;GAAE;GAAQ,UAAU;EAAM,CAAC;CACvD,CAAC,EAAA,CAE4B,KAAK,EAAA,CACzB,SAAS,OAAO,EAAE,OAAO,KAAK;CACvC,OAAO,EAAE,OAAO,gBAAgB,+BAA+B,EAAE;AACnE"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shware/security",
-  "version": "2.5.3",
+  "version": "3.0.0",
   "private": false,
   "repository": {
     "type": "git",
@@ -12,14 +12,24 @@
   "type": "module",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.mjs",
-      "require": "./dist/index.cjs"
+      "import": {
+        "types": "./dist/index.d.mts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
     },
     "./oauth2/provider": {
-      "types": "./dist/oauth2/provider/index.d.ts",
-      "import": "./dist/oauth2/provider/index.mjs",
-      "require": "./dist/oauth2/provider/index.cjs"
+      "import": {
+        "types": "./dist/oauth2/provider/index.d.mts",
+        "default": "./dist/oauth2/provider/index.mjs"
+      },
+      "require": {
+        "types": "./dist/oauth2/provider/index.d.cts",
+        "default": "./dist/oauth2/provider/index.cjs"
+      }
     }
   },
   "publishConfig": {
@@ -32,18 +42,18 @@
     "path-to-regexp": "^8.4.2",
     "uuid": "^14.0.1",
     "zod": "^4.4.3",
-    "@shware/utils": "^1.4.5"
+    "@shware/utils": "^1.5.0"
   },
   "devDependencies": {
-    "@types/node": "^26.1.0",
+    "@types/node": "^26.1.1",
     "ts-node": "^10.9.2",
-    "typescript": "6.0.3",
-    "vitest": "^4.1.9",
+    "typescript": "7.0.2",
+    "vitest": "^4.1.10",
     "@repo/typescript-config": "0.0.0"
   },
   "scripts": {
     "dev": "tsc --watch",
-    "build": "tsup",
+    "build": "tsdown",
     "test": "vitest run",
     "check-types": "tsc --noEmit",
     "lint": "oxlint --type-aware src --fix"

package/dist/auth/index.d.ts

@@ -1,111 +0,0 @@
-import { Principal } from '../core/index.js';
-import { Session } from '../session/types.js';
-import { AuthService, AuthConfig, LoggedHandler, AuthorizedHandler } from './types.js';
-import '../oauth2/types.js';
-import '../utils/http.js';
-import 'cookie';
-
-declare const PATH: {
-    readonly CSRF: "/csrf";
-    readonly LOGOUT: "/logout";
-    readonly LOGGED: "/logged";
-    readonly OAUTH2_STATE: "/oauth2/state/:registrationId";
-    readonly OAUTH2_NONCE: "/oauth2/nonce/:registrationId";
-    readonly OAUTH2_AUTHORIZATION: "/oauth2/authorization/:registrationId";
-    readonly LOGIN_OAUTH2_CODE: "/login/oauth2/code/:registrationId";
-    readonly LOGIN_OAUTH2_NATIVE: "/login/oauth2/native/:registrationId";
-    readonly LOGIN_OAUTH2_ONETAP: "/login/oauth2/onetap/google";
-    readonly LOGIN_EMAIL: "/login/email";
-    readonly LOGIN_PHONE: "/login/phone";
-    readonly SEND_EMAIL_VERIFICATION_CODE: "/auth/sendEmailVerificationCode";
-    readonly SEND_PHONE_VERIFICATION_CODE: "/auth/sendPhoneVerificationCode";
-    readonly DESKTOP_AUTHORIZE: "/auth/desktop/authorize";
-    readonly DESKTOP_EXCHANGE: "/auth/desktop/exchange";
-    readonly CLEANUP_EXPIRED_SESSIONS: "/sessions/expired/cleanup";
-};
-declare class Auth implements AuthService {
-    private readonly timing;
-    private readonly cookieName;
-    private readonly cookieOptions;
-    private readonly kv;
-    private readonly repository;
-    private readonly turnstileSecretKey?;
-    private readonly oauth2Client;
-    private readonly ATTR_OAUTH2_AUTHORIZATION_REQUEST;
-    constructor({ sessionRepository, kvRepository, turnstileSecretKey, oauth2, cookie, timing, }: AuthConfig);
-    private getSessionId;
-    csrf: (_request: Request) => Promise<Response>;
-    logout: (request: Request) => Promise<Response>;
-    logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
-    private createPkceParameters;
-    private getOauth2StateKey;
-    private getOauth2NonceKey;
-    private getEmailVerificationCodeKey;
-    private getPhoneVerificationCodeKey;
-    private getDesktopCodeKey;
-    oauth2State: (request: Request) => Promise<Response>;
-    oauth2Nonce: (request: Request) => Promise<Response>;
-    oauth2Authorization: (request: Request) => Promise<Response>;
-    private redirect;
-    loginOAuth2Code: (request: Request, handler: AuthorizedHandler) => Promise<Response>;
-    loginOAuth2Native: (request: Request, handler: AuthorizedHandler) => Promise<Response>;
-    loginOAuth2Onetap: (request: Request, handler: AuthorizedHandler, registrationId?: string) => Promise<Response>;
-    sendEmailVerificationCode: (request: Request, sender: (data: {
-        email: string;
-        verificationCode: string;
-    }) => Promise<void>) => Promise<Response>;
-    loginEmail: (request: Request, handler: AuthorizedHandler) => Promise<Response>;
-    /**
-     * Step 1 of the desktop / native app sign-in handshake. The caller already
-     * completed normal sign-in on the web (so a cookie session exists); this
-     * issues a 5-minute single-use code that the web page hands off to the
-     * desktop client via a loopback redirect.
-     *
-     * PKCE (RFC 7636, S256 only): the desktop generates a random `code_verifier`
-     * before opening the browser, derives `code_challenge = base64url(sha256(verifier))`,
-     * and threads the challenge through the URL → web page → here. We pin
-     * the challenge to the code in KV; `desktopExchange` enforces that the
-     * caller knows the matching verifier. This blocks an attacker who only
-     * intercepts the auth code (browser history, malicious extension, packet
-     * capture on loopback) from exchanging it.
-     *
-     * Requires an authenticated cookie session — anonymous callers get 401.
-     * Throttling / abuse protection on this endpoint is the API layer's job
-     * (rate-limit per principal); the SDK doesn't gate it because the
-     * upstream sign-in flow already passed CAPTCHA / OAuth / verification.
-     */
-    desktopAuthorize: (request: Request) => Promise<Response>;
-    /**
-     * Step 2 of the desktop / native app sign-in handshake. The desktop
-     * client hands back the auth code it received via the loopback callback,
-     * and we mint a fresh session for it — independent of the web cookie
-     * session that originally `authorize`'d the code, so logging out on
-     * either side doesn't cascade to the other.
-     *
-     * Cookie attributes: defaults to `SameSite=None; Secure` so the cookie
-     * survives cross-site fetches from the desktop renderer's `file://` /
-     * `app://` origin. The configured base `cookieOptions` provide
-     * everything else (`domain`, `path`, `httpOnly`, `maxAge`); the override
-     * is targeted at the SameSite/Secure pair only. In a non-HTTPS dev
-     * backend this combination is rejected by Chromium — see the desktop
-     * sign-in PRD for workarounds.
-     *
-     * No CSRF check needed — the request carries no cookie, the auth code
-     * itself is the credential, and KV's single-use removal blocks replay.
-     */
-    desktopExchange: (request: Request) => Promise<Response>;
-    sendPhoneVerificationCode: (_request: Request, _sender: (data: {
-        phone: string;
-        verificationCode: string;
-    }) => Promise<void>) => Promise<Response>;
-    loginPhone: (_request: Request, _handler: AuthorizedHandler) => Promise<Response>;
-    kick: (principal: Principal) => Promise<void>;
-    isAuthenticated: (request: Request) => Promise<boolean>;
-    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
-    deleteSession: (sessionId: string) => Promise<void>;
-    getPrincipal: (request: Request) => Promise<Principal | null>;
-    listSessions: (principal: Principal) => Promise<Session[]>;
-    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
-}
-
-export { Auth, PATH };

package/dist/auth/types.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../src/auth/types.ts"],"sourcesContent":["import type { Principal } from '../core';\nimport type { OAuth2ClientConfig, OAuth2Token, UserInfo } from '../oauth2/types';\nimport type { KVRepository, Session, SessionRepository } from '../session/types';\nimport type { CookieOptions } from '../utils/http';\n\nexport type LoggedHandler = (principal: Principal) => Promise<void>;\nexport type AuthorizedHandler = (\n  request: Request,\n  registrationId: string,\n  userInfo: UserInfo,\n  token?: OAuth2Token\n) => Promise<Principal>;\n\nexport interface AuthConfig {\n  timing?: boolean;\n  kvRepository: KVRepository;\n  sessionRepository: SessionRepository;\n  cookie?: CookieOptions & { name?: string };\n  turnstileSecretKey?: string;\n  oauth2?: {\n    client?: OAuth2ClientConfig;\n  };\n}\n\nexport interface AuthService {\n  // basic\n  csrf: (request: Request) => Promise<Response>;\n  logout: (request: Request) => Promise<Response>;\n  logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;\n\n  // oauth2\n  oauth2State: (request: Request) => Promise<Response>;\n  oauth2Nonce: (request: Request) => Promise<Response>;\n  oauth2Authorization: (request: Request) => Promise<Response>;\n  loginOAuth2Code: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Native: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;\n  loginOAuth2Onetap: (\n    request: Request,\n    onAuthorized: AuthorizedHandler,\n    registrationId?: string\n  ) => Promise<Response>;\n\n  // email & phone\n  sendEmailVerificationCode: (\n    request: Request,\n    sender: (data: { email: string; verificationCode: string }) => Promise<void>\n  ) => Promise<Response>;\n  sendPhoneVerificationCode: (\n    request: Request,\n    sender: (data: { phone: string; verificationCode: string }) => Promise<void>\n  ) => Promise<Response>;\n\n  loginEmail: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;\n  loginPhone: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;\n\n  // session management\n  kick: (principal: Principal) => Promise<void>;\n  isAuthenticated: (request: Request) => Promise<boolean>;\n  getSession: <T extends boolean>(\n    request: Request,\n    create: T\n  ) => Promise<T extends true ? Session : Session | null>;\n  deleteSession: (sessionId: string) => Promise<void>;\n  getPrincipal: (request: Request) => Promise<Principal | null>;\n  listSessions: (principal: Principal) => Promise<Session[]>;\n  cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAAA;AAAA;","names":[]}

package/dist/auth/types.d.ts

@@ -1,50 +0,0 @@
-import { Principal } from '../core/index.js';
-import { UserInfo, OAuth2Token, OAuth2ClientConfig } from '../oauth2/types.js';
-import { Session, KVRepository, SessionRepository } from '../session/types.js';
-import { CookieOptions } from '../utils/http.js';
-import 'cookie';
-
-type LoggedHandler = (principal: Principal) => Promise<void>;
-type AuthorizedHandler = (request: Request, registrationId: string, userInfo: UserInfo, token?: OAuth2Token) => Promise<Principal>;
-interface AuthConfig {
-    timing?: boolean;
-    kvRepository: KVRepository;
-    sessionRepository: SessionRepository;
-    cookie?: CookieOptions & {
-        name?: string;
-    };
-    turnstileSecretKey?: string;
-    oauth2?: {
-        client?: OAuth2ClientConfig;
-    };
-}
-interface AuthService {
-    csrf: (request: Request) => Promise<Response>;
-    logout: (request: Request) => Promise<Response>;
-    logged: (request: Request, onLogged?: LoggedHandler) => Promise<Response>;
-    oauth2State: (request: Request) => Promise<Response>;
-    oauth2Nonce: (request: Request) => Promise<Response>;
-    oauth2Authorization: (request: Request) => Promise<Response>;
-    loginOAuth2Code: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-    loginOAuth2Native: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-    loginOAuth2Onetap: (request: Request, onAuthorized: AuthorizedHandler, registrationId?: string) => Promise<Response>;
-    sendEmailVerificationCode: (request: Request, sender: (data: {
-        email: string;
-        verificationCode: string;
-    }) => Promise<void>) => Promise<Response>;
-    sendPhoneVerificationCode: (request: Request, sender: (data: {
-        phone: string;
-        verificationCode: string;
-    }) => Promise<void>) => Promise<Response>;
-    loginEmail: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-    loginPhone: (request: Request, onAuthorized: AuthorizedHandler) => Promise<Response>;
-    kick: (principal: Principal) => Promise<void>;
-    isAuthenticated: (request: Request) => Promise<boolean>;
-    getSession: <T extends boolean>(request: Request, create: T) => Promise<T extends true ? Session : Session | null>;
-    deleteSession: (sessionId: string) => Promise<void>;
-    getPrincipal: (request: Request) => Promise<Principal | null>;
-    listSessions: (principal: Principal) => Promise<Session[]>;
-    cleanupExpiredSessions: (cleanupCount?: number) => Promise<Response>;
-}
-
-export type { AuthConfig, AuthService, AuthorizedHandler, LoggedHandler };

package/dist/auth/types.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":[],"sourcesContent":[],"mappings":"","names":[]}

package/dist/core/index.d.ts

@@ -1,32 +0,0 @@
-type JSONValue = null | string | number | boolean | {
-    [value: string]: JSONValue;
-} | Array<JSONValue>;
-interface Principal {
-    name: string;
-}
-interface Authentication extends Principal {
-    authorities: string[];
-    authenticated: boolean;
-}
-interface CsrfToken {
-    token: string;
-    headerName: string;
-    parameterName: string;
-}
-declare enum Provider {
-    APPLE = "APPLE",
-    DISCORD = "DISCORD",
-    FACEBOOK = "FACEBOOK",
-    GITHUB = "GITHUB",
-    GOOGLE = "GOOGLE",
-    LINKEDIN = "LINKEDIN",
-    MICROSOFT = "MICROSOFT",
-    SLACK = "SLACK",
-    WECHAT = "WECHAT",
-    X = "X",
-    EMAIL = "EMAIL",
-    PHONE = "PHONE"
-}
-declare const ALL_PROVIDERS: readonly [Provider.APPLE, Provider.DISCORD, Provider.FACEBOOK, Provider.GITHUB, Provider.GOOGLE, Provider.LINKEDIN, Provider.MICROSOFT, Provider.SLACK, Provider.WECHAT, Provider.X, Provider.EMAIL, Provider.PHONE];
-
-export { ALL_PROVIDERS, type Authentication, type CsrfToken, type JSONValue, type Principal, Provider };

package/dist/email/schema.d.ts

@@ -1,13 +0,0 @@
-import * as zod_v4_core from 'zod/v4/core';
-import * as zod_mini from 'zod/mini';
-
-declare const sendEmailVerificationCodeSchema: zod_mini.ZodMiniObject<{
-    email: zod_mini.ZodMiniEmail;
-    turnstileToken: zod_mini.ZodMiniString<string>;
-}, zod_v4_core.$strip>;
-declare const loginEmailSchema: zod_mini.ZodMiniObject<{
-    email: zod_mini.ZodMiniEmail;
-    verificationCode: zod_mini.ZodMiniString<string>;
-}, zod_v4_core.$strip>;
-
-export { loginEmailSchema, sendEmailVerificationCodeSchema };

package/dist/index.cjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth, PATH } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis';\nexport { DBIndexedSessionRepository } from './session/db';\nexport { PRINCIPAL_NAME_INDEX_NAME } from './session/common';\nexport { Provider, ALL_PROVIDERS } from './core/index';\n\nexport type { Principal, CsrfToken } from './core/index';\nexport type { DBAdapter } from './session/db';\nexport type { Namespace, SessionRepository, Session, KVRepository } from './session/types';\nexport type {\n  NativeCredential,\n  OAuth2Token,\n  OidcToken,\n  OidcScopes,\n  StandardClaims,\n  UserInfo,\n} from './oauth2/types';\nexport type { AuthConfig, AuthService } from './auth/types';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,kBAA2B;AAC3B,oBAAwD;AACxD,mBAAiE;AACjE,gBAA2C;AAC3C,oBAA0C;AAC1C,kBAAwC;","names":[]}

package/dist/index.d.ts

@@ -1,15 +0,0 @@
-export { Auth, PATH } from './auth/index.js';
-export { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client.js';
-export { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis.js';
-export { DBAdapter, DBIndexedSessionRepository } from './session/db.js';
-export { PRINCIPAL_NAME_INDEX_NAME } from './session/common.js';
-export { ALL_PROVIDERS, CsrfToken, Principal, Provider } from './core/index.js';
-export { KVRepository, Namespace, Session, SessionRepository } from './session/types.js';
-export { NativeCredential, OAuth2Token, OidcScopes, OidcToken, StandardClaims, UserInfo } from './oauth2/types.js';
-export { AuthConfig, AuthService } from './auth/types.js';
-import 'zod/v4/core';
-import 'zod/mini';
-import 'ioredis';
-import './session/map-session.js';
-import './utils/http.js';
-import 'cookie';

package/dist/index.mjs.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["export { Auth, PATH } from './auth/index';\nexport { OAuth2Client, oauth2RedirectQuerySchema } from './oauth2/client';\nexport { RedisIndexedSessionRepository, RedisKVRepository } from './session/redis';\nexport { DBIndexedSessionRepository } from './session/db';\nexport { PRINCIPAL_NAME_INDEX_NAME } from './session/common';\nexport { Provider, ALL_PROVIDERS } from './core/index';\n\nexport type { Principal, CsrfToken } from './core/index';\nexport type { DBAdapter } from './session/db';\nexport type { Namespace, SessionRepository, Session, KVRepository } from './session/types';\nexport type {\n  NativeCredential,\n  OAuth2Token,\n  OidcToken,\n  OidcScopes,\n  StandardClaims,\n  UserInfo,\n} from './oauth2/types';\nexport type { AuthConfig, AuthService } from './auth/types';\n"],"mappings":";AAAA,SAAS,MAAM,YAAY;AAC3B,SAAS,cAAc,iCAAiC;AACxD,SAAS,+BAA+B,yBAAyB;AACjE,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAC1C,SAAS,UAAU,qBAAqB;","names":[]}

package/dist/oauth2/client.d.ts

@@ -1,59 +0,0 @@
-import { OAuth2ClientConfig, PkceParameters, OAuth2Token, OidcToken, UserInfo, NativeCredential } from './types.js';
-import * as zod_v4_core from 'zod/v4/core';
-import * as zod_mini from 'zod/mini';
-
-declare const oauth2RedirectQuerySchema: zod_mini.ZodMiniObject<{
-    code: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    state: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error_description: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error_uri: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-}, zod_v4_core.$strip>;
-declare const googleOneTapSchema: zod_mini.ZodMiniObject<{
-    code: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    state: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error_description: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    error_uri: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    nonce: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    g_csrf_token: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    hd: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-    credential: zod_mini.ZodMiniOptional<zod_mini.ZodMiniString<string>>;
-}, zod_v4_core.$strip>;
-declare class OAuth2Client {
-    private config;
-    constructor(config: OAuth2ClientConfig);
-    get baseUri(): string;
-    get successUri(): string;
-    get errorUri(): string;
-    private getClientConfig;
-    createAuthorizationUri({ registrationId, state, pkce, }: {
-        registrationId: string;
-        state: string;
-        pkce?: PkceParameters;
-    }): Promise<URL>;
-    exchangeAuthorizationCode({ registrationId, code, pkce, }: {
-        registrationId: string;
-        code: string;
-        pkce?: PkceParameters;
-    }): Promise<OAuth2Token>;
-    getUserInfo({ registrationId, token, }: {
-        registrationId: string;
-        token: OAuth2Token | OidcToken;
-    }): Promise<UserInfo<unknown>>;
-    refreshAccessToken({ registrationId, refreshToken, }: {
-        registrationId: string;
-        refreshToken: string;
-    }): Promise<OAuth2Token>;
-    revokeToken(registrationId: string, token: string): Promise<void>;
-    loginOAuth2Native({ registrationId, credentials, pkce, }: {
-        registrationId: string;
-        credentials: NativeCredential;
-        pkce?: PkceParameters;
-    }): Promise<{
-        token: OAuth2Token;
-        userInfo: UserInfo;
-    }>;
-}
-
-export { OAuth2Client, googleOneTapSchema, oauth2RedirectQuerySchema };

package/dist/oauth2/provider/apple.d.ts

@@ -1,41 +0,0 @@
-import { NativeCredential, OAuth2Token, Provider } from '../types.js';
-
-declare function createAppleProvider(): Provider;
-declare const apple: Provider;
-interface AppleUserInfo {
-    sub: string;
-    email: string;
-    email_verified: true | 'true';
-    is_private_email: boolean;
-    real_user_status: number;
-    name: string;
-    picture: string;
-    user?: {
-        name: {
-            firstName: string;
-            lastName: string;
-        };
-        email: string;
-    };
-    nonce?: string;
-    nonce_supported?: boolean;
-}
-interface AppleToken extends OAuth2Token {
-    access_token: string;
-    token_type: string;
-    expires_in: number;
-    refresh_token: string;
-    id_token: string;
-}
-interface AppleNativeCredential extends NativeCredential {
-    state: string;
-    code: string;
-    id_token: string;
-    user: string;
-    email?: string;
-}
-interface AppleErrorResponse {
-    error: 'invalid_request' | 'invalid_client' | 'invalid_grant' | 'unauthorized_client' | 'unsupported_grant_type' | 'invalid_scope';
-}
-
-export { type AppleErrorResponse, type AppleNativeCredential, type AppleToken, type AppleUserInfo, apple, createAppleProvider };

package/dist/oauth2/provider/common.d.ts

@@ -1,29 +0,0 @@
-import { PkceParameters, ExchangeCodeParams, RefreshTokenParams } from '../types.js';
-
-declare function createAuthorizationUri(options: {
-    state: string;
-    scope: string[];
-    clientId: string;
-    redirectUri: string;
-    authorizationUri: string;
-    pkce?: Omit<PkceParameters, 'code_verifier'>;
-}): URL;
-declare function exchangeAuthorizationCode(params: ExchangeCodeParams & {
-    tokenUri: string;
-    authentication?: 'basic' | 'post';
-}): Promise<Response>;
-declare function refreshAccessToken(params: RefreshTokenParams & {
-    tokenUri: string;
-    authentication?: 'basic' | 'post';
-}): Promise<Response>;
-interface RevokeTokenParams {
-    token: string;
-    clientId: string;
-    clientSecret: string;
-    tokenRevokeUri: string;
-    authentication?: 'basic' | 'post';
-}
-declare function revokeToken(params: RevokeTokenParams): Promise<void>;
-declare function verifyIdToken<T>(idToken: string, jwkSetUri: string): Promise<T>;
-
-export { createAuthorizationUri, exchangeAuthorizationCode, refreshAccessToken, revokeToken, verifyIdToken };

package/dist/oauth2/provider/facebook.d.ts

@@ -1,44 +0,0 @@
-import { OAuth2Token, Provider } from '../types.js';
-
-/**
- * ref: https://developers.facebook.com/docs/facebook-login/guides/advanced/manual-flow/
- * ref: https://developers.facebook.com/tools/explorer
- * */
-declare function createFacebookProvider(): Provider;
-declare const facebook: Provider;
-interface FacebookDecodedIdToken {
-    sub: string;
-    name: string;
-    email: string;
-    picture: string;
-    nonce?: string;
-}
-interface FacebookUserInfo {
-    id: string;
-    name: string;
-    email: string;
-    email_verified: boolean;
-    picture: {
-        data: {
-            url: string;
-            width: number;
-            height: number;
-            is_silhouette: boolean;
-        };
-    };
-}
-interface FacebookToken extends OAuth2Token {
-    access_token: string;
-    token_type: 'bearer';
-    expires_in: number;
-    id_token?: string;
-}
-type FacebookAppCredential = {
-    state: string;
-    id_token: string;
-} | {
-    state: string;
-    access_token: string;
-};
-
-export { type FacebookAppCredential, type FacebookDecodedIdToken, type FacebookToken, type FacebookUserInfo, createFacebookProvider, facebook };