@sixb/core 0.0.1

package/dist/agents/streams.js

@@ -0,0 +1,32 @@
+// @bun
+import {
+  AGENT_RUN_CANCEL_RECORD,
+  AGENT_RUN_STREAM_SCHEMA_VERSION,
+  DEFAULT_AGENT_RUN_STREAM_RETENTION,
+  agentRunControlStreamDefinition,
+  agentRunControlStreamId,
+  agentRunFinishedEvent,
+  agentRunStreamDefinition,
+  agentRunStreamId,
+  agentRunStreamIdempotencyKey,
+  publishAgentRunCancel,
+  publishAgentRunFinished,
+  subscribeAgentRunCancel
+} from "../chunk-k25jm1x5.js";
+import"../chunk-y64skrwp.js";
+export {
+  subscribeAgentRunCancel,
+  publishAgentRunFinished,
+  publishAgentRunCancel,
+  agentRunStreamIdempotencyKey,
+  agentRunStreamId,
+  agentRunStreamDefinition,
+  agentRunFinishedEvent,
+  agentRunControlStreamId,
+  agentRunControlStreamDefinition,
+  DEFAULT_AGENT_RUN_STREAM_RETENTION,
+  AGENT_RUN_STREAM_SCHEMA_VERSION,
+  AGENT_RUN_CANCEL_RECORD
+};
+
+//# debugId=4CAEB501F3A25A6C64756E2164756E21

package/dist/agents/streams.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "4CAEB501F3A25A6C64756E2164756E21",
+  "names": []
+}

package/dist/agents/types.d.ts

@@ -0,0 +1,52 @@
+import type { LanguageModelV4, LanguageModelV4CallOptions } from "@ai-sdk/provider";
+import type { GroupDefinition } from "../security";
+export type { AgentContextEntryInput, AgentContextInput, AgentContextOrigin, AgentContextPart, } from "./context";
+export type AgentReasoningLevel = NonNullable<LanguageModelV4CallOptions["reasoning"]>;
+export declare const AGENT_REASONING_LEVELS: readonly ["provider-default", "none", "minimal", "low", "medium", "high", "xhigh"];
+/**
+ * Loop / stop controls for an agent run.
+ *
+ * Consumed by the agent worker when it executes a run.
+ */
+export interface AgentLoopConfig {
+    readonly stopWhen?: {
+        readonly maxSteps?: number;
+    };
+}
+/**
+ * Declarative config accepted by {@link defineAgent}.
+ *
+ * Every field is a static value. `instructions` is a plain string; widening it to
+ * `string | (ctx) => string` later would be backwards-compatible.
+ */
+export interface DefineAgentConfig {
+    readonly name: string;
+    readonly description?: string;
+    readonly model: LanguageModelV4;
+    readonly reasoning?: AgentReasoningLevel;
+    readonly providerOptions?: LanguageModelV4CallOptions["providerOptions"];
+    readonly instructions: string;
+    readonly groups?: readonly GroupDefinition[];
+    readonly loop?: AgentLoopConfig;
+}
+/**
+ * Agent definition registered with Sixb.
+ *
+ * Definitions are safe to export from `agents/` modules; the runtime loads and
+ * registers them. The agent worker runs them as streaming turns. The `model` is an
+ * AI SDK language model instance and is therefore not serialisable — the worker
+ * resolves a definition from its own discovery rather than over the wire.
+ */
+export interface AgentDefinition<TId extends string = string> {
+    readonly kind: "agent";
+    readonly id: TId;
+    readonly name: string;
+    readonly description?: string;
+    readonly model: LanguageModelV4;
+    readonly reasoning?: AgentReasoningLevel;
+    readonly providerOptions?: LanguageModelV4CallOptions["providerOptions"];
+    readonly instructions: string;
+    readonly groupIds: readonly string[];
+    readonly loop?: AgentLoopConfig;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/agents/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/agents/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,0BAA0B,EAAE,MAAM,kBAAkB,CAAA;AACnF,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAElD,YAAY,EACV,sBAAsB,EACtB,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,WAAW,CAAA;AAElB,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,0BAA0B,CAAC,WAAW,CAAC,CAAC,CAAA;AAEtF,eAAO,MAAM,sBAAsB,oFAQgB,CAAA;AAEnD;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE;QAClB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAC3B,CAAA;CACF;AAED;;;;;GAKG;AACH,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,MAAM,CAAC,EAAE,SAAS,eAAe,EAAE,CAAA;IAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,eAAe,CAAC,GAAG,SAAS,MAAM,GAAG,MAAM;IAC1D,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;IACtB,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAA;IAChB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAA;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAA;IACxC,QAAQ,CAAC,eAAe,CAAC,EAAE,0BAA0B,CAAC,iBAAiB,CAAC,CAAA;IACxE,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAA;IAC7B,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAA;IACpC,QAAQ,CAAC,IAAI,CAAC,EAAE,eAAe,CAAA;CAChC"}

package/dist/agents/validation.d.ts

@@ -0,0 +1,10 @@
+import type { GroupDefinition, SecurityRegistry } from "../security";
+import { type AgentDefinition, type AgentLoopConfig, type AgentReasoningLevel, type DefineAgentConfig } from "./types";
+export declare function assertNonEmpty(value: string, field: string): void;
+export declare function isAgentDefinition(value: unknown): value is AgentDefinition;
+export declare function assertValidLoopConfig(loop: AgentLoopConfig | undefined): void;
+export declare function assertValidReasoningLevel(reasoning: AgentReasoningLevel | undefined): void;
+export declare function assertValidProviderOptions(providerOptions: DefineAgentConfig["providerOptions"]): void;
+export declare function groupIdsFromDefinitions(agentId: string, groups: readonly GroupDefinition[] | undefined): readonly string[];
+export declare function validateAgentGroupReferences(agents: readonly AgentDefinition[], security: SecurityRegistry): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/agents/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/agents/validation.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAEpE,OAAO,EAEL,KAAK,eAAe,EACpB,KAAK,eAAe,EACpB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACvB,MAAM,SAAS,CAAA;AAEhB,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAIjE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,eAAe,CAW1E;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,GAAG,IAAI,CAU7E;AAED,wBAAgB,yBAAyB,CAAC,SAAS,EAAE,mBAAmB,GAAG,SAAS,GAAG,IAAI,CAS1F;AAED,wBAAgB,0BAA0B,CACxC,eAAe,EAAE,iBAAiB,CAAC,iBAAiB,CAAC,GACpD,IAAI,CAyBN;AAED,wBAAgB,uBAAuB,CACrC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,SAAS,eAAe,EAAE,GAAG,SAAS,GAC7C,SAAS,MAAM,EAAE,CAcnB;AAED,wBAAgB,4BAA4B,CAC1C,MAAM,EAAE,SAAS,eAAe,EAAE,EAClC,QAAQ,EAAE,gBAAgB,GACzB,IAAI,CAWN"}

package/dist/auth/access-tokens.d.ts

@@ -0,0 +1,19 @@
+export declare const PERSONAL_ACCESS_TOKEN_PREFIX = "sixb_pat";
+export declare const SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX = "sixb_sat";
+export type AccessTokenKind = "personal" | "serviceAccount";
+export interface AccessTokenParts {
+    readonly kind: AccessTokenKind;
+    readonly tokenId: string;
+    readonly tokenSecret: string;
+}
+export interface AccessTokenCredential extends AccessTokenParts {
+    readonly tokenHash: string;
+    readonly tokenValue: string;
+}
+export declare function generateAccessTokenSecret(): string;
+export declare function hashAccessTokenSecret(secret: string): string;
+export declare function formatAccessTokenValue(kind: AccessTokenKind, tokenId: string, tokenSecret: string): string;
+export declare function parseAccessTokenValue(value: string | undefined): AccessTokenParts | null;
+export declare function getBearerAccessTokenValue(request: Request): string | null;
+export declare function createAccessTokenCredential(kind: AccessTokenKind, tokenId?: string): AccessTokenCredential;
+//# sourceMappingURL=access-tokens.d.ts.map

package/dist/auth/access-tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"access-tokens.d.ts","sourceRoot":"","sources":["../../src/auth/access-tokens.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,4BAA4B,aAAa,CAAA;AACtD,eAAO,MAAM,mCAAmC,aAAa,CAAA;AAI7D,MAAM,MAAM,eAAe,GAAG,UAAU,GAAG,gBAAgB,CAAA;AAE3D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,eAAe,CAAA;IAC9B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,qBAAsB,SAAQ,gBAAgB;IAC7D,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAC5B;AAKD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAgB,sBAAsB,CACpC,IAAI,EAAE,eAAe,EACrB,OAAO,EAAE,MAAM,EACf,WAAW,EAAE,MAAM,GAClB,MAAM,CAYR;AAED,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,gBAAgB,GAAG,IAAI,CAyBxF;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAYzE;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,eAAe,EACrB,OAAO,SAAwB,GAC9B,qBAAqB,CAUvB"}

package/dist/auth/audience.d.ts

@@ -0,0 +1,8 @@
+export declare const DEFAULT_AUTH_SESSION_AUDIENCE = "atlas";
+export type AuthSessionAudience = typeof DEFAULT_AUTH_SESSION_AUDIENCE | "app";
+export interface AuthSessionAudienceOptions {
+    readonly audience?: AuthSessionAudience;
+}
+export declare function isValidAuthSessionAudience(value: string): value is AuthSessionAudience;
+export declare function resolveAuthSessionAudience(value: AuthSessionAudience | undefined): AuthSessionAudience;
+//# sourceMappingURL=audience.d.ts.map

package/dist/auth/audience.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audience.d.ts","sourceRoot":"","sources":["../../src/auth/audience.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,6BAA6B,UAAU,CAAA;AAEpD,MAAM,MAAM,mBAAmB,GAAG,OAAO,6BAA6B,GAAG,KAAK,CAAA;AAE9E,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,CAAC,EAAE,mBAAmB,CAAA;CACxC;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,KAAK,IAAI,mBAAmB,CAEtF;AAED,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,mBAAmB,GAAG,SAAS,GACrC,mBAAmB,CAWrB"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,50 @@
+import type { AuthSessionAudience } from "./audience";
+import type { AuthCookieOptions } from "./types";
+export declare const DEFAULT_SESSION_COOKIE_NAME = "sixb_session";
+export declare const DEFAULT_CSRF_COOKIE_NAME = "sixb_csrf";
+export interface ResolvedAuthCookieOptions {
+    readonly sessionCookieName: string;
+    readonly csrfCookieName: string;
+    readonly domain?: string;
+    readonly secure: boolean | "auto";
+    readonly sameSite: "strict";
+    readonly csrfHttpOnly: boolean;
+}
+interface CookieSerializationOptions {
+    readonly name: string;
+    readonly value: string;
+    readonly httpOnly?: boolean;
+    readonly maxAge?: number;
+    readonly expires?: Date;
+    readonly domain?: string;
+    readonly secure?: boolean;
+    readonly sameSite: "strict";
+}
+export declare function resolveAuthCookieOptions(options: AuthCookieOptions | undefined): ResolvedAuthCookieOptions;
+export declare function resolveAuthCookieOptionsForAudience(options: ResolvedAuthCookieOptions, audience: AuthSessionAudience | undefined): ResolvedAuthCookieOptions;
+export declare function parseCookieHeader(header: string | null): ReadonlyMap<string, string>;
+export declare function getCookie(request: Request, name: string): string | undefined;
+export declare function serializeCookie(options: CookieSerializationOptions): string;
+export declare function shouldUseSecureCookies(request: Request, options: ResolvedAuthCookieOptions): boolean;
+export declare function createSessionCookieHeader(params: {
+    readonly request: Request;
+    readonly value: string;
+    readonly expiresAt: Date;
+    readonly options: ResolvedAuthCookieOptions;
+}): string;
+export declare function createCsrfCookieHeader(params: {
+    readonly request: Request;
+    readonly value: string;
+    readonly expiresAt: Date;
+    readonly options: ResolvedAuthCookieOptions;
+}): string;
+export declare function clearSessionCookieHeader(params: {
+    readonly request: Request;
+    readonly options: ResolvedAuthCookieOptions;
+}): string;
+export declare function clearCsrfCookieHeader(params: {
+    readonly request: Request;
+    readonly options: ResolvedAuthCookieOptions;
+}): string;
+export {};
+//# sourceMappingURL=cookies.d.ts.map

package/dist/auth/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AAErD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,SAAS,CAAA;AAEhD,eAAO,MAAM,2BAA2B,iBAAiB,CAAA;AACzD,eAAO,MAAM,wBAAwB,cAAc,CAAA;AAEnD,MAAM,WAAW,yBAAyB;IACxC,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAA;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAA;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,CAAA;IACjC,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;IAC3B,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAA;CAC/B;AAED,UAAU,0BAA0B;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAA;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAA;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAA;CAC5B;AAED,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,iBAAiB,GAAG,SAAS,GACrC,yBAAyB,CAY3B;AAED,wBAAgB,mCAAmC,CACjD,OAAO,EAAE,yBAAyB,EAClC,QAAQ,EAAE,mBAAmB,GAAG,SAAS,GACxC,yBAAyB,CAW3B;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBpF;AAED,wBAAgB,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE5E;AAED,wBAAgB,eAAe,CAAC,OAAO,EAAE,0BAA0B,GAAG,MAAM,CA2B3E;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,yBAAyB,GACjC,OAAO,CAkBT;AAED,wBAAgB,yBAAyB,CAAC,MAAM,EAAE;IAChD,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C,GAAG,MAAM,CAWT;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE;IAC7C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;IACxB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C,GAAG,MAAM,CAWT;AAiBD,wBAAgB,wBAAwB,CAAC,MAAM,EAAE;IAC/C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C,GAAG,MAAM,CAWT;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE;IAC5C,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,OAAO,EAAE,yBAAyB,CAAA;CAC5C,GAAG,MAAM,CAUT"}

package/dist/auth/csrf.d.ts

@@ -0,0 +1,8 @@
+export declare const CSRF_HEADER_NAME = "x-sixb-csrf";
+export declare function generateCsrfToken(): string;
+export declare function isCsrfExemptMethod(method: string): boolean;
+export declare function verifyDoubleSubmitCsrf(request: Request, options: {
+    readonly cookieName: string;
+    readonly headerName?: string;
+}): boolean;
+//# sourceMappingURL=csrf.d.ts.map

package/dist/auth/csrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../../src/auth/csrf.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,gBAAgB,gBAAgB,CAAA;AAE7C,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAG1D;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE,GACrE,OAAO,CAaT"}

package/dist/auth/errors.d.ts

@@ -0,0 +1,7 @@
+export type AuthRuntimeErrorCode = "authentication_required" | "auth_storage_missing" | "authorization_denied" | "invalid_auth_input" | "invalid_auth_config" | "rate_limited" | "production_auth_required";
+export declare class AuthRuntimeError extends Error {
+    readonly code: AuthRuntimeErrorCode;
+    readonly name = "AuthRuntimeError";
+    constructor(code: AuthRuntimeErrorCode, message: string);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/auth/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/auth/errors.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,oBAAoB,GAC5B,yBAAyB,GACzB,sBAAsB,GACtB,sBAAsB,GACtB,oBAAoB,GACpB,qBAAqB,GACrB,cAAc,GACd,0BAA0B,CAAA;AAE9B,qBAAa,gBAAiB,SAAQ,KAAK;IAIvC,QAAQ,CAAC,IAAI,EAAE,oBAAoB;IAHrC,QAAQ,CAAC,IAAI,sBAAqB;gBAGvB,IAAI,EAAE,oBAAoB,EACnC,OAAO,EAAE,MAAM;CAIlB"}

package/dist/auth/index.d.ts

@@ -0,0 +1,15 @@
+export type { AccessTokenCredential, AccessTokenKind, AccessTokenParts } from "./access-tokens";
+export { createAccessTokenCredential, formatAccessTokenValue, generateAccessTokenSecret, getBearerAccessTokenValue, hashAccessTokenSecret, PERSONAL_ACCESS_TOKEN_PREFIX, parseAccessTokenValue, SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX, } from "./access-tokens";
+export type { AuthSessionAudience, AuthSessionAudienceOptions } from "./audience";
+export { DEFAULT_AUTH_SESSION_AUDIENCE, isValidAuthSessionAudience, resolveAuthSessionAudience, } from "./audience";
+export { clearCsrfCookieHeader, clearSessionCookieHeader, createCsrfCookieHeader, createSessionCookieHeader, DEFAULT_CSRF_COOKIE_NAME, DEFAULT_SESSION_COOKIE_NAME, getCookie, parseCookieHeader, resolveAuthCookieOptions, serializeCookie, shouldUseSecureCookies, } from "./cookies";
+export { CSRF_HEADER_NAME, generateCsrfToken, isCsrfExemptMethod, verifyDoubleSubmitCsrf, } from "./csrf";
+export type { AuthRuntimeErrorCode } from "./errors";
+export { AuthRuntimeError } from "./errors";
+export type { AuthRuntimeOptions } from "./runtime";
+export { AuthRuntime, DEFAULT_AUTH_INVITATION_TTL_MS, DEFAULT_AUTH_SESSION_CACHE_TTL_MS, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS, MAX_AUTH_INVITATION_TTL_MS, resolveAuthConfig, } from "./runtime";
+export { createSessionCredential, formatSessionCookieValue, generateSessionSecret, hashSessionSecret, parseSessionCookieValue, } from "./sessions";
+export type { AuthCookieOptions, AuthCredentialSource, AuthEmailDeliveryStatus, AuthenticatedAuthSession, AuthenticatedRequestAuthSession, AuthenticatedServiceAccountAccessTokenSession, AuthenticatedUserAccessTokenSession, AuthenticatedUserRequestSession, AuthInvitationRecipientInput, AuthInvitationRecipientResult, AuthInvitationRecipientStatus, AuthRequestResult, AuthSessionFailureReason, AuthSessionOptions, AuthSessionResolutionOptions, AuthSessionResult, AuthStrategy, AuthStrategyKind, CreateAccessTokenResult, CreateInvitationCapability, CreatePersonalAccessTokenInput, CreateServiceAccountAccessTokenInput, CreateServiceAccountAccessTokenResult, CreateServiceAccountInput, CreateServiceAccountResult, DisableServiceAccountInput, DisableServiceAccountResult, GetInvitationOptionsResult, GetMembershipOptionsResult, InvitationDeliveryAuthStrategy, InvitationDeliveryInput, InvitationGroupOption, InvitationRecipientInput, InvitationRecipientResult, InvitationRecipientStatus, InviteDeliveryResult, InviteDeliveryStatus, InviteUserInput, InviteUserOptions, InviteUserResult, ListInvitationsInput, ListInvitationsResult, ListMembersInput, ListMembersResult, ListPersonalAccessTokensResult, ListServiceAccountAccessTokensInput, ListServiceAccountAccessTokensResult, ListServiceAccountsResult, MagicLinkAuthStrategy, MagicLinkCallbackInput, MagicLinkCallbackResult, MagicLinkInvitationRecipientInput, MagicLinkInvitationRecipientResult, MagicLinkInvitationRecipientStatus, MagicLinkPeekInput, MagicLinkPeekResult, MagicLinkRequestInput, MagicLinkRequestResult, MagicLinkRequestStatus, MemberCapabilities, MemberSummary, MembershipCapabilities, MembershipOperationCapabilities, OidcAuthStrategy, OidcCallbackInput, OidcCallbackResult, OidcStartSignInInput, OidcStartSignInResult, Principal, ReactivateMemberInput, ReactivateMemberResult, ResolvedAuthConfig, RevokeAccessTokenResult, RevokeInvitationInput, RevokeInvitationResult, RevokePersonalAccessTokenInput, RevokeServiceAccountAccessTokenInput, RevokeServiceAccountAccessTokenResult, SecurityContext, ServiceAccountWithGroups, SixbAuthConfig, SuspendMemberInput, SuspendMemberResult, UnauthenticatedAuthSession, UpdateMemberGroupsInput, UpdateMemberGroupsResult, } from "./types";
+export { principalsEqual, SYSTEM_PRINCIPAL } from "./types";
+export { isInvitationDeliveryAuthStrategy, isMagicLinkAuthStrategy, isOidcAuthStrategy, } from "./validation";
+//# sourceMappingURL=index.d.ts.map

package/dist/auth/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,qBAAqB,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAA;AAC/F,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EACtB,yBAAyB,EACzB,yBAAyB,EACzB,qBAAqB,EACrB,4BAA4B,EAC5B,qBAAqB,EACrB,mCAAmC,GACpC,MAAM,iBAAiB,CAAA;AACxB,YAAY,EAAE,mBAAmB,EAAE,0BAA0B,EAAE,MAAM,YAAY,CAAA;AACjF,OAAO,EACL,6BAA6B,EAC7B,0BAA0B,EAC1B,0BAA0B,GAC3B,MAAM,YAAY,CAAA;AACnB,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,sBAAsB,EACtB,yBAAyB,EACzB,wBAAwB,EACxB,2BAA2B,EAC3B,SAAS,EACT,iBAAiB,EACjB,wBAAwB,EACxB,eAAe,EACf,sBAAsB,GACvB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,QAAQ,CAAA;AACf,YAAY,EAAE,oBAAoB,EAAE,MAAM,UAAU,CAAA;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAA;AAC3C,YAAY,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAA;AACnD,OAAO,EACL,WAAW,EACX,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,WAAW,CAAA;AAClB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,qBAAqB,EACrB,iBAAiB,EACjB,uBAAuB,GACxB,MAAM,YAAY,CAAA;AACnB,YAAY,EACV,iBAAiB,EACjB,oBAAoB,EACpB,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,6CAA6C,EAC7C,mCAAmC,EACnC,+BAA+B,EAC/B,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,wBAAwB,EACxB,kBAAkB,EAClB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,uBAAuB,EACvB,0BAA0B,EAC1B,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAC1B,8BAA8B,EAC9B,uBAAuB,EACvB,qBAAqB,EACrB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EACzB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,aAAa,EACb,sBAAsB,EACtB,+BAA+B,EAC/B,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,EACrB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EACtB,kBAAkB,EAClB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,wBAAwB,EACxB,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,EAC1B,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAA;AAC3D,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}

package/dist/auth/index.js

@@ -0,0 +1,101 @@
+// @bun
+import {
+  AuthRuntime,
+  CSRF_HEADER_NAME,
+  PERSONAL_ACCESS_TOKEN_PREFIX,
+  SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
+  SYSTEM_PRINCIPAL,
+  createAccessTokenCredential,
+  createSessionCredential,
+  formatAccessTokenValue,
+  formatSessionCookieValue,
+  generateAccessTokenSecret,
+  generateCsrfToken,
+  generateSessionSecret,
+  getBearerAccessTokenValue,
+  hashAccessTokenSecret,
+  hashSessionSecret,
+  isCsrfExemptMethod,
+  parseAccessTokenValue,
+  parseSessionCookieValue,
+  principalsEqual,
+  verifyDoubleSubmitCsrf
+} from "../chunk-dcgrzj1t.js";
+import {
+  AuthRuntimeError,
+  DEFAULT_AUTH_INVITATION_TTL_MS,
+  DEFAULT_AUTH_SESSION_AUDIENCE,
+  DEFAULT_AUTH_SESSION_CACHE_TTL_MS,
+  DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS,
+  DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS,
+  DEFAULT_CSRF_COOKIE_NAME,
+  DEFAULT_SESSION_COOKIE_NAME,
+  MAX_AUTH_INVITATION_TTL_MS,
+  clearCsrfCookieHeader,
+  clearSessionCookieHeader,
+  createCsrfCookieHeader,
+  createSessionCookieHeader,
+  getCookie,
+  isInvitationDeliveryAuthStrategy,
+  isMagicLinkAuthStrategy,
+  isOidcAuthStrategy,
+  isValidAuthSessionAudience,
+  parseCookieHeader,
+  resolveAuthConfig,
+  resolveAuthCookieOptions,
+  resolveAuthSessionAudience,
+  serializeCookie,
+  shouldUseSecureCookies
+} from "../chunk-xwnf87e1.js";
+import"../chunk-0fygrz37.js";
+import"../chunk-btpe64e4.js";
+import"../chunk-1vffvydj.js";
+import"../chunk-y64skrwp.js";
+export {
+  verifyDoubleSubmitCsrf,
+  shouldUseSecureCookies,
+  serializeCookie,
+  resolveAuthSessionAudience,
+  resolveAuthCookieOptions,
+  resolveAuthConfig,
+  principalsEqual,
+  parseSessionCookieValue,
+  parseCookieHeader,
+  parseAccessTokenValue,
+  isValidAuthSessionAudience,
+  isOidcAuthStrategy,
+  isMagicLinkAuthStrategy,
+  isInvitationDeliveryAuthStrategy,
+  isCsrfExemptMethod,
+  hashSessionSecret,
+  hashAccessTokenSecret,
+  getCookie,
+  getBearerAccessTokenValue,
+  generateSessionSecret,
+  generateCsrfToken,
+  generateAccessTokenSecret,
+  formatSessionCookieValue,
+  formatAccessTokenValue,
+  createSessionCredential,
+  createSessionCookieHeader,
+  createCsrfCookieHeader,
+  createAccessTokenCredential,
+  clearSessionCookieHeader,
+  clearCsrfCookieHeader,
+  SYSTEM_PRINCIPAL,
+  SERVICE_ACCOUNT_ACCESS_TOKEN_PREFIX,
+  PERSONAL_ACCESS_TOKEN_PREFIX,
+  MAX_AUTH_INVITATION_TTL_MS,
+  DEFAULT_SESSION_COOKIE_NAME,
+  DEFAULT_CSRF_COOKIE_NAME,
+  DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS,
+  DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS,
+  DEFAULT_AUTH_SESSION_CACHE_TTL_MS,
+  DEFAULT_AUTH_SESSION_AUDIENCE,
+  DEFAULT_AUTH_INVITATION_TTL_MS,
+  CSRF_HEADER_NAME,
+  AuthRuntimeError,
+  AuthRuntime
+};
+
+//# debugId=9FA99CC2ECAE9D7264756E2164756E21

package/dist/auth/index.js.map

@@ -0,0 +1,9 @@
+{
+  "version": 3,
+  "sources": [],
+  "sourcesContent": [
+  ],
+  "mappings": "",
+  "debugId": "9FA99CC2ECAE9D7264756E2164756E21",
+  "names": []
+}

package/dist/auth/runtime.d.ts

@@ -0,0 +1,129 @@
+import { type AuthorizationContext } from "../authorization";
+import { type GroupReference, type SecurityRegistry } from "../security";
+import type { Storage } from "../storage";
+import { type ResolvedAuthCookieOptions } from "./cookies";
+import type { AuthenticatedAuthSession, AuthenticatedRequestAuthSession, AuthenticatedUserRequestSession, AuthRequestResult, AuthSessionResolutionOptions, AuthSessionResult, AuthStrategy, CreateAccessTokenResult, CreatePersonalAccessTokenInput, CreateServiceAccountAccessTokenInput, CreateServiceAccountAccessTokenResult, CreateServiceAccountInput, CreateServiceAccountResult, DisableServiceAccountInput, DisableServiceAccountResult, GetInvitationOptionsResult, GetMembershipOptionsResult, InviteUserInput, InviteUserOptions, InviteUserResult, ListInvitationsInput, ListInvitationsResult, ListMembersInput, ListMembersResult, ListPersonalAccessTokensResult, ListServiceAccountAccessTokensInput, ListServiceAccountAccessTokensResult, ListServiceAccountsResult, MembershipCapabilities, Principal, ReactivateMemberInput, ReactivateMemberResult, RevokeAccessTokenResult, RevokeInvitationInput, RevokeInvitationResult, RevokePersonalAccessTokenInput, RevokeServiceAccountAccessTokenInput, RevokeServiceAccountAccessTokenResult, SecurityContext, SixbAuthConfig, SuspendMemberInput, SuspendMemberResult, UpdateMemberGroupsInput, UpdateMemberGroupsResult } from "./types";
+export { DEFAULT_AUTH_INVITATION_TTL_MS, DEFAULT_AUTH_SESSION_CACHE_TTL_MS, DEFAULT_AUTH_SESSION_IDLE_TIMEOUT_MS, DEFAULT_AUTH_SESSION_RENEWAL_WINDOW_MS, MAX_AUTH_INVITATION_TTL_MS, resolveAuthConfig, } from "./validation";
+export interface AuthRuntimeOptions {
+    readonly projectId: string;
+    readonly storage: Storage;
+    readonly security: SecurityRegistry;
+    readonly config?: SixbAuthConfig;
+}
+export declare class AuthRuntime {
+    private readonly projectId;
+    private readonly storage;
+    private readonly security;
+    private readonly config;
+    private readonly sessionCache;
+    constructor(options: AuthRuntimeOptions);
+    isEnabled(): boolean;
+    getStrategy(): AuthStrategy | null;
+    createSessionDeadlines(now: Date): {
+        readonly expiresAt: Date;
+        readonly absoluteExpiresAt?: Date;
+    };
+    getCookieOptions(options?: AuthSessionResolutionOptions): ResolvedAuthCookieOptions;
+    assertCanServeHttp(params: {
+        readonly production: boolean;
+    }): void;
+    getSession(request: Request, options?: AuthSessionResolutionOptions & {
+        readonly credentialSource?: "session";
+    }): Promise<AuthSessionResult>;
+    getSession(request: Request, options: AuthSessionResolutionOptions & {
+        readonly credentialSource: "accessToken" | "any";
+    }): Promise<AuthRequestResult>;
+    getSession(request: Request, options: AuthSessionResolutionOptions): Promise<AuthRequestResult>;
+    private resolveCookieSession;
+    private canRenewSession;
+    private getRenewedSessionExpiresAt;
+    private resolveAccessTokenSession;
+    /**
+     * Evict a session from the in-process cache. Call this when a session is revoked
+     * (e.g. sign-out) so the cached result is dropped before its TTL would expire.
+     */
+    invalidateSession(sessionId: string): void;
+    private touchSessionLastSeen;
+    private touchAccessTokenLastUsed;
+    requirePrincipal(request: Request, options?: AuthSessionResolutionOptions): Promise<Principal>;
+    requireUser(request: Request, options?: AuthSessionResolutionOptions): Promise<AuthenticatedAuthSession>;
+    requireUserRequest(request: Request, options?: AuthSessionResolutionOptions): Promise<AuthenticatedUserRequestSession>;
+    createSecurityContext(request: Request, options?: AuthSessionResolutionOptions): Promise<SecurityContext>;
+    /**
+     * Resolve the authenticated principal's authorization context for a request.
+     *
+     * Grants resolve eagerly (`groups -> roles -> grants`, subtype-expanded), so
+     * the returned context supports synchronous set-lookup checks and `sixb.as()`.
+     */
+    createAuthorizationContext(request: Request, options?: AuthSessionResolutionOptions): Promise<AuthorizationContext>;
+    /**
+     * Build an authorization context from an already-resolved session, so callers
+     * that resolve the session themselves (e.g. the server auth guard) don't read
+     * the request twice.
+     */
+    contextFromSession(session: AuthenticatedRequestAuthSession): AuthorizationContext;
+    listPersonalAccessTokens(request: Request, options?: AuthSessionResolutionOptions): Promise<ListPersonalAccessTokensResult>;
+    createPersonalAccessToken(request: Request, input: CreatePersonalAccessTokenInput, options?: AuthSessionResolutionOptions): Promise<CreateAccessTokenResult>;
+    revokePersonalAccessToken(request: Request, input: RevokePersonalAccessTokenInput, options?: AuthSessionResolutionOptions): Promise<RevokeAccessTokenResult>;
+    listServiceAccounts(request: Request, options?: AuthSessionResolutionOptions): Promise<ListServiceAccountsResult>;
+    createServiceAccount(request: Request, input: CreateServiceAccountInput, options?: AuthSessionResolutionOptions): Promise<CreateServiceAccountResult>;
+    disableServiceAccount(request: Request, input: DisableServiceAccountInput, options?: AuthSessionResolutionOptions): Promise<DisableServiceAccountResult>;
+    listServiceAccountAccessTokens(request: Request, input: ListServiceAccountAccessTokensInput, options?: AuthSessionResolutionOptions): Promise<ListServiceAccountAccessTokensResult>;
+    createServiceAccountAccessToken(request: Request, input: CreateServiceAccountAccessTokenInput, options?: AuthSessionResolutionOptions): Promise<CreateServiceAccountAccessTokenResult>;
+    revokeServiceAccountAccessToken(request: Request, input: RevokeServiceAccountAccessTokenInput, options?: AuthSessionResolutionOptions): Promise<RevokeServiceAccountAccessTokenResult>;
+    /**
+     * Resolve a service account the caller is allowed to manage.
+     *
+     * A caller may manage a service account only when it belongs to every group
+     * the account is in ("you can manage what you could have created"). This
+     * confines token minting, disabling, and revocation to privileges the caller
+     * already holds and prevents a service-account token from outliving the
+     * caller's own access. Missing and non-manageable accounts raise the same
+     * error so callers cannot probe which privileged accounts exist.
+     */
+    private requireManageableServiceAccount;
+    private listServiceAccountGroupIds;
+    getInvitationOptions(request: Request, options?: AuthSessionResolutionOptions): Promise<GetInvitationOptionsResult>;
+    /**
+     * Resolve what a caller's membership policies let it do, from its groups alone.
+     *
+     * This is the public form of the question the member-admin routes ask internally. It takes groups
+     * rather than a `Request` so project code and tests can ask it without a session — an
+     * `AuthorizationContext` carries `groupIds` for exactly this. Definitions and ids are both accepted,
+     * because a session hands you ids and your own code has the definition.
+     */
+    getMembershipCapabilities(input: {
+        readonly callerGroups: readonly GroupReference[];
+    }): MembershipCapabilities;
+    getMembershipOptions(request: Request, options?: AuthSessionResolutionOptions): Promise<GetMembershipOptionsResult>;
+    listMembers(request: Request, input?: ListMembersInput, options?: AuthSessionResolutionOptions): Promise<ListMembersResult>;
+    updateMemberGroups(request: Request, input: UpdateMemberGroupsInput, options?: AuthSessionResolutionOptions): Promise<UpdateMemberGroupsResult>;
+    suspendMember(request: Request, input: SuspendMemberInput, options?: AuthSessionResolutionOptions): Promise<SuspendMemberResult>;
+    reactivateMember(request: Request, input: ReactivateMemberInput, options?: AuthSessionResolutionOptions): Promise<ReactivateMemberResult>;
+    /** Drop cached sessions for a user after a membership or status change. */
+    invalidateUserSessions(userId: string): void;
+    private scopedGroupOptions;
+    /**
+     * Resolve a member the caller may act on for the given operation.
+     *
+     * A member is manageable only when every group they currently hold is within
+     * the caller's scope for that operation (a group-less member is manageable by
+     * any holder of the operation). Missing and out-of-scope members raise the same
+     * error so callers cannot probe which users exist or how they are grouped.
+     */
+    private requireManageableMember;
+    private resolveMemberGroupIds;
+    invite(request: Request, input: InviteUserInput, options?: InviteUserOptions): Promise<InviteUserResult>;
+    listInvitations(request: Request, input?: ListInvitationsInput, options?: AuthSessionResolutionOptions): Promise<ListInvitationsResult>;
+    revokeInvitation(request: Request, input: RevokeInvitationInput, options?: AuthSessionResolutionOptions): Promise<RevokeInvitationResult>;
+    private requireAuthStorage;
+    private resolveInviteGroupIds;
+    private resolveMembershipPolicyScopeForUser;
+    private resolveCreateInvitationCapability;
+    private assertInvitationApplicationAccess;
+    private assertCanInviteRecipient;
+    private revokeInvitationAfterDeliveryFailure;
+    private createInvitationDeliveryError;
+    private assertCanManageInvitationGroups;
+}
+//# sourceMappingURL=runtime.d.ts.map

package/dist/auth/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../../src/auth/runtime.ts"],"names":[],"mappings":"AACA,OAAO,EACL,KAAK,oBAAoB,EAG1B,MAAM,kBAAkB,CAAA;AACzB,OAAO,EAEL,KAAK,cAAc,EAKnB,KAAK,gBAAgB,EACtB,MAAM,aAAa,CAAA;AACpB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,YAAY,CAAA;AAmBzC,OAAO,EAEL,KAAK,yBAAyB,EAE/B,MAAM,WAAW,CAAA;AAIlB,OAAO,KAAK,EACV,wBAAwB,EACxB,+BAA+B,EAC/B,+BAA+B,EAC/B,iBAAiB,EACjB,4BAA4B,EAC5B,iBAAiB,EACjB,YAAY,EACZ,uBAAuB,EACvB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,yBAAyB,EACzB,0BAA0B,EAC1B,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,0BAA0B,EAM1B,eAAe,EACf,iBAAiB,EACjB,gBAAgB,EAChB,oBAAoB,EACpB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,8BAA8B,EAC9B,mCAAmC,EACnC,oCAAoC,EACpC,yBAAyB,EAEzB,sBAAsB,EACtB,SAAS,EACT,qBAAqB,EACrB,sBAAsB,EAEtB,uBAAuB,EACvB,qBAAqB,EACrB,sBAAsB,EACtB,8BAA8B,EAC9B,oCAAoC,EACpC,qCAAqC,EACrC,eAAe,EACf,cAAc,EACd,kBAAkB,EAClB,mBAAmB,EACnB,uBAAuB,EACvB,wBAAwB,EACzB,MAAM,SAAS,CAAA;AAWhB,OAAO,EACL,8BAA8B,EAC9B,iCAAiC,EACjC,oCAAoC,EACpC,sCAAsC,EACtC,0BAA0B,EAC1B,iBAAiB,GAClB,MAAM,cAAc,CAAA;AAOrB,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;IACzB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAA;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAA;CACjC;AAED,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAoB;IAC3C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAqB;gBAEtC,OAAO,EAAE,kBAAkB;IAgBvC,SAAS,IAAI,OAAO;IAKpB,WAAW,IAAI,YAAY,GAAG,IAAI;IAIlC,sBAAsB,CAAC,GAAG,EAAE,IAAI,GAAG;QACjC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAA;QACxB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,IAAI,CAAA;KAClC;IAUD,gBAAgB,CAAC,OAAO,GAAE,4BAAiC,GAAG,yBAAyB;IAIvF,kBAAkB,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,UAAU,EAAE,OAAO,CAAA;KAAE,GAAG,IAAI;IAgC5D,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,CAAA;KAAE,GACjF,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GAAG;QAAE,QAAQ,CAAC,gBAAgB,EAAE,aAAa,GAAG,KAAK,CAAA;KAAE,GAC3F,OAAO,CAAC,iBAAiB,CAAC;IACvB,UAAU,CACd,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE,4BAA4B,GACpC,OAAO,CAAC,iBAAiB,CAAC;YA+Bf,oBAAoB;IA4GlC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,0BAA0B;YASpB,yBAAyB;IAwFvC;;;OAGG;IACH,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;YAM5B,oBAAoB;YAgBpB,wBAAwB;IAwBhC,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,SAAS,CAAC;IASf,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAS9B,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,+BAA+B,CAAC;IAarC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,eAAe,CAAC;IAU3B;;;;;OAKG;IACG,0BAA0B,CAC9B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oBAAoB,CAAC;IAShC;;;;OAIG;IACH,kBAAkB,CAAC,OAAO,EAAE,+BAA+B,GAAG,oBAAoB;IAS5E,wBAAwB,CAC5B,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,8BAA8B,CAAC;IAgBpC,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA0B7B,yBAAyB,CAC7B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,8BAA8B,EACrC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,uBAAuB,CAAC;IA2B7B,mBAAmB,CACvB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,yBAAyB,CAAC;IAwB/B,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,yBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAmChC,qBAAqB,CACzB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,0BAA0B,EACjC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,2BAA2B,CAAC;IAkBjC,8BAA8B,CAClC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,mCAAmC,EAC1C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,oCAAoC,CAAC;IAqB1C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IAsC3C,+BAA+B,CACnC,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,oCAAoC,EAC3C,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qCAAqC,CAAC;IA+BjD;;;;;;;;;OASG;YACW,+BAA+B;YA0B/B,0BAA0B;IAWlC,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAkBtC;;;;;;;OAOG;IACH,yBAAyB,CAAC,KAAK,EAAE;QAC/B,QAAQ,CAAC,YAAY,EAAE,SAAS,cAAc,EAAE,CAAA;KACjD,GAAG,sBAAsB;IAMpB,oBAAoB,CACxB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,0BAA0B,CAAC;IAWhC,WAAW,CACf,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,gBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,iBAAiB,CAAC;IA4CvB,kBAAkB,CACtB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,uBAAuB,EAC9B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,wBAAwB,CAAC;IAqE9B,aAAa,CACjB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,kBAAkB,EACzB,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,mBAAmB,CAAC;IA0BzB,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkBlC,2EAA2E;IAC3E,sBAAsB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAI5C,OAAO,CAAC,kBAAkB;IAW1B;;;;;;;OAOG;YACW,uBAAuB;IAuBrC,OAAO,CAAC,qBAAqB;IAavB,MAAM,CACV,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,iBAAsB,GAC9B,OAAO,CAAC,gBAAgB,CAAC;IA6DtB,eAAe,CACnB,OAAO,EAAE,OAAO,EAChB,KAAK,GAAE,oBAAyB,EAChC,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,qBAAqB,CAAC;IAuB3B,gBAAgB,CACpB,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,qBAAqB,EAC5B,OAAO,GAAE,4BAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC;IAkClC,OAAO,CAAC,kBAAkB;IAW1B,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,mCAAmC;IAO3C,OAAO,CAAC,iCAAiC;IAczC,OAAO,CAAC,iCAAiC;YAqB3B,wBAAwB;YAwBxB,oCAAoC;IAYlD,OAAO,CAAC,6BAA6B;IAgBrC,OAAO,CAAC,+BAA+B;CAuBxC"}

package/dist/auth/session-cache.d.ts

@@ -0,0 +1,44 @@
+import type { AuthSessionAudience } from "./audience";
+import type { AuthenticatedAuthSession } from "./types";
+export interface SessionCacheGetInput {
+    readonly sessionId: string;
+    readonly tokenHash: string;
+    readonly audience: AuthSessionAudience;
+    readonly nowMs: number;
+}
+export interface SessionCacheSetInput extends SessionCacheGetInput {
+    readonly session: AuthenticatedAuthSession;
+    readonly sessionExpiresAtMs: number;
+    readonly sessionAbsoluteExpiresAtMs?: number;
+}
+/**
+ * Tiny in-process TTL cache for resolved auth sessions, keyed by session id.
+ *
+ * Every authenticated request resolves its session through the shared storage pool
+ * (a session lookup plus user and group-membership reads). Under request bursts that
+ * triples the pool pressure and, with a small pool, can starve the pool so the entire
+ * API stalls. Caching the resolved result for a short TTL collapses those reads to one
+ * per session per window.
+ *
+ * Safety: entries are pinned to the exact token hash + audience that produced them and
+ * are never served past the session's rolling or absolute deadline. The short TTL bounds how long
+ * a revoked session can linger; sign-out additionally invalidates eagerly via
+ * {@link SessionCache.invalidate}.
+ */
+export declare class SessionCache {
+    private readonly ttlMs;
+    private readonly maxEntries;
+    private readonly entries;
+    constructor(ttlMs: number, maxEntries?: number);
+    get(input: SessionCacheGetInput): AuthenticatedAuthSession | undefined;
+    set(input: SessionCacheSetInput): void;
+    invalidate(sessionId: string): void;
+    /**
+     * Drop every cached session for a user. Call this after a change that alters how
+     * the user's session resolves (group reassignment, suspension) so the next request
+     * re-reads storage instead of serving a stale principal.
+     */
+    invalidateUser(userId: string): void;
+    clear(): void;
+}
+//# sourceMappingURL=session-cache.d.ts.map

package/dist/auth/session-cache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-cache.d.ts","sourceRoot":"","sources":["../../src/auth/session-cache.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAA;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,SAAS,CAAA;AASvD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,QAAQ,EAAE,mBAAmB,CAAA;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,oBAAqB,SAAQ,oBAAoB;IAChE,QAAQ,CAAC,OAAO,EAAE,wBAAwB,CAAA;IAC1C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAA;IACnC,QAAQ,CAAC,0BAA0B,CAAC,EAAE,MAAM,CAAA;CAC7C;AAED;;;;;;;;;;;;;GAaG;AACH,qBAAa,YAAY;IAIrB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,UAAU;IAJ7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAuC;gBAG5C,KAAK,EAAE,MAAM,EACb,UAAU,GAAE,MAAa;IAG5C,GAAG,CAAC,KAAK,EAAE,oBAAoB,GAAG,wBAAwB,GAAG,SAAS;IAkBtE,GAAG,CAAC,KAAK,EAAE,oBAAoB,GAAG,IAAI;IA4BtC,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAInC;;;;OAIG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQpC,KAAK,IAAI,IAAI;CAGd"}

package/dist/auth/sessions.d.ts

@@ -0,0 +1,16 @@
+export interface SessionCookieParts {
+    readonly sessionId: string;
+    readonly sessionSecret: string;
+}
+export interface SessionCredential {
+    readonly sessionId: string;
+    readonly sessionSecret: string;
+    readonly tokenHash: string;
+    readonly cookieValue: string;
+}
+export declare function generateSessionSecret(): string;
+export declare function hashSessionSecret(secret: string): string;
+export declare function formatSessionCookieValue(sessionId: string, sessionSecret: string): string;
+export declare function parseSessionCookieValue(value: string | undefined): SessionCookieParts | null;
+export declare function createSessionCredential(sessionId?: string): SessionCredential;
+//# sourceMappingURL=sessions.d.ts.map

package/dist/auth/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../../src/auth/sessions.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAA;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;IAC1B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAA;CAC7B;AAED,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C;AAED,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAExD;AAED,wBAAgB,wBAAwB,CAAC,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,MAAM,CAMzF;AAED,wBAAgB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,kBAAkB,GAAG,IAAI,CAc5F;AAED,wBAAgB,uBAAuB,CAAC,SAAS,SAAwB,GAAG,iBAAiB,CAQ5F"}

package/dist/auth/strategy.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Auth strategy provider contract (`@sixb/core/auth/strategy`).
+ *
+ * The contract auth-strategy packages (e.g. `@sixb/auth-magic-link`,
+ * `@sixb/auth-oidc`) implement, without the server-side auth runtime that
+ * `./index` carries. Strategy authors should not need anything beyond this
+ * entry plus the storage contracts from `@sixb/core/storage`.
+ */
+export type { AuthEmailDeliveryStatus, AuthInvitationRecipientInput, AuthInvitationRecipientResult, AuthInvitationRecipientStatus, AuthRequestResult, AuthStrategy, AuthStrategyKind, InvitationDeliveryAuthStrategy, InvitationDeliveryInput, InvitationRecipientInput, InvitationRecipientResult, InvitationRecipientStatus, InviteDeliveryResult, InviteDeliveryStatus, MagicLinkAuthStrategy, MagicLinkCallbackInput, MagicLinkCallbackResult, MagicLinkInvitationRecipientInput, MagicLinkInvitationRecipientResult, MagicLinkInvitationRecipientStatus, MagicLinkPeekInput, MagicLinkPeekResult, MagicLinkRequestInput, MagicLinkRequestResult, MagicLinkRequestStatus, OidcAuthStrategy, OidcCallbackInput, OidcCallbackResult, OidcStartSignInInput, OidcStartSignInResult, } from "./types";
+export { isInvitationDeliveryAuthStrategy, isMagicLinkAuthStrategy, isOidcAuthStrategy, } from "./validation";
+//# sourceMappingURL=strategy.d.ts.map

package/dist/auth/strategy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"strategy.d.ts","sourceRoot":"","sources":["../../src/auth/strategy.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,YAAY,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,6BAA6B,EAC7B,6BAA6B,EAC7B,iBAAiB,EACjB,YAAY,EACZ,gBAAgB,EAChB,8BAA8B,EAC9B,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,qBAAqB,EACrB,sBAAsB,EACtB,uBAAuB,EACvB,iCAAiC,EACjC,kCAAkC,EAClC,kCAAkC,EAClC,kBAAkB,EAClB,mBAAmB,EACnB,qBAAqB,EACrB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,oBAAoB,EACpB,qBAAqB,GACtB,MAAM,SAAS,CAAA;AAChB,OAAO,EACL,gCAAgC,EAChC,uBAAuB,EACvB,kBAAkB,GACnB,MAAM,cAAc,CAAA"}

package/dist/auth/strategy.js

@@ -0,0 +1,14 @@
+// @bun
+import {
+  isInvitationDeliveryAuthStrategy,
+  isMagicLinkAuthStrategy,
+  isOidcAuthStrategy
+} from "../chunk-xwnf87e1.js";
+import"../chunk-y64skrwp.js";
+export {
+  isOidcAuthStrategy,
+  isMagicLinkAuthStrategy,
+  isInvitationDeliveryAuthStrategy
+};
+
+//# debugId=4DB4B0F784B2311464756E2164756E21