@soulcraft/sdk 3.7.7 → 3.9.0

package/dist/modules/auth/request-middleware.d.ts

@@ -48,7 +48,7 @@
  *   getUser,
  * } from '@soulcraft/sdk/server'
  *
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  *
  * export const handle = async ({ event, resolve }) => {
@@ -66,7 +66,7 @@
  *   getUser,
  * } from '@soulcraft/sdk/server'
  *
- * const verifier = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifier = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { optionalAuth } = createRequestAuthMiddleware(verifier)
  *
  * Bun.serve({
@@ -243,7 +243,7 @@ export declare function getUser(req: Request): SoulcraftSessionUser | null;
  *
  * Pass the returned function to `createRequestAuthMiddleware`:
  * ```typescript
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  * ```
  *
@@ -272,8 +272,8 @@ export declare function createRemoteSessionVerifier(options: RemoteSessionVerifi
  * Designed as a drop-in replacement for `createRemoteSessionVerifier` in local dev:
  *
  * ```typescript
- * const verifySession = process.env.SOULCRAFT_IDP_URL
- *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL })
+ * const verifySession = process.env.SOULCRAFT_AUTH_URL
+ *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL })
  *   : createDevSessionVerifier({ role: 'owner' })
  *
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
@@ -286,8 +286,8 @@ export declare function createRemoteSessionVerifier(options: RemoteSessionVerifi
  *
  * @example
  * ```typescript
- * const verifySession = process.env.SOULCRAFT_IDP_URL
- *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL })
+ * const verifySession = process.env.SOULCRAFT_AUTH_URL
+ *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL })
  *   : createDevSessionVerifier({ role: 'owner' })
  *
  * export const handle = async ({ event, resolve }) => {
@@ -329,7 +329,7 @@ export declare function createDevCookieVerifier(cookieName?: string): SessionVer
  * Compose with `createRemoteSessionVerifier` to allow both authenticated and guest access:
  *
  * ```typescript
- * const verifyReal = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifyReal = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const verifyGuest = createGuestCookieVerifier()
  *
  * const { optionalAuth } = createRequestAuthMiddleware(async (cookie) =>
@@ -364,7 +364,7 @@ export declare function createGuestCookieVerifier(cookieName?: string): SessionV
  *
  * @example Verifier form (Venue / Academy / Workshop in OIDC mode)
  * ```typescript
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  *
  * // Use in any server:

package/dist/modules/auth/request-middleware.js

@@ -48,7 +48,7 @@
  *   getUser,
  * } from '@soulcraft/sdk/server'
  *
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  *
  * export const handle = async ({ event, resolve }) => {
@@ -66,7 +66,7 @@
  *   getUser,
  * } from '@soulcraft/sdk/server'
  *
- * const verifier = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifier = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { optionalAuth } = createRequestAuthMiddleware(verifier)
  *
  * Bun.serve({
@@ -168,7 +168,7 @@ function _decodeSessionCookie(value) {
  *
  * Pass the returned function to `createRequestAuthMiddleware`:
  * ```typescript
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  * ```
  *
@@ -260,8 +260,8 @@ export function createRemoteSessionVerifier(options) {
  * Designed as a drop-in replacement for `createRemoteSessionVerifier` in local dev:
  *
  * ```typescript
- * const verifySession = process.env.SOULCRAFT_IDP_URL
- *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL })
+ * const verifySession = process.env.SOULCRAFT_AUTH_URL
+ *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL })
  *   : createDevSessionVerifier({ role: 'owner' })
  *
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
@@ -274,8 +274,8 @@ export function createRemoteSessionVerifier(options) {
  *
  * @example
  * ```typescript
- * const verifySession = process.env.SOULCRAFT_IDP_URL
- *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL })
+ * const verifySession = process.env.SOULCRAFT_AUTH_URL
+ *   ? createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL })
  *   : createDevSessionVerifier({ role: 'owner' })
  *
  * export const handle = async ({ event, resolve }) => {
@@ -350,7 +350,7 @@ export function createDevCookieVerifier(cookieName = 'soulcraft_dev_session') {
  * Compose with `createRemoteSessionVerifier` to allow both authenticated and guest access:
  *
  * ```typescript
- * const verifyReal = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifyReal = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const verifyGuest = createGuestCookieVerifier()
  *
  * const { optionalAuth } = createRequestAuthMiddleware(async (cookie) =>
@@ -395,7 +395,7 @@ export function createGuestCookieVerifier(cookieName = 'soulcraft_guest_session'
  *
  * @example Verifier form (Venue / Academy / Workshop in OIDC mode)
  * ```typescript
- * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_IDP_URL! })
+ * const verifySession = createRemoteSessionVerifier({ idpUrl: process.env.SOULCRAFT_AUTH_URL! })
  * const { requireAuth } = createRequestAuthMiddleware(verifySession)
  *
  * // Use in any server:

package/dist/modules/auth/sveltekit.d.ts

@@ -3,22 +3,18 @@
  * @description Opinionated SvelteKit auth integration for Soulcraft products.
  *
  * `createSoulcraftAuth()` returns everything a SvelteKit product needs for auth:
- * a `Handle` hook, a backchannel-logout request handler, and a logout request handler.
- * One function, zero choices.
+ * a `Handle` hook and a logout handler. One function, zero choices.
  *
  * ## What it does
  *
- * - **Session resolution** — reads the IdP cross-domain cookie, verifies via
- *   `createRemoteSessionVerifier` (30s LRU cache) in production or
+ * - **Session resolution** — reads the `.soulcraft.com` session cookie, verifies
+ *   via `createRemoteSessionVerifier` (30s LRU cache) in production or
  *   `createDevCookieVerifier` in dev mode
  * - **Stale cookie recovery** — detects "cookie present but session null" and
  *   clears the stale cookie via `Set-Cookie: Max-Age=0`, breaking redirect loops
- * - **CSRF bypass** — rewrites the `origin` header for `POST /api/auth/backchannel-logout`
- *   so SvelteKit's built-in CSRF check doesn't block server-to-server IdP calls
  * - **User enrichment** — optional `enrichUser` callback for product-specific
  *   role resolution (e.g. Venue staff lookup, Portal admin check)
- * - **Backchannel logout** — verifies the HS256 JWT logout token from the IdP
- * - **Logout** — clears local cookies and returns the IdP end-session URL
+ * - **Logout** — clears local cookies, calls auth.soulcraft.com/api/auth/sign-out
  *
  * ## Usage
  *
@@ -29,9 +25,6 @@
  * const auth = createSoulcraftAuth({ product: 'venue' })
  * export const handle = auth.handle
  *
- * // routes/api/auth/backchannel-logout/+server.ts
- * export const POST = auth.backchannelHandler
- *
  * // routes/api/auth/logout/+server.ts
  * export const POST = auth.logoutHandler
  * ```
@@ -88,8 +81,8 @@ export interface SoulcraftAuthOptions {
     /**
      * Optional session verifier override. When omitted, the verifier is
      * auto-selected based on environment:
-     * - `SOULCRAFT_IDP_URL` set → `createRemoteSessionVerifier`
-     * - `SOULCRAFT_IDP_URL` unset → `createDevCookieVerifier`
+     * - `SOULCRAFT_AUTH_URL` set → `createRemoteSessionVerifier`
+     * - `SOULCRAFT_AUTH_URL` unset → `createDevCookieVerifier`
      */
     verifier?: SessionVerifier;
     /**
@@ -118,13 +111,7 @@ export interface SoulcraftAuthOptions {
      */
     devCookieName?: string;
     /**
-     * Path prefix for the backchannel-logout endpoint. The CSRF bypass
-     * rewrites the origin header for POST requests to this path.
-     * Default: `'/api/auth/backchannel-logout'`.
-     */
-    backchannelPath?: string;
-    /**
-     * Default role for auto-login in dev mode. When set and no `SOULCRAFT_IDP_URL`
+     * Default role for auto-login in dev mode. When set and no `SOULCRAFT_AUTH_URL`
      * is configured, the auth handle automatically creates a dev session on the
      * first request if no dev cookie is present. The developer is logged in the
      * moment the page loads — no manual `/api/dev/login` call needed.
@@ -140,8 +127,7 @@ export interface SoulcraftAuthOptions {
  */
 export interface SoulcraftAuth {
     /**
-     * SvelteKit `Handle` hook that resolves sessions, clears stale cookies,
-     * and bypasses CSRF for the backchannel-logout endpoint.
+     * SvelteKit `Handle` hook that resolves sessions and clears stale cookies.
      *
      * Use with `sequence()` if you have other hooks:
      * ```typescript
@@ -149,20 +135,6 @@ export interface SoulcraftAuth {
      * ```
      */
     handle: SvelteKitHandle;
-    /**
-     * SvelteKit request handler for `POST /api/auth/backchannel-logout`.
-     *
-     * Verifies the HS256 JWT logout token from the IdP. Returns 200 on
-     * success, 400 for malformed tokens. Since SvelteKit products hold no
-     * local sessions (auth state lives at the IdP), this endpoint only
-     * verifies the token and acknowledges receipt.
-     *
-     * Mount in `routes/api/auth/backchannel-logout/+server.ts`:
-     * ```typescript
-     * export const POST = auth.backchannelHandler
-     * ```
-     */
-    backchannelHandler: SvelteKitRequestHandler;
     /**
      * SvelteKit request handler for `POST /api/auth/logout`.
      *
@@ -234,18 +206,18 @@ export interface SoulcraftAuth {
 /**
  * @description Creates the complete SvelteKit auth integration for a Soulcraft product.
  *
- * Returns a `handle` hook, a `backchannelHandler`, and a `logoutHandler` — everything
- * needed for auth in a SvelteKit product. One function call replaces ~100 lines of
- * hand-rolled auth code in each product's hooks.server.ts.
+ * Returns a `handle` hook and a `logoutHandler` — everything needed for auth in a
+ * SvelteKit product. One function call replaces ~100 lines of hand-rolled auth code.
+ *
+ * Products authenticate via shared `.soulcraft.com` session cookies. No OIDC, no
+ * client secrets, no backchannel logout. Cookie deletion at sign-out logs out everywhere.
  *
  * **Environment variables read:**
- * - `SOULCRAFT_IDP_URL` — IdP base URL. Present → production mode. Absent → dev mode.
- * - `SOULCRAFT_OIDC_CLIENT_ID` — OIDC client ID. Falls back to `options.product`.
- * - `SOULCRAFT_OIDC_CLIENT_SECRET` — OIDC client secret. Required for backchannel logout.
- * - `BETTER_AUTH_URL` — This product's base URL. Used for `post_logout_redirect_uri`.
+ * - `SOULCRAFT_AUTH_URL` — Auth server URL. Present → production mode. Absent → dev mode.
+ *   No backward compatibility with `SOULCRAFT_IDP_URL` — rename to `SOULCRAFT_AUTH_URL`.
  *
  * @param options - Product name, optional verifier override, optional user enrichment.
- * @returns `{ handle, backchannelHandler, logoutHandler, verifySession }`.
+ * @returns `{ handle, logoutHandler, verifySession }`.
  *
  * @example Minimal setup (Workshop, Academy)
  * ```typescript
@@ -289,11 +261,11 @@ export interface BuildLoginUrlOptions {
 /**
  * @description Build the auth.soulcraft.com login URL for redirecting unauthenticated users.
  *
- * In production (SOULCRAFT_IDP_URL set), returns a URL to the central IdP login page
+ * In production (SOULCRAFT_AUTH_URL set), returns a URL to the central IdP login page
  * with `?redirect=`, `?product=`, and `?tenant=` query params. The IdP sets a
  * `.soulcraft.com` cookie and redirects back to the specified URL.
  *
- * In dev mode (no SOULCRAFT_IDP_URL), returns `/api/dev/login?redirect=<url>` so
+ * In dev mode (no SOULCRAFT_AUTH_URL), returns `/api/dev/login?redirect=<url>` so
  * developers hit the local dev login handler instead of the real IdP.
  *
  * @param options - Redirect URL, optional product and tenant context.

package/dist/modules/auth/sveltekit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAoB,MAAM,YAAY,CAAA;AAOxE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,OAAO,EAAE;QACP,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KACrD,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,cAAc,CAAA;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtD,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEvB;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAMlF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAE1B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,cAAc,KAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/D;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;OAIG;IACH,eAAe,CAAC,EAAE,MAAM,CAAA;IAExB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,GAAG,KAAK,CAAA;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;;OAQG;IACH,MAAM,EAAE,eAAe,CAAA;IAEvB;;;;;;;;;;;;OAYG;IACH,kBAAkB,EAAE,uBAAuB,CAAA;IAE3C;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,uBAAuB,CAAA;IAEtC;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,uBAAuB,CAAA;IAErC;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,uBAAuB,CAAA;IAExC;;;;;;;;;OASG;IACH,cAAc,EAAE,uBAAuB,CAAA;IAEvC;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,CAAA;IAEpD;;;OAGG;IACH,aAAa,EAAE,eAAe,CAAA;CAC/B;AAuFD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAkThF;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAE5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAiBnE"}
+{"version":3,"file":"sveltekit.d.ts","sourceRoot":"","sources":["../../../src/modules/auth/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AAC9D,OAAO,KAAK,EAAE,oBAAoB,EAAoB,MAAM,YAAY,CAAA;AAOxE;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,OAAO,CAAA;IAChB,GAAG,EAAE,GAAG,CAAA;IACR,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC/B,OAAO,EAAE;QACP,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;YAAE,IAAI,CAAC,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAA;KACrD,CAAA;CACF;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE;IACpC,KAAK,EAAE,cAAc,CAAA;IACrB,OAAO,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CACtD,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEvB;;GAEG;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,KAAK,EAAE,cAAc,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAMlF;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;;OAIG;IACH,OAAO,EAAE,MAAM,CAAA;IAEf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,eAAe,CAAA;IAE1B;;;;;;;;;;;;;;;;;;OAkBG;IACH,UAAU,CAAC,EAAE,CACX,IAAI,EAAE,oBAAoB,EAC1B,KAAK,EAAE,cAAc,KAClB,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAE/D;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;IAEtB;;;;;;;;;OASG;IACH,cAAc,CAAC,EAAE,oBAAoB,CAAC,cAAc,CAAC,GAAG,KAAK,CAAA;CAC9D;AAED;;GAEG;AACH,MAAM,WAAW,aAAa;IAC5B;;;;;;;OAOG;IACH,MAAM,EAAE,eAAe,CAAA;IAEvB;;;;;;;;;;;OAWG;IACH,aAAa,EAAE,uBAAuB,CAAA;IAEtC;;;;;;;;;;;OAWG;IACH,YAAY,EAAE,uBAAuB,CAAA;IAErC;;;;;;;;;;;OAWG;IACH,eAAe,EAAE,uBAAuB,CAAA;IAExC;;;;;;;;;OASG;IACH,cAAc,EAAE,uBAAuB,CAAA;IAEvC;;;;;;;;;;OAUG;IACH,eAAe,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,QAAQ,CAAA;IAEpD;;;OAGG;IACH,aAAa,EAAE,eAAe,CAAA;CAC/B;AAuBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,oBAAoB,GAAG,aAAa,CAsOhF;AAMD;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC;;;OAGG;IACH,WAAW,EAAE,MAAM,CAAA;IAEnB;;;OAGG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;IAE5B;;;;OAIG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;CAC5B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,CAiBnE"}

package/dist/modules/auth/sveltekit.js

@@ -3,22 +3,18 @@
  * @description Opinionated SvelteKit auth integration for Soulcraft products.
  *
  * `createSoulcraftAuth()` returns everything a SvelteKit product needs for auth:
- * a `Handle` hook, a backchannel-logout request handler, and a logout request handler.
- * One function, zero choices.
+ * a `Handle` hook and a logout handler. One function, zero choices.
  *
  * ## What it does
  *
- * - **Session resolution** — reads the IdP cross-domain cookie, verifies via
- *   `createRemoteSessionVerifier` (30s LRU cache) in production or
+ * - **Session resolution** — reads the `.soulcraft.com` session cookie, verifies
+ *   via `createRemoteSessionVerifier` (30s LRU cache) in production or
  *   `createDevCookieVerifier` in dev mode
  * - **Stale cookie recovery** — detects "cookie present but session null" and
  *   clears the stale cookie via `Set-Cookie: Max-Age=0`, breaking redirect loops
- * - **CSRF bypass** — rewrites the `origin` header for `POST /api/auth/backchannel-logout`
- *   so SvelteKit's built-in CSRF check doesn't block server-to-server IdP calls
  * - **User enrichment** — optional `enrichUser` callback for product-specific
  *   role resolution (e.g. Venue staff lookup, Portal admin check)
- * - **Backchannel logout** — verifies the HS256 JWT logout token from the IdP
- * - **Logout** — clears local cookies and returns the IdP end-session URL
+ * - **Logout** — clears local cookies, calls auth.soulcraft.com/api/auth/sign-out
  *
  * ## Usage
  *
@@ -29,9 +25,6 @@
  * const auth = createSoulcraftAuth({ product: 'venue' })
  * export const handle = auth.handle
  *
- * // routes/api/auth/backchannel-logout/+server.ts
- * export const POST = auth.backchannelHandler
- *
  * // routes/api/auth/logout/+server.ts
  * export const POST = auth.logoutHandler
  * ```
@@ -62,68 +55,24 @@ const SESSION_COOKIE = '__Secure-better-auth.session_token';
  * Attributes mirror the IdP's original cookie so the browser accepts it.
  */
 const CLEAR_SESSION_COOKIE = `${SESSION_COOKIE}=; Domain=.soulcraft.com; Path=/; Max-Age=0; Secure; HttpOnly; SameSite=Lax`;
-/** OIDC Back-Channel Logout event URI (per spec). */
-const BACKCHANNEL_LOGOUT_EVENT = 'http://schemas.openid.net/event/backchannel-logout';
-// ─────────────────────────────────────────────────────────────────────────────
-// JWT verification (Web Crypto API — no external deps)
-// ─────────────────────────────────────────────────────────────────────────────
-/**
- * Verify an HS256 JWT using the Web Crypto API.
- *
- * @param token - Raw JWT string (`header.payload.signature`).
- * @param secret - HMAC secret for signature verification.
- * @returns The decoded payload if the signature is valid, or null.
- */
-async function verifyHS256JWT(token, secret) {
-    const parts = token.split('.');
-    if (parts.length !== 3)
-        return null;
-    const [headerB64, payloadB64, sigB64] = parts;
-    let key;
-    try {
-        key = await crypto.subtle.importKey('raw', new TextEncoder().encode(secret), { name: 'HMAC', hash: 'SHA-256' }, false, ['verify']);
-    }
-    catch {
-        return null;
-    }
-    const signingInput = `${headerB64}.${payloadB64}`;
-    let sigBytes;
-    try {
-        sigBytes = Uint8Array.from(atob(sigB64.replace(/-/g, '+').replace(/_/g, '/')), (c) => c.charCodeAt(0));
-    }
-    catch {
-        return null;
-    }
-    const valid = await crypto.subtle.verify('HMAC', key, sigBytes.buffer, new TextEncoder().encode(signingInput));
-    if (!valid)
-        return null;
-    try {
-        const padded = payloadB64.replace(/-/g, '+').replace(/_/g, '/') +
-            '=='.slice(0, (4 - (payloadB64.length % 4)) % 4);
-        return JSON.parse(atob(padded));
-    }
-    catch {
-        return null;
-    }
-}
 // ─────────────────────────────────────────────────────────────────────────────
 // createSoulcraftAuth
 // ─────────────────────────────────────────────────────────────────────────────
 /**
  * @description Creates the complete SvelteKit auth integration for a Soulcraft product.
  *
- * Returns a `handle` hook, a `backchannelHandler`, and a `logoutHandler` — everything
- * needed for auth in a SvelteKit product. One function call replaces ~100 lines of
- * hand-rolled auth code in each product's hooks.server.ts.
+ * Returns a `handle` hook and a `logoutHandler` — everything needed for auth in a
+ * SvelteKit product. One function call replaces ~100 lines of hand-rolled auth code.
+ *
+ * Products authenticate via shared `.soulcraft.com` session cookies. No OIDC, no
+ * client secrets, no backchannel logout. Cookie deletion at sign-out logs out everywhere.
  *
  * **Environment variables read:**
- * - `SOULCRAFT_IDP_URL` — IdP base URL. Present → production mode. Absent → dev mode.
- * - `SOULCRAFT_OIDC_CLIENT_ID` — OIDC client ID. Falls back to `options.product`.
- * - `SOULCRAFT_OIDC_CLIENT_SECRET` — OIDC client secret. Required for backchannel logout.
- * - `BETTER_AUTH_URL` — This product's base URL. Used for `post_logout_redirect_uri`.
+ * - `SOULCRAFT_AUTH_URL` — Auth server URL. Present → production mode. Absent → dev mode.
+ *   No backward compatibility with `SOULCRAFT_IDP_URL` — rename to `SOULCRAFT_AUTH_URL`.
  *
  * @param options - Product name, optional verifier override, optional user enrichment.
- * @returns `{ handle, backchannelHandler, logoutHandler, verifySession }`.
+ * @returns `{ handle, logoutHandler, verifySession }`.
  *
  * @example Minimal setup (Workshop, Academy)
  * ```typescript
@@ -143,9 +92,9 @@ async function verifyHS256JWT(token, secret) {
  * ```
  */
 export function createSoulcraftAuth(options) {
-    const { product, enrichUser, devCookieName = 'soulcraft_dev_session', backchannelPath = '/api/auth/backchannel-logout', defaultDevRole = 'owner', } = options;
+    const { product, enrichUser, devCookieName = 'soulcraft_dev_session', defaultDevRole = 'owner', } = options;
     // ── Session verifier selection ──────────────────────────────────────────
-    const idpUrl = process.env['SOULCRAFT_IDP_URL'];
+    const idpUrl = process.env['SOULCRAFT_AUTH_URL'];
     const isDevMode = !idpUrl;
     const verifySession = options.verifier
         ?? (idpUrl
@@ -242,15 +191,6 @@ export function createSoulcraftAuth(options) {
     };
     // ── Handle hook ─────────────────────────────────────────────────────────
     const handle = async ({ event, resolve }) => {
-        // CSRF bypass for backchannel-logout — the IdP sends server-to-server
-        // POST requests without a browser origin header. Rewrite it so
-        // SvelteKit's CSRF check passes. The endpoint itself verifies the JWT.
-        if (event.url.pathname === backchannelPath &&
-            event.request.method === 'POST') {
-            const headers = new Headers(event.request.headers);
-            headers.set('origin', event.url.origin);
-            event.request = new Request(event.request, { headers });
-        }
         // Resolve session
         const cookieHeader = event.request.headers.get('cookie') ?? '';
         let session = await verifySession(cookieHeader);
@@ -315,76 +255,25 @@ export function createSoulcraftAuth(options) {
         }
         return resolve(event);
     };
-    // ── Backchannel logout handler ──────────────────────────────────────────
-    const backchannelHandler = async ({ request }) => {
-        const clientSecret = process.env['SOULCRAFT_OIDC_CLIENT_SECRET'];
-        const idpUrlEnv = process.env['SOULCRAFT_IDP_URL'];
-        const clientId = process.env['SOULCRAFT_OIDC_CLIENT_ID'] ?? product;
-        // Only operates in OIDC client mode
-        if (!clientSecret || !idpUrlEnv) {
-            return new Response(null, { status: 200 });
-        }
-        // Parse logout_token from form body
-        let logoutToken = null;
-        try {
-            const body = await request.text();
-            const params = new URLSearchParams(body);
-            logoutToken = params.get('logout_token');
-        }
-        catch {
-            return new Response('malformed request body', { status: 400 });
-        }
-        if (!logoutToken) {
-            return new Response('missing logout_token', { status: 400 });
-        }
-        // Verify JWT signature and claims
-        const payload = await verifyHS256JWT(logoutToken, clientSecret);
-        if (!payload) {
-            return new Response('invalid logout_token', { status: 400 });
-        }
-        // Validate issuer
-        const expectedIss = idpUrlEnv.replace(/\/$/, '');
-        if (payload['iss'] !== expectedIss) {
-            return new Response('invalid issuer', { status: 400 });
-        }
-        // Validate audience
-        const aud = payload['aud'];
-        const audList = Array.isArray(aud) ? aud : [String(aud ?? '')];
-        if (!audList.includes(clientId)) {
-            return new Response('invalid audience', { status: 400 });
-        }
-        // Validate events claim
-        const events = payload['events'];
-        if (!events || !(BACKCHANNEL_LOGOUT_EVENT in events)) {
-            return new Response('missing backchannel-logout event claim', { status: 400 });
-        }
-        // Validate sub claim
-        if (!payload['sub'] || typeof payload['sub'] !== 'string') {
-            return new Response('missing sub claim', { status: 400 });
-        }
-        // SvelteKit products hold no local sessions — auth state lives at the IdP.
-        // The SDK verifier's 30s LRU cache will expire naturally.
-        return new Response(null, { status: 200 });
-    };
     // ── Logout handler ──────────────────────────────────────────────────────
-    const logoutHandler = async ({ cookies, url }) => {
-        const idpUrlEnv = process.env['SOULCRAFT_IDP_URL'];
-        if (!idpUrlEnv) {
-            // Dev mode — clear the dev session cookie and redirect home
+    // Clears the local dev cookie (if dev mode) and calls the auth server's
+    // sign-out endpoint to clear the .soulcraft.com session cookie.
+    const logoutHandler = async ({ request, cookies, url }) => {
+        if (isDevMode) {
             cookies.delete(devCookieName, { path: '/' });
             return new Response(JSON.stringify({ redirect: '/' }), {
                 headers: { 'Content-Type': 'application/json' },
             });
         }
-        // OIDC mode — build the IdP end-session URL
-        const clientId = process.env['SOULCRAFT_OIDC_CLIENT_ID'] ?? product;
-        const baseUrl = process.env['BETTER_AUTH_URL'] ?? `${url.protocol}//${url.host}`;
-        const params = new URLSearchParams({
-            client_id: clientId,
-            post_logout_redirect_uri: `${baseUrl}/`,
-        });
-        const endSessionUrl = `${idpUrlEnv}/api/auth/oauth2/endsession?${params}`;
-        return new Response(JSON.stringify({ redirect: endSessionUrl }), {
+        // Call auth server sign-out (clears the .soulcraft.com cookie)
+        try {
+            await fetch(`${idpUrl}/api/auth/sign-out`, {
+                method: 'POST',
+                headers: { cookie: request.headers.get('cookie') ?? '' },
+            });
+        }
+        catch { /* sign-out is best-effort */ }
+        return new Response(JSON.stringify({ redirect: '/' }), {
             headers: { 'Content-Type': 'application/json' },
         });
     };
@@ -398,7 +287,6 @@ export function createSoulcraftAuth(options) {
         startHandler,
         callbackHandler,
         sessionHandler,
-        backchannelHandler,
         logoutHandler,
         devLoginHandler,
         verifySession,
@@ -407,11 +295,11 @@ export function createSoulcraftAuth(options) {
 /**
  * @description Build the auth.soulcraft.com login URL for redirecting unauthenticated users.
  *
- * In production (SOULCRAFT_IDP_URL set), returns a URL to the central IdP login page
+ * In production (SOULCRAFT_AUTH_URL set), returns a URL to the central IdP login page
  * with `?redirect=`, `?product=`, and `?tenant=` query params. The IdP sets a
  * `.soulcraft.com` cookie and redirects back to the specified URL.
  *
- * In dev mode (no SOULCRAFT_IDP_URL), returns `/api/dev/login?redirect=<url>` so
+ * In dev mode (no SOULCRAFT_AUTH_URL), returns `/api/dev/login?redirect=<url>` so
  * developers hit the local dev login handler instead of the real IdP.
  *
  * @param options - Redirect URL, optional product and tenant context.
@@ -429,13 +317,13 @@ export function createSoulcraftAuth(options) {
  * ```
  */
 export function buildLoginUrl(options) {
-    const idpUrl = process.env['SOULCRAFT_IDP_URL'];
-    if (!idpUrl) {
+    const authUrl = process.env['SOULCRAFT_AUTH_URL'];
+    if (!authUrl) {
         // Dev mode — use the local dev login endpoint
         const params = new URLSearchParams({ redirect: options.redirectUrl });
         return `/api/dev/login?${params}`;
     }
-    // Production — redirect to the central IdP login page
+    // Production — redirect to the auth server login page
     const params = new URLSearchParams({
         redirect: options.redirectUrl,
     });
@@ -443,6 +331,6 @@ export function buildLoginUrl(options) {
         params.set('product', options.product);
     if (options.tenant)
         params.set('tenant', options.tenant);
-    return `${idpUrl.replace(/\/$/, '')}/login?${params}`;
+    return `${authUrl.replace(/\/$/, '')}/login?${params}`;
 }
 //# sourceMappingURL=sveltekit.js.map

package/dist/modules/auth/sveltekit.js.map

@@ -1 +1 @@
-{"version":3,"file":"sveltekit.js","sourceRoot":"","sources":["../../../src/modules/auth/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AAG5H,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AAkN9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAE3D;;;GAGG;AACH,MAAM,oBAAoB,GACxB,GAAG,cAAc,6EAA6E,CAAA;AAEhG,qDAAqD;AACrD,MAAM,wBAAwB,GAAG,oDAAoD,CAAA;AAErF,gFAAgF;AAChF,uDAAuD;AACvD,gFAAgF;AAEhF;;;;;;GAMG;AACH,KAAK,UAAU,cAAc,CAC3B,KAAa,EACb,MAAc;IAEd,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAA;IAEnC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAA;IAEzE,IAAI,GAAc,CAAA;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACjC,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,IAAI,UAAU,EAAE,CAAA;IACjD,IAAI,QAAoB,CAAA;IACxB,IAAI,CAAC;QACH,QAAQ,GAAG,UAAU,CAAC,IAAI,CACxB,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAClD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CACvB,CAAA;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACtC,MAAM,EACN,GAAG,EACH,QAAQ,CAAC,MAAqB,EAC9B,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CACvC,CAAA;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IAEvB,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;YAC7D,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAClD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAA4B,CAAA;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,EACJ,OAAO,EACP,UAAU,EACV,aAAa,GAAG,uBAAuB,EACvC,eAAe,GAAG,8BAA8B,EAChD,cAAc,GAAG,OAAO,GACzB,GAAG,OAAO,CAAA;IAEX,2EAA2E;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAC/C,MAAM,SAAS,GAAG,CAAC,MAAM,CAAA;IACzB,MAAM,aAAa,GAAoB,OAAO,CAAC,QAAQ;WAClD,CAAC,MAAM;YACR,CAAC,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAA;IAE7C,2EAA2E;IAC3E,IAAI,SAAS,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,iBAAiB,cAAc,GAAG,CAAC,CAAA;QAC1E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACf,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAElE,uCAAuC;IACvC,MAAM,YAAY,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAA;QAErE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,cAAc,IAAI,OAAO,CAAA;YACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,OAAO,aAAa,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAClJ,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;eACrC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO;gBAC5D,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAEvB,MAAM,WAAW,GAAG,GAAG,YAAY,4BAA4B,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAA;QACjG,MAAM,OAAO,GAAG,GAAG,MAAM,uBAAuB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;QACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC,CAAA;IAED,8DAA8D;IAC9D,MAAM,eAAe,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,IAAI,IAAI,GAAmC,IAAI,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,MAAM,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;YACvF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YACpC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwC,CAAA;gBACnE,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAA;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;QAC7G,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACzC,MAAM,WAAW,GAAqB;YACpC,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,KAAK;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChC,KAAK,EAAG,IAAI,CAAC,OAAO,CAAmB,IAAI,IAAI;gBAC/C,YAAY,EAAG,IAAI,CAAC,cAAc,CAA0C,IAAI,SAAS;gBACzF,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;aACnF;YACD,SAAS,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE;YACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAChD,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAA;QAE5G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACtF,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE;YACpC,GAAG,aAAa,IAAI,OAAO,EAAE;YAC7B,QAAQ;YACR,UAAU;YACV,cAAc;YACd,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACtB,gBAAgB;SACjB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7B,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IAED,oDAAoD;IACpD,MAAM,cAAc,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAmC,CAAA;QACnE,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE;gBACJ,EAAE,EAAG,IAAY,CAAC,EAAE;gBACpB,KAAK,EAAG,IAAY,CAAC,KAAK;gBAC1B,IAAI,EAAG,IAAY,CAAC,IAAI;gBACxB,KAAK,EAAG,IAAY,CAAC,KAAK,IAAI,IAAI;aACnC;SACF,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,2EAA2E;IAC3E,MAAM,MAAM,GAAoB,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3D,sEAAsE;QACtE,+DAA+D;QAC/D,uEAAuE;QACvE,IACE,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,eAAe;YACtC,KAAK,CAAC,OAAO,CAAC,MAAM,KAAK,MAAM,EAC/B,CAAC;YACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;YAClD,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YACvC,KAAK,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAA;QACzD,CAAC;QAED,kBAAkB;QAClB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC9D,IAAI,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAA;QAE/C,uEAAuE;QACvE,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9D,IAAI,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;YAC3D,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,SAAS,IAAI,CAAC,OAAO,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,cAAc,CAAA;YAC3B,MAAM,KAAK,GAAG,OAAO,IAAI,gBAAgB,CAAA;YACzC,MAAM,WAAW,GAAqB;gBACpC,IAAI,EAAE;oBACJ,EAAE,EAAE,YAAY,IAAI,EAAE;oBACtB,KAAK;oBACL,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;oBAC3D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC;iBACnC;gBACD,SAAS,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;aACnC,CAAA;YAED,OAAO,GAAG,WAAW,CAAA;YAErB,oEAAoE;YACpE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YAClF,MAAM,SAAS,GAAG;gBAChB,GAAG,aAAa,IAAI,WAAW,EAAE;gBACjC,QAAQ;gBACR,UAAU;gBACV,cAAc;gBACd,eAAe;aAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,kEAAkE;YAClE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAA;YAChG,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;gBAC3C,CAAC,CAAC,WAAW,CAAC,IAAI,CAAA;YACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;YAE3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;YAChD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,oCAAoC;QACpC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;YAChE,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;YAChB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC7B,CAAC;QAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC,CAAA;IAED,2EAA2E;IAC3E,MAAM,kBAAkB,GAA4B,KAAK,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE;QACxE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAA;QAChE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QAClD,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAA;QAEnE,oCAAoC;QACpC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC5C,CAAC;QAED,oCAAoC;QACpC,IAAI,WAAW,GAAkB,IAAI,CAAA;QACrC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAA;YACjC,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,CAAA;YACxC,WAAW,GAAG,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAA;QAC1C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,QAAQ,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAChE,CAAC;QAED,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,kCAAkC;QAClC,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;QAC/D,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,IAAI,QAAQ,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC9D,CAAC;QAED,kBAAkB;QAClB,MAAM,WAAW,GAAG,SAAS,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;QAChD,IAAI,OAAO,CAAC,KAAK,CAAC,KAAK,WAAW,EAAE,CAAC;YACnC,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QACxD,CAAC;QAED,oBAAoB;QACpB,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAA;QAC1B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAe,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAA;QAC1E,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;YAChC,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC1D,CAAC;QAED,wBAAwB;QACxB,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAwC,CAAA;QACvE,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,wBAAwB,IAAI,MAAM,CAAC,EAAE,CAAC;YACrD,OAAO,IAAI,QAAQ,CAAC,wCAAwC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAChF,CAAC;QAED,qBAAqB;QACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC1D,OAAO,IAAI,QAAQ,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;QAC3D,CAAC;QAED,2EAA2E;QAC3E,0DAA0D;QAC1D,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAA;IAC5C,CAAC,CAAA;IAED,2EAA2E;IAC3E,MAAM,aAAa,GAA4B,KAAK,EAAE,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QACxE,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;QAElD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,4DAA4D;YAC5D,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;gBACrD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,4CAA4C;QAC5C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,0BAA0B,CAAC,IAAI,OAAO,CAAA;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,GAAG,GAAG,CAAC,QAAQ,KAAK,GAAG,CAAC,IAAI,EAAE,CAAA;QAChF,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YACjC,SAAS,EAAE,QAAQ;YACnB,wBAAwB,EAAE,GAAG,OAAO,GAAG;SACxC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,GAAG,SAAS,+BAA+B,MAAM,EAAE,CAAA;QACzE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,EAAE;YAC/D,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC/C,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,CAAC,KAAqB,EAAY,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEvF,OAAO;QACL,MAAM;QACN,YAAY;QACZ,eAAe;QACf,cAAc;QACd,kBAAkB;QAClB,aAAa;QACb,eAAe;QACf,aAAa;KACd,CAAA;AACH,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAA;IAE/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,8CAA8C;QAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACrE,OAAO,kBAAkB,MAAM,EAAE,CAAA;IACnC,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,QAAQ,EAAE,OAAO,CAAC,WAAW;KAC9B,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAExD,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,MAAM,EAAE,CAAA;AACvD,CAAC"}
+{"version":3,"file":"sveltekit.js","sourceRoot":"","sources":["../../../src/modules/auth/sveltekit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EAAE,2BAA2B,EAAE,uBAAuB,EAAE,4BAA4B,EAAE,MAAM,yBAAyB,CAAA;AAG5H,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAA;AA2L9C,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF;;;GAGG;AACH,MAAM,cAAc,GAAG,oCAAoC,CAAA;AAE3D;;;GAGG;AACH,MAAM,oBAAoB,GACxB,GAAG,cAAc,6EAA6E,CAAA;AAEhG,gFAAgF;AAChF,sBAAsB;AACtB,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAA6B;IAC/D,MAAM,EACJ,OAAO,EACP,UAAU,EACV,aAAa,GAAG,uBAAuB,EACvC,cAAc,GAAG,OAAO,GACzB,GAAG,OAAO,CAAA;IAEX,2EAA2E;IAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAChD,MAAM,SAAS,GAAG,CAAC,MAAM,CAAA;IACzB,MAAM,aAAa,GAAoB,OAAO,CAAC,QAAQ;WAClD,CAAC,MAAM;YACR,CAAC,CAAC,2BAA2B,CAAC,EAAE,MAAM,EAAE,CAAC;YACzC,CAAC,CAAC,uBAAuB,CAAC,aAAa,CAAC,CAAC,CAAA;IAE7C,2EAA2E;IAC3E,IAAI,SAAS,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,CAAC,CAAA;QAClE,OAAO,CAAC,GAAG,CAAC,oBAAoB,OAAO,iBAAiB,cAAc,GAAG,CAAC,CAAA;QAC1E,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAA;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,wBAAwB,IAAI,EAAE,CAAC,CAAA;QACrE,CAAC;QACD,OAAO,CAAC,GAAG,EAAE,CAAA;IACf,CAAC;IAED,uEAAuE;IACvE,oEAAoE;IACpE,kEAAkE;IAElE,uCAAuC;IACvC,MAAM,YAAY,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC5D,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,GAAG,CAAA;QAErE,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,OAAO,GAAG,cAAc,IAAI,OAAO,CAAA;YACzC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,uBAAuB,OAAO,aAAa,kBAAkB,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,CAAC,CAAA;QAClJ,CAAC;QAED,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;eACrC,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO;gBAC5D,CAAC,CAAC,WAAW,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE;gBAC7B,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAEvB,MAAM,WAAW,GAAG,GAAG,YAAY,4BAA4B,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAA;QACjG,MAAM,OAAO,GAAG,GAAG,MAAM,uBAAuB,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAA;QACjF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,CAAA;IAC5E,CAAC,CAAA;IAED,8DAA8D;IAC9D,MAAM,eAAe,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC/D,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;QAC/C,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,EAAE,CAAC,CAAA;QAClF,CAAC;QAED,IAAI,IAAI,GAAmC,IAAI,CAAA;QAC/C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,GAAG,MAAM,gCAAgC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAA;YACvF,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,CAAA;YACpC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;gBACX,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAwC,CAAA;gBACnE,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAA;YAC1B,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;QAEjC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,wCAAwC,EAAE,EAAE,CAAC,CAAA;QAC7G,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAA;QACzC,MAAM,WAAW,GAAqB;YACpC,IAAI,EAAE;gBACJ,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,KAAK;gBACL,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;gBAChC,KAAK,EAAG,IAAI,CAAC,OAAO,CAAmB,IAAI,IAAI;gBAC/C,YAAY,EAAG,IAAI,CAAC,cAAc,CAA0C,IAAI,SAAS;gBACzF,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC;aACnF;YACD,SAAS,EAAE,gBAAgB,IAAI,CAAC,GAAG,EAAE,EAAE;YACvC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;SAChD,CAAA;QAED,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QAC9E,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,GAAG,CAAA;QAChE,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,KAAK,OAAO,CAAA;QAE5G,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,EAAE,CAAC,CAAA;QACtF,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE;YACpC,GAAG,aAAa,IAAI,OAAO,EAAE;YAC7B,QAAQ;YACR,UAAU;YACV,cAAc;YACd,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;YACtB,gBAAgB;SACjB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7B,OAAO,QAAQ,CAAA;IACjB,CAAC,CAAA;IAED,oDAAoD;IACpD,MAAM,cAAc,GAA4B,KAAK,EAAE,KAAK,EAAE,EAAE;QAC9D,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,CAAmC,CAAA;QACnE,IAAI,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,CAAA;QACzD,OAAO,QAAQ,CAAC,IAAI,CAAC;YACnB,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE;gBACJ,EAAE,EAAG,IAAY,CAAC,EAAE;gBACpB,KAAK,EAAG,IAAY,CAAC,KAAK;gBAC1B,IAAI,EAAG,IAAY,CAAC,IAAI;gBACxB,KAAK,EAAG,IAAY,CAAC,KAAK,IAAI,IAAI;aACnC;SACF,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,2EAA2E;IAC3E,MAAM,MAAM,GAAoB,KAAK,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE;QAC3D,kBAAkB;QAClB,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAA;QAC9D,IAAI,OAAO,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,CAAA;QAE/C,uEAAuE;QACvE,MAAM,gBAAgB,GAAG,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAA;QAC9D,IAAI,gBAAgB,IAAI,CAAC,OAAO,EAAE,CAAC;YACjC,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,oBAAoB,CAAC,CAAA;YAC3D,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,uEAAuE;QACvE,sEAAsE;QACtE,qEAAqE;QACrE,+DAA+D;QAC/D,IAAI,SAAS,IAAI,CAAC,OAAO,IAAI,cAAc,KAAK,KAAK,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,cAAc,CAAA;YAC3B,MAAM,KAAK,GAAG,OAAO,IAAI,gBAAgB,CAAA;YACzC,MAAM,WAAW,GAAqB;gBACpC,IAAI,EAAE;oBACJ,EAAE,EAAE,YAAY,IAAI,EAAE;oBACtB,KAAK;oBACL,IAAI,EAAE,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE;oBAC3D,KAAK,EAAE,IAAI;oBACX,YAAY,EAAE,IAAI;oBAClB,SAAS,EAAE,gBAAgB,CAAC,KAAK,CAAC;iBACnC;gBACD,SAAS,EAAE,oBAAoB,IAAI,CAAC,GAAG,EAAE,EAAE;gBAC3C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU;aACnC,CAAA;YAED,OAAO,GAAG,WAAW,CAAA;YAErB,oEAAoE;YACpE,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;YAClF,MAAM,SAAS,GAAG;gBAChB,GAAG,aAAa,IAAI,WAAW,EAAE;gBACjC,QAAQ;gBACR,UAAU;gBACV,cAAc;gBACd,eAAe;aAChB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAEZ,kEAAkE;YAClE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,SAAS,EAAE,CAAA;YAChG,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,MAAM,UAAU,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC;gBAC3C,CAAC,CAAC,WAAW,CAAC,IAAI,CAAA;YACpB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;YAE3B,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAA;YACrC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,SAAS,CAAC,CAAA;YAChD,OAAO,QAAQ,CAAA;QACjB,CAAC;QAED,oCAAoC;QACpC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,OAAO;YAC/B,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;YAChE,CAAC,CAAC,IAAI,CAAA;QAER,IAAI,OAAO,EAAE,CAAC;YACZ,MAAM,IAAI,GAAG,UAAU;gBACrB,CAAC,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;gBACvC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAA;YAChB,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC7B,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,CAAA;QAC7B,CAAC;QAED,OAAO,OAAO,CAAC,KAAK,CAAC,CAAA;IACvB,CAAC,CAAA;IAED,2EAA2E;IAC3E,wEAAwE;IACxE,gEAAgE;IAChE,MAAM,aAAa,GAA4B,KAAK,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE;QACjF,IAAI,SAAS,EAAE,CAAC;YACd,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAA;YAC5C,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;gBACrD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;aAChD,CAAC,CAAA;QACJ,CAAC;QAED,+DAA+D;QAC/D,IAAI,CAAC;YACH,MAAM,KAAK,CAAC,GAAG,MAAM,oBAAoB,EAAE;gBACzC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE;aACzD,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC,CAAC,6BAA6B,CAAC,CAAC;QAEzC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE;YACrD,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;SAChD,CAAC,CAAA;IACJ,CAAC,CAAA;IAED,0EAA0E;IAC1E,MAAM,WAAW,GAAG,4BAA4B,CAAC;QAC/C,UAAU,EAAE,aAAa;KAC1B,CAAC,CAAA;IACF,MAAM,eAAe,GAAG,CAAC,KAAqB,EAAY,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAEvF,OAAO;QACL,MAAM;QACN,YAAY;QACZ,eAAe;QACf,cAAc;QACd,aAAa;QACb,eAAe;QACf,aAAa;KACd,CAAA;AACH,CAAC;AA8BD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,aAAa,CAAC,OAA6B;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAA;IAEjD,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,8CAA8C;QAC9C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAA;QACrE,OAAO,kBAAkB,MAAM,EAAE,CAAA;IACnC,CAAC;IAED,sDAAsD;IACtD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,QAAQ,EAAE,OAAO,CAAC,WAAW;KAC9B,CAAC,CAAA;IACF,IAAI,OAAO,CAAC,OAAO;QAAE,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAA;IAC3D,IAAI,OAAO,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAExD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,MAAM,EAAE,CAAA;AACxD,CAAC"}

package/dist/modules/auth/types.d.ts

@@ -123,34 +123,6 @@ export interface SoulcraftSession {
     /** Session expiry timestamp (Unix milliseconds). */
     expiresAt: number;
 }
-/**
- * Configuration for a product registering as an OIDC client of the central IdP.
- *
- * Used when `SOULCRAFT_IDP_URL` is set. Without it, each product runs
- * better-auth standalone with its own SQLite auth database.
- */
-export interface OIDCClientConfig {
-    /** The central IdP base URL. @example "https://auth.soulcraft.com" */
-    idpUrl: string;
-    /** This product's OIDC client ID as registered with the central IdP. */
-    clientId: string;
-    /** This product's OIDC client secret. */
-    clientSecret: string;
-    /**
-     * This product's redirect URI for OIDC callbacks.
-     *
-     * Optional — better-auth's genericOAuth plugin derives it automatically from
-     * `BETTER_AUTH_URL` as `${BETTER_AUTH_URL}/api/auth/oauth2/callback/:providerId`.
-     */
-    redirectUri?: string;
-}
-/**
- * The SSO mode this product instance is operating in.
- *
- * - `standalone`   — better-auth handles auth locally (dev or before central IdP)
- * - `oidc-client`  — better-auth delegates to auth.soulcraft.com
- */
-export type AuthMode = 'standalone' | 'oidc-client';
 /**
  * @description The sdk.auth namespace on SoulcraftSDK.
  *