@spfn/auth 0.2.0-beta.11 → 0.2.0-beta.13

package/dist/config.js

@@ -231,6 +231,78 @@ var authEnvSchema = defineEnvSchema({
       required: false,
       examples: ["MyApp", "Your Company"]
     })
+  },
+  SPFN_APP_URL: {
+    ...envString({
+      description: "Next.js application URL. Used for OAuth callback redirects.",
+      default: "http://localhost:3000",
+      required: false,
+      examples: [
+        "https://app.example.com",
+        "http://localhost:3000"
+      ]
+    })
+  },
+  // ============================================================================
+  // OAuth Configuration - Google
+  // ============================================================================
+  SPFN_AUTH_GOOGLE_CLIENT_ID: {
+    ...envString({
+      description: "Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.",
+      required: false,
+      examples: ["123456789-abc123.apps.googleusercontent.com"]
+    })
+  },
+  SPFN_AUTH_GOOGLE_CLIENT_SECRET: {
+    ...envString({
+      description: "Google OAuth 2.0 Client Secret",
+      required: false,
+      sensitive: true,
+      examples: ["GOCSPX-abcdefghijklmnop"]
+    })
+  },
+  SPFN_AUTH_GOOGLE_SCOPES: {
+    ...envString({
+      description: 'Comma-separated Google OAuth scopes. Defaults to "email,profile" if not set.',
+      required: false,
+      examples: [
+        "email,profile",
+        "email,profile,https://www.googleapis.com/auth/gmail.readonly",
+        "email,profile,https://www.googleapis.com/auth/calendar.readonly"
+      ]
+    })
+  },
+  SPFN_AUTH_GOOGLE_REDIRECT_URI: {
+    ...envString({
+      description: "Google OAuth callback URL. Defaults to {SPFN_API_URL}/_auth/oauth/google/callback",
+      required: false,
+      examples: [
+        "https://api.example.com/_auth/oauth/google/callback",
+        "http://localhost:8790/_auth/oauth/google/callback"
+      ]
+    })
+  },
+  SPFN_AUTH_OAUTH_SUCCESS_URL: {
+    ...envString({
+      description: "OAuth callback page URL. This page should use OAuthCallback component to finalize session.",
+      required: false,
+      default: "/auth/callback",
+      examples: [
+        "/auth/callback",
+        "https://app.example.com/auth/callback"
+      ]
+    })
+  },
+  SPFN_AUTH_OAUTH_ERROR_URL: {
+    ...envString({
+      description: "URL to redirect after OAuth error. Use {error} placeholder for error message.",
+      required: false,
+      default: "http://localhost:3000/auth/error?error={error}",
+      examples: [
+        "https://app.example.com/auth/error?error={error}",
+        "http://localhost:3000/auth/error?error={error}"
+      ]
+    })
   }
 });
 

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config/index.ts","../src/config/schema.ts"],"sourcesContent":["/**\n * Core Package Configuration\n *\n * @example\n * ```typescript\n * import { registry } from '@spfn/core/config';\n *\n * const env = registry.validate();\n * console.log(env.DB_POOL_MAX);\n * ```\n *\n * @module config\n */\n\nimport { createEnvRegistry } from '@spfn/core/env';\nimport { authEnvSchema } from './schema';\n\nexport { authEnvSchema as envSchema } from './schema';\n\n/**\n * Environment registry\n */\nconst registry = createEnvRegistry(authEnvSchema);\nexport const env = registry.validate();","/**\n * Auth Environment Variable Schema\n *\n * Centralized schema definition for all environment variables used in @spfn/auth.\n * This provides type safety, validation, and documentation for Auth configuration.\n *\n * @module config/schema\n */\n\nimport {\n    defineEnvSchema,\n    envString,\n    envNumber,\n    createSecureSecretParser,\n    createPasswordParser,\n} from '@spfn/core/env';\n\n/**\n * Auth environment variable schema\n *\n * Defines all Auth environment variables with:\n * - Type information\n * - Default values\n * - Validation rules\n * - Documentation\n *\n * @example\n * ```typescript\n * import { authEnvSchema } from '@spfn/auth/config';\n *\n * // Access schema information\n * console.log(authEnvSchema.SPFN_AUTH_SESSION_SECRET.description);\n * console.log(authEnvSchema.SPFN_AUTH_JWT_EXPIRES_IN.default);\n * ```\n */\nexport const authEnvSchema = defineEnvSchema({\n    // ============================================================================\n    // Session Configuration\n    // ============================================================================\n    SPFN_AUTH_SESSION_SECRET: {\n        ...envString({\n            description: 'Session encryption secret (minimum 32 characters for AES-256)',\n            required: true,\n            fallbackKeys: ['SESSION_SECRET'],\n            validator: createSecureSecretParser({\n                minLength: 32,\n                minUniqueChars: 16,\n                minEntropy: 3.5,\n            }),\n            sensitive: true,\n            nextjs: true, // Required for Next.js RSC session validation\n            examples: [\n                'my-super-secret-session-key-at-least-32-chars-long',\n                'use-a-cryptographically-secure-random-string-here',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_SESSION_TTL: {\n        ...envString({\n            description: 'Session TTL (time to live) - supports duration strings like \\'7d\\', \\'12h\\', \\'45m\\'',\n            default: '7d',\n            required: false,\n            nextjs: true, // May be needed for session validation in Next.js RSC\n            examples: ['7d', '30d', '12h', '45m', '3600'],\n        }),\n    },\n\n    // ============================================================================\n    // JWT Configuration\n    // ============================================================================\n    SPFN_AUTH_JWT_SECRET: {\n        ...envString({\n            description: 'JWT signing secret for server-signed tokens (legacy mode)',\n            default: 'dev-secret-key-change-in-production',\n            required: false,\n            examples: [\n                'your-jwt-secret-key-here',\n                'use-different-from-session-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_JWT_EXPIRES_IN: {\n        ...envString({\n            description: 'JWT token expiration time (e.g., \\'7d\\', \\'24h\\', \\'1h\\')',\n            default: '7d',\n            required: false,\n            examples: ['7d', '24h', '1h', '30m'],\n        }),\n    },\n\n    // ============================================================================\n    // Security Configuration\n    // ============================================================================\n    SPFN_AUTH_BCRYPT_SALT_ROUNDS: {\n        ...envNumber({\n            description: 'Bcrypt salt rounds (cost factor, higher = more secure but slower)',\n            default: 10,\n            required: false,\n            examples: [10, 12, 14],\n        }),\n        key: 'SPFN_AUTH_BCRYPT_SALT_ROUNDS',\n    },\n\n    SPFN_AUTH_VERIFICATION_TOKEN_SECRET: {\n        ...envString({\n            description: 'Verification token secret for email verification, password reset, etc.',\n            required: true,\n            examples: [\n                'your-verification-token-secret',\n                'can-be-different-from-jwt-secret',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // Admin Account Configuration\n    // ============================================================================\n    SPFN_AUTH_ADMIN_ACCOUNTS: {\n        ...envString({\n            description: 'JSON array of admin accounts (recommended for multiple admins)',\n            required: false,\n            examples: [\n                '[{\"email\":\"admin@example.com\",\"password\":\"secure-pass\",\"role\":\"admin\"}]',\n                '[{\"email\":\"super@example.com\",\"password\":\"pass1\",\"role\":\"superadmin\"},{\"email\":\"admin@example.com\",\"password\":\"pass2\",\"role\":\"admin\"}]',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAILS: {\n        ...envString({\n            description: 'Comma-separated list of admin emails (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin@example.com,user@example.com',\n                'super@example.com,admin@example.com,user@example.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORDS: {\n        ...envString({\n            description: 'Comma-separated list of admin passwords (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin-pass,user-pass',\n                'super-pass,admin-pass,user-pass',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_ROLES: {\n        ...envString({\n            description: 'Comma-separated list of admin roles (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin,user',\n                'superadmin,admin,user',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAIL: {\n        ...envString({\n            description: 'Single admin email (simplest format)',\n            required: false,\n            examples: ['admin@example.com'],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORD: {\n        ...envString({\n            description: 'Single admin password (simplest format)',\n            required: false,\n            validator: createPasswordParser({\n                minLength: 8,\n                requireUppercase: true,\n                requireLowercase: true,\n                requireNumber: true,\n                requireSpecial: true,\n            }),\n            sensitive: true,\n            examples: ['SecureAdmin123!'],\n        }),\n    },\n\n    // ============================================================================\n    // API Configuration\n    // ============================================================================\n    SPFN_API_URL: {\n        ...envString({\n            description: 'Base API URL for invitation links and other external-facing URLs',\n            default: 'http://localhost:8790',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // AWS SNS Configuration (SMS)\n    // ============================================================================\n    SPFN_AUTH_AWS_REGION: {\n        ...envString({\n            description: 'AWS region for SNS service',\n            default: 'ap-northeast-2',\n            required: false,\n            examples: ['ap-northeast-2', 'us-east-1', 'eu-west-1'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID: {\n        ...envString({\n            description: 'AWS SNS access key ID (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['AKIAIOSFODNN7EXAMPLE'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY: {\n        ...envString({\n            description: 'AWS SNS secret access key (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_SENDER_ID: {\n        ...envString({\n            description: 'SMS sender ID displayed to recipients (max 11 characters, alphanumeric)',\n            required: false,\n            examples: ['MyApp', 'YourBrand'],\n        }),\n    },\n\n    // ============================================================================\n    // AWS SES Configuration (Email)\n    // ============================================================================\n    SPFN_AUTH_AWS_SES_ACCESS_KEY_ID: {\n        ...envString({\n            description: 'AWS SES access key ID (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['AKIAIOSFODNN7EXAMPLE'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY: {\n        ...envString({\n            description: 'AWS SES secret access key (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_FROM_EMAIL: {\n        ...envString({\n            description: 'Sender email address (must be verified in AWS SES)',\n            required: false,\n            examples: ['noreply@example.com', 'auth@yourdomain.com'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_FROM_NAME: {\n        ...envString({\n            description: 'Sender display name',\n            required: false,\n            examples: ['MyApp', 'Your Company'],\n        }),\n    },\n});"],"mappings":";AAcA,SAAS,yBAAyB;;;ACLlC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAoBA,IAAM,gBAAgB,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIzC,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc,CAAC,gBAAgB;AAAA,MAC/B,WAAW,yBAAyB;AAAA,QAChC,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,YAAY;AAAA,MAChB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,MACR,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,UAAU,CAAC,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IAChD,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,MAAM,OAAO,MAAM,KAAK;AAAA,IACvC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,IACD,KAAK;AAAA,EACT;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,mBAAmB;AAAA,IAClC,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW,qBAAqB;AAAA,QAC5B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,gBAAgB;AAAA,MACpB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,UAAU,CAAC,iBAAiB;AAAA,IAChC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,kBAAkB,aAAa,WAAW;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0CAA0C;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,SAAS,WAAW;AAAA,IACnC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0CAA0C;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,uBAAuB,qBAAqB;AAAA,IAC3D,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,SAAS,cAAc;AAAA,IACtC,CAAC;AAAA,EACL;AACJ,CAAC;;;AD9PD,IAAM,WAAW,kBAAkB,aAAa;AACzC,IAAM,MAAM,SAAS,SAAS;","names":[]}
+{"version":3,"sources":["../src/config/index.ts","../src/config/schema.ts"],"sourcesContent":["/**\n * Core Package Configuration\n *\n * @example\n * ```typescript\n * import { registry } from '@spfn/core/config';\n *\n * const env = registry.validate();\n * console.log(env.DB_POOL_MAX);\n * ```\n *\n * @module config\n */\n\nimport { createEnvRegistry } from '@spfn/core/env';\nimport { authEnvSchema } from './schema';\n\nexport { authEnvSchema as envSchema } from './schema';\n\n/**\n * Environment registry\n */\nconst registry = createEnvRegistry(authEnvSchema);\nexport const env = registry.validate();","/**\n * Auth Environment Variable Schema\n *\n * Centralized schema definition for all environment variables used in @spfn/auth.\n * This provides type safety, validation, and documentation for Auth configuration.\n *\n * @module config/schema\n */\n\nimport {\n    defineEnvSchema,\n    envString,\n    envNumber,\n    createSecureSecretParser,\n    createPasswordParser,\n} from '@spfn/core/env';\n\n/**\n * Auth environment variable schema\n *\n * Defines all Auth environment variables with:\n * - Type information\n * - Default values\n * - Validation rules\n * - Documentation\n *\n * @example\n * ```typescript\n * import { authEnvSchema } from '@spfn/auth/config';\n *\n * // Access schema information\n * console.log(authEnvSchema.SPFN_AUTH_SESSION_SECRET.description);\n * console.log(authEnvSchema.SPFN_AUTH_JWT_EXPIRES_IN.default);\n * ```\n */\nexport const authEnvSchema = defineEnvSchema({\n    // ============================================================================\n    // Session Configuration\n    // ============================================================================\n    SPFN_AUTH_SESSION_SECRET: {\n        ...envString({\n            description: 'Session encryption secret (minimum 32 characters for AES-256)',\n            required: true,\n            fallbackKeys: ['SESSION_SECRET'],\n            validator: createSecureSecretParser({\n                minLength: 32,\n                minUniqueChars: 16,\n                minEntropy: 3.5,\n            }),\n            sensitive: true,\n            nextjs: true, // Required for Next.js RSC session validation\n            examples: [\n                'my-super-secret-session-key-at-least-32-chars-long',\n                'use-a-cryptographically-secure-random-string-here',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_SESSION_TTL: {\n        ...envString({\n            description: 'Session TTL (time to live) - supports duration strings like \\'7d\\', \\'12h\\', \\'45m\\'',\n            default: '7d',\n            required: false,\n            nextjs: true, // May be needed for session validation in Next.js RSC\n            examples: ['7d', '30d', '12h', '45m', '3600'],\n        }),\n    },\n\n    // ============================================================================\n    // JWT Configuration\n    // ============================================================================\n    SPFN_AUTH_JWT_SECRET: {\n        ...envString({\n            description: 'JWT signing secret for server-signed tokens (legacy mode)',\n            default: 'dev-secret-key-change-in-production',\n            required: false,\n            examples: [\n                'your-jwt-secret-key-here',\n                'use-different-from-session-secret',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_JWT_EXPIRES_IN: {\n        ...envString({\n            description: 'JWT token expiration time (e.g., \\'7d\\', \\'24h\\', \\'1h\\')',\n            default: '7d',\n            required: false,\n            examples: ['7d', '24h', '1h', '30m'],\n        }),\n    },\n\n    // ============================================================================\n    // Security Configuration\n    // ============================================================================\n    SPFN_AUTH_BCRYPT_SALT_ROUNDS: {\n        ...envNumber({\n            description: 'Bcrypt salt rounds (cost factor, higher = more secure but slower)',\n            default: 10,\n            required: false,\n            examples: [10, 12, 14],\n        }),\n        key: 'SPFN_AUTH_BCRYPT_SALT_ROUNDS',\n    },\n\n    SPFN_AUTH_VERIFICATION_TOKEN_SECRET: {\n        ...envString({\n            description: 'Verification token secret for email verification, password reset, etc.',\n            required: true,\n            examples: [\n                'your-verification-token-secret',\n                'can-be-different-from-jwt-secret',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // Admin Account Configuration\n    // ============================================================================\n    SPFN_AUTH_ADMIN_ACCOUNTS: {\n        ...envString({\n            description: 'JSON array of admin accounts (recommended for multiple admins)',\n            required: false,\n            examples: [\n                '[{\"email\":\"admin@example.com\",\"password\":\"secure-pass\",\"role\":\"admin\"}]',\n                '[{\"email\":\"super@example.com\",\"password\":\"pass1\",\"role\":\"superadmin\"},{\"email\":\"admin@example.com\",\"password\":\"pass2\",\"role\":\"admin\"}]',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAILS: {\n        ...envString({\n            description: 'Comma-separated list of admin emails (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin@example.com,user@example.com',\n                'super@example.com,admin@example.com,user@example.com',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORDS: {\n        ...envString({\n            description: 'Comma-separated list of admin passwords (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin-pass,user-pass',\n                'super-pass,admin-pass,user-pass',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_ROLES: {\n        ...envString({\n            description: 'Comma-separated list of admin roles (legacy CSV format)',\n            required: false,\n            examples: [\n                'admin,user',\n                'superadmin,admin,user',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_EMAIL: {\n        ...envString({\n            description: 'Single admin email (simplest format)',\n            required: false,\n            examples: ['admin@example.com'],\n        }),\n    },\n\n    SPFN_AUTH_ADMIN_PASSWORD: {\n        ...envString({\n            description: 'Single admin password (simplest format)',\n            required: false,\n            validator: createPasswordParser({\n                minLength: 8,\n                requireUppercase: true,\n                requireLowercase: true,\n                requireNumber: true,\n                requireSpecial: true,\n            }),\n            sensitive: true,\n            examples: ['SecureAdmin123!'],\n        }),\n    },\n\n    // ============================================================================\n    // API Configuration\n    // ============================================================================\n    SPFN_API_URL: {\n        ...envString({\n            description: 'Base API URL for invitation links and other external-facing URLs',\n            default: 'http://localhost:8790',\n            required: false,\n            examples: [\n                'https://api.example.com',\n                'http://localhost:8790',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // AWS SNS Configuration (SMS)\n    // ============================================================================\n    SPFN_AUTH_AWS_REGION: {\n        ...envString({\n            description: 'AWS region for SNS service',\n            default: 'ap-northeast-2',\n            required: false,\n            examples: ['ap-northeast-2', 'us-east-1', 'eu-west-1'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_ACCESS_KEY_ID: {\n        ...envString({\n            description: 'AWS SNS access key ID (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['AKIAIOSFODNN7EXAMPLE'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_SECRET_ACCESS_KEY: {\n        ...envString({\n            description: 'AWS SNS secret access key (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SNS_SENDER_ID: {\n        ...envString({\n            description: 'SMS sender ID displayed to recipients (max 11 characters, alphanumeric)',\n            required: false,\n            examples: ['MyApp', 'YourBrand'],\n        }),\n    },\n\n    // ============================================================================\n    // AWS SES Configuration (Email)\n    // ============================================================================\n    SPFN_AUTH_AWS_SES_ACCESS_KEY_ID: {\n        ...envString({\n            description: 'AWS SES access key ID (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['AKIAIOSFODNN7EXAMPLE'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_SECRET_ACCESS_KEY: {\n        ...envString({\n            description: 'AWS SES secret access key (optional, uses default credentials chain if not provided)',\n            required: false,\n            sensitive: true,\n            examples: ['wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_FROM_EMAIL: {\n        ...envString({\n            description: 'Sender email address (must be verified in AWS SES)',\n            required: false,\n            examples: ['noreply@example.com', 'auth@yourdomain.com'],\n        }),\n    },\n\n    SPFN_AUTH_AWS_SES_FROM_NAME: {\n        ...envString({\n            description: 'Sender display name',\n            required: false,\n            examples: ['MyApp', 'Your Company'],\n        }),\n    },\n\n    SPFN_APP_URL: {\n        ...envString({\n            description: 'Next.js application URL. Used for OAuth callback redirects.',\n            default: 'http://localhost:3000',\n            required: false,\n            examples: [\n                'https://app.example.com',\n                'http://localhost:3000',\n            ],\n        }),\n    },\n\n    // ============================================================================\n    // OAuth Configuration - Google\n    // ============================================================================\n    SPFN_AUTH_GOOGLE_CLIENT_ID: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client ID. When set, Google OAuth routes are automatically enabled.',\n            required: false,\n            examples: ['123456789-abc123.apps.googleusercontent.com'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_CLIENT_SECRET: {\n        ...envString({\n            description: 'Google OAuth 2.0 Client Secret',\n            required: false,\n            sensitive: true,\n            examples: ['GOCSPX-abcdefghijklmnop'],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_SCOPES: {\n        ...envString({\n            description: 'Comma-separated Google OAuth scopes. Defaults to \"email,profile\" if not set.',\n            required: false,\n            examples: [\n                'email,profile',\n                'email,profile,https://www.googleapis.com/auth/gmail.readonly',\n                'email,profile,https://www.googleapis.com/auth/calendar.readonly',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_GOOGLE_REDIRECT_URI: {\n        ...envString({\n            description: 'Google OAuth callback URL. Defaults to {SPFN_API_URL}/_auth/oauth/google/callback',\n            required: false,\n            examples: [\n                'https://api.example.com/_auth/oauth/google/callback',\n                'http://localhost:8790/_auth/oauth/google/callback',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_SUCCESS_URL: {\n        ...envString({\n            description: 'OAuth callback page URL. This page should use OAuthCallback component to finalize session.',\n            required: false,\n            default: '/auth/callback',\n            examples: [\n                '/auth/callback',\n                'https://app.example.com/auth/callback',\n            ],\n        }),\n    },\n\n    SPFN_AUTH_OAUTH_ERROR_URL: {\n        ...envString({\n            description: 'URL to redirect after OAuth error. Use {error} placeholder for error message.',\n            required: false,\n            default: 'http://localhost:3000/auth/error?error={error}',\n            examples: [\n                'https://app.example.com/auth/error?error={error}',\n                'http://localhost:3000/auth/error?error={error}',\n            ],\n        }),\n    },\n});"],"mappings":";AAcA,SAAS,yBAAyB;;;ACLlC;AAAA,EACI;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACG;AAoBA,IAAM,gBAAgB,gBAAgB;AAAA;AAAA;AAAA;AAAA,EAIzC,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,cAAc,CAAC,gBAAgB;AAAA,MAC/B,WAAW,yBAAyB;AAAA,QAChC,WAAW;AAAA,QACX,gBAAgB;AAAA,QAChB,YAAY;AAAA,MAChB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,QAAQ;AAAA;AAAA,MACR,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,QAAQ;AAAA;AAAA,MACR,UAAU,CAAC,MAAM,OAAO,OAAO,OAAO,MAAM;AAAA,IAChD,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,MAAM,OAAO,MAAM,KAAK;AAAA,IACvC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,IAAI,IAAI,EAAE;AAAA,IACzB,CAAC;AAAA,IACD,KAAK;AAAA,EACT;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,wBAAwB;AAAA,IACpB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,uBAAuB;AAAA,IACnB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,mBAAmB;AAAA,IAClC,CAAC;AAAA,EACL;AAAA,EAEA,0BAA0B;AAAA,IACtB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW,qBAAqB;AAAA,QAC5B,WAAW;AAAA,QACX,kBAAkB;AAAA,QAClB,kBAAkB;AAAA,QAClB,eAAe;AAAA,QACf,gBAAgB;AAAA,MACpB,CAAC;AAAA,MACD,WAAW;AAAA,MACX,UAAU,CAAC,iBAAiB;AAAA,IAChC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,sBAAsB;AAAA,IAClB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,kBAAkB,aAAa,WAAW;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0CAA0C;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,SAAS,WAAW;AAAA,IACnC,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,iCAAiC;AAAA,IAC7B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,sBAAsB;AAAA,IACrC,CAAC;AAAA,EACL;AAAA,EAEA,qCAAqC;AAAA,IACjC,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,0CAA0C;AAAA,IACzD,CAAC;AAAA,EACL;AAAA,EAEA,8BAA8B;AAAA,IAC1B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,uBAAuB,qBAAqB;AAAA,IAC3D,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,SAAS,cAAc;AAAA,IACtC,CAAC;AAAA,EACL;AAAA,EAEA,cAAc;AAAA,IACV,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,SAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA;AAAA;AAAA;AAAA,EAKA,4BAA4B;AAAA,IACxB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU,CAAC,6CAA6C;AAAA,IAC5D,CAAC;AAAA,EACL;AAAA,EAEA,gCAAgC;AAAA,IAC5B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,WAAW;AAAA,MACX,UAAU,CAAC,yBAAyB;AAAA,IACxC,CAAC;AAAA,EACL;AAAA,EAEA,yBAAyB;AAAA,IACrB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,+BAA+B;AAAA,IAC3B,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,6BAA6B;AAAA,IACzB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AAAA,EAEA,2BAA2B;AAAA,IACvB,GAAG,UAAU;AAAA,MACT,aAAa;AAAA,MACb,UAAU;AAAA,MACV,SAAS;AAAA,MACT,UAAU;AAAA,QACN;AAAA,QACA;AAAA,MACJ;AAAA,IACJ,CAAC;AAAA,EACL;AACJ,CAAC;;;AD7UD,IAAM,WAAW,kBAAkB,aAAa;AACzC,IAAM,MAAM,SAAS,SAAS;","names":[]}

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { R as RoleConfig, P as PermissionConfig, C as CheckAccountExistsResult, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, U as UserProfile, c as ProfileInfo, m as mainAuthRouter } from './authenticate-CU6_zQaa.js';
-export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './authenticate-CU6_zQaa.js';
+import { R as RoleConfig, P as PermissionConfig, C as CheckAccountExistsResult, S as SendVerificationCodeResult, a as RegisterResult, L as LoginResult, b as RotateKeyResult, O as OAuthStartResult, U as UserProfile, c as ProfileInfo, m as mainAuthRouter } from './authenticate-Cz2FjLdB.js';
+export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './authenticate-Cz2FjLdB.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import { HttpMethod } from '@spfn/core/route';
 import * as _sinclair_typebox from '@sinclair/typebox';
@@ -175,6 +175,50 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
         emailVerified: boolean;
         phoneVerified: boolean;
     }>;
+    oauthGoogleStart: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            state: _sinclair_typebox.TString;
+        }>;
+    }, {}, Response>;
+    oauthGoogleCallback: _spfn_core_route.RouteDef<{
+        query: _sinclair_typebox.TObject<{
+            code: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            error_description: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, Response>;
+    oauthStart: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            provider: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"google" | "github" | "kakao" | "naver">[]>;
+            returnUrl: _sinclair_typebox.TString;
+            publicKey: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            fingerprint: _sinclair_typebox.TString;
+            algorithm: _sinclair_typebox.TUnion<_sinclair_typebox.TLiteral<"ES256" | "RS256">[]>;
+        }>;
+    }, {}, OAuthStartResult>;
+    oauthProviders: _spfn_core_route.RouteDef<{}, {}, {
+        providers: ("google" | "github" | "kakao" | "naver")[];
+    }>;
+    getGoogleOAuthUrl: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+            state: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        authUrl: string;
+    }>;
+    oauthFinalize: _spfn_core_route.RouteDef<{
+        body: _sinclair_typebox.TObject<{
+            userId: _sinclair_typebox.TString;
+            keyId: _sinclair_typebox.TString;
+            returnUrl: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
+        }>;
+    }, {}, {
+        success: boolean;
+        returnUrl: string;
+    }>;
     getInvitation: _spfn_core_route.RouteDef<{
         params: _sinclair_typebox.TObject<{
             token: _sinclair_typebox.TString;

package/dist/nextjs/api.js

@@ -333,10 +333,196 @@ var keyRotationInterceptor = {
   }
 };
 
+// src/nextjs/interceptors/oauth.ts
+import {
+  generateKeyPair as generateKeyPair3,
+  createOAuthState,
+  sealSession as sealSession5,
+  COOKIE_NAMES as COOKIE_NAMES5,
+  getSessionTtl as getSessionTtl5,
+  authLogger as authLogger4
+} from "@spfn/auth/server";
+
+// src/nextjs/session-helpers.ts
+import * as jose from "jose";
+import { cookies } from "next/headers.js";
+import {
+  sealSession as sealSession4,
+  unsealSession as unsealSession3,
+  COOKIE_NAMES as COOKIE_NAMES4,
+  getSessionTtl as getSessionTtl4,
+  parseDuration
+} from "@spfn/auth/server";
+import { env as env3 } from "@spfn/auth/config";
+import { logger } from "@spfn/core/logger";
+async function getPendingSessionKey() {
+  const secret = env3.SPFN_AUTH_SESSION_SECRET;
+  const encoder = new TextEncoder();
+  const data = encoder.encode(`oauth-pending:${secret}`);
+  const hashBuffer = await crypto.subtle.digest("SHA-256", data);
+  return new Uint8Array(hashBuffer);
+}
+async function sealPendingSession(data, ttl = 600) {
+  const key = await getPendingSessionKey();
+  return await new jose.EncryptJWT({ data }).setProtectedHeader({ alg: "dir", enc: "A256GCM" }).setIssuedAt().setExpirationTime(`${ttl}s`).setIssuer("spfn-auth").setAudience("spfn-oauth").encrypt(key);
+}
+async function unsealPendingSession(jwt) {
+  const key = await getPendingSessionKey();
+  const { payload } = await jose.jwtDecrypt(jwt, key, {
+    issuer: "spfn-auth",
+    audience: "spfn-oauth"
+  });
+  return payload.data;
+}
+
+// src/nextjs/interceptors/oauth.ts
+import { env as env4 } from "@spfn/core/config";
+var oauthUrlInterceptor = {
+  pathPattern: /^\/_auth\/oauth\/\w+\/url$/,
+  method: "POST",
+  request: async (ctx, next) => {
+    const provider = ctx.path.split("/")[3];
+    const returnUrl = ctx.body?.returnUrl || "/";
+    const keyPair = generateKeyPair3("ES256");
+    const state = await createOAuthState({
+      provider,
+      returnUrl,
+      publicKey: keyPair.publicKey,
+      keyId: keyPair.keyId,
+      fingerprint: keyPair.fingerprint,
+      algorithm: keyPair.algorithm
+    });
+    if (!ctx.body) {
+      ctx.body = {};
+    }
+    ctx.body.state = state;
+    ctx.metadata.pendingSession = {
+      privateKey: keyPair.privateKey,
+      keyId: keyPair.keyId,
+      algorithm: keyPair.algorithm
+    };
+    authLogger4.interceptor.oauth?.debug?.("OAuth state created", {
+      provider,
+      keyId: keyPair.keyId
+    });
+    await next();
+  },
+  response: async (ctx, next) => {
+    if (ctx.response.ok && ctx.metadata.pendingSession) {
+      try {
+        const sealed = await sealPendingSession(ctx.metadata.pendingSession);
+        ctx.setCookies.push({
+          name: COOKIE_NAMES5.OAUTH_PENDING,
+          value: sealed,
+          options: {
+            httpOnly: true,
+            secure: env4.NODE_ENV === "production",
+            sameSite: "lax",
+            // OAuth 리다이렉트 허용
+            maxAge: 600,
+            // 10분
+            path: "/"
+          }
+        });
+        authLogger4.interceptor.oauth?.debug?.("Pending session cookie set", {
+          keyId: ctx.metadata.pendingSession.keyId
+        });
+      } catch (error) {
+        const err = error;
+        authLogger4.interceptor.oauth?.error?.("Failed to set pending session", err);
+      }
+    }
+    await next();
+  }
+};
+var oauthFinalizeInterceptor = {
+  pathPattern: /^\/_auth\/oauth\/finalize$/,
+  method: "POST",
+  response: async (ctx, next) => {
+    if (!ctx.response.ok) {
+      await next();
+      return;
+    }
+    const pendingCookie = ctx.cookies.get(COOKIE_NAMES5.OAUTH_PENDING);
+    if (!pendingCookie) {
+      authLogger4.interceptor.oauth?.warn?.("No pending session cookie found");
+      await next();
+      return;
+    }
+    try {
+      const pendingSession = await unsealPendingSession(pendingCookie);
+      const { userId, keyId } = ctx.response.body || {};
+      if (!userId || !keyId) {
+        authLogger4.interceptor.oauth?.error?.("Missing userId or keyId in response");
+        await next();
+        return;
+      }
+      if (pendingSession.keyId !== keyId) {
+        authLogger4.interceptor.oauth?.error?.("KeyId mismatch", {
+          expected: pendingSession.keyId,
+          received: keyId
+        });
+        await next();
+        return;
+      }
+      const ttl = getSessionTtl5();
+      const sessionToken = await sealSession5({
+        userId,
+        privateKey: pendingSession.privateKey,
+        keyId: pendingSession.keyId,
+        algorithm: pendingSession.algorithm
+      }, ttl);
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.SESSION,
+        value: sessionToken,
+        options: {
+          httpOnly: true,
+          secure: env4.NODE_ENV === "production",
+          sameSite: "strict",
+          maxAge: ttl,
+          path: "/"
+        }
+      });
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.SESSION_KEY_ID,
+        value: keyId,
+        options: {
+          httpOnly: true,
+          secure: env4.NODE_ENV === "production",
+          sameSite: "strict",
+          maxAge: ttl,
+          path: "/"
+        }
+      });
+      ctx.setCookies.push({
+        name: COOKIE_NAMES5.OAUTH_PENDING,
+        value: "",
+        options: {
+          httpOnly: true,
+          secure: env4.NODE_ENV === "production",
+          sameSite: "lax",
+          maxAge: 0,
+          path: "/"
+        }
+      });
+      authLogger4.interceptor.oauth?.debug?.("OAuth session finalized", {
+        userId,
+        keyId
+      });
+    } catch (error) {
+      const err = error;
+      authLogger4.interceptor.oauth?.error?.("Failed to finalize OAuth session", err);
+    }
+    await next();
+  }
+};
+
 // src/nextjs/interceptors/index.ts
 var authInterceptors = [
   loginRegisterInterceptor,
   keyRotationInterceptor,
+  oauthUrlInterceptor,
+  oauthFinalizeInterceptor,
   generalAuthInterceptor
 ];
 

package/dist/nextjs/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionCookieValue: sessionCookie ? '***EXISTS***' : 'NOT_FOUND',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n\n            // Session expired or invalid\n            if (err.message.includes('expired') || err.message.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', { message: err.message });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: process.env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', { userId: sessionData.userId });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.ok)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;AACtF,SAAS,WAAW;AAQb,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAC/H,SAAS,OAAAC,YAAW;AAKpB,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAD,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYD,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAC,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,oBAAoB,gBAAgB,iBAAiB;AAAA,IACzD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AAGZ,UAAI,IAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,SAAS,GACrE;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B,EAAE,SAAS,IAAI,QAAQ,CAAC;AAC1F,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMD,eAAc;AAG1B,cAAM,SAAS,MAAMD,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAME,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQE,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACjC,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAC,YAAW,YAAY,QAAQ,KAAK,qBAAqB,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,MAC3F,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,IACtD;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACvOA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAQnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAID,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMJ,eAAc,aAAa;AAGxD,YAAM,aAAaD,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQG;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAG,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMF,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMF,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACjIO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACJ;;;AJHA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","env","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger"]}
+{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/oauth.ts","../../src/nextjs/session-helpers.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionCookieValue: sessionCookie ? '***EXISTS***' : 'NOT_FOUND',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n\n            // Session expired or invalid\n            if (err.message.includes('expired') || err.message.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', { message: err.message });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: process.env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', { userId: sessionData.userId });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.ok)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * OAuth Interceptors\n *\n * 1. oauthUrlInterceptor: OAuth URL 요청 시 키쌍 생성 및 state 주입\n * 2. oauthFinalizeInterceptor: OAuth 완료 시 pending session에서 세션 저장\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport {\n    generateKeyPair,\n    createOAuthState,\n    sealSession,\n    COOKIE_NAMES,\n    getSessionTtl,\n    authLogger,\n} from '@spfn/auth/server';\nimport { sealPendingSession, unsealPendingSession } from '../session-helpers';\nimport { env } from '@spfn/core/config';\n\n/**\n * OAuth URL Interceptor\n *\n * POST /_auth/oauth/:provider/url 요청을 가로채서\n * 키쌍 생성 및 state 주입 처리\n */\nexport const oauthUrlInterceptor: InterceptorRule = {\n    pathPattern: /^\\/_auth\\/oauth\\/\\w+\\/url$/,\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const provider = ctx.path.split('/')[3]; // google, github, etc.\n        const returnUrl = ctx.body?.returnUrl || '/';\n\n        // 키쌍 생성\n        const keyPair = generateKeyPair('ES256');\n\n        // state 생성 (publicKey 포함)\n        const state = await createOAuthState({\n            provider,\n            returnUrl,\n            publicKey: keyPair.publicKey,\n            keyId: keyPair.keyId,\n            fingerprint: keyPair.fingerprint,\n            algorithm: keyPair.algorithm,\n        });\n\n        // body에 state 주입\n        if (!ctx.body)\n        {\n            ctx.body = {};\n        }\n        ctx.body.state = state;\n\n        // pending session 저장용 metadata\n        ctx.metadata.pendingSession = {\n            privateKey: keyPair.privateKey,\n            keyId: keyPair.keyId,\n            algorithm: keyPair.algorithm,\n        };\n\n        authLogger.interceptor.oauth?.debug?.('OAuth state created', {\n            provider,\n            keyId: keyPair.keyId,\n        });\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // 성공 응답이고 pending session이 있으면 쿠키 설정\n        if (ctx.response.ok && ctx.metadata.pendingSession)\n        {\n            try\n            {\n                const sealed = await sealPendingSession(ctx.metadata.pendingSession);\n\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.OAUTH_PENDING,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'lax', // OAuth 리다이렉트 허용\n                        maxAge: 600, // 10분\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.oauth?.debug?.('Pending session cookie set', {\n                    keyId: ctx.metadata.pendingSession.keyId,\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.oauth?.error?.('Failed to set pending session', err);\n            }\n        }\n\n        await next();\n    },\n};\n\n/**\n * OAuth Finalize Interceptor\n *\n * POST /_auth/oauth/finalize 요청을 가로채서\n * pending session에서 세션 저장\n */\nexport const oauthFinalizeInterceptor: InterceptorRule = {\n    pathPattern: /^\\/_auth\\/oauth\\/finalize$/,\n    method: 'POST',\n\n    response: async (ctx, next) =>\n    {\n        // 성공 응답일 때만 처리\n        if (!ctx.response.ok)\n        {\n            await next();\n            return;\n        }\n\n        const pendingCookie = ctx.cookies.get(COOKIE_NAMES.OAUTH_PENDING);\n        if (!pendingCookie)\n        {\n            authLogger.interceptor.oauth?.warn?.('No pending session cookie found');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // pending session에서 privateKey 복원\n            const pendingSession = await unsealPendingSession(pendingCookie);\n\n            // body에서 userId, keyId 추출\n            const { userId, keyId } = ctx.response.body || {};\n\n            if (!userId || !keyId)\n            {\n                authLogger.interceptor.oauth?.error?.('Missing userId or keyId in response');\n                await next();\n                return;\n            }\n\n            // keyId 일치 확인\n            if (pendingSession.keyId !== keyId)\n            {\n                authLogger.interceptor.oauth?.error?.('KeyId mismatch', {\n                    expected: pendingSession.keyId,\n                    received: keyId,\n                });\n                await next();\n                return;\n            }\n\n            // 세션 생성\n            const ttl = getSessionTtl();\n            const sessionToken = await sealSession({\n                userId,\n                privateKey: pendingSession.privateKey,\n                keyId: pendingSession.keyId,\n                algorithm: pendingSession.algorithm,\n            }, ttl);\n\n            // 세션 쿠키 설정\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sessionToken,\n                options: {\n                    httpOnly: true,\n                    secure: env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // keyId 쿠키 설정\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: keyId,\n                options: {\n                    httpOnly: true,\n                    secure: env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // pending session 쿠키 삭제 (maxAge: 0)\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.OAUTH_PENDING,\n                value: '',\n                options: {\n                    httpOnly: true,\n                    secure: env.NODE_ENV === 'production',\n                    sameSite: 'lax',\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            authLogger.interceptor.oauth?.debug?.('OAuth session finalized', {\n                userId,\n                keyId,\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.oauth?.error?.('Failed to finalize OAuth session', err);\n        }\n\n        await next();\n    },\n};\n","/**\n * Session helpers for Next.js\n *\n * Server-side only (uses next/headers)\n */\n\nimport * as jose from 'jose';\nimport { cookies } from 'next/headers.js';\nimport {\n    sealSession,\n    unsealSession,\n    COOKIE_NAMES,\n    getSessionTtl,\n    parseDuration,\n    type SessionData,\n    type KeyAlgorithmType,\n} from '@spfn/auth/server';\nimport { env } from '@spfn/auth/config';\nimport { logger } from '@spfn/core/logger';\n\nexport type { SessionData };\n\n/**\n * Pending OAuth session data (before user ID is known)\n */\nexport interface PendingSessionData\n{\n    privateKey: string;\n    keyId: string;\n    algorithm: KeyAlgorithmType;\n}\n\n/**\n * Public session information (excludes sensitive data)\n */\nexport interface PublicSession\n{\n    /** User ID */\n    userId: string;\n}\n\n/**\n * Options for saveSession\n */\nexport interface SaveSessionOptions\n{\n    /**\n     * Session TTL (time to live)\n     *\n     * Supports:\n     * - Number: seconds (e.g., 2592000)\n     * - String: duration format ('30d', '12h', '45m', '3600s')\n     *\n     * If not provided, uses global configuration:\n     * 1. Global config (configureAuth)\n     * 2. Environment variable (SPFN_AUTH_SESSION_TTL)\n     * 3. Default (7d)\n     */\n    maxAge?: number | string;\n\n    /**\n     * Remember me option\n     *\n     * When true, uses extended session duration (if configured)\n     */\n    remember?: boolean;\n}\n\n/**\n * Save session to HttpOnly cookie\n *\n * @param data - Session data to save\n * @param options - Session options (maxAge, remember)\n *\n * @example\n * ```typescript\n * // Use global configuration\n * await saveSession(sessionData);\n *\n * // Custom TTL with duration string\n * await saveSession(sessionData, { maxAge: '30d' });\n *\n * // Custom TTL in seconds\n * await saveSession(sessionData, { maxAge: 2592000 });\n *\n * // Remember me\n * await saveSession(sessionData, { remember: true });\n * ```\n */\nexport async function saveSession(\n    data: SessionData,\n    options?: SaveSessionOptions\n): Promise<void>\n{\n    // Calculate maxAge\n    let maxAge: number;\n\n    if (options?.maxAge !== undefined)\n    {\n        // Custom maxAge provided\n        maxAge = typeof options.maxAge === 'number'\n            ? options.maxAge\n            : parseDuration(options.maxAge);\n    }\n    else\n    {\n        // Use getSessionTtl for consistent configuration\n        maxAge = getSessionTtl();\n    }\n\n    const token = await sealSession(data, maxAge);\n    const cookieStore = await cookies();\n\n    cookieStore.set(COOKIE_NAMES.SESSION, token, {\n        httpOnly: true,\n        secure: process.env.NODE_ENV === 'production',\n        sameSite: 'strict',\n        path: '/',\n        maxAge\n    });\n}\n\n/**\n * Get session from HttpOnly cookie\n *\n * Returns public session info only (excludes privateKey, algorithm, keyId)\n */\nexport async function getSession(): Promise<PublicSession | null>\n{\n    const cookieStore = await cookies();\n    const sessionCookie = cookieStore.get(COOKIE_NAMES.SESSION);\n\n    if (!sessionCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        logger.debug('Validating session cookie', { cookie: sessionCookie.value });\n        const session = await unsealSession(sessionCookie.value);\n        // Return only public information\n        return {\n            userId: session.userId,\n        };\n    }\n    catch (error)\n    {\n        // Session expired or invalid\n        // Note: Cannot delete cookies in Server Components (read-only)\n        // Use validateSessionMiddleware() in Next.js middleware for automatic cleanup\n        logger.debug('Session validation failed', {\n            error: error instanceof Error ? error.message : String(error)\n        });\n\n        return null;\n    }\n}\n\n/**\n * Clear session cookie\n */\nexport async function clearSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.SESSION);\n    cookieStore.delete(COOKIE_NAMES.SESSION_KEY_ID);\n}\n\n// ============================================================================\n// Pending OAuth Session (for OAuth flow)\n// ============================================================================\n\n/**\n * Get encryption key for pending session\n */\nasync function getPendingSessionKey(): Promise<Uint8Array>\n{\n    const secret = env.SPFN_AUTH_SESSION_SECRET;\n    const encoder = new TextEncoder();\n    const data = encoder.encode(`oauth-pending:${secret}`);\n    const hashBuffer = await crypto.subtle.digest('SHA-256', data);\n    return new Uint8Array(hashBuffer);\n}\n\n/**\n * Seal pending session data (for OAuth flow)\n *\n * @param data - Pending session data (privateKey, keyId, algorithm)\n * @param ttl - Time to live in seconds (default: 10 minutes)\n */\nexport async function sealPendingSession(\n    data: PendingSessionData,\n    ttl: number = 600\n): Promise<string>\n{\n    const key = await getPendingSessionKey();\n\n    return await new jose.EncryptJWT({ data })\n        .setProtectedHeader({ alg: 'dir', enc: 'A256GCM' })\n        .setIssuedAt()\n        .setExpirationTime(`${ttl}s`)\n        .setIssuer('spfn-auth')\n        .setAudience('spfn-oauth')\n        .encrypt(key);\n}\n\n/**\n * Unseal pending session data\n *\n * @param jwt - Encrypted pending session token\n */\nexport async function unsealPendingSession(jwt: string): Promise<PendingSessionData>\n{\n    const key = await getPendingSessionKey();\n\n    const { payload } = await jose.jwtDecrypt(jwt, key, {\n        issuer: 'spfn-auth',\n        audience: 'spfn-oauth',\n    });\n\n    return payload.data as PendingSessionData;\n}\n\n/**\n * Get pending session from cookie\n */\nexport async function getPendingSession(): Promise<PendingSessionData | null>\n{\n    const cookieStore = await cookies();\n    const pendingCookie = cookieStore.get(COOKIE_NAMES.OAUTH_PENDING);\n\n    if (!pendingCookie)\n    {\n        return null;\n    }\n\n    try\n    {\n        return await unsealPendingSession(pendingCookie.value);\n    }\n    catch (error)\n    {\n        logger.debug('Pending session validation failed', {\n            error: error instanceof Error ? error.message : String(error),\n        });\n        return null;\n    }\n}\n\n/**\n * Clear pending session cookie\n */\nexport async function clearPendingSession(): Promise<void>\n{\n    const cookieStore = await cookies();\n    cookieStore.delete(COOKIE_NAMES.OAUTH_PENDING);\n}\n","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. oauthUrlInterceptor - OAuth URL generation (key generation + state injection)\n * 4. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\nimport { oauthUrlInterceptor, oauthFinalizeInterceptor } from './oauth';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. oauthUrlInterceptor - Handles OAuth URL requests (key generation + state injection + pending session)\n * 4. oauthFinalizeInterceptor - Handles OAuth finalize (pending session → full session)\n * 5. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    oauthUrlInterceptor,\n    oauthFinalizeInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\nexport { oauthUrlInterceptor, oauthFinalizeInterceptor } from './oauth';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;AACtF,SAAS,WAAW;AAQb,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAC/H,SAAS,OAAAC,YAAW;AAKpB,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAD,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYD,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAC,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,oBAAoB,gBAAgB,iBAAiB;AAAA,IACzD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AAGZ,UAAI,IAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,SAAS,GACrE;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B,EAAE,SAAS,IAAI,QAAQ,CAAC;AAC1F,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMD,eAAc;AAG1B,cAAM,SAAS,MAAMD,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAME,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQE,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACjC,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAC,YAAW,YAAY,QAAQ,KAAK,qBAAqB,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,MAC3F,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,IACtD;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACvOA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAQnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAID,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMJ,eAAc,aAAa;AAGxD,YAAM,aAAaD,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQG;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAG,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMF,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMF,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;AChJA;AAAA,EACI,mBAAAC;AAAA,EACA;AAAA,EACA,eAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,cAAAC;AAAA,OACG;;;ACTP,YAAY,UAAU;AACtB,SAAS,eAAe;AACxB;AAAA,EACI,eAAAC;AAAA,EACA,iBAAAC;AAAA,EACA,gBAAAC;AAAA,EACA,iBAAAC;AAAA,EACA;AAAA,OAGG;AACP,SAAS,OAAAC,YAAW;AACpB,SAAS,cAAc;AA8JvB,eAAe,uBACf;AACI,QAAM,SAASC,KAAI;AACnB,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,OAAO,QAAQ,OAAO,iBAAiB,MAAM,EAAE;AACrD,QAAM,aAAa,MAAM,OAAO,OAAO,OAAO,WAAW,IAAI;AAC7D,SAAO,IAAI,WAAW,UAAU;AACpC;AAQA,eAAsB,mBAClB,MACA,MAAc,KAElB;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,SAAO,MAAM,IAAS,gBAAW,EAAE,KAAK,CAAC,EACpC,mBAAmB,EAAE,KAAK,OAAO,KAAK,UAAU,CAAC,EACjD,YAAY,EACZ,kBAAkB,GAAG,GAAG,GAAG,EAC3B,UAAU,WAAW,EACrB,YAAY,YAAY,EACxB,QAAQ,GAAG;AACpB;AAOA,eAAsB,qBAAqB,KAC3C;AACI,QAAM,MAAM,MAAM,qBAAqB;AAEvC,QAAM,EAAE,QAAQ,IAAI,MAAW,gBAAW,KAAK,KAAK;AAAA,IAChD,QAAQ;AAAA,IACR,UAAU;AAAA,EACd,CAAC;AAED,SAAO,QAAQ;AACnB;;;AD7MA,SAAS,OAAAC,YAAW;AAQb,IAAM,sBAAuC;AAAA,EAChD,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,WAAW,IAAI,KAAK,MAAM,GAAG,EAAE,CAAC;AACtC,UAAM,YAAY,IAAI,MAAM,aAAa;AAGzC,UAAM,UAAUC,iBAAgB,OAAO;AAGvC,UAAM,QAAQ,MAAM,iBAAiB;AAAA,MACjC;AAAA,MACA;AAAA,MACA,WAAW,QAAQ;AAAA,MACnB,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,WAAW,QAAQ;AAAA,IACvB,CAAC;AAGD,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AACA,QAAI,KAAK,QAAQ;AAGjB,QAAI,SAAS,iBAAiB;AAAA,MAC1B,YAAY,QAAQ;AAAA,MACpB,OAAO,QAAQ;AAAA,MACf,WAAW,QAAQ;AAAA,IACvB;AAEA,IAAAC,YAAW,YAAY,OAAO,QAAQ,uBAAuB;AAAA,MACzD;AAAA,MACA,OAAO,QAAQ;AAAA,IACnB,CAAC;AAED,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,MAAM,IAAI,SAAS,gBACpC;AACI,UACA;AACI,cAAM,SAAS,MAAM,mBAAmB,IAAI,SAAS,cAAc;AAEnE,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMC,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQH,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA;AAAA,YACV,QAAQ;AAAA;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAE,YAAW,YAAY,OAAO,QAAQ,8BAA8B;AAAA,UAChE,OAAO,IAAI,SAAS,eAAe;AAAA,QACvC,CAAC;AAAA,MACL,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,OAAO,QAAQ,iCAAiC,GAAG;AAAA,MAC9E;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;AAQO,IAAM,2BAA4C;AAAA,EACrD,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,CAAC,IAAI,SAAS,IAClB;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,UAAM,gBAAgB,IAAI,QAAQ,IAAIC,cAAa,aAAa;AAChE,QAAI,CAAC,eACL;AACI,MAAAD,YAAW,YAAY,OAAO,OAAO,iCAAiC;AACtE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAM,qBAAqB,aAAa;AAG/D,YAAM,EAAE,QAAQ,MAAM,IAAI,IAAI,SAAS,QAAQ,CAAC;AAEhD,UAAI,CAAC,UAAU,CAAC,OAChB;AACI,QAAAA,YAAW,YAAY,OAAO,QAAQ,qCAAqC;AAC3E,cAAM,KAAK;AACX;AAAA,MACJ;AAGA,UAAI,eAAe,UAAU,OAC7B;AACI,QAAAA,YAAW,YAAY,OAAO,QAAQ,kBAAkB;AAAA,UACpD,UAAU,eAAe;AAAA,UACzB,UAAU;AAAA,QACd,CAAC;AACD,cAAM,KAAK;AACX;AAAA,MACJ;AAGA,YAAM,MAAME,eAAc;AAC1B,YAAM,eAAe,MAAMC,aAAY;AAAA,QACnC;AAAA,QACA,YAAY,eAAe;AAAA,QAC3B,OAAO,eAAe;AAAA,QACtB,WAAW,eAAe;AAAA,MAC9B,GAAG,GAAG;AAGN,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMF,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQH,KAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQH,KAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQH,KAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,MAAAE,YAAW,YAAY,OAAO,QAAQ,2BAA2B;AAAA,QAC7D;AAAA,QACA;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAA,YAAW,YAAY,OAAO,QAAQ,oCAAoC,GAAG;AAAA,IACjF;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;AEhMO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACJ;;;ANTA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","env","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger","generateKeyPair","sealSession","COOKIE_NAMES","getSessionTtl","authLogger","sealSession","unsealSession","COOKIE_NAMES","getSessionTtl","env","env","env","generateKeyPair","authLogger","COOKIE_NAMES","getSessionTtl","sealSession"]}