@spfn/auth 0.2.0-beta.6 → 0.2.0-beta.9

package/dist/{dto-Bb2qFUO6.d.ts → dto-CRlgoCP5.d.ts}

@@ -488,12 +488,8 @@ declare const mainAuthRouter: _spfn_core_route.Router<{
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
     }, LoginResult>;
-    logout: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{}>;
-    }, {}, void>;
-    rotateKey: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{}>;
-    }, {
+    logout: _spfn_core_route.RouteDef<{}, {}, void>;
+    rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import * as _spfn_core_nextjs from '@spfn/core/nextjs';
-import { R as RoleConfig, P as PermissionConfig, U as UserProfile, a as ProfileInfo, C as CheckAccountExistsResult, S as SendVerificationCodeResult, b as RegisterResult, L as LoginResult, c as RotateKeyResult, m as mainAuthRouter } from './dto-Bb2qFUO6.js';
-export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './dto-Bb2qFUO6.js';
+import { R as RoleConfig, P as PermissionConfig, U as UserProfile, a as ProfileInfo, C as CheckAccountExistsResult, S as SendVerificationCodeResult, b as RegisterResult, L as LoginResult, c as RotateKeyResult, m as mainAuthRouter } from './dto-CRlgoCP5.js';
+export { k as AuthInitOptions, A as AuthSession, I as INVITATION_STATUSES, n as InvitationStatus, K as KEY_ALGORITHM, l as KeyAlgorithmType, i as PERMISSION_CATEGORIES, j as PermissionCategory, e as SOCIAL_PROVIDERS, p as SocialProvider, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, f as VerificationPurpose, V as VerificationTargetType } from './dto-CRlgoCP5.js';
 import * as _spfn_core_route from '@spfn/core/route';
 import * as _sinclair_typebox from '@sinclair/typebox';
 import '@spfn/auth/server';
@@ -248,12 +248,8 @@ declare const authApi: _spfn_core_nextjs.Client<_spfn_core_route.Router<{
             oldKeyId: _sinclair_typebox.TOptional<_sinclair_typebox.TString>;
         }>;
     }, LoginResult>;
-    logout: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{}>;
-    }, {}, void>;
-    rotateKey: _spfn_core_route.RouteDef<{
-        body: _sinclair_typebox.TObject<{}>;
-    }, {
+    logout: _spfn_core_route.RouteDef<{}, {}, void>;
+    rotateKey: _spfn_core_route.RouteDef<{}, {
         body: _sinclair_typebox.TObject<{
             publicKey: _sinclair_typebox.TString;
             keyId: _sinclair_typebox.TString;

package/dist/nextjs/api.js

@@ -213,7 +213,7 @@ var generalAuthInterceptor = {
         const err = error;
         authLogger2.interceptor.general.error("Failed to refresh session", err);
       }
-    } else if (ctx.path === "/_auth/logout" && ctx.response.status === 200) {
+    } else if (ctx.path === "/_auth/logout" && ctx.response.ok) {
       ctx.setCookies.push({
         name: COOKIE_NAMES2.SESSION,
         value: "",

package/dist/nextjs/api.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionCookieValue: sessionCookie ? '***EXISTS***' : 'NOT_FOUND',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n\n            // Session expired or invalid\n            if (err.message.includes('expired') || err.message.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', { message: err.message });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: process.env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', { userId: sessionData.userId });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.status === 200)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;AACtF,SAAS,WAAW;AAQb,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAC/H,SAAS,OAAAC,YAAW;AAKpB,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAD,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYD,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAC,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,oBAAoB,gBAAgB,iBAAiB;AAAA,IACzD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AAGZ,UAAI,IAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,SAAS,GACrE;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B,EAAE,SAAS,IAAI,QAAQ,CAAC;AAC1F,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMD,eAAc;AAG1B,cAAM,SAAS,MAAMD,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAME,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQE,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACjC,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAC,YAAW,YAAY,QAAQ,KAAK,qBAAqB,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,MAC3F,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,WAAW,KACjE;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACvOA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAQnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAID,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMJ,eAAc,aAAa;AAGxD,YAAM,aAAaD,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQG;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAG,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMF,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMF,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACjIO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACJ;;;AJHA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","env","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger"]}
+{"version":3,"sources":["../../src/nextjs/api.ts","../../src/nextjs/interceptors/login-register.ts","../../src/nextjs/interceptors/general-auth.ts","../../src/nextjs/interceptors/key-rotation.ts","../../src/nextjs/interceptors/index.ts"],"sourcesContent":["/**\n * @spfn/auth/adapters/nextjs/api\n *\n * Next.js Adapter for SPFN Auth\n *\n * Provides automatic interceptor registration for seamless auth flow:\n * - Session management (HttpOnly cookies)\n * - JWT generation and signing\n * - Public key encryption\n *\n * @requires next >= 13.0.0\n *\n * @example\n * ```typescript\n * // Just import to auto-register interceptors\n * import '@spfn/auth/nextjs/api';\n * ```\n */\n\n// Re-export interceptors for advanced usage\nimport { registerInterceptors } from \"@spfn/core/nextjs/server\";\nimport { authInterceptors } from './interceptors';\n\n// Auto-register interceptors on import\nregisterInterceptors('auth', authInterceptors);","/**\n * Login/Register Interceptor\n *\n * Automatically handles key generation and session management\n * for login and register endpoints\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, sealSession, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Login and Register Interceptor\n *\n * Request: Generates key pair and adds publicKey to request body\n * Response: Saves privateKey to HttpOnly cookie\n */\nexport const loginRegisterInterceptor: InterceptorRule =\n    {\n        pathPattern: /^\\/_auth\\/(login|register)$/,\n        method: 'POST',\n\n        request: async (ctx, next) =>\n        {\n            // Get old session if exists (for key rotation on login)\n            const oldKeyId = ctx.cookies.get(COOKIE_NAMES.SESSION_KEY_ID);\n\n            // Extract remember option from request body (if provided)\n            const remember = ctx.body?.remember;\n\n            // Generate new key pair\n            const keyPair = generateKeyPair('ES256');\n\n            // Add publicKey data to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = keyPair.publicKey;\n            ctx.body.keyId = keyPair.keyId;\n            ctx.body.fingerprint = keyPair.fingerprint;\n            ctx.body.algorithm = keyPair.algorithm;\n            ctx.body.keySize = Buffer.from(keyPair.publicKey, 'base64').length;\n\n            // Add oldKeyId for login (key rotation)\n            if (ctx.path === '/_auth/login' && oldKeyId)\n            {\n                ctx.body.oldKeyId = oldKeyId;\n            }\n\n            // Remove remember from body (not part of contract)\n            delete ctx.body.remember;\n\n            // Store privateKey and remember in metadata for response interceptor\n            ctx.metadata.privateKey = keyPair.privateKey;\n            ctx.metadata.keyId = keyPair.keyId;\n            ctx.metadata.algorithm = keyPair.algorithm;\n            ctx.metadata.remember = remember;\n\n            await next();\n        },\n\n        response: async (ctx, next) =>\n        {\n            // Only process successful responses\n            if (ctx.response.status !== 200)\n            {\n                await next();\n                return;\n            }\n\n            // Handle both wrapped ({ data: { userId } }) and direct ({ userId }) responses\n            const userData = ctx.response.body?.data || ctx.response.body;\n            if (!userData?.userId)\n            {\n                authLogger.interceptor.login.error('No userId in response');\n                await next();\n                return;\n            }\n\n            try\n            {\n                // Get session TTL (priority: runtime > global > env > default)\n                const ttl = getSessionTtl(ctx.metadata.remember);\n\n                // Encrypt session data\n                const sessionData =\n                    {\n                        userId: userData.userId,\n                        privateKey: ctx.metadata.privateKey,\n                        keyId: ctx.metadata.keyId,\n                        algorithm: ctx.metadata.algorithm,\n                    };\n\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Set HttpOnly session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Set keyId cookie (for oldKeyId lookup)\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: ctx.metadata.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.login.error('Failed to save session', err);\n            }\n\n            await next();\n        },\n    };","/**\n * General Authentication Interceptor\n *\n * Handles authentication for all API requests except login/register\n * - Session validation and renewal\n * - JWT generation and signing\n * - Expired session cleanup\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { unsealSession, sealSession, shouldRefreshSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\nimport { env } from '@spfn/core/config';\n\n/**\n * Check if path requires authentication\n */\nfunction requiresAuth(path: string): boolean\n{\n    // Paths that don't require auth\n    const publicPaths = [\n        /^\\/_auth\\/login$/,\n        /^\\/_auth\\/register$/,\n        /^\\/_auth\\/codes$/,           // Send verification code\n        /^\\/_auth\\/codes\\/verify$/,   // Verify code\n        /^\\/_auth\\/exists$/,           // Check account exists\n    ];\n\n    return !publicPaths.some((pattern) => pattern.test(path));\n}\n\n/**\n * General Authentication Interceptor\n *\n * Applies to all paths except login/register/codes\n * - Validates session\n * - Generates JWT token\n * - Refreshes session if needed\n * - Clears expired sessions\n */\nexport const generalAuthInterceptor: InterceptorRule =\n{\n    pathPattern: '*',  // Match all paths, filter by requiresAuth()\n    method: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],\n\n    request: async (ctx, next) =>\n    {\n        // Skip if path doesn't require auth\n        if (!requiresAuth(ctx.path))\n        {\n            authLogger.interceptor.general.debug(`Public path, skipping auth: ${ctx.path}`);\n            await next();\n            return;\n        }\n\n        // Log available cookies\n        const cookieNames = Array.from(ctx.cookies.keys());\n        authLogger.interceptor.general.debug('Available cookies:', {\n            cookieNames,\n            totalCount: cookieNames.length,\n            lookingFor: COOKIE_NAMES.SESSION,\n        });\n\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        authLogger.interceptor.general.debug('Request', {\n            method: ctx.method,\n            path: ctx.path,\n            hasSession: !!sessionCookie,\n            sessionCookieValue: sessionCookie ? '***EXISTS***' : 'NOT_FOUND',\n        });\n\n        // No session cookie\n        if (!sessionCookie)\n        {\n            authLogger.interceptor.general.debug('No session cookie, proceeding without auth');\n            // Let request proceed - server will return 401\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Decrypt and validate session\n            const session = await unsealSession(sessionCookie);\n\n            authLogger.interceptor.general.debug('Session valid', {\n                userId: session.userId,\n                keyId: session.keyId,\n            });\n\n            // Check if session should be refreshed (within 24h of expiry)\n            const needsRefresh = await shouldRefreshSession(sessionCookie, 24);\n\n            if (needsRefresh)\n            {\n                authLogger.interceptor.general.debug('Session needs refresh (within 24h of expiry)');\n                // Mark for session renewal in response interceptor\n                ctx.metadata.refreshSession = true;\n                ctx.metadata.sessionData = session;\n            }\n\n            // Generate JWT token\n            const token = generateClientToken(\n                {\n                    userId: session.userId,\n                    keyId: session.keyId,\n                    timestamp: Date.now(),\n                },\n                session.privateKey,\n                session.algorithm,\n                { expiresIn: '15m' }\n            );\n\n            authLogger.interceptor.general.debug('Generated JWT token (expires in 15m)');\n\n            // Add authentication headers\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = session.keyId;\n\n            // Store session info in metadata\n            ctx.metadata.userId = session.userId;\n            ctx.metadata.sessionValid = true;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n\n            // Session expired or invalid\n            if (err.message.includes('expired') || err.message.includes('invalid'))\n            {\n                authLogger.interceptor.general.warn('Session expired or invalid', { message: err.message });\n                authLogger.interceptor.general.debug('Marking session for cleanup');\n\n                // Mark for cleanup in response interceptor\n                ctx.metadata.clearSession = true;\n                ctx.metadata.sessionValid = false;\n            }\n            else\n            {\n                authLogger.interceptor.general.error('Failed to process session', err);\n            }\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Clear expired/invalid session\n        if (ctx.metadata.clearSession)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n        // Refresh session if needed and request was successful\n        else if (ctx.metadata.refreshSession && ctx.response.status === 200)\n        {\n            try\n            {\n                const sessionData = ctx.metadata.sessionData;\n                const ttl = getSessionTtl();\n\n                // Re-encrypt session with new TTL\n                const sealed = await sealSession(sessionData, ttl);\n\n                // Update session cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION,\n                    value: sealed,\n                    options: {\n                        httpOnly: true,\n                        secure: env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                // Update keyId cookie\n                ctx.setCookies.push({\n                    name: COOKIE_NAMES.SESSION_KEY_ID,\n                    value: sessionData.keyId,\n                    options: {\n                        httpOnly: true,\n                        secure: process.env.NODE_ENV === 'production',\n                        sameSite: 'strict',\n                        maxAge: ttl,\n                        path: '/',\n                    },\n                });\n\n                authLogger.interceptor.general.info('Session refreshed', { userId: sessionData.userId });\n            }\n            catch (error)\n            {\n                const err = error as Error;\n                authLogger.interceptor.general.error('Failed to refresh session', err);\n            }\n        }\n        // Handle logout (clear session)\n        else if (ctx.path === '/_auth/logout' && ctx.response.ok)\n        {\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: '',\n                options: {\n                    maxAge: 0,\n                    path: '/',\n                },\n            });\n        }\n\n        await next();\n    },\n};","/**\n * Key Rotation Interceptor\n *\n * Handles key rotation with new key generation and session update\n */\n\nimport type { InterceptorRule } from '@spfn/core/nextjs';\nimport { generateKeyPair, unsealSession, sealSession, generateClientToken, getSessionTtl, COOKIE_NAMES, authLogger } from '@spfn/auth/server';\n\n/**\n * Key Rotation Interceptor\n *\n * Request: Generates new key pair and adds to body, authenticates with current key\n * Response: Updates session with new privateKey\n */\nexport const keyRotationInterceptor: InterceptorRule =\n{\n    pathPattern: '/_auth/keys/rotate',\n    method: 'POST',\n\n    request: async (ctx, next) =>\n    {\n        const sessionCookie = ctx.cookies.get(COOKIE_NAMES.SESSION);\n\n        if (!sessionCookie)\n        {\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get current session\n            const currentSession = await unsealSession(sessionCookie);\n\n            // Generate new key pair\n            const newKeyPair = generateKeyPair('ES256');\n\n            // Add new publicKey to request body\n            if (!ctx.body)\n            {\n                ctx.body = {};\n            }\n\n            ctx.body.publicKey = newKeyPair.publicKey;\n            ctx.body.keyId = newKeyPair.keyId;\n            ctx.body.fingerprint = newKeyPair.fingerprint;\n            ctx.body.algorithm = newKeyPair.algorithm;\n            ctx.body.keySize = Buffer.from(newKeyPair.publicKey, 'base64').length;\n\n            console.log('New key generated:', newKeyPair);\n            console.log('publicKey:', newKeyPair.publicKey);\n            console.log('keyId:', newKeyPair.keyId);\n            console.log('fingerprint:', newKeyPair.fingerprint);\n\n            // Authenticate with CURRENT key\n            const token = generateClientToken(\n                {\n                    userId: currentSession.userId,\n                    keyId: currentSession.keyId,\n                    action: 'rotate_key',\n                    timestamp: Date.now(),\n                },\n                currentSession.privateKey,\n                currentSession.algorithm,\n                {expiresIn: '15m'}\n            );\n\n            ctx.headers['Authorization'] = `Bearer ${token}`;\n            ctx.headers['X-Key-Id'] = currentSession.keyId;\n\n            // Store new key and userId in metadata\n            ctx.metadata.newPrivateKey = newKeyPair.privateKey;\n            ctx.metadata.newKeyId = newKeyPair.keyId;\n            ctx.metadata.newAlgorithm = newKeyPair.algorithm;\n            ctx.metadata.userId = currentSession.userId;\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to prepare key rotation', err);\n        }\n\n        await next();\n    },\n\n    response: async (ctx, next) =>\n    {\n        // Only update session on successful rotation\n        if (ctx.response.status !== 200)\n        {\n            await next();\n            return;\n        }\n\n        if (!ctx.metadata.newPrivateKey || !ctx.metadata.userId)\n        {\n            authLogger.interceptor.keyRotation.error('Missing key rotation metadata');\n            await next();\n            return;\n        }\n\n        try\n        {\n            // Get session TTL\n            const ttl = getSessionTtl();\n\n            // Create new session with rotated key\n            const newSessionData =\n            {\n                userId: ctx.metadata.userId,\n                privateKey: ctx.metadata.newPrivateKey,\n                keyId: ctx.metadata.newKeyId,\n                algorithm: ctx.metadata.newAlgorithm,\n            };\n\n            const sealed = await sealSession(newSessionData, ttl);\n\n            // Update session cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION,\n                value: sealed,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n\n            // Update keyId cookie\n            ctx.setCookies.push({\n                name: COOKIE_NAMES.SESSION_KEY_ID,\n                value: ctx.metadata.newKeyId,\n                options: {\n                    httpOnly: true,\n                    secure: process.env.NODE_ENV === 'production',\n                    sameSite: 'strict',\n                    maxAge: ttl,\n                    path: '/',\n                },\n            });\n        }\n        catch (error)\n        {\n            const err = error as Error;\n            authLogger.interceptor.keyRotation.error('Failed to update session after rotation', err);\n        }\n\n        await next();\n    },\n};","/**\n * Auth Interceptors for Next.js Proxy\n *\n * Automatically registers interceptors for authentication flow\n *\n * Order matters - more specific interceptors first:\n * 1. loginRegisterInterceptor - Most specific (login/register only)\n * 2. keyRotationInterceptor - Specific (key rotation only)\n * 3. generalAuthInterceptor - General (all authenticated requests)\n */\n\nimport { loginRegisterInterceptor } from './login-register';\nimport { generalAuthInterceptor } from './general-auth';\nimport { keyRotationInterceptor } from './key-rotation';\n\n/**\n * All auth interceptors\n *\n * Execution order:\n * 1. loginRegisterInterceptor - Handles login/register (key generation + session save)\n * 2. keyRotationInterceptor - Handles key rotation (new key generation + session update)\n * 3. generalAuthInterceptor - Handles all authenticated requests (session validation + JWT injection + session renewal)\n */\nexport const authInterceptors = [\n    loginRegisterInterceptor,\n    keyRotationInterceptor,\n    generalAuthInterceptor,\n];\n\nexport { loginRegisterInterceptor } from './login-register';\nexport { generalAuthInterceptor } from './general-auth';\nexport { keyRotationInterceptor } from './key-rotation';\n\n// Deprecated: use generalAuthInterceptor instead\nexport { generalAuthInterceptor as authenticationInterceptor };"],"mappings":";AAoBA,SAAS,4BAA4B;;;ACZrC,SAAS,iBAAiB,aAAa,eAAe,cAAc,kBAAkB;AACtF,SAAS,WAAW;AAQb,IAAM,2BACT;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AAEI,UAAM,WAAW,IAAI,QAAQ,IAAI,aAAa,cAAc;AAG5D,UAAM,WAAW,IAAI,MAAM;AAG3B,UAAM,UAAU,gBAAgB,OAAO;AAGvC,QAAI,CAAC,IAAI,MACT;AACI,UAAI,OAAO,CAAC;AAAA,IAChB;AAEA,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,QAAQ,QAAQ;AACzB,QAAI,KAAK,cAAc,QAAQ;AAC/B,QAAI,KAAK,YAAY,QAAQ;AAC7B,QAAI,KAAK,UAAU,OAAO,KAAK,QAAQ,WAAW,QAAQ,EAAE;AAG5D,QAAI,IAAI,SAAS,kBAAkB,UACnC;AACI,UAAI,KAAK,WAAW;AAAA,IACxB;AAGA,WAAO,IAAI,KAAK;AAGhB,QAAI,SAAS,aAAa,QAAQ;AAClC,QAAI,SAAS,QAAQ,QAAQ;AAC7B,QAAI,SAAS,YAAY,QAAQ;AACjC,QAAI,SAAS,WAAW;AAExB,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,WAAW,IAAI,SAAS,MAAM,QAAQ,IAAI,SAAS;AACzD,QAAI,CAAC,UAAU,QACf;AACI,iBAAW,YAAY,MAAM,MAAM,uBAAuB;AAC1D,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAM,cAAc,IAAI,SAAS,QAAQ;AAG/C,YAAM,cACF;AAAA,QACI,QAAQ,SAAS;AAAA,QACjB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEJ,YAAM,SAAS,MAAM,YAAY,aAAa,GAAG;AAGjD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAM,aAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,IAAI,aAAa;AAAA,UACzB,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,iBAAW,YAAY,MAAM,MAAM,0BAA0B,GAAG;AAAA,IACpE;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACzHJ,SAAS,eAAe,eAAAA,cAAa,sBAAsB,qBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAC/H,SAAS,OAAAC,YAAW;AAKpB,SAAS,aAAa,MACtB;AAEI,QAAM,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,IACA;AAAA;AAAA,EACJ;AAEA,SAAO,CAAC,YAAY,KAAK,CAAC,YAAY,QAAQ,KAAK,IAAI,CAAC;AAC5D;AAWO,IAAM,yBACb;AAAA,EACI,aAAa;AAAA;AAAA,EACb,QAAQ,CAAC,OAAO,QAAQ,OAAO,SAAS,QAAQ;AAAA,EAEhD,SAAS,OAAO,KAAK,SACrB;AAEI,QAAI,CAAC,aAAa,IAAI,IAAI,GAC1B;AACI,MAAAD,YAAW,YAAY,QAAQ,MAAM,+BAA+B,IAAI,IAAI,EAAE;AAC9E,YAAM,KAAK;AACX;AAAA,IACJ;AAGA,UAAM,cAAc,MAAM,KAAK,IAAI,QAAQ,KAAK,CAAC;AACjD,IAAAA,YAAW,YAAY,QAAQ,MAAM,sBAAsB;AAAA,MACvD;AAAA,MACA,YAAY,YAAY;AAAA,MACxB,YAAYD,cAAa;AAAA,IAC7B,CAAC;AAED,UAAM,gBAAgB,IAAI,QAAQ,IAAIA,cAAa,OAAO;AAE1D,IAAAC,YAAW,YAAY,QAAQ,MAAM,WAAW;AAAA,MAC5C,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI;AAAA,MACV,YAAY,CAAC,CAAC;AAAA,MACd,oBAAoB,gBAAgB,iBAAiB;AAAA,IACzD,CAAC;AAGD,QAAI,CAAC,eACL;AACI,MAAAA,YAAW,YAAY,QAAQ,MAAM,4CAA4C;AAEjF,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,UAAU,MAAM,cAAc,aAAa;AAEjD,MAAAA,YAAW,YAAY,QAAQ,MAAM,iBAAiB;AAAA,QAClD,QAAQ,QAAQ;AAAA,QAChB,OAAO,QAAQ;AAAA,MACnB,CAAC;AAGD,YAAM,eAAe,MAAM,qBAAqB,eAAe,EAAE;AAEjE,UAAI,cACJ;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,8CAA8C;AAEnF,YAAI,SAAS,iBAAiB;AAC9B,YAAI,SAAS,cAAc;AAAA,MAC/B;AAGA,YAAM,QAAQ;AAAA,QACV;AAAA,UACI,QAAQ,QAAQ;AAAA,UAChB,OAAO,QAAQ;AAAA,UACf,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,EAAE,WAAW,MAAM;AAAA,MACvB;AAEA,MAAAA,YAAW,YAAY,QAAQ,MAAM,sCAAsC;AAG3E,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,QAAQ;AAGlC,UAAI,SAAS,SAAS,QAAQ;AAC9B,UAAI,SAAS,eAAe;AAAA,IAChC,SACO,OACP;AACI,YAAM,MAAM;AAGZ,UAAI,IAAI,QAAQ,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,SAAS,GACrE;AACI,QAAAA,YAAW,YAAY,QAAQ,KAAK,8BAA8B,EAAE,SAAS,IAAI,QAAQ,CAAC;AAC1F,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B;AAGlE,YAAI,SAAS,eAAe;AAC5B,YAAI,SAAS,eAAe;AAAA,MAChC,OAEA;AACI,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,cACjB;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,WAES,IAAI,SAAS,kBAAkB,IAAI,SAAS,WAAW,KAChE;AACI,UACA;AACI,cAAM,cAAc,IAAI,SAAS;AACjC,cAAM,MAAMD,eAAc;AAG1B,cAAM,SAAS,MAAMD,aAAY,aAAa,GAAG;AAGjD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAME,cAAa;AAAA,UACnB,OAAO;AAAA,UACP,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQE,KAAI,aAAa;AAAA,YACzB,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAGD,YAAI,WAAW,KAAK;AAAA,UAChB,MAAMF,cAAa;AAAA,UACnB,OAAO,YAAY;AAAA,UACnB,SAAS;AAAA,YACL,UAAU;AAAA,YACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,YACjC,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,MAAM;AAAA,UACV;AAAA,QACJ,CAAC;AAED,QAAAC,YAAW,YAAY,QAAQ,KAAK,qBAAqB,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,MAC3F,SACO,OACP;AACI,cAAM,MAAM;AACZ,QAAAA,YAAW,YAAY,QAAQ,MAAM,6BAA6B,GAAG;AAAA,MACzE;AAAA,IACJ,WAES,IAAI,SAAS,mBAAmB,IAAI,SAAS,IACtD;AACI,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMD,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAED,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACvOA,SAAS,mBAAAG,kBAAiB,iBAAAC,gBAAe,eAAAC,cAAa,uBAAAC,sBAAqB,iBAAAC,gBAAe,gBAAAC,eAAc,cAAAC,mBAAkB;AAQnH,IAAM,yBACb;AAAA,EACI,aAAa;AAAA,EACb,QAAQ;AAAA,EAER,SAAS,OAAO,KAAK,SACrB;AACI,UAAM,gBAAgB,IAAI,QAAQ,IAAID,cAAa,OAAO;AAE1D,QAAI,CAAC,eACL;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,iBAAiB,MAAMJ,eAAc,aAAa;AAGxD,YAAM,aAAaD,iBAAgB,OAAO;AAG1C,UAAI,CAAC,IAAI,MACT;AACI,YAAI,OAAO,CAAC;AAAA,MAChB;AAEA,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,QAAQ,WAAW;AAC5B,UAAI,KAAK,cAAc,WAAW;AAClC,UAAI,KAAK,YAAY,WAAW;AAChC,UAAI,KAAK,UAAU,OAAO,KAAK,WAAW,WAAW,QAAQ,EAAE;AAE/D,cAAQ,IAAI,sBAAsB,UAAU;AAC5C,cAAQ,IAAI,cAAc,WAAW,SAAS;AAC9C,cAAQ,IAAI,UAAU,WAAW,KAAK;AACtC,cAAQ,IAAI,gBAAgB,WAAW,WAAW;AAGlD,YAAM,QAAQG;AAAA,QACV;AAAA,UACI,QAAQ,eAAe;AAAA,UACvB,OAAO,eAAe;AAAA,UACtB,QAAQ;AAAA,UACR,WAAW,KAAK,IAAI;AAAA,QACxB;AAAA,QACA,eAAe;AAAA,QACf,eAAe;AAAA,QACf,EAAC,WAAW,MAAK;AAAA,MACrB;AAEA,UAAI,QAAQ,eAAe,IAAI,UAAU,KAAK;AAC9C,UAAI,QAAQ,UAAU,IAAI,eAAe;AAGzC,UAAI,SAAS,gBAAgB,WAAW;AACxC,UAAI,SAAS,WAAW,WAAW;AACnC,UAAI,SAAS,eAAe,WAAW;AACvC,UAAI,SAAS,SAAS,eAAe;AAAA,IACzC,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAG,YAAW,YAAY,YAAY,MAAM,kCAAkC,GAAG;AAAA,IAClF;AAEA,UAAM,KAAK;AAAA,EACf;AAAA,EAEA,UAAU,OAAO,KAAK,SACtB;AAEI,QAAI,IAAI,SAAS,WAAW,KAC5B;AACI,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QAAI,CAAC,IAAI,SAAS,iBAAiB,CAAC,IAAI,SAAS,QACjD;AACI,MAAAA,YAAW,YAAY,YAAY,MAAM,+BAA+B;AACxE,YAAM,KAAK;AACX;AAAA,IACJ;AAEA,QACA;AAEI,YAAM,MAAMF,eAAc;AAG1B,YAAM,iBACN;AAAA,QACI,QAAQ,IAAI,SAAS;AAAA,QACrB,YAAY,IAAI,SAAS;AAAA,QACzB,OAAO,IAAI,SAAS;AAAA,QACpB,WAAW,IAAI,SAAS;AAAA,MAC5B;AAEA,YAAM,SAAS,MAAMF,aAAY,gBAAgB,GAAG;AAGpD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMG,cAAa;AAAA,QACnB,OAAO;AAAA,QACP,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAGD,UAAI,WAAW,KAAK;AAAA,QAChB,MAAMA,cAAa;AAAA,QACnB,OAAO,IAAI,SAAS;AAAA,QACpB,SAAS;AAAA,UACL,UAAU;AAAA,UACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,UACjC,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,MAAM;AAAA,QACV;AAAA,MACJ,CAAC;AAAA,IACL,SACO,OACP;AACI,YAAM,MAAM;AACZ,MAAAC,YAAW,YAAY,YAAY,MAAM,2CAA2C,GAAG;AAAA,IAC3F;AAEA,UAAM,KAAK;AAAA,EACf;AACJ;;;ACjIO,IAAM,mBAAmB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AACJ;;;AJHA,qBAAqB,QAAQ,gBAAgB;","names":["sealSession","getSessionTtl","COOKIE_NAMES","authLogger","env","generateKeyPair","unsealSession","sealSession","generateClientToken","getSessionTtl","COOKIE_NAMES","authLogger"]}

package/dist/server.d.ts

@@ -1,5 +1,5 @@
-import { k as AuthInitOptions, l as KeyAlgorithmType, n as InvitationStatus, f as VerificationPurpose, j as PermissionCategory, q as AuthContext } from './dto-Bb2qFUO6.js';
-export { B as ChangePasswordParams, w as CheckAccountExistsParams, C as CheckAccountExistsResult, X as EmailSchema, I as INVITATION_STATUSES, K as KEY_ALGORITHM, y as LoginParams, L as LoginResult, z as LogoutParams, Z as PasswordSchema, Y as PhoneSchema, x as RegisterParams, O as RegisterPublicKeyParams, b as RegisterResult, T as RevokeKeyParams, Q as RotateKeyParams, c as RotateKeyResult, e as SOCIAL_PROVIDERS, F as SendVerificationCodeParams, S as SendVerificationCodeResult, p as SocialProvider, _ as TargetTypeSchema, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, $ as VerificationPurposeSchema, V as VerificationTargetType, G as VerifyCodeParams, H as VerifyCodeResult, m as authRouter, W as authenticate, v as changePasswordService, r as checkAccountExistsService, t as loginService, u as logoutService, J as registerPublicKeyService, s as registerService, N as revokeKeyService, M as rotateKeyService, D as sendVerificationCodeService, E as verifyCodeService } from './dto-Bb2qFUO6.js';
+import { k as AuthInitOptions, l as KeyAlgorithmType, n as InvitationStatus, f as VerificationPurpose, j as PermissionCategory, q as AuthContext } from './dto-CRlgoCP5.js';
+export { B as ChangePasswordParams, w as CheckAccountExistsParams, C as CheckAccountExistsResult, X as EmailSchema, I as INVITATION_STATUSES, K as KEY_ALGORITHM, y as LoginParams, L as LoginResult, z as LogoutParams, Z as PasswordSchema, Y as PhoneSchema, x as RegisterParams, O as RegisterPublicKeyParams, b as RegisterResult, T as RevokeKeyParams, Q as RotateKeyParams, c as RotateKeyResult, e as SOCIAL_PROVIDERS, F as SendVerificationCodeParams, S as SendVerificationCodeResult, p as SocialProvider, _ as TargetTypeSchema, d as USER_STATUSES, o as UserStatus, h as VERIFICATION_PURPOSES, g as VERIFICATION_TARGET_TYPES, $ as VerificationPurposeSchema, V as VerificationTargetType, G as VerifyCodeParams, H as VerifyCodeResult, m as authRouter, W as authenticate, v as changePasswordService, r as checkAccountExistsService, t as loginService, u as logoutService, J as registerPublicKeyService, s as registerService, N as revokeKeyService, M as rotateKeyService, D as sendVerificationCodeService, E as verifyCodeService } from './dto-CRlgoCP5.js';
 import * as drizzle_orm_pg_core from 'drizzle-orm/pg-core';
 import { UserProfile as UserProfile$1, ProfileInfo } from '@spfn/auth';
 import { BaseRepository } from '@spfn/core/db';

package/dist/server.js

@@ -6888,12 +6888,18 @@ function createAWSSESProvider() {
           };
         }
         if (!env4.SPFN_AUTH_AWS_SES_ACCESS_KEY_ID) {
+          authLogger.email.warn("AWS SES credentials not configured", {
+            hint: "Set SPFN_AUTH_AWS_SES_ACCESS_KEY_ID environment variable"
+          });
           return {
             success: false,
             error: "AWS SES credentials not configured. Set SPFN_AUTH_AWS_SES_ACCESS_KEY_ID environment variable."
           };
         }
         if (!env4.SPFN_AUTH_AWS_SES_FROM_EMAIL) {
+          authLogger.email.warn("AWS SES sender email not configured", {
+            hint: "Set SPFN_AUTH_AWS_SES_FROM_EMAIL environment variable"
+          });
           return {
             success: false,
             error: "AWS SES sender email not configured. Set SPFN_AUTH_AWS_SES_FROM_EMAIL environment variable."
@@ -6960,6 +6966,9 @@ function createAWSSESProvider() {
       }
     };
   } catch (error) {
+    authLogger.email.debug("@aws-sdk/client-ses not available, AWS SES provider disabled", {
+      error: error instanceof Error ? error.message : String(error)
+    });
     return null;
   }
 }
@@ -6968,6 +6977,8 @@ var awsSESProvider = createAWSSESProvider();
 // src/server/services/email/index.ts
 if (awsSESProvider) {
   registerEmailProvider(awsSESProvider);
+} else {
+  authLogger.email.warn("No email provider registered, using fallback (dev mode). Emails will NOT be sent. Install @aws-sdk/client-ses to enable AWS SES.");
 }
 
 // src/server/services/email/templates/verification-code.ts
@@ -8062,9 +8073,7 @@ var login = route.post("/_auth/login").input({
   const { body } = await c.data();
   return await loginService(body);
 });
-var logout = route.post("/_auth/logout").input({
-  body: Type.Object({})
-}).handler(async (c) => {
+var logout = route.post("/_auth/logout").handler(async (c) => {
   const auth = getAuth(c);
   if (!auth) {
     return c.noContent();
@@ -8073,9 +8082,7 @@ var logout = route.post("/_auth/logout").input({
   await logoutService({ userId: Number(userId), keyId });
   return c.noContent();
 });
-var rotateKey = route.post("/_auth/keys/rotate").input({
-  body: Type.Object({})
-}).interceptor({
+var rotateKey = route.post("/_auth/keys/rotate").interceptor({
   body: Type.Object({
     publicKey: Type.String({ description: "New public key" }),
     keyId: Type.String({ description: "New key identifier" }),