@spfn/auth 0.2.0-beta.9 → 0.2.0-beta.90

package/dist/session-CFK4BT25.d.ts

@@ -0,0 +1,53 @@
+import { K as KeyAlgorithmType } from './types-CD95yudz.js';
+
+/**
+ * @spfn/auth - Client Session Management
+ *
+ * Uses Jose JWE (JSON Web Encryption) to securely store session data in cookies
+ * More efficient than Iron Session with better Edge Runtime support
+ */
+
+interface SessionData {
+    userId: string;
+    privateKey: string;
+    keyId: string;
+    algorithm: KeyAlgorithmType;
+}
+/**
+ * Seal session data into encrypted JWT (JWE)
+ *
+ * @param data - Session data to encrypt
+ * @param ttl - Time to live in seconds (default: 7 days)
+ * @returns Encrypted JWT string
+ */
+declare function sealSession(data: SessionData, ttl?: number): Promise<string>;
+/**
+ * Unseal encrypted JWT (JWE) to session data
+ *
+ * @param jwt - Encrypted JWT string
+ * @returns Session data
+ * @throws Error if session is invalid or expired
+ */
+declare function unsealSession(jwt: string): Promise<SessionData>;
+/**
+ * Get session metadata without decrypting
+ *
+ * @param jwt - Encrypted JWT string
+ * @returns Session metadata or null if invalid
+ */
+declare function getSessionInfo(jwt: string): Promise<{
+    issuedAt: Date;
+    expiresAt: Date;
+    issuer: string;
+    audience: string;
+} | null>;
+/**
+ * Check if session is about to expire (within threshold)
+ *
+ * @param jwt - Encrypted JWT string
+ * @param thresholdHours - Hours before expiry to trigger refresh (default: 24)
+ * @returns True if session should be refreshed
+ */
+declare function shouldRefreshSession(jwt: string, thresholdHours?: number): Promise<boolean>;
+
+export { type SessionData as S, shouldRefreshSession as a, getSessionInfo as g, sealSession as s, unsealSession as u };

package/dist/types-CD95yudz.d.ts

@@ -0,0 +1,98 @@
+/**
+ * @spfn/auth - Shared Types
+ *
+ * Common types and constants used across the auth package
+ */
+/**
+ * Supported JWT signature algorithms
+ *
+ * - ES256: ECDSA with P-256 and SHA-256 (recommended, smaller keys)
+ * - RS256: RSA with SHA-256 (fallback, larger keys)
+ */
+declare const KEY_ALGORITHM: readonly ["ES256", "RS256"];
+/**
+ * Key algorithm type derived from the const array
+ */
+type KeyAlgorithmType = typeof KEY_ALGORITHM[number];
+/**
+ * Where a registered key lives, as the client declares it.
+ *
+ * Only for telling one entry apart from another in the key list — nothing is
+ * authorized or refused by it, so a client that lies gains nothing. Stored via
+ * `enumText`, so adding a value here needs no migration.
+ */
+declare const KEY_PLATFORM: readonly ["ios", "android", "web", "desktop"];
+/**
+ * Key platform type derived from the const array
+ */
+type KeyPlatformType = typeof KEY_PLATFORM[number];
+/** Longest device label accepted at registration, and what the list returns. */
+declare const KEY_DEVICE_NAME_MAX_LENGTH = 64;
+/**
+ * Invitation status enum values
+ * Single source of truth for all invitation statuses
+ */
+declare const INVITATION_STATUSES: readonly ["pending", "accepted", "expired", "cancelled"];
+/**
+ * Invitation status type derived from the const array
+ */
+type InvitationStatus = typeof INVITATION_STATUSES[number];
+/**
+ * User status enum values
+ * Single source of truth for all user statuses
+ *
+ * - active: Normal operation (default)
+ * - inactive: Deactivated (user request, dormant)
+ * - suspended: Locked (security incident, ToS violation)
+ * - pending_deletion: Deletion requested, within the grace period (recoverable)
+ * - deleted: Grace period elapsed and the account was purged (anonymize mode only —
+ *   hard-delete removes the row instead, so this status never appears for it)
+ */
+declare const USER_STATUSES: readonly ["active", "inactive", "suspended", "pending_deletion", "deleted"];
+/**
+ * User status type derived from the const array
+ */
+type UserStatus = typeof USER_STATUSES[number];
+/**
+ * Social provider enum values
+ * Single source of truth for supported OAuth providers
+ */
+declare const SOCIAL_PROVIDERS: readonly ["google", "apple", "github", "kakao", "naver", "superself"];
+/**
+ * Social provider type derived from the const array
+ */
+type SocialProvider = typeof SOCIAL_PROVIDERS[number];
+/**
+ * Account deletion request status enum values
+ * Single source of truth for `account_deletion_requests.status`
+ *
+ * - pending: Awaiting the grace period (or immediate purge)
+ * - cancelled: User (or admin) recovered the account before purge
+ * - completed: The purge ran (row is kept as an audit record, never deleted)
+ */
+declare const ACCOUNT_DELETION_REQUEST_STATUSES: readonly ["pending", "cancelled", "completed"];
+/**
+ * Account deletion request status type derived from the const array
+ */
+type AccountDeletionRequestStatus = typeof ACCOUNT_DELETION_REQUEST_STATUSES[number];
+/**
+ * Who initiated an account deletion request
+ */
+declare const ACCOUNT_DELETION_REQUESTED_BY: readonly ["self", "admin"];
+/**
+ * Account deletion requester type derived from the const array
+ */
+type AccountDeletionRequestedBy = typeof ACCOUNT_DELETION_REQUESTED_BY[number];
+/**
+ * Purge strategy enum values
+ *
+ * - anonymize: Scrub PII, keep the row (status becomes 'deleted') — default
+ * - hard-delete: Physically remove the `users` row (cascades to child rows)
+ */
+declare const PURGE_STRATEGIES: readonly ["anonymize", "hard-delete"];
+/**
+ * Purge strategy type derived from the const array
+ */
+type PurgeStrategy = typeof PURGE_STRATEGIES[number];
+
+export { ACCOUNT_DELETION_REQUEST_STATUSES as A, INVITATION_STATUSES as I, type KeyAlgorithmType as K, PURGE_STRATEGIES as P, SOCIAL_PROVIDERS as S, USER_STATUSES as U, KEY_ALGORITHM as a, ACCOUNT_DELETION_REQUESTED_BY as b, KEY_PLATFORM as c, type KeyPlatformType as d, KEY_DEVICE_NAME_MAX_LENGTH as e, type InvitationStatus as f, type UserStatus as g, type SocialProvider as h, type AccountDeletionRequestStatus as i, type AccountDeletionRequestedBy as j, type PurgeStrategy as k };