@tillstack/auth-node 0.2.2 → 0.3.0

package/dist/index.cjs

@@ -137,19 +137,15 @@ function parseCookieHeader(header) {
 
 // src/index.ts
 var DEFAULT_API2 = "https://auth.tilldev.dev";
-var LEGACY_ISSUER = "tillauth";
 var REALM_SEGMENT = "/realms/";
 function trimSlash(s) {
   return s.replace(/\/+$/, "");
 }
-function issuerAccepted(iss, canonical, pinnedIssuer) {
+function issuerAccepted(iss, canonical, appId, pinnedIssuer) {
   if (typeof iss !== "string" || iss.length === 0) return false;
-  if (iss === LEGACY_ISSUER) return true;
   if (pinnedIssuer) return iss === trimSlash(pinnedIssuer);
   const canon = trimSlash(canonical);
-  if (iss === canon) return true;
-  const prefix = `${canon}${REALM_SEGMENT}`;
-  return iss.startsWith(prefix) && iss.length > prefix.length;
+  return iss === canon || iss === `${canon}${REALM_SEGMENT}${appId}`;
 }
 var TillAuthVerifyError = class extends Error {
   constructor(message, code) {
@@ -160,6 +156,8 @@ var TillAuthVerifyError = class extends Error {
 };
 var TillAuthVerifier = class {
   constructor(opts) {
+    /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */
+    this.remoteRealm = null;
     if (!opts.appId) throw new Error("TillAuthVerifier: appId is required");
     this.opts = {
       appId: opts.appId,
@@ -175,9 +173,25 @@ var TillAuthVerifier = class {
       );
     } else {
       this.remote = jose.createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`));
+      this.remoteRealm = jose.createRemoteJWKSet(
+        new URL(`${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}/.well-known/jwks.json`)
+      );
       this.inlineKeys = null;
     }
   }
+  /**
+   * The key set entitled to have signed a token carrying `iss`, or `null` if no set
+   * is. Selecting on the UNVERIFIED issuer is safe because the choice is then
+   * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about
+   * its issuer to reach a different key set must still verify against that set — and
+   * that set contains only keys entitled to the issuer it named.
+   */
+  keySetFor(iss) {
+    if (typeof iss !== "string") return null;
+    if (iss === this.opts.apiBase) return this.remote;
+    if (iss === `${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}`) return this.remoteRealm;
+    return null;
+  }
   async verify(token) {
     if (!token) throw new TillAuthVerifyError("No token", "no_token");
     let claims;
@@ -196,7 +210,15 @@ var TillAuthVerifier = class {
         }
         throw lastErr ?? new Error("No key matched");
       }
-      const { payload } = await jose.jwtVerify(token, this.remote, { algorithms: ["EdDSA"] });
+      const unverifiedIss = jose.decodeJwt(token).iss;
+      const keySet = this.keySetFor(unverifiedIss);
+      if (!keySet) {
+        throw new TillAuthVerifyError("Untrusted token issuer", "invalid_issuer");
+      }
+      const { payload } = await jose.jwtVerify(token, keySet, {
+        algorithms: ["EdDSA"],
+        issuer: unverifiedIss
+      });
       claims = payload;
     } catch (e) {
       if (e instanceof TillAuthVerifyError) throw e;
@@ -208,7 +230,7 @@ var TillAuthVerifier = class {
     return this.applyClaimsChecks(claims);
   }
   applyClaimsChecks(claims) {
-    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.pinnedIssuer)) {
+    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.opts.appId, this.pinnedIssuer)) {
       throw new TillAuthVerifyError("Untrusted token issuer", "invalid_issuer");
     }
     if (claims.app !== this.opts.appId) {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cookie-proxy.ts","../src/index.ts"],"names":["DEFAULT_API","importJWK","createRemoteJWKSet","payload","jwtVerify"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAc,0BAAA;AAuCpB,SAAS,QAAQ,IAAA,EAAwD;AACvE,EAAA,OAAO;AAAA,IACL,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,UAAU,IAAA,CAAK,OAAA,IAAW,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,IACxD,YAAA,EAAc,KAAK,YAAA,IAAgB,QAAA;AAAA,IACnC,aAAA,EAAe,KAAK,aAAA,IAAiB,QAAA;AAAA,IACrC,UAAA,EAAY,KAAK,UAAA,IAAc,GAAA;AAAA,IAC/B,YAAA,EAAc,KAAK,YAAA,IAAgB,EAAA;AAAA,IACnC,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,IAAI,QAAA,KAAa;AAAA,GAClD;AACF;AAEA,SAAS,WACP,IAAA,EACA,KAAA,EACA,CAAA,EACA,IAAA,GAA6C,EAAC,EACtC;AACR,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,KAAA,GAAQ,EAAA,GAAK,KAAK,CAAA,CAAE,CAAA;AACnD,EAAA,KAAA,CAAM,KAAK,UAAU,CAAA;AACrB,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AACjC,EAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,EAAE,YAAA,EAAc,KAAA,CAAM,KAAK,CAAA,OAAA,EAAU,CAAA,CAAE,YAAY,CAAA,CAAE,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AAAA,OAAA,IAC7B,IAAA,CAAK,WAAW,MAAA,EAAW,KAAA,CAAM,KAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvE,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,WAAA,CAAY,KAAwB,GAAA,EAAsD;AACvG,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAG5C,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAO,IAAI,CAAA,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,kBAAkB,IAAA,CAAK,KAAA;AAAA,IACvB,YAAA,EAAc;AAAA,GAChB;AAGA,EAAA,IAAI,OAAO,GAAA,CAAI,IAAA;AACf,EAAA,IAAI,SAAS,IAAA,IAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AACnD,IAAA,OAAA,CAAQ,gBAAgB,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,QACnD,YAAY,EAAC;AAAA,QACb,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAChD;AAAA,IACF;AACA,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,EAAE,aAAA,EAAe,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAA,EAAe,EAAA,IAAM,IAAI,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,EAAA,IAAI,OAAiB,EAAC;AACtB,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,IAAA,EAAK;AAEtB,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,IAAA,CAAK,YAAA,EAAc,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AAC3F,IAAA,OAAO,GAAA,CAAI,YAAA;AAAA,EACb;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,aAAA,KAAkB,QAAA,EAAU;AAE1C,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,KAAK,aAAA,EAAe,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AACvG,IAAA,OAAO,GAAA,CAAI,aAAA;AACX,IAAA,OAAO,GAAA,CAAI,kBAAA;AAAA,EACb;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AACxE,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACxB,UAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAChD;AACF;AAIO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAe,OAAA,CAAQ,GAAA,EAAc,GAAA,GAAiD,EAAC,EAAsB;AAClH,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAG3B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,GAAA,CAAI,QAAQ,IAAA,EAAM;AACpB,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAA,CAAA;AAAA,IACnG,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,UAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAC3D,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA,KAAW,SAAS,MAAM,GAAA,CAAI,MAAK,GAAI,IAAA;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAA;AACnF,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAC,CAAA;AAC9D,IAAA,OAAO,IAAI,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,CAAA;AAAA,EAC/D,CAAA;AACF;AAkBO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAgB,KAAa,GAAA,EAA4B;AAC9D,IAAA,MAAM,OACJ,GAAA,CAAI,IAAA,IAAA,CAAS,GAAA,CAAI,WAAA,IAAe,IAAI,GAAA,IAAO,GAAA,EAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAC/F,IAAA,MAAM,eACJ,OAAO,GAAA,CAAI,QAAQ,MAAA,KAAW,QAAA,GAAW,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC5H,IAAA,MAAM,IAAA,GACJ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,IAAA,GAAO,GAAA,CAAI,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAClF,IAAA,MAAM,MAAM,MAAM,WAAA;AAAA,MAChB;AAAA,QACE,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,QAAA,EAAU,IAAA;AAAA,QACV,IAAA;AAAA,QACA,OAAA,EAAS,iBAAA,CAAkB,YAAA,IAAgB,IAAI;AAAA,OACjD;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,MAAA,CAAO,IAAI,MAAM,CAAA;AACrB,IAAA,IAAI,GAAA,CAAI,WAAW,MAAA,GAAS,CAAA,MAAO,SAAA,CAAU,YAAA,EAAc,IAAI,UAAU,CAAA;AACzE,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AACpE,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC/B,CAAA;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA+C;AACxE,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAC1C,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;;;ACnNA,IAAMA,YAAAA,GAAc,0BAAA;AACpB,IAAM,aAAA,GAAgB,UAAA;AACtB,IAAM,aAAA,GAAgB,UAAA;AAEtB,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC7B;AASA,SAAS,cAAA,CAAe,GAAA,EAAc,SAAA,EAAmB,YAAA,EAAgC;AACvF,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,GAAA,KAAQ,eAAe,OAAO,IAAA;AAClC,EAAA,IAAI,YAAA,EAAc,OAAO,GAAA,KAAQ,SAAA,CAAU,YAAY,CAAA;AACvD,EAAA,MAAM,KAAA,GAAQ,UAAU,SAAS,CAAA;AACjC,EAAA,IAAI,GAAA,KAAQ,OAAO,OAAO,IAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,CAAA,EAAG,KAAK,CAAA,EAAG,aAAa,CAAA,CAAA;AACvC,EAAA,OAAO,IAAI,UAAA,CAAW,MAAM,CAAA,IAAK,GAAA,CAAI,SAAS,MAAA,CAAO,MAAA;AACvD;AAiDO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAE7C,WAAA,CAAY,SAAiB,IAAA,EAAmC;AAC9D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,MAAuB;AAAA,EAM5B,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACtE,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,OAAA,IAAWA,YAAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxD,oBAAA,EAAsB,KAAK,oBAAA,IAAwB,KAAA;AAAA,MACnD,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KACjC;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,MAAA,GAAS,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,GAAI,MAAA;AACnE,IAAA,IAAI,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,MAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,GAAA;AAAA,QACxB,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAO,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,KAAK,MAAMC,cAAA,CAAU,CAAA,EAAG,OAAO,GAAE,CAAE;AAAA,OACrF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,MAAA,GAASC,wBAAmB,IAAI,GAAA,CAAI,GAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAwB,CAAC,CAAA;AACtF,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,KAAA,EAAoC;AAC/C,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,mBAAA,CAAoB,YAAY,UAAU,CAAA;AAEhE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA;AACxB,QAAA,IAAI,OAAA;AACJ,QAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,UAAA,IAAI;AAGF,YAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,KAAA,EAAO,CAAA,CAAE,GAAA,EAAK,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAC3E,YAAA,MAAA,GAASD,QAAAA;AACT,YAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,UACtC,SAAS,CAAA,EAAG;AACV,YAAA,OAAA,GAAU,CAAA;AAAA,UACZ;AAAA,QACF;AACA,QAAA,MAAM,OAAA,IAAW,IAAI,KAAA,CAAM,gBAAgB,CAAA;AAAA,MAC7C;AACA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,KAAA,EAAO,IAAA,CAAK,MAAA,EAAS,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAClF,MAAA,MAAA,GAAS,OAAA;AAAA,IACX,SAAS,CAAA,EAAG;AAIV,MAAA,IAAI,CAAA,YAAa,qBAAqB,MAAM,CAAA;AAC5C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,eAAA;AAAA,QACjC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,EACtC;AAAA,EAEQ,kBAAkB,MAAA,EAAgC;AAGxD,IAAA,IAAI,CAAC,eAAe,MAAA,CAAO,GAAA,EAAK,KAAK,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,YAAY,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,CAAA,EAAkC,WAAW,CAAA;AAAA,IAC7E;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,CAAC,OAAO,GAAA,EAAK;AACvC,MAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgB,cAAc,CAAA;AAAA,IAC9D;AAIA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,oBAAA,IAAwB,MAAA,CAAO,mBAAmB,IAAA,EAAM;AACpE,MAAA,MAAM,IAAI,mBAAA,CAAoB,oBAAA,EAAsB,oBAAoB,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAAA,EAA4D;AAC7E,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,mBAAA,CAAoB,sBAAA,EAAwB,UAAU,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACxC;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAA4B,IAAA,GAA4D,EAAC,EAAG;AAC5H,EAAA,OAAO,eAAgB,GAAA,EAAqB,GAAA,EAAqB,IAAA,EAAkB;AACjF,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,OAAA,EAAS,aAAA;AACvB,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAC,CAAA;AACrE,MAAC,IAA8C,IAAA,GAAO,MAAA;AACvD,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAA8B,CAAA;AACnD,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAUO,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,OAAO,eACL,KACA,KAAA,EACA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACrC,MAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACvC,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,IAAI,CAAA;AAC/C,MAAA,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,IACb,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAGO,SAAS,eAAe,IAAA,EAAuC;AACpE,EAAA,OAAO,IAAI,iBAAiB,IAAI,CAAA;AAClC","file":"index.cjs","sourcesContent":["// Cookie-mode proxy for TillAuth.\n//\n// Mount this on the customer's backend (typically at /api/auth/*). It\n// forwards JSON bodies to TillAuth's /v1/* endpoints, then translates\n// access_token + refresh_token in the response into HttpOnly cookies on\n// the customer's domain. The browser's localStorage never sees the\n// tokens — XSS can't exfiltrate them.\n//\n// Two adapters: a generic web-fetch handler (Cloudflare Workers, Next.js\n// Route Handlers, Bun, Deno) and an Express middleware. Pick one.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\n\nexport interface CookieProxyOptions {\n  /** TillAuth public app id (`tau_…`). */\n  appId: string\n  /** Override the TillAuth API base. */\n  apiBase?: string\n  /** Cookie name for the access token. Default `tau_at`. */\n  accessCookie?: string\n  /** Cookie name for the refresh token. Default `tau_rt`. */\n  refreshCookie?: string\n  /** Cookie path. Default '/'. */\n  cookiePath?: string\n  /** Cookie domain (e.g. `.example.com` to share across subdomains). */\n  cookieDomain?: string\n  /** Secure flag. Defaults to true in production, false otherwise. */\n  secure?: boolean\n}\n\ninterface NormalizedRequest {\n  method: string\n  pathname: string // path relative to the mount point (`/signin`, `/refresh`)\n  body: string\n  cookies: Record<string, string>\n}\ninterface NormalizedResponse {\n  status: number\n  body: string\n  setCookies: string[]\n  headers: Record<string, string>\n}\n\ninterface AuthBody {\n  access_token?: string\n  refresh_token?: string\n  refresh_expires_at?: string\n  [key: string]: unknown\n}\n\nfunction resolve(opts: CookieProxyOptions): Required<CookieProxyOptions> {\n  return {\n    appId: opts.appId,\n    apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n    accessCookie: opts.accessCookie ?? 'tau_at',\n    refreshCookie: opts.refreshCookie ?? 'tau_rt',\n    cookiePath: opts.cookiePath ?? '/',\n    cookieDomain: opts.cookieDomain ?? '',\n    secure: opts.secure ?? process.env.NODE_ENV === 'production',\n  }\n}\n\nfunction makeCookie(\n  name: string,\n  value: string,\n  o: Required<CookieProxyOptions>,\n  opts: { maxAge?: number; clear?: boolean } = {},\n): string {\n  const parts = [`${name}=${opts.clear ? '' : value}`]\n  parts.push('HttpOnly')\n  if (o.secure) parts.push('Secure')\n  parts.push('SameSite=Lax')\n  parts.push(`Path=${o.cookiePath}`)\n  if (o.cookieDomain) parts.push(`Domain=${o.cookieDomain}`)\n  if (opts.clear) parts.push('Max-Age=0')\n  else if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`)\n  return parts.join('; ')\n}\n\nasync function handleProxy(req: NormalizedRequest, raw: CookieProxyOptions): Promise<NormalizedResponse> {\n  const opts = resolve(raw)\n  const path = req.pathname.replace(/^\\/+/, '')\n\n  // Map proxy paths → TillAuth paths.\n  const url = `${opts.apiBase}/v1/${path}`\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'X-TillAuth-App': opts.appId,\n    'User-Agent': 'tilldev-auth-node/cookie-proxy',\n  }\n\n  // /me, /refresh, /signout need to carry tokens from cookies, not the body.\n  let body = req.body\n  if (path === 'me' && req.cookies[opts.accessCookie]) {\n    headers.Authorization = `Bearer ${req.cookies[opts.accessCookie]}`\n  }\n  if (path === 'refresh') {\n    const rt = req.cookies[opts.refreshCookie]\n    if (!rt) {\n      return {\n        status: 401,\n        body: JSON.stringify({ error: 'no refresh cookie' }),\n        setCookies: [],\n        headers: { 'Content-Type': 'application/json' },\n      }\n    }\n    body = JSON.stringify({ refresh_token: rt })\n  }\n  if (path === 'signout') {\n    const rt = req.cookies[opts.refreshCookie]\n    body = JSON.stringify({ refresh_token: rt ?? '' })\n  }\n\n  const upstream = await fetch(url, { method: req.method, headers, body })\n  const text = await upstream.text()\n  let json: AuthBody = {}\n  try {\n    json = JSON.parse(text) as AuthBody\n  } catch {\n    json = {}\n  }\n\n  const setCookies: string[] = []\n  // Always strip token fields before returning to the SPA.\n  const out = { ...json }\n\n  if (typeof json.access_token === 'string') {\n    setCookies.push(makeCookie(opts.accessCookie, json.access_token, opts, { maxAge: 60 * 10 }))\n    delete out.access_token\n  }\n  if (typeof json.refresh_token === 'string') {\n    // 30d in line with the Fastify REFRESH_TTL_MS.\n    setCookies.push(makeCookie(opts.refreshCookie, json.refresh_token, opts, { maxAge: 60 * 60 * 24 * 30 }))\n    delete out.refresh_token\n    delete out.refresh_expires_at\n  }\n  if (path === 'signout') {\n    setCookies.push(makeCookie(opts.accessCookie, '', opts, { clear: true }))\n    setCookies.push(makeCookie(opts.refreshCookie, '', opts, { clear: true }))\n  }\n\n  return {\n    status: upstream.status,\n    body: JSON.stringify(out),\n    setCookies,\n    headers: { 'Content-Type': 'application/json' },\n  }\n}\n\n// ── Adapter 1: web-fetch (Next.js Route Handlers, Workers, Bun, Deno) ───────\n\nexport function createFetchHandler(opts: CookieProxyOptions) {\n  return async function handler(req: Request, ctx: { params?: { path?: string | string[] } } = {}): Promise<Response> {\n    const url = new URL(req.url)\n    // Derive the proxy-relative path. Prefer ctx.params.path (Next.js catch-all);\n    // fall back to the part of the URL after the mount point heuristic.\n    let pathname: string\n    if (ctx.params?.path) {\n      pathname = Array.isArray(ctx.params.path) ? `/${ctx.params.path.join('/')}` : `/${ctx.params.path}`\n    } else {\n      pathname = url.pathname.replace(/^\\/api\\/auth/, '')\n    }\n    const cookies = parseCookieHeader(req.headers.get('cookie'))\n    const body = req.method === 'POST' ? await req.text() : '{}'\n    const out = await handleProxy({ method: req.method, pathname, body, cookies }, opts)\n    const headers = new Headers(out.headers)\n    for (const c of out.setCookies) headers.append('Set-Cookie', c)\n    return new Response(out.body, { status: out.status, headers })\n  }\n}\n\n// ── Adapter 2: Express ──────────────────────────────────────────────────────\n\ninterface ExpReq {\n  method: string\n  url?: string\n  originalUrl?: string\n  path?: string\n  body?: unknown\n  headers: Record<string, string | string[] | undefined>\n}\ninterface ExpRes {\n  status(n: number): ExpRes\n  setHeader(name: string, value: string | string[]): void\n  json(body: unknown): void\n}\n\nexport function expressCookieProxy(opts: CookieProxyOptions) {\n  return async function (req: ExpReq, res: ExpRes): Promise<void> {\n    const path =\n      req.path ?? (req.originalUrl ?? req.url ?? '/').replace(/^\\/api\\/auth/, '').split('?')[0] ?? '/'\n    const cookieHeader =\n      typeof req.headers.cookie === 'string' ? req.headers.cookie : Array.isArray(req.headers.cookie) ? req.headers.cookie[0] : ''\n    const body =\n      typeof req.body === 'string' ? req.body : req.body ? JSON.stringify(req.body) : '{}'\n    const out = await handleProxy(\n      {\n        method: req.method,\n        pathname: path,\n        body,\n        cookies: parseCookieHeader(cookieHeader ?? null),\n      },\n      opts,\n    )\n    res.status(out.status)\n    if (out.setCookies.length > 0) res.setHeader('Set-Cookie', out.setCookies)\n    for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v)\n    res.json(JSON.parse(out.body))\n  }\n}\n\nfunction parseCookieHeader(header: string | null): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!header) return out\n  for (const part of header.split(';')) {\n    const [k, ...rest] = part.trim().split('=')\n    if (!k) continue\n    out[k] = decodeURIComponent(rest.join('='))\n  }\n  return out\n}\n","import { jwtVerify, createRemoteJWKSet, importJWK, type JWK } from 'jose'\n\n// Server-side TillAuth verification.\n//\n// You configure once with the issuer + JWKS endpoint (or inline public keys),\n// then call `verify(token)` or use the framework-specific middleware.\n//\n// Verification is offline against the cached JWKS — no round-trip to TillAuth\n// on the hot path.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\nconst LEGACY_ISSUER = 'tillauth'\nconst REALM_SEGMENT = '/realms/'\n\nfunction trimSlash(s: string): string {\n  return s.replace(/\\/+$/, '')\n}\n\n/**\n * Dual-accept issuer check. TillAuth is migrating access tokens from the legacy\n * `\"tillauth\"` string to a canonical HTTPS issuer (equal to `apiBase`) and, for\n * dedicated realms, a per-realm issuer `{apiBase}/realms/<app>`. During the\n * migration window a verifier accepts all three. Pass `pinnedIssuer` (the\n * `issuer` option) to hard-pin to exactly one realm's issuer instead.\n */\nfunction issuerAccepted(iss: unknown, canonical: string, pinnedIssuer?: string): boolean {\n  if (typeof iss !== 'string' || iss.length === 0) return false\n  if (iss === LEGACY_ISSUER) return true // legacy window\n  if (pinnedIssuer) return iss === trimSlash(pinnedIssuer)\n  const canon = trimSlash(canonical)\n  if (iss === canon) return true\n  const prefix = `${canon}${REALM_SEGMENT}`\n  return iss.startsWith(prefix) && iss.length > prefix.length\n}\n\nexport interface VerifyOptions {\n  /** TillAuth public app id (`tau_…`). Used to enforce app scoping. */\n  appId: string\n  /** TillAuth API base. Defaults to https://auth.tilldev.dev */\n  apiBase?: string\n  /**\n   * Pin verification to exactly one issuer (e.g. a dedicated realm's\n   * `https://auth.tilldev.dev/realms/<app>`). When omitted, the verifier accepts\n   * the legacy string, the canonical HTTPS issuer (derived from `apiBase`), and\n   * any per-realm issuer under it — the migration-window default.\n   */\n  issuer?: string\n  /**\n   * Inline JWKS as a JWK array (the same `publicJwk` entries you'd find in\n   * the TILLAUTH_JWT_KEYS env). Use this in environments where you want\n   * fully air-gapped verification.\n   */\n  publicJwks?: JWK[]\n  /** Require email_verified=true. Defaults to false. */\n  requireVerifiedEmail?: boolean\n  /** Require MFA was satisfied this session. Defaults to false. */\n  requireMfa?: boolean\n}\n\nexport interface AuthClaims {\n  /** User id */\n  sub: string\n  /** App id the token was issued for */\n  app: string\n  /** Lowercased email */\n  email: string\n  /** Whether MFA was satisfied this session */\n  mfa: boolean\n  /**\n   * Whether the account's email was verified at issue time. Optional: tokens\n   * minted before this claim existed omit it. When `requireVerifiedEmail` is\n   * set, an absent claim is treated as unverified (fail-closed on the check).\n   */\n  email_verified?: boolean\n  /** Token issuer — validated against the accepted set (see `issuerAccepted`). */\n  iss?: string\n  /** Issued-at (seconds) */\n  iat: number\n  /** Expires-at (seconds) */\n  exp: number\n}\n\nexport class TillAuthVerifyError extends Error {\n  code: 'no_token' | 'invalid_token' | 'wrong_app' | 'mfa_required' | 'email_not_verified' | 'invalid_issuer'\n  constructor(message: string, code: TillAuthVerifyError['code']) {\n    super(message)\n    this.name = 'TillAuthVerifyError'\n    this.code = code\n  }\n}\n\nexport class TillAuthVerifier {\n  private readonly opts: Required<Pick<VerifyOptions, 'appId' | 'apiBase' | 'requireVerifiedEmail' | 'requireMfa'>>\n  private readonly pinnedIssuer: string | undefined\n  private readonly remote: ReturnType<typeof createRemoteJWKSet> | null\n  private readonly inlineKeys: Promise<Array<{ kid?: string; key: Awaited<ReturnType<typeof importJWK>> }>> | null\n\n  constructor(opts: VerifyOptions) {\n    if (!opts.appId) throw new Error('TillAuthVerifier: appId is required')\n    this.opts = {\n      appId: opts.appId,\n      apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n      requireVerifiedEmail: opts.requireVerifiedEmail ?? false,\n      requireMfa: opts.requireMfa ?? false,\n    }\n    this.pinnedIssuer = opts.issuer ? opts.issuer.replace(/\\/$/, '') : undefined\n    if (opts.publicJwks && opts.publicJwks.length > 0) {\n      this.remote = null\n      this.inlineKeys = Promise.all(\n        opts.publicJwks.map(async (k) => ({ kid: k.kid, key: await importJWK(k, 'EdDSA') })),\n      )\n    } else {\n      this.remote = createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`))\n      this.inlineKeys = null\n    }\n  }\n\n  async verify(token: string): Promise<AuthClaims> {\n    if (!token) throw new TillAuthVerifyError('No token', 'no_token')\n\n    let claims: AuthClaims\n    try {\n      if (this.inlineKeys) {\n        const keys = await this.inlineKeys\n        let lastErr: unknown\n        for (const k of keys) {\n          try {\n            // No jose `issuer` pin — the issuer is one of several accepted values\n            // (legacy string / canonical HTTPS / per-realm), checked below.\n            const { payload } = await jwtVerify(token, k.key, { algorithms: ['EdDSA'] })\n            claims = payload as unknown as AuthClaims\n            return this.applyClaimsChecks(claims)\n          } catch (e) {\n            lastErr = e\n          }\n        }\n        throw lastErr ?? new Error('No key matched')\n      }\n      const { payload } = await jwtVerify(token, this.remote!, { algorithms: ['EdDSA'] })\n      claims = payload as unknown as AuthClaims\n    } catch (e) {\n      // Preserve a specific claims verdict (wrong_app / invalid_issuer) thrown by\n      // applyClaimsChecks on the inline path; only a genuine signature/JWKS\n      // failure becomes the generic invalid_token.\n      if (e instanceof TillAuthVerifyError) throw e\n      throw new TillAuthVerifyError(\n        e instanceof Error ? e.message : 'Invalid token',\n        'invalid_token',\n      )\n    }\n    return this.applyClaimsChecks(claims)\n  }\n\n  private applyClaimsChecks(claims: AuthClaims): AuthClaims {\n    // Issuer is validated here (jose's exact `issuer` pin is intentionally not\n    // used) so the legacy→HTTPS→per-realm migration doesn't break verification.\n    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.pinnedIssuer)) {\n      throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n    }\n    if (claims.app !== this.opts.appId) {\n      throw new TillAuthVerifyError(`Token issued for different app`, 'wrong_app')\n    }\n    if (this.opts.requireMfa && !claims.mfa) {\n      throw new TillAuthVerifyError('MFA required', 'mfa_required')\n    }\n    // Absent claim (older tokens) is treated as unverified only when the check\n    // is enabled — so requireVerifiedEmail fails closed rather than silently\n    // passing when the issuer predates the claim.\n    if (this.opts.requireVerifiedEmail && claims.email_verified !== true) {\n      throw new TillAuthVerifyError('Email not verified', 'email_not_verified')\n    }\n    return claims\n  }\n\n  /**\n   * Pull a Bearer token out of an Authorization header and verify. Returns\n   * the claims or throws TillAuthVerifyError.\n   */\n  async verifyHeader(authHeader: string | undefined | null): Promise<AuthClaims> {\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      throw new TillAuthVerifyError('Missing Bearer token', 'no_token')\n    }\n    return this.verify(authHeader.slice(7))\n  }\n}\n\n// ── Framework adapters ──────────────────────────────────────────────────────\n\n// Express-style middleware. Adds `req.user` on success.\nexport function expressMiddleware(verifier: TillAuthVerifier, opts: { onError?: (err: TillAuthVerifyError) => unknown } = {}) {\n  return async function (req: ExpressLikeReq, res: ExpressLikeRes, next: () => void) {\n    try {\n      const h = req.headers?.authorization\n      const claims = await verifier.verifyHeader(Array.isArray(h) ? h[0] : h)\n      ;(req as ExpressLikeReq & { user: AuthClaims }).user = claims\n      next()\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      if (opts.onError) {\n        const out = opts.onError(err)\n        if (out !== undefined) {\n          res.status(401).json(out as Record<string, unknown>)\n          return\n        }\n      }\n      res.status(401).json({ error: err.message, code: err.code })\n    }\n  }\n}\n\ninterface ExpressLikeReq {\n  headers?: { authorization?: string | string[] }\n}\ninterface ExpressLikeRes {\n  status: (n: number) => { json: (b: Record<string, unknown>) => void }\n}\n\n// Fastify plugin shape — not bound to Fastify's types to avoid a peer dep.\nexport function fastifyHook(verifier: TillAuthVerifier) {\n  return async function (\n    req: { headers: Record<string, string | string[] | undefined>; user?: AuthClaims },\n    reply: { code: (n: number) => { send: (b: unknown) => void } },\n  ) {\n    try {\n      const h = req.headers['authorization']\n      const auth = Array.isArray(h) ? h[0] : h\n      const claims = await verifier.verifyHeader(auth)\n      req.user = claims\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      reply.code(401).send({ error: err.message, code: err.code })\n    }\n  }\n}\n\n// Convenience entrypoint for users who want a one-call setup.\nexport function createVerifier(opts: VerifyOptions): TillAuthVerifier {\n  return new TillAuthVerifier(opts)\n}\n\nexport { createFetchHandler, expressCookieProxy } from './cookie-proxy.js'\nexport type { CookieProxyOptions } from './cookie-proxy.js'\n"]}
+{"version":3,"sources":["../src/cookie-proxy.ts","../src/index.ts"],"names":["DEFAULT_API","importJWK","createRemoteJWKSet","payload","jwtVerify","decodeJwt"],"mappings":";;;;;;;AAWA,IAAM,WAAA,GAAc,0BAAA;AAuCpB,SAAS,QAAQ,IAAA,EAAwD;AACvE,EAAA,OAAO;AAAA,IACL,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,UAAU,IAAA,CAAK,OAAA,IAAW,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,IACxD,YAAA,EAAc,KAAK,YAAA,IAAgB,QAAA;AAAA,IACnC,aAAA,EAAe,KAAK,aAAA,IAAiB,QAAA;AAAA,IACrC,UAAA,EAAY,KAAK,UAAA,IAAc,GAAA;AAAA,IAC/B,YAAA,EAAc,KAAK,YAAA,IAAgB,EAAA;AAAA,IACnC,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,IAAI,QAAA,KAAa;AAAA,GAClD;AACF;AAEA,SAAS,WACP,IAAA,EACA,KAAA,EACA,CAAA,EACA,IAAA,GAA6C,EAAC,EACtC;AACR,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,KAAA,GAAQ,EAAA,GAAK,KAAK,CAAA,CAAE,CAAA;AACnD,EAAA,KAAA,CAAM,KAAK,UAAU,CAAA;AACrB,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AACjC,EAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,EAAE,YAAA,EAAc,KAAA,CAAM,KAAK,CAAA,OAAA,EAAU,CAAA,CAAE,YAAY,CAAA,CAAE,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AAAA,OAAA,IAC7B,IAAA,CAAK,WAAW,MAAA,EAAW,KAAA,CAAM,KAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvE,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,WAAA,CAAY,KAAwB,GAAA,EAAsD;AACvG,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAG5C,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAO,IAAI,CAAA,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,kBAAkB,IAAA,CAAK,KAAA;AAAA,IACvB,YAAA,EAAc;AAAA,GAChB;AAGA,EAAA,IAAI,OAAO,GAAA,CAAI,IAAA;AACf,EAAA,IAAI,SAAS,IAAA,IAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AACnD,IAAA,OAAA,CAAQ,gBAAgB,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,QACnD,YAAY,EAAC;AAAA,QACb,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAChD;AAAA,IACF;AACA,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,EAAE,aAAA,EAAe,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAA,EAAe,EAAA,IAAM,IAAI,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,EAAA,IAAI,OAAiB,EAAC;AACtB,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,IAAA,EAAK;AAEtB,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,IAAA,CAAK,YAAA,EAAc,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AAC3F,IAAA,OAAO,GAAA,CAAI,YAAA;AAAA,EACb;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,aAAA,KAAkB,QAAA,EAAU;AAE1C,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,KAAK,aAAA,EAAe,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AACvG,IAAA,OAAO,GAAA,CAAI,aAAA;AACX,IAAA,OAAO,GAAA,CAAI,kBAAA;AAAA,EACb;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AACxE,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACxB,UAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAChD;AACF;AAIO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAe,OAAA,CAAQ,GAAA,EAAc,GAAA,GAAiD,EAAC,EAAsB;AAClH,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAG3B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,GAAA,CAAI,QAAQ,IAAA,EAAM;AACpB,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAA,CAAA;AAAA,IACnG,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,UAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAC3D,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA,KAAW,SAAS,MAAM,GAAA,CAAI,MAAK,GAAI,IAAA;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAA;AACnF,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAC,CAAA;AAC9D,IAAA,OAAO,IAAI,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,CAAA;AAAA,EAC/D,CAAA;AACF;AAkBO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAgB,KAAa,GAAA,EAA4B;AAC9D,IAAA,MAAM,OACJ,GAAA,CAAI,IAAA,IAAA,CAAS,GAAA,CAAI,WAAA,IAAe,IAAI,GAAA,IAAO,GAAA,EAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAC/F,IAAA,MAAM,eACJ,OAAO,GAAA,CAAI,QAAQ,MAAA,KAAW,QAAA,GAAW,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC5H,IAAA,MAAM,IAAA,GACJ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,IAAA,GAAO,GAAA,CAAI,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAClF,IAAA,MAAM,MAAM,MAAM,WAAA;AAAA,MAChB;AAAA,QACE,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,QAAA,EAAU,IAAA;AAAA,QACV,IAAA;AAAA,QACA,OAAA,EAAS,iBAAA,CAAkB,YAAA,IAAgB,IAAI;AAAA,OACjD;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,MAAA,CAAO,IAAI,MAAM,CAAA;AACrB,IAAA,IAAI,GAAA,CAAI,WAAW,MAAA,GAAS,CAAA,MAAO,SAAA,CAAU,YAAA,EAAc,IAAI,UAAU,CAAA;AACzE,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AACpE,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC/B,CAAA;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA+C;AACxE,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAC1C,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;;;ACnNA,IAAMA,YAAAA,GAAc,0BAAA;AACpB,IAAM,aAAA,GAAgB,UAAA;AAEtB,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC7B;AAqBA,SAAS,cAAA,CACP,GAAA,EACA,SAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,YAAA,EAAc,OAAO,GAAA,KAAQ,SAAA,CAAU,YAAY,CAAA;AACvD,EAAA,MAAM,KAAA,GAAQ,UAAU,SAAS,CAAA;AACjC,EAAA,OAAO,GAAA,KAAQ,SAAS,GAAA,KAAQ,CAAA,EAAG,KAAK,CAAA,EAAG,aAAa,GAAG,KAAK,CAAA,CAAA;AAClE;AAqDO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAE7C,WAAA,CAAY,SAAiB,IAAA,EAAmC;AAC9D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,MAAuB;AAAA,EAQ5B,YAAY,IAAA,EAAqB;AAHjC;AAAA,IAAA,IAAA,CAAiB,WAAA,GAA4D,IAAA;AAI3E,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACtE,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,OAAA,IAAWA,YAAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxD,oBAAA,EAAsB,KAAK,oBAAA,IAAwB,KAAA;AAAA,MACnD,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KACjC;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,MAAA,GAAS,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,GAAI,MAAA;AACnE,IAAA,IAAI,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,MAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,GAAA;AAAA,QACxB,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAO,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,KAAK,MAAMC,cAAA,CAAU,CAAA,EAAG,OAAO,GAAE,CAAE;AAAA,OACrF;AAAA,IACF,CAAA,MAAO;AAeL,MAAA,IAAA,CAAK,MAAA,GAASC,wBAAmB,IAAI,GAAA,CAAI,GAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAwB,CAAC,CAAA;AACtF,MAAA,IAAA,CAAK,WAAA,GAAcA,uBAAA;AAAA,QACjB,IAAI,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,aAAa,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,sBAAA,CAAwB;AAAA,OACxF;AACA,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,UAAU,GAAA,EAA4D;AAC5E,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,IAAA,IAAI,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,OAAA,SAAgB,IAAA,CAAK,MAAA;AAC3C,IAAA,IAAI,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,aAAa,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,CAAA,SAAW,IAAA,CAAK,WAAA;AAClF,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,KAAA,EAAoC;AAC/C,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,mBAAA,CAAoB,YAAY,UAAU,CAAA;AAEhE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA;AACxB,QAAA,IAAI,OAAA;AACJ,QAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,UAAA,IAAI;AAGF,YAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAMC,cAAA,CAAU,KAAA,EAAO,CAAA,CAAE,GAAA,EAAK,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAC3E,YAAA,MAAA,GAASD,QAAAA;AACT,YAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,UACtC,SAAS,CAAA,EAAG;AACV,YAAA,OAAA,GAAU,CAAA;AAAA,UACZ;AAAA,QACF;AACA,QAAA,MAAM,OAAA,IAAW,IAAI,KAAA,CAAM,gBAAgB,CAAA;AAAA,MAC7C;AAQA,MAAA,MAAM,aAAA,GAAgBE,cAAA,CAAU,KAAK,CAAA,CAAE,GAAA;AACvC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,aAAa,CAAA;AAC3C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,MAC1E;AACA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAMD,cAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,QACjD,UAAA,EAAY,CAAC,OAAO,CAAA;AAAA,QACpB,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,MAAA,GAAS,OAAA;AAAA,IACX,SAAS,CAAA,EAAG;AAIV,MAAA,IAAI,CAAA,YAAa,qBAAqB,MAAM,CAAA;AAC5C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,eAAA;AAAA,QACjC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,EACtC;AAAA,EAEQ,kBAAkB,MAAA,EAAgC;AAGxD,IAAA,IAAI,CAAC,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA,EAAG;AACtF,MAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,CAAA,EAAkC,WAAW,CAAA;AAAA,IAC7E;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,CAAC,OAAO,GAAA,EAAK;AACvC,MAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgB,cAAc,CAAA;AAAA,IAC9D;AAIA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,oBAAA,IAAwB,MAAA,CAAO,mBAAmB,IAAA,EAAM;AACpE,MAAA,MAAM,IAAI,mBAAA,CAAoB,oBAAA,EAAsB,oBAAoB,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAAA,EAA4D;AAC7E,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,mBAAA,CAAoB,sBAAA,EAAwB,UAAU,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACxC;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAA4B,IAAA,GAA4D,EAAC,EAAG;AAC5H,EAAA,OAAO,eAAgB,GAAA,EAAqB,GAAA,EAAqB,IAAA,EAAkB;AACjF,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,OAAA,EAAS,aAAA;AACvB,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAC,CAAA;AACrE,MAAC,IAA8C,IAAA,GAAO,MAAA;AACvD,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAA8B,CAAA;AACnD,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAUO,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,OAAO,eACL,KACA,KAAA,EACA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACrC,MAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACvC,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,IAAI,CAAA;AAC/C,MAAA,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,IACb,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAGO,SAAS,eAAe,IAAA,EAAuC;AACpE,EAAA,OAAO,IAAI,iBAAiB,IAAI,CAAA;AAClC","file":"index.cjs","sourcesContent":["// Cookie-mode proxy for TillAuth.\n//\n// Mount this on the customer's backend (typically at /api/auth/*). It\n// forwards JSON bodies to TillAuth's /v1/* endpoints, then translates\n// access_token + refresh_token in the response into HttpOnly cookies on\n// the customer's domain. The browser's localStorage never sees the\n// tokens — XSS can't exfiltrate them.\n//\n// Two adapters: a generic web-fetch handler (Cloudflare Workers, Next.js\n// Route Handlers, Bun, Deno) and an Express middleware. Pick one.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\n\nexport interface CookieProxyOptions {\n  /** TillAuth public app id (`tau_…`). */\n  appId: string\n  /** Override the TillAuth API base. */\n  apiBase?: string\n  /** Cookie name for the access token. Default `tau_at`. */\n  accessCookie?: string\n  /** Cookie name for the refresh token. Default `tau_rt`. */\n  refreshCookie?: string\n  /** Cookie path. Default '/'. */\n  cookiePath?: string\n  /** Cookie domain (e.g. `.example.com` to share across subdomains). */\n  cookieDomain?: string\n  /** Secure flag. Defaults to true in production, false otherwise. */\n  secure?: boolean\n}\n\ninterface NormalizedRequest {\n  method: string\n  pathname: string // path relative to the mount point (`/signin`, `/refresh`)\n  body: string\n  cookies: Record<string, string>\n}\ninterface NormalizedResponse {\n  status: number\n  body: string\n  setCookies: string[]\n  headers: Record<string, string>\n}\n\ninterface AuthBody {\n  access_token?: string\n  refresh_token?: string\n  refresh_expires_at?: string\n  [key: string]: unknown\n}\n\nfunction resolve(opts: CookieProxyOptions): Required<CookieProxyOptions> {\n  return {\n    appId: opts.appId,\n    apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n    accessCookie: opts.accessCookie ?? 'tau_at',\n    refreshCookie: opts.refreshCookie ?? 'tau_rt',\n    cookiePath: opts.cookiePath ?? '/',\n    cookieDomain: opts.cookieDomain ?? '',\n    secure: opts.secure ?? process.env.NODE_ENV === 'production',\n  }\n}\n\nfunction makeCookie(\n  name: string,\n  value: string,\n  o: Required<CookieProxyOptions>,\n  opts: { maxAge?: number; clear?: boolean } = {},\n): string {\n  const parts = [`${name}=${opts.clear ? '' : value}`]\n  parts.push('HttpOnly')\n  if (o.secure) parts.push('Secure')\n  parts.push('SameSite=Lax')\n  parts.push(`Path=${o.cookiePath}`)\n  if (o.cookieDomain) parts.push(`Domain=${o.cookieDomain}`)\n  if (opts.clear) parts.push('Max-Age=0')\n  else if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`)\n  return parts.join('; ')\n}\n\nasync function handleProxy(req: NormalizedRequest, raw: CookieProxyOptions): Promise<NormalizedResponse> {\n  const opts = resolve(raw)\n  const path = req.pathname.replace(/^\\/+/, '')\n\n  // Map proxy paths → TillAuth paths.\n  const url = `${opts.apiBase}/v1/${path}`\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'X-TillAuth-App': opts.appId,\n    'User-Agent': 'tilldev-auth-node/cookie-proxy',\n  }\n\n  // /me, /refresh, /signout need to carry tokens from cookies, not the body.\n  let body = req.body\n  if (path === 'me' && req.cookies[opts.accessCookie]) {\n    headers.Authorization = `Bearer ${req.cookies[opts.accessCookie]}`\n  }\n  if (path === 'refresh') {\n    const rt = req.cookies[opts.refreshCookie]\n    if (!rt) {\n      return {\n        status: 401,\n        body: JSON.stringify({ error: 'no refresh cookie' }),\n        setCookies: [],\n        headers: { 'Content-Type': 'application/json' },\n      }\n    }\n    body = JSON.stringify({ refresh_token: rt })\n  }\n  if (path === 'signout') {\n    const rt = req.cookies[opts.refreshCookie]\n    body = JSON.stringify({ refresh_token: rt ?? '' })\n  }\n\n  const upstream = await fetch(url, { method: req.method, headers, body })\n  const text = await upstream.text()\n  let json: AuthBody = {}\n  try {\n    json = JSON.parse(text) as AuthBody\n  } catch {\n    json = {}\n  }\n\n  const setCookies: string[] = []\n  // Always strip token fields before returning to the SPA.\n  const out = { ...json }\n\n  if (typeof json.access_token === 'string') {\n    setCookies.push(makeCookie(opts.accessCookie, json.access_token, opts, { maxAge: 60 * 10 }))\n    delete out.access_token\n  }\n  if (typeof json.refresh_token === 'string') {\n    // 30d in line with the Fastify REFRESH_TTL_MS.\n    setCookies.push(makeCookie(opts.refreshCookie, json.refresh_token, opts, { maxAge: 60 * 60 * 24 * 30 }))\n    delete out.refresh_token\n    delete out.refresh_expires_at\n  }\n  if (path === 'signout') {\n    setCookies.push(makeCookie(opts.accessCookie, '', opts, { clear: true }))\n    setCookies.push(makeCookie(opts.refreshCookie, '', opts, { clear: true }))\n  }\n\n  return {\n    status: upstream.status,\n    body: JSON.stringify(out),\n    setCookies,\n    headers: { 'Content-Type': 'application/json' },\n  }\n}\n\n// ── Adapter 1: web-fetch (Next.js Route Handlers, Workers, Bun, Deno) ───────\n\nexport function createFetchHandler(opts: CookieProxyOptions) {\n  return async function handler(req: Request, ctx: { params?: { path?: string | string[] } } = {}): Promise<Response> {\n    const url = new URL(req.url)\n    // Derive the proxy-relative path. Prefer ctx.params.path (Next.js catch-all);\n    // fall back to the part of the URL after the mount point heuristic.\n    let pathname: string\n    if (ctx.params?.path) {\n      pathname = Array.isArray(ctx.params.path) ? `/${ctx.params.path.join('/')}` : `/${ctx.params.path}`\n    } else {\n      pathname = url.pathname.replace(/^\\/api\\/auth/, '')\n    }\n    const cookies = parseCookieHeader(req.headers.get('cookie'))\n    const body = req.method === 'POST' ? await req.text() : '{}'\n    const out = await handleProxy({ method: req.method, pathname, body, cookies }, opts)\n    const headers = new Headers(out.headers)\n    for (const c of out.setCookies) headers.append('Set-Cookie', c)\n    return new Response(out.body, { status: out.status, headers })\n  }\n}\n\n// ── Adapter 2: Express ──────────────────────────────────────────────────────\n\ninterface ExpReq {\n  method: string\n  url?: string\n  originalUrl?: string\n  path?: string\n  body?: unknown\n  headers: Record<string, string | string[] | undefined>\n}\ninterface ExpRes {\n  status(n: number): ExpRes\n  setHeader(name: string, value: string | string[]): void\n  json(body: unknown): void\n}\n\nexport function expressCookieProxy(opts: CookieProxyOptions) {\n  return async function (req: ExpReq, res: ExpRes): Promise<void> {\n    const path =\n      req.path ?? (req.originalUrl ?? req.url ?? '/').replace(/^\\/api\\/auth/, '').split('?')[0] ?? '/'\n    const cookieHeader =\n      typeof req.headers.cookie === 'string' ? req.headers.cookie : Array.isArray(req.headers.cookie) ? req.headers.cookie[0] : ''\n    const body =\n      typeof req.body === 'string' ? req.body : req.body ? JSON.stringify(req.body) : '{}'\n    const out = await handleProxy(\n      {\n        method: req.method,\n        pathname: path,\n        body,\n        cookies: parseCookieHeader(cookieHeader ?? null),\n      },\n      opts,\n    )\n    res.status(out.status)\n    if (out.setCookies.length > 0) res.setHeader('Set-Cookie', out.setCookies)\n    for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v)\n    res.json(JSON.parse(out.body))\n  }\n}\n\nfunction parseCookieHeader(header: string | null): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!header) return out\n  for (const part of header.split(';')) {\n    const [k, ...rest] = part.trim().split('=')\n    if (!k) continue\n    out[k] = decodeURIComponent(rest.join('='))\n  }\n  return out\n}\n","import { jwtVerify, createRemoteJWKSet, importJWK, decodeJwt, type JWK } from 'jose'\n\n// Server-side TillAuth verification.\n//\n// You configure once with the issuer + JWKS endpoint (or inline public keys),\n// then call `verify(token)` or use the framework-specific middleware.\n//\n// Verification is offline against the cached JWKS — no round-trip to TillAuth\n// on the hot path.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\nconst REALM_SEGMENT = '/realms/'\n\nfunction trimSlash(s: string): string {\n  return s.replace(/\\/+$/, '')\n}\n\n/**\n * Issuer acceptance check.\n *\n * A token this verifier may accept was minted for THIS app, so exactly two issuers\n * are legitimate: the canonical one (the app has no dedicated realm keys, so the\n * shared plane key signed it) or THIS app's own realm issuer. Nothing else.\n *\n * ⚠️ THIS USED TO ACCEPT ANY `{canonical}/realms/<anything>` when no issuer was\n * pinned. Together with a shared JWKS carrying every realm's key, that was a\n * cross-realm forgery (`atrium` `00` D13): holding any one realm's signing key was\n * enough to mint a token naming any OTHER realm. The signature verified (the key was\n * in the merged JWKS), the issuer passed this prefix test, and the `app` check\n * passed too — because the attacker wrote that claim as well.\n *\n * Note the `issuer` option was NOT the mitigation it looked like: pinning it\n * constrained the *claim* while the *key* still came from the merged set.\n *\n * The bare legacy `\"tillauth\"` string was retired 2026-07-20 and is not accepted.\n */\nfunction issuerAccepted(\n  iss: unknown,\n  canonical: string,\n  appId: string,\n  pinnedIssuer?: string,\n): boolean {\n  if (typeof iss !== 'string' || iss.length === 0) return false\n  if (pinnedIssuer) return iss === trimSlash(pinnedIssuer)\n  const canon = trimSlash(canonical)\n  return iss === canon || iss === `${canon}${REALM_SEGMENT}${appId}`\n}\n\nexport interface VerifyOptions {\n  /** TillAuth public app id (`tau_…`). Used to enforce app scoping. */\n  appId: string\n  /** TillAuth API base. Defaults to https://auth.tilldev.dev */\n  apiBase?: string\n  /**\n   * Pin verification to exactly one issuer (e.g. a dedicated realm's\n   * `https://auth.tilldev.dev/realms/<app>`).\n   *\n   * Rarely needed now: when omitted, the verifier accepts the canonical HTTPS issuer\n   * (derived from `apiBase`) and THIS app's own realm issuer — never another realm's.\n   * It previously accepted any realm under `apiBase`, which is what made this option\n   * look load-bearing; it was not, because the key still came from a merged JWKS\n   * (`atrium` `00` D13). The retired legacy `\"tillauth\"` string is never accepted.\n   */\n  issuer?: string\n  /**\n   * Inline JWKS as a JWK array (the same `publicJwk` entries you'd find in\n   * the TILLAUTH_JWT_KEYS env). Use this in environments where you want\n   * fully air-gapped verification.\n   */\n  publicJwks?: JWK[]\n  /** Require email_verified=true. Defaults to false. */\n  requireVerifiedEmail?: boolean\n  /** Require MFA was satisfied this session. Defaults to false. */\n  requireMfa?: boolean\n}\n\nexport interface AuthClaims {\n  /** User id */\n  sub: string\n  /** App id the token was issued for */\n  app: string\n  /** Lowercased email */\n  email: string\n  /** Whether MFA was satisfied this session */\n  mfa: boolean\n  /**\n   * Whether the account's email was verified at issue time. Optional: tokens\n   * minted before this claim existed omit it. When `requireVerifiedEmail` is\n   * set, an absent claim is treated as unverified (fail-closed on the check).\n   */\n  email_verified?: boolean\n  /** Token issuer — validated against the accepted set (see `issuerAccepted`). */\n  iss?: string\n  /** Issued-at (seconds) */\n  iat: number\n  /** Expires-at (seconds) */\n  exp: number\n}\n\nexport class TillAuthVerifyError extends Error {\n  code: 'no_token' | 'invalid_token' | 'wrong_app' | 'mfa_required' | 'email_not_verified' | 'invalid_issuer'\n  constructor(message: string, code: TillAuthVerifyError['code']) {\n    super(message)\n    this.name = 'TillAuthVerifyError'\n    this.code = code\n  }\n}\n\nexport class TillAuthVerifier {\n  private readonly opts: Required<Pick<VerifyOptions, 'appId' | 'apiBase' | 'requireVerifiedEmail' | 'requireMfa'>>\n  private readonly pinnedIssuer: string | undefined\n  private readonly remote: ReturnType<typeof createRemoteJWKSet> | null\n  /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */\n  private readonly remoteRealm: ReturnType<typeof createRemoteJWKSet> | null = null\n  private readonly inlineKeys: Promise<Array<{ kid?: string; key: Awaited<ReturnType<typeof importJWK>> }>> | null\n\n  constructor(opts: VerifyOptions) {\n    if (!opts.appId) throw new Error('TillAuthVerifier: appId is required')\n    this.opts = {\n      appId: opts.appId,\n      apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n      requireVerifiedEmail: opts.requireVerifiedEmail ?? false,\n      requireMfa: opts.requireMfa ?? false,\n    }\n    this.pinnedIssuer = opts.issuer ? opts.issuer.replace(/\\/$/, '') : undefined\n    if (opts.publicJwks && opts.publicJwks.length > 0) {\n      this.remote = null\n      this.inlineKeys = Promise.all(\n        opts.publicJwks.map(async (k) => ({ kid: k.kid, key: await importJWK(k, 'EdDSA') })),\n      )\n    } else {\n      /*\n       * TWO key sets, selected by the token's issuer (`atrium` `00` D13 F4).\n       *\n       * `remote` is the shared plane's set — after the D13 F6 change it holds ONLY\n       * the global signing keys, never a realm's. `remoteRealm` is this app's own\n       * realm set, which holds only this realm's keys and 404s if the app has no\n       * dedicated keys.\n       *\n       * Because neither set can contain ANOTHER realm's key, a forged token naming a\n       * different realm cannot be verified from either — the isolation is structural\n       * rather than a claim check. This replaced a single `createRemoteJWKSet` on the\n       * merged JWKS, where every realm's key was resolvable by `kid` and the realm\n       * checks below were therefore decorative.\n       */\n      this.remote = createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`))\n      this.remoteRealm = createRemoteJWKSet(\n        new URL(`${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}/.well-known/jwks.json`),\n      )\n      this.inlineKeys = null\n    }\n  }\n\n  /**\n   * The key set entitled to have signed a token carrying `iss`, or `null` if no set\n   * is. Selecting on the UNVERIFIED issuer is safe because the choice is then\n   * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about\n   * its issuer to reach a different key set must still verify against that set — and\n   * that set contains only keys entitled to the issuer it named.\n   */\n  private keySetFor(iss: unknown): ReturnType<typeof createRemoteJWKSet> | null {\n    if (typeof iss !== 'string') return null\n    if (iss === this.opts.apiBase) return this.remote\n    if (iss === `${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}`) return this.remoteRealm\n    return null\n  }\n\n  async verify(token: string): Promise<AuthClaims> {\n    if (!token) throw new TillAuthVerifyError('No token', 'no_token')\n\n    let claims: AuthClaims\n    try {\n      if (this.inlineKeys) {\n        const keys = await this.inlineKeys\n        let lastErr: unknown\n        for (const k of keys) {\n          try {\n            // No jose `issuer` pin — the issuer is one of several accepted values\n            // (legacy string / canonical HTTPS / per-realm), checked below.\n            const { payload } = await jwtVerify(token, k.key, { algorithms: ['EdDSA'] })\n            claims = payload as unknown as AuthClaims\n            return this.applyClaimsChecks(claims)\n          } catch (e) {\n            lastErr = e\n          }\n        }\n        throw lastErr ?? new Error('No key matched')\n      }\n      /*\n       * Pick the key set from the token's own issuer, then PIN that issuer during\n       * verification. The pin is what makes reading an unverified claim safe: it\n       * cannot be used to reach a key set and then disown the issuer that selected\n       * it. A token naming a realm this verifier does not serve gets no key set at\n       * all and is refused before any crypto runs.\n       */\n      const unverifiedIss = decodeJwt(token).iss\n      const keySet = this.keySetFor(unverifiedIss)\n      if (!keySet) {\n        throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n      }\n      const { payload } = await jwtVerify(token, keySet, {\n        algorithms: ['EdDSA'],\n        issuer: unverifiedIss as string,\n      })\n      claims = payload as unknown as AuthClaims\n    } catch (e) {\n      // Preserve a specific claims verdict (wrong_app / invalid_issuer) thrown by\n      // applyClaimsChecks on the inline path; only a genuine signature/JWKS\n      // failure becomes the generic invalid_token.\n      if (e instanceof TillAuthVerifyError) throw e\n      throw new TillAuthVerifyError(\n        e instanceof Error ? e.message : 'Invalid token',\n        'invalid_token',\n      )\n    }\n    return this.applyClaimsChecks(claims)\n  }\n\n  private applyClaimsChecks(claims: AuthClaims): AuthClaims {\n    // Issuer is validated here (jose's exact `issuer` pin is intentionally not\n    // used) so per-realm HTTPS issuers verify alongside the canonical one.\n    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.opts.appId, this.pinnedIssuer)) {\n      throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n    }\n    if (claims.app !== this.opts.appId) {\n      throw new TillAuthVerifyError(`Token issued for different app`, 'wrong_app')\n    }\n    if (this.opts.requireMfa && !claims.mfa) {\n      throw new TillAuthVerifyError('MFA required', 'mfa_required')\n    }\n    // Absent claim (older tokens) is treated as unverified only when the check\n    // is enabled — so requireVerifiedEmail fails closed rather than silently\n    // passing when the issuer predates the claim.\n    if (this.opts.requireVerifiedEmail && claims.email_verified !== true) {\n      throw new TillAuthVerifyError('Email not verified', 'email_not_verified')\n    }\n    return claims\n  }\n\n  /**\n   * Pull a Bearer token out of an Authorization header and verify. Returns\n   * the claims or throws TillAuthVerifyError.\n   */\n  async verifyHeader(authHeader: string | undefined | null): Promise<AuthClaims> {\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      throw new TillAuthVerifyError('Missing Bearer token', 'no_token')\n    }\n    return this.verify(authHeader.slice(7))\n  }\n}\n\n// ── Framework adapters ──────────────────────────────────────────────────────\n\n// Express-style middleware. Adds `req.user` on success.\nexport function expressMiddleware(verifier: TillAuthVerifier, opts: { onError?: (err: TillAuthVerifyError) => unknown } = {}) {\n  return async function (req: ExpressLikeReq, res: ExpressLikeRes, next: () => void) {\n    try {\n      const h = req.headers?.authorization\n      const claims = await verifier.verifyHeader(Array.isArray(h) ? h[0] : h)\n      ;(req as ExpressLikeReq & { user: AuthClaims }).user = claims\n      next()\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      if (opts.onError) {\n        const out = opts.onError(err)\n        if (out !== undefined) {\n          res.status(401).json(out as Record<string, unknown>)\n          return\n        }\n      }\n      res.status(401).json({ error: err.message, code: err.code })\n    }\n  }\n}\n\ninterface ExpressLikeReq {\n  headers?: { authorization?: string | string[] }\n}\ninterface ExpressLikeRes {\n  status: (n: number) => { json: (b: Record<string, unknown>) => void }\n}\n\n// Fastify plugin shape — not bound to Fastify's types to avoid a peer dep.\nexport function fastifyHook(verifier: TillAuthVerifier) {\n  return async function (\n    req: { headers: Record<string, string | string[] | undefined>; user?: AuthClaims },\n    reply: { code: (n: number) => { send: (b: unknown) => void } },\n  ) {\n    try {\n      const h = req.headers['authorization']\n      const auth = Array.isArray(h) ? h[0] : h\n      const claims = await verifier.verifyHeader(auth)\n      req.user = claims\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      reply.code(401).send({ error: err.message, code: err.code })\n    }\n  }\n}\n\n// Convenience entrypoint for users who want a one-call setup.\nexport function createVerifier(opts: VerifyOptions): TillAuthVerifier {\n  return new TillAuthVerifier(opts)\n}\n\nexport { createFetchHandler, expressCookieProxy } from './cookie-proxy.js'\nexport type { CookieProxyOptions } from './cookie-proxy.js'\n"]}

package/dist/index.d.cts

@@ -43,9 +43,13 @@ interface VerifyOptions {
     apiBase?: string;
     /**
      * Pin verification to exactly one issuer (e.g. a dedicated realm's
-     * `https://auth.tilldev.dev/realms/<app>`). When omitted, the verifier accepts
-     * the legacy string, the canonical HTTPS issuer (derived from `apiBase`), and
-     * any per-realm issuer under it — the migration-window default.
+     * `https://auth.tilldev.dev/realms/<app>`).
+     *
+     * Rarely needed now: when omitted, the verifier accepts the canonical HTTPS issuer
+     * (derived from `apiBase`) and THIS app's own realm issuer — never another realm's.
+     * It previously accepted any realm under `apiBase`, which is what made this option
+     * look load-bearing; it was not, because the key still came from a merged JWKS
+     * (`atrium` `00` D13). The retired legacy `"tillauth"` string is never accepted.
      */
     issuer?: string;
     /**
@@ -89,8 +93,18 @@ declare class TillAuthVerifier {
     private readonly opts;
     private readonly pinnedIssuer;
     private readonly remote;
+    /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */
+    private readonly remoteRealm;
     private readonly inlineKeys;
     constructor(opts: VerifyOptions);
+    /**
+     * The key set entitled to have signed a token carrying `iss`, or `null` if no set
+     * is. Selecting on the UNVERIFIED issuer is safe because the choice is then
+     * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about
+     * its issuer to reach a different key set must still verify against that set — and
+     * that set contains only keys entitled to the issuer it named.
+     */
+    private keySetFor;
     verify(token: string): Promise<AuthClaims>;
     private applyClaimsChecks;
     /**

package/dist/index.d.ts

@@ -43,9 +43,13 @@ interface VerifyOptions {
     apiBase?: string;
     /**
      * Pin verification to exactly one issuer (e.g. a dedicated realm's
-     * `https://auth.tilldev.dev/realms/<app>`). When omitted, the verifier accepts
-     * the legacy string, the canonical HTTPS issuer (derived from `apiBase`), and
-     * any per-realm issuer under it — the migration-window default.
+     * `https://auth.tilldev.dev/realms/<app>`).
+     *
+     * Rarely needed now: when omitted, the verifier accepts the canonical HTTPS issuer
+     * (derived from `apiBase`) and THIS app's own realm issuer — never another realm's.
+     * It previously accepted any realm under `apiBase`, which is what made this option
+     * look load-bearing; it was not, because the key still came from a merged JWKS
+     * (`atrium` `00` D13). The retired legacy `"tillauth"` string is never accepted.
      */
     issuer?: string;
     /**
@@ -89,8 +93,18 @@ declare class TillAuthVerifier {
     private readonly opts;
     private readonly pinnedIssuer;
     private readonly remote;
+    /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */
+    private readonly remoteRealm;
     private readonly inlineKeys;
     constructor(opts: VerifyOptions);
+    /**
+     * The key set entitled to have signed a token carrying `iss`, or `null` if no set
+     * is. Selecting on the UNVERIFIED issuer is safe because the choice is then
+     * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about
+     * its issuer to reach a different key set must still verify against that set — and
+     * that set contains only keys entitled to the issuer it named.
+     */
+    private keySetFor;
     verify(token: string): Promise<AuthClaims>;
     private applyClaimsChecks;
     /**

package/dist/index.js

@@ -1,4 +1,4 @@
-import { importJWK, createRemoteJWKSet, jwtVerify } from 'jose';
+import { importJWK, createRemoteJWKSet, jwtVerify, decodeJwt } from 'jose';
 
 // src/index.ts
 
@@ -135,19 +135,15 @@ function parseCookieHeader(header) {
 
 // src/index.ts
 var DEFAULT_API2 = "https://auth.tilldev.dev";
-var LEGACY_ISSUER = "tillauth";
 var REALM_SEGMENT = "/realms/";
 function trimSlash(s) {
   return s.replace(/\/+$/, "");
 }
-function issuerAccepted(iss, canonical, pinnedIssuer) {
+function issuerAccepted(iss, canonical, appId, pinnedIssuer) {
   if (typeof iss !== "string" || iss.length === 0) return false;
-  if (iss === LEGACY_ISSUER) return true;
   if (pinnedIssuer) return iss === trimSlash(pinnedIssuer);
   const canon = trimSlash(canonical);
-  if (iss === canon) return true;
-  const prefix = `${canon}${REALM_SEGMENT}`;
-  return iss.startsWith(prefix) && iss.length > prefix.length;
+  return iss === canon || iss === `${canon}${REALM_SEGMENT}${appId}`;
 }
 var TillAuthVerifyError = class extends Error {
   constructor(message, code) {
@@ -158,6 +154,8 @@ var TillAuthVerifyError = class extends Error {
 };
 var TillAuthVerifier = class {
   constructor(opts) {
+    /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */
+    this.remoteRealm = null;
     if (!opts.appId) throw new Error("TillAuthVerifier: appId is required");
     this.opts = {
       appId: opts.appId,
@@ -173,9 +171,25 @@ var TillAuthVerifier = class {
       );
     } else {
       this.remote = createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`));
+      this.remoteRealm = createRemoteJWKSet(
+        new URL(`${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}/.well-known/jwks.json`)
+      );
       this.inlineKeys = null;
     }
   }
+  /**
+   * The key set entitled to have signed a token carrying `iss`, or `null` if no set
+   * is. Selecting on the UNVERIFIED issuer is safe because the choice is then
+   * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about
+   * its issuer to reach a different key set must still verify against that set — and
+   * that set contains only keys entitled to the issuer it named.
+   */
+  keySetFor(iss) {
+    if (typeof iss !== "string") return null;
+    if (iss === this.opts.apiBase) return this.remote;
+    if (iss === `${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}`) return this.remoteRealm;
+    return null;
+  }
   async verify(token) {
     if (!token) throw new TillAuthVerifyError("No token", "no_token");
     let claims;
@@ -194,7 +208,15 @@ var TillAuthVerifier = class {
         }
         throw lastErr ?? new Error("No key matched");
       }
-      const { payload } = await jwtVerify(token, this.remote, { algorithms: ["EdDSA"] });
+      const unverifiedIss = decodeJwt(token).iss;
+      const keySet = this.keySetFor(unverifiedIss);
+      if (!keySet) {
+        throw new TillAuthVerifyError("Untrusted token issuer", "invalid_issuer");
+      }
+      const { payload } = await jwtVerify(token, keySet, {
+        algorithms: ["EdDSA"],
+        issuer: unverifiedIss
+      });
       claims = payload;
     } catch (e) {
       if (e instanceof TillAuthVerifyError) throw e;
@@ -206,7 +228,7 @@ var TillAuthVerifier = class {
     return this.applyClaimsChecks(claims);
   }
   applyClaimsChecks(claims) {
-    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.pinnedIssuer)) {
+    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.opts.appId, this.pinnedIssuer)) {
       throw new TillAuthVerifyError("Untrusted token issuer", "invalid_issuer");
     }
     if (claims.app !== this.opts.appId) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cookie-proxy.ts","../src/index.ts"],"names":["DEFAULT_API","payload"],"mappings":";;;;;AAWA,IAAM,WAAA,GAAc,0BAAA;AAuCpB,SAAS,QAAQ,IAAA,EAAwD;AACvE,EAAA,OAAO;AAAA,IACL,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,UAAU,IAAA,CAAK,OAAA,IAAW,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,IACxD,YAAA,EAAc,KAAK,YAAA,IAAgB,QAAA;AAAA,IACnC,aAAA,EAAe,KAAK,aAAA,IAAiB,QAAA;AAAA,IACrC,UAAA,EAAY,KAAK,UAAA,IAAc,GAAA;AAAA,IAC/B,YAAA,EAAc,KAAK,YAAA,IAAgB,EAAA;AAAA,IACnC,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,IAAI,QAAA,KAAa;AAAA,GAClD;AACF;AAEA,SAAS,WACP,IAAA,EACA,KAAA,EACA,CAAA,EACA,IAAA,GAA6C,EAAC,EACtC;AACR,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,KAAA,GAAQ,EAAA,GAAK,KAAK,CAAA,CAAE,CAAA;AACnD,EAAA,KAAA,CAAM,KAAK,UAAU,CAAA;AACrB,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AACjC,EAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,EAAE,YAAA,EAAc,KAAA,CAAM,KAAK,CAAA,OAAA,EAAU,CAAA,CAAE,YAAY,CAAA,CAAE,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AAAA,OAAA,IAC7B,IAAA,CAAK,WAAW,MAAA,EAAW,KAAA,CAAM,KAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvE,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,WAAA,CAAY,KAAwB,GAAA,EAAsD;AACvG,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAG5C,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAO,IAAI,CAAA,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,kBAAkB,IAAA,CAAK,KAAA;AAAA,IACvB,YAAA,EAAc;AAAA,GAChB;AAGA,EAAA,IAAI,OAAO,GAAA,CAAI,IAAA;AACf,EAAA,IAAI,SAAS,IAAA,IAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AACnD,IAAA,OAAA,CAAQ,gBAAgB,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,QACnD,YAAY,EAAC;AAAA,QACb,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAChD;AAAA,IACF;AACA,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,EAAE,aAAA,EAAe,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAA,EAAe,EAAA,IAAM,IAAI,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,EAAA,IAAI,OAAiB,EAAC;AACtB,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,IAAA,EAAK;AAEtB,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,IAAA,CAAK,YAAA,EAAc,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AAC3F,IAAA,OAAO,GAAA,CAAI,YAAA;AAAA,EACb;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,aAAA,KAAkB,QAAA,EAAU;AAE1C,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,KAAK,aAAA,EAAe,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AACvG,IAAA,OAAO,GAAA,CAAI,aAAA;AACX,IAAA,OAAO,GAAA,CAAI,kBAAA;AAAA,EACb;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AACxE,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACxB,UAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAChD;AACF;AAIO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAe,OAAA,CAAQ,GAAA,EAAc,GAAA,GAAiD,EAAC,EAAsB;AAClH,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAG3B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,GAAA,CAAI,QAAQ,IAAA,EAAM;AACpB,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAA,CAAA;AAAA,IACnG,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,UAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAC3D,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA,KAAW,SAAS,MAAM,GAAA,CAAI,MAAK,GAAI,IAAA;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAA;AACnF,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAC,CAAA;AAC9D,IAAA,OAAO,IAAI,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,CAAA;AAAA,EAC/D,CAAA;AACF;AAkBO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAgB,KAAa,GAAA,EAA4B;AAC9D,IAAA,MAAM,OACJ,GAAA,CAAI,IAAA,IAAA,CAAS,GAAA,CAAI,WAAA,IAAe,IAAI,GAAA,IAAO,GAAA,EAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAC/F,IAAA,MAAM,eACJ,OAAO,GAAA,CAAI,QAAQ,MAAA,KAAW,QAAA,GAAW,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC5H,IAAA,MAAM,IAAA,GACJ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,IAAA,GAAO,GAAA,CAAI,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAClF,IAAA,MAAM,MAAM,MAAM,WAAA;AAAA,MAChB;AAAA,QACE,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,QAAA,EAAU,IAAA;AAAA,QACV,IAAA;AAAA,QACA,OAAA,EAAS,iBAAA,CAAkB,YAAA,IAAgB,IAAI;AAAA,OACjD;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,MAAA,CAAO,IAAI,MAAM,CAAA;AACrB,IAAA,IAAI,GAAA,CAAI,WAAW,MAAA,GAAS,CAAA,MAAO,SAAA,CAAU,YAAA,EAAc,IAAI,UAAU,CAAA;AACzE,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AACpE,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC/B,CAAA;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA+C;AACxE,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAC1C,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;;;ACnNA,IAAMA,YAAAA,GAAc,0BAAA;AACpB,IAAM,aAAA,GAAgB,UAAA;AACtB,IAAM,aAAA,GAAgB,UAAA;AAEtB,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC7B;AASA,SAAS,cAAA,CAAe,GAAA,EAAc,SAAA,EAAmB,YAAA,EAAgC;AACvF,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,GAAA,KAAQ,eAAe,OAAO,IAAA;AAClC,EAAA,IAAI,YAAA,EAAc,OAAO,GAAA,KAAQ,SAAA,CAAU,YAAY,CAAA;AACvD,EAAA,MAAM,KAAA,GAAQ,UAAU,SAAS,CAAA;AACjC,EAAA,IAAI,GAAA,KAAQ,OAAO,OAAO,IAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,CAAA,EAAG,KAAK,CAAA,EAAG,aAAa,CAAA,CAAA;AACvC,EAAA,OAAO,IAAI,UAAA,CAAW,MAAM,CAAA,IAAK,GAAA,CAAI,SAAS,MAAA,CAAO,MAAA;AACvD;AAiDO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAE7C,WAAA,CAAY,SAAiB,IAAA,EAAmC;AAC9D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,MAAuB;AAAA,EAM5B,YAAY,IAAA,EAAqB;AAC/B,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACtE,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,OAAA,IAAWA,YAAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxD,oBAAA,EAAsB,KAAK,oBAAA,IAAwB,KAAA;AAAA,MACnD,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KACjC;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,MAAA,GAAS,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,GAAI,MAAA;AACnE,IAAA,IAAI,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,MAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,GAAA;AAAA,QACxB,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAO,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,KAAK,MAAM,SAAA,CAAU,CAAA,EAAG,OAAO,GAAE,CAAE;AAAA,OACrF;AAAA,IACF,CAAA,MAAO;AACL,MAAA,IAAA,CAAK,MAAA,GAAS,mBAAmB,IAAI,GAAA,CAAI,GAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAwB,CAAC,CAAA;AACtF,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,KAAA,EAAoC;AAC/C,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,mBAAA,CAAoB,YAAY,UAAU,CAAA;AAEhE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA;AACxB,QAAA,IAAI,OAAA;AACJ,QAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,UAAA,IAAI;AAGF,YAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,KAAA,EAAO,CAAA,CAAE,GAAA,EAAK,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAC3E,YAAA,MAAA,GAASA,QAAAA;AACT,YAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,UACtC,SAAS,CAAA,EAAG;AACV,YAAA,OAAA,GAAU,CAAA;AAAA,UACZ;AAAA,QACF;AACA,QAAA,MAAM,OAAA,IAAW,IAAI,KAAA,CAAM,gBAAgB,CAAA;AAAA,MAC7C;AACA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,KAAA,EAAO,IAAA,CAAK,MAAA,EAAS,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAClF,MAAA,MAAA,GAAS,OAAA;AAAA,IACX,SAAS,CAAA,EAAG;AAIV,MAAA,IAAI,CAAA,YAAa,qBAAqB,MAAM,CAAA;AAC5C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,eAAA;AAAA,QACjC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,EACtC;AAAA,EAEQ,kBAAkB,MAAA,EAAgC;AAGxD,IAAA,IAAI,CAAC,eAAe,MAAA,CAAO,GAAA,EAAK,KAAK,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,YAAY,CAAA,EAAG;AACrE,MAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,CAAA,EAAkC,WAAW,CAAA;AAAA,IAC7E;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,CAAC,OAAO,GAAA,EAAK;AACvC,MAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgB,cAAc,CAAA;AAAA,IAC9D;AAIA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,oBAAA,IAAwB,MAAA,CAAO,mBAAmB,IAAA,EAAM;AACpE,MAAA,MAAM,IAAI,mBAAA,CAAoB,oBAAA,EAAsB,oBAAoB,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAAA,EAA4D;AAC7E,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,mBAAA,CAAoB,sBAAA,EAAwB,UAAU,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACxC;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAA4B,IAAA,GAA4D,EAAC,EAAG;AAC5H,EAAA,OAAO,eAAgB,GAAA,EAAqB,GAAA,EAAqB,IAAA,EAAkB;AACjF,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,OAAA,EAAS,aAAA;AACvB,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAC,CAAA;AACrE,MAAC,IAA8C,IAAA,GAAO,MAAA;AACvD,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAA8B,CAAA;AACnD,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAUO,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,OAAO,eACL,KACA,KAAA,EACA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACrC,MAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACvC,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,IAAI,CAAA;AAC/C,MAAA,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,IACb,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAGO,SAAS,eAAe,IAAA,EAAuC;AACpE,EAAA,OAAO,IAAI,iBAAiB,IAAI,CAAA;AAClC","file":"index.js","sourcesContent":["// Cookie-mode proxy for TillAuth.\n//\n// Mount this on the customer's backend (typically at /api/auth/*). It\n// forwards JSON bodies to TillAuth's /v1/* endpoints, then translates\n// access_token + refresh_token in the response into HttpOnly cookies on\n// the customer's domain. The browser's localStorage never sees the\n// tokens — XSS can't exfiltrate them.\n//\n// Two adapters: a generic web-fetch handler (Cloudflare Workers, Next.js\n// Route Handlers, Bun, Deno) and an Express middleware. Pick one.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\n\nexport interface CookieProxyOptions {\n  /** TillAuth public app id (`tau_…`). */\n  appId: string\n  /** Override the TillAuth API base. */\n  apiBase?: string\n  /** Cookie name for the access token. Default `tau_at`. */\n  accessCookie?: string\n  /** Cookie name for the refresh token. Default `tau_rt`. */\n  refreshCookie?: string\n  /** Cookie path. Default '/'. */\n  cookiePath?: string\n  /** Cookie domain (e.g. `.example.com` to share across subdomains). */\n  cookieDomain?: string\n  /** Secure flag. Defaults to true in production, false otherwise. */\n  secure?: boolean\n}\n\ninterface NormalizedRequest {\n  method: string\n  pathname: string // path relative to the mount point (`/signin`, `/refresh`)\n  body: string\n  cookies: Record<string, string>\n}\ninterface NormalizedResponse {\n  status: number\n  body: string\n  setCookies: string[]\n  headers: Record<string, string>\n}\n\ninterface AuthBody {\n  access_token?: string\n  refresh_token?: string\n  refresh_expires_at?: string\n  [key: string]: unknown\n}\n\nfunction resolve(opts: CookieProxyOptions): Required<CookieProxyOptions> {\n  return {\n    appId: opts.appId,\n    apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n    accessCookie: opts.accessCookie ?? 'tau_at',\n    refreshCookie: opts.refreshCookie ?? 'tau_rt',\n    cookiePath: opts.cookiePath ?? '/',\n    cookieDomain: opts.cookieDomain ?? '',\n    secure: opts.secure ?? process.env.NODE_ENV === 'production',\n  }\n}\n\nfunction makeCookie(\n  name: string,\n  value: string,\n  o: Required<CookieProxyOptions>,\n  opts: { maxAge?: number; clear?: boolean } = {},\n): string {\n  const parts = [`${name}=${opts.clear ? '' : value}`]\n  parts.push('HttpOnly')\n  if (o.secure) parts.push('Secure')\n  parts.push('SameSite=Lax')\n  parts.push(`Path=${o.cookiePath}`)\n  if (o.cookieDomain) parts.push(`Domain=${o.cookieDomain}`)\n  if (opts.clear) parts.push('Max-Age=0')\n  else if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`)\n  return parts.join('; ')\n}\n\nasync function handleProxy(req: NormalizedRequest, raw: CookieProxyOptions): Promise<NormalizedResponse> {\n  const opts = resolve(raw)\n  const path = req.pathname.replace(/^\\/+/, '')\n\n  // Map proxy paths → TillAuth paths.\n  const url = `${opts.apiBase}/v1/${path}`\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'X-TillAuth-App': opts.appId,\n    'User-Agent': 'tilldev-auth-node/cookie-proxy',\n  }\n\n  // /me, /refresh, /signout need to carry tokens from cookies, not the body.\n  let body = req.body\n  if (path === 'me' && req.cookies[opts.accessCookie]) {\n    headers.Authorization = `Bearer ${req.cookies[opts.accessCookie]}`\n  }\n  if (path === 'refresh') {\n    const rt = req.cookies[opts.refreshCookie]\n    if (!rt) {\n      return {\n        status: 401,\n        body: JSON.stringify({ error: 'no refresh cookie' }),\n        setCookies: [],\n        headers: { 'Content-Type': 'application/json' },\n      }\n    }\n    body = JSON.stringify({ refresh_token: rt })\n  }\n  if (path === 'signout') {\n    const rt = req.cookies[opts.refreshCookie]\n    body = JSON.stringify({ refresh_token: rt ?? '' })\n  }\n\n  const upstream = await fetch(url, { method: req.method, headers, body })\n  const text = await upstream.text()\n  let json: AuthBody = {}\n  try {\n    json = JSON.parse(text) as AuthBody\n  } catch {\n    json = {}\n  }\n\n  const setCookies: string[] = []\n  // Always strip token fields before returning to the SPA.\n  const out = { ...json }\n\n  if (typeof json.access_token === 'string') {\n    setCookies.push(makeCookie(opts.accessCookie, json.access_token, opts, { maxAge: 60 * 10 }))\n    delete out.access_token\n  }\n  if (typeof json.refresh_token === 'string') {\n    // 30d in line with the Fastify REFRESH_TTL_MS.\n    setCookies.push(makeCookie(opts.refreshCookie, json.refresh_token, opts, { maxAge: 60 * 60 * 24 * 30 }))\n    delete out.refresh_token\n    delete out.refresh_expires_at\n  }\n  if (path === 'signout') {\n    setCookies.push(makeCookie(opts.accessCookie, '', opts, { clear: true }))\n    setCookies.push(makeCookie(opts.refreshCookie, '', opts, { clear: true }))\n  }\n\n  return {\n    status: upstream.status,\n    body: JSON.stringify(out),\n    setCookies,\n    headers: { 'Content-Type': 'application/json' },\n  }\n}\n\n// ── Adapter 1: web-fetch (Next.js Route Handlers, Workers, Bun, Deno) ───────\n\nexport function createFetchHandler(opts: CookieProxyOptions) {\n  return async function handler(req: Request, ctx: { params?: { path?: string | string[] } } = {}): Promise<Response> {\n    const url = new URL(req.url)\n    // Derive the proxy-relative path. Prefer ctx.params.path (Next.js catch-all);\n    // fall back to the part of the URL after the mount point heuristic.\n    let pathname: string\n    if (ctx.params?.path) {\n      pathname = Array.isArray(ctx.params.path) ? `/${ctx.params.path.join('/')}` : `/${ctx.params.path}`\n    } else {\n      pathname = url.pathname.replace(/^\\/api\\/auth/, '')\n    }\n    const cookies = parseCookieHeader(req.headers.get('cookie'))\n    const body = req.method === 'POST' ? await req.text() : '{}'\n    const out = await handleProxy({ method: req.method, pathname, body, cookies }, opts)\n    const headers = new Headers(out.headers)\n    for (const c of out.setCookies) headers.append('Set-Cookie', c)\n    return new Response(out.body, { status: out.status, headers })\n  }\n}\n\n// ── Adapter 2: Express ──────────────────────────────────────────────────────\n\ninterface ExpReq {\n  method: string\n  url?: string\n  originalUrl?: string\n  path?: string\n  body?: unknown\n  headers: Record<string, string | string[] | undefined>\n}\ninterface ExpRes {\n  status(n: number): ExpRes\n  setHeader(name: string, value: string | string[]): void\n  json(body: unknown): void\n}\n\nexport function expressCookieProxy(opts: CookieProxyOptions) {\n  return async function (req: ExpReq, res: ExpRes): Promise<void> {\n    const path =\n      req.path ?? (req.originalUrl ?? req.url ?? '/').replace(/^\\/api\\/auth/, '').split('?')[0] ?? '/'\n    const cookieHeader =\n      typeof req.headers.cookie === 'string' ? req.headers.cookie : Array.isArray(req.headers.cookie) ? req.headers.cookie[0] : ''\n    const body =\n      typeof req.body === 'string' ? req.body : req.body ? JSON.stringify(req.body) : '{}'\n    const out = await handleProxy(\n      {\n        method: req.method,\n        pathname: path,\n        body,\n        cookies: parseCookieHeader(cookieHeader ?? null),\n      },\n      opts,\n    )\n    res.status(out.status)\n    if (out.setCookies.length > 0) res.setHeader('Set-Cookie', out.setCookies)\n    for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v)\n    res.json(JSON.parse(out.body))\n  }\n}\n\nfunction parseCookieHeader(header: string | null): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!header) return out\n  for (const part of header.split(';')) {\n    const [k, ...rest] = part.trim().split('=')\n    if (!k) continue\n    out[k] = decodeURIComponent(rest.join('='))\n  }\n  return out\n}\n","import { jwtVerify, createRemoteJWKSet, importJWK, type JWK } from 'jose'\n\n// Server-side TillAuth verification.\n//\n// You configure once with the issuer + JWKS endpoint (or inline public keys),\n// then call `verify(token)` or use the framework-specific middleware.\n//\n// Verification is offline against the cached JWKS — no round-trip to TillAuth\n// on the hot path.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\nconst LEGACY_ISSUER = 'tillauth'\nconst REALM_SEGMENT = '/realms/'\n\nfunction trimSlash(s: string): string {\n  return s.replace(/\\/+$/, '')\n}\n\n/**\n * Dual-accept issuer check. TillAuth is migrating access tokens from the legacy\n * `\"tillauth\"` string to a canonical HTTPS issuer (equal to `apiBase`) and, for\n * dedicated realms, a per-realm issuer `{apiBase}/realms/<app>`. During the\n * migration window a verifier accepts all three. Pass `pinnedIssuer` (the\n * `issuer` option) to hard-pin to exactly one realm's issuer instead.\n */\nfunction issuerAccepted(iss: unknown, canonical: string, pinnedIssuer?: string): boolean {\n  if (typeof iss !== 'string' || iss.length === 0) return false\n  if (iss === LEGACY_ISSUER) return true // legacy window\n  if (pinnedIssuer) return iss === trimSlash(pinnedIssuer)\n  const canon = trimSlash(canonical)\n  if (iss === canon) return true\n  const prefix = `${canon}${REALM_SEGMENT}`\n  return iss.startsWith(prefix) && iss.length > prefix.length\n}\n\nexport interface VerifyOptions {\n  /** TillAuth public app id (`tau_…`). Used to enforce app scoping. */\n  appId: string\n  /** TillAuth API base. Defaults to https://auth.tilldev.dev */\n  apiBase?: string\n  /**\n   * Pin verification to exactly one issuer (e.g. a dedicated realm's\n   * `https://auth.tilldev.dev/realms/<app>`). When omitted, the verifier accepts\n   * the legacy string, the canonical HTTPS issuer (derived from `apiBase`), and\n   * any per-realm issuer under it — the migration-window default.\n   */\n  issuer?: string\n  /**\n   * Inline JWKS as a JWK array (the same `publicJwk` entries you'd find in\n   * the TILLAUTH_JWT_KEYS env). Use this in environments where you want\n   * fully air-gapped verification.\n   */\n  publicJwks?: JWK[]\n  /** Require email_verified=true. Defaults to false. */\n  requireVerifiedEmail?: boolean\n  /** Require MFA was satisfied this session. Defaults to false. */\n  requireMfa?: boolean\n}\n\nexport interface AuthClaims {\n  /** User id */\n  sub: string\n  /** App id the token was issued for */\n  app: string\n  /** Lowercased email */\n  email: string\n  /** Whether MFA was satisfied this session */\n  mfa: boolean\n  /**\n   * Whether the account's email was verified at issue time. Optional: tokens\n   * minted before this claim existed omit it. When `requireVerifiedEmail` is\n   * set, an absent claim is treated as unverified (fail-closed on the check).\n   */\n  email_verified?: boolean\n  /** Token issuer — validated against the accepted set (see `issuerAccepted`). */\n  iss?: string\n  /** Issued-at (seconds) */\n  iat: number\n  /** Expires-at (seconds) */\n  exp: number\n}\n\nexport class TillAuthVerifyError extends Error {\n  code: 'no_token' | 'invalid_token' | 'wrong_app' | 'mfa_required' | 'email_not_verified' | 'invalid_issuer'\n  constructor(message: string, code: TillAuthVerifyError['code']) {\n    super(message)\n    this.name = 'TillAuthVerifyError'\n    this.code = code\n  }\n}\n\nexport class TillAuthVerifier {\n  private readonly opts: Required<Pick<VerifyOptions, 'appId' | 'apiBase' | 'requireVerifiedEmail' | 'requireMfa'>>\n  private readonly pinnedIssuer: string | undefined\n  private readonly remote: ReturnType<typeof createRemoteJWKSet> | null\n  private readonly inlineKeys: Promise<Array<{ kid?: string; key: Awaited<ReturnType<typeof importJWK>> }>> | null\n\n  constructor(opts: VerifyOptions) {\n    if (!opts.appId) throw new Error('TillAuthVerifier: appId is required')\n    this.opts = {\n      appId: opts.appId,\n      apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n      requireVerifiedEmail: opts.requireVerifiedEmail ?? false,\n      requireMfa: opts.requireMfa ?? false,\n    }\n    this.pinnedIssuer = opts.issuer ? opts.issuer.replace(/\\/$/, '') : undefined\n    if (opts.publicJwks && opts.publicJwks.length > 0) {\n      this.remote = null\n      this.inlineKeys = Promise.all(\n        opts.publicJwks.map(async (k) => ({ kid: k.kid, key: await importJWK(k, 'EdDSA') })),\n      )\n    } else {\n      this.remote = createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`))\n      this.inlineKeys = null\n    }\n  }\n\n  async verify(token: string): Promise<AuthClaims> {\n    if (!token) throw new TillAuthVerifyError('No token', 'no_token')\n\n    let claims: AuthClaims\n    try {\n      if (this.inlineKeys) {\n        const keys = await this.inlineKeys\n        let lastErr: unknown\n        for (const k of keys) {\n          try {\n            // No jose `issuer` pin — the issuer is one of several accepted values\n            // (legacy string / canonical HTTPS / per-realm), checked below.\n            const { payload } = await jwtVerify(token, k.key, { algorithms: ['EdDSA'] })\n            claims = payload as unknown as AuthClaims\n            return this.applyClaimsChecks(claims)\n          } catch (e) {\n            lastErr = e\n          }\n        }\n        throw lastErr ?? new Error('No key matched')\n      }\n      const { payload } = await jwtVerify(token, this.remote!, { algorithms: ['EdDSA'] })\n      claims = payload as unknown as AuthClaims\n    } catch (e) {\n      // Preserve a specific claims verdict (wrong_app / invalid_issuer) thrown by\n      // applyClaimsChecks on the inline path; only a genuine signature/JWKS\n      // failure becomes the generic invalid_token.\n      if (e instanceof TillAuthVerifyError) throw e\n      throw new TillAuthVerifyError(\n        e instanceof Error ? e.message : 'Invalid token',\n        'invalid_token',\n      )\n    }\n    return this.applyClaimsChecks(claims)\n  }\n\n  private applyClaimsChecks(claims: AuthClaims): AuthClaims {\n    // Issuer is validated here (jose's exact `issuer` pin is intentionally not\n    // used) so the legacy→HTTPS→per-realm migration doesn't break verification.\n    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.pinnedIssuer)) {\n      throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n    }\n    if (claims.app !== this.opts.appId) {\n      throw new TillAuthVerifyError(`Token issued for different app`, 'wrong_app')\n    }\n    if (this.opts.requireMfa && !claims.mfa) {\n      throw new TillAuthVerifyError('MFA required', 'mfa_required')\n    }\n    // Absent claim (older tokens) is treated as unverified only when the check\n    // is enabled — so requireVerifiedEmail fails closed rather than silently\n    // passing when the issuer predates the claim.\n    if (this.opts.requireVerifiedEmail && claims.email_verified !== true) {\n      throw new TillAuthVerifyError('Email not verified', 'email_not_verified')\n    }\n    return claims\n  }\n\n  /**\n   * Pull a Bearer token out of an Authorization header and verify. Returns\n   * the claims or throws TillAuthVerifyError.\n   */\n  async verifyHeader(authHeader: string | undefined | null): Promise<AuthClaims> {\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      throw new TillAuthVerifyError('Missing Bearer token', 'no_token')\n    }\n    return this.verify(authHeader.slice(7))\n  }\n}\n\n// ── Framework adapters ──────────────────────────────────────────────────────\n\n// Express-style middleware. Adds `req.user` on success.\nexport function expressMiddleware(verifier: TillAuthVerifier, opts: { onError?: (err: TillAuthVerifyError) => unknown } = {}) {\n  return async function (req: ExpressLikeReq, res: ExpressLikeRes, next: () => void) {\n    try {\n      const h = req.headers?.authorization\n      const claims = await verifier.verifyHeader(Array.isArray(h) ? h[0] : h)\n      ;(req as ExpressLikeReq & { user: AuthClaims }).user = claims\n      next()\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      if (opts.onError) {\n        const out = opts.onError(err)\n        if (out !== undefined) {\n          res.status(401).json(out as Record<string, unknown>)\n          return\n        }\n      }\n      res.status(401).json({ error: err.message, code: err.code })\n    }\n  }\n}\n\ninterface ExpressLikeReq {\n  headers?: { authorization?: string | string[] }\n}\ninterface ExpressLikeRes {\n  status: (n: number) => { json: (b: Record<string, unknown>) => void }\n}\n\n// Fastify plugin shape — not bound to Fastify's types to avoid a peer dep.\nexport function fastifyHook(verifier: TillAuthVerifier) {\n  return async function (\n    req: { headers: Record<string, string | string[] | undefined>; user?: AuthClaims },\n    reply: { code: (n: number) => { send: (b: unknown) => void } },\n  ) {\n    try {\n      const h = req.headers['authorization']\n      const auth = Array.isArray(h) ? h[0] : h\n      const claims = await verifier.verifyHeader(auth)\n      req.user = claims\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      reply.code(401).send({ error: err.message, code: err.code })\n    }\n  }\n}\n\n// Convenience entrypoint for users who want a one-call setup.\nexport function createVerifier(opts: VerifyOptions): TillAuthVerifier {\n  return new TillAuthVerifier(opts)\n}\n\nexport { createFetchHandler, expressCookieProxy } from './cookie-proxy.js'\nexport type { CookieProxyOptions } from './cookie-proxy.js'\n"]}
+{"version":3,"sources":["../src/cookie-proxy.ts","../src/index.ts"],"names":["DEFAULT_API","payload"],"mappings":";;;;;AAWA,IAAM,WAAA,GAAc,0BAAA;AAuCpB,SAAS,QAAQ,IAAA,EAAwD;AACvE,EAAA,OAAO;AAAA,IACL,OAAO,IAAA,CAAK,KAAA;AAAA,IACZ,UAAU,IAAA,CAAK,OAAA,IAAW,WAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,IACxD,YAAA,EAAc,KAAK,YAAA,IAAgB,QAAA;AAAA,IACnC,aAAA,EAAe,KAAK,aAAA,IAAiB,QAAA;AAAA,IACrC,UAAA,EAAY,KAAK,UAAA,IAAc,GAAA;AAAA,IAC/B,YAAA,EAAc,KAAK,YAAA,IAAgB,EAAA;AAAA,IACnC,MAAA,EAAQ,IAAA,CAAK,MAAA,IAAU,OAAA,CAAQ,IAAI,QAAA,KAAa;AAAA,GAClD;AACF;AAEA,SAAS,WACP,IAAA,EACA,KAAA,EACA,CAAA,EACA,IAAA,GAA6C,EAAC,EACtC;AACR,EAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,EAAG,IAAI,IAAI,IAAA,CAAK,KAAA,GAAQ,EAAA,GAAK,KAAK,CAAA,CAAE,CAAA;AACnD,EAAA,KAAA,CAAM,KAAK,UAAU,CAAA;AACrB,EAAA,IAAI,CAAA,CAAE,MAAA,EAAQ,KAAA,CAAM,IAAA,CAAK,QAAQ,CAAA;AACjC,EAAA,KAAA,CAAM,KAAK,cAAc,CAAA;AACzB,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,KAAA,EAAQ,CAAA,CAAE,UAAU,CAAA,CAAE,CAAA;AACjC,EAAA,IAAI,EAAE,YAAA,EAAc,KAAA,CAAM,KAAK,CAAA,OAAA,EAAU,CAAA,CAAE,YAAY,CAAA,CAAE,CAAA;AACzD,EAAA,IAAI,IAAA,CAAK,KAAA,EAAO,KAAA,CAAM,IAAA,CAAK,WAAW,CAAA;AAAA,OAAA,IAC7B,IAAA,CAAK,WAAW,MAAA,EAAW,KAAA,CAAM,KAAK,CAAA,QAAA,EAAW,IAAA,CAAK,MAAM,CAAA,CAAE,CAAA;AACvE,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;AAEA,eAAe,WAAA,CAAY,KAAwB,GAAA,EAAsD;AACvG,EAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,EAAA,MAAM,IAAA,GAAO,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,QAAQ,EAAE,CAAA;AAG5C,EAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAA,CAAK,OAAO,OAAO,IAAI,CAAA,CAAA;AAEtC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,cAAA,EAAgB,kBAAA;AAAA,IAChB,kBAAkB,IAAA,CAAK,KAAA;AAAA,IACvB,YAAA,EAAc;AAAA,GAChB;AAGA,EAAA,IAAI,OAAO,GAAA,CAAI,IAAA;AACf,EAAA,IAAI,SAAS,IAAA,IAAQ,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAA,EAAG;AACnD,IAAA,OAAA,CAAQ,gBAAgB,CAAA,OAAA,EAAU,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,YAAY,CAAC,CAAA,CAAA;AAAA,EAClE;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAI,CAAC,EAAA,EAAI;AACP,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,GAAA;AAAA,QACR,MAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,qBAAqB,CAAA;AAAA,QACnD,YAAY,EAAC;AAAA,QACb,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,OAChD;AAAA,IACF;AACA,IAAA,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,EAAE,aAAA,EAAe,IAAI,CAAA;AAAA,EAC7C;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,MAAM,EAAA,GAAK,GAAA,CAAI,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA;AACzC,IAAA,IAAA,GAAO,KAAK,SAAA,CAAU,EAAE,aAAA,EAAe,EAAA,IAAM,IAAI,CAAA;AAAA,EACnD;AAEA,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,QAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,IAAA,EAAM,CAAA;AACvE,EAAA,MAAM,IAAA,GAAO,MAAM,QAAA,CAAS,IAAA,EAAK;AACjC,EAAA,IAAI,OAAiB,EAAC;AACtB,EAAA,IAAI;AACF,IAAA,IAAA,GAAO,IAAA,CAAK,MAAM,IAAI,CAAA;AAAA,EACxB,CAAA,CAAA,MAAQ;AACN,IAAA,IAAA,GAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,aAAuB,EAAC;AAE9B,EAAA,MAAM,GAAA,GAAM,EAAE,GAAG,IAAA,EAAK;AAEtB,EAAA,IAAI,OAAO,IAAA,CAAK,YAAA,KAAiB,QAAA,EAAU;AACzC,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,IAAA,CAAK,YAAA,EAAc,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AAC3F,IAAA,OAAO,GAAA,CAAI,YAAA;AAAA,EACb;AACA,EAAA,IAAI,OAAO,IAAA,CAAK,aAAA,KAAkB,QAAA,EAAU;AAE1C,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,KAAK,aAAA,EAAe,IAAA,EAAM,EAAE,MAAA,EAAQ,EAAA,GAAK,EAAA,GAAK,EAAA,GAAK,EAAA,EAAI,CAAC,CAAA;AACvG,IAAA,OAAO,GAAA,CAAI,aAAA;AACX,IAAA,OAAO,GAAA,CAAI,kBAAA;AAAA,EACb;AACA,EAAA,IAAI,SAAS,SAAA,EAAW;AACtB,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,YAAA,EAAc,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AACxE,IAAA,UAAA,CAAW,IAAA,CAAK,UAAA,CAAW,IAAA,CAAK,aAAA,EAAe,EAAA,EAAI,MAAM,EAAE,KAAA,EAAO,IAAA,EAAM,CAAC,CAAA;AAAA,EAC3E;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,QAAA,CAAS,MAAA;AAAA,IACjB,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,GAAG,CAAA;AAAA,IACxB,UAAA;AAAA,IACA,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA;AAAmB,GAChD;AACF;AAIO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAe,OAAA,CAAQ,GAAA,EAAc,GAAA,GAAiD,EAAC,EAAsB;AAClH,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,GAAA,CAAI,GAAG,CAAA;AAG3B,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI,GAAA,CAAI,QAAQ,IAAA,EAAM;AACpB,MAAA,QAAA,GAAW,MAAM,OAAA,CAAQ,GAAA,CAAI,MAAA,CAAO,IAAI,IAAI,CAAA,CAAA,EAAI,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAA,EAAI,GAAA,CAAI,OAAO,IAAI,CAAA,CAAA;AAAA,IACnG,CAAA,MAAO;AACL,MAAA,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA;AAAA,IACpD;AACA,IAAA,MAAM,UAAU,iBAAA,CAAkB,GAAA,CAAI,OAAA,CAAQ,GAAA,CAAI,QAAQ,CAAC,CAAA;AAC3D,IAAA,MAAM,OAAO,GAAA,CAAI,MAAA,KAAW,SAAS,MAAM,GAAA,CAAI,MAAK,GAAI,IAAA;AACxD,IAAA,MAAM,GAAA,GAAM,MAAM,WAAA,CAAY,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,QAAA,EAAU,IAAA,EAAM,OAAA,EAAQ,EAAG,IAAI,CAAA;AACnF,IAAA,MAAM,OAAA,GAAU,IAAI,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA;AACvC,IAAA,KAAA,MAAW,KAAK,GAAA,CAAI,UAAA,EAAY,OAAA,CAAQ,MAAA,CAAO,cAAc,CAAC,CAAA;AAC9D,IAAA,OAAO,IAAI,SAAS,GAAA,CAAI,IAAA,EAAM,EAAE,MAAA,EAAQ,GAAA,CAAI,MAAA,EAAQ,OAAA,EAAS,CAAA;AAAA,EAC/D,CAAA;AACF;AAkBO,SAAS,mBAAmB,IAAA,EAA0B;AAC3D,EAAA,OAAO,eAAgB,KAAa,GAAA,EAA4B;AAC9D,IAAA,MAAM,OACJ,GAAA,CAAI,IAAA,IAAA,CAAS,GAAA,CAAI,WAAA,IAAe,IAAI,GAAA,IAAO,GAAA,EAAK,OAAA,CAAQ,cAAA,EAAgB,EAAE,CAAA,CAAE,KAAA,CAAM,GAAG,CAAA,CAAE,CAAC,CAAA,IAAK,GAAA;AAC/F,IAAA,MAAM,eACJ,OAAO,GAAA,CAAI,QAAQ,MAAA,KAAW,QAAA,GAAW,IAAI,OAAA,CAAQ,MAAA,GAAS,MAAM,OAAA,CAAQ,GAAA,CAAI,QAAQ,MAAM,CAAA,GAAI,IAAI,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,GAAI,EAAA;AAC5H,IAAA,MAAM,IAAA,GACJ,OAAO,GAAA,CAAI,IAAA,KAAS,QAAA,GAAW,GAAA,CAAI,IAAA,GAAO,GAAA,CAAI,IAAA,GAAO,IAAA,CAAK,SAAA,CAAU,GAAA,CAAI,IAAI,CAAA,GAAI,IAAA;AAClF,IAAA,MAAM,MAAM,MAAM,WAAA;AAAA,MAChB;AAAA,QACE,QAAQ,GAAA,CAAI,MAAA;AAAA,QACZ,QAAA,EAAU,IAAA;AAAA,QACV,IAAA;AAAA,QACA,OAAA,EAAS,iBAAA,CAAkB,YAAA,IAAgB,IAAI;AAAA,OACjD;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,MAAA,CAAO,IAAI,MAAM,CAAA;AACrB,IAAA,IAAI,GAAA,CAAI,WAAW,MAAA,GAAS,CAAA,MAAO,SAAA,CAAU,YAAA,EAAc,IAAI,UAAU,CAAA;AACzE,IAAA,KAAA,MAAW,CAAC,CAAA,EAAG,CAAC,CAAA,IAAK,MAAA,CAAO,OAAA,CAAQ,GAAA,CAAI,OAAO,CAAA,EAAG,GAAA,CAAI,SAAA,CAAU,CAAA,EAAG,CAAC,CAAA;AACpE,IAAA,GAAA,CAAI,IAAA,CAAK,IAAA,CAAK,KAAA,CAAM,GAAA,CAAI,IAAI,CAAC,CAAA;AAAA,EAC/B,CAAA;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA+C;AACxE,EAAA,MAAM,MAA8B,EAAC;AACrC,EAAA,IAAI,CAAC,QAAQ,OAAO,GAAA;AACpB,EAAA,KAAA,MAAW,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,EAAG;AACpC,IAAA,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,IAAA,CAAK,IAAA,EAAK,CAAE,KAAA,CAAM,GAAG,CAAA;AAC1C,IAAA,IAAI,CAAC,CAAA,EAAG;AACR,IAAA,GAAA,CAAI,CAAC,CAAA,GAAI,kBAAA,CAAmB,IAAA,CAAK,IAAA,CAAK,GAAG,CAAC,CAAA;AAAA,EAC5C;AACA,EAAA,OAAO,GAAA;AACT;;;ACnNA,IAAMA,YAAAA,GAAc,0BAAA;AACpB,IAAM,aAAA,GAAgB,UAAA;AAEtB,SAAS,UAAU,CAAA,EAAmB;AACpC,EAAA,OAAO,CAAA,CAAE,OAAA,CAAQ,MAAA,EAAQ,EAAE,CAAA;AAC7B;AAqBA,SAAS,cAAA,CACP,GAAA,EACA,SAAA,EACA,KAAA,EACA,YAAA,EACS;AACT,EAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,MAAA,KAAW,GAAG,OAAO,KAAA;AACxD,EAAA,IAAI,YAAA,EAAc,OAAO,GAAA,KAAQ,SAAA,CAAU,YAAY,CAAA;AACvD,EAAA,MAAM,KAAA,GAAQ,UAAU,SAAS,CAAA;AACjC,EAAA,OAAO,GAAA,KAAQ,SAAS,GAAA,KAAQ,CAAA,EAAG,KAAK,CAAA,EAAG,aAAa,GAAG,KAAK,CAAA,CAAA;AAClE;AAqDO,IAAM,mBAAA,GAAN,cAAkC,KAAA,CAAM;AAAA,EAE7C,WAAA,CAAY,SAAiB,IAAA,EAAmC;AAC9D,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,qBAAA;AACZ,IAAA,IAAA,CAAK,IAAA,GAAO,IAAA;AAAA,EACd;AACF;AAEO,IAAM,mBAAN,MAAuB;AAAA,EAQ5B,YAAY,IAAA,EAAqB;AAHjC;AAAA,IAAA,IAAA,CAAiB,WAAA,GAA4D,IAAA;AAI3E,IAAA,IAAI,CAAC,IAAA,CAAK,KAAA,EAAO,MAAM,IAAI,MAAM,qCAAqC,CAAA;AACtE,IAAA,IAAA,CAAK,IAAA,GAAO;AAAA,MACV,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,UAAU,IAAA,CAAK,OAAA,IAAWA,YAAAA,EAAa,OAAA,CAAQ,OAAO,EAAE,CAAA;AAAA,MACxD,oBAAA,EAAsB,KAAK,oBAAA,IAAwB,KAAA;AAAA,MACnD,UAAA,EAAY,KAAK,UAAA,IAAc;AAAA,KACjC;AACA,IAAA,IAAA,CAAK,YAAA,GAAe,KAAK,MAAA,GAAS,IAAA,CAAK,OAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA,GAAI,MAAA;AACnE,IAAA,IAAI,IAAA,CAAK,UAAA,IAAc,IAAA,CAAK,UAAA,CAAW,SAAS,CAAA,EAAG;AACjD,MAAA,IAAA,CAAK,MAAA,GAAS,IAAA;AACd,MAAA,IAAA,CAAK,aAAa,OAAA,CAAQ,GAAA;AAAA,QACxB,IAAA,CAAK,UAAA,CAAW,GAAA,CAAI,OAAO,OAAO,EAAE,GAAA,EAAK,CAAA,CAAE,GAAA,EAAK,KAAK,MAAM,SAAA,CAAU,CAAA,EAAG,OAAO,GAAE,CAAE;AAAA,OACrF;AAAA,IACF,CAAA,MAAO;AAeL,MAAA,IAAA,CAAK,MAAA,GAAS,mBAAmB,IAAI,GAAA,CAAI,GAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,sBAAA,CAAwB,CAAC,CAAA;AACtF,MAAA,IAAA,CAAK,WAAA,GAAc,kBAAA;AAAA,QACjB,IAAI,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,aAAa,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,sBAAA,CAAwB;AAAA,OACxF;AACA,MAAA,IAAA,CAAK,UAAA,GAAa,IAAA;AAAA,IACpB;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,UAAU,GAAA,EAA4D;AAC5E,IAAA,IAAI,OAAO,GAAA,KAAQ,QAAA,EAAU,OAAO,IAAA;AACpC,IAAA,IAAI,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,OAAA,SAAgB,IAAA,CAAK,MAAA;AAC3C,IAAA,IAAI,GAAA,KAAQ,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,OAAO,CAAA,EAAG,aAAa,CAAA,EAAG,IAAA,CAAK,IAAA,CAAK,KAAK,CAAA,CAAA,SAAW,IAAA,CAAK,WAAA;AAClF,IAAA,OAAO,IAAA;AAAA,EACT;AAAA,EAEA,MAAM,OAAO,KAAA,EAAoC;AAC/C,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,mBAAA,CAAoB,YAAY,UAAU,CAAA;AAEhE,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI;AACF,MAAA,IAAI,KAAK,UAAA,EAAY;AACnB,QAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,UAAA;AACxB,QAAA,IAAI,OAAA;AACJ,QAAA,KAAA,MAAW,KAAK,IAAA,EAAM;AACpB,UAAA,IAAI;AAGF,YAAA,MAAM,EAAE,OAAA,EAAAC,QAAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,KAAA,EAAO,CAAA,CAAE,GAAA,EAAK,EAAE,UAAA,EAAY,CAAC,OAAO,GAAG,CAAA;AAC3E,YAAA,MAAA,GAASA,QAAAA;AACT,YAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,UACtC,SAAS,CAAA,EAAG;AACV,YAAA,OAAA,GAAU,CAAA;AAAA,UACZ;AAAA,QACF;AACA,QAAA,MAAM,OAAA,IAAW,IAAI,KAAA,CAAM,gBAAgB,CAAA;AAAA,MAC7C;AAQA,MAAA,MAAM,aAAA,GAAgB,SAAA,CAAU,KAAK,CAAA,CAAE,GAAA;AACvC,MAAA,MAAM,MAAA,GAAS,IAAA,CAAK,SAAA,CAAU,aAAa,CAAA;AAC3C,MAAA,IAAI,CAAC,MAAA,EAAQ;AACX,QAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,MAC1E;AACA,MAAA,MAAM,EAAE,OAAA,EAAQ,GAAI,MAAM,SAAA,CAAU,OAAO,MAAA,EAAQ;AAAA,QACjD,UAAA,EAAY,CAAC,OAAO,CAAA;AAAA,QACpB,MAAA,EAAQ;AAAA,OACT,CAAA;AACD,MAAA,MAAA,GAAS,OAAA;AAAA,IACX,SAAS,CAAA,EAAG;AAIV,MAAA,IAAI,CAAA,YAAa,qBAAqB,MAAM,CAAA;AAC5C,MAAA,MAAM,IAAI,mBAAA;AAAA,QACR,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,eAAA;AAAA,QACjC;AAAA,OACF;AAAA,IACF;AACA,IAAA,OAAO,IAAA,CAAK,kBAAkB,MAAM,CAAA;AAAA,EACtC;AAAA,EAEQ,kBAAkB,MAAA,EAAgC;AAGxD,IAAA,IAAI,CAAC,cAAA,CAAe,MAAA,CAAO,GAAA,EAAK,IAAA,CAAK,IAAA,CAAK,OAAA,EAAS,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO,IAAA,CAAK,YAAY,CAAA,EAAG;AACtF,MAAA,MAAM,IAAI,mBAAA,CAAoB,wBAAA,EAA0B,gBAAgB,CAAA;AAAA,IAC1E;AACA,IAAA,IAAI,MAAA,CAAO,GAAA,KAAQ,IAAA,CAAK,IAAA,CAAK,KAAA,EAAO;AAClC,MAAA,MAAM,IAAI,mBAAA,CAAoB,CAAA,8BAAA,CAAA,EAAkC,WAAW,CAAA;AAAA,IAC7E;AACA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,UAAA,IAAc,CAAC,OAAO,GAAA,EAAK;AACvC,MAAA,MAAM,IAAI,mBAAA,CAAoB,cAAA,EAAgB,cAAc,CAAA;AAAA,IAC9D;AAIA,IAAA,IAAI,IAAA,CAAK,IAAA,CAAK,oBAAA,IAAwB,MAAA,CAAO,mBAAmB,IAAA,EAAM;AACpE,MAAA,MAAM,IAAI,mBAAA,CAAoB,oBAAA,EAAsB,oBAAoB,CAAA;AAAA,IAC1E;AACA,IAAA,OAAO,MAAA;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,aAAa,UAAA,EAA4D;AAC7E,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,UAAA,CAAW,UAAA,CAAW,SAAS,CAAA,EAAG;AACpD,MAAA,MAAM,IAAI,mBAAA,CAAoB,sBAAA,EAAwB,UAAU,CAAA;AAAA,IAClE;AACA,IAAA,OAAO,IAAA,CAAK,MAAA,CAAO,UAAA,CAAW,KAAA,CAAM,CAAC,CAAC,CAAA;AAAA,EACxC;AACF;AAKO,SAAS,iBAAA,CAAkB,QAAA,EAA4B,IAAA,GAA4D,EAAC,EAAG;AAC5H,EAAA,OAAO,eAAgB,GAAA,EAAqB,GAAA,EAAqB,IAAA,EAAkB;AACjF,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,IAAI,OAAA,EAAS,aAAA;AACvB,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAC,CAAA;AACrE,MAAC,IAA8C,IAAA,GAAO,MAAA;AACvD,MAAA,IAAA,EAAK;AAAA,IACP,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,IAAI,KAAK,OAAA,EAAS;AAChB,QAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC5B,QAAA,IAAI,QAAQ,MAAA,EAAW;AACrB,UAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,GAA8B,CAAA;AACnD,UAAA;AAAA,QACF;AAAA,MACF;AACA,MAAA,GAAA,CAAI,MAAA,CAAO,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAUO,SAAS,YAAY,QAAA,EAA4B;AACtD,EAAA,OAAO,eACL,KACA,KAAA,EACA;AACA,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,GAAA,CAAI,OAAA,CAAQ,eAAe,CAAA;AACrC,MAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA;AACvC,MAAA,MAAM,MAAA,GAAS,MAAM,QAAA,CAAS,YAAA,CAAa,IAAI,CAAA;AAC/C,MAAA,GAAA,CAAI,IAAA,GAAO,MAAA;AAAA,IACb,SAAS,CAAA,EAAG;AACV,MAAA,MAAM,MAAM,CAAA,YAAa,mBAAA,GAAsB,IAAI,IAAI,mBAAA,CAAoB,eAAe,eAAe,CAAA;AACzG,MAAA,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA,CAAE,IAAA,CAAK,EAAE,KAAA,EAAO,GAAA,CAAI,OAAA,EAAS,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,CAAA;AAAA,IAC7D;AAAA,EACF,CAAA;AACF;AAGO,SAAS,eAAe,IAAA,EAAuC;AACpE,EAAA,OAAO,IAAI,iBAAiB,IAAI,CAAA;AAClC","file":"index.js","sourcesContent":["// Cookie-mode proxy for TillAuth.\n//\n// Mount this on the customer's backend (typically at /api/auth/*). It\n// forwards JSON bodies to TillAuth's /v1/* endpoints, then translates\n// access_token + refresh_token in the response into HttpOnly cookies on\n// the customer's domain. The browser's localStorage never sees the\n// tokens — XSS can't exfiltrate them.\n//\n// Two adapters: a generic web-fetch handler (Cloudflare Workers, Next.js\n// Route Handlers, Bun, Deno) and an Express middleware. Pick one.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\n\nexport interface CookieProxyOptions {\n  /** TillAuth public app id (`tau_…`). */\n  appId: string\n  /** Override the TillAuth API base. */\n  apiBase?: string\n  /** Cookie name for the access token. Default `tau_at`. */\n  accessCookie?: string\n  /** Cookie name for the refresh token. Default `tau_rt`. */\n  refreshCookie?: string\n  /** Cookie path. Default '/'. */\n  cookiePath?: string\n  /** Cookie domain (e.g. `.example.com` to share across subdomains). */\n  cookieDomain?: string\n  /** Secure flag. Defaults to true in production, false otherwise. */\n  secure?: boolean\n}\n\ninterface NormalizedRequest {\n  method: string\n  pathname: string // path relative to the mount point (`/signin`, `/refresh`)\n  body: string\n  cookies: Record<string, string>\n}\ninterface NormalizedResponse {\n  status: number\n  body: string\n  setCookies: string[]\n  headers: Record<string, string>\n}\n\ninterface AuthBody {\n  access_token?: string\n  refresh_token?: string\n  refresh_expires_at?: string\n  [key: string]: unknown\n}\n\nfunction resolve(opts: CookieProxyOptions): Required<CookieProxyOptions> {\n  return {\n    appId: opts.appId,\n    apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n    accessCookie: opts.accessCookie ?? 'tau_at',\n    refreshCookie: opts.refreshCookie ?? 'tau_rt',\n    cookiePath: opts.cookiePath ?? '/',\n    cookieDomain: opts.cookieDomain ?? '',\n    secure: opts.secure ?? process.env.NODE_ENV === 'production',\n  }\n}\n\nfunction makeCookie(\n  name: string,\n  value: string,\n  o: Required<CookieProxyOptions>,\n  opts: { maxAge?: number; clear?: boolean } = {},\n): string {\n  const parts = [`${name}=${opts.clear ? '' : value}`]\n  parts.push('HttpOnly')\n  if (o.secure) parts.push('Secure')\n  parts.push('SameSite=Lax')\n  parts.push(`Path=${o.cookiePath}`)\n  if (o.cookieDomain) parts.push(`Domain=${o.cookieDomain}`)\n  if (opts.clear) parts.push('Max-Age=0')\n  else if (opts.maxAge !== undefined) parts.push(`Max-Age=${opts.maxAge}`)\n  return parts.join('; ')\n}\n\nasync function handleProxy(req: NormalizedRequest, raw: CookieProxyOptions): Promise<NormalizedResponse> {\n  const opts = resolve(raw)\n  const path = req.pathname.replace(/^\\/+/, '')\n\n  // Map proxy paths → TillAuth paths.\n  const url = `${opts.apiBase}/v1/${path}`\n\n  const headers: Record<string, string> = {\n    'Content-Type': 'application/json',\n    'X-TillAuth-App': opts.appId,\n    'User-Agent': 'tilldev-auth-node/cookie-proxy',\n  }\n\n  // /me, /refresh, /signout need to carry tokens from cookies, not the body.\n  let body = req.body\n  if (path === 'me' && req.cookies[opts.accessCookie]) {\n    headers.Authorization = `Bearer ${req.cookies[opts.accessCookie]}`\n  }\n  if (path === 'refresh') {\n    const rt = req.cookies[opts.refreshCookie]\n    if (!rt) {\n      return {\n        status: 401,\n        body: JSON.stringify({ error: 'no refresh cookie' }),\n        setCookies: [],\n        headers: { 'Content-Type': 'application/json' },\n      }\n    }\n    body = JSON.stringify({ refresh_token: rt })\n  }\n  if (path === 'signout') {\n    const rt = req.cookies[opts.refreshCookie]\n    body = JSON.stringify({ refresh_token: rt ?? '' })\n  }\n\n  const upstream = await fetch(url, { method: req.method, headers, body })\n  const text = await upstream.text()\n  let json: AuthBody = {}\n  try {\n    json = JSON.parse(text) as AuthBody\n  } catch {\n    json = {}\n  }\n\n  const setCookies: string[] = []\n  // Always strip token fields before returning to the SPA.\n  const out = { ...json }\n\n  if (typeof json.access_token === 'string') {\n    setCookies.push(makeCookie(opts.accessCookie, json.access_token, opts, { maxAge: 60 * 10 }))\n    delete out.access_token\n  }\n  if (typeof json.refresh_token === 'string') {\n    // 30d in line with the Fastify REFRESH_TTL_MS.\n    setCookies.push(makeCookie(opts.refreshCookie, json.refresh_token, opts, { maxAge: 60 * 60 * 24 * 30 }))\n    delete out.refresh_token\n    delete out.refresh_expires_at\n  }\n  if (path === 'signout') {\n    setCookies.push(makeCookie(opts.accessCookie, '', opts, { clear: true }))\n    setCookies.push(makeCookie(opts.refreshCookie, '', opts, { clear: true }))\n  }\n\n  return {\n    status: upstream.status,\n    body: JSON.stringify(out),\n    setCookies,\n    headers: { 'Content-Type': 'application/json' },\n  }\n}\n\n// ── Adapter 1: web-fetch (Next.js Route Handlers, Workers, Bun, Deno) ───────\n\nexport function createFetchHandler(opts: CookieProxyOptions) {\n  return async function handler(req: Request, ctx: { params?: { path?: string | string[] } } = {}): Promise<Response> {\n    const url = new URL(req.url)\n    // Derive the proxy-relative path. Prefer ctx.params.path (Next.js catch-all);\n    // fall back to the part of the URL after the mount point heuristic.\n    let pathname: string\n    if (ctx.params?.path) {\n      pathname = Array.isArray(ctx.params.path) ? `/${ctx.params.path.join('/')}` : `/${ctx.params.path}`\n    } else {\n      pathname = url.pathname.replace(/^\\/api\\/auth/, '')\n    }\n    const cookies = parseCookieHeader(req.headers.get('cookie'))\n    const body = req.method === 'POST' ? await req.text() : '{}'\n    const out = await handleProxy({ method: req.method, pathname, body, cookies }, opts)\n    const headers = new Headers(out.headers)\n    for (const c of out.setCookies) headers.append('Set-Cookie', c)\n    return new Response(out.body, { status: out.status, headers })\n  }\n}\n\n// ── Adapter 2: Express ──────────────────────────────────────────────────────\n\ninterface ExpReq {\n  method: string\n  url?: string\n  originalUrl?: string\n  path?: string\n  body?: unknown\n  headers: Record<string, string | string[] | undefined>\n}\ninterface ExpRes {\n  status(n: number): ExpRes\n  setHeader(name: string, value: string | string[]): void\n  json(body: unknown): void\n}\n\nexport function expressCookieProxy(opts: CookieProxyOptions) {\n  return async function (req: ExpReq, res: ExpRes): Promise<void> {\n    const path =\n      req.path ?? (req.originalUrl ?? req.url ?? '/').replace(/^\\/api\\/auth/, '').split('?')[0] ?? '/'\n    const cookieHeader =\n      typeof req.headers.cookie === 'string' ? req.headers.cookie : Array.isArray(req.headers.cookie) ? req.headers.cookie[0] : ''\n    const body =\n      typeof req.body === 'string' ? req.body : req.body ? JSON.stringify(req.body) : '{}'\n    const out = await handleProxy(\n      {\n        method: req.method,\n        pathname: path,\n        body,\n        cookies: parseCookieHeader(cookieHeader ?? null),\n      },\n      opts,\n    )\n    res.status(out.status)\n    if (out.setCookies.length > 0) res.setHeader('Set-Cookie', out.setCookies)\n    for (const [k, v] of Object.entries(out.headers)) res.setHeader(k, v)\n    res.json(JSON.parse(out.body))\n  }\n}\n\nfunction parseCookieHeader(header: string | null): Record<string, string> {\n  const out: Record<string, string> = {}\n  if (!header) return out\n  for (const part of header.split(';')) {\n    const [k, ...rest] = part.trim().split('=')\n    if (!k) continue\n    out[k] = decodeURIComponent(rest.join('='))\n  }\n  return out\n}\n","import { jwtVerify, createRemoteJWKSet, importJWK, decodeJwt, type JWK } from 'jose'\n\n// Server-side TillAuth verification.\n//\n// You configure once with the issuer + JWKS endpoint (or inline public keys),\n// then call `verify(token)` or use the framework-specific middleware.\n//\n// Verification is offline against the cached JWKS — no round-trip to TillAuth\n// on the hot path.\n\nconst DEFAULT_API = 'https://auth.tilldev.dev'\nconst REALM_SEGMENT = '/realms/'\n\nfunction trimSlash(s: string): string {\n  return s.replace(/\\/+$/, '')\n}\n\n/**\n * Issuer acceptance check.\n *\n * A token this verifier may accept was minted for THIS app, so exactly two issuers\n * are legitimate: the canonical one (the app has no dedicated realm keys, so the\n * shared plane key signed it) or THIS app's own realm issuer. Nothing else.\n *\n * ⚠️ THIS USED TO ACCEPT ANY `{canonical}/realms/<anything>` when no issuer was\n * pinned. Together with a shared JWKS carrying every realm's key, that was a\n * cross-realm forgery (`atrium` `00` D13): holding any one realm's signing key was\n * enough to mint a token naming any OTHER realm. The signature verified (the key was\n * in the merged JWKS), the issuer passed this prefix test, and the `app` check\n * passed too — because the attacker wrote that claim as well.\n *\n * Note the `issuer` option was NOT the mitigation it looked like: pinning it\n * constrained the *claim* while the *key* still came from the merged set.\n *\n * The bare legacy `\"tillauth\"` string was retired 2026-07-20 and is not accepted.\n */\nfunction issuerAccepted(\n  iss: unknown,\n  canonical: string,\n  appId: string,\n  pinnedIssuer?: string,\n): boolean {\n  if (typeof iss !== 'string' || iss.length === 0) return false\n  if (pinnedIssuer) return iss === trimSlash(pinnedIssuer)\n  const canon = trimSlash(canonical)\n  return iss === canon || iss === `${canon}${REALM_SEGMENT}${appId}`\n}\n\nexport interface VerifyOptions {\n  /** TillAuth public app id (`tau_…`). Used to enforce app scoping. */\n  appId: string\n  /** TillAuth API base. Defaults to https://auth.tilldev.dev */\n  apiBase?: string\n  /**\n   * Pin verification to exactly one issuer (e.g. a dedicated realm's\n   * `https://auth.tilldev.dev/realms/<app>`).\n   *\n   * Rarely needed now: when omitted, the verifier accepts the canonical HTTPS issuer\n   * (derived from `apiBase`) and THIS app's own realm issuer — never another realm's.\n   * It previously accepted any realm under `apiBase`, which is what made this option\n   * look load-bearing; it was not, because the key still came from a merged JWKS\n   * (`atrium` `00` D13). The retired legacy `\"tillauth\"` string is never accepted.\n   */\n  issuer?: string\n  /**\n   * Inline JWKS as a JWK array (the same `publicJwk` entries you'd find in\n   * the TILLAUTH_JWT_KEYS env). Use this in environments where you want\n   * fully air-gapped verification.\n   */\n  publicJwks?: JWK[]\n  /** Require email_verified=true. Defaults to false. */\n  requireVerifiedEmail?: boolean\n  /** Require MFA was satisfied this session. Defaults to false. */\n  requireMfa?: boolean\n}\n\nexport interface AuthClaims {\n  /** User id */\n  sub: string\n  /** App id the token was issued for */\n  app: string\n  /** Lowercased email */\n  email: string\n  /** Whether MFA was satisfied this session */\n  mfa: boolean\n  /**\n   * Whether the account's email was verified at issue time. Optional: tokens\n   * minted before this claim existed omit it. When `requireVerifiedEmail` is\n   * set, an absent claim is treated as unverified (fail-closed on the check).\n   */\n  email_verified?: boolean\n  /** Token issuer — validated against the accepted set (see `issuerAccepted`). */\n  iss?: string\n  /** Issued-at (seconds) */\n  iat: number\n  /** Expires-at (seconds) */\n  exp: number\n}\n\nexport class TillAuthVerifyError extends Error {\n  code: 'no_token' | 'invalid_token' | 'wrong_app' | 'mfa_required' | 'email_not_verified' | 'invalid_issuer'\n  constructor(message: string, code: TillAuthVerifyError['code']) {\n    super(message)\n    this.name = 'TillAuthVerifyError'\n    this.code = code\n  }\n}\n\nexport class TillAuthVerifier {\n  private readonly opts: Required<Pick<VerifyOptions, 'appId' | 'apiBase' | 'requireVerifiedEmail' | 'requireMfa'>>\n  private readonly pinnedIssuer: string | undefined\n  private readonly remote: ReturnType<typeof createRemoteJWKSet> | null\n  /** This app's own realm key set — see `keySetFor`. Null on the inline-keys path. */\n  private readonly remoteRealm: ReturnType<typeof createRemoteJWKSet> | null = null\n  private readonly inlineKeys: Promise<Array<{ kid?: string; key: Awaited<ReturnType<typeof importJWK>> }>> | null\n\n  constructor(opts: VerifyOptions) {\n    if (!opts.appId) throw new Error('TillAuthVerifier: appId is required')\n    this.opts = {\n      appId: opts.appId,\n      apiBase: (opts.apiBase ?? DEFAULT_API).replace(/\\/$/, ''),\n      requireVerifiedEmail: opts.requireVerifiedEmail ?? false,\n      requireMfa: opts.requireMfa ?? false,\n    }\n    this.pinnedIssuer = opts.issuer ? opts.issuer.replace(/\\/$/, '') : undefined\n    if (opts.publicJwks && opts.publicJwks.length > 0) {\n      this.remote = null\n      this.inlineKeys = Promise.all(\n        opts.publicJwks.map(async (k) => ({ kid: k.kid, key: await importJWK(k, 'EdDSA') })),\n      )\n    } else {\n      /*\n       * TWO key sets, selected by the token's issuer (`atrium` `00` D13 F4).\n       *\n       * `remote` is the shared plane's set — after the D13 F6 change it holds ONLY\n       * the global signing keys, never a realm's. `remoteRealm` is this app's own\n       * realm set, which holds only this realm's keys and 404s if the app has no\n       * dedicated keys.\n       *\n       * Because neither set can contain ANOTHER realm's key, a forged token naming a\n       * different realm cannot be verified from either — the isolation is structural\n       * rather than a claim check. This replaced a single `createRemoteJWKSet` on the\n       * merged JWKS, where every realm's key was resolvable by `kid` and the realm\n       * checks below were therefore decorative.\n       */\n      this.remote = createRemoteJWKSet(new URL(`${this.opts.apiBase}/.well-known/jwks.json`))\n      this.remoteRealm = createRemoteJWKSet(\n        new URL(`${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}/.well-known/jwks.json`),\n      )\n      this.inlineKeys = null\n    }\n  }\n\n  /**\n   * The key set entitled to have signed a token carrying `iss`, or `null` if no set\n   * is. Selecting on the UNVERIFIED issuer is safe because the choice is then\n   * enforced: `jwtVerify` pins `issuer` to the same value, so a token that lies about\n   * its issuer to reach a different key set must still verify against that set — and\n   * that set contains only keys entitled to the issuer it named.\n   */\n  private keySetFor(iss: unknown): ReturnType<typeof createRemoteJWKSet> | null {\n    if (typeof iss !== 'string') return null\n    if (iss === this.opts.apiBase) return this.remote\n    if (iss === `${this.opts.apiBase}${REALM_SEGMENT}${this.opts.appId}`) return this.remoteRealm\n    return null\n  }\n\n  async verify(token: string): Promise<AuthClaims> {\n    if (!token) throw new TillAuthVerifyError('No token', 'no_token')\n\n    let claims: AuthClaims\n    try {\n      if (this.inlineKeys) {\n        const keys = await this.inlineKeys\n        let lastErr: unknown\n        for (const k of keys) {\n          try {\n            // No jose `issuer` pin — the issuer is one of several accepted values\n            // (legacy string / canonical HTTPS / per-realm), checked below.\n            const { payload } = await jwtVerify(token, k.key, { algorithms: ['EdDSA'] })\n            claims = payload as unknown as AuthClaims\n            return this.applyClaimsChecks(claims)\n          } catch (e) {\n            lastErr = e\n          }\n        }\n        throw lastErr ?? new Error('No key matched')\n      }\n      /*\n       * Pick the key set from the token's own issuer, then PIN that issuer during\n       * verification. The pin is what makes reading an unverified claim safe: it\n       * cannot be used to reach a key set and then disown the issuer that selected\n       * it. A token naming a realm this verifier does not serve gets no key set at\n       * all and is refused before any crypto runs.\n       */\n      const unverifiedIss = decodeJwt(token).iss\n      const keySet = this.keySetFor(unverifiedIss)\n      if (!keySet) {\n        throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n      }\n      const { payload } = await jwtVerify(token, keySet, {\n        algorithms: ['EdDSA'],\n        issuer: unverifiedIss as string,\n      })\n      claims = payload as unknown as AuthClaims\n    } catch (e) {\n      // Preserve a specific claims verdict (wrong_app / invalid_issuer) thrown by\n      // applyClaimsChecks on the inline path; only a genuine signature/JWKS\n      // failure becomes the generic invalid_token.\n      if (e instanceof TillAuthVerifyError) throw e\n      throw new TillAuthVerifyError(\n        e instanceof Error ? e.message : 'Invalid token',\n        'invalid_token',\n      )\n    }\n    return this.applyClaimsChecks(claims)\n  }\n\n  private applyClaimsChecks(claims: AuthClaims): AuthClaims {\n    // Issuer is validated here (jose's exact `issuer` pin is intentionally not\n    // used) so per-realm HTTPS issuers verify alongside the canonical one.\n    if (!issuerAccepted(claims.iss, this.opts.apiBase, this.opts.appId, this.pinnedIssuer)) {\n      throw new TillAuthVerifyError('Untrusted token issuer', 'invalid_issuer')\n    }\n    if (claims.app !== this.opts.appId) {\n      throw new TillAuthVerifyError(`Token issued for different app`, 'wrong_app')\n    }\n    if (this.opts.requireMfa && !claims.mfa) {\n      throw new TillAuthVerifyError('MFA required', 'mfa_required')\n    }\n    // Absent claim (older tokens) is treated as unverified only when the check\n    // is enabled — so requireVerifiedEmail fails closed rather than silently\n    // passing when the issuer predates the claim.\n    if (this.opts.requireVerifiedEmail && claims.email_verified !== true) {\n      throw new TillAuthVerifyError('Email not verified', 'email_not_verified')\n    }\n    return claims\n  }\n\n  /**\n   * Pull a Bearer token out of an Authorization header and verify. Returns\n   * the claims or throws TillAuthVerifyError.\n   */\n  async verifyHeader(authHeader: string | undefined | null): Promise<AuthClaims> {\n    if (!authHeader || !authHeader.startsWith('Bearer ')) {\n      throw new TillAuthVerifyError('Missing Bearer token', 'no_token')\n    }\n    return this.verify(authHeader.slice(7))\n  }\n}\n\n// ── Framework adapters ──────────────────────────────────────────────────────\n\n// Express-style middleware. Adds `req.user` on success.\nexport function expressMiddleware(verifier: TillAuthVerifier, opts: { onError?: (err: TillAuthVerifyError) => unknown } = {}) {\n  return async function (req: ExpressLikeReq, res: ExpressLikeRes, next: () => void) {\n    try {\n      const h = req.headers?.authorization\n      const claims = await verifier.verifyHeader(Array.isArray(h) ? h[0] : h)\n      ;(req as ExpressLikeReq & { user: AuthClaims }).user = claims\n      next()\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      if (opts.onError) {\n        const out = opts.onError(err)\n        if (out !== undefined) {\n          res.status(401).json(out as Record<string, unknown>)\n          return\n        }\n      }\n      res.status(401).json({ error: err.message, code: err.code })\n    }\n  }\n}\n\ninterface ExpressLikeReq {\n  headers?: { authorization?: string | string[] }\n}\ninterface ExpressLikeRes {\n  status: (n: number) => { json: (b: Record<string, unknown>) => void }\n}\n\n// Fastify plugin shape — not bound to Fastify's types to avoid a peer dep.\nexport function fastifyHook(verifier: TillAuthVerifier) {\n  return async function (\n    req: { headers: Record<string, string | string[] | undefined>; user?: AuthClaims },\n    reply: { code: (n: number) => { send: (b: unknown) => void } },\n  ) {\n    try {\n      const h = req.headers['authorization']\n      const auth = Array.isArray(h) ? h[0] : h\n      const claims = await verifier.verifyHeader(auth)\n      req.user = claims\n    } catch (e) {\n      const err = e instanceof TillAuthVerifyError ? e : new TillAuthVerifyError('Auth failed', 'invalid_token')\n      reply.code(401).send({ error: err.message, code: err.code })\n    }\n  }\n}\n\n// Convenience entrypoint for users who want a one-call setup.\nexport function createVerifier(opts: VerifyOptions): TillAuthVerifier {\n  return new TillAuthVerifier(opts)\n}\n\nexport { createFetchHandler, expressCookieProxy } from './cookie-proxy.js'\nexport type { CookieProxyOptions } from './cookie-proxy.js'\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tillstack/auth-node",
-  "version": "0.2.2",
+  "version": "0.3.0",
   "description": "Node SDK for TillAuth — JWT verification + middleware",
   "license": "Apache-2.0",
   "type": "module",
@@ -25,19 +25,13 @@
   "files": [
     "dist"
   ],
-  "scripts": {
-    "build": "tsup",
-    "dev": "tsup --watch",
-    "typecheck": "tsc --noEmit",
-    "prepack": "tsup",
-    "clean": "rm -rf dist"
-  },
   "dependencies": {
     "jose": "^5.9.6"
   },
   "devDependencies": {
     "tsup": "^8.3.5",
-    "typescript": "^5.7.3"
+    "typescript": "^5.7.3",
+    "tsx": "^4.19.2"
   },
   "repository": {
     "type": "git",
@@ -50,5 +44,12 @@
   },
   "publishConfig": {
     "access": "public"
+  },
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsup --watch",
+    "typecheck": "tsc --noEmit",
+    "clean": "rm -rf dist",
+    "test": "node --import tsx --test test/*.test.ts"
   }
-}
+}