@tktchurch/auth 0.9.9 → 0.11.0

package/dist/server.d.ts

@@ -0,0 +1,289 @@
+import { i as AuthorizationUrlOptions, a as AuthClient, h as AuthorizationRequest } from './types-1sQaP6TE.js';
+
+/**
+ * Cookie domain / attribute policy for TKTChurch browser sessions.
+ *
+ * - `sso` — tiny opaque identity cookie on the parent domain (`.tktchurch.com`)
+ * - `app` — host-only product session (never parent Domain — avoids 431 bleed)
+ * - `transient` — host-only short-lived PKCE / OTP state
+ */
+type CookieKind = "sso" | "app" | "transient";
+interface CookiePolicyInput {
+    kind: CookieKind;
+    /** Request hostname without port (e.g. `developers.tktchurch.com`). */
+    hostname?: string;
+    maxAge?: number;
+    /**
+     * Force Secure. Defaults to true unless `allowInsecure` is set.
+     * Never derive Secure from client-controlled `X-Forwarded-Proto`.
+     */
+    secure?: boolean;
+    /** Local HTTP only — mirrors ALLOW_INSECURE_COOKIES. */
+    allowInsecure?: boolean;
+    /**
+     * Parent domain for `sso` cookies. Defaults to `tktchurch.com` when hostname
+     * ends with `.tktchurch.com`, else `tktchurch.net` for `.tktchurch.net`.
+     */
+    ssoParentDomain?: string;
+    path?: string;
+    sameSite?: "lax" | "strict" | "none";
+}
+/** Options compatible with h3 `setCookie` / the `cookie` package. */
+interface SessionCookieOptions {
+    httpOnly: true;
+    secure: boolean;
+    sameSite: "lax" | "strict" | "none";
+    path: string;
+    maxAge?: number;
+    /** Only set for `kind: "sso"`. */
+    domain?: string;
+}
+declare const DEFAULT_SSO_COOKIE_NAME = "tkt_sid";
+declare const DEFAULT_SSO_MAX_AGE_SECONDS: number;
+declare const DEFAULT_TRANSIENT_MAX_AGE_SECONDS: number;
+declare const DEFAULT_APP_MAX_AGE_SECONDS: number;
+/** Parent registrable domain for SSO, or undefined when not on a TKT host. */
+declare function resolveSsoParentDomain(hostname: string | undefined, override?: string): string | undefined;
+/**
+ * Build Set-Cookie attribute options for a session cookie kind.
+ * `app` and `transient` are always host-only (no `domain`).
+ */
+declare function cookieOptions(input: CookiePolicyInput): SessionCookieOptions;
+/** Serialize options into a `Set-Cookie` attribute suffix (no name=value). */
+declare function formatCookieAttributes(options: SessionCookieOptions): string;
+/** Full `Set-Cookie` header value. */
+declare function serializeSetCookie(name: string, value: string, options: SessionCookieOptions): string;
+/**
+ * Emit Max-Age=0 Set-Cookie headers that clear legacy parent-domain app cookies
+ * (the bleed that causes Deno 431 on microsites).
+ */
+declare function expireLegacyParentDomainCookies(names: string[], input?: {
+    hostname?: string;
+    allowInsecure?: boolean;
+    parentDomains?: string[];
+}): string[];
+/** h3-compatible options for clearing a cookie (same domain/path as set). */
+declare function clearCookieOptions(kind: CookieKind, input?: Omit<CookiePolicyInput, "kind" | "maxAge">): SessionCookieOptions;
+
+/**
+ * AES-256-GCM seal/unseal for session cookies (Web Crypto — Node 18+, Deno, edge).
+ *
+ * Wire format matches existing Nuxt apps: `iv.tag.ciphertext` (each base64url).
+ */
+/** Encrypt a UTF-8 string into `iv.tag.ciphertext` base64url parts. */
+declare function sealString(secret: string, plaintext: string): Promise<string>;
+/** Decrypt a `iv.tag.ciphertext` sealed string. */
+declare function unsealString(secret: string, sealed: string): Promise<string>;
+/** JSON seal helper. */
+declare function sealJson<T>(secret: string, value: T): Promise<string>;
+/** JSON unseal helper. */
+declare function unsealJson<T>(secret: string, sealed: string): Promise<T>;
+
+/**
+ * Progressive compaction so sealed session cookies stay under browser limits.
+ */
+declare const DEFAULT_MAX_SESSION_COOKIE_VALUE_LENGTH = 3800;
+type CompactRoleMode = "all" | "identity" | "none";
+interface CompactableUser {
+    id?: string;
+    sub?: string;
+    organizationId?: string | null;
+    email?: string | null;
+    username?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    phoneNumber?: string | null;
+    emailVerified?: boolean;
+    phoneNumberVerified?: boolean;
+    isActive?: boolean;
+    isVerified?: boolean;
+    mfaEnabled?: boolean;
+    picture?: string | null;
+    permissions?: string[];
+    roles?: Array<{
+        id?: string;
+        organizationId?: string | null;
+        name?: string | null;
+        slug?: string | null;
+        description?: string | null;
+        isSystem?: boolean;
+        permissions?: unknown[];
+        [key: string]: unknown;
+    }>;
+    [key: string]: unknown;
+}
+interface CompactableSession {
+    accessToken?: string;
+    refreshToken?: string;
+    idToken?: string;
+    expiresAt?: number;
+    scope?: string;
+    rememberMe?: boolean;
+    user?: CompactableUser;
+    [key: string]: unknown;
+}
+declare function slimUserForCookie(user: CompactableUser, options?: {
+    includePicture?: boolean;
+    roles?: CompactRoleMode;
+}): CompactableUser;
+/**
+ * Pick the smallest session variant that fits `maxLength` when JSON-stringified
+ * (caller should measure sealed length; this uses JSON length as a stand-in when
+ * `measure` is omitted).
+ */
+declare function compactSession<T extends CompactableSession>(session: T, options?: {
+    maxLength?: number;
+    /** Return true when the candidate fits (e.g. sealed length). */
+    measure?: (candidate: T) => boolean | Promise<boolean>;
+}): T | Promise<T>;
+/** Sync compact using sealed-length measurement. */
+declare function compactSessionForSeal<T extends CompactableSession>(secret: string, session: T, maxLength?: number): Promise<T>;
+
+/**
+ * Opaque SSO session id (`tkt_sid`) + pluggable store.
+ */
+
+interface SsoSessionRecord {
+    /** Subject / user id. */
+    userId: string;
+    /** Optional refresh-token handle or hash (never required for presence checks). */
+    refreshHandle?: string;
+    createdAt: number;
+    expiresAt: number;
+    rememberMe?: boolean;
+}
+interface SidStore {
+    get(sid: string): Promise<SsoSessionRecord | null>;
+    set(sid: string, record: SsoSessionRecord, ttlSeconds: number): Promise<void>;
+    delete(sid: string): Promise<void>;
+}
+/** In-memory store (tests / single-process only). */
+declare class MemorySidStore implements SidStore {
+    private readonly map;
+    get(sid: string): Promise<SsoSessionRecord | null>;
+    set(sid: string, record: SsoSessionRecord, ttlSeconds: number): Promise<void>;
+    delete(sid: string): Promise<void>;
+}
+/**
+ * Redis-compatible store. Pass any client with get/set/del
+ * (node-redis, ioredis, Upstash REST wrapper, etc.).
+ */
+interface RedisLike {
+    get(key: string): Promise<string | null>;
+    set(key: string, value: string, options?: {
+        ex?: number;
+    }): Promise<unknown>;
+    del(key: string): Promise<unknown>;
+}
+declare class RedisSidStore implements SidStore {
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(redis: RedisLike, keyPrefix?: string);
+    private key;
+    get(sid: string): Promise<SsoSessionRecord | null>;
+    set(sid: string, record: SsoSessionRecord, ttlSeconds: number): Promise<void>;
+    delete(sid: string): Promise<void>;
+}
+/**
+ * Cookie-embedded SSO record when no Redis is available (Accounts on Vercel).
+ * The cookie value is the sealed record itself (still tiny — no JWTs).
+ * `sid` returned to callers is a random id used only as a local handle; the
+ * sealed payload is what browsers store as `tkt_sid`.
+ */
+interface SealedSidCookie {
+    /** Value to put in the `tkt_sid` cookie (sealed JSON). */
+    cookieValue: string;
+    record: SsoSessionRecord;
+}
+declare function mintSealedSsoCookieValue(secret: string, record: Omit<SsoSessionRecord, "createdAt"> & {
+    createdAt?: number;
+}): Promise<SealedSidCookie>;
+declare function readSealedSsoCookieValue(secret: string, cookieValue: string): Promise<SsoSessionRecord | null>;
+declare function createOpaqueSid(bytes?: number): string;
+declare function mintOpaqueSsoSession(store: SidStore, record: Omit<SsoSessionRecord, "createdAt" | "expiresAt"> & {
+    ttlSeconds?: number;
+    expiresAt?: number;
+}): Promise<{
+    sid: string;
+    record: SsoSessionRecord;
+}>;
+declare function revokeSsoSession(store: SidStore, sid: string): Promise<void>;
+declare function ssoSetCookieHeader(sidOrSealedValue: string, input?: {
+    hostname?: string;
+    maxAge?: number;
+    allowInsecure?: boolean;
+    cookieName?: string;
+}): string;
+declare function ssoClearCookieHeader(input?: {
+    hostname?: string;
+    allowInsecure?: boolean;
+    cookieName?: string;
+}): string;
+declare function ssoCookieOptions(input?: {
+    hostname?: string;
+    maxAge?: number;
+    allowInsecure?: boolean;
+}): SessionCookieOptions;
+/** Read a named cookie from a Cookie header. */
+declare function readCookieHeader(cookieHeader: string | null | undefined, name: string): string | null;
+
+/**
+ * High-level session cookie helpers shared by Nuxt (h3) and Deno apps.
+ */
+
+interface SessionCookieConfig {
+    secret: string;
+    /** Product session cookie name (e.g. `dev_auth_session`). */
+    cookieName: string;
+    /** Default kind for the main session cookie. */
+    kind?: Exclude<CookieKind, "sso">;
+    maxValueLength?: number;
+    allowInsecure?: boolean;
+    /** Cookie names previously set with Domain=.tktchurch.com to expire. */
+    legacyParentDomainNames?: string[];
+}
+interface SetSessionInput {
+    hostname?: string;
+    maxAge?: number;
+    kind?: Exclude<CookieKind, "sso">;
+}
+/**
+ * Framework-agnostic session cookie controller.
+ * Use `serialize*` for Deno `Headers.append("set-cookie", …)` and
+ * `options*` with h3 `setCookie` / `deleteCookie`.
+ */
+declare function createSessionCookies(config: SessionCookieConfig): {
+    cookieName: string;
+    sealSessionValue: <T extends CompactableSession>(session: T) => Promise<string>;
+    readSessionValue: <T>(raw: string | null | undefined) => Promise<T | null>;
+    optionsFor: (input?: SetSessionInput) => SessionCookieOptions;
+    clearOptionsFor: (input?: SetSessionInput) => SessionCookieOptions;
+    serializeSessionSetCookie: <T extends CompactableSession>(session: T, input?: SetSessionInput) => Promise<string>;
+    serializeSessionClearCookie: (input?: SetSessionInput) => string;
+    serializeLegacyExpiry: (hostname?: string) => string[];
+    sealTransient: (value: unknown) => Promise<string>;
+    unsealTransient: <T>(raw: string | null | undefined) => Promise<T | null>;
+    transientOptions: (hostname?: string, maxAge?: number) => SessionCookieOptions;
+};
+type SessionCookies = ReturnType<typeof createSessionCookies>;
+
+/**
+ * Silent / prompt=none authorization helpers for cross-app SSO.
+ */
+
+interface SilentAuthorizeOptions extends Omit<AuthorizationUrlOptions, "prompt"> {
+    /** When true (default), sets `prompt=none`. */
+    silent?: boolean;
+}
+/**
+ * Start an authorization-code + PKCE request intended for SSO resume.
+ * Persist `state` / `nonce` / `codeVerifier` in a **host-only transient** cookie.
+ */
+declare function startSilentAuthorize(client: AuthClient, options: SilentAuthorizeOptions): Promise<AuthorizationRequest>;
+/**
+ * True when an SSO identity cookie is present (opaque sid or sealed record).
+ * Does not validate the store — callers should resolve via SidStore / unseal.
+ */
+declare function hasSsoCookieHint(cookieHeader: string | null | undefined, cookieName?: string): boolean;
+
+export { type CompactRoleMode, type CompactableSession, type CompactableUser, type CookieKind, type CookiePolicyInput, DEFAULT_APP_MAX_AGE_SECONDS, DEFAULT_MAX_SESSION_COOKIE_VALUE_LENGTH, DEFAULT_SSO_COOKIE_NAME, DEFAULT_SSO_MAX_AGE_SECONDS, DEFAULT_TRANSIENT_MAX_AGE_SECONDS, MemorySidStore, type RedisLike, RedisSidStore, type SealedSidCookie, type SessionCookieConfig, type SessionCookieOptions, type SessionCookies, type SetSessionInput, type SidStore, type SilentAuthorizeOptions, type SsoSessionRecord, clearCookieOptions, compactSession, compactSessionForSeal, cookieOptions, createOpaqueSid, createSessionCookies, expireLegacyParentDomainCookies, formatCookieAttributes, hasSsoCookieHint, mintOpaqueSsoSession, mintSealedSsoCookieValue, readCookieHeader, readSealedSsoCookieValue, resolveSsoParentDomain, revokeSsoSession, sealJson, sealString, serializeSetCookie, slimUserForCookie, ssoClearCookieHeader, ssoCookieOptions, ssoSetCookieHeader, startSilentAuthorize, unsealJson, unsealString };

package/dist/server.js

@@ -0,0 +1 @@
+var X=Object.defineProperty;var L=(e,t)=>()=>(e&&(t=e(e=0)),t);var B=(e,t)=>{for(var n in t)X(e,n,{get:t[n],enumerable:!0})};var l,_=L(()=>{"use strict";l=class extends Error{code;status;details;constructor(t,n,r){super(n),this.name="AuthError",this.code=t,this.status=r?.status,this.details=r?.details}}});var K={};B(K,{sealJson:()=>g,sealString:()=>v,unsealJson:()=>S,unsealString:()=>N});function I(){let e=globalThis.crypto;if(!e?.subtle||!e.getRandomValues)throw new l("server_error","Web Crypto API is unavailable; session seal requires globalThis.crypto.subtle.");return e}function O(e){let t="";for(let n of e)t+=String.fromCharCode(n);if(typeof btoa!="function")throw new l("server_error","base64UrlEncode requires globalThis.btoa.");return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function P(e){let t=e.replace(/-/g,"+").replace(/_/g,"/"),n=t.length%4===0?"":"=".repeat(4-t.length%4);if(typeof atob!="function")throw new l("server_error","base64UrlDecode requires globalThis.atob.");let r=atob(t+n),s=new Uint8Array(r.length);for(let o=0;o<r.length;o++)s[o]=r.charCodeAt(o);return s}async function z(e){let t=F.get(e);return t||(t=(async()=>{let n=I(),r=await n.subtle.digest("SHA-256",new TextEncoder().encode(e));return n.subtle.importKey("raw",r,{name:"AES-GCM"},!1,["encrypt","decrypt"])})(),F.set(e,t),t)}async function v(e,t){if(!e||e.length<16)throw new l("invalid_request","Session secret must be at least 16 characters.");let n=I(),r=await z(e),s=n.getRandomValues(new Uint8Array(V)),o=new Uint8Array(await n.subtle.encrypt({name:"AES-GCM",iv:s},r,new TextEncoder().encode(t)));if(o.length<b)throw new l("server_error","AES-GCM encrypt produced empty output.");let c=o.slice(0,o.length-b),u=o.slice(o.length-b);return[O(s),O(u),O(c)].join(".")}async function N(e,t){let n=t.split(".");if(n.length!==3||!n[0]||!n[1]||!n[2])throw new l("invalid_token","Invalid sealed session format.");let r=P(n[0]),s=P(n[1]),o=P(n[2]);if(r.length!==V||s.length!==b)throw new l("invalid_token","Invalid sealed session parts.");let c=new Uint8Array(o.length+s.length);c.set(o),c.set(s,o.length);let u=I(),C=await z(e);try{let a=await u.subtle.decrypt({name:"AES-GCM",iv:r},C,c);return new TextDecoder().decode(a)}catch{throw new l("invalid_token","Failed to decrypt session.")}}async function g(e,t){return v(e,JSON.stringify(t))}async function S(e,t){return JSON.parse(await N(e,t))}var V,b,F,k=L(()=>{"use strict";_();V=12,b=16;F=new Map});var A="tkt_sid",y=2592e3,W=600,j=2592e3;function E(e,t){if(t)return t;let n=((e||"").split(":")[0]||"").toLowerCase();if(n){if(n==="tktchurch.com"||n.endsWith(".tktchurch.com"))return"tktchurch.com";if(n==="tktchurch.net"||n.endsWith(".tktchurch.net"))return"tktchurch.net"}}function d(e){let t=e.allowInsecure===!0,n=e.secure??!t,r=e.sameSite??"lax",s=e.path??"/",o={httpOnly:!0,secure:n,sameSite:r,path:s};if(typeof e.maxAge=="number"?o.maxAge=e.maxAge:e.kind==="transient"?o.maxAge=600:e.kind==="sso"&&(o.maxAge=2592e3),e.kind==="sso"){let c=E(e.hostname,e.ssoParentDomain);c&&(o.domain=c)}return o}function q(e){let t=[`Path=${e.path}`,"HttpOnly"];return e.secure&&t.push("Secure"),t.push(`SameSite=${e.sameSite==="none"?"None":e.sameSite==="strict"?"Strict":"Lax"}`),typeof e.maxAge=="number"&&t.push(`Max-Age=${e.maxAge}`),e.domain&&t.push(`Domain=${e.domain}`),t.join("; ")}function m(e,t,n){return`${e}=${t}; ${q(n)}`}function T(e,t={}){let n=t.parentDomains??[],r=E(t.hostname);r&&!n.includes(r)&&n.push(r),n.length===0&&n.push("tktchurch.com","tktchurch.net");let s=t.allowInsecure===!0,o=[];for(let c of e)for(let u of n)o.push(m(c,"",{httpOnly:!0,secure:!s,sameSite:"lax",path:"/",maxAge:0,domain:u}));return o}function x(e,t={}){return d({...t,kind:e,maxAge:0})}k();var U=3800;function Y(e){let t=e||[];return t.includes("*:*")?["*:*"]:t}function Q(e){if(typeof e!="string")return null;let t=e.trim();return!t||t.startsWith("data:")||t.length>512?null:t}function Z(e,t){let n=(e||[]).map(r=>({...r,description:null,permissions:[]}));return t==="none"?[]:(t==="identity"&&(n=n.filter(r=>r.slug==="admin"||r.slug==="superadmin"||r.slug==="super_admin").slice(0,4)),n)}function f(e,t={}){let n=t.includePicture!==!1,r=t.roles||"all";return{...e,phoneNumber:e.phoneNumber??null,roles:Z(e.roles,r),permissions:Y(e.permissions),picture:n?Q(e.picture):null}}function $(e,t={}){let n=t.maxLength??3800,r=t.measure??(a=>JSON.stringify(a).length<=n),s=e.user;if(!s){let a={...e,idToken:void 0},h=r(a);return h instanceof Promise?h.then(w=>a):a}let o={...e,idToken:void 0},c=[e,o,{...o,user:f(s,{roles:"all"})},{...o,user:f(s,{roles:"identity"})},{...o,user:f(s,{roles:"none",includePicture:!0})},{...o,user:f(s,{roles:"none",includePicture:!1})}],u={...e,idToken:void 0,accessToken:e.accessToken,refreshToken:e.refreshToken,user:f(s,{roles:"none",includePicture:!1})};if(c.every(a=>typeof r(a)=="boolean")){for(let a of c)if(r(a))return a;return u}return(async()=>{for(let a of c)if(await r(a))return a;return u})()}async function D(e,t,n=3800){let{sealJson:r}=await Promise.resolve().then(()=>(k(),K)),s=$(t,{maxLength:n,measure:async o=>(await r(e,o)).length<=n});return s instanceof Promise,s}_();_();function ee(){let e=globalThis.crypto;if(!e?.getRandomValues)throw new l("invalid_request","Web Crypto API is unavailable in this runtime. PKCE requires globalThis.crypto.");return e}function te(e){let t="";for(let r of e)t+=String.fromCharCode(r);if(typeof btoa!="function")throw new l("server_error","base64UrlEncode requires globalThis.btoa (Web/Deno runtime).");return btoa(t).replace(/\+/g,"-").replace(/\//g,"_").replace(/=+$/g,"")}function G(e=32){if(!Number.isInteger(e)||e<=0)throw new l("invalid_request","randomUrlSafeString length must be a positive integer.");let t=new Uint8Array(e);return ee().getRandomValues(t),te(t)}k();var M=class{map=new Map;async get(t){let n=this.map.get(t);return n?n.expiresAtMs<=Date.now()?(this.map.delete(t),null):n.record:null}async set(t,n,r){this.map.set(t,{record:n,expiresAtMs:Date.now()+Math.max(1,r)*1e3})}async delete(t){this.map.delete(t)}},R=class{constructor(t,n="tkt:sso:"){this.redis=t;this.keyPrefix=n}key(t){return`${this.keyPrefix}${t}`}async get(t){let n=await this.redis.get(this.key(t));if(!n)return null;try{let r=JSON.parse(n);return r.expiresAt<=Date.now()?(await this.delete(t),null):r}catch{return null}}async set(t,n,r){await this.redis.set(this.key(t),JSON.stringify(n),{ex:Math.max(1,r)})}async delete(t){await this.redis.del(this.key(t))}};async function ne(e,t){let n={...t,createdAt:t.createdAt??Date.now()};return{cookieValue:await g(e,n),record:n}}async function re(e,t){try{let n=await S(e,t);return!n?.userId||n.expiresAt<=Date.now()?null:n}catch{return null}}function H(e=32){return G(e)}async function oe(e,t){let n=t.ttlSeconds??2592e3,r=H(),s={userId:t.userId,refreshHandle:t.refreshHandle,rememberMe:t.rememberMe,createdAt:Date.now(),expiresAt:t.expiresAt??Date.now()+n*1e3};return await e.set(r,s,n),{sid:r,record:s}}async function se(e,t){await e.delete(t)}function ie(e,t={}){let n=t.cookieName??A,r=d({kind:"sso",hostname:t.hostname,maxAge:t.maxAge??2592e3,allowInsecure:t.allowInsecure});if(!r.domain)throw new l("invalid_request","SSO cookie requires a tktchurch.com / tktchurch.net hostname.");return m(n,e,r)}function ae(e={}){let t=e.cookieName??A,n=d({kind:"sso",hostname:e.hostname,maxAge:0,allowInsecure:e.allowInsecure});return m(t,"",n)}function ce(e={}){return d({kind:"sso",hostname:e.hostname,maxAge:e.maxAge??2592e3,allowInsecure:e.allowInsecure})}function le(e,t){if(!e)return null;let n=e.match(new RegExp(`(?:^|;\\s*)${t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}=([^;]*)`));return n?.[1]?decodeURIComponent(n[1]):null}k();function ue(e){let t=e.kind??"app",n=e.maxValueLength??3800,r=e.allowInsecure===!0;async function s(i){let p=await D(e.secret,i,n);return g(e.secret,p)}async function o(i){if(!i)return null;try{return await S(e.secret,i)}catch{return null}}function c(i={}){return d({kind:i.kind??t,hostname:i.hostname,maxAge:i.maxAge,allowInsecure:r})}async function u(i,p={}){let J=await s(i);return m(e.cookieName,J,c(p))}function C(i={}){return m(e.cookieName,"",x(i.kind??t,{hostname:i.hostname,allowInsecure:r}))}function a(i){let p=e.legacyParentDomainNames??[e.cookieName];return T(p,{hostname:i,allowInsecure:r})}async function h(i){return g(e.secret,i)}async function w(i){return o(i)}return{cookieName:e.cookieName,sealSessionValue:s,readSessionValue:o,optionsFor:c,clearOptionsFor:(i={})=>x(i.kind??t,{hostname:i.hostname,allowInsecure:r}),serializeSessionSetCookie:u,serializeSessionClearCookie:C,serializeLegacyExpiry:a,sealTransient:h,unsealTransient:w,transientOptions:(i,p)=>d({kind:"transient",hostname:i,maxAge:p,allowInsecure:r})}}async function de(e,t){let{silent:n=!0,...r}=t;return e.authorize.createRequest({...r,prompt:n?"none":void 0})}function me(e,t="tkt_sid"){if(!e)return!1;let n=t.replace(/[.*+?^${}()|[\]\\]/g,"\\$&");return new RegExp(`(?:^|;\\s*)${n}=([^;]+)`).test(e)}export{j as DEFAULT_APP_MAX_AGE_SECONDS,U as DEFAULT_MAX_SESSION_COOKIE_VALUE_LENGTH,A as DEFAULT_SSO_COOKIE_NAME,y as DEFAULT_SSO_MAX_AGE_SECONDS,W as DEFAULT_TRANSIENT_MAX_AGE_SECONDS,M as MemorySidStore,R as RedisSidStore,x as clearCookieOptions,$ as compactSession,D as compactSessionForSeal,d as cookieOptions,H as createOpaqueSid,ue as createSessionCookies,T as expireLegacyParentDomainCookies,q as formatCookieAttributes,me as hasSsoCookieHint,oe as mintOpaqueSsoSession,ne as mintSealedSsoCookieValue,le as readCookieHeader,re as readSealedSsoCookieValue,E as resolveSsoParentDomain,se as revokeSsoSession,g as sealJson,v as sealString,m as serializeSetCookie,f as slimUserForCookie,ae as ssoClearCookieHeader,ce as ssoCookieOptions,ie as ssoSetCookieHeader,de as startSilentAuthorize,S as unsealJson,N as unsealString};

package/dist/storage/memory.d.cts

@@ -1 +1,12 @@
-export { a8 as createMemoryTokenStorage } from '../memory-DCHtjktX.cjs';
+import { a3 as TokenStorage } from '../types-1sQaP6TE.cjs';
+
+/**
+ * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
+ *
+ * Tokens are not encrypted and do not survive process restarts. This is the
+ * default and the recommended choice for server-side clients (SSR routes,
+ * workers) where persistence belongs in HttpOnly cookies or a server session.
+ */
+declare function createMemoryTokenStorage(): TokenStorage;
+
+export { createMemoryTokenStorage };

package/dist/storage/memory.d.ts

@@ -1 +1,12 @@
-export { a8 as createMemoryTokenStorage } from '../memory-DCHtjktX.js';
+import { a3 as TokenStorage } from '../types-1sQaP6TE.js';
+
+/**
+ * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
+ *
+ * Tokens are not encrypted and do not survive process restarts. This is the
+ * default and the recommended choice for server-side clients (SSR routes,
+ * workers) where persistence belongs in HttpOnly cookies or a server session.
+ */
+declare function createMemoryTokenStorage(): TokenStorage;
+
+export { createMemoryTokenStorage };

package/dist/{memory-DCHtjktX.d.cts → types-1sQaP6TE.d.cts}

@@ -903,6 +903,10 @@ interface AuthorizationUrlOptions {
     codeChallengeMethod?: "S256" | "plain";
     /** OIDC `prompt` parameter (e.g. `login`, `none`, `consent`). */
     prompt?: string;
+    /** OIDC maximum authentication age in seconds. Use `0` for a fresh login. */
+    maxAge?: number;
+    /** Ordered OIDC Authentication Context Class References. */
+    acrValues?: string[];
     /** OIDC `login_hint` to prefill the identifier. */
     loginHint?: string;
     /** OAuth `response_type`. Defaults to `code`. */
@@ -1204,6 +1208,24 @@ interface UserProfile {
     mfaEnabled?: boolean;
     [key: string]: JsonValue | undefined;
 }
+/** Lifecycle state for one private avatar version. */
+type AvatarAssetState = "created" | "processing" | "active" | "deleted";
+/**
+ * Private avatar-history metadata.
+ *
+ * The OAuth API intentionally does not expose source URLs or managed object
+ * keys. Use `UserProfile.picture` for the active compatibility image.
+ */
+interface AvatarAsset {
+    id: string;
+    state: AvatarAssetState;
+    isActive: boolean;
+    isManaged: boolean;
+    contentType?: string;
+    byteCount?: number;
+    createdAt?: string;
+    deletedAt?: string;
+}
 /** Starts primary-email verification without changing the current email. */
 interface StartEmailVerificationRequest {
     email: string;
@@ -1316,6 +1338,12 @@ interface UserEndpoints {
         newPassword: string;
     }): Promise<void>;
     uploadAvatar(file: Blob | Buffer, filename?: string): Promise<UserProfile>;
+    avatarAssets: {
+        list(): Promise<AvatarAsset[]>;
+        select(assetId: string): Promise<AvatarAsset>;
+        delete(assetId: string): Promise<void>;
+    };
+    /** Deselects the current avatar without deleting retained history. */
     deleteAvatar(): Promise<UserProfile>;
     verifyPhone(input: JsonObject): Promise<JsonObject>;
     verifyRecoveryEmail(input: JsonObject): Promise<JsonObject>;
@@ -1402,13 +1430,4 @@ interface ApiRequestOptions {
     token?: string;
 }
 
-/**
- * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
- *
- * Tokens are not encrypted and do not survive process restarts. This is the
- * default and the recommended choice for server-side clients (SSR routes,
- * workers) where persistence belongs in HttpOnly cookies or a server session.
- */
-declare function createMemoryTokenStorage(): TokenStorage;
-
-export { type TokenExchangeRequest as $, type AuthClientConfig as A, type OidcDiscoveryDocument as B, type ConsumerAuthClient as C, type OidcEndpoints as D, type EmailVerificationResponse as E, type FlowEndpoints as F, type PageResponse as G, type HandleCallbackOptions as H, type InitAuthenticationRequest as I, type PasswordResetEndpoints as J, type PasswordTokenRequest as K, type PublicClientInfo as L, type MaintenanceStatus as M, type PushAuthorizationRequestOptions as N, type OAuthAuthorizationServerMetadata as O, type PageQuery as P, type PushedAuthorizationResult as Q, type RefreshTokenRequest as R, type RevocationResponse as S, type RevokeSessionRequest as T, type RevokeTokenRequest as U, type SessionDetail as V, type SessionEndpoints as W, type SessionListQuery as X, type SessionSummary as Y, type StartEmailVerificationRequest as Z, type TokenEndpoints as _, type AuthClient as a, type TokenIntrospectionResponse as a0, type TokenStorage as a1, type UpdateSessionRequest as a2, type UserEndpoints as a3, type UserInfoResponse as a4, type UserProfile as a5, type VerifyEmailVerificationRequest as a6, type WebAuthnEndpoints as a7, createMemoryTokenStorage as a8, type AuthTokens as b, type AuthorizationCodeTokenRequest as c, type AuthorizationConsentBody as d, type AuthorizationConsentResponse as e, type AuthorizationDetail as f, type AuthorizationProbeResult as g, type AuthorizationRequest as h, type AuthorizationUrlOptions as i, type AuthorizeEndpoints as j, type CallbackParams as k, type ClientCredentialsRequest as l, type ConsumerMaintenanceEndpoints as m, type ConsumerUserEndpoints as n, type ExecuteStepRequest as o, type FlowInitResponse as p, type FlowSessionStatus as q, type FlowStep as r, type FlowStepCompleteResult as s, type FlowStepInProgressResult as t, type FlowStepResult as u, type InitRegistrationRequest as v, type IntrospectTokenRequest as w, type MfaDevice as x, type MfaEndpoints as y, type OAuthMetaEndpoints as z };
+export type { StartEmailVerificationRequest as $, AuthClientConfig as A, MfaEndpoints as B, ConsumerAuthClient as C, OAuthMetaEndpoints as D, EmailVerificationResponse as E, FlowEndpoints as F, OidcDiscoveryDocument as G, HandleCallbackOptions as H, InitAuthenticationRequest as I, OidcEndpoints as J, PageResponse as K, PasswordResetEndpoints as L, MaintenanceStatus as M, PasswordTokenRequest as N, OAuthAuthorizationServerMetadata as O, PageQuery as P, PublicClientInfo as Q, PushAuthorizationRequestOptions as R, PushedAuthorizationResult as S, RefreshTokenRequest as T, RevocationResponse as U, RevokeSessionRequest as V, RevokeTokenRequest as W, SessionDetail as X, SessionEndpoints as Y, SessionListQuery as Z, SessionSummary as _, AuthClient as a, TokenEndpoints as a0, TokenExchangeRequest as a1, TokenIntrospectionResponse as a2, TokenStorage as a3, UpdateSessionRequest as a4, UserEndpoints as a5, UserInfoResponse as a6, UserProfile as a7, VerifyEmailVerificationRequest as a8, WebAuthnEndpoints as a9, AuthTokens as b, AuthorizationCodeTokenRequest as c, AuthorizationConsentBody as d, AuthorizationConsentResponse as e, AuthorizationDetail as f, AuthorizationProbeResult as g, AuthorizationRequest as h, AuthorizationUrlOptions as i, AuthorizeEndpoints as j, AvatarAsset as k, AvatarAssetState as l, CallbackParams as m, ClientCredentialsRequest as n, ConsumerMaintenanceEndpoints as o, ConsumerUserEndpoints as p, ExecuteStepRequest as q, FlowInitResponse as r, FlowSessionStatus as s, FlowStep as t, FlowStepCompleteResult as u, FlowStepInProgressResult as v, FlowStepResult as w, InitRegistrationRequest as x, IntrospectTokenRequest as y, MfaDevice as z };

package/dist/{memory-DCHtjktX.d.ts → types-1sQaP6TE.d.ts}

@@ -903,6 +903,10 @@ interface AuthorizationUrlOptions {
     codeChallengeMethod?: "S256" | "plain";
     /** OIDC `prompt` parameter (e.g. `login`, `none`, `consent`). */
     prompt?: string;
+    /** OIDC maximum authentication age in seconds. Use `0` for a fresh login. */
+    maxAge?: number;
+    /** Ordered OIDC Authentication Context Class References. */
+    acrValues?: string[];
     /** OIDC `login_hint` to prefill the identifier. */
     loginHint?: string;
     /** OAuth `response_type`. Defaults to `code`. */
@@ -1204,6 +1208,24 @@ interface UserProfile {
     mfaEnabled?: boolean;
     [key: string]: JsonValue | undefined;
 }
+/** Lifecycle state for one private avatar version. */
+type AvatarAssetState = "created" | "processing" | "active" | "deleted";
+/**
+ * Private avatar-history metadata.
+ *
+ * The OAuth API intentionally does not expose source URLs or managed object
+ * keys. Use `UserProfile.picture` for the active compatibility image.
+ */
+interface AvatarAsset {
+    id: string;
+    state: AvatarAssetState;
+    isActive: boolean;
+    isManaged: boolean;
+    contentType?: string;
+    byteCount?: number;
+    createdAt?: string;
+    deletedAt?: string;
+}
 /** Starts primary-email verification without changing the current email. */
 interface StartEmailVerificationRequest {
     email: string;
@@ -1316,6 +1338,12 @@ interface UserEndpoints {
         newPassword: string;
     }): Promise<void>;
     uploadAvatar(file: Blob | Buffer, filename?: string): Promise<UserProfile>;
+    avatarAssets: {
+        list(): Promise<AvatarAsset[]>;
+        select(assetId: string): Promise<AvatarAsset>;
+        delete(assetId: string): Promise<void>;
+    };
+    /** Deselects the current avatar without deleting retained history. */
     deleteAvatar(): Promise<UserProfile>;
     verifyPhone(input: JsonObject): Promise<JsonObject>;
     verifyRecoveryEmail(input: JsonObject): Promise<JsonObject>;
@@ -1402,13 +1430,4 @@ interface ApiRequestOptions {
     token?: string;
 }
 
-/**
- * Creates in-memory token storage suitable for Node, edge, and browser runtimes.
- *
- * Tokens are not encrypted and do not survive process restarts. This is the
- * default and the recommended choice for server-side clients (SSR routes,
- * workers) where persistence belongs in HttpOnly cookies or a server session.
- */
-declare function createMemoryTokenStorage(): TokenStorage;
-
-export { type TokenExchangeRequest as $, type AuthClientConfig as A, type OidcDiscoveryDocument as B, type ConsumerAuthClient as C, type OidcEndpoints as D, type EmailVerificationResponse as E, type FlowEndpoints as F, type PageResponse as G, type HandleCallbackOptions as H, type InitAuthenticationRequest as I, type PasswordResetEndpoints as J, type PasswordTokenRequest as K, type PublicClientInfo as L, type MaintenanceStatus as M, type PushAuthorizationRequestOptions as N, type OAuthAuthorizationServerMetadata as O, type PageQuery as P, type PushedAuthorizationResult as Q, type RefreshTokenRequest as R, type RevocationResponse as S, type RevokeSessionRequest as T, type RevokeTokenRequest as U, type SessionDetail as V, type SessionEndpoints as W, type SessionListQuery as X, type SessionSummary as Y, type StartEmailVerificationRequest as Z, type TokenEndpoints as _, type AuthClient as a, type TokenIntrospectionResponse as a0, type TokenStorage as a1, type UpdateSessionRequest as a2, type UserEndpoints as a3, type UserInfoResponse as a4, type UserProfile as a5, type VerifyEmailVerificationRequest as a6, type WebAuthnEndpoints as a7, createMemoryTokenStorage as a8, type AuthTokens as b, type AuthorizationCodeTokenRequest as c, type AuthorizationConsentBody as d, type AuthorizationConsentResponse as e, type AuthorizationDetail as f, type AuthorizationProbeResult as g, type AuthorizationRequest as h, type AuthorizationUrlOptions as i, type AuthorizeEndpoints as j, type CallbackParams as k, type ClientCredentialsRequest as l, type ConsumerMaintenanceEndpoints as m, type ConsumerUserEndpoints as n, type ExecuteStepRequest as o, type FlowInitResponse as p, type FlowSessionStatus as q, type FlowStep as r, type FlowStepCompleteResult as s, type FlowStepInProgressResult as t, type FlowStepResult as u, type InitRegistrationRequest as v, type IntrospectTokenRequest as w, type MfaDevice as x, type MfaEndpoints as y, type OAuthMetaEndpoints as z };
+export type { StartEmailVerificationRequest as $, AuthClientConfig as A, MfaEndpoints as B, ConsumerAuthClient as C, OAuthMetaEndpoints as D, EmailVerificationResponse as E, FlowEndpoints as F, OidcDiscoveryDocument as G, HandleCallbackOptions as H, InitAuthenticationRequest as I, OidcEndpoints as J, PageResponse as K, PasswordResetEndpoints as L, MaintenanceStatus as M, PasswordTokenRequest as N, OAuthAuthorizationServerMetadata as O, PageQuery as P, PublicClientInfo as Q, PushAuthorizationRequestOptions as R, PushedAuthorizationResult as S, RefreshTokenRequest as T, RevocationResponse as U, RevokeSessionRequest as V, RevokeTokenRequest as W, SessionDetail as X, SessionEndpoints as Y, SessionListQuery as Z, SessionSummary as _, AuthClient as a, TokenEndpoints as a0, TokenExchangeRequest as a1, TokenIntrospectionResponse as a2, TokenStorage as a3, UpdateSessionRequest as a4, UserEndpoints as a5, UserInfoResponse as a6, UserProfile as a7, VerifyEmailVerificationRequest as a8, WebAuthnEndpoints as a9, AuthTokens as b, AuthorizationCodeTokenRequest as c, AuthorizationConsentBody as d, AuthorizationConsentResponse as e, AuthorizationDetail as f, AuthorizationProbeResult as g, AuthorizationRequest as h, AuthorizationUrlOptions as i, AuthorizeEndpoints as j, AvatarAsset as k, AvatarAssetState as l, CallbackParams as m, ClientCredentialsRequest as n, ConsumerMaintenanceEndpoints as o, ConsumerUserEndpoints as p, ExecuteStepRequest as q, FlowInitResponse as r, FlowSessionStatus as s, FlowStep as t, FlowStepCompleteResult as u, FlowStepInProgressResult as v, FlowStepResult as w, InitRegistrationRequest as x, IntrospectTokenRequest as y, MfaDevice as z };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tktchurch/auth",
-  "version": "0.9.9",
+  "version": "0.11.0",
   "description": "Framework-agnostic auth SDK for TKTChurch OAuth/AuthFlow services",
   "license": "MIT",
   "type": "module",
@@ -45,6 +45,11 @@
       "types": "./dist/nuxt/module.d.ts",
       "import": "./dist/nuxt/module.js",
       "require": "./dist/nuxt/module.cjs"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js",
+      "require": "./dist/server.cjs"
     }
   },
   "files": [