@usearete/sdk 0.1.0

package/dist/ssr/nextjs-app.js

@@ -0,0 +1,359 @@
+'use strict';
+
+var ed25519 = require('@noble/ed25519');
+
+function _interopNamespaceDefault(e) {
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n.default = e;
+    return Object.freeze(n);
+}
+
+var ed25519__namespace = /*#__PURE__*/_interopNamespaceDefault(ed25519);
+
+/**
+ * Base64URL encoding/decoding utilities
+ */
+/**
+ * Encode Uint8Array to base64url string (RFC 4648)
+ */
+function encode(bytes) {
+    // Convert to regular base64
+    const base64 = Buffer.from(bytes).toString('base64');
+    // Convert to base64url: replace + with -, / with _, remove padding
+    return base64
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode base64url string to Uint8Array
+ */
+function decode(base64url) {
+    // Convert from base64url to regular base64
+    let base64 = base64url
+        .replace(/-/g, '+')
+        .replace(/_/g, '/');
+    // Add padding if needed
+    const padding = 4 - (base64.length % 4);
+    if (padding !== 4) {
+        base64 += '='.repeat(padding);
+    }
+    return new Uint8Array(Buffer.from(base64, 'base64'));
+}
+const base64url = {
+    encode,
+    decode,
+};
+
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+/**
+ * Decode base64 to Uint8Array
+ */
+function decodeBase64(base64) {
+    const binary = Buffer.from(base64, 'base64');
+    return new Uint8Array(binary);
+}
+/**
+ * Encode Uint8Array to base64url
+ */
+function encodeBase64url(bytes) {
+    return base64url.encode(bytes);
+}
+/**
+ * Generate a key ID from public key bytes
+ */
+function deriveKeyId(publicKey) {
+    // Use first 8 bytes of public key as hex for kid
+    return Array.from(publicKey.slice(0, 8))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Create JWT header for Ed25519
+ */
+function createJwtHeader(keyId) {
+    const header = {
+        alg: 'EdDSA',
+        typ: 'JWT',
+        kid: keyId,
+    };
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(header)));
+}
+/**
+ * Create JWT payload from claims
+ */
+function createJwtPayload(claims) {
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(claims)));
+}
+/**
+ * Sign data with Ed25519
+ */
+async function signEd25519(data, privateKey) {
+    const messageBytes = new TextEncoder().encode(data);
+    return await ed25519__namespace.signAsync(messageBytes, privateKey);
+}
+/**
+ * Mint a session token using Ed25519 signing
+ * `subject` must come from verified server-side auth or trusted service code.
+ */
+async function mintSessionToken(config, subject = 'anonymous', scope = 'read', origin) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    if (!signingKeyBase64) {
+        throw new Error('ARETE_SIGNING_KEY not set. Generate with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'base64\'))"');
+    }
+    const privateKeyBytes = decodeBase64(signingKeyBase64);
+    if (privateKeyBytes.length !== 32) {
+        throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}. ` +
+            'Ed25519 signing key must be 32 bytes (base64-encoded).');
+    }
+    // Derive public key from private key
+    const publicKeyBytes = await ed25519__namespace.getPublicKeyAsync(privateKeyBytes);
+    const keyId = config.keyId || deriveKeyId(publicKeyBytes);
+    const issuer = config.issuer || process.env.ARETE_ISSUER || 'arete';
+    const audience = config.audience || process.env.ARETE_AUDIENCE || 'arete';
+    const ttlSeconds = config.ttlSeconds || 300;
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + ttlSeconds;
+    const claims = {
+        iss: issuer,
+        sub: subject,
+        aud: audience,
+        iat: now,
+        nbf: now,
+        exp: expiresAt,
+        jti: crypto.randomUUID(),
+        scope,
+        metering_key: `meter:${subject}`,
+        key_class: 'secret',
+        limits: config.limits || {
+            max_connections: 10,
+            max_subscriptions: 100,
+            max_snapshot_rows: 1000,
+            max_messages_per_minute: 10000,
+            max_bytes_per_minute: 100 * 1024 * 1024,
+        },
+    };
+    // Add origin binding if provided
+    if (origin) {
+        claims.origin = origin;
+    }
+    // Create JWT
+    const header = createJwtHeader(keyId);
+    const payload = createJwtPayload(claims);
+    const signingInput = `${header}.${payload}`;
+    const signature = await signEd25519(signingInput, privateKeyBytes);
+    const signatureBase64 = encodeBase64url(signature);
+    const token = `${signingInput}.${signatureBase64}`;
+    return {
+        token,
+        expires_at: expiresAt,
+    };
+}
+/**
+ * Generate JWKS response from signing key
+ */
+async function generateJwks(config) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    const publicKeyBase64 = config.publicKey || process.env.ARETE_PUBLIC_KEY;
+    if (!signingKeyBase64 && !publicKeyBase64) {
+        return { keys: [] };
+    }
+    let publicKeyBytes;
+    if (publicKeyBase64) {
+        // Use provided public key
+        publicKeyBytes = decodeBase64(publicKeyBase64);
+        if (publicKeyBytes.length !== 32) {
+            throw new Error(`Invalid public key length: expected 32 bytes, got ${publicKeyBytes.length}`);
+        }
+    }
+    else {
+        // Derive public key from private key
+        const privateKeyBytes = decodeBase64(signingKeyBase64);
+        if (privateKeyBytes.length !== 32) {
+            throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}`);
+        }
+        publicKeyBytes = await ed25519__namespace.getPublicKeyAsync(privateKeyBytes);
+    }
+    const keyId = config.keyId ||
+        (publicKeyBase64 ? 'key-1' : deriveKeyId(publicKeyBytes));
+    return {
+        keys: [
+            {
+                kty: 'OKP',
+                crv: 'Ed25519',
+                kid: keyId,
+                use: 'sig',
+                alg: 'EdDSA',
+                x: encodeBase64url(publicKeyBytes),
+            },
+        ],
+    };
+}
+
+/**
+ * Next.js App Router integration for Arete Auth
+ *
+ * Drop-in route handlers for Next.js App Router.
+ * `resolveSession` must derive the subject from verified server-side auth.
+ * Never trust caller-supplied headers for identity or scope.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * async function getAuthenticatedUser() {
+ *   // Return your verified server-side user/session here.
+ * }
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id };
+ *   },
+ * });
+ * export const GET = createNextJsJwksRoute();
+ * ```
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (with custom config)
+ * import { createNextJsSessionRoute, createNextJsJwksRoute } from '@usearete/sdk/ssr/nextjs-app';
+ *
+ * export const POST = createNextJsSessionRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ *   resolveSession: async () => {
+ *     const user = await getAuthenticatedUser();
+ *     if (!user) return null;
+ *     return { subject: user.id, scope: 'read' };
+ *   },
+ *   ttlSeconds: 600,
+ * });
+ *
+ * export const GET = createNextJsJwksRoute({
+ *   signingKey: process.env.ARETE_SIGNING_KEY,
+ * });
+ * ```
+ */
+/**
+ * Create a Next.js App Router POST handler for /ws/sessions
+ */
+function createNextJsSessionRoute(config = {}) {
+    return async function POST(request) {
+        const origin = request.headers.get('origin') || undefined;
+        try {
+            if (!config.resolveSession) {
+                return new Response(JSON.stringify({
+                    error: 'createNextJsSessionRoute requires resolveSession to derive the subject from authenticated server-side state',
+                }), {
+                    status: 500,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            const session = await config.resolveSession(request);
+            if (!session) {
+                return new Response(JSON.stringify({
+                    error: 'Unauthorized',
+                }), {
+                    status: 401,
+                    headers: {
+                        'Content-Type': 'application/json',
+                    },
+                });
+            }
+            const tokenData = await mintSessionToken(config, session.subject, session.scope || 'read', origin);
+            return new Response(JSON.stringify(tokenData), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            return new Response(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to mint token',
+            }), {
+                status: 500,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+    };
+}
+/**
+ * Create a Next.js App Router GET handler for /.well-known/jwks.json
+ */
+function createNextJsJwksRoute(config = {}) {
+    return async function GET() {
+        try {
+            const jwks = await generateJwks(config);
+            return new Response(JSON.stringify(jwks), {
+                status: 200,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+        catch (error) {
+            return new Response(JSON.stringify({
+                error: error instanceof Error ? error.message : 'Failed to generate JWKS',
+            }), {
+                status: 500,
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+            });
+        }
+    };
+}
+/**
+ * Create a combined route handler that supports both POST (sessions) and GET (JWKS)
+ * Mount at a single route like /api/arete/auth
+ */
+function createNextJsAuthRoute(config = {}) {
+    return {
+        POST: createNextJsSessionRoute(config),
+        GET: createNextJsJwksRoute(config),
+    };
+}
+
+exports.createNextJsAuthRoute = createNextJsAuthRoute;
+exports.createNextJsJwksRoute = createNextJsJwksRoute;
+exports.createNextJsSessionRoute = createNextJsSessionRoute;
+//# sourceMappingURL=nextjs-app.js.map

package/dist/ssr/nextjs-app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"nextjs-app.js","sources":["../../src/ssr/utils.ts","../../src/ssr/handlers.ts","../../src/ssr/nextjs-app.ts"],"sourcesContent":[null,null,null],"names":["ed25519"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;;AAEG;AAEH;;AAEG;AACG,SAAU,MAAM,CAAC,KAAiB,EAAA;;AAEtC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;AAErD,IAAA,OAAO,MAAM;AACV,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;AAEG;AACG,SAAU,MAAM,CAAC,SAAiB,EAAA;;IAEtC,IAAI,MAAM,GAAG,SAAS;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAClB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;;IAGtB,MAAM,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACxC,IAAA,IAAI,OAAO,KAAK,CAAC,EAAE;AACjB,QAAA,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAC/B;AAED,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAEM,MAAM,SAAS,GAAG;IACvB,MAAM;IACN,MAAM;CACP;;ACtCD;;;;;;;;;;;;;;;;;;;;;AAqBG;AAoGH;;AAEG;AACH,SAAS,YAAY,CAAC,MAAc,EAAA;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAiB,EAAA;AACxC,IAAA,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;AAEG;AACH,SAAS,WAAW,CAAC,SAAqB,EAAA;;AAExC,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,SAAA,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAa,EAAA;AACpC,IAAA,MAAM,MAAM,GAAG;AACb,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,KAAK;AACV,QAAA,GAAG,EAAE,KAAK;KACX,CAAC;AACF,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB,EAAA;AAC7C,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,eAAe,WAAW,CACxB,IAAY,EACZ,UAAsB,EAAA;IAEtB,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,MAAMA,kBAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;AAGG;AACI,eAAe,gBAAgB,CACpC,MAAyB,EACzB,OAAA,GAAkB,WAAW,EAC7B,KAAgB,GAAA,MAAM,EACtB,MAAe,EAAA;IAEf,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,IAAI,CAAC,gBAAgB,EAAE;AACrB,QAAA,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;KACH;AAED,IAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AACvD,IAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;AACjC,QAAA,MAAM,IAAI,KAAK,CACb,sDAAsD,eAAe,CAAC,MAAM,CAAI,EAAA,CAAA;AAChF,YAAA,wDAAwD,CACzD,CAAC;KACH;;IAGD,MAAM,cAAc,GAAG,MAAMA,kBAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;AAE1D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC;AACpE,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;AAC1E,IAAA,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;AAE5C,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1C,IAAA,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;AAEnC,IAAA,MAAM,MAAM,GAAkB;AAC5B,QAAA,GAAG,EAAE,MAAM;AACX,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,QAAQ;AACb,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,SAAS;AACd,QAAA,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK;QACL,YAAY,EAAE,CAAS,MAAA,EAAA,OAAO,CAAE,CAAA;AAChC,QAAA,SAAS,EAAE,QAAQ;AACnB,QAAA,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;AACvB,YAAA,eAAe,EAAE,EAAE;AACnB,YAAA,iBAAiB,EAAE,GAAG;AACtB,YAAA,iBAAiB,EAAE,IAAI;AACvB,YAAA,uBAAuB,EAAE,KAAK;AAC9B,YAAA,oBAAoB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;AACxC,SAAA;KACF,CAAC;;IAGF,IAAI,MAAM,EAAE;AACV,QAAA,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;KACxB;;AAGD,IAAA,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,IAAA,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACzC,IAAA,MAAM,YAAY,GAAG,CAAA,EAAG,MAAM,CAAI,CAAA,EAAA,OAAO,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AACnE,IAAA,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;AAEnD,IAAA,MAAM,KAAK,GAAG,CAAA,EAAG,YAAY,CAAI,CAAA,EAAA,eAAe,EAAE,CAAC;IAEnD,OAAO;QACL,KAAK;AACL,QAAA,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;AAEG;AACI,eAAe,YAAY,CAAC,MAAyB,EAAA;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEzE,IAAA,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe,EAAE;AACzC,QAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;KACrB;AAED,IAAA,IAAI,cAA0B,CAAC;IAE/B,IAAI,eAAe,EAAE;;AAEnB,QAAA,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CACb,CAAA,kDAAA,EAAqD,cAAc,CAAC,MAAM,CAAE,CAAA,CAC7E,CAAC;SACH;KACF;SAAM;;AAEL,QAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAiB,CAAC,CAAC;AACxD,QAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CACb,CAAA,mDAAA,EAAsD,eAAe,CAAC,MAAM,CAAE,CAAA,CAC/E,CAAC;SACH;QACD,cAAc,GAAG,MAAMA,kBAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;KACnE;AAED,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;AACxB,SAAC,eAAe,GAAG,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAE5D,OAAO;AACL,QAAA,IAAI,EAAE;AACJ,YAAA;AACE,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,SAAS;AACd,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,OAAO;AACZ,gBAAA,CAAC,EAAE,eAAe,CAAC,cAAc,CAAC;AACnC,aAAA;AACF,SAAA;KACF,CAAC;AACJ;;AC3SA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA6CG;AAiBH;;AAEG;AACa,SAAA,wBAAwB,CAAC,MAAA,GAAmC,EAAE,EAAA;AAC5E,IAAA,OAAO,eAAe,IAAI,CAAC,OAAoB,EAAA;AAC7C,QAAA,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;AAE1D,QAAA,IAAI;AACF,YAAA,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;AAC1B,gBAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,oBAAA,KAAK,EAAE,6GAA6G;AACrH,iBAAA,CAAC,EACF;AACE,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,OAAO,EAAE;AACP,wBAAA,cAAc,EAAE,kBAAkB;AACnC,qBAAA;AACF,iBAAA,CACF,CAAC;aACH;YAED,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC;YACrD,IAAI,CAAC,OAAO,EAAE;AACZ,gBAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,oBAAA,KAAK,EAAE,cAAc;AACtB,iBAAA,CAAC,EACF;AACE,oBAAA,MAAM,EAAE,GAAG;AACX,oBAAA,OAAO,EAAE;AACP,wBAAA,cAAc,EAAE,kBAAkB;AACnC,qBAAA;AACF,iBAAA,CACF,CAAC;aACH;AAED,YAAA,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,MAAM,CAAC,CAAC;YAEnG,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;AAC7C,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,gBAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,sBAAsB;AACvE,aAAA,CAAC,EACF;AACE,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CACF,CAAC;SACH;AACH,KAAC,CAAC;AACJ,CAAC;AAED;;AAEG;AACa,SAAA,qBAAqB,CAAC,MAAA,GAA4B,EAAE,EAAA;IAClE,OAAO,eAAe,GAAG,GAAA;AACvB,QAAA,IAAI;AACF,YAAA,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;YAExC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AACxC,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CAAC,CAAC;SACJ;QAAC,OAAO,KAAK,EAAE;AACd,YAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,gBAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,yBAAyB;AAC1E,aAAA,CAAC,EACF;AACE,gBAAA,MAAM,EAAE,GAAG;AACX,gBAAA,OAAO,EAAE;AACP,oBAAA,cAAc,EAAE,kBAAkB;AACnC,iBAAA;AACF,aAAA,CACF,CAAC;SACH;AACH,KAAC,CAAC;AACJ,CAAC;AAED;;;AAGG;AACa,SAAA,qBAAqB,CAAC,MAAA,GAAmC,EAAE,EAAA;IACzE,OAAO;AACL,QAAA,IAAI,EAAE,wBAAwB,CAAC,MAAM,CAAC;AACtC,QAAA,GAAG,EAAE,qBAAqB,CAAC,MAAM,CAAC;KACnC,CAAC;AACJ;;;;;;"}

package/dist/ssr/tanstack-start.d.ts

@@ -0,0 +1,165 @@
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+interface AuthHandlerConfig {
+    /**
+     * Ed25519 signing key seed (base64-encoded, 32 bytes).
+     * Set ARETE_SIGNING_KEY env var OR pass here.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+     */
+    signingKey?: string;
+    /**
+     * Optional: Pre-derived public key (base64-encoded, 32 bytes).
+     * If not provided, will be derived from the signing key.
+     */
+    publicKey?: string;
+    /**
+     * Token issuer (defaults to ARETE_ISSUER env var or 'arete')
+     */
+    issuer?: string;
+    /**
+     * Token audience (defaults to ARETE_AUDIENCE env var)
+     */
+    audience?: string;
+    /**
+     * Token TTL in seconds (defaults to 300 = 5 minutes)
+     */
+    ttlSeconds?: number;
+    /**
+     * Key ID for JWKS (defaults to 'key-1')
+     */
+    keyId?: string;
+    /**
+     * Custom limits for tokens
+     */
+    limits?: {
+        max_connections?: number;
+        max_subscriptions?: number;
+        max_snapshot_rows?: number;
+    };
+}
+interface TokenResponse {
+    token: string;
+    expires_at: number;
+}
+/**
+ * Authenticated session data resolved by framework adapters.
+ * Always derive this from verified server-side auth, never request headers.
+ */
+interface ResolvedSession {
+    subject: string;
+    scope?: string;
+}
+
+/**
+ * TanStack Start integration for Arete Auth
+ *
+ * Drop-in API route handlers for TanStack Start.
+ * `resolveSession` must derive the subject from verified server-side auth.
+ * Never trust caller-supplied headers for identity or scope.
+ *
+ * @example
+ * ```typescript
+ * // app/routes/api/arete/sessions.ts
+ * import { createTanStackSessionRoute, createTanStackJwksRoute } from '@usearete/sdk/ssr/tanstack-start';
+ * import { json } from '@tanstack/react-start';
+ *
+ * export const APIRoute = createTanStackSessionRoute({
+ *   resolveSession: async ({ request }) => {
+ *     const user = await getAuthenticatedUser(request);
+ *     if (!user) return null;
+ *     return { subject: user.id };
+ *   },
+ * });
+ *
+ * // For JWKS at the same route with GET
+ * export const GET = createTanStackJwksRoute();
+ * ```
+ */
+
+interface TanStackRequest {
+    url: string;
+    headers: Headers;
+}
+interface TanStackResponse {
+    json: (data: unknown, init?: {
+        status?: number;
+    }) => Response;
+}
+interface TanStackContext {
+    request: TanStackRequest;
+}
+interface TanStackSessionRouteConfig extends AuthHandlerConfig {
+    resolveSession?: (context: TanStackContext) => Promise<ResolvedSession | null> | ResolvedSession | null;
+}
+/**
+ * Create a TanStack Start handler for POST /sessions
+ * Returns a function compatible with TanStack Start's APIRoute
+ */
+declare function createTanStackSessionRoute(config?: TanStackSessionRouteConfig): ({ request }: TanStackContext) => Promise<Response>;
+/**
+ * Create a TanStack Start handler for GET /.well-known/jwks.json
+ */
+declare function createTanStackJwksRoute(config?: AuthHandlerConfig): () => Promise<Response>;
+/**
+ * Create a TanStack Start API route that handles both POST (sessions) and GET (JWKS)
+ *
+ * @example
+ * ```typescript
+ * // app/routes/api/arete/auth.ts
+ * import { createTanStackAuthRoute } from '@usearete/sdk/ssr/tanstack-start';
+ *
+ * export const APIRoute = createTanStackAuthRoute({
+ *   resolveSession: async ({ request }) => {
+ *     const user = await getAuthenticatedUser(request);
+ *     if (!user) return null;
+ *     return { subject: user.id };
+ *   },
+ *   ttlSeconds: 600,
+ * });
+ * ```
+ */
+declare function createTanStackAuthRoute(config?: TanStackSessionRouteConfig): {
+    POST: ({ request }: TanStackContext) => Promise<Response>;
+    GET: () => Promise<Response>;
+};
+/**
+ * Hook to access the Arete token in TanStack Start loaders
+ *
+ * @example
+ * ```typescript
+ * // app/routes/dashboard.tsx
+ * import { createFileRoute } from '@tanstack/react-start';
+ * import { fetchAreteToken } from '@usearete/sdk/ssr/tanstack-start';
+ *
+ * export const Route = createFileRoute('/dashboard')({
+ *   loader: async () => {
+ *     const token = await fetchAreteToken('/api/arete/sessions');
+ *     // Use token for data fetching...
+ *   },
+ * });
+ * ```
+ */
+declare function fetchAreteToken(endpoint?: string): Promise<string>;
+
+export { createTanStackAuthRoute, createTanStackJwksRoute, createTanStackSessionRoute, fetchAreteToken };
+export type { AuthHandlerConfig, ResolvedSession, TanStackContext, TanStackRequest, TanStackResponse, TanStackSessionRouteConfig, TokenResponse };