@usearete/sdk 0.1.0

package/dist/ssr/handlers.js

@@ -0,0 +1,294 @@
+'use strict';
+
+var ed25519 = require('@noble/ed25519');
+
+function _interopNamespaceDefault(e) {
+    var n = Object.create(null);
+    if (e) {
+        Object.keys(e).forEach(function (k) {
+            if (k !== 'default') {
+                var d = Object.getOwnPropertyDescriptor(e, k);
+                Object.defineProperty(n, k, d.get ? d : {
+                    enumerable: true,
+                    get: function () { return e[k]; }
+                });
+            }
+        });
+    }
+    n.default = e;
+    return Object.freeze(n);
+}
+
+var ed25519__namespace = /*#__PURE__*/_interopNamespaceDefault(ed25519);
+
+/**
+ * Base64URL encoding/decoding utilities
+ */
+/**
+ * Encode Uint8Array to base64url string (RFC 4648)
+ */
+function encode(bytes) {
+    // Convert to regular base64
+    const base64 = Buffer.from(bytes).toString('base64');
+    // Convert to base64url: replace + with -, / with _, remove padding
+    return base64
+        .replace(/\+/g, '-')
+        .replace(/\//g, '_')
+        .replace(/=/g, '');
+}
+/**
+ * Decode base64url string to Uint8Array
+ */
+function decode(base64url) {
+    // Convert from base64url to regular base64
+    let base64 = base64url
+        .replace(/-/g, '+')
+        .replace(/_/g, '/');
+    // Add padding if needed
+    const padding = 4 - (base64.length % 4);
+    if (padding !== 4) {
+        base64 += '='.repeat(padding);
+    }
+    return new Uint8Array(Buffer.from(base64, 'base64'));
+}
+const base64url = {
+    encode,
+    decode,
+};
+
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+/**
+ * Decode base64 to Uint8Array
+ */
+function decodeBase64(base64) {
+    const binary = Buffer.from(base64, 'base64');
+    return new Uint8Array(binary);
+}
+/**
+ * Encode Uint8Array to base64url
+ */
+function encodeBase64url(bytes) {
+    return base64url.encode(bytes);
+}
+/**
+ * Generate a key ID from public key bytes
+ */
+function deriveKeyId(publicKey) {
+    // Use first 8 bytes of public key as hex for kid
+    return Array.from(publicKey.slice(0, 8))
+        .map(b => b.toString(16).padStart(2, '0'))
+        .join('');
+}
+/**
+ * Create JWT header for Ed25519
+ */
+function createJwtHeader(keyId) {
+    const header = {
+        alg: 'EdDSA',
+        typ: 'JWT',
+        kid: keyId,
+    };
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(header)));
+}
+/**
+ * Create JWT payload from claims
+ */
+function createJwtPayload(claims) {
+    return encodeBase64url(new TextEncoder().encode(JSON.stringify(claims)));
+}
+/**
+ * Sign data with Ed25519
+ */
+async function signEd25519(data, privateKey) {
+    const messageBytes = new TextEncoder().encode(data);
+    return await ed25519__namespace.signAsync(messageBytes, privateKey);
+}
+/**
+ * Mint a session token using Ed25519 signing
+ * `subject` must come from verified server-side auth or trusted service code.
+ */
+async function mintSessionToken(config, subject = 'anonymous', scope = 'read', origin) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    if (!signingKeyBase64) {
+        throw new Error('ARETE_SIGNING_KEY not set. Generate with: node -e "console.log(require(\'crypto\').randomBytes(32).toString(\'base64\'))"');
+    }
+    const privateKeyBytes = decodeBase64(signingKeyBase64);
+    if (privateKeyBytes.length !== 32) {
+        throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}. ` +
+            'Ed25519 signing key must be 32 bytes (base64-encoded).');
+    }
+    // Derive public key from private key
+    const publicKeyBytes = await ed25519__namespace.getPublicKeyAsync(privateKeyBytes);
+    const keyId = config.keyId || deriveKeyId(publicKeyBytes);
+    const issuer = config.issuer || process.env.ARETE_ISSUER || 'arete';
+    const audience = config.audience || process.env.ARETE_AUDIENCE || 'arete';
+    const ttlSeconds = config.ttlSeconds || 300;
+    const now = Math.floor(Date.now() / 1000);
+    const expiresAt = now + ttlSeconds;
+    const claims = {
+        iss: issuer,
+        sub: subject,
+        aud: audience,
+        iat: now,
+        nbf: now,
+        exp: expiresAt,
+        jti: crypto.randomUUID(),
+        scope,
+        metering_key: `meter:${subject}`,
+        key_class: 'secret',
+        limits: config.limits || {
+            max_connections: 10,
+            max_subscriptions: 100,
+            max_snapshot_rows: 1000,
+            max_messages_per_minute: 10000,
+            max_bytes_per_minute: 100 * 1024 * 1024,
+        },
+    };
+    // Add origin binding if provided
+    if (origin) {
+        claims.origin = origin;
+    }
+    // Create JWT
+    const header = createJwtHeader(keyId);
+    const payload = createJwtPayload(claims);
+    const signingInput = `${header}.${payload}`;
+    const signature = await signEd25519(signingInput, privateKeyBytes);
+    const signatureBase64 = encodeBase64url(signature);
+    const token = `${signingInput}.${signatureBase64}`;
+    return {
+        token,
+        expires_at: expiresAt,
+    };
+}
+/**
+ * Generate JWKS response from signing key
+ */
+async function generateJwks(config) {
+    const signingKeyBase64 = config.signingKey || process.env.ARETE_SIGNING_KEY;
+    const publicKeyBase64 = config.publicKey || process.env.ARETE_PUBLIC_KEY;
+    if (!signingKeyBase64 && !publicKeyBase64) {
+        return { keys: [] };
+    }
+    let publicKeyBytes;
+    if (publicKeyBase64) {
+        // Use provided public key
+        publicKeyBytes = decodeBase64(publicKeyBase64);
+        if (publicKeyBytes.length !== 32) {
+            throw new Error(`Invalid public key length: expected 32 bytes, got ${publicKeyBytes.length}`);
+        }
+    }
+    else {
+        // Derive public key from private key
+        const privateKeyBytes = decodeBase64(signingKeyBase64);
+        if (privateKeyBytes.length !== 32) {
+            throw new Error(`Invalid signing key length: expected 32 bytes, got ${privateKeyBytes.length}`);
+        }
+        publicKeyBytes = await ed25519__namespace.getPublicKeyAsync(privateKeyBytes);
+    }
+    const keyId = config.keyId ||
+        (publicKeyBase64 ? 'key-1' : deriveKeyId(publicKeyBytes));
+    return {
+        keys: [
+            {
+                kty: 'OKP',
+                crv: 'Ed25519',
+                kid: keyId,
+                use: 'sig',
+                alg: 'EdDSA',
+                x: encodeBase64url(publicKeyBytes),
+            },
+        ],
+    };
+}
+/**
+ * Framework-agnostic request handler for token minting
+ * Returns a Response object that can be used with any framework
+ * The `subject` must be derived from verified server-side auth.
+ */
+async function handleSessionRequest(config = {}, subject = 'anonymous', scope = 'read', origin) {
+    try {
+        const tokenData = await mintSessionToken(config, subject, scope, origin);
+        return new Response(JSON.stringify(tokenData), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+    catch (error) {
+        return new Response(JSON.stringify({
+            error: error instanceof Error ? error.message : 'Failed to mint token',
+        }), {
+            status: 500,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+}
+/**
+ * Framework-agnostic request handler for JWKS endpoint
+ */
+async function handleJwksRequest(config = {}) {
+    try {
+        const jwks = await generateJwks(config);
+        return new Response(JSON.stringify(jwks), {
+            status: 200,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+    catch (error) {
+        return new Response(JSON.stringify({
+            error: error instanceof Error ? error.message : 'Failed to generate JWKS',
+        }), {
+            status: 500,
+            headers: {
+                'Content-Type': 'application/json',
+            },
+        });
+    }
+}
+/**
+ * Framework-agnostic health check handler
+ */
+function handleHealthRequest() {
+    return new Response(JSON.stringify({
+        status: 'healthy',
+        version: '0.5.10',
+    }), {
+        status: 200,
+        headers: {
+            'Content-Type': 'application/json',
+        },
+    });
+}
+
+exports.generateJwks = generateJwks;
+exports.handleHealthRequest = handleHealthRequest;
+exports.handleJwksRequest = handleJwksRequest;
+exports.handleSessionRequest = handleSessionRequest;
+exports.mintSessionToken = mintSessionToken;
+//# sourceMappingURL=handlers.js.map

package/dist/ssr/handlers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"handlers.js","sources":["../../src/ssr/utils.ts","../../src/ssr/handlers.ts"],"sourcesContent":[null,null],"names":["ed25519"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;AAAA;;AAEG;AAEH;;AAEG;AACG,SAAU,MAAM,CAAC,KAAiB,EAAA;;AAEtC,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;;AAErD,IAAA,OAAO,MAAM;AACV,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;AACvB,CAAC;AAED;;AAEG;AACG,SAAU,MAAM,CAAC,SAAiB,EAAA;;IAEtC,IAAI,MAAM,GAAG,SAAS;AACnB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;AAClB,SAAA,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;;IAGtB,MAAM,OAAO,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACxC,IAAA,IAAI,OAAO,KAAK,CAAC,EAAE;AACjB,QAAA,MAAM,IAAI,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAC/B;AAED,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAEM,MAAM,SAAS,GAAG;IACvB,MAAM;IACN,MAAM;CACP;;ACtCD;;;;;;;;;;;;;;;;;;;;;AAqBG;AAoGH;;AAEG;AACH,SAAS,YAAY,CAAC,MAAc,EAAA;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AAC7C,IAAA,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAiB,EAAA;AACxC,IAAA,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED;;AAEG;AACH,SAAS,WAAW,CAAC,SAAqB,EAAA;;AAExC,IAAA,OAAO,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACrC,SAAA,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;SACzC,IAAI,CAAC,EAAE,CAAC,CAAC;AACd,CAAC;AAED;;AAEG;AACH,SAAS,eAAe,CAAC,KAAa,EAAA;AACpC,IAAA,MAAM,MAAM,GAAG;AACb,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,KAAK;AACV,QAAA,GAAG,EAAE,KAAK;KACX,CAAC;AACF,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,SAAS,gBAAgB,CAAC,MAAqB,EAAA;AAC7C,IAAA,OAAO,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED;;AAEG;AACH,eAAe,WAAW,CACxB,IAAY,EACZ,UAAsB,EAAA;IAEtB,MAAM,YAAY,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACpD,OAAO,MAAMA,kBAAO,CAAC,SAAS,CAAC,YAAY,EAAE,UAAU,CAAC,CAAC;AAC3D,CAAC;AAED;;;AAGG;AACI,eAAe,gBAAgB,CACpC,MAAyB,EACzB,OAAA,GAAkB,WAAW,EAC7B,KAAgB,GAAA,MAAM,EACtB,MAAe,EAAA;IAEf,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,IAAI,CAAC,gBAAgB,EAAE;AACrB,QAAA,MAAM,IAAI,KAAK,CACb,2HAA2H,CAC5H,CAAC;KACH;AAED,IAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AACvD,IAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;AACjC,QAAA,MAAM,IAAI,KAAK,CACb,sDAAsD,eAAe,CAAC,MAAM,CAAI,EAAA,CAAA;AAChF,YAAA,wDAAwD,CACzD,CAAC;KACH;;IAGD,MAAM,cAAc,GAAG,MAAMA,kBAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;AAE1D,IAAA,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,OAAO,CAAC;AACpE,IAAA,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,OAAO,CAAC;AAC1E,IAAA,MAAM,UAAU,GAAG,MAAM,CAAC,UAAU,IAAI,GAAG,CAAC;AAE5C,IAAA,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;AAC1C,IAAA,MAAM,SAAS,GAAG,GAAG,GAAG,UAAU,CAAC;AAEnC,IAAA,MAAM,MAAM,GAAkB;AAC5B,QAAA,GAAG,EAAE,MAAM;AACX,QAAA,GAAG,EAAE,OAAO;AACZ,QAAA,GAAG,EAAE,QAAQ;AACb,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,GAAG;AACR,QAAA,GAAG,EAAE,SAAS;AACd,QAAA,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE;QACxB,KAAK;QACL,YAAY,EAAE,CAAS,MAAA,EAAA,OAAO,CAAE,CAAA;AAChC,QAAA,SAAS,EAAE,QAAQ;AACnB,QAAA,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI;AACvB,YAAA,eAAe,EAAE,EAAE;AACnB,YAAA,iBAAiB,EAAE,GAAG;AACtB,YAAA,iBAAiB,EAAE,IAAI;AACvB,YAAA,uBAAuB,EAAE,KAAK;AAC9B,YAAA,oBAAoB,EAAE,GAAG,GAAG,IAAI,GAAG,IAAI;AACxC,SAAA;KACF,CAAC;;IAGF,IAAI,MAAM,EAAE;AACV,QAAA,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;KACxB;;AAGD,IAAA,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;AACtC,IAAA,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;AACzC,IAAA,MAAM,YAAY,GAAG,CAAA,EAAG,MAAM,CAAI,CAAA,EAAA,OAAO,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,YAAY,EAAE,eAAe,CAAC,CAAC;AACnE,IAAA,MAAM,eAAe,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;AAEnD,IAAA,MAAM,KAAK,GAAG,CAAA,EAAG,YAAY,CAAI,CAAA,EAAA,eAAe,EAAE,CAAC;IAEnD,OAAO;QACL,KAAK;AACL,QAAA,UAAU,EAAE,SAAS;KACtB,CAAC;AACJ,CAAC;AAED;;AAEG;AACI,eAAe,YAAY,CAAC,MAAyB,EAAA;IAC1D,MAAM,gBAAgB,GAAG,MAAM,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;IAC5E,MAAM,eAAe,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;AAEzE,IAAA,IAAI,CAAC,gBAAgB,IAAI,CAAC,eAAe,EAAE;AACzC,QAAA,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;KACrB;AAED,IAAA,IAAI,cAA0B,CAAC;IAE/B,IAAI,eAAe,EAAE;;AAEnB,QAAA,cAAc,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAC/C,QAAA,IAAI,cAAc,CAAC,MAAM,KAAK,EAAE,EAAE;YAChC,MAAM,IAAI,KAAK,CACb,CAAA,kDAAA,EAAqD,cAAc,CAAC,MAAM,CAAE,CAAA,CAC7E,CAAC;SACH;KACF;SAAM;;AAEL,QAAA,MAAM,eAAe,GAAG,YAAY,CAAC,gBAAiB,CAAC,CAAC;AACxD,QAAA,IAAI,eAAe,CAAC,MAAM,KAAK,EAAE,EAAE;YACjC,MAAM,IAAI,KAAK,CACb,CAAA,mDAAA,EAAsD,eAAe,CAAC,MAAM,CAAE,CAAA,CAC/E,CAAC;SACH;QACD,cAAc,GAAG,MAAMA,kBAAO,CAAC,iBAAiB,CAAC,eAAe,CAAC,CAAC;KACnE;AAED,IAAA,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK;AACxB,SAAC,eAAe,GAAG,OAAO,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,CAAC;IAE5D,OAAO;AACL,QAAA,IAAI,EAAE;AACJ,YAAA;AACE,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,SAAS;AACd,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,KAAK;AACV,gBAAA,GAAG,EAAE,OAAO;AACZ,gBAAA,CAAC,EAAE,eAAe,CAAC,cAAc,CAAC;AACnC,aAAA;AACF,SAAA;KACF,CAAC;AACJ,CAAC;AAED;;;;AAIG;AACI,eAAe,oBAAoB,CACxC,MAA4B,GAAA,EAAE,EAC9B,OAAA,GAAkB,WAAW,EAC7B,KAAgB,GAAA,MAAM,EACtB,MAAe,EAAA;AAEf,IAAA,IAAI;AACF,QAAA,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAEzE,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,EAAE;AAC7C,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,OAAO,EAAE;AACP,gBAAA,cAAc,EAAE,kBAAkB;AACnC,aAAA;AACF,SAAA,CAAC,CAAC;KACJ;IAAC,OAAO,KAAK,EAAE;AACd,QAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,YAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,sBAAsB;AACvE,SAAA,CAAC,EACF;AACE,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,OAAO,EAAE;AACP,gBAAA,cAAc,EAAE,kBAAkB;AACnC,aAAA;AACF,SAAA,CACF,CAAC;KACH;AACH,CAAC;AAED;;AAEG;AACI,eAAe,iBAAiB,CAAC,SAA4B,EAAE,EAAA;AACpE,IAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,MAAM,CAAC,CAAC;QAExC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE;AACxC,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,OAAO,EAAE;AACP,gBAAA,cAAc,EAAE,kBAAkB;AACnC,aAAA;AACF,SAAA,CAAC,CAAC;KACJ;IAAC,OAAO,KAAK,EAAE;AACd,QAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,YAAA,KAAK,EAAE,KAAK,YAAY,KAAK,GAAG,KAAK,CAAC,OAAO,GAAG,yBAAyB;AAC1E,SAAA,CAAC,EACF;AACE,YAAA,MAAM,EAAE,GAAG;AACX,YAAA,OAAO,EAAE;AACP,gBAAA,cAAc,EAAE,kBAAkB;AACnC,aAAA;AACF,SAAA,CACF,CAAC;KACH;AACH,CAAC;AAED;;AAEG;SACa,mBAAmB,GAAA;AACjC,IAAA,OAAO,IAAI,QAAQ,CACjB,IAAI,CAAC,SAAS,CAAC;AACb,QAAA,MAAM,EAAE,SAAS;AACjB,QAAA,OAAO,EAAE,QAAQ;AAClB,KAAA,CAAC,EACF;AACE,QAAA,MAAM,EAAE,GAAG;AACX,QAAA,OAAO,EAAE;AACP,YAAA,cAAc,EAAE,kBAAkB;AACnC,SAAA;AACF,KAAA,CACF,CAAC;AACJ;;;;;;;;"}

package/dist/ssr/index.d.ts

@@ -0,0 +1,147 @@
+/**
+ * Arete Auth Server - Drop-in Endpoint Handlers
+ *
+ * These are framework-agnostic API route handlers that users can mount however they like.
+ * They handle token minting and JWKS serving directly using Ed25519 signing.
+ *
+ * @example
+ * ```typescript
+ * // app/api/arete/sessions/route.ts (Next.js App Router)
+ * import { handleSessionRequest, handleJwksRequest } from '@usearete/sdk/ssr/handlers';
+ *
+ * export async function POST(request: Request) {
+ *   const user = await getAuthenticatedUser(request);
+ *   if (!user) return new Response('Unauthorized', { status: 401 });
+ *   return handleSessionRequest({}, user.id);
+ * }
+ *
+ * export async function GET() {
+ *   return handleJwksRequest();
+ * }
+ * ```
+ */
+interface AuthHandlerConfig {
+    /**
+     * Ed25519 signing key seed (base64-encoded, 32 bytes).
+     * Set ARETE_SIGNING_KEY env var OR pass here.
+     * Generate with: node -e "console.log(require('crypto').randomBytes(32).toString('base64'))"
+     */
+    signingKey?: string;
+    /**
+     * Optional: Pre-derived public key (base64-encoded, 32 bytes).
+     * If not provided, will be derived from the signing key.
+     */
+    publicKey?: string;
+    /**
+     * Token issuer (defaults to ARETE_ISSUER env var or 'arete')
+     */
+    issuer?: string;
+    /**
+     * Token audience (defaults to ARETE_AUDIENCE env var)
+     */
+    audience?: string;
+    /**
+     * Token TTL in seconds (defaults to 300 = 5 minutes)
+     */
+    ttlSeconds?: number;
+    /**
+     * Key ID for JWKS (defaults to 'key-1')
+     */
+    keyId?: string;
+    /**
+     * Custom limits for tokens
+     */
+    limits?: {
+        max_connections?: number;
+        max_subscriptions?: number;
+        max_snapshot_rows?: number;
+    };
+}
+interface SessionClaims {
+    iss: string;
+    sub: string;
+    aud: string;
+    iat: number;
+    nbf: number;
+    exp: number;
+    jti: string;
+    scope: string;
+    metering_key: string;
+    key_class: 'secret' | 'publishable';
+    limits?: {
+        max_connections?: number;
+        max_subscriptions?: number;
+        max_snapshot_rows?: number;
+        max_messages_per_minute?: number;
+        max_bytes_per_minute?: number;
+    };
+    /**
+     * Origin binding for browser tokens (optional defense-in-depth)
+     */
+    origin?: string;
+}
+interface TokenResponse {
+    token: string;
+    expires_at: number;
+}
+/**
+ * Authenticated session data resolved by framework adapters.
+ * Always derive this from verified server-side auth, never request headers.
+ */
+interface ResolvedSession {
+    subject: string;
+    scope?: string;
+}
+interface JwksKey {
+    kty: 'OKP';
+    crv: 'Ed25519';
+    kid: string;
+    use: 'sig';
+    alg: 'EdDSA';
+    x: string;
+}
+interface JwksResponse {
+    keys: JwksKey[];
+}
+/**
+ * Mint a session token using Ed25519 signing
+ * `subject` must come from verified server-side auth or trusted service code.
+ */
+declare function mintSessionToken(config: AuthHandlerConfig, subject?: string, scope?: string, origin?: string): Promise<TokenResponse>;
+/**
+ * Generate JWKS response from signing key
+ */
+declare function generateJwks(config: AuthHandlerConfig): Promise<JwksResponse>;
+/**
+ * Framework-agnostic request handler for token minting
+ * Returns a Response object that can be used with any framework
+ * The `subject` must be derived from verified server-side auth.
+ */
+declare function handleSessionRequest(config?: AuthHandlerConfig, subject?: string, scope?: string, origin?: string): Promise<Response>;
+/**
+ * Framework-agnostic request handler for JWKS endpoint
+ */
+declare function handleJwksRequest(config?: AuthHandlerConfig): Promise<Response>;
+/**
+ * Framework-agnostic health check handler
+ */
+declare function handleHealthRequest(): Response;
+
+/**
+ * Base64URL encoding/decoding utilities
+ */
+/**
+ * Encode Uint8Array to base64url string (RFC 4648)
+ */
+declare function encode(bytes: Uint8Array): string;
+/**
+ * Decode base64url string to Uint8Array
+ */
+declare function decode(base64url: string): Uint8Array;
+declare const base64url: {
+    encode: typeof encode;
+    decode: typeof decode;
+};
+
+export { base64url, generateJwks, handleHealthRequest, handleJwksRequest, handleSessionRequest, mintSessionToken };
+export type { AuthHandlerConfig, JwksResponse, ResolvedSession, SessionClaims, TokenResponse };