@vantageos/cloud-identity 0.7.0 → 0.9.0

package/dist/authorize-flow.js

@@ -0,0 +1,262 @@
+import { MIN_SECRET_LENGTH, PKCE_METHOD, isWellFormedChallenge, refusal, signBlob, signMac, utf8, toBase64Url, verifyBlob, } from "./authorize-shared.js";
+import { sha256Hex, timingSafeEqual } from "./crypto.js";
+import { verifyClerkSessionToken, } from "./clerk-session.js";
+const STATE_PARAM = "authorize_state";
+const refused = (reason) => ({
+    kind: "refused",
+    refusal: refusal(reason),
+});
+function nowOf(deps) {
+    return (deps.now ?? Date.now)();
+}
+function configOk(cfg) {
+    return (typeof cfg.stateSecret === "string" &&
+        cfg.stateSecret.length >= MIN_SECRET_LENGTH &&
+        cfg.allowedResources.length > 0);
+}
+function validateRequest(params, client, cfg) {
+    if (client.revoked === true)
+        return { ok: false, reason: "unknown-client" };
+    const redirectUri = params.redirect_uri;
+    if (!redirectUri || !client.redirectUris.includes(redirectUri)) {
+        return { ok: false, reason: "redirect-uri-mismatch" };
+    }
+    if (params.response_type !== undefined && params.response_type !== "code") {
+        return { ok: false, reason: "unsupported-response-type" };
+    }
+    const challenge = params.code_challenge;
+    const method = params.code_challenge_method ?? PKCE_METHOD;
+    if (!challenge || method !== PKCE_METHOD || !isWellFormedChallenge(challenge)) {
+        return { ok: false, reason: "pkce-required" };
+    }
+    const resource = params.resource;
+    if (!resource || !cfg.allowedResources.includes(resource)) {
+        return { ok: false, reason: "resource-not-allowed" };
+    }
+    const scope = (params.scope ?? "").trim() || (cfg.defaultScope ?? "openid");
+    if (cfg.supportedScopes) {
+        const supported = cfg.supportedScopes;
+        if (!scope.split(/\s+/).every((s) => supported.includes(s))) {
+            return { ok: false, reason: "scope-not-supported" };
+        }
+    }
+    return {
+        ok: true,
+        req: {
+            clientId: client.clientId,
+            redirectUri,
+            state: params.state ?? null,
+            codeChallenge: challenge,
+            resource,
+            scope,
+        },
+    };
+}
+async function signState(req, cfg, deps) {
+    const payload = {
+        v: 1,
+        cid: req.clientId,
+        ru: req.redirectUri,
+        st: req.state,
+        cc: req.codeChallenge,
+        rs: req.resource,
+        sc: req.scope,
+        exp: nowOf(deps) + (cfg.stateTtlSeconds ?? 600) * 1000,
+    };
+    return signBlob(payload, cfg.stateSecret);
+}
+function signInRedirect(cfg, stateBlob) {
+    const back = new URL(cfg.callbackUrl);
+    back.searchParams.set(STATE_PARAM, stateBlob);
+    const url = new URL(cfg.signInUrl);
+    url.searchParams.set("redirect_url", back.toString());
+    return { kind: "redirect-to-sign-in", url: url.toString() };
+}
+async function lookupClientSafe(deps, clientId) {
+    try {
+        return { ok: true, client: await deps.lookupClient(clientId) };
+    }
+    catch {
+        return { ok: false };
+    }
+}
+async function bindAndIssue(req, stateBlob, session, clientName, choice, cfg, deps) {
+    let memberships;
+    try {
+        memberships = await deps.listMemberships(session.userId);
+    }
+    catch {
+        return refused("membership-lookup-unavailable");
+    }
+    if (memberships.length === 0)
+        return refused("no-organization");
+    let picked;
+    if (choice.orgId !== undefined) {
+        // The chosen id is a CLAIM from the browser: it is honoured only if the
+        // verified user's own membership list contains it.
+        picked = memberships.find((m) => m.organization.id === choice.orgId);
+        if (!picked)
+            return refused("org-not-a-member");
+    }
+    else if (memberships.length === 1) {
+        picked = memberships[0];
+    }
+    const consentRequired = cfg.requireConsent !== false;
+    // The token binds the picker to the verified user, the signed state and the
+    // set of organisations that user belongs to (the set is what was shown).
+    const expectedToken = consentRequired
+        ? await consentTokenFor(cfg.stateSecret, stateBlob, session.userId, memberships.map((m) => m.organization.id))
+        : null;
+    if (consentRequired && picked && choice.approved === true) {
+        // `approved: true` is a CLAIM in a POST body. An attacker client can mint
+        // its own state and replay it with a victim's session; only a token the
+        // server issued to this user for this state proves the picker was shown.
+        const presented = choice.consentToken;
+        const ok = typeof presented === "string" &&
+            expectedToken !== null &&
+            (await timingSafeEqual(utf8(presented), utf8(expectedToken)));
+        if (!ok)
+            return refused("consent-required");
+    }
+    if (!picked || (consentRequired && choice.approved !== true)) {
+        return {
+            kind: "org-picker",
+            model: {
+                state: stateBlob,
+                client: { clientId: req.clientId, clientName },
+                resource: req.resource,
+                scope: req.scope,
+                organizations: memberships.map((m) => ({
+                    id: m.organization.id,
+                    slug: m.organization.slug,
+                    name: m.organization.name,
+                    role: m.role,
+                })),
+                consentRequired,
+                consentToken: expectedToken,
+            },
+        };
+    }
+    const code = (deps.generateCode ?? randomCode)();
+    const record = {
+        codeHash: await sha256Hex(code),
+        clerkUserId: session.userId,
+        orgId: picked.organization.id,
+        orgSlug: picked.organization.slug,
+        orgRole: picked.role,
+        clientId: req.clientId,
+        redirectUri: req.redirectUri,
+        codeChallenge: req.codeChallenge,
+        resource: req.resource,
+        scope: req.scope,
+        expiresAt: nowOf(deps) + (cfg.codeTtlSeconds ?? 60) * 1000,
+    };
+    try {
+        await deps.codeStore.put(record);
+    }
+    catch {
+        return refused("code-store-unavailable");
+    }
+    const back = new URL(req.redirectUri);
+    back.searchParams.set("code", code);
+    if (req.state !== null)
+        back.searchParams.set("state", req.state);
+    return { kind: "redirect-to-client", url: back.toString() };
+}
+/**
+ * `HMAC(stateSecret, "consent-v1\0" + state + "\0" + clerkUserId + "\0" +
+ * sorted organisation ids joined by ",")`. Bound to the exact state blob (so a
+ * token for one request is useless for another), to the verified user (so it
+ * cannot be replayed under another session) and to the organisation set shown
+ * (the chosen org is separately required to be in the live membership list).
+ */
+async function consentTokenFor(secret, state, userId, orgIds) {
+    const set = [...orgIds].sort().join(",");
+    return signMac(`consent-v1\0${state}\0${userId}\0${set}`, secret);
+}
+function randomCode() {
+    return toBase64Url(crypto.getRandomValues(new Uint8Array(32)));
+}
+// ---------------------------------------------------------------------------
+// Public functions
+// ---------------------------------------------------------------------------
+/**
+ * Handles `GET /authorize`. Validates the request against the registered
+ * client, then:
+ *   - no Clerk session (absent, expired or forged) -> `redirect-to-sign-in`,
+ *     carrying a signed, short-lived state blob and issuing NO code;
+ *   - a verified session -> continues exactly as `resumeAuthorize` does.
+ * A Clerk key set that cannot be reached is a refusal (`jwks-unavailable`),
+ * never a redirect and never a grant.
+ */
+export async function startAuthorize(params, sessionToken, cfg, deps) {
+    if (!configOk(cfg))
+        return refused("server-misconfigured");
+    const clientId = params.client_id;
+    if (!clientId)
+        return refused("invalid-request");
+    const found = await lookupClientSafe(deps, clientId);
+    if (!found.ok)
+        return refused("client-lookup-unavailable");
+    if (!found.client)
+        return refused("unknown-client");
+    const v = validateRequest(params, found.client, cfg);
+    if (!v.ok)
+        return refused(v.reason);
+    const stateBlob = await signState(v.req, cfg, deps);
+    if (!sessionToken)
+        return signInRedirect(cfg, stateBlob);
+    const verified = await verifyClerkSessionToken(sessionToken, cfg.session, nowOf(deps));
+    if (!verified.ok) {
+        return verified.refusal.reason === "jwks-unavailable"
+            ? { kind: "refused", refusal: verified.refusal }
+            : signInRedirect(cfg, stateBlob);
+    }
+    return bindAndIssue(v.req, stateBlob, verified.session, found.client.clientName ?? null, {}, cfg, deps);
+}
+/**
+ * Handles the return from Clerk (and the picker's form post). The request is
+ * rebuilt ONLY from the signed state: no query parameter other than the blob
+ * itself is read. A tampered or expired blob is refused; the client is looked
+ * up again so a client revoked mid-flow gets no code.
+ */
+export async function resumeAuthorize(input, cfg, deps) {
+    if (!configOk(cfg))
+        return refused("server-misconfigured");
+    const raw = typeof input.state === "string" ? await verifyBlob(input.state, cfg.stateSecret) : null;
+    const p = raw;
+    if (!p ||
+        p.v !== 1 ||
+        typeof p.cid !== "string" ||
+        typeof p.ru !== "string" ||
+        typeof p.cc !== "string" ||
+        typeof p.rs !== "string" ||
+        typeof p.sc !== "string" ||
+        typeof p.exp !== "number" ||
+        (p.st !== null && typeof p.st !== "string")) {
+        return refused("state-invalid");
+    }
+    if (p.exp <= nowOf(deps))
+        return refused("state-expired");
+    const found = await lookupClientSafe(deps, p.cid);
+    if (!found.ok)
+        return refused("client-lookup-unavailable");
+    if (!found.client)
+        return refused("unknown-client");
+    const v = validateRequest({
+        redirect_uri: p.ru,
+        code_challenge: p.cc,
+        resource: p.rs,
+        scope: p.sc,
+        ...(p.st !== null && p.st !== undefined ? { state: p.st } : {}),
+    }, found.client, cfg);
+    if (!v.ok)
+        return refused(v.reason);
+    if (!input.sessionToken)
+        return refused("session-required");
+    const verified = await verifyClerkSessionToken(input.sessionToken, cfg.session, nowOf(deps));
+    if (!verified.ok)
+        return { kind: "refused", refusal: verified.refusal };
+    return bindAndIssue(v.req, input.state, verified.session, found.client.clientName ?? null, { orgId: input.orgId, approved: input.approved, consentToken: input.consentToken }, cfg, deps);
+}
+//# sourceMappingURL=authorize-flow.js.map

package/dist/authorize-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-flow.js","sourceRoot":"","sources":["../src/authorize-flow.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,iBAAiB,EACjB,WAAW,EACX,qBAAqB,EACrB,OAAO,EACP,QAAQ,EACR,OAAO,EACP,IAAI,EACJ,WAAW,EACX,UAAU,GACX,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAGL,uBAAuB,GACxB,MAAM,oBAAoB,CAAC;AA+K5B,MAAM,WAAW,GAAG,iBAAiB,CAAC;AAEtC,MAAM,OAAO,GAAG,CAAC,MAAqC,EAAoB,EAAE,CAAC,CAAC;IAC5E,IAAI,EAAE,SAAS;IACf,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC;CACzB,CAAC,CAAC;AAEH,SAAS,KAAK,CAAC,IAAmB;IAChC,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAC,GAAoB;IACpC,OAAO,CACL,OAAO,GAAG,CAAC,WAAW,KAAK,QAAQ;QACnC,GAAG,CAAC,WAAW,CAAC,MAAM,IAAI,iBAAiB;QAC3C,GAAG,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC,CAChC,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,MAAoD,EACpD,MAAuB,EACvB,GAAoB;IAEpB,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC5E,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC;IACxC,IAAI,CAAC,WAAW,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IACxD,CAAC;IACD,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,EAAE,CAAC;IAC5D,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,qBAAqB,IAAI,WAAW,CAAC;IAC3D,IAAI,CAAC,SAAS,IAAI,MAAM,KAAK,WAAW,IAAI,CAAC,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IACvD,CAAC;IACD,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,QAAQ,CAAC,CAAC;IAC5E,IAAI,GAAG,CAAC,eAAe,EAAE,CAAC;QACxB,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,CAAC;QACtC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IACD,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE;YACH,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,WAAW;YACX,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,IAAI;YAC3B,aAAa,EAAE,SAAS;YACxB,QAAQ;YACR,KAAK;SACN;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,GAAqB,EACrB,GAAoB,EACpB,IAAmB;IAEnB,MAAM,OAAO,GAAiB;QAC5B,CAAC,EAAE,CAAC;QACJ,GAAG,EAAE,GAAG,CAAC,QAAQ;QACjB,EAAE,EAAE,GAAG,CAAC,WAAW;QACnB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,EAAE,EAAE,GAAG,CAAC,aAAa;QACrB,EAAE,EAAE,GAAG,CAAC,QAAQ;QAChB,EAAE,EAAE,GAAG,CAAC,KAAK;QACb,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,GAAG,CAAC,GAAG,IAAI;KACvD,CAAC;IACF,OAAO,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CAAC,GAAoB,EAAE,SAAiB;IAC7D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACnC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,qBAAqB,EAAE,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,IAAmB,EACnB,QAAgB;IAEhB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,EAAE,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,GAAqB,EACrB,SAAiB,EACjB,OAA6B,EAC7B,UAAyB,EACzB,MAAqE,EACrE,GAAoB,EACpB,IAAmB;IAEnB,IAAI,WAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,WAAW,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IAEhE,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;QAC/B,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC;QACrE,IAAI,CAAC,MAAM;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAClD,CAAC;SAAM,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpC,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IAED,MAAM,eAAe,GAAG,GAAG,CAAC,cAAc,KAAK,KAAK,CAAC;IACrD,4EAA4E;IAC5E,yEAAyE;IACzE,MAAM,aAAa,GAAG,eAAe;QACnC,CAAC,CAAC,MAAM,eAAe,CACnB,GAAG,CAAC,WAAW,EACf,SAAS,EACT,OAAO,CAAC,MAAM,EACd,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,CAC1C;QACH,CAAC,CAAC,IAAI,CAAC;IACT,IAAI,eAAe,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC1D,0EAA0E;QAC1E,wEAAwE;QACxE,yEAAyE;QACzE,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC;QACtC,MAAM,EAAE,GACN,OAAO,SAAS,KAAK,QAAQ;YAC7B,aAAa,KAAK,IAAI;YACtB,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,EAAE;YAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7D,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE;gBACL,KAAK,EAAE,SAAS;gBAChB,MAAM,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,UAAU,EAAE;gBAC9C,QAAQ,EAAE,GAAG,CAAC,QAAQ;gBACtB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,aAAa,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;oBACrC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,EAAE;oBACrB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,YAAY,CAAC,IAAI;oBACzB,IAAI,EAAE,CAAC,CAAC,IAAI;iBACb,CAAC,CAAC;gBACH,eAAe;gBACf,YAAY,EAAE,aAAa;aAC5B;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,CAAC;IACjD,MAAM,MAAM,GAA4B;QACtC,QAAQ,EAAE,MAAM,SAAS,CAAC,IAAI,CAAC;QAC/B,WAAW,EAAE,OAAO,CAAC,MAAM;QAC3B,KAAK,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE;QAC7B,OAAO,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI;QACjC,OAAO,EAAE,MAAM,CAAC,IAAI;QACpB,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,aAAa,EAAE,GAAG,CAAC,aAAa;QAChC,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC,GAAG,IAAI;KAC3D,CAAC;IACF,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IACpC,IAAI,GAAG,CAAC,KAAK,KAAK,IAAI;QAAE,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC;IAClE,OAAO,EAAE,IAAI,EAAE,oBAAoB,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,eAAe,CAC5B,MAAc,EACd,KAAa,EACb,MAAc,EACd,MAAyB;IAEzB,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,OAAO,OAAO,CAAC,eAAe,KAAK,KAAK,MAAM,KAAK,GAAG,EAAE,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,WAAW,CAAC,MAAM,CAAC,eAAe,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAoD,EACpD,YAAgC,EAChC,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,CAAC,QAAQ;QAAE,OAAO,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACrD,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACpD,IAAI,CAAC,YAAY;QAAE,OAAO,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACzD,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,YAAY,EACZ,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,KAAK,kBAAkB;YACnD,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;YAChD,CAAC,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,YAAY,CAAC,CAAC,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;AAC1G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAkB,EAClB,GAAoB,EACpB,IAAmB;IAEnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IAC3D,MAAM,GAAG,GACP,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC1F,MAAM,CAAC,GAAG,GAAmC,CAAC;IAC9C,IACE,CAAC,CAAC;QACF,CAAC,CAAC,CAAC,KAAK,CAAC;QACT,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ;QACxB,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ;QACzB,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,EAC3C,CAAC;QACD,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,KAAK,CAAC,IAAI,CAAC;QAAE,OAAO,OAAO,CAAC,eAAe,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC3D,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,OAAO,OAAO,CAAC,gBAAgB,CAAC,CAAC;IACpD,MAAM,CAAC,GAAG,eAAe,CACvB;QACE,YAAY,EAAE,CAAC,CAAC,EAAE;QAClB,cAAc,EAAE,CAAC,CAAC,EAAE;QACpB,QAAQ,EAAE,CAAC,CAAC,EAAE;QACd,KAAK,EAAE,CAAC,CAAC,EAAE;QACX,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,IAAI,IAAI,CAAC,CAAC,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAChE,EACD,KAAK,CAAC,MAAM,EACZ,GAAG,CACJ,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IAEpC,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC5D,MAAM,QAAQ,GAAG,MAAM,uBAAuB,CAC5C,KAAK,CAAC,YAAY,EAClB,GAAG,CAAC,OAAO,EACX,KAAK,CAAC,IAAI,CAAC,CACZ,CAAC;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IAExE,OAAO,YAAY,CACjB,CAAC,CAAC,GAAG,EACL,KAAK,CAAC,KAAK,EACX,QAAQ,CAAC,OAAO,EAChB,KAAK,CAAC,MAAM,CAAC,UAAU,IAAI,IAAI,EAC/B,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,EAClF,GAAG,EACH,IAAI,CACL,CAAC;AACJ,CAAC"}

package/dist/authorize-shared.d.ts

@@ -0,0 +1,44 @@
+/**
+ * Shared vocabulary of the person-authorization flow: the typed refusal, the
+ * base64url and PKCE helpers, and the signed state blob. Internal to the
+ * package except for the names `index.ts` re-exports.
+ */
+/**
+ * Why the flow refused. Every refusal of the authorize flow, the token
+ * exchange, the session verifier and the OIDC helpers carries one of these.
+ */
+export type AuthorizeRefusalReason = "invalid-request" | "unknown-client" | "redirect-uri-mismatch" | "unsupported-response-type" | "pkce-required" | "resource-not-allowed" | "scope-not-supported" | "state-invalid" | "state-expired" | "session-required" | "session-invalid" | "jwks-unavailable" | "no-organization" | "org-not-a-member" | "consent-required" | "client-lookup-unavailable" | "membership-lookup-unavailable" | "code-store-unavailable" | "server-misconfigured" | "code-unknown" | "code-reused" | "code-expired" | "client-mismatch" | "redirect-uri-changed" | "resource-mismatch" | "verifier-malformed" | "pkce-mismatch" | "subject-mismatch" | "openid-scope-required" | "issuer-invalid";
+/**
+ * The typed refusal: a non-empty object carrying its own code, in the same
+ * `{ code, reason }` shape as `RoleRefusal` and `TenantAbsence`.
+ */
+export type AuthorizeRefusal = {
+    code: "AUTHORIZE_REFUSED";
+    reason: AuthorizeRefusalReason;
+};
+export declare function refusal(reason: AuthorizeRefusalReason): AuthorizeRefusal;
+/**
+ * Maps a refusal to the OAuth error code and HTTP status a token or
+ * authorize endpoint answers with (RFC 6749 section 5.2, RFC 8707).
+ */
+export declare function oauthErrorFor(r: AuthorizeRefusal): {
+    error: string;
+    status: number;
+};
+export declare function toBase64Url(bytes: Uint8Array): string;
+export declare function fromBase64Url(input: string): Uint8Array | null;
+export declare function utf8(input: string): Uint8Array;
+/** The PKCE method name, assembled as one constant. */
+export declare const PKCE_METHOD: string;
+export declare function isWellFormedChallenge(challenge: string): boolean;
+export declare function isWellFormedVerifier(verifier: string): boolean;
+/** `base64url(SHA-256(verifier))` — the challenge a client derives from its verifier. */
+export declare function pkceChallengeFromVerifier(verifier: string): Promise<string>;
+export declare const MIN_SECRET_LENGTH = 32;
+/** `base64url(json).base64url(hmac)`. */
+export declare function signBlob(payload: unknown, secret: string): Promise<string>;
+/** `base64url(HMAC-SHA-256(secret, message))`. */
+export declare function signMac(message: string, secret: string): Promise<string>;
+/** Returns the parsed payload when the MAC verifies (constant time), else `null`. */
+export declare function verifyBlob(blob: string, secret: string): Promise<unknown | null>;
+//# sourceMappingURL=authorize-shared.d.ts.map

package/dist/authorize-shared.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-shared.d.ts","sourceRoot":"","sources":["../src/authorize-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH;;;GAGG;AACH,MAAM,MAAM,sBAAsB,GAE9B,iBAAiB,GACjB,gBAAgB,GAChB,uBAAuB,GACvB,2BAA2B,GAC3B,eAAe,GACf,sBAAsB,GACtB,qBAAqB,GAErB,eAAe,GACf,eAAe,GAEf,kBAAkB,GAClB,iBAAiB,GACjB,kBAAkB,GAElB,iBAAiB,GACjB,kBAAkB,GAClB,kBAAkB,GAElB,2BAA2B,GAC3B,+BAA+B,GAC/B,wBAAwB,GACxB,sBAAsB,GAEtB,cAAc,GACd,aAAa,GACb,cAAc,GACd,iBAAiB,GACjB,sBAAsB,GACtB,mBAAmB,GACnB,oBAAoB,GACpB,eAAe,GAEf,kBAAkB,GAClB,uBAAuB,GACvB,gBAAgB,CAAC;AAErB;;;GAGG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,mBAAmB,CAAC;IAC1B,MAAM,EAAE,sBAAsB,CAAC;CAChC,CAAC;AAEF,wBAAgB,OAAO,CAAC,MAAM,EAAE,sBAAsB,GAAG,gBAAgB,CAExE;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,gBAAgB,GAAG;IAClD,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CAChB,CAsCA;AAMD,wBAAgB,WAAW,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAIrD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,GAAG,IAAI,CAS9D;AAED,wBAAgB,IAAI,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAE9C;AAMD,uDAAuD;AACvD,eAAO,MAAM,WAAW,EAAE,MAA8B,CAAC;AAKzD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAEhE;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE9D;AAED,yFAAyF;AACzF,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,CAAC,CAMjB;AAMD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAYpC,yCAAyC;AACzC,wBAAsB,QAAQ,CAC5B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,MAAM,CAAC,CAQjB;AAED,kDAAkD;AAClD,wBAAsB,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAO9E;AAED,qFAAqF;AACrF,wBAAsB,UAAU,CAC9B,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAoBzB"}

package/dist/authorize-shared.js

@@ -0,0 +1,134 @@
+/**
+ * Shared vocabulary of the person-authorization flow: the typed refusal, the
+ * base64url and PKCE helpers, and the signed state blob. Internal to the
+ * package except for the names `index.ts` re-exports.
+ */
+export function refusal(reason) {
+    return { code: "AUTHORIZE_REFUSED", reason };
+}
+/**
+ * Maps a refusal to the OAuth error code and HTTP status a token or
+ * authorize endpoint answers with (RFC 6749 section 5.2, RFC 8707).
+ */
+export function oauthErrorFor(r) {
+    switch (r.reason) {
+        case "unknown-client":
+        case "client-mismatch":
+            return { error: "invalid_client", status: 400 };
+        case "unsupported-response-type":
+            return { error: "unsupported_response_type", status: 400 };
+        case "scope-not-supported":
+            return { error: "invalid_scope", status: 400 };
+        case "resource-not-allowed":
+        case "resource-mismatch":
+            return { error: "invalid_target", status: 400 };
+        case "code-unknown":
+        case "code-reused":
+        case "code-expired":
+        case "redirect-uri-changed":
+        case "verifier-malformed":
+        case "pkce-mismatch":
+            return { error: "invalid_grant", status: 400 };
+        case "session-required":
+        case "session-invalid":
+        case "no-organization":
+        case "org-not-a-member":
+        case "consent-required":
+        case "subject-mismatch":
+        case "openid-scope-required":
+            return { error: "access_denied", status: 403 };
+        case "jwks-unavailable":
+        case "client-lookup-unavailable":
+        case "membership-lookup-unavailable":
+        case "code-store-unavailable":
+            return { error: "temporarily_unavailable", status: 503 };
+        case "server-misconfigured":
+        case "issuer-invalid":
+            return { error: "server_error", status: 500 };
+        default:
+            return { error: "invalid_request", status: 400 };
+    }
+}
+// ---------------------------------------------------------------------------
+// base64url
+// ---------------------------------------------------------------------------
+export function toBase64Url(bytes) {
+    let bin = "";
+    for (const b of bytes)
+        bin += String.fromCharCode(b);
+    return btoa(bin).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+export function fromBase64Url(input) {
+    if (!/^[A-Za-z0-9_-]*$/.test(input))
+        return null;
+    const padded = input.replace(/-/g, "+").replace(/_/g, "/");
+    try {
+        const bin = atob(padded + "=".repeat((4 - (padded.length % 4)) % 4));
+        return Uint8Array.from(bin, (c) => c.charCodeAt(0));
+    }
+    catch {
+        return null;
+    }
+}
+export function utf8(input) {
+    return new TextEncoder().encode(input);
+}
+// ---------------------------------------------------------------------------
+// PKCE (RFC 7636)
+// ---------------------------------------------------------------------------
+/** The PKCE method name, assembled as one constant. */
+export const PKCE_METHOD = ["S", "256"].join("");
+const VERIFIER_RE = /^[A-Za-z0-9\-._~]{43,128}$/;
+const CHALLENGE_RE = /^[A-Za-z0-9_-]{43}$/;
+export function isWellFormedChallenge(challenge) {
+    return CHALLENGE_RE.test(challenge);
+}
+export function isWellFormedVerifier(verifier) {
+    return VERIFIER_RE.test(verifier);
+}
+/** `base64url(SHA-256(verifier))` — the challenge a client derives from its verifier. */
+export async function pkceChallengeFromVerifier(verifier) {
+    const digest = await crypto.subtle.digest("SHA-256", utf8(verifier));
+    return toBase64Url(new Uint8Array(digest));
+}
+// ---------------------------------------------------------------------------
+// Signed state blob
+// ---------------------------------------------------------------------------
+export const MIN_SECRET_LENGTH = 32;
+async function hmacKey(secret, usage) {
+    return crypto.subtle.importKey("raw", utf8(secret), { name: "HMAC", hash: "SHA-256" }, false, [usage]);
+}
+/** `base64url(json).base64url(hmac)`. */
+export async function signBlob(payload, secret) {
+    const body = toBase64Url(utf8(JSON.stringify(payload)));
+    const mac = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), utf8(body));
+    return `${body}.${toBase64Url(new Uint8Array(mac))}`;
+}
+/** `base64url(HMAC-SHA-256(secret, message))`. */
+export async function signMac(message, secret) {
+    const mac = await crypto.subtle.sign("HMAC", await hmacKey(secret, "sign"), utf8(message));
+    return toBase64Url(new Uint8Array(mac));
+}
+/** Returns the parsed payload when the MAC verifies (constant time), else `null`. */
+export async function verifyBlob(blob, secret) {
+    const parts = blob.split(".");
+    if (parts.length !== 2)
+        return null;
+    const [body, mac] = parts;
+    const macBytes = fromBase64Url(mac);
+    if (!macBytes)
+        return null;
+    const ok = await crypto.subtle.verify("HMAC", await hmacKey(secret, "verify"), macBytes, utf8(body));
+    if (!ok)
+        return null;
+    const bodyBytes = fromBase64Url(body);
+    if (!bodyBytes)
+        return null;
+    try {
+        return JSON.parse(new TextDecoder().decode(bodyBytes));
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=authorize-shared.js.map

package/dist/authorize-shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authorize-shared.js","sourceRoot":"","sources":["../src/authorize-shared.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAsDH,MAAM,UAAU,OAAO,CAAC,MAA8B;IACpD,OAAO,EAAE,IAAI,EAAE,mBAAmB,EAAE,MAAM,EAAE,CAAC;AAC/C,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,CAAmB;IAI/C,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;QACjB,KAAK,gBAAgB,CAAC;QACtB,KAAK,iBAAiB;YACpB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAClD,KAAK,2BAA2B;YAC9B,OAAO,EAAE,KAAK,EAAE,2BAA2B,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC7D,KAAK,qBAAqB;YACxB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjD,KAAK,sBAAsB,CAAC;QAC5B,KAAK,mBAAmB;YACtB,OAAO,EAAE,KAAK,EAAE,gBAAgB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAClD,KAAK,cAAc,CAAC;QACpB,KAAK,aAAa,CAAC;QACnB,KAAK,cAAc,CAAC;QACpB,KAAK,sBAAsB,CAAC;QAC5B,KAAK,oBAAoB,CAAC;QAC1B,KAAK,eAAe;YAClB,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjD,KAAK,kBAAkB,CAAC;QACxB,KAAK,iBAAiB,CAAC;QACvB,KAAK,iBAAiB,CAAC;QACvB,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,kBAAkB,CAAC;QACxB,KAAK,uBAAuB;YAC1B,OAAO,EAAE,KAAK,EAAE,eAAe,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QACjD,KAAK,kBAAkB,CAAC;QACxB,KAAK,2BAA2B,CAAC;QACjC,KAAK,+BAA+B,CAAC;QACrC,KAAK,wBAAwB;YAC3B,OAAO,EAAE,KAAK,EAAE,yBAAyB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAC3D,KAAK,sBAAsB,CAAC;QAC5B,KAAK,gBAAgB;YACnB,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;QAChD;YACE,OAAO,EAAE,KAAK,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC;IACrD,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E,MAAM,UAAU,WAAW,CAAC,KAAiB;IAC3C,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IACzC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrE,OAAO,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,UAAU,IAAI,CAAC,KAAa;IAChC,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,8EAA8E;AAC9E,kBAAkB;AAClB,8EAA8E;AAE9E,uDAAuD;AACvD,MAAM,CAAC,MAAM,WAAW,GAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEzD,MAAM,WAAW,GAAG,4BAA4B,CAAC;AACjD,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C,MAAM,UAAU,qBAAqB,CAAC,SAAiB;IACrD,OAAO,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,OAAO,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,yFAAyF;AACzF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,QAAgB;IAEhB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACvC,SAAS,EACT,IAAI,CAAC,QAAQ,CAA4B,CAC1C,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7C,CAAC;AAED,8EAA8E;AAC9E,oBAAoB;AACpB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,KAAK,UAAU,OAAO,CAAC,MAAc,EAAE,KAAwB;IAC7D,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAC5B,KAAK,EACL,IAAI,CAAC,MAAM,CAA4B,EACvC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,KAAK,CAAC,CACR,CAAC;AACJ,CAAC;AAED,yCAAyC;AACzC,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,OAAgB,EAChB,MAAc;IAEd,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,IAAI,CAAC,IAAI,CAA4B,CACtC,CAAC;IACF,OAAO,GAAG,IAAI,IAAI,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;AACvD,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,OAAe,EAAE,MAAc;IAC3D,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,CAClC,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,EAC7B,IAAI,CAAC,OAAO,CAA4B,CACzC,CAAC;IACF,OAAO,WAAW,CAAC,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AAC1C,CAAC;AAED,qFAAqF;AACrF,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,IAAY,EACZ,MAAc;IAEd,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,KAAyB,CAAC;IAC9C,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CACnC,MAAM,EACN,MAAM,OAAO,CAAC,MAAM,EAAE,QAAQ,CAAC,EAC/B,QAAmC,EACnC,IAAI,CAAC,IAAI,CAA4B,CACtC,CAAC;IACF,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACrB,MAAM,SAAS,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/clerk-session.d.ts

@@ -0,0 +1,52 @@
+import { type AuthorizeRefusal } from "./authorize-shared.js";
+/**
+ * Verification of a Clerk session token (a signed RS256 JWT) against the
+ * instance's JWKS. The consumer supplies the issuer, the key set and, where it
+ * wants them, the audience and authorized parties; this module holds every
+ * decision and performs no network call of its own.
+ *
+ * @security Only RS256 is accepted. `alg: none`, HMAC algorithms and any key
+ * type other than RSA are refused before a signature is looked at.
+ */
+export interface ClerkJwk {
+    kty: string;
+    kid?: string;
+    n?: string;
+    e?: string;
+    alg?: string;
+    use?: string;
+}
+export interface ClerkJwks {
+    keys: readonly ClerkJwk[];
+}
+export interface ClerkSessionVerifierConfig {
+    /** Exact `iss` the token must carry (the Clerk frontend API URL). */
+    issuer: string;
+    /** The key set, or a function returning it (the consumer owns fetching and caching). */
+    jwks: ClerkJwks | (() => Promise<ClerkJwks>);
+    /** When set, the token's `aud` must contain one of these. */
+    audience?: string | readonly string[];
+    /** When set, the token's `azp` must be present and listed. */
+    authorizedParties?: readonly string[];
+    /** Clock tolerance in seconds for `exp` / `nbf`. Default 5. */
+    clockToleranceSeconds?: number;
+}
+export interface VerifiedClerkSession {
+    userId: string;
+    sessionId: string | null;
+    claims: Readonly<Record<string, unknown>>;
+}
+export type VerifyClerkSessionResult = {
+    ok: true;
+    session: VerifiedClerkSession;
+} | {
+    ok: false;
+    refusal: AuthorizeRefusal;
+};
+/**
+ * Verifies a Clerk session token. `nowMs` is injectable for tests.
+ * An unreachable key set is `jwks-unavailable` (retryable, 503), never a
+ * bad-credential answer; every other failure is `session-invalid`.
+ */
+export declare function verifyClerkSessionToken(token: string, config: ClerkSessionVerifierConfig, nowMs?: number): Promise<VerifyClerkSessionResult>;
+//# sourceMappingURL=clerk-session.d.ts.map

package/dist/clerk-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk-session.d.ts","sourceRoot":"","sources":["../src/clerk-session.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gBAAgB,EAItB,MAAM,uBAAuB,CAAC;AAE/B;;;;;;;;GAQG;AAEH,MAAM,WAAW,QAAQ;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,CAAC,CAAC,EAAE,MAAM,CAAC;IACX,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,SAAS,QAAQ,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,0BAA0B;IACzC,qEAAqE;IACrE,MAAM,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,IAAI,EAAE,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7C,6DAA6D;IAC7D,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,MAAM,EAAE,CAAC;IACtC,8DAA8D;IAC9D,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,+DAA+D;IAC/D,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,wBAAwB,GAChC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GAC3C;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,gBAAgB,CAAA;CAAE,CAAC;AAc7C;;;;GAIG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,0BAA0B,EAClC,KAAK,GAAE,MAAmB,GACzB,OAAO,CAAC,wBAAwB,CAAC,CA+EnC"}

package/dist/clerk-session.js

@@ -0,0 +1,93 @@
+import { fromBase64Url, refusal, utf8, } from "./authorize-shared.js";
+function parseJson(bytes) {
+    if (!bytes)
+        return null;
+    try {
+        const v = JSON.parse(new TextDecoder().decode(bytes));
+        return typeof v === "object" && v !== null && !Array.isArray(v)
+            ? v
+            : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Verifies a Clerk session token. `nowMs` is injectable for tests.
+ * An unreachable key set is `jwks-unavailable` (retryable, 503), never a
+ * bad-credential answer; every other failure is `session-invalid`.
+ */
+export async function verifyClerkSessionToken(token, config, nowMs = Date.now()) {
+    const bad = () => ({
+        ok: false,
+        refusal: refusal("session-invalid"),
+    });
+    const parts = token.split(".");
+    if (parts.length !== 3)
+        return bad();
+    const [h, p, s] = parts;
+    const header = parseJson(fromBase64Url(h));
+    const claims = parseJson(fromBase64Url(p));
+    const sig = fromBase64Url(s);
+    if (!header || !claims || !sig || sig.length === 0)
+        return bad();
+    if (header.alg !== "RS256")
+        return bad();
+    if (typeof header.kid !== "string" || header.kid.length === 0)
+        return bad();
+    let jwks;
+    try {
+        jwks = typeof config.jwks === "function" ? await config.jwks() : config.jwks;
+    }
+    catch {
+        return { ok: false, refusal: refusal("jwks-unavailable") };
+    }
+    const jwk = jwks.keys.find((k) => k.kid === header.kid && k.kty === "RSA");
+    if (!jwk)
+        return bad();
+    let valid = false;
+    try {
+        const key = await crypto.subtle.importKey("jwk", { kty: "RSA", n: jwk.n, e: jwk.e, alg: "RS256", ext: true }, { name: "RSASSA-PKCS1-v1_5", hash: "SHA-256" }, false, ["verify"]);
+        valid = await crypto.subtle.verify("RSASSA-PKCS1-v1_5", key, sig, utf8(`${h}.${p}`));
+    }
+    catch {
+        return bad();
+    }
+    if (!valid)
+        return bad();
+    const tol = config.clockToleranceSeconds ?? 5;
+    const nowSec = Math.floor(nowMs / 1000);
+    if (claims.iss !== config.issuer)
+        return bad();
+    if (typeof claims.exp !== "number" || claims.exp + tol < nowSec)
+        return bad();
+    if (claims.nbf !== undefined) {
+        if (typeof claims.nbf !== "number" || claims.nbf - tol > nowSec)
+            return bad();
+    }
+    if (typeof claims.sub !== "string" || claims.sub.length === 0)
+        return bad();
+    if (config.audience !== undefined) {
+        const wanted = typeof config.audience === "string" ? [config.audience] : config.audience;
+        const got = Array.isArray(claims.aud)
+            ? claims.aud
+            : [claims.aud];
+        if (!got.some((a) => typeof a === "string" && wanted.includes(a)))
+            return bad();
+    }
+    if (config.authorizedParties !== undefined) {
+        if (typeof claims.azp !== "string" ||
+            !config.authorizedParties.includes(claims.azp)) {
+            return bad();
+        }
+    }
+    return {
+        ok: true,
+        session: {
+            userId: claims.sub,
+            sessionId: typeof claims.sid === "string" ? claims.sid : null,
+            claims,
+        },
+    };
+}
+//# sourceMappingURL=clerk-session.js.map

package/dist/clerk-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"clerk-session.js","sourceRoot":"","sources":["../src/clerk-session.ts"],"names":[],"mappings":"AAAA,OAAO,EAEL,aAAa,EACb,OAAO,EACP,IAAI,GACL,MAAM,uBAAuB,CAAC;AAgD/B,SAAS,SAAS,CAAC,KAAwB;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/D,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;YAC7D,CAAC,CAAE,CAA6B;YAChC,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAa,EACb,MAAkC,EAClC,QAAgB,IAAI,CAAC,GAAG,EAAE;IAE1B,MAAM,GAAG,GAAG,GAA6B,EAAE,CAAC,CAAC;QAC3C,EAAE,EAAE,KAAK;QACT,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IACrC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAiC,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IACjE,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,GAAG,EAAE,CAAC;IACzC,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IAE5E,IAAI,IAAe,CAAC;IACpB,IAAI,CAAC;QACH,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,kBAAkB,CAAC,EAAE,CAAC;IAC7D,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;IAC3E,IAAI,CAAC,GAAG;QAAE,OAAO,GAAG,EAAE,CAAC;IAEvB,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EAC3D,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAChC,mBAAmB,EACnB,GAAG,EACH,GAA8B,EAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAA4B,CAC7C,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,EAAE,CAAC;IACf,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,EAAE,CAAC;IAEzB,MAAM,GAAG,GAAG,MAAM,CAAC,qBAAqB,IAAI,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,CAAC,MAAM;QAAE,OAAO,GAAG,EAAE,CAAC;IAC/C,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM;QAAE,OAAO,GAAG,EAAE,CAAC;IAC9E,IAAI,MAAM,CAAC,GAAG,KAAK,SAAS,EAAE,CAAC;QAC7B,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,MAAM;YAAE,OAAO,GAAG,EAAE,CAAC;IAChF,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,EAAE,CAAC;IAE5E,IAAI,MAAM,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,MAAM,GACV,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC;YACnC,CAAC,CAAE,MAAM,CAAC,GAAiB;YAC3B,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,GAAG,EAAE,CAAC;IAClF,CAAC;IACD,IAAI,MAAM,CAAC,iBAAiB,KAAK,SAAS,EAAE,CAAC;QAC3C,IACE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAC9C,CAAC;YACD,OAAO,GAAG,EAAE,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,OAAO,EAAE;YACP,MAAM,EAAE,MAAM,CAAC,GAAG;YAClB,SAAS,EAAE,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI;YAC7D,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/human-path.d.ts

@@ -20,10 +20,10 @@
  */
 import { z } from "zod";
 export declare const humanAccountRoleSchema: z.ZodEnum<{
+    client: "client";
     owner: "owner";
     admin: "admin";
     member: "member";
-    client: "client";
 }>;
 export type HumanAccountRole = z.infer<typeof humanAccountRoleSchema>;
 /**