@vibesdotdev/auth 0.0.0-stage → 1.0.0-rc.3

package/dist/keys/recipient-key-bundle.js

@@ -0,0 +1,143 @@
+import { calculateJwkThumbprint, CompactSign } from 'jose';
+import { JsonValueSchema } from '@vibesdotdev/kernel/schemas/json';
+import { z } from 'zod/v4';
+import { didKeyVerificationMethodId, ed25519DidKeySchema } from "./did-key.js";
+import { KEY_ENVELOPE_VERSIONS } from "./envelope-versions.js";
+import { attempt } from "./attempt.js";
+import { KeyEnvelopeError, stepFailure } from "./errors.js";
+import { readVersion, verifyEd25519CompactJws } from "./jws.js";
+/**
+ * Recipient key bundle v1: a device's self-signed statement "my X25519
+ * agreement key is cnf.jwk, and I accept these envelope versions". A compact
+ * JWS signed by the device's Ed25519 did:key; the verifier derives the key
+ * from the header kid and never from anything the payload says.
+ */
+export const RECIPIENT_KEY_BUNDLE_TYP = 'vibes-agreement-key+jwt';
+export const RECIPIENT_KEY_BUNDLE_VERSION = 1;
+const RECIPIENT_KEY_BUNDLE_VERSIONS = [RECIPIENT_KEY_BUNDLE_VERSION];
+const DEFAULT_CLOCK_TOLERANCE_SECONDS = 30;
+/**
+ * A bundle arrives from untrusted storage or peers and is parsed before its
+ * signature is checked, so its length is bounded first. A v1 bundle is 669
+ * characters; 4096 leaves room for longer envelopeVersions lists.
+ */
+const MAX_RECIPIENT_KEY_BUNDLE_LENGTH = 4096;
+export const x25519PublicJwkSchema = z
+    .object({
+    kty: z.literal('OKP'),
+    crv: z.literal('X25519'),
+    x: z.string().regex(/^[A-Za-z0-9_-]{43}$/)
+})
+    .strict();
+export const recipientKeyBundleClaimsV1Schema = z
+    .object({
+    v: z.literal(1),
+    iss: ed25519DidKeySchema,
+    kid: z.string(),
+    cnf: z.object({ jwk: x25519PublicJwkSchema }).strict(),
+    envelopeVersions: z.array(z.number().int().positive()).nonempty(),
+    iat: z.number().int().nonnegative(),
+    exp: z.number().int().positive()
+})
+    .strict();
+/** Reads only what the key-type check needs: an object-valued `cnf.jwk` (the strict claims schema reads everything else). */
+const agreementKeyProbeSchema = z.object({
+    cnf: z.object({ jwk: z.union([z.record(z.string(), JsonValueSchema), z.array(JsonValueSchema)]) })
+});
+const ttlSecondsSchema = z.number().int().positive();
+const toleranceSecondsSchema = z.number().int().nonnegative();
+export function epochSeconds(now) {
+    const milliseconds = (now ?? Date.now)();
+    if (!Number.isFinite(milliseconds))
+        throw new KeyEnvelopeError('malformed', 'now() is not a finite epoch time');
+    return Math.floor(milliseconds / 1000);
+}
+/** Sign a v1 recipient key bundle advertising KEY_ENVELOPE_VERSIONS. */
+export async function createRecipientKeyBundle(device, options) {
+    if (!ttlSecondsSchema.safeParse(options.ttlSeconds).success) {
+        throw new KeyEnvelopeError('malformed', 'ttlSeconds must be a positive integer');
+    }
+    const publicJwk = x25519PublicJwkSchema.safeParse(device.agreement.publicJwk);
+    if (!publicJwk.success)
+        throw new KeyEnvelopeError('malformed', 'agreement.publicJwk is not an X25519 public JWK');
+    if (device.agreement.kid !== (await calculateJwkThumbprint(publicJwk.data))) {
+        throw new KeyEnvelopeError('malformed', 'agreement.kid is not the RFC 7638 thumbprint of publicJwk');
+    }
+    const iat = epochSeconds(options.now);
+    const claims = {
+        v: RECIPIENT_KEY_BUNDLE_VERSION,
+        iss: device.did,
+        kid: device.agreement.kid,
+        cnf: { jwk: publicJwk.data },
+        envelopeVersions: [...KEY_ENVELOPE_VERSIONS],
+        iat,
+        exp: iat + options.ttlSeconds
+    };
+    const signed = await attempt(() => new CompactSign(new TextEncoder().encode(JSON.stringify(claims)))
+        .setProtectedHeader({
+        alg: 'EdDSA',
+        typ: RECIPIENT_KEY_BUNDLE_TYP,
+        kid: didKeyVerificationMethodId(device.did)
+    })
+        .sign(device.signingKey));
+    if (!signed.ok)
+        throw stepFailure(signed.failure, 'unsupported_key_type', 'sign the recipient key bundle');
+    return signed.value;
+}
+/**
+ * Verify a recipient key bundle. Pinned order: length over 4096 characters
+ * (too_large), shape and header (malformed), typ (wrong_type), alg
+ * (unsupported_algorithm), kid (malformed_did /
+ * unsupported_key_type / malformed), strict signature bytes and verify with
+ * kid's key (bad_signature), payload JSON (malformed), v (unsupported_version),
+ * cnf.jwk kty/crv (unsupported_key_type), strict claims (malformed), iss equals
+ * kid's did (sender_mismatch), kid equals thumbprint(cnf.jwk) (malformed), iat
+ * (not_yet_valid), exp (expired).
+ */
+export async function verifyRecipientKeyBundle(bundle, options = {}) {
+    const tolerance = options.clockToleranceSeconds ?? DEFAULT_CLOCK_TOLERANCE_SECONDS;
+    if (!toleranceSecondsSchema.safeParse(tolerance).success) {
+        throw new KeyEnvelopeError('malformed', 'clockToleranceSeconds must be a non-negative integer');
+    }
+    const bundleText = z.string().safeParse(bundle);
+    if (bundleText.success && bundleText.data.length > MAX_RECIPIENT_KEY_BUNDLE_LENGTH) {
+        throw new KeyEnvelopeError('too_large', `recipient key bundle is longer than ${MAX_RECIPIENT_KEY_BUNDLE_LENGTH} characters`);
+    }
+    const { signer, payload } = await verifyEd25519CompactJws(bundle, RECIPIENT_KEY_BUNDLE_TYP, 'recipient key bundle');
+    readVersion(payload, RECIPIENT_KEY_BUNDLE_VERSIONS, 'recipient key bundle');
+    const probe = agreementKeyProbeSchema.safeParse(payload);
+    if (probe.success) {
+        const jwk = probe.data.cnf.jwk;
+        // An array (also an object to the old probe) has no kty, so it is not X25519 either.
+        const { kty, crv } = Array.isArray(jwk) ? { kty: undefined, crv: undefined } : jwk;
+        if (kty !== 'OKP' || crv !== 'X25519') {
+            throw new KeyEnvelopeError('unsupported_key_type', 'recipient agreement key is not X25519');
+        }
+    }
+    const parsed = recipientKeyBundleClaimsV1Schema.safeParse(payload);
+    if (!parsed.success)
+        throw new KeyEnvelopeError('malformed', 'recipient key bundle claims are malformed');
+    const claims = parsed.data;
+    if (claims.iss !== signer) {
+        throw new KeyEnvelopeError('sender_mismatch', 'recipient key bundle iss is not the did:key that signed it');
+    }
+    if (claims.kid !== (await calculateJwkThumbprint(claims.cnf.jwk))) {
+        throw new KeyEnvelopeError('malformed', 'recipient key bundle kid is not the thumbprint of cnf.jwk');
+    }
+    const now = epochSeconds(options.now);
+    if (claims.iat > now + tolerance) {
+        throw new KeyEnvelopeError('not_yet_valid', 'recipient key bundle is not valid yet');
+    }
+    if (now > claims.exp + tolerance) {
+        throw new KeyEnvelopeError('expired', 'recipient key bundle has expired');
+    }
+    return Object.freeze({
+        did: claims.iss,
+        kid: claims.kid,
+        publicJwk: Object.freeze({ ...claims.cnf.jwk }),
+        envelopeVersions: Object.freeze([...claims.envelopeVersions]),
+        issuedAt: claims.iat,
+        expiresAt: claims.exp
+    });
+}
+//# sourceMappingURL=recipient-key-bundle.js.map

package/dist/keys/recipient-key-bundle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"recipient-key-bundle.js","sourceRoot":"","sources":["../../src/keys/recipient-key-bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,MAAM,MAAM,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,0BAA0B,EAAE,mBAAmB,EAAsB,MAAM,cAAc,CAAC;AACnG,OAAO,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAEhE;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,wBAAwB,GAAG,yBAAyB,CAAC;AAClE,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC;AAC9C,MAAM,6BAA6B,GAAG,CAAC,4BAA4B,CAAU,CAAC;AAC9E,MAAM,+BAA+B,GAAG,EAAE,CAAC;AAC3C;;;;GAIG;AACH,MAAM,+BAA+B,GAAG,IAAI,CAAC;AAE7C,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACpC,MAAM,CAAC;IACP,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;IACrB,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;IACxB,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;CAC1C,CAAC;KACD,MAAM,EAAE,CAAC;AAIX,MAAM,CAAC,MAAM,gCAAgC,GAAG,CAAC;KAC/C,MAAM,CAAC;IACP,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,mBAAmB;IACxB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,qBAAqB,EAAE,CAAC,CAAC,MAAM,EAAE;IACtD,gBAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE;IACjE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACnC,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CAChC,CAAC;KACD,MAAM,EAAE,CAAC;AAoBX,6HAA6H;AAC7H,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IACxC,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;CAClG,CAAC,CAAC;AAEH,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;AACrD,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,CAAC;AAE9D,MAAM,UAAU,YAAY,CAAC,GAA+B;IAC3D,MAAM,YAAY,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,kCAAkC,CAAC,CAAC;IAChH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,IAAI,CAAC,CAAC;AACxC,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAAgC,EAChC,OAAmD;IAEnD,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,OAAO,EAAE,CAAC;QAC7D,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,uCAAuC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,MAAM,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC9E,IAAI,CAAC,SAAS,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,iDAAiD,CAAC,CAAC;IACnH,IAAI,MAAM,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC,MAAM,sBAAsB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAC7E,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2DAA2D,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,MAAM,MAAM,GAA+B;QAC1C,CAAC,EAAE,4BAA4B;QAC/B,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,GAAG;QACzB,GAAG,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,IAAI,EAAE;QAC5B,gBAAgB,EAAE,CAAC,GAAG,qBAAqB,CAAC;QAC5C,GAAG;QACH,GAAG,EAAE,GAAG,GAAG,OAAO,CAAC,UAAU;KAC7B,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,CACjC,IAAI,WAAW,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;SAC/D,kBAAkB,CAAC;QACnB,GAAG,EAAE,OAAO;QACZ,GAAG,EAAE,wBAAwB;QAC7B,GAAG,EAAE,0BAA0B,CAAC,MAAM,CAAC,GAAG,CAAC;KAC3C,CAAC;SACD,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CACzB,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,MAAM,WAAW,CAAC,MAAM,CAAC,OAAO,EAAE,sBAAsB,EAAE,+BAA+B,CAAC,CAAC;IAC3G,OAAO,MAAM,CAAC,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC7C,MAAc,EACd,UAAkE,EAAE;IAEpE,MAAM,SAAS,GAAG,OAAO,CAAC,qBAAqB,IAAI,+BAA+B,CAAC;IACnF,IAAI,CAAC,sBAAsB,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1D,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,sDAAsD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,GAAG,+BAA+B,EAAE,CAAC;QACpF,MAAM,IAAI,gBAAgB,CACzB,WAAW,EACX,uCAAuC,+BAA+B,aAAa,CACnF,CAAC;IACH,CAAC;IACD,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,EAAE,sBAAsB,CAAC,CAAC;IACpH,WAAW,CAAC,OAAO,EAAE,6BAA6B,EAAE,sBAAsB,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;QAC/B,qFAAqF;QACrF,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QACnF,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvC,MAAM,IAAI,gBAAgB,CAAC,sBAAsB,EAAE,uCAAuC,CAAC,CAAC;QAC7F,CAAC;IACF,CAAC;IACD,MAAM,MAAM,GAAG,gCAAgC,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACnE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2CAA2C,CAAC,CAAC;IAC1G,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3B,IAAI,MAAM,CAAC,GAAG,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,gBAAgB,CAAC,iBAAiB,EAAE,4DAA4D,CAAC,CAAC;IAC7G,CAAC;IACD,IAAI,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,sBAAsB,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,IAAI,gBAAgB,CAAC,WAAW,EAAE,2DAA2D,CAAC,CAAC;IACtG,CAAC;IACD,MAAM,GAAG,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,MAAM,CAAC,GAAG,GAAG,GAAG,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,eAAe,EAAE,uCAAuC,CAAC,CAAC;IACtF,CAAC;IACD,IAAI,GAAG,GAAG,MAAM,CAAC,GAAG,GAAG,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,gBAAgB,CAAC,SAAS,EAAE,kCAAkC,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC;QAC/C,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC7D,QAAQ,EAAE,MAAM,CAAC,GAAG;QACpB,SAAS,EAAE,MAAM,CAAC,GAAG;KACrB,CAAC,CAAC;AACJ,CAAC"}

package/dist/keys/replay-guard.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod/v4';
+import { type Ed25519DidKey } from './did-key.ts';
+/**
+ * What openKeyEnvelope asks a replay guard to record: the authenticated
+ * sender, the envelope's jti, and the last epoch second at which the envelope
+ * could still be accepted (exp + the open call's clockToleranceSeconds).
+ */
+export declare const keyEnvelopeReplayClaimSchema: z.ZodObject<{
+    sender: z.ZodString & z.ZodType<`did:key:z6Mk${string}`, string, z.core.$ZodTypeInternals<`did:key:z6Mk${string}`, string>>;
+    jti: z.ZodString;
+    retainUntil: z.ZodNumber;
+}, z.core.$strict>;
+export interface KeyEnvelopeReplayClaim {
+    readonly sender: Ed25519DidKey;
+    readonly jti: string;
+    /** Epoch seconds. */
+    readonly retainUntil: number;
+}
+/**
+ * The replay seen-set contract. `./keys` ships no implementation: replay state
+ * depends on the environment (a process-local set is fake success across
+ * isolates), so features obtain a guard from the auth/key kind, which resolves
+ * a storage-backed one. They never construct one.
+ *
+ * An implementation MUST:
+ * - return 'replayed' for any (sender, jti) claimed earlier whose retainUntil
+ *   has not passed (retainUntil >= now);
+ * - never forget an entry before its retainUntil, and apply no tolerance of
+ *   its own (openKeyEnvelope already folded its tolerance into retainUntil);
+ * - bound its storage and throw KeyEnvelopeError('replay_guard_full') when it
+ *   cannot record a claim, instead of returning an unrecorded 'fresh'.
+ *
+ * openKeyEnvelope opens an envelope only on an explicit 'fresh'; any other
+ * result is treated as 'replayed'.
+ */
+export interface KeyEnvelopeReplayGuard {
+    claim(entry: KeyEnvelopeReplayClaim): Promise<'fresh' | 'replayed'>;
+}
+//# sourceMappingURL=replay-guard.d.ts.map

package/dist/keys/replay-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-guard.d.ts","sourceRoot":"","sources":["../../src/keys/replay-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAuB,KAAK,aAAa,EAAE,MAAM,cAAc,CAAC;AAEvE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;kBAM/B,CAAC;AAEX,MAAM,WAAW,sBAAsB;IACtC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,qBAAqB;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC7B;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,sBAAsB;IACtC,KAAK,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,OAAO,GAAG,UAAU,CAAC,CAAC;CACpE"}

package/dist/keys/replay-guard.js

@@ -0,0 +1,15 @@
+import { z } from 'zod/v4';
+import { ed25519DidKeySchema } from "./did-key.js";
+/**
+ * What openKeyEnvelope asks a replay guard to record: the authenticated
+ * sender, the envelope's jti, and the last epoch second at which the envelope
+ * could still be accepted (exp + the open call's clockToleranceSeconds).
+ */
+export const keyEnvelopeReplayClaimSchema = z
+    .object({
+    sender: ed25519DidKeySchema,
+    jti: z.string().regex(/^[A-Za-z0-9_-]{22}$/),
+    retainUntil: z.number().int().nonnegative()
+})
+    .strict();
+//# sourceMappingURL=replay-guard.js.map

package/dist/keys/replay-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"replay-guard.js","sourceRoot":"","sources":["../../src/keys/replay-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,QAAQ,CAAC;AAC3B,OAAO,EAAE,mBAAmB,EAAsB,MAAM,cAAc,CAAC;AAEvE;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,MAAM,EAAE,mBAAmB;IAC3B,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,qBAAqB,CAAC;IAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC"}

package/dist/providers/builtin/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Builtin Auth Providers
+ *
+ * Public metadata contract for built-in sign-in providers.
+ */
+export { KNOWN_PROVIDERS, getProviderMetadata, type KnownProviderMetadata } from './known-providers.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/providers/builtin/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/providers/builtin/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,KAAK,qBAAqB,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/providers/builtin/index.js

@@ -0,0 +1,7 @@
+/**
+ * Builtin Auth Providers
+ *
+ * Public metadata contract for built-in sign-in providers.
+ */
+export { KNOWN_PROVIDERS, getProviderMetadata } from "./known-providers.js";
+//# sourceMappingURL=index.js.map

package/dist/providers/builtin/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/providers/builtin/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAA8B,MAAM,sBAAsB,CAAC"}

package/dist/providers/builtin/known-providers.d.ts

@@ -0,0 +1,239 @@
+/**
+ * Known Auth Provider Metadata
+ *
+ * Metadata for the built-in social providers supported by the host auth
+ * implementation. The host supplies the runtime provider list.
+ *
+ * @see better-auth/core/src/social-providers/index.ts
+ */
+export interface KnownProviderMetadata {
+    displayName: string;
+    icon: string;
+    defaultScopes?: string[];
+    description?: string;
+}
+/**
+ * Metadata for all known built-in social providers.
+ *
+ * Keep this in sync with the host auth implementation's supported providers.
+ * Run `bun run check:auth-providers` to verify.
+ *
+ */
+export declare const KNOWN_PROVIDERS: {
+    apple: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    atlassian: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    cognito: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    discord: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    dropbox: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    facebook: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    figma: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    github: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    gitlab: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    google: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    huggingface: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    kakao: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    kick: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    line: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    linear: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    linkedin: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    microsoft: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    naver: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    notion: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    paybin: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    paypal: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    polar: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    railway: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    reddit: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    roblox: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    salesforce: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    slack: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    spotify: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    tiktok: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    twitch: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    twitter: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    vercel: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    vk: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    wechat: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+    zoom: {
+        displayName: string;
+        icon: string;
+        defaultScopes: string[];
+        description: string;
+    };
+};
+/**
+ * Get metadata for a known provider.
+ * Falls back to sensible defaults if not found.
+ */
+export declare function getProviderMetadata(providerId: string): KnownProviderMetadata;
+//# sourceMappingURL=known-providers.d.ts.map

package/dist/providers/builtin/known-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"known-providers.d.ts","sourceRoot":"","sources":["../../../src/providers/builtin/known-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,qBAAqB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;;GAMG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmNqB,CAAC;AAIlD;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,qBAAqB,CAQ7E"}