@voyant-travel/auth 0.113.3

package/dist/cloud-broker/state.d.ts

@@ -0,0 +1,55 @@
+export declare const VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE = "voyant-cloud-admin-auth";
+export type CloudAdminAuthStartConfig = {
+    cloudAuthStartUrl: string;
+    deploymentId: string;
+    adminCallbackUrl: string;
+    cookieSecret: string;
+    appId?: string | null;
+    environment?: string | null;
+    surface?: string | null;
+    stateTtlSeconds?: number;
+};
+export type CloudAdminAuthState = {
+    state: string;
+    nonce: string;
+    deploymentId: string;
+    redirectUri: string;
+    next: string;
+    expiresAt: number;
+};
+export type CreateCloudAdminAuthStartInput = {
+    requestUrl: string;
+    next?: string | null;
+    config: CloudAdminAuthStartConfig;
+    now?: Date;
+    randomState?: string;
+    randomNonce?: string;
+};
+export type CreateCloudAdminAuthStartResult = {
+    redirectUrl: string;
+    state: CloudAdminAuthState;
+    setCookie: string;
+};
+export type VerifyCloudAdminAuthCallbackInput = {
+    requestUrl: string;
+    cookieHeader?: string | null;
+    cookieSecret: string;
+    now?: Date;
+};
+export type VerifyCloudAdminAuthCallbackResult = {
+    ok: true;
+    code: string;
+    state: CloudAdminAuthState;
+    clearCookie: string;
+} | {
+    ok: false;
+    error: "cloud_error" | "invalid_request" | "invalid_state" | "expired_state";
+    description?: string;
+    cloudError?: string;
+    clearCookie: string;
+};
+export declare function createCloudAdminAuthStart({ requestUrl, next, config, now, randomState, randomNonce, }: CreateCloudAdminAuthStartInput): Promise<CreateCloudAdminAuthStartResult>;
+export declare function verifyCloudAdminAuthCallback({ requestUrl, cookieHeader, cookieSecret, now, }: VerifyCloudAdminAuthCallbackInput): Promise<VerifyCloudAdminAuthCallbackResult>;
+export declare function normalizeCloudAdminAuthNext(next: string | null | undefined, adminOrigin: string): string;
+export declare function buildClearCloudAdminAuthStateCookie(secure: boolean, path?: string): string;
+//# sourceMappingURL=state.d.ts.map

package/dist/cloud-broker/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/cloud-broker/state.ts"],"names":[],"mappings":"AAQA,eAAO,MAAM,oCAAoC,4BAA4B,CAAA;AAK7E,MAAM,MAAM,yBAAyB,GAAG;IACtC,iBAAiB,EAAE,MAAM,CAAA;IACzB,YAAY,EAAE,MAAM,CAAA;IACpB,gBAAgB,EAAE,MAAM,CAAA;IACxB,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACvB,eAAe,CAAC,EAAE,MAAM,CAAA;CACzB,CAAA;AAED,MAAM,MAAM,mBAAmB,GAAG;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,MAAM,CAAA;IACZ,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,8BAA8B,GAAG;IAC3C,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,MAAM,EAAE,yBAAyB,CAAA;IACjC,GAAG,CAAC,EAAE,IAAI,CAAA;IACV,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB,CAAA;AAED,MAAM,MAAM,+BAA+B,GAAG;IAC5C,WAAW,EAAE,MAAM,CAAA;IACnB,KAAK,EAAE,mBAAmB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB,CAAA;AAED,MAAM,MAAM,iCAAiC,GAAG;IAC9C,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,CAAA;IACpB,GAAG,CAAC,EAAE,IAAI,CAAA;CACX,CAAA;AAED,MAAM,MAAM,kCAAkC,GAC1C;IACE,EAAE,EAAE,IAAI,CAAA;IACR,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,mBAAmB,CAAA;IAC1B,WAAW,EAAE,MAAM,CAAA;CACpB,GACD;IACE,EAAE,EAAE,KAAK,CAAA;IACT,KAAK,EAAE,aAAa,GAAG,iBAAiB,GAAG,eAAe,GAAG,eAAe,CAAA;IAC5E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;CACpB,CAAA;AAEL,wBAAsB,yBAAyB,CAAC,EAC9C,UAAU,EACV,IAAI,EACJ,MAAM,EACN,GAAgB,EAChB,WAAW,EACX,WAAW,GACZ,EAAE,8BAA8B,GAAG,OAAO,CAAC,+BAA+B,CAAC,CAuC3E;AAED,wBAAsB,4BAA4B,CAAC,EACjD,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,GAAgB,GACjB,EAAE,iCAAiC,GAAG,OAAO,CAAC,kCAAkC,CAAC,CAwCjF;AAED,wBAAgB,2BAA2B,CACzC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAC/B,WAAW,EAAE,MAAM,GAClB,MAAM,CAeR;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,SAAgB,GAAG,MAAM,CAQjG"}

package/dist/cloud-broker/state.js

@@ -0,0 +1,191 @@
+import { base64UrlDecode, base64UrlEncode, isRecord, normalizeAbsoluteUrl, timingSafeEqual, } from "./utils.js";
+export const VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE = "voyant-cloud-admin-auth";
+const DEFAULT_STATE_TTL_SECONDS = 300;
+const RANDOM_BYTES = 32;
+export async function createCloudAdminAuthStart({ requestUrl, next, config, now = new Date(), randomState, randomNonce, }) {
+    validateStartConfig(config);
+    const parsedRequestUrl = new URL(requestUrl);
+    const ttlSeconds = config.stateTtlSeconds ?? DEFAULT_STATE_TTL_SECONDS;
+    const state = {
+        state: randomState ?? randomToken(),
+        nonce: randomNonce ?? randomToken(),
+        deploymentId: config.deploymentId.trim(),
+        redirectUri: normalizeAbsoluteUrl(config.adminCallbackUrl, "adminCallbackUrl"),
+        next: normalizeCloudAdminAuthNext(next, parsedRequestUrl.origin),
+        expiresAt: now.getTime() + ttlSeconds * 1000,
+    };
+    const redirectUrl = new URL(config.cloudAuthStartUrl);
+    redirectUrl.searchParams.set("deployment_id", state.deploymentId);
+    redirectUrl.searchParams.set("redirect_uri", state.redirectUri);
+    redirectUrl.searchParams.set("state", state.state);
+    redirectUrl.searchParams.set("nonce", state.nonce);
+    redirectUrl.searchParams.set("surface", config.surface?.trim() || "admin");
+    redirectUrl.searchParams.set("next", state.next);
+    if (config.appId?.trim()) {
+        redirectUrl.searchParams.set("app_id", config.appId.trim());
+    }
+    if (config.environment?.trim()) {
+        redirectUrl.searchParams.set("environment", config.environment.trim());
+    }
+    return {
+        redirectUrl: redirectUrl.toString(),
+        state,
+        setCookie: await buildCloudAdminAuthStateCookie({
+            state,
+            secret: config.cookieSecret,
+            secure: parsedRequestUrl.protocol === "https:",
+            path: cloudAuthCookiePath(new URL(state.redirectUri).pathname),
+            maxAgeSeconds: ttlSeconds,
+        }),
+    };
+}
+export async function verifyCloudAdminAuthCallback({ requestUrl, cookieHeader, cookieSecret, now = new Date(), }) {
+    assertUsableSecret(cookieSecret);
+    const url = new URL(requestUrl);
+    const clearCookie = buildClearCloudAdminAuthStateCookie(url.protocol === "https:", cloudAuthCookiePath(url.pathname));
+    const cloudError = url.searchParams.get("error");
+    if (cloudError) {
+        return {
+            ok: false,
+            error: "cloud_error",
+            cloudError,
+            description: url.searchParams.get("error_description") ?? undefined,
+            clearCookie,
+        };
+    }
+    const stateParam = url.searchParams.get("state");
+    const code = url.searchParams.get("code");
+    if (!stateParam || !code) {
+        return { ok: false, error: "invalid_request", clearCookie };
+    }
+    const stateCookie = readCookie(cookieHeader, VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE);
+    if (!stateCookie) {
+        return { ok: false, error: "invalid_state", clearCookie };
+    }
+    const state = await verifyCloudAdminAuthStateCookie(stateCookie, cookieSecret);
+    if (!state || state.state !== stateParam) {
+        return { ok: false, error: "invalid_state", clearCookie };
+    }
+    if (state.expiresAt <= now.getTime()) {
+        return { ok: false, error: "expired_state", clearCookie };
+    }
+    return { ok: true, code, state, clearCookie };
+}
+export function normalizeCloudAdminAuthNext(next, adminOrigin) {
+    const value = next?.trim();
+    if (!value)
+        return "/";
+    if (value.startsWith("/") && !value.startsWith("//")) {
+        return value;
+    }
+    try {
+        const url = new URL(value);
+        if (url.origin !== adminOrigin)
+            return "/";
+        return `${url.pathname}${url.search}${url.hash}` || "/";
+    }
+    catch {
+        return "/";
+    }
+}
+export function buildClearCloudAdminAuthStateCookie(secure, path = "/auth/cloud") {
+    return serializeCookie(VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, "", {
+        httpOnly: true,
+        maxAge: 0,
+        path,
+        sameSite: "Lax",
+        secure,
+    });
+}
+async function buildCloudAdminAuthStateCookie({ state, secret, secure, path, maxAgeSeconds, }) {
+    const payload = base64UrlEncode(new TextEncoder().encode(JSON.stringify(state)));
+    const signature = await hmac(payload, secret);
+    return serializeCookie(VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, `${payload}.${signature}`, {
+        httpOnly: true,
+        maxAge: maxAgeSeconds,
+        path,
+        sameSite: "Lax",
+        secure,
+    });
+}
+async function verifyCloudAdminAuthStateCookie(cookieValue, secret) {
+    const [payload, signature, ...rest] = cookieValue.split(".");
+    if (!payload || !signature || rest.length > 0)
+        return null;
+    const expectedSignature = await hmac(payload, secret);
+    if (!timingSafeEqual(signature, expectedSignature))
+        return null;
+    const parsed = JSON.parse(new TextDecoder().decode(base64UrlDecode(payload)));
+    if (!isCloudAdminAuthState(parsed))
+        return null;
+    return parsed;
+}
+function validateStartConfig(config) {
+    assertUsableSecret(config.cookieSecret);
+    normalizeAbsoluteUrl(config.cloudAuthStartUrl, "cloudAuthStartUrl");
+    normalizeAbsoluteUrl(config.adminCallbackUrl, "adminCallbackUrl");
+    if (!config.deploymentId.trim()) {
+        throw new Error("Voyant Cloud auth requires deploymentId");
+    }
+}
+function assertUsableSecret(secret) {
+    if (!secret || secret.length < 32) {
+        throw new Error("Voyant Cloud auth requires a cookie secret with at least 32 characters");
+    }
+}
+function isCloudAdminAuthState(value) {
+    if (!isRecord(value))
+        return false;
+    return (typeof value.state === "string" &&
+        typeof value.nonce === "string" &&
+        typeof value.deploymentId === "string" &&
+        typeof value.redirectUri === "string" &&
+        typeof value.next === "string" &&
+        typeof value.expiresAt === "number");
+}
+function readCookie(cookieHeader, name) {
+    if (!cookieHeader)
+        return null;
+    for (const part of cookieHeader.split(";")) {
+        const [rawName, ...rawValue] = part.trim().split("=");
+        if (rawName === name)
+            return rawValue.join("=");
+    }
+    return null;
+}
+function cloudAuthCookiePath(pathname) {
+    const normalized = pathname.replace(/\/+$/, "") || "/";
+    const marker = "/auth/cloud/";
+    const markerIndex = normalized.indexOf(marker);
+    if (markerIndex >= 0) {
+        return normalized.slice(0, markerIndex + marker.length - 1) || "/auth/cloud";
+    }
+    if (normalized.endsWith("/auth/cloud")) {
+        return normalized;
+    }
+    return "/auth/cloud";
+}
+function serializeCookie(name, value, options) {
+    const parts = [
+        `${name}=${value}`,
+        `Max-Age=${options.maxAge}`,
+        `Path=${options.path}`,
+        `SameSite=${options.sameSite}`,
+    ];
+    if (options.httpOnly)
+        parts.push("HttpOnly");
+    if (options.secure)
+        parts.push("Secure");
+    return parts.join("; ");
+}
+function randomToken() {
+    const bytes = new Uint8Array(RANDOM_BYTES);
+    globalThis.crypto.getRandomValues(bytes);
+    return base64UrlEncode(bytes);
+}
+async function hmac(value, secret) {
+    const key = await globalThis.crypto.subtle.importKey("raw", new TextEncoder().encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["sign"]);
+    const signature = await globalThis.crypto.subtle.sign("HMAC", key, new TextEncoder().encode(value));
+    return base64UrlEncode(new Uint8Array(signature));
+}
+//# sourceMappingURL=state.js.map

package/dist/cloud-broker/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/cloud-broker/state.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,eAAe,EACf,eAAe,EACf,QAAQ,EACR,oBAAoB,EACpB,eAAe,GAChB,MAAM,YAAY,CAAA;AAEnB,MAAM,CAAC,MAAM,oCAAoC,GAAG,yBAAyB,CAAA;AAE7E,MAAM,yBAAyB,GAAG,GAAG,CAAA;AACrC,MAAM,YAAY,GAAG,EAAE,CAAA;AA2DvB,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,EAC9C,UAAU,EACV,IAAI,EACJ,MAAM,EACN,GAAG,GAAG,IAAI,IAAI,EAAE,EAChB,WAAW,EACX,WAAW,GACoB;IAC/B,mBAAmB,CAAC,MAAM,CAAC,CAAA;IAE3B,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC5C,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,yBAAyB,CAAA;IACtE,MAAM,KAAK,GAAwB;QACjC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,KAAK,EAAE,WAAW,IAAI,WAAW,EAAE;QACnC,YAAY,EAAE,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE;QACxC,WAAW,EAAE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC;QAC9E,IAAI,EAAE,2BAA2B,CAAC,IAAI,EAAE,gBAAgB,CAAC,MAAM,CAAC;QAChE,SAAS,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,UAAU,GAAG,IAAI;KAC7C,CAAA;IACD,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;IACrD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAA;IACjE,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,KAAK,CAAC,WAAW,CAAC,CAAA;IAC/D,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,CAAC,CAAA;IAClD,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,OAAO,CAAC,CAAA;IAC1E,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAA;IAEhD,IAAI,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC;QACzB,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAA;IAC7D,CAAC;IACD,IAAI,MAAM,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QAC/B,WAAW,CAAC,YAAY,CAAC,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,CAAA;IACxE,CAAC;IAED,OAAO;QACL,WAAW,EAAE,WAAW,CAAC,QAAQ,EAAE;QACnC,KAAK;QACL,SAAS,EAAE,MAAM,8BAA8B,CAAC;YAC9C,KAAK;YACL,MAAM,EAAE,MAAM,CAAC,YAAY;YAC3B,MAAM,EAAE,gBAAgB,CAAC,QAAQ,KAAK,QAAQ;YAC9C,IAAI,EAAE,mBAAmB,CAAC,IAAI,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,QAAQ,CAAC;YAC9D,aAAa,EAAE,UAAU;SAC1B,CAAC;KACH,CAAA;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,EACjD,UAAU,EACV,YAAY,EACZ,YAAY,EACZ,GAAG,GAAG,IAAI,IAAI,EAAE,GACkB;IAClC,kBAAkB,CAAC,YAAY,CAAC,CAAA;IAEhC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,CAAA;IAC/B,MAAM,WAAW,GAAG,mCAAmC,CACrD,GAAG,CAAC,QAAQ,KAAK,QAAQ,EACzB,mBAAmB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAClC,CAAA;IACD,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,aAAa;YACpB,UAAU;YACV,WAAW,EAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,SAAS;YACnE,WAAW;SACZ,CAAA;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;IAChD,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;IACzC,IAAI,CAAC,UAAU,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,iBAAiB,EAAE,WAAW,EAAE,CAAA;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,EAAE,oCAAoC,CAAC,CAAA;IAClF,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,+BAA+B,CAAC,WAAW,EAAE,YAAY,CAAC,CAAA;IAC9E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;QACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;QACrC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,CAAA;IAC3D,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,WAAW,EAAE,CAAA;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,IAA+B,EAC/B,WAAmB;IAEnB,MAAM,KAAK,GAAG,IAAI,EAAE,IAAI,EAAE,CAAA;IAC1B,IAAI,CAAC,KAAK;QAAE,OAAO,GAAG,CAAA;IAEtB,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;QAC1B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;YAAE,OAAO,GAAG,CAAA;QAC1C,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAA;IACZ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAAe,EAAE,IAAI,GAAG,aAAa;IACvF,OAAO,eAAe,CAAC,oCAAoC,EAAE,EAAE,EAAE;QAC/D,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,CAAC;QACT,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,8BAA8B,CAAC,EAC5C,KAAK,EACL,MAAM,EACN,MAAM,EACN,IAAI,EACJ,aAAa,GAOd;IACC,MAAM,OAAO,GAAG,eAAe,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAChF,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAE7C,OAAO,eAAe,CAAC,oCAAoC,EAAE,GAAG,OAAO,IAAI,SAAS,EAAE,EAAE;QACtF,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,aAAa;QACrB,IAAI;QACJ,QAAQ,EAAE,KAAK;QACf,MAAM;KACP,CAAC,CAAA;AACJ,CAAC;AAED,KAAK,UAAU,+BAA+B,CAC5C,WAAmB,EACnB,MAAc;IAEd,MAAM,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5D,IAAI,CAAC,OAAO,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAE1D,MAAM,iBAAiB,GAAG,MAAM,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IACrD,IAAI,CAAC,eAAe,CAAC,SAAS,EAAE,iBAAiB,CAAC;QAAE,OAAO,IAAI,CAAA;IAE/D,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC,CAAY,CAAA;IACxF,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAA;IAC/C,OAAO,MAAM,CAAA;AACf,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAiC;IAC5D,kBAAkB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;IACvC,oBAAoB,CAAC,MAAM,CAAC,iBAAiB,EAAE,mBAAmB,CAAC,CAAA;IACnE,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAEjE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAA;IAC5D,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAA;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAClC,OAAO,CACL,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;QAC/B,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ;QACtC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,CACpC,CAAA;AACH,CAAC;AAED,SAAS,UAAU,CAAC,YAAuC,EAAE,IAAY;IACvE,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,CAAC,OAAO,EAAE,GAAG,QAAQ,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO,KAAK,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACjD,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,mBAAmB,CAAC,QAAgB;IAC3C,MAAM,UAAU,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,GAAG,CAAA;IACtD,MAAM,MAAM,GAAG,cAAc,CAAA;IAC7B,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC9C,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACrB,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,aAAa,CAAA;IAC9E,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QACvC,OAAO,UAAU,CAAA;IACnB,CAAC;IAED,OAAO,aAAa,CAAA;AACtB,CAAC;AAED,SAAS,eAAe,CACtB,IAAY,EACZ,KAAa,EACb,OAMC;IAED,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,IAAI,KAAK,EAAE;QAClB,WAAW,OAAO,CAAC,MAAM,EAAE;QAC3B,QAAQ,OAAO,CAAC,IAAI,EAAE;QACtB,YAAY,OAAO,CAAC,QAAQ,EAAE;KAC/B,CAAA;IAED,IAAI,OAAO,CAAC,QAAQ;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IAC5C,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IAExC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzB,CAAC;AAED,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,CAAA;IAC1C,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAA;IACxC,OAAO,eAAe,CAAC,KAAK,CAAC,CAAA;AAC/B,CAAC;AAED,KAAK,UAAU,IAAI,CAAC,KAAa,EAAE,MAAc;IAC/C,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,EAChC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,MAAM,CAAC,CACT,CAAA;IACD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CACnD,MAAM,EACN,GAAG,EACH,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAChC,CAAA;IACD,OAAO,eAAe,CAAC,IAAI,UAAU,CAAC,SAAS,CAAC,CAAC,CAAA;AACnD,CAAC"}

package/dist/cloud-broker/utils.d.ts

@@ -0,0 +1,7 @@
+export declare function normalizeAbsoluteUrl(value: string, label: string): string;
+export declare function isRecord(value: unknown): value is Record<string, unknown>;
+export declare function base64UrlEncode(bytes: Uint8Array): string;
+export declare function base64UrlDecode(value: string): Uint8Array;
+export declare function toArrayBuffer(bytes: Uint8Array): ArrayBuffer;
+export declare function timingSafeEqual(left: string, right: string): boolean;
+//# sourceMappingURL=utils.d.ts.map

package/dist/cloud-broker/utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/cloud-broker/utils.ts"],"names":[],"mappings":"AAAA,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAWzE;AAED,wBAAgB,QAAQ,CAAC,KAAK,EAAE,OAAO,GAAG,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAEzE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,UAAU,GAAG,MAAM,CAMzD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAWzD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,WAAW,CAI5D;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAUpE"}

package/dist/cloud-broker/utils.js

@@ -0,0 +1,50 @@
+export function normalizeAbsoluteUrl(value, label) {
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new Error(`Voyant Cloud auth requires ${label}`);
+    }
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:" && url.hostname !== "localhost" && url.hostname !== "127.0.0.1") {
+        throw new Error(`Voyant Cloud auth ${label} must use HTTPS outside localhost`);
+    }
+    return url.toString();
+}
+export function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+export function base64UrlEncode(bytes) {
+    let binary = "";
+    for (const byte of bytes) {
+        binary += String.fromCharCode(byte);
+    }
+    return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/g, "");
+}
+export function base64UrlDecode(value) {
+    const padded = value
+        .replace(/-/g, "+")
+        .replace(/_/g, "/")
+        .padEnd(Math.ceil(value.length / 4) * 4, "=");
+    const binary = atob(padded);
+    const bytes = new Uint8Array(binary.length);
+    for (let i = 0; i < binary.length; i += 1) {
+        bytes[i] = binary.charCodeAt(i);
+    }
+    return bytes;
+}
+export function toArrayBuffer(bytes) {
+    const buffer = new ArrayBuffer(bytes.byteLength);
+    new Uint8Array(buffer).set(bytes);
+    return buffer;
+}
+export function timingSafeEqual(left, right) {
+    const leftBytes = new TextEncoder().encode(left);
+    const rightBytes = new TextEncoder().encode(right);
+    if (leftBytes.length !== rightBytes.length)
+        return false;
+    let diff = 0;
+    for (let i = 0; i < leftBytes.length; i += 1) {
+        diff |= leftBytes[i] ^ rightBytes[i];
+    }
+    return diff === 0;
+}
+//# sourceMappingURL=utils.js.map

package/dist/cloud-broker/utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"utils.js","sourceRoot":"","sources":["../../src/cloud-broker/utils.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,KAAa;IAC/D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAA;IAC5B,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,MAAM,IAAI,KAAK,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAA;IACxD,CAAC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;QAC9F,MAAM,IAAI,KAAK,CAAC,qBAAqB,KAAK,mCAAmC,CAAC,CAAA;IAChF,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAA;AACvB,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;AAC7E,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAiB;IAC/C,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACrC,CAAC;IACD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,MAAM,MAAM,GAAG,KAAK;SACjB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC;SAClB,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,CAAA;IAC3B,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAA;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,KAAK,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IACjC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAiB;IAC7C,MAAM,MAAM,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAChD,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACjC,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa;IACzD,MAAM,SAAS,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IAChD,MAAM,UAAU,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAClD,IAAI,SAAS,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAExD,IAAI,IAAI,GAAG,CAAC,CAAA;IACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7C,IAAI,IAAI,SAAS,CAAC,CAAC,CAAE,GAAG,UAAU,CAAC,CAAC,CAAE,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,KAAK,CAAC,CAAA;AACnB,CAAC"}

package/dist/cloud-broker.d.ts

@@ -0,0 +1,5 @@
+export type { CloudAdminAssertion, CloudAdminAuthExchangeConfig, CloudAdminAuthRevalidateConfig, CloudAdminAuthRevalidationResult, ExchangeCloudAdminAuthCodeInput, RevalidateCloudAdminAuthAccessInput, } from "./cloud-broker/assertion.js";
+export { exchangeCloudAdminAuthCode, revalidateCloudAdminAuthAccess, VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER, verifyCloudAdminAssertion, } from "./cloud-broker/assertion.js";
+export type { CloudAdminAuthStartConfig, CloudAdminAuthState, CreateCloudAdminAuthStartInput, CreateCloudAdminAuthStartResult, VerifyCloudAdminAuthCallbackInput, VerifyCloudAdminAuthCallbackResult, } from "./cloud-broker/state.js";
+export { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart, normalizeCloudAdminAuthNext, VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, verifyCloudAdminAuthCallback, } from "./cloud-broker/state.js";
+//# sourceMappingURL=cloud-broker.d.ts.map

package/dist/cloud-broker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-broker.d.ts","sourceRoot":"","sources":["../src/cloud-broker.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,mBAAmB,EACnB,4BAA4B,EAC5B,8BAA8B,EAC9B,gCAAgC,EAChC,+BAA+B,EAC/B,mCAAmC,GACpC,MAAM,6BAA6B,CAAA;AACpC,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAA;AACpC,YAAY,EACV,yBAAyB,EACzB,mBAAmB,EACnB,8BAA8B,EAC9B,+BAA+B,EAC/B,iCAAiC,EACjC,kCAAkC,GACnC,MAAM,yBAAyB,CAAA;AAChC,OAAO,EACL,mCAAmC,EACnC,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA"}

package/dist/cloud-broker.js

@@ -0,0 +1,3 @@
+export { exchangeCloudAdminAuthCode, revalidateCloudAdminAuthAccess, VOYANT_CLOUD_ADMIN_ASSERTION_ISSUER, verifyCloudAdminAssertion, } from "./cloud-broker/assertion.js";
+export { buildClearCloudAdminAuthStateCookie, createCloudAdminAuthStart, normalizeCloudAdminAuthNext, VOYANT_CLOUD_ADMIN_AUTH_STATE_COOKIE, verifyCloudAdminAuthCallback, } from "./cloud-broker/state.js";
+//# sourceMappingURL=cloud-broker.js.map

package/dist/cloud-broker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloud-broker.js","sourceRoot":"","sources":["../src/cloud-broker.ts"],"names":[],"mappings":"AAQA,OAAO,EACL,0BAA0B,EAC1B,8BAA8B,EAC9B,mCAAmC,EACnC,yBAAyB,GAC1B,MAAM,6BAA6B,CAAA;AASpC,OAAO,EACL,mCAAmC,EACnC,yBAAyB,EACzB,2BAA2B,EAC3B,oCAAoC,EACpC,4BAA4B,GAC7B,MAAM,yBAAyB,CAAA"}

package/dist/edge.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Edge-compatible session check for Next.js middleware.
+ *
+ * Does NOT import better-auth (which uses eval / new Function via
+ * createTelemetry, incompatible with Edge Runtime).
+ *
+ * Instead it reads the session cookie, unsigns it using the same
+ * HMAC-SHA256 scheme that better-call uses, and queries better-auth's
+ * `session` + `user` tables directly via the Neon HTTP drizzle adapter.
+ *
+ * With the identity table collapse, authUser.id IS the userId —
+ * no extra identity lookup required.
+ */
+type AuthContext = {
+    userId: string | null;
+    email: string | null;
+    sessionId: string | null;
+};
+/**
+ * Lightweight edge-compatible session check.
+ * Safe to call from Next.js middleware.
+ *
+ * Returns `userId` which is Better Auth's `user.id` — the single
+ * canonical user identifier after the identity table collapse.
+ */
+export declare function getAuthContextFromHeaders(headers: Headers): Promise<AuthContext>;
+export {};
+//# sourceMappingURL=edge.d.ts.map

package/dist/edge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge.d.ts","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAkEH,KAAK,WAAW,GAAG;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB,CAAA;AAQD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,CA8BtF"}

package/dist/edge.js

@@ -0,0 +1,106 @@
+/**
+ * Edge-compatible session check for Next.js middleware.
+ *
+ * Does NOT import better-auth (which uses eval / new Function via
+ * createTelemetry, incompatible with Edge Runtime).
+ *
+ * Instead it reads the session cookie, unsigns it using the same
+ * HMAC-SHA256 scheme that better-call uses, and queries better-auth's
+ * `session` + `user` tables directly via the Neon HTTP drizzle adapter.
+ *
+ * With the identity table collapse, authUser.id IS the userId —
+ * no extra identity lookup required.
+ */
+import { getDb } from "@voyant-travel/db";
+import { authSession, authUser } from "@voyant-travel/db/schema/iam";
+import { and, eq, gt } from "drizzle-orm";
+const SESSION_COOKIE_NAME = "better-auth.session_token";
+function getAuthSecret() {
+    return process.env.BETTER_AUTH_SECRET || process.env.SESSION_CLAIMS_SECRET || "";
+}
+/**
+ * Unsign a Better Auth cookie value.
+ *
+ * Better Auth (via better-call) signs cookies as:
+ *   encodeURIComponent(value + "." + base64(HMAC-SHA256(value, secret)))
+ *
+ * This function reverses that: URL-decode, split at last ".",
+ * verify the HMAC-SHA256 signature, and return the raw value.
+ */
+async function unsignCookie(rawCookieValue, secret) {
+    const decoded = decodeURIComponent(rawCookieValue);
+    const lastDot = decoded.lastIndexOf(".");
+    if (lastDot < 1)
+        return null;
+    const value = decoded.substring(0, lastDot);
+    const signature = decoded.substring(lastDot + 1);
+    // Better Auth signatures are 44-char base64 strings ending with "="
+    if (signature.length !== 44 || !signature.endsWith("="))
+        return null;
+    const encoder = new TextEncoder();
+    const key = await crypto.subtle.importKey("raw", encoder.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, ["verify"]);
+    const sigBinStr = atob(signature);
+    const sigBytes = new Uint8Array(sigBinStr.length);
+    for (let i = 0; i < sigBinStr.length; i++)
+        sigBytes[i] = sigBinStr.charCodeAt(i);
+    const valid = await crypto.subtle.verify("HMAC", key, sigBytes, encoder.encode(value));
+    return valid ? value : null;
+}
+function getRawCookieValue(headers) {
+    const cookieHeader = headers.get("cookie");
+    if (!cookieHeader)
+        return null;
+    for (const part of cookieHeader.split(";")) {
+        const trimmed = part.trim();
+        const eqIdx = trimmed.indexOf("=");
+        if (eqIdx === -1)
+            continue;
+        const name = trimmed.slice(0, eqIdx).trim();
+        if (name === SESSION_COOKIE_NAME) {
+            return trimmed.slice(eqIdx + 1).trim() || null;
+        }
+    }
+    return null;
+}
+const EMPTY = {
+    userId: null,
+    email: null,
+    sessionId: null,
+};
+/**
+ * Lightweight edge-compatible session check.
+ * Safe to call from Next.js middleware.
+ *
+ * Returns `userId` which is Better Auth's `user.id` — the single
+ * canonical user identifier after the identity table collapse.
+ */
+export async function getAuthContextFromHeaders(headers) {
+    const rawCookie = getRawCookieValue(headers);
+    if (!rawCookie)
+        return EMPTY;
+    const secret = getAuthSecret();
+    if (!secret)
+        return EMPTY;
+    const token = await unsignCookie(rawCookie, secret);
+    if (!token)
+        return EMPTY;
+    const db = getDb("edge");
+    const [row] = await db
+        .select({
+        sessionId: authSession.id,
+        userId: authSession.userId,
+        email: authUser.email,
+    })
+        .from(authSession)
+        .innerJoin(authUser, eq(authUser.id, authSession.userId))
+        .where(and(eq(authSession.token, token), gt(authSession.expiresAt, new Date())))
+        .limit(1);
+    if (!row)
+        return EMPTY;
+    return {
+        userId: row.userId,
+        email: row.email,
+        sessionId: row.sessionId,
+    };
+}
+//# sourceMappingURL=edge.js.map

package/dist/edge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"edge.js","sourceRoot":"","sources":["../src/edge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAA;AACzC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAA;AACpE,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,aAAa,CAAA;AAEzC,MAAM,mBAAmB,GAAG,2BAA2B,CAAA;AAEvD,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAA;AAClF,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,YAAY,CAAC,cAAsB,EAAE,MAAc;IAChE,MAAM,OAAO,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAA;IAElD,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,CAAA;IACxC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAE5B,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,OAAO,CAAC,CAAA;IAC3C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,GAAG,CAAC,CAAC,CAAA;IAEhD,oEAAoE;IACpE,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAA;IAEpE,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAA;IACjC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CACvC,KAAK,EACL,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EACtB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EACjC,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAA;IAED,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,IAAI,UAAU,CAAC,SAAS,CAAC,MAAM,CAAC,CAAA;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;IAEhF,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAA;IACtF,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;AAC7B,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAA;IAE9B,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QAClC,IAAI,KAAK,KAAK,CAAC,CAAC;YAAE,SAAQ;QAC1B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,EAAE,CAAA;QAC3C,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACjC,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAA;QAChD,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAQD,MAAM,KAAK,GAAgB;IACzB,MAAM,EAAE,IAAI;IACZ,KAAK,EAAE,IAAI;IACX,SAAS,EAAE,IAAI;CAChB,CAAA;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAAC,OAAgB;IAC9D,MAAM,SAAS,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAA;IAC5C,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAA;IAE5B,MAAM,MAAM,GAAG,aAAa,EAAE,CAAA;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAA;IAEzB,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAA;IACnD,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAA;IAExB,MAAM,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC,CAAA;IAExB,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;SACnB,MAAM,CAAC;QACN,SAAS,EAAE,WAAW,CAAC,EAAE;QACzB,MAAM,EAAE,WAAW,CAAC,MAAM;QAC1B,KAAK,EAAE,QAAQ,CAAC,KAAK;KACtB,CAAC;SACD,IAAI,CAAC,WAAW,CAAC;SACjB,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;SACxD,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;SAC/E,KAAK,CAAC,CAAC,CAAC,CAAA;IAEX,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAA;IAEtB,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,MAAM;QAClB,KAAK,EAAE,GAAG,CAAC,KAAK;QAChB,SAAS,EAAE,GAAG,CAAC,SAAS;KACzB,CAAA;AACH,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+export type RouteContext = {
+    siteId?: string;
+    organizationType?: "live" | "sandbox" | null;
+};
+export declare function isStaticPath(pathname: string): boolean;
+export declare function isApiPath(_pathname: string): boolean;
+export declare function isPublicPath(pathname: string): boolean;
+export declare function attachOrganizationHeaders(headers: Headers, ctx: RouteContext): void;
+export type VoyantSubdomain = {
+    type: "booking" | "customer";
+    slug: string;
+    isLocal: boolean;
+};
+export declare function parseVoyantSubdomain(hostname: string): VoyantSubdomain | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,YAAY,GAAG;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAAA;CAC7C,CAAA;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,WAE5C;AAGD,wBAAgB,SAAS,CAAC,SAAS,EAAE,MAAM,WAG1C;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,WAI5C;AAED,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,QAG5E;AAED,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,SAAS,GAAG,UAAU,CAAA;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,OAAO,CAAA;CACjB,CAAA;AAED,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAwB7E"}

package/dist/index.js

@@ -0,0 +1,42 @@
+export function isStaticPath(pathname) {
+    return pathname.startsWith("/_next") || /\.(?:svg|png|jpg|jpeg|gif|webp|ico)$/.test(pathname);
+}
+// eslint-disable-next-line @typescript-eslint/no-unused-vars -- owner: auth; existing suppression is intentional pending typed cleanup.
+export function isApiPath(_pathname) {
+    // API routes should be evaluated by middleware for auth context propagation.
+    return false;
+}
+export function isPublicPath(pathname) {
+    return ["/login", "/auth", "/sign-in", "/sign-up", "/forgot-password", "/reset-password"].some((p) => pathname.startsWith(p));
+}
+export function attachOrganizationHeaders(headers, ctx) {
+    if (ctx.siteId)
+        headers.set("x-site-id", String(ctx.siteId));
+    if (ctx.organizationType)
+        headers.set("x-organization-type", ctx.organizationType);
+}
+export function parseVoyantSubdomain(hostname) {
+    const normalized = hostname.toLowerCase().split(":")[0] ?? "";
+    const prodMatch = normalized.match(/^([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.(booking|customer)\.voyantcloud\.app$/);
+    if (prodMatch?.[1] && prodMatch[2]) {
+        const slug = prodMatch[1];
+        const type = prodMatch[2];
+        if (slug.includes("--"))
+            return null;
+        return { type, slug, isLocal: false };
+    }
+    const localMatch = normalized.match(/^([a-z0-9](?:[a-z0-9-]*[a-z0-9])?)\.(booking|customer)\.localhost$/);
+    if (localMatch?.[1] && localMatch[2]) {
+        const slug = localMatch[1];
+        const type = localMatch[2];
+        if (slug.includes("--"))
+            return null;
+        return { type, slug, isLocal: true };
+    }
+    return null;
+}
+// NOTE: Do NOT re-export from ./server here.
+// Those modules import better-auth which uses dynamic code evaluation
+// (eval/new Function) incompatible with Edge Runtime middleware.
+// Import it directly: @voyant-travel/auth/server
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAKA,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,QAAQ,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,sCAAsC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;AAC/F,CAAC;AAED,wIAAwI;AACxI,MAAM,UAAU,SAAS,CAAC,SAAiB;IACzC,6EAA6E;IAC7E,OAAO,KAAK,CAAA;AACd,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,kBAAkB,EAAE,iBAAiB,CAAC,CAAC,IAAI,CAC5F,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAC9B,CAAA;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,OAAgB,EAAE,GAAiB;IAC3E,IAAI,GAAG,CAAC,MAAM;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAA;IAC5D,IAAI,GAAG,CAAC,gBAAgB;QAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAA;AACpF,CAAC;AAQD,MAAM,UAAU,oBAAoB,CAAC,QAAgB;IACnD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAA;IAE7D,MAAM,SAAS,GAAG,UAAU,CAAC,KAAK,CAChC,2EAA2E,CAC5E,CAAA;IACD,IAAI,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAA2B,CAAA;QACnD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAA;IACvC,CAAC;IAED,MAAM,UAAU,GAAG,UAAU,CAAC,KAAK,CACjC,oEAAoE,CACrE,CAAA;IACD,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;QAC1B,MAAM,IAAI,GAAG,UAAU,CAAC,CAAC,CAA2B,CAAA;QACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAA;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAA;IACtC,CAAC;IAED,OAAO,IAAI,CAAA;AACb,CAAC;AAED,6CAA6C;AAC7C,sEAAsE;AACtE,iEAAiE;AACjE,iDAAiD"}