@zauso-ai/capstan-auth 1.0.0-beta.7 → 1.0.0-beta.8

package/dist/execution.d.ts

@@ -0,0 +1,10 @@
+import type { ActorIdentity, DelegationLink, ExecutionIdentity, ExecutionKind } from "./types.js";
+export declare function createExecutionIdentity(kind: ExecutionKind, source: string, options?: {
+    parentId?: string;
+    metadata?: Record<string, unknown>;
+}): ExecutionIdentity;
+export declare function createRequestExecution(request: Request, options?: {
+    parentId?: string;
+}): ExecutionIdentity;
+export declare function createDelegationLink(from: ActorIdentity | ExecutionIdentity, to: ActorIdentity | ExecutionIdentity, reason: string, metadata?: Record<string, unknown>): DelegationLink;
+//# sourceMappingURL=execution.d.ts.map

package/dist/execution.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.d.ts","sourceRoot":"","sources":["../src/execution.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EAEd,iBAAiB,EACjB,aAAa,EACd,MAAM,YAAY,CAAC;AASpB,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,aAAa,EACnB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACpC,GACA,iBAAiB,CAQnB;AAED,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,OAAO,EAChB,OAAO,CAAC,EAAE;IACR,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,GACA,iBAAiB,CAoBnB;AASD,wBAAgB,oBAAoB,CAClC,IAAI,EAAE,aAAa,GAAG,iBAAiB,EACvC,EAAE,EAAE,aAAa,GAAG,iBAAiB,EACrC,MAAM,EAAE,MAAM,EACd,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,cAAc,CAWhB"}

package/dist/execution.js

@@ -0,0 +1,50 @@
+function buildExecutionId(kind, source) {
+    if (kind === "request") {
+        return source;
+    }
+    return `${kind}:${source}`;
+}
+export function createExecutionIdentity(kind, source, options) {
+    const execution = {
+        kind,
+        id: buildExecutionId(kind, source),
+    };
+    if (options?.parentId !== undefined)
+        execution.parentId = options.parentId;
+    if (options?.metadata !== undefined)
+        execution.metadata = options.metadata;
+    return execution;
+}
+export function createRequestExecution(request, options) {
+    const url = new URL(request.url);
+    const createOptions = {
+        metadata: {
+            method: request.method,
+            pathname: url.pathname,
+            origin: url.origin,
+        },
+    };
+    if (options?.parentId !== undefined) {
+        createOptions.parentId = options.parentId;
+    }
+    return createExecutionIdentity("request", `${request.method} ${url.pathname}`, createOptions);
+}
+function toTargetRef(target) {
+    return {
+        kind: target.kind,
+        id: target.id,
+    };
+}
+export function createDelegationLink(from, to, reason, metadata) {
+    const link = {
+        from: toTargetRef(from),
+        to: toTargetRef(to),
+        reason,
+        issuedAt: new Date().toISOString(),
+    };
+    if (metadata !== undefined) {
+        link.metadata = metadata;
+    }
+    return link;
+}
+//# sourceMappingURL=execution.js.map

package/dist/execution.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"execution.js","sourceRoot":"","sources":["../src/execution.ts"],"names":[],"mappings":"AAQA,SAAS,gBAAgB,CAAC,IAAmB,EAAE,MAAc;IAC3D,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,IAAI,IAAI,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,IAAmB,EACnB,MAAc,EACd,OAGC;IAED,MAAM,SAAS,GAAsB;QACnC,IAAI;QACJ,EAAE,EAAE,gBAAgB,CAAC,IAAI,EAAE,MAAM,CAAC;KACnC,CAAC;IACF,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3E,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS;QAAE,SAAS,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC3E,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,OAAgB,EAChB,OAEC;IAED,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,aAAa,GAGf;QACF,QAAQ,EAAE;YACR,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,GAAG,CAAC,QAAQ;YACtB,MAAM,EAAE,GAAG,CAAC,MAAM;SACnB;KACF,CAAC;IACF,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS,EAAE,CAAC;QACpC,aAAa,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAC5C,CAAC;IACD,OAAO,uBAAuB,CAC5B,SAAS,EACT,GAAG,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,EACnC,aAAa,CACd,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAyC;IAC5D,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,EAAE,EAAE,MAAM,CAAC,EAAE;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,IAAuC,EACvC,EAAqC,EACrC,MAAc,EACd,QAAkC;IAElC,MAAM,IAAI,GAAmB;QAC3B,IAAI,EAAE,WAAW,CAAC,IAAI,CAAC;QACvB,EAAE,EAAE,WAAW,CAAC,EAAE,CAAC;QACnB,MAAM;QACN,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACnC,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/harness-authorizer.d.ts

@@ -0,0 +1,10 @@
+import type { RuntimeGrantSupplier } from "./runtime-authorizer.js";
+import { type RuntimeGrantAuthorizationResult, type RuntimeGrantAuthorizerRequest } from "./runtime-authorizer.js";
+export interface HarnessGrantAuthorizationRequest {
+    action: string;
+    runId?: string;
+    detail?: Record<string, unknown>;
+}
+export declare function toRuntimeGrantRequest(request: HarnessGrantAuthorizationRequest): RuntimeGrantAuthorizerRequest;
+export declare function createHarnessGrantAuthorizer(supplier: RuntimeGrantSupplier): (request: HarnessGrantAuthorizationRequest) => Promise<RuntimeGrantAuthorizationResult>;
+//# sourceMappingURL=harness-authorizer.d.ts.map

package/dist/harness-authorizer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-authorizer.d.ts","sourceRoot":"","sources":["../src/harness-authorizer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAEL,KAAK,+BAA+B,EACpC,KAAK,6BAA6B,EACnC,MAAM,yBAAyB,CAAC;AAEjC,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAiGD,wBAAgB,qBAAqB,CACnC,OAAO,EAAE,gCAAgC,GACxC,6BAA6B,CAa/B;AAED,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,oBAAoB,IAIvE,SAAS,gCAAgC,KACxC,OAAO,CAAC,+BAA+B,CAAC,CAE5C"}

package/dist/harness-authorizer.js

@@ -0,0 +1,90 @@
+import { createRuntimeGrantAuthorizer, } from "./runtime-authorizer.js";
+function readString(source, key) {
+    const value = source?.[key];
+    return typeof value === "string" && value.trim().length > 0 ? value : undefined;
+}
+function readRecord(source, key) {
+    const value = source?.[key];
+    return value != null && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : undefined;
+}
+function deriveMemoryAttributes(detail) {
+    const kind = readString(detail, "kind");
+    if (kind === "session_memory") {
+        return { memoryKind: "session" };
+    }
+    if (kind === "persistent_memory") {
+        return { memoryKind: "persistent" };
+    }
+    const kinds = Array.isArray(detail?.["kinds"])
+        ? detail["kinds"].filter((entry) => typeof entry === "string")
+        : [];
+    if (kinds.length === 1 && kinds[0] === "session_memory") {
+        return { memoryKind: "session" };
+    }
+    if (kinds.length === 1 && kinds[0] === "persistent_memory") {
+        return { memoryKind: "persistent" };
+    }
+    return undefined;
+}
+function deriveApprovalAttributes(detail) {
+    const pendingApproval = readRecord(detail, "pendingApproval");
+    const directKind = readString(detail, "kind");
+    const nestedKind = readString(pendingApproval, "kind");
+    const approvalKind = directKind === "tool" || directKind === "task"
+        ? directKind
+        : nestedKind === "tool" || nestedKind === "task"
+            ? nestedKind
+            : undefined;
+    return approvalKind ? { approvalKind } : undefined;
+}
+function buildScope(request) {
+    if (request.action.endsWith(":list")) {
+        return request.runId ? { runId: request.runId } : undefined;
+    }
+    const detail = request.detail;
+    const pendingApproval = readRecord(detail, "pendingApproval");
+    const pendingToolCall = readRecord(detail, "pendingToolCall");
+    const scope = {};
+    if (request.runId) {
+        scope.runId = request.runId;
+    }
+    const scopedFields = [
+        ["approvalId", readString(detail, "approvalId") ?? readString(pendingApproval, "id")],
+        ["artifactId", readString(detail, "artifactId")],
+        ["memoryId", readString(detail, "memoryId")],
+        ["summaryId", readString(detail, "summaryId")],
+        ["taskId", readString(detail, "taskId")],
+        [
+            "tool",
+            readString(detail, "tool") ??
+                readString(pendingApproval, "tool") ??
+                readString(pendingToolCall, "tool"),
+        ],
+    ];
+    for (const [key, value] of scopedFields) {
+        if (value) {
+            scope[key] = value;
+        }
+    }
+    return Object.keys(scope).length > 0 ? scope : undefined;
+}
+export function toRuntimeGrantRequest(request) {
+    const detail = request.detail;
+    const attributes = {
+        ...(request.action.startsWith("memory:") ? deriveMemoryAttributes(detail) ?? {} : {}),
+        ...(request.action.startsWith("approval:") ? deriveApprovalAttributes(detail) ?? {} : {}),
+    };
+    const scope = buildScope(request);
+    return {
+        action: request.action,
+        ...(scope ? { scope } : {}),
+        ...(Object.keys(attributes).length > 0 ? { attributes } : {}),
+    };
+}
+export function createHarnessGrantAuthorizer(supplier) {
+    const runtimeAuthorizer = createRuntimeGrantAuthorizer(supplier);
+    return async (request) => runtimeAuthorizer(toRuntimeGrantRequest(request));
+}
+//# sourceMappingURL=harness-authorizer.js.map

package/dist/harness-authorizer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"harness-authorizer.js","sourceRoot":"","sources":["../src/harness-authorizer.ts"],"names":[],"mappings":"AACA,OAAO,EACL,4BAA4B,GAG7B,MAAM,yBAAyB,CAAC;AAQjC,SAAS,UAAU,CACjB,MAA2C,EAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAClF,CAAC;AAED,SAAS,UAAU,CACjB,MAA2C,EAC3C,GAAW;IAEX,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,KAAK,IAAI,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACxE,CAAC,CAAE,KAAiC;QACpC,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,sBAAsB,CAC7B,MAA2C;IAE3C,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,gBAAgB,EAAE,CAAC;QAC9B,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,IAAI,KAAK,mBAAmB,EAAE,CAAC;QACjC,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAC/E,CAAC,CAAC,EAAE,CAAC;IACP,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;QACxD,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,mBAAmB,EAAE,CAAC;QAC3D,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;IACtC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,wBAAwB,CAC/B,MAA2C;IAE3C,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,UAAU,GAAG,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACvD,MAAM,YAAY,GAChB,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM;QAC5C,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,UAAU,KAAK,MAAM,IAAI,UAAU,KAAK,MAAM;YAC9C,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACrD,CAAC;AAED,SAAS,UAAU,CACjB,OAAyC;IAEzC,IAAI,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,CAAC;IACD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,MAAM,eAAe,GAAG,UAAU,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAC9D,MAAM,KAAK,GAA2B,EAAE,CAAC;IAEzC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;QAClB,KAAK,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC9B,CAAC;IAED,MAAM,YAAY,GAAwC;QACxD,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,IAAI,UAAU,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;QACrF,CAAC,YAAY,EAAE,UAAU,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;QAChD,CAAC,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAC5C,CAAC,WAAW,EAAE,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC9C,CAAC,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxC;YACE,MAAM;YACN,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;gBACxB,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC;gBACnC,UAAU,CAAC,eAAe,EAAE,MAAM,CAAC;SACtC;KACF,CAAC;IAEF,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,YAAY,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,OAAyC;IAEzC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,MAAM,UAAU,GAAG;QACjB,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,sBAAsB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACrF,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,wBAAwB,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC1F,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO;QACL,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9D,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,QAA8B;IACzE,MAAM,iBAAiB,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAEjE,OAAO,KAAK,EACV,OAAyC,EACC,EAAE,CAC5C,iBAAiB,CAAC,qBAAqB,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC"}

package/dist/index.d.ts

@@ -1,12 +1,18 @@
 export { signSession, verifySession } from "./session.js";
 export { generateApiKey, verifyApiKey, extractApiKeyPrefix, } from "./api-key.js";
 export { createAuthMiddleware } from "./middleware.js";
-export { checkPermission, derivePermission } from "./permissions.js";
+export { authorizeGrant, checkGrant, checkPermission, derivePermission, normalizePermissionsToGrants, serializeGrantsToPermissions, } from "./permissions.js";
+export { createExecutionIdentity, createRequestExecution, createDelegationLink, } from "./execution.js";
+export { createGrant, grantRunActions, grantRunCollectionActions, grantApprovalActions, grantApprovalCollectionActions, grantEventActions, grantEventCollectionActions, grantArtifactActions, grantCheckpointActions, grantTaskActions, grantSummaryActions, grantSummaryCollectionActions, grantMemoryActions, grantContextActions, grantRuntimePathsActions, } from "./runtime-grants.js";
+export { deriveRuntimeGrantRequirements, authorizeRuntimeAction, createRuntimeGrantAuthorizer, } from "./runtime-authorizer.js";
+export { createHarnessGrantAuthorizer, toRuntimeGrantRequest, } from "./harness-authorizer.js";
 export { validateDpopProof, clearDpopReplayCache, setDpopReplayStore } from "./dpop.js";
 export { extractWorkloadIdentity, isValidSpiffeId } from "./workload.js";
 export { googleProvider, githubProvider, createOAuthHandlers, } from "./oauth.js";
 export type { DpopValidationResult } from "./dpop.js";
 export type { WorkloadIdentity } from "./workload.js";
 export type { OAuthProvider, OAuthConfig, OAuthHandlers } from "./oauth.js";
-export type { AuthConfig, SessionPayload, AgentCredential, AuthContext, AuthResolverDeps, } from "./types.js";
+export type { ActorIdentity, AuthConfig, SessionPayload, SessionSigningOptions, SessionVerificationOptions, AgentCredential, AuthEnvelope, AuthGrant, AuthGrantRequirement, AuthContext, AuthResolverDeps, CredentialProof, DelegationLink, ExecutionIdentity, } from "./types.js";
+export type { RuntimeGrantAuthorizerRequest, RuntimeGrantAuthorizationResult, RuntimeGrantSupplier, } from "./runtime-authorizer.js";
+export type { HarnessGrantAuthorizationRequest } from "./harness-authorizer.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EACV,UAAU,EACV,cAAc,EACd,eAAe,EACf,WAAW,EACX,gBAAgB,GACjB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,oBAAoB,EAAE,MAAM,WAAW,CAAC;AACtD,YAAY,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AACtD,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC5E,YAAY,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,qBAAqB,EACrB,0BAA0B,EAC1B,eAAe,EACf,YAAY,EACZ,SAAS,EACT,oBAAoB,EACpB,WAAW,EACX,gBAAgB,EAChB,eAAe,EACf,cAAc,EACd,iBAAiB,GAClB,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,6BAA6B,EAC7B,+BAA+B,EAC/B,oBAAoB,GACrB,MAAM,yBAAyB,CAAC;AACjC,YAAY,EAAE,gCAAgC,EAAE,MAAM,yBAAyB,CAAC"}

package/dist/index.js

@@ -1,7 +1,11 @@
 export { signSession, verifySession } from "./session.js";
 export { generateApiKey, verifyApiKey, extractApiKeyPrefix, } from "./api-key.js";
 export { createAuthMiddleware } from "./middleware.js";
-export { checkPermission, derivePermission } from "./permissions.js";
+export { authorizeGrant, checkGrant, checkPermission, derivePermission, normalizePermissionsToGrants, serializeGrantsToPermissions, } from "./permissions.js";
+export { createExecutionIdentity, createRequestExecution, createDelegationLink, } from "./execution.js";
+export { createGrant, grantRunActions, grantRunCollectionActions, grantApprovalActions, grantApprovalCollectionActions, grantEventActions, grantEventCollectionActions, grantArtifactActions, grantCheckpointActions, grantTaskActions, grantSummaryActions, grantSummaryCollectionActions, grantMemoryActions, grantContextActions, grantRuntimePathsActions, } from "./runtime-grants.js";
+export { deriveRuntimeGrantRequirements, authorizeRuntimeAction, createRuntimeGrantAuthorizer, } from "./runtime-authorizer.js";
+export { createHarnessGrantAuthorizer, toRuntimeGrantRequest, } from "./harness-authorizer.js";
 export { validateDpopProof, clearDpopReplayCache, setDpopReplayStore } from "./dpop.js";
 export { extractWorkloadIdentity, isValidSpiffeId } from "./workload.js";
 export { googleProvider, githubProvider, createOAuthHandlers, } from "./oauth.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EACL,cAAc,EACd,YAAY,EACZ,mBAAmB,GACpB,MAAM,cAAc,CAAC;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EACL,cAAc,EACd,UAAU,EACV,eAAe,EACf,gBAAgB,EAChB,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,uBAAuB,EACvB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,WAAW,EACX,eAAe,EACf,yBAAyB,EACzB,oBAAoB,EACpB,8BAA8B,EAC9B,iBAAiB,EACjB,2BAA2B,EAC3B,oBAAoB,EACpB,sBAAsB,EACtB,gBAAgB,EAChB,mBAAmB,EACnB,6BAA6B,EAC7B,kBAAkB,EAClB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,8BAA8B,EAC9B,sBAAsB,EACtB,4BAA4B,GAC7B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EACL,4BAA4B,EAC5B,qBAAqB,GACtB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACzE,OAAO,EACL,cAAc,EACd,cAAc,EACd,mBAAmB,GACpB,MAAM,YAAY,CAAC"}

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EACX,gBAAgB,EACjB,MAAM,YAAY,CAAC;AA6BpB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,gBAAgB,GACrB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAyG5C"}
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,UAAU,EACV,WAAW,EAGX,gBAAgB,EAEjB,MAAM,YAAY,CAAC;AA6CpB;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,gBAAgB,GACrB,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,WAAW,CAAC,CAiP5C"}

package/dist/middleware.js

@@ -2,11 +2,24 @@ import { verifySession } from "./session.js";
 import { verifyApiKey, extractApiKeyPrefix } from "./api-key.js";
 import { validateDpopProof } from "./dpop.js";
 import { extractWorkloadIdentity } from "./workload.js";
-const SESSION_COOKIE_NAME = "capstan_session";
+import { normalizePermissionsToGrants, serializeGrantsToPermissions, } from "./permissions.js";
+import { createRequestExecution } from "./execution.js";
 const DEFAULT_API_KEY_PREFIX = "cap_ak_";
 const ANONYMOUS_CONTEXT = {
     isAuthenticated: false,
     type: "anonymous",
+    actor: {
+        kind: "anonymous",
+        id: "anonymous",
+        displayName: "Anonymous",
+    },
+    credential: {
+        kind: "anonymous",
+        subjectId: "anonymous",
+        presentedAt: new Date(0).toISOString(),
+    },
+    delegation: [],
+    grants: [],
 };
 // ── Cookie helpers ─────────────────────────────────────────────────
 function parseCookies(header) {
@@ -40,6 +53,47 @@ export function createAuthMiddleware(config, deps) {
     const apiKeyPrefix = config.apiKeys?.prefix ?? DEFAULT_API_KEY_PREFIX;
     const authHeaderName = config.apiKeys?.headerName ?? "Authorization";
     const trustedDomains = config.trustedDomains ?? [];
+    const sessionCookieName = config.session.cookieName ?? "capstan_session";
+    function syncEnvelope(authCtx) {
+        const envelope = {
+            actor: authCtx.actor,
+            credential: authCtx.credential,
+            delegation: authCtx.delegation,
+            grants: authCtx.grants,
+        };
+        if (authCtx.execution !== undefined) {
+            envelope.execution = authCtx.execution;
+        }
+        authCtx.envelope = envelope;
+        return authCtx;
+    }
+    async function enrichContext(authCtx, request) {
+        const extraGrants = await deps.resolveAdditionalGrants?.(authCtx, request);
+        if (extraGrants && extraGrants.length > 0) {
+            authCtx.grants = [...authCtx.grants, ...normalizePermissionsToGrants(extraGrants)];
+            authCtx.permissions = serializeGrantsToPermissions(authCtx.grants);
+        }
+        const execution = (await deps.resolveExecution?.(authCtx, request)) ??
+            createRequestExecution(request);
+        authCtx.execution = execution;
+        const delegation = await deps.resolveDelegation?.(authCtx, request);
+        if (delegation && delegation.length > 0) {
+            authCtx.delegation = delegation;
+        }
+        return syncEnvelope(authCtx);
+    }
+    function createCredential(kind, subjectId, options) {
+        const credential = {
+            kind,
+            subjectId,
+            presentedAt: new Date().toISOString(),
+        };
+        if (options?.expiresAt !== undefined)
+            credential.expiresAt = options.expiresAt;
+        if (options?.metadata !== undefined)
+            credential.metadata = options.metadata;
+        return credential;
+    }
     return async (request) => {
         let authCtx;
         let accessToken;
@@ -54,6 +108,20 @@ export function createAuthMiddleware(config, deps) {
                 authCtx = {
                     isAuthenticated: true,
                     type: "workload",
+                    actor: {
+                        kind: "workload",
+                        id: identity.spiffeId,
+                        displayName: identity.workloadPath,
+                    },
+                    credential: createCredential("mtls", identity.spiffeId, {
+                        metadata: {
+                            certFingerprint: identity.certFingerprint,
+                            trustDomain: identity.trustDomain,
+                            workloadPath: identity.workloadPath,
+                        },
+                    }),
+                    delegation: [],
+                    grants: [],
                     spiffeId: identity.spiffeId,
                     certFingerprint: identity.certFingerprint,
                 };
@@ -63,19 +131,52 @@ export function createAuthMiddleware(config, deps) {
         const cookieHeader = request.headers.get("cookie");
         if (!authCtx && cookieHeader) {
             const cookies = parseCookies(cookieHeader);
-            const sessionToken = cookies.get(SESSION_COOKIE_NAME);
+            const sessionToken = cookies.get(sessionCookieName);
             if (sessionToken) {
-                const payload = verifySession(sessionToken, config.session.secret);
+                const payload = verifySession(sessionToken, config.session.secret, {
+                    ...(config.session.issuer !== undefined
+                        ? { issuer: config.session.issuer }
+                        : {}),
+                    ...(config.session.audience !== undefined
+                        ? { audience: config.session.audience }
+                        : {}),
+                });
                 if (payload) {
+                    const grants = normalizePermissionsToGrants(payload.permissions ?? []);
                     const ctx = {
                         isAuthenticated: true,
                         type: "human",
+                        actor: {
+                            kind: "user",
+                            id: payload.userId,
+                            ...(payload.displayName !== undefined
+                                ? { displayName: payload.displayName }
+                                : {}),
+                            ...(payload.role !== undefined ? { role: payload.role } : {}),
+                            ...(payload.email !== undefined ? { email: payload.email } : {}),
+                            ...(payload.claims !== undefined ? { claims: payload.claims } : {}),
+                        },
+                        credential: createCredential("session", payload.userId, {
+                            expiresAt: new Date(payload.exp * 1000).toISOString(),
+                            metadata: {
+                                issuedAt: new Date(payload.iat * 1000).toISOString(),
+                                ...(payload.sessionId !== undefined
+                                    ? { sessionId: payload.sessionId }
+                                    : {}),
+                                ...(payload.iss !== undefined ? { issuer: payload.iss } : {}),
+                                ...(payload.aud !== undefined ? { audience: payload.aud } : {}),
+                            },
+                        }),
+                        delegation: [],
+                        grants,
                         userId: payload.userId,
                     };
                     if (payload.role !== undefined)
                         ctx.role = payload.role;
                     if (payload.email !== undefined)
                         ctx.email = payload.email;
+                    if (payload.permissions !== undefined)
+                        ctx.permissions = [...payload.permissions];
                     authCtx = ctx;
                     accessToken = sessionToken;
                 }
@@ -96,12 +197,27 @@ export function createAuthMiddleware(config, deps) {
                     if (credential && !credential.revokedAt) {
                         const valid = await verifyApiKey(token, credential.apiKeyHash);
                         if (valid) {
+                            const grants = normalizePermissionsToGrants([
+                                ...credential.permissions,
+                                ...(credential.grants ?? []),
+                            ]);
                             authCtx = {
                                 isAuthenticated: true,
                                 type: "agent",
+                                actor: {
+                                    kind: "agent",
+                                    id: credential.id,
+                                    displayName: credential.name,
+                                    ...(credential.claims !== undefined
+                                        ? { claims: credential.claims }
+                                        : {}),
+                                },
+                                credential: createCredential("api_key", credential.id),
+                                delegation: [],
+                                grants,
                                 agentId: credential.id,
                                 agentName: credential.name,
-                                permissions: credential.permissions,
+                                permissions: serializeGrantsToPermissions(grants),
                             };
                             accessToken = token;
                         }
@@ -118,13 +234,32 @@ export function createAuthMiddleware(config, deps) {
             const result = await validateDpopProof(dpopHeader, request.method, request.url, accessToken);
             if (!result) {
                 // DPoP proof failed validation — treat as unauthenticated.
-                return ANONYMOUS_CONTEXT;
+                return syncEnvelope({ ...ANONYMOUS_CONTEXT });
             }
             // Bind the DPoP thumbprint to the auth context.
             authCtx.dpopThumbprint = result.thumbprint;
+            authCtx.credential = createCredential("dpop", authCtx.actor.id, {
+                ...(authCtx.credential.expiresAt !== undefined
+                    ? { expiresAt: authCtx.credential.expiresAt }
+                    : {}),
+                metadata: {
+                    ...(authCtx.credential.metadata ?? {}),
+                    thumbprint: result.thumbprint,
+                    boundCredentialKind: authCtx.credential.kind,
+                },
+            });
         }
         // ── 5. Anonymous ─────────────────────────────────────────────
-        return authCtx ?? ANONYMOUS_CONTEXT;
+        if (!authCtx) {
+            return enrichContext({
+                ...ANONYMOUS_CONTEXT,
+                credential: {
+                    ...ANONYMOUS_CONTEXT.credential,
+                    presentedAt: new Date().toISOString(),
+                },
+            }, request);
+        }
+        return enrichContext(authCtx, request);
     };
 }
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AAExD,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AAC9C,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,iBAAiB,GAAgB;IACrC,eAAe,EAAE,KAAK;IACtB,IAAI,EAAE,WAAW;CAClB,CAAC;AAEF,sEAAsE;AAEtE,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,IAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,eAAe,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IAEnD,OAAO,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACtD,IAAI,OAAgC,CAAC;QACrC,IAAI,WAA+B,CAAC;QAEpC,gEAAgE;QAChE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAuC,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG;oBACR,eAAe,EAAE,IAAI;oBACrB,IAAI,EAAE,UAAU;oBAChB,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;YAEtD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;gBACnE,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,GAAG,GAAgB;wBACvB,eAAe,EAAE,IAAI;wBACrB,IAAI,EAAE,OAAO;wBACb,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;oBACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;wBAAE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;oBACxD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;wBAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;oBAC3D,OAAO,GAAG,GAAG,CAAC;oBACd,WAAW,GAAG,YAAY,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC9B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;wBACrB,CAAC,CAAC,IAAI,CAAC;gBAEX,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;oBAE3D,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;wBACxC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;wBAC/D,IAAI,KAAK,EAAE,CAAC;4BACV,OAAO,GAAG;gCACR,eAAe,EAAE,IAAI;gCACrB,IAAI,EAAE,OAAO;gCACb,OAAO,EAAE,UAAU,CAAC,EAAE;gCACtB,SAAS,EAAE,UAAU,CAAC,IAAI;gCAC1B,WAAW,EAAE,UAAU,CAAC,WAAW;6BACpC,CAAC;4BACF,WAAW,GAAG,KAAK,CAAC;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,UAAU,EACV,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,EACX,WAAW,CACZ,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2DAA2D;gBAC3D,OAAO,iBAAiB,CAAC;YAC3B,CAAC;YAED,gDAAgD;YAChD,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;QAC7C,CAAC;QAED,gEAAgE;QAChE,OAAO,OAAO,IAAI,iBAAiB,CAAC;IACtC,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,cAAc,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,EACL,4BAA4B,EAC5B,4BAA4B,GAC7B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,sBAAsB,GAAG,SAAS,CAAC;AACzC,MAAM,iBAAiB,GAAgB;IACrC,eAAe,EAAE,KAAK;IACtB,IAAI,EAAE,WAAW;IACjB,KAAK,EAAE;QACL,IAAI,EAAE,WAAW;QACjB,EAAE,EAAE,WAAW;QACf,WAAW,EAAE,WAAW;KACzB;IACD,UAAU,EAAE;QACV,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;KACvC;IACD,UAAU,EAAE,EAAE;IACd,MAAM,EAAE,EAAE;CACX,CAAC;AAEF,sEAAsE;AAEtE,SAAS,YAAY,CAAC,MAAc;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,uEAAuE;AAEvE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,oBAAoB,CAClC,MAAkB,EAClB,IAAsB;IAEtB,MAAM,YAAY,GAAG,MAAM,CAAC,OAAO,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACtE,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,eAAe,CAAC;IACrE,MAAM,cAAc,GAAG,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC;IACnD,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,IAAI,iBAAiB,CAAC;IAEzE,SAAS,YAAY,CAAC,OAAoB;QACxC,MAAM,QAAQ,GAAiB;YAC7B,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,UAAU,EAAE,OAAO,CAAC,UAAU;YAC9B,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC;QACF,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,QAAQ,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAC5B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,UAAU,aAAa,CAC1B,OAAoB,EACpB,OAAgB;QAEhB,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,uBAAuB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAC3E,IAAI,WAAW,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1C,OAAO,CAAC,MAAM,GAAG,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC,CAAC;YACnF,OAAO,CAAC,WAAW,GAAG,4BAA4B,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QACrE,CAAC;QACD,MAAM,SAAS,GACb,CAAC,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACjD,sBAAsB,CAAC,OAAO,CAAC,CAAC;QAClC,OAAO,CAAC,SAAS,GAAG,SAAS,CAAC;QAC9B,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACpE,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,CAAC,UAAU,GAAG,UAAU,CAAC;QAClC,CAAC;QACD,OAAO,YAAY,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,SAAS,gBAAgB,CACvB,IAA6B,EAC7B,SAAiB,EACjB,OAGC;QAED,MAAM,UAAU,GAAoB;YAClC,IAAI;YACJ,SAAS;YACT,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC;QACF,IAAI,OAAO,EAAE,SAAS,KAAK,SAAS;YAAE,UAAU,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/E,IAAI,OAAO,EAAE,QAAQ,KAAK,SAAS;YAAE,UAAU,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QAC5E,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,KAAK,EAAE,OAAgB,EAAwB,EAAE;QACtD,IAAI,OAAgC,CAAC;QACrC,IAAI,WAA+B,CAAC;QAEpC,gEAAgE;QAChE,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,OAAO,GAAuC,EAAE,CAAC;YACvD,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC;gBACrD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,CAAC;YAED,MAAM,QAAQ,GAAG,uBAAuB,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;YAClE,IAAI,QAAQ,EAAE,CAAC;gBACb,OAAO,GAAG;oBACR,eAAe,EAAE,IAAI;oBACrB,IAAI,EAAE,UAAU;oBAChB,KAAK,EAAE;wBACL,IAAI,EAAE,UAAU;wBAChB,EAAE,EAAE,QAAQ,CAAC,QAAQ;wBACrB,WAAW,EAAE,QAAQ,CAAC,YAAY;qBACnC;oBACD,UAAU,EAAE,gBAAgB,CAAC,MAAM,EAAE,QAAQ,CAAC,QAAQ,EAAE;wBACtD,QAAQ,EAAE;4BACR,eAAe,EAAE,QAAQ,CAAC,eAAe;4BACzC,WAAW,EAAE,QAAQ,CAAC,WAAW;4BACjC,YAAY,EAAE,QAAQ,CAAC,YAAY;yBACpC;qBACF,CAAC;oBACF,UAAU,EAAE,EAAE;oBACd,MAAM,EAAE,EAAE;oBACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;oBAC3B,eAAe,EAAE,QAAQ,CAAC,eAAe;iBAC1C,CAAC;YACJ,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,YAAY,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;YAC3C,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YAEpD,IAAI,YAAY,EAAE,CAAC;gBACjB,MAAM,OAAO,GAAG,aAAa,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;oBACjE,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS;wBACrC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE;wBACnC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,SAAS;wBACvC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE;wBACvC,CAAC,CAAC,EAAE,CAAC;iBACR,CAAC,CAAC;gBACH,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,MAAM,GAAG,4BAA4B,CAAC,OAAO,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;oBACvE,MAAM,GAAG,GAAgB;wBACvB,eAAe,EAAE,IAAI;wBACrB,IAAI,EAAE,OAAO;wBACb,KAAK,EAAE;4BACL,IAAI,EAAE,MAAM;4BACZ,EAAE,EAAE,OAAO,CAAC,MAAM;4BAClB,GAAG,CAAC,OAAO,CAAC,WAAW,KAAK,SAAS;gCACnC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE;gCACtC,CAAC,CAAC,EAAE,CAAC;4BACP,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAC7D,GAAG,CAAC,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;4BAChE,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACpE;wBACD,UAAU,EAAE,gBAAgB,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE;4BACtD,SAAS,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;4BACrD,QAAQ,EAAE;gCACR,QAAQ,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE;gCACpD,GAAG,CAAC,OAAO,CAAC,SAAS,KAAK,SAAS;oCACjC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE;oCAClC,CAAC,CAAC,EAAE,CAAC;gCACP,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gCAC7D,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;6BAChE;yBACF,CAAC;wBACF,UAAU,EAAE,EAAE;wBACd,MAAM;wBACN,MAAM,EAAE,OAAO,CAAC,MAAM;qBACvB,CAAC;oBACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;wBAAE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC;oBACxD,IAAI,OAAO,CAAC,KAAK,KAAK,SAAS;wBAAE,GAAG,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;oBAC3D,IAAI,OAAO,CAAC,WAAW,KAAK,SAAS;wBAAE,GAAG,CAAC,WAAW,GAAG,CAAC,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;oBAClF,OAAO,GAAG,GAAG,CAAC;oBACd,WAAW,GAAG,YAAY,CAAC;gBAC7B,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,KAAK,GAAG,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;oBAC5C,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;oBACrB,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC;wBAC9B,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;wBACrB,CAAC,CAAC,IAAI,CAAC;gBAEX,IAAI,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACzE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;oBAC1C,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC;oBAE3D,IAAI,UAAU,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC;wBACxC,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,KAAK,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC;wBAC/D,IAAI,KAAK,EAAE,CAAC;4BACV,MAAM,MAAM,GAAG,4BAA4B,CAAC;gCAC1C,GAAG,UAAU,CAAC,WAAW;gCACzB,GAAG,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,CAAC;6BAC7B,CAAC,CAAC;4BACH,OAAO,GAAG;gCACR,eAAe,EAAE,IAAI;gCACrB,IAAI,EAAE,OAAO;gCACb,KAAK,EAAE;oCACL,IAAI,EAAE,OAAO;oCACb,EAAE,EAAE,UAAU,CAAC,EAAE;oCACjB,WAAW,EAAE,UAAU,CAAC,IAAI;oCAC5B,GAAG,CAAC,UAAU,CAAC,MAAM,KAAK,SAAS;wCACjC,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE;wCAC/B,CAAC,CAAC,EAAE,CAAC;iCACR;gCACD,UAAU,EAAE,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,CAAC;gCACtD,UAAU,EAAE,EAAE;gCACd,MAAM;gCACN,OAAO,EAAE,UAAU,CAAC,EAAE;gCACtB,SAAS,EAAE,UAAU,CAAC,IAAI;gCAC1B,WAAW,EAAE,4BAA4B,CAAC,MAAM,CAAC;6BAClD,CAAC;4BACF,WAAW,GAAG,KAAK,CAAC;wBACtB,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gEAAgE;QAChE,+DAA+D;QAC/D,gEAAgE;QAChE,gEAAgE;QAChE,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,UAAU,IAAI,OAAO,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CACpC,UAAU,EACV,OAAO,CAAC,MAAM,EACd,OAAO,CAAC,GAAG,EACX,WAAW,CACZ,CAAC;YAEF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,2DAA2D;gBAC3D,OAAO,YAAY,CAAC,EAAE,GAAG,iBAAiB,EAAE,CAAC,CAAC;YAChD,CAAC;YAED,gDAAgD;YAChD,OAAO,CAAC,cAAc,GAAG,MAAM,CAAC,UAAU,CAAC;YAC3C,OAAO,CAAC,UAAU,GAAG,gBAAgB,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,EAAE;gBAC9D,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,SAAS,KAAK,SAAS;oBAC5C,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,UAAU,CAAC,SAAS,EAAE;oBAC7C,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,EAAE;oBACR,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,IAAI,EAAE,CAAC;oBACtC,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,mBAAmB,EAAE,OAAO,CAAC,UAAU,CAAC,IAAI;iBAC7C;aACF,CAAC,CAAC;QACL,CAAC;QAED,gEAAgE;QAChE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO,aAAa,CAClB;gBACE,GAAG,iBAAiB;gBACpB,UAAU,EAAE;oBACV,GAAG,iBAAiB,CAAC,UAAU;oBAC/B,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACtC;aACF,EACD,OAAO,CACR,CAAC;QACJ,CAAC;QACD,OAAO,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC,CAAC;AACJ,CAAC"}

package/dist/oauth.d.ts

@@ -1,3 +1,4 @@
+import type { AuthCookieConfig } from "./types.js";
 export interface OAuthProvider {
     name: string;
     authorizeUrl: string;
@@ -10,7 +11,15 @@ export interface OAuthProvider {
 export interface OAuthConfig {
     providers: OAuthProvider[];
     callbackPath?: string;
-    sessionSecret: string;
+    sessionSecret?: string;
+    session?: {
+        secret?: string;
+        maxAge?: string;
+        cookieName?: string;
+        cookie?: AuthCookieConfig;
+    };
+    successRedirectPath?: string;
+    stateCookieName?: string;
 }
 /** Pre-built Google OAuth provider */
 export declare function googleProvider(opts: {

package/dist/oauth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;CACvB;AAkBD,sCAAsC;AACtC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,aAAa,CAUhB;AAED,sCAAsC;AACtC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,aAAa,CAUhB;AAyBD,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,QAAQ,CAAC;IAC5D,iEAAiE;IACjE,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,aAAa,CAyKf"}
+{"version":3,"file":"oauth.d.ts","sourceRoot":"","sources":["../src/oauth.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAInD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,aAAa,EAAE,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,MAAM,CAAC,EAAE,gBAAgB,CAAC;KAC3B,CAAC;IACF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAkBD,sCAAsC;AACtC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,aAAa,CAUhB;AAED,sCAAsC;AACtC,wBAAgB,cAAc,CAAC,IAAI,EAAE;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;CACtB,GAAG,aAAa,CAUhB;AAwCD,MAAM,WAAW,aAAa;IAC5B,6DAA6D;IAC7D,KAAK,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,KAAK,QAAQ,CAAC;IAC5D,iEAAiE;IACjE,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;CACnD;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,WAAW,EACnB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,aAAa,CA4Lf"}

package/dist/oauth.js

@@ -43,6 +43,20 @@ function parseCookies(header) {
     }
     return cookies;
 }
+function buildCookie(name, value, options) {
+    const parts = [`${name}=${value}`];
+    parts.push(`Path=${options?.path ?? "/"}`);
+    if (options?.domain)
+        parts.push(`Domain=${options.domain}`);
+    if (options?.httpOnly !== false)
+        parts.push("HttpOnly");
+    parts.push(`SameSite=${options?.sameSite ?? "Lax"}`);
+    if (options?.secure)
+        parts.push("Secure");
+    if (options?.maxAge !== undefined)
+        parts.push(`Max-Age=${options.maxAge}`);
+    return parts.join("; ");
+}
 /**
  * Create OAuth route handlers.
  * Returns handlers for:
@@ -51,6 +65,13 @@ function parseCookies(header) {
  */
 export function createOAuthHandlers(config, fetchFn = globalThis.fetch) {
     const callbackPath = config.callbackPath ?? "/auth/callback";
+    const stateCookieName = config.stateCookieName ?? "capstan_oauth_state";
+    const sessionCookieName = config.session?.cookieName ?? "capstan_session";
+    const resolvedSessionSecret = config.session?.secret ?? config.sessionSecret;
+    if (!resolvedSessionSecret) {
+        throw new Error("OAuthConfig requires session.secret or sessionSecret");
+    }
+    const sessionSecret = resolvedSessionSecret;
     const providerMap = new Map();
     for (const p of config.providers) {
         providerMap.set(p.name, p);
@@ -73,7 +94,9 @@ export function createOAuthHandlers(config, fetchFn = globalThis.fetch) {
             status: 302,
             headers: {
                 location: authorizeUrl.toString(),
-                "set-cookie": `capstan_oauth_state=${providerName}:${state}; Path=/; HttpOnly; SameSite=Lax; Max-Age=600`,
+                "set-cookie": buildCookie(stateCookieName, `${providerName}:${state}`, {
+                    maxAge: 600,
+                }),
             },
         });
     }
@@ -87,7 +110,7 @@ export function createOAuthHandlers(config, fetchFn = globalThis.fetch) {
         // Validate state against cookie
         const cookieHeader = request.headers.get("cookie") ?? "";
         const cookies = parseCookies(cookieHeader);
-        const storedState = cookies.get("capstan_oauth_state");
+        const storedState = cookies.get(stateCookieName);
         if (!storedState || storedState !== stateParam) {
             return new Response(JSON.stringify({ error: "Invalid state parameter" }), { status: 403, headers: { "content-type": "application/json" } });
         }
@@ -151,17 +174,23 @@ export function createOAuthHandlers(config, fetchFn = globalThis.fetch) {
         const userId = userInfo.sub ?? userInfo.id?.toString() ?? userInfo.login ?? "unknown";
         const sessionData = {
             userId: `${providerName}:${userId}`,
+            ...(userInfo.name !== undefined ? { displayName: userInfo.name } : {}),
         };
         if (userInfo.email !== undefined) {
             sessionData.email = userInfo.email;
         }
-        const sessionToken = signSession(sessionData, config.sessionSecret);
+        const sessionToken = signSession(sessionData, sessionSecret, config.session?.maxAge !== undefined
+            ? { maxAge: config.session.maxAge }
+            : undefined);
         // Set session cookie and redirect to /
         return new Response(null, {
             status: 302,
             headers: {
-                location: "/",
-                "set-cookie": `capstan_session=${sessionToken}; Path=/; HttpOnly; SameSite=Lax; Max-Age=604800`,
+                location: config.successRedirectPath ?? "/",
+                "set-cookie": buildCookie(sessionCookieName, sessionToken, {
+                    ...(config.session?.cookie ?? {}),
+                    maxAge: 604800,
+                }),
             },
         });
     }