@~lyre/auth 0.0.4

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Britam Trust Services / Lyre
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,59 @@
+# @~lyre/auth
+
+Shared **Axis Accounts** auth SDK. A small, framework-agnostic core for session
+and identity handling (HMAC-signed cookies, the accounts login → callback →
+logout exchange, tenant resolution), plus an optional turnkey **SvelteKit**
+adapter that wires it all up in a few lines.
+
+Ships as raw TypeScript source.
+
+## Install
+
+```bash
+pnpm add @~lyre/auth        # or: npm i / yarn add
+```
+
+## Entry points
+
+### `@~lyre/auth` — framework-agnostic core
+
+Session, identity and accounts primitives — usable from any Node runtime:
+
+```ts
+import {
+  createPlatformAuth,
+  beginAccountsLoginRedirect,
+  handleAccountsCallback,
+  readPlatformSessionCookie,
+  clearPlatformSessionCookie,
+  resolveActiveTenant,
+  syncAccountsUser,
+  type PlatformSession,
+  type AccountsIdentity,
+} from '@~lyre/auth';
+```
+
+The core depends only on `node:crypto` — no framework required.
+
+### `@~lyre/auth/sveltekit` — turnkey SvelteKit adapter
+
+A single `handle` that reads the session into `event.locals`, serves
+`/auth/login`, `/auth/callback` and `/auth/logout` inline (no route files), and
+optionally gates protected paths:
+
+```ts
+// src/hooks.server.ts
+import { createAuthHandle } from '@~lyre/auth/sveltekit';
+
+export const handle = createAuthHandle({
+  // ...SvelteKitAuthOptions
+});
+```
+
+`@sveltejs/kit` is an **optional peer dependency** — only required if you import
+the `/sveltekit` entry.
+
+## Publishing
+
+See [PUBLISHING.md](PUBLISHING.md). Published to npm via GitHub Actions Trusted
+Publishing on version bump.

package/dist/chunk-R3JOX2XR.js

@@ -0,0 +1,246 @@
+// src/index.ts
+import { createHmac, timingSafeEqual } from "crypto";
+var SESSION_COOKIE_NAME = "platform_session";
+var STATE_COOKIE_NAME = "accounts_auth_state";
+function createAccountsClientConfig(input = {}) {
+  return {
+    baseUrl: input.baseUrl ?? process.env.ACCOUNTS_BASE_URL,
+    clientId: input.clientId ?? process.env.ACCOUNTS_CLIENT_ID ?? "accounts-app",
+    clientSecret: input.clientSecret ?? process.env.ACCOUNTS_CLIENT_SECRET,
+    redirectUri: input.redirectUri ?? process.env.ACCOUNTS_REDIRECT_URI ?? "http://localhost:5173/auth/callback",
+    logoutRedirectUri: input.logoutRedirectUri ?? process.env.ACCOUNTS_LOGOUT_REDIRECT_URI ?? "http://localhost:5173/",
+    useMock: input.useMock ?? (process.env.ACCOUNTS_USE_MOCK === "true" || !process.env.ACCOUNTS_BASE_URL || !process.env.ACCOUNTS_CLIENT_ID)
+  };
+}
+function createPlatformAuth() {
+  return {
+    readSession(cookieHeader) {
+      return readPlatformSessionCookie(cookieHeader);
+    },
+    requirePrincipal(session) {
+      if (!session.principal) {
+        throw new Error("Authentication required.");
+      }
+      return session.principal;
+    }
+  };
+}
+function beginAccountsLoginRedirect(config, options) {
+  const nonce = globalThis.crypto?.randomUUID?.() ?? Math.random().toString(36).slice(2);
+  const state = {
+    nonce,
+    nextPath: options.nextPath && options.nextPath.startsWith("/") ? options.nextPath : "/",
+    tenantSlug: options.tenantSlug
+  };
+  if (config.useMock) {
+    const redirectUrl = new URL(config.redirectUri);
+    redirectUrl.searchParams.set("code", `demo_${nonce}`);
+    redirectUrl.searchParams.set("state", serializeAuthorizationState(state));
+    return {
+      redirectUrl: redirectUrl.toString(),
+      stateValue: serializeAuthorizationState(state),
+      stateCookie: createStateCookie(serializeAuthorizationState(state), options.cookieOptions)
+    };
+  }
+  const authorizeUrl = new URL("/auth/authorize", config.baseUrl);
+  authorizeUrl.searchParams.set("app_id", config.clientId);
+  authorizeUrl.searchParams.set("redirect_uri", config.redirectUri);
+  authorizeUrl.searchParams.set("state", serializeAuthorizationState(state));
+  return {
+    redirectUrl: authorizeUrl.toString(),
+    stateValue: serializeAuthorizationState(state),
+    stateCookie: createStateCookie(serializeAuthorizationState(state))
+  };
+}
+async function handleAccountsCallback(input) {
+  if (!input.code) {
+    throw new Error("Missing authorization code.");
+  }
+  if (input.storedState && input.state !== input.storedState) {
+    throw new Error("Invalid authorization state.");
+  }
+  const parsedState = parseAuthorizationState(input.state);
+  const tokenResponse = await exchangeAuthorizationCode({
+    config: input.config,
+    code: input.code,
+    fetchImpl: input.fetchImpl
+  });
+  const identity = normalizeIdentity(tokenResponse.user);
+  const local = await input.syncAccountsUser(identity);
+  const session = {
+    principal: {
+      identity,
+      user: local.user,
+      tenantAccess: {
+        activeTenantId: local.activeTenantId,
+        memberships: local.memberships
+      }
+    },
+    tenant: null,
+    accessToken: tokenResponse.access_token,
+    refreshToken: tokenResponse.refresh_token,
+    expiresAt: new Date(Date.now() + tokenResponse.expires_in * 1e3).toISOString()
+  };
+  return {
+    session,
+    nextPath: parsedState.nextPath,
+    tenantSlug: parsedState.tenantSlug,
+    sessionCookie: createSessionCookie(session, input.cookieOptions, input.secret),
+    clearStateCookie: clearStateCookie(input.cookieOptions)
+  };
+}
+async function exchangeAuthorizationCode(input) {
+  if (input.config.useMock || input.code.startsWith("demo_")) {
+    return createMockTokenResponse(input.code);
+  }
+  const fetchImpl = input.fetchImpl ?? fetch;
+  const response = await fetchImpl(new URL("/api/auth/token", input.config.baseUrl), {
+    method: "POST",
+    headers: {
+      "content-type": "application/json"
+    },
+    body: JSON.stringify({
+      grant_type: "authorization_code",
+      code: input.code,
+      redirect_uri: input.config.redirectUri,
+      client_id: input.config.clientId,
+      client_secret: input.config.clientSecret
+    })
+  });
+  if (!response.ok) {
+    throw new Error(`Accounts token exchange failed with status ${response.status}.`);
+  }
+  return await response.json();
+}
+function syncAccountsUser(identity, syncer) {
+  return syncer(identity);
+}
+var identityPassthroughSync = (identity) => ({
+  user: {
+    id: identity.id,
+    externalIdentityId: identity.id,
+    email: identity.email,
+    name: identity.name,
+    firstName: identity.firstName,
+    lastName: identity.lastName
+  },
+  memberships: []
+});
+function resolveActiveTenant(memberships, preferredTenantId) {
+  if (preferredTenantId && memberships.some((membership) => membership.tenantId === preferredTenantId)) {
+    return preferredTenantId;
+  }
+  return memberships.find((membership) => membership.isDefault)?.tenantId ?? memberships[0]?.tenantId;
+}
+function readPlatformSessionCookie(cookieHeader, opts) {
+  const cookieValue = readCookie(cookieHeader, SESSION_COOKIE_NAME);
+  if (!cookieValue) {
+    return { principal: null, tenant: null };
+  }
+  let raw = cookieValue;
+  if (opts?.secret) {
+    const verified = unsignValue(cookieValue, opts.secret);
+    if (verified == null) return { principal: null, tenant: null };
+    raw = verified;
+  }
+  try {
+    return JSON.parse(decodeURIComponent(raw));
+  } catch {
+    return { principal: null, tenant: null };
+  }
+}
+function cookieAttrs(opts) {
+  const sameSite = opts?.sameSite ?? "lax";
+  const secure = opts?.secure || sameSite === "none";
+  const cap = sameSite.charAt(0).toUpperCase() + sameSite.slice(1);
+  return `Path=/; HttpOnly; SameSite=${cap}${secure ? "; Secure" : ""}`;
+}
+function signValue(value, secret) {
+  const sig = createHmac("sha256", secret).update(value).digest("hex");
+  return `${value}.${sig}`;
+}
+function unsignValue(signed, secret) {
+  const dot = signed.lastIndexOf(".");
+  if (dot < 0) return null;
+  const value = signed.slice(0, dot);
+  const sig = signed.slice(dot + 1);
+  if (!/^[0-9a-f]{64}$/.test(sig)) return null;
+  const expected = createHmac("sha256", secret).update(value).digest("hex");
+  const a = Buffer.from(sig, "hex");
+  const b = Buffer.from(expected, "hex");
+  if (a.length !== b.length) return null;
+  return timingSafeEqual(a, b) ? value : null;
+}
+function clearPlatformSessionCookie(opts) {
+  return `${SESSION_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
+}
+function createSessionCookie(session, opts, secret) {
+  const raw = encodeURIComponent(JSON.stringify(session));
+  const value = secret ? signValue(raw, secret) : raw;
+  return `${SESSION_COOKIE_NAME}=${value}; ${cookieAttrs(opts)}; Max-Age=${60 * 60 * 24 * 7}`;
+}
+function createStateCookie(value, opts) {
+  return `${STATE_COOKIE_NAME}=${encodeURIComponent(value)}; ${cookieAttrs(opts)}; Max-Age=${60 * 10}`;
+}
+function clearStateCookie(opts) {
+  return `${STATE_COOKIE_NAME}=; ${cookieAttrs(opts)}; Max-Age=0`;
+}
+function serializeAuthorizationState(state) {
+  return encodeURIComponent(JSON.stringify(state));
+}
+function parseAuthorizationState(value) {
+  try {
+    return JSON.parse(decodeURIComponent(value));
+  } catch {
+    throw new Error("Invalid authorization state payload.");
+  }
+}
+function normalizeIdentity(user) {
+  return {
+    id: user.id,
+    email: user.email ?? `${user.id}@accounts.local`,
+    name: user.name ?? ([user.first_name, user.last_name].filter(Boolean).join(" ") || "Accounts User"),
+    firstName: user.first_name,
+    lastName: user.last_name,
+    avatarUrl: user.avatar_url
+  };
+}
+function createMockTokenResponse(code) {
+  const suffix = code.replace("demo_", "").slice(0, 8) || "demo";
+  return {
+    access_token: `access_${suffix}`,
+    refresh_token: `refresh_${suffix}`,
+    token_type: "Bearer",
+    expires_in: 60 * 60 * 24 * 7,
+    user: {
+      id: "accounts-user-demo-admin",
+      email: "hello@babyplanet.example",
+      name: "Baby Planet Admin",
+      first_name: "Baby",
+      last_name: "Planet"
+    }
+  };
+}
+function readCookie(cookieHeader, name) {
+  if (!cookieHeader) return null;
+  for (const part of cookieHeader.split(";")) {
+    const [key, ...rest] = part.trim().split("=");
+    if (key === name) {
+      return rest.join("=");
+    }
+  }
+  return null;
+}
+
+export {
+  createAccountsClientConfig,
+  createPlatformAuth,
+  beginAccountsLoginRedirect,
+  handleAccountsCallback,
+  exchangeAuthorizationCode,
+  syncAccountsUser,
+  identityPassthroughSync,
+  resolveActiveTenant,
+  readPlatformSessionCookie,
+  clearPlatformSessionCookie
+};

package/dist/index.d.ts

@@ -0,0 +1,142 @@
+type PermissionSet = string[];
+type AccountsIdentity = {
+    id: string;
+    email: string;
+    name: string;
+    firstName?: string;
+    lastName?: string;
+    avatarUrl?: string;
+};
+type LocalUser = {
+    id: string;
+    externalIdentityId: string;
+    email: string;
+    name: string;
+    firstName?: string;
+    lastName?: string;
+    defaultTenantId?: string;
+};
+type TenantMembership = {
+    tenantId: string;
+    role: 'customer' | 'admin' | 'owner';
+    permissions: PermissionSet;
+    isDefault?: boolean;
+};
+type TenantContext = {
+    id: string;
+    slug: string;
+    name: string;
+    primaryDomain: string;
+    locale: string;
+    currency: string;
+    themeKey: string;
+    status: 'draft' | 'active' | 'archived';
+};
+type TenantAccessContext = {
+    activeTenantId?: string;
+    memberships: TenantMembership[];
+};
+type AuthenticatedPrincipal = {
+    identity: AccountsIdentity;
+    user: LocalUser;
+    tenantAccess: TenantAccessContext;
+};
+type PlatformSession = {
+    principal: AuthenticatedPrincipal | null;
+    tenant: TenantContext | null;
+    accessToken?: string;
+    refreshToken?: string;
+    expiresAt?: string;
+};
+type AccountsClientConfig = {
+    baseUrl?: string;
+    clientId: string;
+    clientSecret?: string;
+    redirectUri: string;
+    logoutRedirectUri?: string;
+    useMock?: boolean;
+};
+type AuthorizationState = {
+    nonce: string;
+    nextPath: string;
+    tenantSlug?: string;
+};
+type AccountsTokenResponse = {
+    access_token: string;
+    refresh_token?: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    user: {
+        id: string;
+        email?: string;
+        name?: string;
+        first_name?: string;
+        last_name?: string;
+        avatar_url?: string;
+    };
+};
+type SyncAccountsUserResult = {
+    user: LocalUser;
+    memberships: TenantMembership[];
+    activeTenantId?: string;
+};
+type SyncAccountsUser = (identity: AccountsIdentity) => SyncAccountsUserResult | Promise<SyncAccountsUserResult>;
+declare function createAccountsClientConfig(input?: Partial<AccountsClientConfig>): AccountsClientConfig;
+declare function createPlatformAuth(): {
+    readSession(cookieHeader: string | null | undefined): PlatformSession;
+    requirePrincipal(session: PlatformSession): AuthenticatedPrincipal;
+};
+declare function beginAccountsLoginRedirect(config: AccountsClientConfig, options: {
+    nextPath?: string;
+    tenantSlug?: string;
+    cookieOptions?: CookieOptions;
+}): {
+    redirectUrl: string;
+    stateValue: string;
+    stateCookie: string;
+};
+declare function handleAccountsCallback(input: {
+    config: AccountsClientConfig;
+    code: string;
+    state: string;
+    storedState?: string | null;
+    syncAccountsUser: SyncAccountsUser;
+    fetchImpl?: typeof fetch;
+    cookieOptions?: CookieOptions;
+    /** When set, the session cookie is HMAC-signed so it cannot be forged/tampered. */
+    secret?: string;
+}): Promise<{
+    session: PlatformSession;
+    nextPath: string;
+    tenantSlug: string | undefined;
+    sessionCookie: string;
+    clearStateCookie: string;
+}>;
+declare function exchangeAuthorizationCode(input: {
+    config: AccountsClientConfig;
+    code: string;
+    fetchImpl?: typeof fetch;
+}): Promise<AccountsTokenResponse>;
+declare function syncAccountsUser(identity: AccountsIdentity, syncer: SyncAccountsUser): SyncAccountsUserResult | Promise<SyncAccountsUserResult>;
+/**
+ * Default identity → local-user mapping for apps that do NOT keep their own users table
+ * (e.g. a read-only companion app). Maps the Accounts identity straight through with no
+ * memberships. Added 0.0.2; non-breaking.
+ */
+declare const identityPassthroughSync: SyncAccountsUser;
+declare function resolveActiveTenant(memberships: TenantMembership[], preferredTenantId?: string): string;
+declare function readPlatformSessionCookie(cookieHeader: string | null | undefined, opts?: {
+    secret?: string;
+}): PlatformSession;
+/**
+ * Cookie attribute options. Set `sameSite: 'none'` (which implies `secure: true`) to make
+ * the session usable on CROSS-SITE requests — required when an SDK on another origin calls
+ * an API that relies on this cookie. Added 0.0.3; defaults preserve the prior Lax behavior.
+ */
+type CookieOptions = {
+    sameSite?: 'lax' | 'none' | 'strict';
+    secure?: boolean;
+};
+declare function clearPlatformSessionCookie(opts?: CookieOptions): string;
+
+export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, readPlatformSessionCookie, resolveActiveTenant, syncAccountsUser };

package/dist/index.js

@@ -0,0 +1,24 @@
+import {
+  beginAccountsLoginRedirect,
+  clearPlatformSessionCookie,
+  createAccountsClientConfig,
+  createPlatformAuth,
+  exchangeAuthorizationCode,
+  handleAccountsCallback,
+  identityPassthroughSync,
+  readPlatformSessionCookie,
+  resolveActiveTenant,
+  syncAccountsUser
+} from "./chunk-R3JOX2XR.js";
+export {
+  beginAccountsLoginRedirect,
+  clearPlatformSessionCookie,
+  createAccountsClientConfig,
+  createPlatformAuth,
+  exchangeAuthorizationCode,
+  handleAccountsCallback,
+  identityPassthroughSync,
+  readPlatformSessionCookie,
+  resolveActiveTenant,
+  syncAccountsUser
+};

package/dist/sveltekit.d.ts

@@ -0,0 +1,39 @@
+import { RequestEvent, Handle } from '@sveltejs/kit';
+import { PlatformSession, AccountsClientConfig, SyncAccountsUser, CookieOptions } from './index.js';
+export { clearPlatformSessionCookie } from './index.js';
+
+type SvelteKitAuthOptions = {
+    /** Accounts client config (use createAccountsClientConfig()). */
+    config: AccountsClientConfig;
+    /** Map an Accounts identity to a local user. Defaults to identity passthrough (no DB). */
+    syncAccountsUser?: SyncAccountsUser;
+    loginPath?: string;
+    callbackPath?: string;
+    logoutPath?: string;
+    /** Where to send the user after logout. Default '/'. */
+    postLogoutPath?: string;
+    /**
+     * Return true if THIS request must be authenticated. Unauthenticated page requests are
+     * redirected to the login flow; unauthenticated /api requests get a 401 JSON response.
+     * Omit to leave everything public (session is still read into locals).
+     */
+    protect?: (event: RequestEvent) => boolean;
+    /**
+     * Cookie attributes for the session + state cookies. Set `{ sameSite: 'none' }` to make
+     * the session usable cross-site (an SDK on another origin calling a protected API).
+     */
+    cookieOptions?: CookieOptions;
+    /**
+     * HMAC secret. When set, the session cookie is signed on write and verified on read —
+     * unsigned/forged/tampered cookies are rejected (treated as logged out). Strongly
+     * recommended in production, since the session payload includes tenant memberships.
+     */
+    sessionSecret?: string;
+};
+type PlatformLocals = {
+    session: PlatformSession;
+    principal: PlatformSession['principal'];
+};
+declare function createAuthHandle(opts: SvelteKitAuthOptions): Handle;
+
+export { type PlatformLocals, type SvelteKitAuthOptions, createAuthHandle };

package/dist/sveltekit.js

@@ -0,0 +1,76 @@
+import {
+  beginAccountsLoginRedirect,
+  clearPlatformSessionCookie,
+  handleAccountsCallback,
+  identityPassthroughSync,
+  readPlatformSessionCookie
+} from "./chunk-R3JOX2XR.js";
+
+// src/sveltekit.ts
+import { redirect } from "@sveltejs/kit";
+var STATE_COOKIE = "accounts_auth_state";
+function redirectWithCookies(location, cookies) {
+  const headers = new Headers({ location });
+  for (const c of cookies) if (c) headers.append("set-cookie", c);
+  return new Response(null, { status: 302, headers });
+}
+function createAuthHandle(opts) {
+  const sync = opts.syncAccountsUser ?? identityPassthroughSync;
+  const loginPath = opts.loginPath ?? "/auth/login";
+  const callbackPath = opts.callbackPath ?? "/auth/callback";
+  const logoutPath = opts.logoutPath ?? "/auth/logout";
+  const postLogoutPath = opts.postLogoutPath ?? "/";
+  const cookieOptions = opts.cookieOptions;
+  const sessionSecret = opts.sessionSecret;
+  return async ({ event, resolve }) => {
+    const session = readPlatformSessionCookie(event.request.headers.get("cookie"), {
+      secret: sessionSecret
+    });
+    event.locals.session = session;
+    event.locals.principal = session.principal;
+    const path = event.url.pathname;
+    if (path === loginPath) {
+      const next = event.url.searchParams.get("next") ?? "/";
+      const flow = beginAccountsLoginRedirect(opts.config, { nextPath: next, cookieOptions });
+      return redirectWithCookies(flow.redirectUrl, [flow.stateCookie]);
+    }
+    if (path === callbackPath) {
+      const code = event.url.searchParams.get("code") ?? "";
+      const state = event.url.searchParams.get("state") ?? "";
+      const storedState = event.cookies.get(STATE_COOKIE);
+      const result = await handleAccountsCallback({
+        config: opts.config,
+        code,
+        state,
+        storedState,
+        syncAccountsUser: sync,
+        cookieOptions,
+        secret: sessionSecret
+      });
+      return redirectWithCookies(result.nextPath || "/", [
+        result.sessionCookie,
+        result.clearStateCookie
+      ]);
+    }
+    if (path === logoutPath) {
+      return redirectWithCookies(postLogoutPath, [
+        clearPlatformSessionCookie(cookieOptions),
+        `${STATE_COOKIE}=; ${cookieOptions?.sameSite === "none" ? "Path=/; HttpOnly; SameSite=None; Secure" : "Path=/; HttpOnly; SameSite=Lax"}; Max-Age=0`
+      ]);
+    }
+    if (opts.protect && opts.protect(event) && !session.principal) {
+      if (path.startsWith("/api")) {
+        return new Response(JSON.stringify({ message: "Authentication required." }), {
+          status: 401,
+          headers: { "content-type": "application/json" }
+        });
+      }
+      throw redirect(302, `${loginPath}?next=${encodeURIComponent(path + event.url.search)}`);
+    }
+    return resolve(event);
+  };
+}
+export {
+  clearPlatformSessionCookie,
+  createAuthHandle
+};

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "@~lyre/auth",
+  "version": "0.0.4",
+  "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
+  "type": "module",
+  "sideEffects": false,
+  "license": "MIT",
+  "author": "Britam Trust Services / Lyre",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/kigathi-chege/lyre-auth-sdk.git"
+  },
+  "homepage": "https://github.com/kigathi-chege/lyre-auth-sdk#readme",
+  "bugs": {
+    "url": "https://github.com/kigathi-chege/lyre-auth-sdk/issues"
+  },
+  "keywords": [
+    "auth",
+    "sso",
+    "accounts",
+    "session",
+    "sveltekit",
+    "hmac",
+    "lyre"
+  ],
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./sveltekit": {
+      "types": "./dist/sveltekit.d.ts",
+      "import": "./dist/sveltekit.js"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup src/index.ts src/sveltekit.ts --format esm --dts --clean",
+    "check": "tsc --noEmit"
+  },
+  "peerDependencies": {
+    "@sveltejs/kit": "^2.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@sveltejs/kit": {
+      "optional": true
+    }
+  },
+  "devDependencies": {
+    "@sveltejs/kit": "^2.0.0",
+    "@types/node": "^22",
+    "tsup": "^8.3.5",
+    "typescript": "^6.0.2"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}