@~lyre/auth 0.0.9 → 0.3.0

package/README.md

@@ -5,7 +5,7 @@ and identity handling (HMAC-signed cookies, the accounts login → callback →
 logout exchange, tenant resolution), plus an optional turnkey **SvelteKit**
 adapter that wires it all up in a few lines.
 
-Ships as raw TypeScript source.
+Ships built ESM output from `dist/`, with type declarations.
 
 ## Install
 
@@ -53,6 +53,43 @@ export const handle = createAuthHandle({
 `@sveltejs/kit` is an **optional peer dependency** — only required if you import
 the `/sveltekit` entry.
 
+### `@~lyre/auth/nest` — Nest / Fastify adapter
+
+For services on Nest + Fastify. Adds **no dependencies** — nothing here imports
+`@nestjs/*` or `fastify`; you supply the guard class and DI wiring, the SDK
+supplies the Accounts logic. Works from a plain Fastify app too: any request
+whose `headers` is a plain object satisfies the input type.
+
+```ts
+import { createServiceKeyResolver, createUserSessionResolver, hasScopes }
+  from '@~lyre/auth/nest';
+
+const keys = createServiceKeyResolver({ config: { baseUrl: ACCOUNTS_BASE_URL } });
+const sessions = createUserSessionResolver({ config: { baseUrl: ACCOUNTS_BASE_URL } });
+
+// In a Nest guard (req is the Fastify request):
+const key = await keys.resolve(req);
+if (key.status === 'invalid') throw new UnauthorizedException();  // present but bad
+if (key.status === 'ok') {
+  if (!hasScopes(key.context, ['my-app:things:read'])) throw new ForbiddenException();
+  // key.context.accessibleApps tells you which apps this key may act on
+}
+
+// A user session bearer resolves to who + which app, from the token alone:
+const user = await sessions.resolve(req);
+// → { userId, sessionId, appId, tenantId, email, name } | null
+```
+
+Semantics match `createServiceKeyHandle`: **absent key → `absent`** (fall through to
+other auth), **present-but-invalid → `invalid`** (reject rather than silently
+continue). Introspection is cached by `sha256` of the credential — negative
+results too, so a bad key can't hammer Accounts. Neither resolver throws: a
+transport failure reads as "not authenticated", so a flaky Accounts cannot 500
+the consuming service.
+
+`resolve()` needs `GET /api/auth/me` to return `session.appId` (Accounts ≥ the
+release that added it); older deployments yield `appId: null`.
+
 ## Publishing
 
 See [PUBLISHING.md](PUBLISHING.md). Published to npm via GitHub Actions Trusted

package/dist/admin.d.ts

@@ -0,0 +1,146 @@
+interface AccountsAdminOptions {
+    /** Accounts base URL, e.g. `https://accounts.example.com`. */
+    baseUrl: string;
+    /** A user session id (bearer) for session-authed endpoints (invites, profile update, user list). */
+    sessionToken?: string;
+    /** A machine service key (`sk_…`) for `x-api-key`-authed reads (group members). */
+    serviceKey?: string;
+    /** Override the fetch implementation (defaults to the global). */
+    fetchImpl?: typeof fetch;
+}
+interface AccountsUser {
+    id: string;
+    email: string;
+    name?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    emailVerified?: boolean;
+    /** The user's avatar URL (from their latest OAuth sign-in with a picture, or their upload). */
+    avatarUrl?: string | null;
+    profileData?: Record<string, string>;
+    userGroups?: Array<{
+        id: string;
+        slug?: string;
+        displayName?: string;
+        role?: string;
+    }>;
+    apps?: Array<{
+        id: string;
+        slug: string;
+        name?: string;
+    }>;
+    [key: string]: unknown;
+}
+interface ChangePasswordResult {
+    success: boolean;
+    mode?: 'set' | 'changed';
+    revokedCount?: number;
+    error?: string;
+}
+interface ListUsersQuery {
+    tenantId?: string;
+    appId?: string;
+    q?: string;
+    name?: string;
+    email?: string;
+    limit?: number;
+    offset?: number;
+}
+interface ListUsersResult {
+    users: AccountsUser[];
+    pagination?: {
+        total: number;
+        limit: number;
+        offset: number;
+    };
+}
+interface AppMember {
+    id: string;
+    email: string;
+    name?: string | null;
+    via?: 'member' | 'role';
+}
+interface InviteResult {
+    /** `added` = the email already had an Accounts user and was granted app access immediately;
+     *  `invited` = a new invite was created and an accept link emailed. */
+    status: 'added' | 'invited';
+    [key: string]: unknown;
+}
+interface GroupMember {
+    id: string;
+    email: string;
+    name?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+    role?: string | null;
+}
+/** Thrown on a non-2xx Accounts response so callers can surface the upstream message + status. */
+declare class AccountsAdminError extends Error {
+    readonly status: number;
+    readonly body?: unknown | undefined;
+    constructor(status: number, message: string, body?: unknown | undefined);
+}
+declare class AccountsAdmin {
+    private readonly opts;
+    private readonly base;
+    private readonly f;
+    constructor(opts: AccountsAdminOptions);
+    /** List/search users in a tenant. Session-authed (caller must be privileged in the tenant). */
+    listUsers(query?: ListUsersQuery): Promise<ListUsersResult>;
+    /** One user's full detail (includes `profileData`, `userGroups`, `apps`). Session-authed. */
+    getUser(userId: string): Promise<AccountsUser>;
+    /** Update a user (self, or admin/owner/super-admin). `profileData` requires `appId`. Session-authed.
+     *  Password is NOT set here — use {@link changePassword} (Accounts verifies the current password). */
+    updateUser(userId: string, input: {
+        name?: string;
+        email?: string;
+        appId?: string;
+        profileData?: Record<string, string>;
+    }): Promise<AccountsUser>;
+    /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
+     *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
+     *  user — no id is passed. */
+    changePassword(input: {
+        currentPassword: string;
+        newPassword: string;
+        confirmPassword?: string;
+        revokeOtherSessions?: boolean;
+    }): Promise<ChangePasswordResult>;
+    /** Invite an email to an app: adds an existing Accounts user immediately, else emails an accept
+     *  link. Session-authed (caller must have access to the app). */
+    inviteToApp(appSlug: string, input: {
+        email: string;
+    }): Promise<InviteResult>;
+    /** Everyone with access to an app. Session-authed. */
+    listAppUsers(appSlug: string): Promise<AppMember[]>;
+    /** Revoke a user's access to an app. Session-authed. */
+    removeAppUser(appSlug: string, userId: string): Promise<void>;
+    /** Members of a user_group (the workspace's agents). Service-key authed (`stats:read`). */
+    listGroupMembers(groupId: string, opts?: {
+        appId?: string;
+    }): Promise<GroupMember[]>;
+    /** Read a user's app-scoped `profileData` (the store for per-app preferences). Session-authed. */
+    getAppProfile(userId: string): Promise<Record<string, string>>;
+    /** Write app-scoped `profileData` fields for a user (e.g. availability, soundEnabled). All values
+     *  are stored as strings by Accounts; booleans are serialised. Session-authed. */
+    setAppProfile(userId: string, appId: string, profile: Record<string, string | number | boolean>): Promise<AccountsUser>;
+    /** Upload a user's avatar image. The bytes are stored by Accounts and a public URL is returned +
+     *  persisted (source = 'upload', which survives later OAuth sign-ins). Session-authed, self-only.
+     *  `image` is the file bytes (Blob/Buffer/Uint8Array); `mimeType` + `filename` describe it. */
+    uploadAvatar(userId: string, image: Blob | ArrayBuffer | Uint8Array, opts?: {
+        mimeType?: string;
+        filename?: string;
+    }): Promise<{
+        avatarUrl: string;
+    }>;
+    /** Remove a user's uploaded avatar (clears it, or reverts to their latest OAuth picture if any).
+     *  Session-authed, self-only. */
+    removeAvatar(userId: string): Promise<{
+        avatarUrl: string | null;
+    }>;
+    private request;
+}
+/** Convenience factory mirroring the SDK's other `create*` helpers. */
+declare function createAccountsAdmin(opts: AccountsAdminOptions): AccountsAdmin;
+
+export { AccountsAdmin, AccountsAdminError, type AccountsAdminOptions, type AccountsUser, type AppMember, type ChangePasswordResult, type GroupMember, type InviteResult, type ListUsersQuery, type ListUsersResult, createAccountsAdmin };

package/dist/admin.js

@@ -0,0 +1,193 @@
+// src/admin.ts
+var AccountsAdminError = class extends Error {
+  constructor(status, message, body) {
+    super(message);
+    this.status = status;
+    this.body = body;
+    this.name = "AccountsAdminError";
+  }
+  status;
+  body;
+};
+var AccountsAdmin = class {
+  constructor(opts) {
+    this.opts = opts;
+    const base = (opts.baseUrl ?? "").trim();
+    if (!base) throw new Error("AccountsAdmin: baseUrl is required.");
+    this.base = base.replace(/\/+$/, "");
+    this.f = opts.fetchImpl ?? fetch;
+  }
+  opts;
+  base;
+  f;
+  // ── Users ──────────────────────────────────────────────────────────────────
+  /** List/search users in a tenant. Session-authed (caller must be privileged in the tenant). */
+  async listUsers(query = {}) {
+    const qs = new URLSearchParams();
+    for (const [k, v] of Object.entries(query)) {
+      if (v !== void 0 && v !== null) qs.set(k, String(v));
+    }
+    const suffix = qs.toString() ? `?${qs.toString()}` : "";
+    const data = await this.request(
+      "GET",
+      `/api/auth/users${suffix}`,
+      { auth: "session" }
+    );
+    return { users: data.users ?? [], ...data.pagination ? { pagination: data.pagination } : {} };
+  }
+  /** One user's full detail (includes `profileData`, `userGroups`, `apps`). Session-authed. */
+  async getUser(userId) {
+    return this.request("GET", `/api/auth/users/${encodeURIComponent(userId)}`, {
+      auth: "session"
+    });
+  }
+  /** Update a user (self, or admin/owner/super-admin). `profileData` requires `appId`. Session-authed.
+   *  Password is NOT set here — use {@link changePassword} (Accounts verifies the current password). */
+  async updateUser(userId, input) {
+    return this.request("PATCH", `/api/auth/users/${encodeURIComponent(userId)}`, {
+      auth: "session",
+      body: input
+    });
+  }
+  /** Change the signed-in user's password. Session-authed; Accounts verifies `currentPassword` and,
+   *  with `revokeOtherSessions`, logs the user out everywhere else. The target is the session's own
+   *  user — no id is passed. */
+  async changePassword(input) {
+    return this.request("POST", "/api/auth/change-password", {
+      auth: "session",
+      body: {
+        currentPassword: input.currentPassword,
+        newPassword: input.newPassword,
+        confirmPassword: input.confirmPassword ?? input.newPassword,
+        ...input.revokeOtherSessions !== void 0 ? { revokeOtherSessions: input.revokeOtherSessions } : {}
+      }
+    });
+  }
+  // ── App membership (invite / list / remove) ─────────────────────────────────
+  /** Invite an email to an app: adds an existing Accounts user immediately, else emails an accept
+   *  link. Session-authed (caller must have access to the app). */
+  async inviteToApp(appSlug, input) {
+    return this.request("POST", `/api/auth/apps/${encodeURIComponent(appSlug)}/invites`, {
+      auth: "session",
+      body: input
+    });
+  }
+  /** Everyone with access to an app. Session-authed. */
+  async listAppUsers(appSlug) {
+    const data = await this.request(
+      "GET",
+      `/api/auth/apps/${encodeURIComponent(appSlug)}/users`,
+      { auth: "session" }
+    );
+    return data.users ?? [];
+  }
+  /** Revoke a user's access to an app. Session-authed. */
+  async removeAppUser(appSlug, userId) {
+    await this.request(
+      "DELETE",
+      `/api/auth/apps/${encodeURIComponent(appSlug)}/users?userId=${encodeURIComponent(userId)}`,
+      { auth: "session" }
+    );
+  }
+  // ── Groups (agent picker) ───────────────────────────────────────────────────
+  /** Members of a user_group (the workspace's agents). Service-key authed (`stats:read`). */
+  async listGroupMembers(groupId, opts = {}) {
+    const suffix = opts.appId ? `?appId=${encodeURIComponent(opts.appId)}` : "";
+    const data = await this.request(
+      "GET",
+      `/api/auth/user-groups/${encodeURIComponent(groupId)}/members${suffix}`,
+      { auth: "key" }
+    );
+    return data.members ?? [];
+  }
+  // ── App-scoped profile (availability / sound / any per-app preference) ───────
+  /** Read a user's app-scoped `profileData` (the store for per-app preferences). Session-authed. */
+  async getAppProfile(userId) {
+    const user = await this.getUser(userId);
+    return user.profileData ?? {};
+  }
+  /** Write app-scoped `profileData` fields for a user (e.g. availability, soundEnabled). All values
+   *  are stored as strings by Accounts; booleans are serialised. Session-authed. */
+  async setAppProfile(userId, appId, profile) {
+    const profileData = {};
+    for (const [k, v] of Object.entries(profile)) profileData[k] = String(v);
+    return this.updateUser(userId, { appId, profileData });
+  }
+  // ── Avatar (uploaded image; social avatars are captured server-side on sign-in) ─
+  /** Upload a user's avatar image. The bytes are stored by Accounts and a public URL is returned +
+   *  persisted (source = 'upload', which survives later OAuth sign-ins). Session-authed, self-only.
+   *  `image` is the file bytes (Blob/Buffer/Uint8Array); `mimeType` + `filename` describe it. */
+  async uploadAvatar(userId, image, opts = {}) {
+    if (!this.opts.sessionToken) {
+      throw new Error("AccountsAdmin: a session token is required to upload an avatar.");
+    }
+    const mimeType = opts.mimeType ?? "application/octet-stream";
+    const blob = image instanceof Blob ? image : new Blob([image], { type: mimeType });
+    const form = new FormData();
+    form.append("avatar", blob, opts.filename ?? "avatar");
+    const res = await this.f(
+      new URL(`/api/auth/users/${encodeURIComponent(userId)}/avatar`, this.base),
+      {
+        method: "POST",
+        headers: { authorization: `Bearer ${this.opts.sessionToken}`, accept: "application/json" },
+        body: form
+      }
+    );
+    const text = await res.text();
+    const parsed = text ? JSON.parse(text) : {};
+    if (!res.ok) {
+      throw new AccountsAdminError(res.status, parsed?.error ?? "Avatar upload failed.", parsed);
+    }
+    return parsed;
+  }
+  /** Remove a user's uploaded avatar (clears it, or reverts to their latest OAuth picture if any).
+   *  Session-authed, self-only. */
+  async removeAvatar(userId) {
+    return this.request(
+      "DELETE",
+      `/api/auth/users/${encodeURIComponent(userId)}/avatar`,
+      { auth: "session" }
+    );
+  }
+  // ── internals ───────────────────────────────────────────────────────────────
+  async request(method, path, opts) {
+    const headers = { accept: "application/json" };
+    if (opts.auth === "session") {
+      if (!this.opts.sessionToken) {
+        throw new Error(`AccountsAdmin: a session token is required for ${method} ${path}.`);
+      }
+      headers.authorization = `Bearer ${this.opts.sessionToken}`;
+    } else {
+      if (!this.opts.serviceKey) {
+        throw new Error(`AccountsAdmin: a service key is required for ${method} ${path}.`);
+      }
+      headers["x-api-key"] = this.opts.serviceKey;
+    }
+    let bodyStr;
+    if (opts.body !== void 0) {
+      bodyStr = JSON.stringify(opts.body);
+      headers["content-type"] = "application/json";
+    }
+    const res = await this.f(new URL(path, this.base), { method, headers, body: bodyStr });
+    const text = await res.text();
+    let parsed;
+    try {
+      parsed = text ? JSON.parse(text) : void 0;
+    } catch {
+      parsed = text;
+    }
+    if (!res.ok) {
+      const message = (parsed && typeof parsed === "object" && "error" in parsed ? String(parsed.error) : void 0) ?? `Accounts request failed with status ${res.status}.`;
+      throw new AccountsAdminError(res.status, message, parsed);
+    }
+    return parsed;
+  }
+};
+function createAccountsAdmin(opts) {
+  return new AccountsAdmin(opts);
+}
+export {
+  AccountsAdmin,
+  AccountsAdminError,
+  createAccountsAdmin
+};

package/dist/{chunk-QIAL6IDV.js → chunk-TQNQLX3C.js}

@@ -308,6 +308,11 @@ function verifyWebhookSignature(rawBody, signature, secret) {
   if (a.length !== b.length) return false;
   return timingSafeEqual(a, b);
 }
+function normalizeAccountsWebhook(payload) {
+  const body = payload && typeof payload === "object" ? payload : {};
+  const type = String(body.event ?? body.type ?? "unknown");
+  return { ...body, type, data: body.data };
+}
 function scopeSatisfied(granted, required) {
   if (!granted || granted.length === 0) return false;
   return granted.includes(required);
@@ -328,5 +333,6 @@ export {
   introspectServiceKey,
   logoutFromAccounts,
   verifyWebhookSignature,
+  normalizeAccountsWebhook,
   scopeSatisfied
 };

package/dist/index.d.ts

@@ -174,8 +174,18 @@ declare function logoutFromAccounts(input: {
 declare function verifyWebhookSignature(rawBody: string, signature: string | null | undefined, secret: string): boolean;
 type AccountsWebhookEvent = {
     type: string;
+    data?: unknown;
     [key: string]: unknown;
 };
+/**
+ * Normalize an Accounts webhook body into a stable `AccountsWebhookEvent`.
+ *
+ * The Accounts webhook worker sends `{ event, timestamp, data }` (the event NAME under `event`,
+ * the payload under `data`). Older/other senders may put the name under `type`. This collapses both
+ * so a consumer always reads `event.type` and `event.data`, and keeps the raw fields alongside.
+ * Framework-agnostic so both the SvelteKit handle and the Nest helper share one shape.
+ */
+declare function normalizeAccountsWebhook(payload: unknown): AccountsWebhookEvent;
 declare function scopeSatisfied(granted: string[] | undefined, required: string): boolean;
 
-export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AccountsWebhookEvent, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, logoutFromAccounts, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser, verifyWebhookSignature };
+export { type AccountsClientConfig, type AccountsIdentity, type AccountsTokenResponse, type AccountsWebhookEvent, type AuthenticatedPrincipal, type AuthorizationState, type CookieOptions, type LocalUser, type PermissionSet, type PlatformSession, type ServiceKeyApp, type ServiceKeyContext, type SyncAccountsUser, type SyncAccountsUserResult, type TenantAccessContext, type TenantContext, type TenantMembership, beginAccountsLoginRedirect, clearPlatformSessionCookie, createAccountsClientConfig, createPlatformAuth, exchangeAuthorizationCode, handleAccountsCallback, identityPassthroughSync, introspectServiceKey, logoutFromAccounts, normalizeAccountsWebhook, readPlatformSessionCookie, resolveActiveTenant, scopeSatisfied, serviceKeyFromRequest, syncAccountsUser, verifyWebhookSignature };

package/dist/index.js

@@ -8,13 +8,14 @@ import {
   identityPassthroughSync,
   introspectServiceKey,
   logoutFromAccounts,
+  normalizeAccountsWebhook,
   readPlatformSessionCookie,
   resolveActiveTenant,
   scopeSatisfied,
   serviceKeyFromRequest,
   syncAccountsUser,
   verifyWebhookSignature
-} from "./chunk-QIAL6IDV.js";
+} from "./chunk-TQNQLX3C.js";
 export {
   beginAccountsLoginRedirect,
   clearPlatformSessionCookie,
@@ -25,6 +26,7 @@ export {
   identityPassthroughSync,
   introspectServiceKey,
   logoutFromAccounts,
+  normalizeAccountsWebhook,
   readPlatformSessionCookie,
   resolveActiveTenant,
   scopeSatisfied,

package/dist/nest.d.ts

@@ -0,0 +1,85 @@
+import { AccountsWebhookEvent, ServiceKeyContext, AccountsClientConfig } from './index.js';
+export { normalizeAccountsWebhook } from './index.js';
+
+/**
+ * The minimum a request must expose. Fastify's `request` satisfies this as-is
+ * (`headers` is a plain object), as does Node's IncomingMessage.
+ */
+type HeaderCarrier = {
+    headers: Record<string, string | string[] | undefined>;
+};
+/**
+ * Adapt a header-bearing request to the web `Request` that the core helpers expect.
+ * Only headers are needed — `serviceKeyFromRequest` reads `x-api-key` / `authorization`.
+ */
+declare function toWebRequest(carrier: HeaderCarrier): Request;
+/** Extract an `sk_` service key from a Fastify/Node request, or null when absent. */
+declare function serviceKeyFromHeaders(carrier: HeaderCarrier): string | null;
+type ServiceKeyResolverOptions = {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    fetchImpl?: typeof fetch;
+    /** Introspection cache TTL in ms. Default 60_000; 0 disables caching. */
+    cacheTtlMs?: number;
+};
+type ServiceKeyResolution = {
+    status: 'absent';
+} | {
+    status: 'invalid';
+} | {
+    status: 'ok';
+    context: ServiceKeyContext;
+};
+declare function createServiceKeyResolver(opts: ServiceKeyResolverOptions): {
+    resolve: (carrier: HeaderCarrier) => Promise<ServiceKeyResolution>;
+    invalidate: (key: string) => void;
+};
+type UserSessionContext = {
+    userId: string;
+    email?: string;
+    name?: string;
+    sessionId: string;
+    /** The app the session was issued for. Null for sessions created outside an app context. */
+    appId: string | null;
+    tenantId: string | null;
+    expiresAt?: string;
+};
+type UserSessionResolverOptions = {
+    config: Pick<AccountsClientConfig, 'baseUrl'>;
+    fetchImpl?: typeof fetch;
+    /** Cache TTL in ms. Default 60_000; 0 disables caching. */
+    cacheTtlMs?: number;
+};
+/** A session bearer is any Authorization: Bearer token that is NOT an `sk_` service key. */
+declare function sessionTokenFromHeaders(carrier: HeaderCarrier): string | null;
+declare function createUserSessionResolver(opts: UserSessionResolverOptions): {
+    resolve: (carrier: HeaderCarrier) => Promise<UserSessionContext | null>;
+    invalidate: (token: string) => void;
+};
+/**
+ * Whether a resolved key grants every required scope. Uses the core's `scopeSatisfied`
+ * (flat exact match, no wildcards) so behaviour matches Accounts' own enforcement.
+ */
+declare function hasScopes(ctx: ServiceKeyContext, required: readonly string[]): boolean;
+/** Whether a resolved key may act on an app, matched by Accounts app id OR slug. */
+declare function canAccessApp(ctx: ServiceKeyContext, appIdOrSlug: string): boolean;
+type AccountsWebhookResult = {
+    ok: true;
+    event: AccountsWebhookEvent;
+} | {
+    ok: false;
+    reason: 'bad_signature' | 'bad_json';
+};
+/** Header the Accounts webhook worker sends (HMAC-SHA256 hex of the raw body). */
+declare const ACCOUNTS_WEBHOOK_SIGNATURE_HEADER = "x-webhook-signature";
+/**
+ * Verify an Accounts webhook and parse it into a normalized `{ type, data, ... }` event.
+ *
+ * Pass the RAW request body (a Nest/Fastify controller must read the raw body, not a re-serialized
+ * object — the signature is over the exact bytes), the signature header value
+ * (`request.headers['x-webhook-signature']`), and the shared secret. Returns `{ok:false}` on a bad
+ * signature or unparseable JSON so the controller can 401/400; `{ok:true, event}` otherwise. The
+ * controller then reacts to `event.type` / `event.data` and returns 200 (so Accounts doesn't retry).
+ */
+declare function verifyAndParseAccountsWebhook(rawBody: string, signatureHeaderValue: string | string[] | undefined, secret: string): AccountsWebhookResult;
+
+export { ACCOUNTS_WEBHOOK_SIGNATURE_HEADER, AccountsClientConfig, AccountsWebhookEvent, type AccountsWebhookResult, type HeaderCarrier, ServiceKeyContext, type ServiceKeyResolution, type ServiceKeyResolverOptions, type UserSessionContext, type UserSessionResolverOptions, canAccessApp, createServiceKeyResolver, createUserSessionResolver, hasScopes, serviceKeyFromHeaders, sessionTokenFromHeaders, toWebRequest, verifyAndParseAccountsWebhook };

package/dist/nest.js

@@ -0,0 +1,134 @@
+import {
+  introspectServiceKey,
+  normalizeAccountsWebhook,
+  scopeSatisfied,
+  serviceKeyFromRequest,
+  verifyWebhookSignature
+} from "./chunk-TQNQLX3C.js";
+
+// src/nest.ts
+import { createHash } from "crypto";
+function headerValue(carrier, name) {
+  const v = carrier.headers[name] ?? carrier.headers[name.toLowerCase()];
+  return Array.isArray(v) ? v[0] : v;
+}
+function toWebRequest(carrier) {
+  const headers = new Headers();
+  for (const [k, v] of Object.entries(carrier.headers)) {
+    if (v === void 0) continue;
+    if (Array.isArray(v)) {
+      for (const item of v) headers.append(k, item);
+    } else {
+      headers.set(k, v);
+    }
+  }
+  return new Request("http://localhost/", { headers });
+}
+function serviceKeyFromHeaders(carrier) {
+  return serviceKeyFromRequest(toWebRequest(carrier));
+}
+function createServiceKeyResolver(opts) {
+  const ttl = opts.cacheTtlMs ?? 6e4;
+  const cache = /* @__PURE__ */ new Map();
+  async function resolve(carrier) {
+    const key = serviceKeyFromHeaders(carrier);
+    if (!key) return { status: "absent" };
+    const hash = createHash("sha256").update(key).digest("hex");
+    const now = Date.now();
+    let ctx;
+    const cached = ttl > 0 ? cache.get(hash) : void 0;
+    if (cached && cached.expires > now) {
+      ctx = cached.value;
+    } else {
+      ctx = await introspectServiceKey({ config: opts.config, key, fetchImpl: opts.fetchImpl });
+      if (ttl > 0) cache.set(hash, { value: ctx, expires: now + ttl });
+    }
+    return ctx ? { status: "ok", context: ctx } : { status: "invalid" };
+  }
+  function invalidate(key) {
+    cache.delete(createHash("sha256").update(key).digest("hex"));
+  }
+  return { resolve, invalidate };
+}
+function sessionTokenFromHeaders(carrier) {
+  const auth = headerValue(carrier, "authorization");
+  if (!auth || !auth.startsWith("Bearer ")) return null;
+  const token = auth.slice(7).trim();
+  if (!token || token.startsWith("sk_")) return null;
+  return token;
+}
+function createUserSessionResolver(opts) {
+  const ttl = opts.cacheTtlMs ?? 6e4;
+  const cache = /* @__PURE__ */ new Map();
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  async function introspect(token) {
+    const base = opts.config.baseUrl?.replace(/\/$/, "");
+    if (!base || !token) return null;
+    try {
+      const res = await fetchImpl(new URL("/api/auth/me", base), {
+        headers: { authorization: `Bearer ${token}`, accept: "application/json" }
+      });
+      if (!res.ok) return null;
+      const data = await res.json();
+      const userId = data.user?.id;
+      const sessionId = data.session?.id;
+      if (!userId || !sessionId) return null;
+      return {
+        userId,
+        email: data.user?.emailAddress ?? data.user?.email,
+        name: data.user?.name,
+        sessionId,
+        appId: data.session?.appId ?? null,
+        tenantId: data.session?.tenantId ?? null,
+        expiresAt: data.session?.expiresAt
+      };
+    } catch {
+      return null;
+    }
+  }
+  async function resolve(carrier) {
+    const token = sessionTokenFromHeaders(carrier);
+    if (!token) return null;
+    const hash = createHash("sha256").update(token).digest("hex");
+    const now = Date.now();
+    const cached = ttl > 0 ? cache.get(hash) : void 0;
+    if (cached && cached.expires > now) return cached.value;
+    const ctx = await introspect(token);
+    if (ttl > 0) cache.set(hash, { value: ctx, expires: now + ttl });
+    return ctx;
+  }
+  function invalidate(token) {
+    cache.delete(createHash("sha256").update(token).digest("hex"));
+  }
+  return { resolve, invalidate };
+}
+function hasScopes(ctx, required) {
+  return required.every((scope) => scopeSatisfied(ctx.scopes, scope));
+}
+function canAccessApp(ctx, appIdOrSlug) {
+  return ctx.accessibleApps.some((a) => a.id === appIdOrSlug || a.slug === appIdOrSlug);
+}
+var ACCOUNTS_WEBHOOK_SIGNATURE_HEADER = "x-webhook-signature";
+function verifyAndParseAccountsWebhook(rawBody, signatureHeaderValue, secret) {
+  const signature = Array.isArray(signatureHeaderValue) ? signatureHeaderValue[0] : signatureHeaderValue;
+  if (!verifyWebhookSignature(rawBody, signature ?? null, secret)) {
+    return { ok: false, reason: "bad_signature" };
+  }
+  try {
+    return { ok: true, event: normalizeAccountsWebhook(JSON.parse(rawBody)) };
+  } catch {
+    return { ok: false, reason: "bad_json" };
+  }
+}
+export {
+  ACCOUNTS_WEBHOOK_SIGNATURE_HEADER,
+  canAccessApp,
+  createServiceKeyResolver,
+  createUserSessionResolver,
+  hasScopes,
+  normalizeAccountsWebhook,
+  serviceKeyFromHeaders,
+  sessionTokenFromHeaders,
+  toWebRequest,
+  verifyAndParseAccountsWebhook
+};

package/dist/sveltekit.d.ts

@@ -55,7 +55,10 @@ type AccountsWebhookOptions = {
     secret: string;
     /** Route to receive webhooks on. Default '/api/auth/accounts/webhook'. */
     path?: string;
-    /** Header carrying the signature. Default 'x-accounts-signature'. */
+    /**
+     * Header carrying the signature. Default 'x-webhook-signature' — the header the Accounts
+     * webhook worker actually sends (HMAC-SHA256 hex of the raw body).
+     */
     signatureHeader?: string;
     /** React to a verified event. Throwing yields a 500 (Accounts may retry). */
     onEvent: (event: AccountsWebhookEvent, raw: string, request: RequestEvent) => void | Promise<void>;

package/dist/sveltekit.js

@@ -5,10 +5,11 @@ import {
   identityPassthroughSync,
   introspectServiceKey,
   logoutFromAccounts,
+  normalizeAccountsWebhook,
   readPlatformSessionCookie,
   serviceKeyFromRequest,
   verifyWebhookSignature
-} from "./chunk-QIAL6IDV.js";
+} from "./chunk-TQNQLX3C.js";
 
 // src/sveltekit.ts
 import { createHash } from "crypto";
@@ -113,21 +114,21 @@ function jsonResponse(status, body) {
 }
 function createAccountsWebhookHandle(opts) {
   const path = opts.path ?? "/api/auth/accounts/webhook";
-  const sigHeader = opts.signatureHeader ?? "x-accounts-signature";
+  const sigHeader = opts.signatureHeader ?? "x-webhook-signature";
   return async ({ event, resolve }) => {
     if (event.url.pathname !== path || event.request.method !== "POST") return resolve(event);
     const raw = await event.request.text();
     if (!verifyWebhookSignature(raw, event.request.headers.get(sigHeader), opts.secret)) {
       return jsonResponse(401, { ok: false, error: "Invalid webhook signature." });
     }
-    let payload;
+    let parsed;
     try {
-      payload = JSON.parse(raw);
+      parsed = normalizeAccountsWebhook(JSON.parse(raw));
     } catch {
       return jsonResponse(400, { ok: false, error: "Invalid JSON body." });
     }
     try {
-      await opts.onEvent({ ...payload, type: String(payload.type ?? "unknown") }, raw, event);
+      await opts.onEvent(parsed, raw, event);
     } catch {
       return jsonResponse(500, { ok: false, error: "Webhook handler failed." });
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@~lyre/auth",
-  "version": "0.0.9",
+  "version": "0.3.0",
   "description": "Shared Axis Accounts auth SDK — framework-agnostic session/identity core (HMAC-signed cookies, accounts login/callback/logout) plus an optional turnkey SvelteKit adapter.",
   "type": "module",
   "sideEffects": false,
@@ -33,7 +33,16 @@
     "./sveltekit": {
       "types": "./dist/sveltekit.d.ts",
       "import": "./dist/sveltekit.js"
-    }
+    },
+    "./nest": {
+      "types": "./dist/nest.d.ts",
+      "import": "./dist/nest.js"
+    },
+    "./admin": {
+      "types": "./dist/admin.d.ts",
+      "import": "./dist/admin.js"
+    },
+    "./package.json": "./package.json"
   },
   "files": [
     "dist",
@@ -41,7 +50,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsup src/index.ts src/sveltekit.ts --format esm --dts --clean",
+    "build": "tsup src/index.ts src/sveltekit.ts src/nest.ts src/admin.ts --format esm --dts --clean",
     "check": "tsc --noEmit"
   },
   "peerDependencies": {