alepha 0.21.2 → 0.23.0

package/dist/server/auth/index.browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/index.browser.ts"],"sourcesContent":["export const alephaServerAuthRoutes = {\n  login: \"/oauth/login\",\n  callback: \"/oauth/callback\",\n  logout: \"/oauth/logout\",\n  token: \"/_auth/token\",\n  refresh: \"/_auth/refresh\",\n  userinfo: \"/_auth/userinfo\",\n};\n","import { type Static, t } from \"alepha\";\n\nexport const authenticationProviderSchema = t.object(\n  {\n    name: t.text({\n      description: \"Name of the authentication provider.\",\n    }),\n    type: t.enum([\"OAUTH2\", \"OIDC\", \"CREDENTIALS\"], {\n      description: \"Type of the authentication provider.\",\n    }),\n  },\n  {\n    title: \"AuthenticationProvider\",\n  },\n);\n\nexport type AuthenticationProvider = Static<\n  typeof authenticationProviderSchema\n>;\n","import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const tokensSchema = t.object({\n  provider: t.text(),\n  access_token: t.text({ size: \"rich\" }),\n  issued_at: t.number(),\n  expires_in: t.optional(t.number()),\n  refresh_token: t.optional(t.text({ size: \"rich\" })),\n  refresh_token_expires_in: t.optional(t.number()),\n  refresh_expires_in: t.optional(\n    t.number({\n      description:\n        \"Alias of `refresh_token_expires_in` for compatibility with some providers.\",\n    }),\n  ),\n  id_token: t.optional(t.text({ size: \"rich\" })),\n  scope: t.optional(t.text()),\n});\n\nexport type Tokens = Static<typeof tokensSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\nimport { tokensSchema } from \"./tokensSchema.ts\";\n\nexport const tokenResponseSchema = t.extend(tokensSchema, {\n  user: userAccountInfoSchema,\n  api: apiRegistryResponseSchema,\n});\n\nexport type TokenResponse = Static<typeof tokenResponseSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\n\nexport const userinfoResponseSchema = t.object({\n  user: t.optional(userAccountInfoSchema),\n  api: apiRegistryResponseSchema,\n});\n\nexport type UserinfoResponse = Static<typeof userinfoResponseSchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./index.shared.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerAuth = $module({\n  name: \"alepha.server.auth\",\n  primitives: [],\n  services: [],\n});\n"],"mappings":";;;;AAAA,MAAa,yBAAyB;CACpC,OAAO;CACP,UAAU;CACV,QAAQ;CACR,OAAO;CACP,SAAS;CACT,UAAU;CACX;;;ACLD,MAAa,+BAA+B,EAAE,OAC5C;CACE,MAAM,EAAE,KAAK,EACX,aAAa,wCACd,CAAC;CACF,MAAM,EAAE,KAAK;EAAC;EAAU;EAAQ;EAAc,EAAE,EAC9C,aAAa,wCACd,CAAC;CACH,EACD,EACE,OAAO,0BACR,CACF;;;ACXD,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,MAAM;CAClB,cAAc,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;CACtC,WAAW,EAAE,QAAQ;CACrB,YAAY,EAAE,SAAS,EAAE,QAAQ,CAAC;CAClC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC;CACnD,0BAA0B,EAAE,SAAS,EAAE,QAAQ,CAAC;CAChD,oBAAoB,EAAE,SACpB,EAAE,OAAO,EACP,aACE,8EACH,CAAC,CACH;CACD,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC;CAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;;;ACbF,MAAa,sBAAsB,EAAE,OAAO,cAAc;CACxD,MAAM;CACN,KAAK;CACN,CAAC;;;ACJF,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,SAAS,sBAAsB;CACvC,KAAK;CACN,CAAC;;;ACCF,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,YAAY,EAAE;CACd,UAAU,EAAE;CACb,CAAC"}
+{"version":3,"file":"index.browser.js","names":[],"sources":["../../../src/server/auth/constants/routes.ts","../../../src/server/auth/schemas/authenticationProviderSchema.ts","../../../src/server/auth/schemas/tokensSchema.ts","../../../src/server/auth/schemas/tokenResponseSchema.ts","../../../src/server/auth/schemas/userinfoResponseSchema.ts","../../../src/server/auth/index.browser.ts"],"sourcesContent":["export const alephaServerAuthRoutes = {\n  login: \"/oauth/login\",\n  callback: \"/oauth/callback\",\n  logout: \"/oauth/logout\",\n  token: \"/_auth/token\",\n  refresh: \"/_auth/refresh\",\n  userinfo: \"/_auth/userinfo\",\n};\n","import { type Static, t } from \"alepha\";\n\nexport const authenticationProviderSchema = t.object(\n  {\n    name: t.text({\n      description: \"Name of the authentication provider.\",\n    }),\n    type: t.enum([\"OAUTH2\", \"OIDC\", \"CREDENTIALS\"], {\n      description: \"Type of the authentication provider.\",\n    }),\n  },\n  {\n    title: \"AuthenticationProvider\",\n  },\n);\n\nexport type AuthenticationProvider = Static<\n  typeof authenticationProviderSchema\n>;\n","import type { Static } from \"alepha\";\nimport { t } from \"alepha\";\n\nexport const tokensSchema = t.object({\n  provider: t.text(),\n  access_token: t.text({ size: \"rich\" }),\n  issued_at: t.number(),\n  expires_in: t.optional(t.number()),\n  refresh_token: t.optional(t.text({ size: \"rich\" })),\n  refresh_token_expires_in: t.optional(t.number()),\n  refresh_expires_in: t.optional(\n    t.number({\n      description:\n        \"Alias of `refresh_token_expires_in` for compatibility with some providers.\",\n    }),\n  ),\n  id_token: t.optional(t.text({ size: \"rich\" })),\n  scope: t.optional(t.text()),\n});\n\nexport type Tokens = Static<typeof tokensSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\nimport { tokensSchema } from \"./tokensSchema.ts\";\n\nexport const tokenResponseSchema = t.extend(tokensSchema, {\n  user: userAccountInfoSchema,\n  api: apiRegistryResponseSchema,\n});\n\nexport type TokenResponse = Static<typeof tokenResponseSchema>;\n","import { type Static, t } from \"alepha\";\nimport { userAccountInfoSchema } from \"alepha/security\";\nimport { apiRegistryResponseSchema } from \"alepha/server/links\";\n\nexport const userinfoResponseSchema = t.object({\n  user: t.optional(userAccountInfoSchema),\n  api: apiRegistryResponseSchema,\n});\n\nexport type UserinfoResponse = Static<typeof userinfoResponseSchema>;\n","import { $module } from \"alepha\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport * from \"./index.shared.ts\";\n\n// ---------------------------------------------------------------------------------------------------------------------\n\nexport const AlephaServerAuth = $module({\n  name: \"alepha.server.auth\",\n  primitives: [],\n  services: [],\n});\n"],"mappings":";;;;AAAA,MAAa,yBAAyB;CACpC,OAAO;CACP,UAAU;CACV,QAAQ;CACR,OAAO;CACP,SAAS;CACT,UAAU;AACZ;;;ACLA,MAAa,+BAA+B,EAAE,OAC5C;CACE,MAAM,EAAE,KAAK,EACX,aAAa,uCACf,CAAC;CACD,MAAM,EAAE,KAAK;EAAC;EAAU;EAAQ;CAAa,GAAG,EAC9C,aAAa,uCACf,CAAC;AACH,GACA,EACE,OAAO,yBACT,CACF;;;ACXA,MAAa,eAAe,EAAE,OAAO;CACnC,UAAU,EAAE,KAAK;CACjB,cAAc,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;CACrC,WAAW,EAAE,OAAO;CACpB,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC;CACjC,eAAe,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC;CAClD,0BAA0B,EAAE,SAAS,EAAE,OAAO,CAAC;CAC/C,oBAAoB,EAAE,SACpB,EAAE,OAAO,EACP,aACE,6EACJ,CAAC,CACH;CACA,UAAU,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC,CAAC;CAC7C,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC;AAC5B,CAAC;;;ACbD,MAAa,sBAAsB,EAAE,OAAO,cAAc;CACxD,MAAM;CACN,KAAK;AACP,CAAC;;;ACJD,MAAa,yBAAyB,EAAE,OAAO;CAC7C,MAAM,EAAE,SAAS,qBAAqB;CACtC,KAAK;AACP,CAAC;;;ACCD,MAAa,mBAAmB,QAAQ;CACtC,MAAM;CACN,YAAY,CAAC;CACb,UAAU,CAAC;AACb,CAAC"}

package/dist/server/auth/index.d.ts

@@ -1,15 +1,52 @@
-import * as _$alepha from "alepha";
 import { Alepha, Async, KIND, Primitive, Static } from "alepha";
-import * as _$alepha_server_cookies0 from "alepha/server/cookies";
 import { Cookies, ServerCookiesProvider } from "alepha/server/cookies";
 import { DateTimeProvider } from "alepha/datetime";
 import { AccessTokenResponse, IssuerPrimitive, SecurityProvider, UserAccount } from "alepha/security";
-import * as _$alepha_logger0 from "alepha/logger";
-import * as _$alepha_server0 from "alepha/server";
 import { ServerRawRequest, ServerReply } from "alepha/server";
 import { ServerLinksProvider } from "alepha/server/links";
-import * as _$typebox from "typebox";
 
+//#region ../../src/server/auth/helpers/appleClientSecret.d.ts
+interface AppleClientSecretOptions {
+  privateKeyPem: string;
+  teamId: string;
+  serviceId: string;
+  keyId: string;
+  ttlSeconds?: number;
+}
+/** Signs Apple's short-lived ES256 client_secret JWT on demand (no rotation job). */
+declare function signAppleClientSecret(opts: AppleClientSecretOptions): Promise<string>;
+//#endregion
+//#region ../../src/server/auth/helpers/federationAssertion.d.ts
+interface FederationProfile {
+  provider: "google" | "apple";
+  sub: string;
+  email?: string;
+  email_verified?: boolean;
+  name?: string;
+  given_name?: string;
+  family_name?: string;
+  picture?: string;
+  is_private_email?: boolean;
+}
+interface SignAssertionOptions {
+  privateKeyPem: string;
+  issuer: string;
+  audience: string;
+  ttlSeconds?: number;
+  jti?: string;
+}
+interface VerifyAssertionOptions {
+  publicKeyPem: string;
+  issuer: string;
+  audience: string;
+}
+interface VerifiedAssertion {
+  profile: FederationProfile;
+  jti: string;
+}
+declare function signFederationAssertion(profile: FederationProfile, opts: SignAssertionOptions): Promise<string>;
+declare function verifyFederationAssertion(token: string, opts: VerifyAssertionOptions): Promise<VerifiedAssertion>;
+//#endregion
 //#region ../../src/server/auth/constants/routes.d.ts
 declare const alephaServerAuthRoutes: {
   login: string;
@@ -21,85 +58,85 @@ declare const alephaServerAuthRoutes: {
 };
 //#endregion
 //#region ../../src/server/auth/schemas/authenticationProviderSchema.d.ts
-declare const authenticationProviderSchema: _$typebox.TObject<{
-  name: _$typebox.TString;
-  type: _$typebox.TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
+declare const authenticationProviderSchema: import("typebox").TObject<{
+  name: import("typebox").TString;
+  type: import("typebox").TUnsafe<"OAUTH2" | "OIDC" | "CREDENTIALS">;
 }>;
 type AuthenticationProvider = Static<typeof authenticationProviderSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokenResponseSchema.d.ts
-declare const tokenResponseSchema: _$typebox.TObject<{
-  provider: _$typebox.TString;
-  access_token: _$typebox.TString;
-  issued_at: _$typebox.TNumber;
-  expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  refresh_token: _$typebox.TOptional<_$typebox.TString>;
-  refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  id_token: _$typebox.TOptional<_$typebox.TString>;
-  scope: _$typebox.TOptional<_$typebox.TString>;
-  user: _$typebox.TObject<{
-    id: _$typebox.TString;
-    name: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    sessionId: _$typebox.TOptional<_$typebox.TString>;
-    organization: _$typebox.TOptional<_$typebox.TString>;
-    roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-    realm: _$typebox.TOptional<_$typebox.TString>;
+declare const tokenResponseSchema: import("typebox").TObject<{
+  provider: import("typebox").TString;
+  access_token: import("typebox").TString;
+  issued_at: import("typebox").TNumber;
+  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  refresh_token: import("typebox").TOptional<import("typebox").TString>;
+  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  id_token: import("typebox").TOptional<import("typebox").TString>;
+  scope: import("typebox").TOptional<import("typebox").TString>;
+  user: import("typebox").TObject<{
+    id: import("typebox").TString;
+    name: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    sessionId: import("typebox").TOptional<import("typebox").TString>;
+    organization: import("typebox").TOptional<import("typebox").TString>;
+    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
+    realm: import("typebox").TOptional<import("typebox").TString>;
   }>;
-  api: _$typebox.TObject<{
-    prefix: _$typebox.TOptional<_$typebox.TString>;
-    actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-      path: _$typebox.TString;
-      method: _$typebox.TOptional<_$typebox.TString>;
-      contentType: _$typebox.TOptional<_$typebox.TString>;
-      kind: _$typebox.TOptional<_$typebox.TString>;
-      service: _$typebox.TOptional<_$typebox.TString>;
+  api: import("typebox").TObject<{
+    prefix: import("typebox").TOptional<import("typebox").TString>;
+    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
+      path: import("typebox").TString;
+      method: import("typebox").TOptional<import("typebox").TString>;
+      contentType: import("typebox").TOptional<import("typebox").TString>;
+      kind: import("typebox").TOptional<import("typebox").TString>;
+      service: import("typebox").TOptional<import("typebox").TString>;
     }>>;
-    permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
   }>;
 }>;
 type TokenResponse = Static<typeof tokenResponseSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/tokensSchema.d.ts
-declare const tokensSchema: _$typebox.TObject<{
-  provider: _$typebox.TString;
-  access_token: _$typebox.TString;
-  issued_at: _$typebox.TNumber;
-  expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  refresh_token: _$typebox.TOptional<_$typebox.TString>;
-  refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-  id_token: _$typebox.TOptional<_$typebox.TString>;
-  scope: _$typebox.TOptional<_$typebox.TString>;
+declare const tokensSchema: import("typebox").TObject<{
+  provider: import("typebox").TString;
+  access_token: import("typebox").TString;
+  issued_at: import("typebox").TNumber;
+  expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  refresh_token: import("typebox").TOptional<import("typebox").TString>;
+  refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+  id_token: import("typebox").TOptional<import("typebox").TString>;
+  scope: import("typebox").TOptional<import("typebox").TString>;
 }>;
 type Tokens = Static<typeof tokensSchema>;
 //#endregion
 //#region ../../src/server/auth/schemas/userinfoResponseSchema.d.ts
-declare const userinfoResponseSchema: _$typebox.TObject<{
-  user: _$typebox.TOptional<_$typebox.TObject<{
-    id: _$typebox.TString;
-    name: _$typebox.TOptional<_$typebox.TString>;
-    email: _$typebox.TOptional<_$typebox.TString>;
-    username: _$typebox.TOptional<_$typebox.TString>;
-    picture: _$typebox.TOptional<_$typebox.TString>;
-    sessionId: _$typebox.TOptional<_$typebox.TString>;
-    organization: _$typebox.TOptional<_$typebox.TString>;
-    roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-    realm: _$typebox.TOptional<_$typebox.TString>;
+declare const userinfoResponseSchema: import("typebox").TObject<{
+  user: import("typebox").TOptional<import("typebox").TObject<{
+    id: import("typebox").TString;
+    name: import("typebox").TOptional<import("typebox").TString>;
+    email: import("typebox").TOptional<import("typebox").TString>;
+    username: import("typebox").TOptional<import("typebox").TString>;
+    picture: import("typebox").TOptional<import("typebox").TString>;
+    sessionId: import("typebox").TOptional<import("typebox").TString>;
+    organization: import("typebox").TOptional<import("typebox").TString>;
+    roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
+    realm: import("typebox").TOptional<import("typebox").TString>;
   }>>;
-  api: _$typebox.TObject<{
-    prefix: _$typebox.TOptional<_$typebox.TString>;
-    actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-      path: _$typebox.TString;
-      method: _$typebox.TOptional<_$typebox.TString>;
-      contentType: _$typebox.TOptional<_$typebox.TString>;
-      kind: _$typebox.TOptional<_$typebox.TString>;
-      service: _$typebox.TOptional<_$typebox.TString>;
+  api: import("typebox").TObject<{
+    prefix: import("typebox").TOptional<import("typebox").TString>;
+    actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
+      path: import("typebox").TString;
+      method: import("typebox").TOptional<import("typebox").TString>;
+      contentType: import("typebox").TOptional<import("typebox").TString>;
+      kind: import("typebox").TOptional<import("typebox").TString>;
+      service: import("typebox").TOptional<import("typebox").TString>;
     }>>;
-    permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+    permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
   }>;
 }>;
 type UserinfoResponse = Static<typeof userinfoResponseSchema>;
@@ -1160,7 +1197,7 @@ declare class Configuration implements ConfigurationMethods, ConfigurationProper
 //#endregion
 //#region ../../src/server/auth/providers/ServerAuthProvider.d.ts
 declare class ServerAuthProvider {
-  protected readonly log: _$alepha_logger0.Logger;
+  protected readonly log: import("alepha/logger").Logger;
   protected readonly alepha: Alepha;
   protected readonly serverCookiesProvider: ServerCookiesProvider;
   protected readonly dateTimeProvider: DateTimeProvider;
@@ -1175,137 +1212,137 @@ declare class ServerAuthProvider {
    */
   protected validateRedirectUri(uri: string): string;
   get identities(): Array<AuthPrimitive>;
-  protected readonly authorizationCode: _$alepha_server_cookies0.AbstractCookiePrimitive<_$typebox.TObject<{
-    provider: _$typebox.TString;
-    realm: _$typebox.TOptional<_$typebox.TString>;
-    codeVerifier: _$typebox.TOptional<_$typebox.TString>;
-    redirectUri: _$typebox.TOptional<_$typebox.TString>;
-    loginUri: _$typebox.TOptional<_$typebox.TString>;
-    state: _$typebox.TOptional<_$typebox.TString>;
-    nonce: _$typebox.TOptional<_$typebox.TString>;
+  protected readonly authorizationCode: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
+    provider: import("typebox").TString;
+    realm: import("typebox").TOptional<import("typebox").TString>;
+    codeVerifier: import("typebox").TOptional<import("typebox").TString>;
+    redirectUri: import("typebox").TOptional<import("typebox").TString>;
+    loginUri: import("typebox").TOptional<import("typebox").TString>;
+    state: import("typebox").TOptional<import("typebox").TString>;
+    nonce: import("typebox").TOptional<import("typebox").TString>;
   }>>;
-  readonly tokens: _$alepha_server_cookies0.AbstractCookiePrimitive<_$typebox.TObject<{
-    provider: _$typebox.TString;
-    access_token: _$typebox.TString;
-    issued_at: _$typebox.TNumber;
-    expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-    refresh_token: _$typebox.TOptional<_$typebox.TString>;
-    refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-    refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-    id_token: _$typebox.TOptional<_$typebox.TString>;
-    scope: _$typebox.TOptional<_$typebox.TString>;
+  readonly tokens: import("alepha/server/cookies").AbstractCookiePrimitive<import("typebox").TObject<{
+    provider: import("typebox").TString;
+    access_token: import("typebox").TString;
+    issued_at: import("typebox").TNumber;
+    expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+    refresh_token: import("typebox").TOptional<import("typebox").TString>;
+    refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+    refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+    id_token: import("typebox").TOptional<import("typebox").TString>;
+    scope: import("typebox").TOptional<import("typebox").TString>;
   }>>;
-  protected readonly configure: _$alepha.HookPrimitive<"configure">;
+  protected readonly configure: import("alepha").HookPrimitive<"configure">;
   /**
    * Fill request headers with access token from cookies or fallback to provider's fallback function.
    */
-  protected readonly onRequest: _$alepha.HookPrimitive<"server:onRequest">;
+  protected readonly onRequest: import("alepha").HookPrimitive<"server:onRequest">;
   /**
    * Get user information.
    */
-  readonly userinfo: _$alepha_server0.RoutePrimitive<{
-    response: _$typebox.TObject<{
-      user: _$typebox.TOptional<_$typebox.TObject<{
-        id: _$typebox.TString;
-        name: _$typebox.TOptional<_$typebox.TString>;
-        email: _$typebox.TOptional<_$typebox.TString>;
-        username: _$typebox.TOptional<_$typebox.TString>;
-        picture: _$typebox.TOptional<_$typebox.TString>;
-        sessionId: _$typebox.TOptional<_$typebox.TString>;
-        organization: _$typebox.TOptional<_$typebox.TString>;
-        roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-        realm: _$typebox.TOptional<_$typebox.TString>;
+  readonly userinfo: import("alepha/server").RoutePrimitive<{
+    response: import("typebox").TObject<{
+      user: import("typebox").TOptional<import("typebox").TObject<{
+        id: import("typebox").TString;
+        name: import("typebox").TOptional<import("typebox").TString>;
+        email: import("typebox").TOptional<import("typebox").TString>;
+        username: import("typebox").TOptional<import("typebox").TString>;
+        picture: import("typebox").TOptional<import("typebox").TString>;
+        sessionId: import("typebox").TOptional<import("typebox").TString>;
+        organization: import("typebox").TOptional<import("typebox").TString>;
+        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
+        realm: import("typebox").TOptional<import("typebox").TString>;
       }>>;
-      api: _$typebox.TObject<{
-        prefix: _$typebox.TOptional<_$typebox.TString>;
-        actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-          path: _$typebox.TString;
-          method: _$typebox.TOptional<_$typebox.TString>;
-          contentType: _$typebox.TOptional<_$typebox.TString>;
-          kind: _$typebox.TOptional<_$typebox.TString>;
-          service: _$typebox.TOptional<_$typebox.TString>;
+      api: import("typebox").TObject<{
+        prefix: import("typebox").TOptional<import("typebox").TString>;
+        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
+          path: import("typebox").TString;
+          method: import("typebox").TOptional<import("typebox").TString>;
+          contentType: import("typebox").TOptional<import("typebox").TString>;
+          kind: import("typebox").TOptional<import("typebox").TString>;
+          service: import("typebox").TOptional<import("typebox").TString>;
         }>>;
-        permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
       }>;
     }>;
   }>;
   /**
    * Refresh a token for internal providers.
    */
-  readonly refresh: _$alepha_server0.RoutePrimitive<{
-    query: _$typebox.TObject<{
-      provider: _$typebox.TString;
+  readonly refresh: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      provider: import("typebox").TString;
     }>;
-    body: _$typebox.TObject<{
-      refresh_token: _$typebox.TString;
-      access_token: _$typebox.TOptional<_$typebox.TString>;
+    body: import("typebox").TObject<{
+      refresh_token: import("typebox").TString;
+      access_token: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    response: _$typebox.TObject<{
-      provider: _$typebox.TString;
-      access_token: _$typebox.TString;
-      issued_at: _$typebox.TNumber;
-      expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      refresh_token: _$typebox.TOptional<_$typebox.TString>;
-      refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      id_token: _$typebox.TOptional<_$typebox.TString>;
-      scope: _$typebox.TOptional<_$typebox.TString>;
+    response: import("typebox").TObject<{
+      provider: import("typebox").TString;
+      access_token: import("typebox").TString;
+      issued_at: import("typebox").TNumber;
+      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      refresh_token: import("typebox").TOptional<import("typebox").TString>;
+      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      id_token: import("typebox").TOptional<import("typebox").TString>;
+      scope: import("typebox").TOptional<import("typebox").TString>;
     }>;
   }>;
   /**
    * Login for local password-based authentication.
    */
-  readonly token: _$alepha_server0.RoutePrimitive<{
-    query: _$typebox.TObject<{
-      provider: _$typebox.TString;
-      realm: _$typebox.TOptional<_$typebox.TString>;
+  readonly token: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      provider: import("typebox").TString;
+      realm: import("typebox").TOptional<import("typebox").TString>;
     }>;
-    body: _$typebox.TObject<{
-      username: _$typebox.TString;
-      password: _$typebox.TString;
+    body: import("typebox").TObject<{
+      username: import("typebox").TString;
+      password: import("typebox").TString;
     }>;
-    response: _$typebox.TObject<{
-      provider: _$typebox.TString;
-      access_token: _$typebox.TString;
-      issued_at: _$typebox.TNumber;
-      expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      refresh_token: _$typebox.TOptional<_$typebox.TString>;
-      refresh_token_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      refresh_expires_in: _$typebox.TOptional<_$typebox.TNumber>;
-      id_token: _$typebox.TOptional<_$typebox.TString>;
-      scope: _$typebox.TOptional<_$typebox.TString>;
-      user: _$typebox.TObject<{
-        id: _$typebox.TString;
-        name: _$typebox.TOptional<_$typebox.TString>;
-        email: _$typebox.TOptional<_$typebox.TString>;
-        username: _$typebox.TOptional<_$typebox.TString>;
-        picture: _$typebox.TOptional<_$typebox.TString>;
-        sessionId: _$typebox.TOptional<_$typebox.TString>;
-        organization: _$typebox.TOptional<_$typebox.TString>;
-        roles: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
-        realm: _$typebox.TOptional<_$typebox.TString>;
+    response: import("typebox").TObject<{
+      provider: import("typebox").TString;
+      access_token: import("typebox").TString;
+      issued_at: import("typebox").TNumber;
+      expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      refresh_token: import("typebox").TOptional<import("typebox").TString>;
+      refresh_token_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      refresh_expires_in: import("typebox").TOptional<import("typebox").TNumber>;
+      id_token: import("typebox").TOptional<import("typebox").TString>;
+      scope: import("typebox").TOptional<import("typebox").TString>;
+      user: import("typebox").TObject<{
+        id: import("typebox").TString;
+        name: import("typebox").TOptional<import("typebox").TString>;
+        email: import("typebox").TOptional<import("typebox").TString>;
+        username: import("typebox").TOptional<import("typebox").TString>;
+        picture: import("typebox").TOptional<import("typebox").TString>;
+        sessionId: import("typebox").TOptional<import("typebox").TString>;
+        organization: import("typebox").TOptional<import("typebox").TString>;
+        roles: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
+        realm: import("typebox").TOptional<import("typebox").TString>;
       }>;
-      api: _$typebox.TObject<{
-        prefix: _$typebox.TOptional<_$typebox.TString>;
-        actions: _$typebox.TRecord<"^.*$", _$typebox.TObject<{
-          path: _$typebox.TString;
-          method: _$typebox.TOptional<_$typebox.TString>;
-          contentType: _$typebox.TOptional<_$typebox.TString>;
-          kind: _$typebox.TOptional<_$typebox.TString>;
-          service: _$typebox.TOptional<_$typebox.TString>;
+      api: import("typebox").TObject<{
+        prefix: import("typebox").TOptional<import("typebox").TString>;
+        actions: import("typebox").TRecord<"^.*$", import("typebox").TObject<{
+          path: import("typebox").TString;
+          method: import("typebox").TOptional<import("typebox").TString>;
+          contentType: import("typebox").TOptional<import("typebox").TString>;
+          kind: import("typebox").TOptional<import("typebox").TString>;
+          service: import("typebox").TOptional<import("typebox").TString>;
         }>>;
-        permissions: _$typebox.TOptional<_$typebox.TArray<_$typebox.TString>>;
+        permissions: import("typebox").TOptional<import("typebox").TArray<import("typebox").TString>>;
       }>;
     }>;
   }>;
   /**
    * Oauth2/OIDC login route.
    */
-  readonly login: _$alepha_server0.RoutePrimitive<{
-    query: _$typebox.TObject<{
-      provider: _$typebox.TString;
-      realm: _$typebox.TOptional<_$typebox.TString>;
-      redirect_uri: _$typebox.TOptional<_$typebox.TString>;
+  readonly login: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      provider: import("typebox").TString;
+      realm: import("typebox").TOptional<import("typebox").TString>;
+      redirect_uri: import("typebox").TOptional<import("typebox").TString>;
     }>;
   }>;
   /**
@@ -1321,22 +1358,28 @@ declare class ServerAuthProvider {
    * is passed so openid-client can read the authorization code from the POST body.
    */
   protected handleCallback(url: URL, reply: ServerReply, cookies: Cookies, raw?: ServerRawRequest): Promise<void>;
+  /**
+   * Establish a local session for an already-resolved user: mint realm tokens
+   * and write the `tokens` cookie. Used by the OAuth callback and by federated
+   * (broker) login. `issuer` is the realm issuer (provider.issuer / realm).
+   */
+  establishSession(user: UserAccount, issuer: IssuerPrimitive, providerName: string, cookies: Cookies): Promise<void>;
   /**
    * Callback for OAuth2/OIDC providers.
    * It handles the authorization code flow and retrieves the access token.
    */
-  readonly callback: _$alepha_server0.RoutePrimitive<_$alepha_server0.RequestConfigSchema>;
+  readonly callback: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
   /**
    * POST callback for OAuth2/OIDC providers using form_post response mode.
    * Apple Sign In sends the authorization code via POST body instead of URL query parameters.
    */
-  readonly callbackPost: _$alepha_server0.RoutePrimitive<_$alepha_server0.RequestConfigSchema>;
+  readonly callbackPost: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
   /**
    * Logout route for OAuth2/OIDC providers.
    */
-  readonly logout: _$alepha_server0.RoutePrimitive<{
-    query: _$typebox.TObject<{
-      post_logout_redirect_uri: _$typebox.TOptional<_$typebox.TString>;
+  readonly logout: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      post_logout_redirect_uri: import("typebox").TOptional<import("typebox").TString>;
     }>;
   }>;
   getAuthenticationProviders(filters?: {
@@ -1692,6 +1735,62 @@ declare const $authCredentials: (realm: IssuerPrimitive & WithLoginFn, options?:
  */
 declare const $authFacebook: (realm: IssuerPrimitive & WithLinkFn, options?: Partial<OidcOptions>) => AuthPrimitive;
 //#endregion
+//#region ../../src/server/auth/primitives/$authFederationBroker.d.ts
+interface FederationBrokerProviders {
+  google?: {
+    clientId: string;
+    clientSecret: string;
+  };
+  apple?: {
+    serviceId: string;
+    teamId: string;
+    keyId: string;
+    privateKeyPem: string;
+  };
+}
+interface FederationBrokerOptions {
+  /** Broker public origin, e.g. https://alepha.club — becomes the assertion `iss`. */
+  issuer: string;
+  /** EdDSA PKCS#8 PEM — signs assertions. */
+  signingKeyPem: string;
+  providers: FederationBrokerProviders;
+  /** Validate the requested tenant and return its exact origin (or null to reject). */
+  resolveTenant: (tenant: string) => Promise<string | null>;
+  assertionTtlSeconds?: number;
+}
+declare const $authFederationBroker: (options: FederationBrokerOptions) => {
+  start: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      provider: import("typebox").TString;
+      tenant: import("typebox").TString;
+      redirect: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+  }>;
+  callback: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
+  callbackPost: import("alepha/server").RoutePrimitive<import("alepha/server").RequestConfigSchema>;
+};
+//#endregion
+//#region ../../src/server/auth/primitives/$authFederationClient.d.ts
+declare function assertionToProfile(token: string, opts: VerifyAssertionOptions): Promise<{
+  provider: string;
+  jti: string;
+  link: LinkAccountOptions;
+}>;
+interface FederationClientOptions {
+  realm: IssuerPrimitive & WithLinkFn;
+  brokerUrl: string;
+  publicKeyPem: string;
+  selfOrigin?: string;
+}
+declare const $authFederationClient: (options: FederationClientOptions) => {
+  callback: import("alepha/server").RoutePrimitive<{
+    query: import("typebox").TObject<{
+      token: import("typebox").TString;
+      redirect: import("typebox").TOptional<import("typebox").TString>;
+    }>;
+  }>;
+};
+//#endregion
 //#region ../../src/server/auth/primitives/$authFranceConnect.d.ts
 /**
  * Creates an authentication provider primitive for France Connect.
@@ -1791,7 +1890,7 @@ declare const $authMicrosoft: (realm: IssuerPrimitive & WithLinkFn, options?: Pa
  *
  * @module alepha.server.auth
  */
-declare const AlephaServerAuth: _$alepha.Service<_$alepha.Module>;
+declare const AlephaServerAuth: import("alepha").Service<import("alepha").Module>;
 //#endregion
-export { $auth, $authApple, $authCredentials, $authFacebook, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, TokenResponse, Tokens, UserinfoResponse, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, authenticationProviderSchema, tokenResponseSchema, tokensSchema, userinfoResponseSchema };
+export { $auth, $authApple, $authCredentials, $authFacebook, $authFederationBroker, $authFederationClient, $authFranceConnect, $authGithub, $authGoogle, $authMicrosoft, AccessToken, AlephaServerAuth, AppleClientSecretOptions, AuthExternal, AuthInternal, AuthPrimitive, AuthPrimitiveOptions, AuthenticationProvider, Credentials, CredentialsFn, CredentialsOptions, FederationBrokerOptions, FederationBrokerProviders, FederationClientOptions, FederationProfile, LinkAccountFn, LinkAccountOptions, OAuth2Options, OAuth2Profile, OidcOptions, ServerAuthProvider, SignAssertionOptions, TokenResponse, Tokens, UserinfoResponse, VerifiedAssertion, VerifyAssertionOptions, WithLinkFn, WithLoginFn, alephaServerAuthRoutes, assertionToProfile, authenticationProviderSchema, signAppleClientSecret, signFederationAssertion, tokenResponseSchema, tokensSchema, userinfoResponseSchema, verifyFederationAssertion };
 //# sourceMappingURL=index.d.ts.map