astro-tokenkit 1.0.14 → 1.0.16

package/dist/middleware.cjs

@@ -0,0 +1,796 @@
+'use strict';
+
+var node_async_hooks = require('node:async_hooks');
+
+/******************************************************************************
+Copyright (c) Microsoft Corporation.
+
+Permission to use, copy, modify, and/or distribute this software for any
+purpose with or without fee is hereby granted.
+
+THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH
+REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT,
+INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM
+LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR
+OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR
+PERFORMANCE OF THIS SOFTWARE.
+***************************************************************************** */
+/* global Reflect, Promise, SuppressedError, Symbol, Iterator */
+
+
+function __awaiter(thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+}
+
+typeof SuppressedError === "function" ? SuppressedError : function (error, suppressed, message) {
+    var e = new Error(message);
+    return e.name = "SuppressedError", e.error = error, e.suppressed = suppressed, e;
+};
+
+// packages/astro-tokenkit/src/types.ts
+/**
+ * API Error
+ */
+class APIError extends Error {
+    constructor(message, status, response, request) {
+        super(message);
+        this.status = status;
+        this.response = response;
+        this.request = request;
+        this.name = 'APIError';
+    }
+}
+/**
+ * Authentication Error
+ */
+class AuthError extends APIError {
+    constructor(message, status, response, request) {
+        super(message, status, response, request);
+        this.name = 'AuthError';
+    }
+}
+
+// packages/astro-tokenkit/src/auth/detector.ts
+/**
+ * Common field names for access tokens
+ */
+const ACCESS_TOKEN_FIELDS = [
+    'access_token',
+    'accessToken',
+    'token',
+    'jwt',
+    'id_token',
+    'idToken',
+];
+/**
+ * Common field names for refresh tokens
+ */
+const REFRESH_TOKEN_FIELDS = [
+    'refresh_token',
+    'refreshToken',
+    'refresh',
+];
+/**
+ * Common field names for expiration timestamp
+ */
+const EXPIRES_AT_FIELDS = [
+    'expires_at',
+    'expiresAt',
+    'exp',
+    'expiry',
+];
+/**
+ * Common field names for expires_in (seconds)
+ */
+const EXPIRES_IN_FIELDS = [
+    'expires_in',
+    'expiresIn',
+    'ttl',
+];
+/**
+ * Common field names for token type
+ */
+const TOKEN_TYPE_FIELDS = [
+    'token_type',
+    'tokenType',
+];
+/**
+ * Common field names for session payload
+ */
+const SESSION_PAYLOAD_FIELDS = [
+    'user',
+    'profile',
+    'account',
+    'data',
+];
+/**
+ * Auto-detect token fields from response body
+ */
+function autoDetectFields(body, fieldMapping) {
+    // Helper to find field
+    const findField = (candidates, mapping) => {
+        if (mapping && body[mapping] !== undefined) {
+            return body[mapping];
+        }
+        for (const candidate of candidates) {
+            if (body[candidate] !== undefined) {
+                return body[candidate];
+            }
+        }
+        return undefined;
+    };
+    // Detect access token
+    const accessToken = findField(ACCESS_TOKEN_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.accessToken);
+    if (!accessToken) {
+        throw new Error(`Could not detect access token field. Tried: ${ACCESS_TOKEN_FIELDS.join(', ')}. ` +
+            `Provide custom parseLogin/parseRefresh or field mapping.`);
+    }
+    // Detect refresh token
+    const refreshToken = findField(REFRESH_TOKEN_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.refreshToken);
+    if (!refreshToken) {
+        throw new Error(`Could not detect refresh token field. Tried: ${REFRESH_TOKEN_FIELDS.join(', ')}. ` +
+            `Provide custom parseLogin/parseRefresh or field mapping.`);
+    }
+    // Detect expiration
+    let accessExpiresAt;
+    // Try expires_at first (timestamp)
+    const expiresAtValue = findField(EXPIRES_AT_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.expiresAt);
+    if (expiresAtValue !== undefined) {
+        accessExpiresAt = typeof expiresAtValue === 'number'
+            ? expiresAtValue
+            : parseInt(expiresAtValue, 10);
+    }
+    // Try expires_in (seconds from now)
+    if (accessExpiresAt === undefined) {
+        const expiresInValue = findField(EXPIRES_IN_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.expiresIn);
+        if (expiresInValue !== undefined) {
+            const expiresIn = typeof expiresInValue === 'number'
+                ? expiresInValue
+                : parseInt(expiresInValue, 10);
+            accessExpiresAt = Math.floor(Date.now() / 1000) + expiresIn;
+        }
+    }
+    if (accessExpiresAt === undefined) {
+        throw new Error(`Could not detect expiration field. Tried: ${[...EXPIRES_AT_FIELDS, ...EXPIRES_IN_FIELDS].join(', ')}. ` +
+            `Provide custom parseLogin/parseRefresh or field mapping.`);
+    }
+    // Detect session payload (optional)
+    const sessionPayload = findField(SESSION_PAYLOAD_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.sessionPayload);
+    // Detect token type (optional)
+    const tokenType = findField(TOKEN_TYPE_FIELDS, fieldMapping === null || fieldMapping === void 0 ? void 0 : fieldMapping.tokenType);
+    return {
+        accessToken,
+        refreshToken,
+        accessExpiresAt,
+        tokenType: tokenType || undefined,
+        sessionPayload: sessionPayload || undefined,
+    };
+}
+/**
+ * Parse JWT payload without verification (for reading only)
+ */
+function parseJWTPayload(token) {
+    try {
+        const parts = token.split('.');
+        if (parts.length !== 3) {
+            return null;
+        }
+        const payload = parts[1];
+        // Better UTF-8 support for environments with Buffer (like Node.js/Astro)
+        if (typeof Buffer !== 'undefined') {
+            return JSON.parse(Buffer.from(payload, 'base64').toString('utf8'));
+        }
+        const decoded = atob(payload.replace(/-/g, '+').replace(/_/g, '/'));
+        return JSON.parse(decoded);
+    }
+    catch (_a) {
+        return null;
+    }
+}
+
+// packages/astro-tokenkit/src/auth/storage.ts
+/**
+ * Get cookie names with optional prefix
+ */
+function getCookieNames(prefix) {
+    const p = prefix ? `${prefix}_` : '';
+    return {
+        accessToken: `${p}access_token`,
+        refreshToken: `${p}refresh_token`,
+        expiresAt: `${p}access_expires_at`,
+        lastRefreshAt: `${p}last_refresh_at`,
+        tokenType: `${p}token_type`,
+    };
+}
+/**
+ * Get cookie options with smart defaults
+ */
+function getCookieOptions(config = {}) {
+    var _a, _b;
+    const isProduction = process.env.NODE_ENV === 'production';
+    return {
+        secure: (_a = config.secure) !== null && _a !== void 0 ? _a : isProduction,
+        sameSite: (_b = config.sameSite) !== null && _b !== void 0 ? _b : 'lax',
+        httpOnly: true, // Always HttpOnly for security
+        domain: config.domain,
+    };
+}
+/**
+ * Store token bundle in cookies
+ */
+function storeTokens(ctx, bundle, cookieConfig = {}) {
+    const names = getCookieNames(cookieConfig.prefix);
+    const options = getCookieOptions(cookieConfig);
+    const now = Math.floor(Date.now() / 1000);
+    // Calculate max age
+    const accessMaxAge = Math.max(0, bundle.accessExpiresAt - now);
+    const refreshMaxAge = bundle.refreshExpiresAt
+        ? Math.max(0, bundle.refreshExpiresAt - now)
+        : 7 * 24 * 60 * 60; // Default 7 days
+    // Set access token
+    ctx.cookies.set(names.accessToken, bundle.accessToken, Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    // Set refresh token (restricted path for security)
+    ctx.cookies.set(names.refreshToken, bundle.refreshToken, Object.assign(Object.assign({}, options), { maxAge: refreshMaxAge, path: '/' }));
+    // Set expiration timestamp
+    ctx.cookies.set(names.expiresAt, bundle.accessExpiresAt.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    // Set last refresh timestamp
+    ctx.cookies.set(names.lastRefreshAt, now.toString(), Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    // Set token type if available
+    if (bundle.tokenType) {
+        ctx.cookies.set(names.tokenType, bundle.tokenType, Object.assign(Object.assign({}, options), { maxAge: accessMaxAge, path: '/' }));
+    }
+}
+/**
+ * Retrieve tokens from cookies
+ */
+function retrieveTokens(ctx, cookieConfig = {}) {
+    var _a, _b, _c, _d, _e;
+    const names = getCookieNames(cookieConfig.prefix);
+    const accessToken = ((_a = ctx.cookies.get(names.accessToken)) === null || _a === void 0 ? void 0 : _a.value) || null;
+    const refreshToken = ((_b = ctx.cookies.get(names.refreshToken)) === null || _b === void 0 ? void 0 : _b.value) || null;
+    const tokenType = ((_c = ctx.cookies.get(names.tokenType)) === null || _c === void 0 ? void 0 : _c.value) || null;
+    const expiresAtStr = (_d = ctx.cookies.get(names.expiresAt)) === null || _d === void 0 ? void 0 : _d.value;
+    const expiresAt = expiresAtStr ? parseInt(expiresAtStr, 10) : null;
+    const lastRefreshAtStr = (_e = ctx.cookies.get(names.lastRefreshAt)) === null || _e === void 0 ? void 0 : _e.value;
+    const lastRefreshAt = lastRefreshAtStr ? parseInt(lastRefreshAtStr, 10) : null;
+    return { accessToken, refreshToken, expiresAt, lastRefreshAt, tokenType };
+}
+/**
+ * Clear all auth cookies
+ */
+function clearTokens(ctx, cookieConfig = {}) {
+    const names = getCookieNames(cookieConfig.prefix);
+    const options = getCookieOptions(cookieConfig);
+    ctx.cookies.delete(names.accessToken, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.refreshToken, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.expiresAt, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.lastRefreshAt, Object.assign(Object.assign({}, options), { path: '/' }));
+    ctx.cookies.delete(names.tokenType, Object.assign(Object.assign({}, options), { path: '/' }));
+}
+
+// packages/astro-tokenkit/src/utils/time.ts
+/**
+ * Parse time string to seconds
+ * Supports: '5m', '30s', '1h', '2d'
+ */
+function parseTime(input) {
+    if (typeof input === 'number') {
+        return input;
+    }
+    const match = input.match(/^(\d+)([smhd])$/);
+    if (!match) {
+        throw new Error(`Invalid time format: ${input}. Use format like '5m', '30s', '1h', '2d'`);
+    }
+    const value = parseInt(match[1], 10);
+    const unit = match[2];
+    const multipliers = {
+        s: 1,
+        m: 60,
+        h: 60 * 60,
+        d: 60 * 60 * 24,
+    };
+    return value * multipliers[unit];
+}
+
+// packages/astro-tokenkit/src/auth/policy.ts
+/**
+ * Default refresh policy
+ */
+const DEFAULT_POLICY = {
+    refreshBefore: 300, // 5 minutes
+    clockSkew: 60, // 1 minute
+    minInterval: 30, // 30 seconds
+};
+/**
+ * Normalize refresh policy (convert time strings to seconds)
+ */
+function normalizePolicy(policy = {}) {
+    return {
+        refreshBefore: policy.refreshBefore
+            ? parseTime(policy.refreshBefore)
+            : DEFAULT_POLICY.refreshBefore,
+        clockSkew: policy.clockSkew
+            ? parseTime(policy.clockSkew)
+            : DEFAULT_POLICY.clockSkew,
+        minInterval: policy.minInterval
+            ? parseTime(policy.minInterval)
+            : DEFAULT_POLICY.minInterval,
+    };
+}
+/**
+ * Check if token should be refreshed
+ */
+function shouldRefresh(expiresAt, now, lastRefreshAt, policy = {}) {
+    const normalized = normalizePolicy(policy);
+    const refreshBefore = typeof normalized.refreshBefore === 'number'
+        ? normalized.refreshBefore
+        : parseTime(normalized.refreshBefore);
+    const clockSkew = typeof normalized.clockSkew === 'number'
+        ? normalized.clockSkew
+        : parseTime(normalized.clockSkew);
+    const minInterval = typeof normalized.minInterval === 'number'
+        ? normalized.minInterval
+        : parseTime(normalized.minInterval);
+    // Adjust for clock skew
+    const adjustedNow = now + clockSkew;
+    // Check if near expiration
+    const timeUntilExpiry = expiresAt - adjustedNow;
+    if (timeUntilExpiry > refreshBefore) {
+        return false;
+    }
+    // Check minimum interval
+    if (lastRefreshAt !== null) {
+        const timeSinceLastRefresh = now - lastRefreshAt;
+        if (timeSinceLastRefresh < minInterval) {
+            return false;
+        }
+    }
+    return true;
+}
+/**
+ * Check if token is expired
+ */
+function isExpired(expiresAt, now, policy = {}) {
+    const normalized = normalizePolicy(policy);
+    const clockSkew = typeof normalized.clockSkew === 'number'
+        ? normalized.clockSkew
+        : parseTime(normalized.clockSkew);
+    // Pessimistic: consider it expired if current time + skew is past expiration
+    return now + clockSkew > expiresAt;
+}
+
+// packages/astro-tokenkit/src/auth/manager.ts
+/**
+ * Single-flight refresh manager
+ */
+class SingleFlight {
+    constructor() {
+        this.inFlight = new Map();
+    }
+    execute(key, fn) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const existing = this.inFlight.get(key);
+            if (existing)
+                return existing;
+            const promise = this.doExecute(key, fn);
+            this.inFlight.set(key, promise);
+            return promise;
+        });
+    }
+    doExecute(key, fn) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield fn();
+            }
+            finally {
+                this.inFlight.delete(key);
+            }
+        });
+    }
+}
+/**
+ * Token Manager handles all token operations
+ */
+class TokenManager {
+    constructor(config, baseURL) {
+        this.config = config;
+        this.singleFlight = new SingleFlight();
+        this.baseURL = baseURL;
+    }
+    /**
+     * Perform login
+     */
+    login(ctx, credentials, options) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const url = this.joinURL(this.baseURL, this.config.login);
+            const contentType = this.config.contentType || 'application/json';
+            const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), options === null || options === void 0 ? void 0 : options.headers);
+            const data = Object.assign(Object.assign(Object.assign({}, this.config.loginData), options === null || options === void 0 ? void 0 : options.data), credentials);
+            let requestBody;
+            if (contentType === 'application/x-www-form-urlencoded') {
+                requestBody = new URLSearchParams(data).toString();
+            }
+            else {
+                requestBody = JSON.stringify(data);
+            }
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
+                const authError = new AuthError(`Login request failed: ${error.message}`);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
+            }
+            if (!response.ok) {
+                const authError = new AuthError(`Login failed: ${response.status} ${response.statusText}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
+            }
+            const body = yield response.json().catch(() => ({}));
+            // Parse response
+            let bundle;
+            try {
+                bundle = this.config.parseLogin
+                    ? this.config.parseLogin(body)
+                    : autoDetectFields(body, this.config.fields);
+            }
+            catch (error) {
+                const authError = new AuthError(`Invalid login response: ${error.message}`, response.status, response);
+                if (options === null || options === void 0 ? void 0 : options.onError)
+                    yield options.onError(authError, ctx);
+                throw authError;
+            }
+            // Store in cookies
+            storeTokens(ctx, bundle, this.config.cookies);
+            // Call onLogin callback if provided
+            if (options === null || options === void 0 ? void 0 : options.onLogin) {
+                yield options.onLogin(bundle, body, ctx);
+            }
+            return {
+                data: bundle,
+                status: response.status,
+                statusText: response.statusText,
+                headers: response.headers,
+                url: response.url,
+                ok: response.ok,
+            };
+        });
+    }
+    /**
+     * Perform token refresh
+     */
+    refresh(ctx, refreshToken, options, headers) {
+        return __awaiter(this, void 0, void 0, function* () {
+            try {
+                return yield this.performRefresh(ctx, refreshToken, options, headers);
+            }
+            catch (error) {
+                clearTokens(ctx, this.config.cookies);
+                throw error;
+            }
+        });
+    }
+    /**
+     * Internal refresh implementation
+     */
+    performRefresh(ctx, refreshToken, options, extraHeaders) {
+        return __awaiter(this, void 0, void 0, function* () {
+            const url = this.joinURL(this.baseURL, this.config.refresh);
+            const contentType = this.config.contentType || 'application/json';
+            const headers = Object.assign(Object.assign({ 'Content-Type': contentType }, this.config.headers), extraHeaders);
+            const refreshField = this.config.refreshRequestField || 'refreshToken';
+            const data = Object.assign(Object.assign(Object.assign({}, this.config.refreshData), options === null || options === void 0 ? void 0 : options.data), { [refreshField]: refreshToken });
+            let requestBody;
+            if (contentType === 'application/x-www-form-urlencoded') {
+                requestBody = new URLSearchParams(data).toString();
+            }
+            else {
+                requestBody = JSON.stringify(data);
+            }
+            let response;
+            try {
+                response = yield fetch(url, {
+                    method: 'POST',
+                    headers,
+                    body: requestBody,
+                });
+            }
+            catch (error) {
+                throw new AuthError(`Refresh request failed: ${error.message}`);
+            }
+            if (!response.ok) {
+                // 401/403 = invalid refresh token
+                if (response.status === 401 || response.status === 403) {
+                    clearTokens(ctx, this.config.cookies);
+                    return null;
+                }
+                throw new AuthError(`Refresh failed: ${response.status} ${response.statusText}`, response.status, response);
+            }
+            const body = yield response.json().catch(() => ({}));
+            // Parse response
+            let bundle;
+            try {
+                bundle = this.config.parseRefresh
+                    ? this.config.parseRefresh(body)
+                    : autoDetectFields(body, this.config.fields);
+            }
+            catch (error) {
+                throw new AuthError(`Invalid refresh response: ${error.message}`, response.status, response);
+            }
+            // Validate bundle
+            if (!bundle.accessToken || !bundle.refreshToken || !bundle.accessExpiresAt) {
+                throw new AuthError('Invalid token bundle returned from refresh endpoint', response.status, response);
+            }
+            // Store new tokens
+            storeTokens(ctx, bundle, this.config.cookies);
+            return bundle;
+        });
+    }
+    /**
+     * Ensure valid tokens (with automatic refresh)
+     */
+    ensure(ctx, options, headers) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a, _b, _c, _d, _e, _f;
+            const now = Math.floor(Date.now() / 1000);
+            const tokens = retrieveTokens(ctx, this.config.cookies);
+            // No tokens
+            if (!tokens.accessToken || !tokens.refreshToken || !tokens.expiresAt) {
+                return null;
+            }
+            // Token expired
+            if (isExpired(tokens.expiresAt, now, this.config.policy)) {
+                const flightKey = this.createFlightKey(tokens.refreshToken);
+                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
+                if (!bundle)
+                    return null;
+                return {
+                    accessToken: bundle.accessToken,
+                    expiresAt: bundle.accessExpiresAt,
+                    tokenType: bundle.tokenType,
+                    payload: (_b = (_a = bundle.sessionPayload) !== null && _a !== void 0 ? _a : parseJWTPayload(bundle.accessToken)) !== null && _b !== void 0 ? _b : undefined,
+                };
+            }
+            // Proactive refresh
+            if (shouldRefresh(tokens.expiresAt, now, tokens.lastRefreshAt, this.config.policy)) {
+                const flightKey = this.createFlightKey(tokens.refreshToken);
+                const bundle = yield this.singleFlight.execute(flightKey, () => this.refresh(ctx, tokens.refreshToken, options, headers));
+                if (bundle) {
+                    return {
+                        accessToken: bundle.accessToken,
+                        expiresAt: bundle.accessExpiresAt,
+                        tokenType: bundle.tokenType,
+                        payload: (_d = (_c = bundle.sessionPayload) !== null && _c !== void 0 ? _c : parseJWTPayload(bundle.accessToken)) !== null && _d !== void 0 ? _d : undefined,
+                    };
+                }
+                // Refresh failed, check if tokens still exist
+                const currentTokens = retrieveTokens(ctx, this.config.cookies);
+                if (!currentTokens.accessToken) {
+                    return null;
+                }
+            }
+            // Return current session
+            return {
+                accessToken: tokens.accessToken,
+                expiresAt: tokens.expiresAt,
+                tokenType: (_e = tokens.tokenType) !== null && _e !== void 0 ? _e : undefined,
+                payload: (_f = parseJWTPayload(tokens.accessToken)) !== null && _f !== void 0 ? _f : undefined,
+            };
+        });
+    }
+    /**
+     * Logout (clear tokens)
+     */
+    logout(ctx) {
+        return __awaiter(this, void 0, void 0, function* () {
+            var _a;
+            // Optionally call logout endpoint
+            if (this.config.logout) {
+                try {
+                    const url = this.joinURL(this.baseURL, this.config.logout);
+                    const session = this.getSession(ctx);
+                    const headers = {};
+                    if (session === null || session === void 0 ? void 0 : session.accessToken) {
+                        const injectFn = (_a = this.config.injectToken) !== null && _a !== void 0 ? _a : ((token, type) => `${type !== null && type !== void 0 ? type : 'Bearer'} ${token}`);
+                        headers['Authorization'] = injectFn(session.accessToken, session.tokenType);
+                    }
+                    yield fetch(url, { method: 'POST', headers });
+                }
+                catch (error) {
+                    // Ignore logout endpoint errors
+                    console.warn('[TokenKit] Logout endpoint failed:', error);
+                }
+            }
+            clearTokens(ctx, this.config.cookies);
+        });
+    }
+    /**
+     * Get current session (no refresh)
+     */
+    getSession(ctx) {
+        var _a, _b;
+        const tokens = retrieveTokens(ctx, this.config.cookies);
+        if (!tokens.accessToken || !tokens.expiresAt) {
+            return null;
+        }
+        return {
+            accessToken: tokens.accessToken,
+            expiresAt: tokens.expiresAt,
+            tokenType: (_a = tokens.tokenType) !== null && _a !== void 0 ? _a : undefined,
+            payload: (_b = parseJWTPayload(tokens.accessToken)) !== null && _b !== void 0 ? _b : undefined,
+        };
+    }
+    /**
+     * Check if authenticated
+     */
+    isAuthenticated(ctx) {
+        const tokens = retrieveTokens(ctx, this.config.cookies);
+        return !!(tokens.accessToken && tokens.refreshToken);
+    }
+    /**
+     * Create flight key for single-flight deduplication
+     */
+    createFlightKey(token) {
+        // Avoid weak hashing of sensitive tokens
+        return `refresh_${token}`;
+    }
+    /**
+     * Join base URL and path safely
+     */
+    joinURL(base, path) {
+        const b = base.endsWith('/') ? base : base + '/';
+        const p = path.startsWith('/') ? path.slice(1) : path;
+        return b + p;
+    }
+}
+
+// packages/astro-tokenkit/src/config.ts
+const CONFIG_KEY = Symbol.for('astro-tokenkit.config');
+const MANAGER_KEY = Symbol.for('astro-tokenkit.manager');
+const globalStorage = globalThis;
+// Initialize global storage if not present
+if (!globalStorage[CONFIG_KEY]) {
+    globalStorage[CONFIG_KEY] = {
+        runWithContext: undefined,
+        getContextStore: undefined,
+        setContextStore: undefined,
+        baseURL: "",
+    };
+}
+/**
+ * Set configuration
+ */
+function setConfig(userConfig) {
+    const currentConfig = globalStorage[CONFIG_KEY];
+    const finalConfig = Object.assign(Object.assign({}, currentConfig), userConfig);
+    // Validate that getter and setter are defined together
+    if ((finalConfig.getContextStore && !finalConfig.setContextStore) ||
+        (!finalConfig.getContextStore && finalConfig.setContextStore)) {
+        throw new Error("[TokenKit] getContextStore and setContextStore must be defined together.");
+    }
+    globalStorage[CONFIG_KEY] = finalConfig;
+    // Re-initialize global token manager if auth changed
+    if (finalConfig.auth) {
+        globalStorage[MANAGER_KEY] = new TokenManager(finalConfig.auth, finalConfig.baseURL);
+    }
+    else {
+        globalStorage[MANAGER_KEY] = undefined;
+    }
+}
+/**
+ * Get current configuration
+ */
+function getConfig() {
+    return globalStorage[CONFIG_KEY];
+}
+/**
+ * Get global token manager
+ */
+function getTokenManager() {
+    return globalStorage[MANAGER_KEY];
+}
+// Handle injected configuration from Astro integration
+try {
+    // @ts-ignore
+    const injectedConfig = typeof __TOKENKIT_CONFIG__ !== 'undefined' ? __TOKENKIT_CONFIG__ : undefined;
+    if (injectedConfig) {
+        setConfig(injectedConfig);
+    }
+}
+catch (e) {
+    // Ignore errors in environments where __TOKENKIT_CONFIG__ might be restricted
+}
+
+// packages/astro-tokenkit/src/client/context.ts
+/**
+ * Async local storage for Astro context
+ */
+const als = new node_async_hooks.AsyncLocalStorage();
+/**
+ * Bind Astro context for the current async scope
+ */
+function runWithContext(ctx, fn) {
+    const config = getConfig();
+    const runner = config.runWithContext;
+    if (runner) {
+        return runner(ctx, fn);
+    }
+    return als.run(ctx, fn);
+}
+
+// packages/astro-tokenkit/src/middleware.ts
+const LOGGED_KEY = Symbol.for('astro-tokenkit.middleware.logged');
+/**
+ * Create middleware for context binding and automatic token rotation
+ */
+function createMiddleware() {
+    return (ctx, next) => __awaiter(this, void 0, void 0, function* () {
+        const tokenManager = getTokenManager();
+        const config = getConfig();
+        const globalStorage = globalThis;
+        if (!globalStorage[LOGGED_KEY]) {
+            const authStatus = tokenManager ? 'enabled' : 'disabled';
+            let contextStrategy = 'default';
+            if (config.runWithContext) {
+                contextStrategy = 'custom (runWithContext)';
+            }
+            else if (config.setContextStore) {
+                contextStrategy = 'custom (getter/setter)';
+            }
+            else if (config.context) {
+                contextStrategy = 'custom (external AsyncLocalStorage)';
+            }
+            console.log(`[TokenKit] Middleware initialized (auth: ${authStatus}, context: ${contextStrategy})`);
+            globalStorage[LOGGED_KEY] = true;
+        }
+        const runLogic = () => __awaiter(this, void 0, void 0, function* () {
+            // Proactively ensure a valid session if auth is configured
+            if (tokenManager) {
+                try {
+                    // This handles token rotation (refresh) if needed
+                    yield tokenManager.ensure(ctx);
+                }
+                catch (error) {
+                    // Log only the message to avoid leaking sensitive data in the error object
+                    console.error('[TokenKit] Automatic token rotation failed:', error.message || error);
+                }
+            }
+            return next();
+        });
+        const setupAndRun = () => __awaiter(this, void 0, void 0, function* () {
+            if (config.setContextStore) {
+                config.setContextStore(ctx);
+            }
+            return runLogic();
+        });
+        if (config.runWithContext) {
+            return config.runWithContext(ctx, setupAndRun);
+        }
+        if (config.setContextStore) {
+            return setupAndRun();
+        }
+        return runWithContext(ctx, runLogic);
+    });
+}
+/**
+ * Standard Astro middleware export for autoinjection
+ */
+const onRequest = createMiddleware();
+
+exports.createMiddleware = createMiddleware;
+exports.onRequest = onRequest;
+//# sourceMappingURL=middleware.cjs.map