huia-auth-core 1.0.0-alpha.5

package/dist/refresh.js

@@ -0,0 +1,87 @@
+import { randomUUID } from 'uncrypto';
+import { needsRefresh } from './tokens.js';
+export class RefreshTokenExpiredError extends Error {
+    constructor(message = 'refresh_token_expired') {
+        super(message);
+        this.name = 'RefreshTokenExpiredError';
+    }
+}
+const inflight = new Map();
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+/**
+ * Ensures token record is fresh, using deduplicated in-memory promises and storage locking.
+ */
+export async function ensureFreshTokenRecord(storage, record, refreshFn, options = {}) {
+    const earlyRefreshSeconds = options.earlyRefreshSeconds ?? 30;
+    if (!needsRefresh(record.accessTokenExpiresAt, earlyRefreshSeconds)) {
+        return record;
+    }
+    const sid = record.sid;
+    const existing = inflight.get(sid);
+    if (existing)
+        return existing;
+    const p = guardedRefresh(storage, sid, record, refreshFn, options);
+    inflight.set(sid, p);
+    try {
+        return await p;
+    }
+    finally {
+        inflight.delete(sid);
+    }
+}
+async function guardedRefresh(storage, sid, record, refreshFn, options) {
+    const lockId = randomUUID();
+    const ttlMs = options.ttlMs ?? 15000;
+    const maxWaitMs = options.maxWaitMs ?? 5000;
+    const retryIntervalMs = options.retryIntervalMs ?? 100;
+    // 1. Try to acquire the lock
+    if (await tryAcquireLock(storage, sid, lockId, ttlMs)) {
+        try {
+            // Re-check: another process may have refreshed right before we locked
+            const current = await storage.getTokenRecord(sid);
+            if (current && !needsRefresh(current.accessTokenExpiresAt, options.earlyRefreshSeconds ?? 30)) {
+                return current;
+            }
+            const refreshed = await refreshFn(current ?? record);
+            await storage.setTokenRecord(sid, refreshed);
+            return refreshed;
+        }
+        finally {
+            await releaseLock(storage, sid, lockId);
+        }
+    }
+    // 2. Someone else holds the lock — wait and inspect
+    const started = Date.now();
+    while (Date.now() - started < maxWaitMs) {
+        await sleep(retryIntervalMs);
+        const lock = await storage.getLock(sid);
+        if (!lock) {
+            // Lock released, read winner's token record
+            const latest = await storage.getTokenRecord(sid);
+            if (!latest)
+                throw new RefreshTokenExpiredError('cleared_by_lock_holder');
+            if (!needsRefresh(latest.accessTokenExpiresAt, options.earlyRefreshSeconds ?? 30)) {
+                return latest;
+            }
+            // Still needs refresh, retry acquisition
+            return guardedRefresh(storage, sid, latest, refreshFn, options);
+        }
+    }
+    throw new Error('token_refresh_timeout');
+}
+async function tryAcquireLock(storage, sid, lockId, ttlMs) {
+    const cur = await storage.getLock(sid);
+    if (cur && Date.now() - cur.acquiredAt < ttlMs) {
+        return false;
+    }
+    await storage.setLock(sid, { lockId, acquiredAt: Date.now() }, Math.ceil(ttlMs / 1000));
+    const check = await storage.getLock(sid);
+    return check?.lockId === lockId;
+}
+async function releaseLock(storage, sid, lockId) {
+    const cur = await storage.getLock(sid);
+    if (cur?.lockId === lockId) {
+        await storage.deleteLock(sid).catch(() => { });
+    }
+}
+//# sourceMappingURL=refresh.js.map

package/dist/refresh.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"refresh.js","sourceRoot":"","sources":["../src/refresh.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAA;AAErC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAA;AAE1C,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACjD,YAAY,OAAO,GAAG,uBAAuB;QAC3C,KAAK,CAAC,OAAO,CAAC,CAAA;QACd,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAA;IACxC,CAAC;CACF;AASD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAgC,CAAA;AACxD,MAAM,KAAK,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAEnF;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,OAA2B,EAC3B,MAAmB,EACnB,SAAwD,EACxD,UAA8B,EAAE;IAEhC,MAAM,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAA;IAC7D,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,oBAAoB,EAAE,mBAAmB,CAAC,EAAE,CAAC;QACpE,OAAO,MAAM,CAAA;IACf,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAA;IACtB,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;IAClC,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAA;IAE7B,MAAM,CAAC,GAAG,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;IAClE,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,CAAA;IACpB,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,CAAA;IAChB,CAAC;YACO,CAAC;QACP,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA2B,EAC3B,GAAW,EACX,MAAmB,EACnB,SAAwD,EACxD,OAA2B;IAE3B,MAAM,MAAM,GAAG,UAAU,EAAE,CAAA;IAC3B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,KAAK,CAAA;IACpC,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAA;IAC3C,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,GAAG,CAAA;IAEtD,6BAA6B;IAC7B,IAAI,MAAM,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;QACtD,IAAI,CAAC;YACH,sEAAsE;YACtE,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YACjD,IAAI,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAC9F,OAAO,OAAO,CAAA;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,OAAO,IAAI,MAAM,CAAC,CAAA;YACpD,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;YAC5C,OAAO,SAAS,CAAA;QAClB,CAAC;gBACO,CAAC;YACP,MAAM,WAAW,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAA;QACzC,CAAC;IACH,CAAC;IAED,oDAAoD;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;IAC1B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,GAAG,SAAS,EAAE,CAAC;QACxC,MAAM,KAAK,CAAC,eAAe,CAAC,CAAA;QAC5B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;QACvC,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,4CAA4C;YAC5C,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC,CAAA;YAChD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,wBAAwB,CAAC,wBAAwB,CAAC,CAAA;YACzE,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,oBAAoB,EAAE,OAAO,CAAC,mBAAmB,IAAI,EAAE,CAAC,EAAE,CAAC;gBAClF,OAAO,MAAM,CAAA;YACf,CAAC;YACD,yCAAyC;YACzC,OAAO,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAA;QACjE,CAAC;IACH,CAAC;IAED,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAA;AAC1C,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,OAA2B,EAC3B,GAAW,EACX,MAAc,EACd,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,GAAG,CAAC,UAAU,GAAG,KAAK,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAA;IACd,CAAC;IACD,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,CAAA;IACvF,MAAM,KAAK,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACxC,OAAO,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;AACjC,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,GAAW,EAAE,MAAc;IACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACtC,IAAI,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,CAAC;QAC3B,MAAM,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC"}

package/dist/storage.d.ts

@@ -0,0 +1,50 @@
+import type { Redis } from 'ioredis';
+import type { HuiaStorageAdapter, TokenRecord, AuthStateRecord, LockRecord } from './types.js';
+/**
+ * In-memory storage adapter with TTL support.
+ * Thread-safe for single process Node / Next.js / dev servers.
+ */
+export declare class MemoryStorageAdapter implements HuiaStorageAdapter {
+    private tokens;
+    private states;
+    private locks;
+    private cleanExpired;
+    getTokenRecord(sid: string): Promise<TokenRecord | null>;
+    setTokenRecord(sid: string, record: TokenRecord, ttlSeconds?: number): Promise<void>;
+    deleteTokenRecord(sid: string): Promise<void>;
+    getStateRecord(state: string): Promise<AuthStateRecord | null>;
+    setStateRecord(state: string, record: AuthStateRecord, ttlSeconds?: number): Promise<void>;
+    deleteStateRecord(state: string): Promise<void>;
+    getLock(sid: string): Promise<LockRecord | null>;
+    setLock(sid: string, lock: LockRecord, ttlSeconds?: number): Promise<void>;
+    deleteLock(sid: string): Promise<void>;
+}
+/** Default singleton in-memory storage */
+export declare const defaultStorage: MemoryStorageAdapter;
+/**
+ * Redis-backed storage adapter. Required for the Next.js flavors (next-huia-oidc,
+ * next-huia-headless) as soon as more than one server process is in play — which in practice means
+ * almost immediately: Next.js's App Router compiles each Route Handler as an independent bundle, and
+ * module-level state like {@link MemoryStorageAdapter}'s Map is not reliably shared between them (a
+ * token record written by the login route can be invisible to a completely different route reading it
+ * back moments later). The Nuxt flavors don't need this — they use Nitro's own `useStorage()` instead,
+ * which has no such isolation.
+ */
+export declare class RedisStorageAdapter implements HuiaStorageAdapter {
+    private readonly redis;
+    private readonly keyPrefix;
+    constructor(redis: Redis, keyPrefix?: string);
+    private key;
+    private getJson;
+    private setJson;
+    getTokenRecord(sid: string): Promise<TokenRecord | null>;
+    setTokenRecord(sid: string, record: TokenRecord, ttlSeconds?: number): Promise<void>;
+    deleteTokenRecord(sid: string): Promise<void>;
+    getStateRecord(state: string): Promise<AuthStateRecord | null>;
+    setStateRecord(state: string, record: AuthStateRecord, ttlSeconds?: number): Promise<void>;
+    deleteStateRecord(state: string): Promise<void>;
+    getLock(sid: string): Promise<LockRecord | null>;
+    setLock(sid: string, lock: LockRecord, ttlSeconds?: number): Promise<void>;
+    deleteLock(sid: string): Promise<void>;
+}
+//# sourceMappingURL=storage.d.ts.map

package/dist/storage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.d.ts","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AACpC,OAAO,KAAK,EACV,kBAAkB,EAClB,WAAW,EACX,eAAe,EACf,UAAU,EACX,MAAM,YAAY,CAAA;AAOnB;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,kBAAkB;IAC7D,OAAO,CAAC,MAAM,CAA6C;IAC3D,OAAO,CAAC,MAAM,CAAiD;IAC/D,OAAO,CAAC,KAAK,CAA4C;IAEzD,OAAO,CAAC,YAAY;IAUd,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAWxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKpF,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK7C,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAW9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKvF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAK/C,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAWhD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAKtE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7C;AAED,0CAA0C;AAC1C,eAAO,MAAM,cAAc,sBAA6B,CAAA;AAExD;;;;;;;;GAQG;AACH,qBAAa,mBAAoB,YAAW,kBAAkB;IAC5D,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAO;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;gBAEtB,KAAK,EAAE,KAAK,EAAE,SAAS,SAAU;IAK7C,OAAO,CAAC,GAAG;YAIG,OAAO;YAKP,OAAO;IAWrB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC;IAIxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI9E,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKnD,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAI9D,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,SAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjF,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAKrD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAIhD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,SAAK,GAAG,OAAO,CAAC,IAAI,CAAC;IAIhE,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7C"}

package/dist/storage.js

@@ -0,0 +1,140 @@
+/**
+ * In-memory storage adapter with TTL support.
+ * Thread-safe for single process Node / Next.js / dev servers.
+ */
+export class MemoryStorageAdapter {
+    tokens = new Map();
+    states = new Map();
+    locks = new Map();
+    cleanExpired(map) {
+        const now = Date.now();
+        for (const [key, item] of map.entries()) {
+            if (item.expiresAt !== null && item.expiresAt <= now) {
+                map.delete(key);
+            }
+        }
+    }
+    /* ── Tokens ── */
+    async getTokenRecord(sid) {
+        this.cleanExpired(this.tokens);
+        const item = this.tokens.get(sid);
+        if (!item)
+            return null;
+        if (item.expiresAt !== null && item.expiresAt <= Date.now()) {
+            this.tokens.delete(sid);
+            return null;
+        }
+        return item.value;
+    }
+    async setTokenRecord(sid, record, ttlSeconds) {
+        const expiresAt = ttlSeconds ? Date.now() + ttlSeconds * 1000 : null;
+        this.tokens.set(sid, { value: record, expiresAt });
+    }
+    async deleteTokenRecord(sid) {
+        this.tokens.delete(sid);
+    }
+    /* ── Auth State ── */
+    async getStateRecord(state) {
+        this.cleanExpired(this.states);
+        const item = this.states.get(state);
+        if (!item)
+            return null;
+        if (item.expiresAt !== null && item.expiresAt <= Date.now()) {
+            this.states.delete(state);
+            return null;
+        }
+        return item.value;
+    }
+    async setStateRecord(state, record, ttlSeconds = 600) {
+        const expiresAt = Date.now() + ttlSeconds * 1000;
+        this.states.set(state, { value: record, expiresAt });
+    }
+    async deleteStateRecord(state) {
+        this.states.delete(state);
+    }
+    /* ── Locks ── */
+    async getLock(sid) {
+        this.cleanExpired(this.locks);
+        const item = this.locks.get(sid);
+        if (!item)
+            return null;
+        if (item.expiresAt !== null && item.expiresAt <= Date.now()) {
+            this.locks.delete(sid);
+            return null;
+        }
+        return item.value;
+    }
+    async setLock(sid, lock, ttlSeconds = 15) {
+        const expiresAt = Date.now() + ttlSeconds * 1000;
+        this.locks.set(sid, { value: lock, expiresAt });
+    }
+    async deleteLock(sid) {
+        this.locks.delete(sid);
+    }
+}
+/** Default singleton in-memory storage */
+export const defaultStorage = new MemoryStorageAdapter();
+/**
+ * Redis-backed storage adapter. Required for the Next.js flavors (next-huia-oidc,
+ * next-huia-headless) as soon as more than one server process is in play — which in practice means
+ * almost immediately: Next.js's App Router compiles each Route Handler as an independent bundle, and
+ * module-level state like {@link MemoryStorageAdapter}'s Map is not reliably shared between them (a
+ * token record written by the login route can be invisible to a completely different route reading it
+ * back moments later). The Nuxt flavors don't need this — they use Nitro's own `useStorage()` instead,
+ * which has no such isolation.
+ */
+export class RedisStorageAdapter {
+    redis;
+    keyPrefix;
+    constructor(redis, keyPrefix = 'huia:') {
+        this.redis = redis;
+        this.keyPrefix = keyPrefix;
+    }
+    key(kind, id) {
+        return `${this.keyPrefix}${kind}:${id}`;
+    }
+    async getJson(key) {
+        const raw = await this.redis.get(key);
+        return raw ? JSON.parse(raw) : null;
+    }
+    async setJson(key, value, ttlSeconds) {
+        const payload = JSON.stringify(value);
+        if (ttlSeconds) {
+            await this.redis.set(key, payload, 'EX', ttlSeconds);
+        }
+        else {
+            await this.redis.set(key, payload);
+        }
+    }
+    /* ── Tokens ── */
+    getTokenRecord(sid) {
+        return this.getJson(this.key('token', sid));
+    }
+    setTokenRecord(sid, record, ttlSeconds) {
+        return this.setJson(this.key('token', sid), record, ttlSeconds);
+    }
+    async deleteTokenRecord(sid) {
+        await this.redis.del(this.key('token', sid));
+    }
+    /* ── Auth State ── */
+    getStateRecord(state) {
+        return this.getJson(this.key('state', state));
+    }
+    setStateRecord(state, record, ttlSeconds = 600) {
+        return this.setJson(this.key('state', state), record, ttlSeconds);
+    }
+    async deleteStateRecord(state) {
+        await this.redis.del(this.key('state', state));
+    }
+    /* ── Locks ── */
+    getLock(sid) {
+        return this.getJson(this.key('lock', sid));
+    }
+    setLock(sid, lock, ttlSeconds = 15) {
+        return this.setJson(this.key('lock', sid), lock, ttlSeconds);
+    }
+    async deleteLock(sid) {
+        await this.redis.del(this.key('lock', sid));
+    }
+}
+//# sourceMappingURL=storage.js.map

package/dist/storage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"storage.js","sourceRoot":"","sources":["../src/storage.ts"],"names":[],"mappings":"AAaA;;;GAGG;AACH,MAAM,OAAO,oBAAoB;IACvB,MAAM,GAAG,IAAI,GAAG,EAAmC,CAAA;IACnD,MAAM,GAAG,IAAI,GAAG,EAAuC,CAAA;IACvD,KAAK,GAAG,IAAI,GAAG,EAAkC,CAAA;IAEjD,YAAY,CAAI,GAA+B;QACrD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QACtB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC;YACxC,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,GAAG,EAAE,CAAC;gBACrD,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,KAAK,CAAC,cAAc,CAAC,GAAW;QAC9B,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACjC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACvB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,GAAW,EAAE,MAAmB,EAAE,UAAmB;QACxE,MAAM,SAAS,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAA;QACpE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;IACpD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACjC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACzB,CAAC;IAED,sBAAsB;IACtB,KAAK,CAAC,cAAc,CAAC,KAAa;QAChC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;YACzB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,KAAa,EAAE,MAAuB,EAAE,UAAU,GAAG,GAAG;QAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAA;QAChD,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IAC3B,CAAC;IAED,iBAAiB;IACjB,KAAK,CAAC,OAAO,CAAC,GAAW;QACvB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QAChC,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAA;QACtB,IAAI,IAAI,CAAC,SAAS,KAAK,IAAI,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;YAC5D,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YACtB,OAAO,IAAI,CAAA;QACb,CAAC;QACD,OAAO,IAAI,CAAC,KAAK,CAAA;IACnB,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,IAAgB,EAAE,UAAU,GAAG,EAAE;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,GAAG,IAAI,CAAA;QAChD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAA;IACjD,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;IACxB,CAAC;CACF;AAED,0CAA0C;AAC1C,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,oBAAoB,EAAE,CAAA;AAExD;;;;;;;;GAQG;AACH,MAAM,OAAO,mBAAmB;IACb,KAAK,CAAO;IACZ,SAAS,CAAQ;IAElC,YAAY,KAAY,EAAE,SAAS,GAAG,OAAO;QAC3C,IAAI,CAAC,KAAK,GAAG,KAAK,CAAA;QAClB,IAAI,CAAC,SAAS,GAAG,SAAS,CAAA;IAC5B,CAAC;IAEO,GAAG,CAAC,IAAgC,EAAE,EAAU;QACtD,OAAO,GAAG,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,EAAE,EAAE,CAAA;IACzC,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,GAAW;QAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;QACrC,OAAO,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IAC1C,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,GAAW,EAAE,KAAc,EAAE,UAAmB;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;QACrC,IAAI,UAAU,EAAE,CAAC;YACf,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;QACtD,CAAC;aACI,CAAC;YACJ,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAA;QACpC,CAAC;IACH,CAAC;IAED,kBAAkB;IAClB,cAAc,CAAC,GAAW;QACxB,OAAO,IAAI,CAAC,OAAO,CAAc,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC1D,CAAC;IAED,cAAc,CAAC,GAAW,EAAE,MAAmB,EAAE,UAAmB;QAClE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACjE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,GAAW;QACjC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC9C,CAAC;IAED,sBAAsB;IACtB,cAAc,CAAC,KAAa;QAC1B,OAAO,IAAI,CAAC,OAAO,CAAkB,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAChE,CAAC;IAED,cAAc,CAAC,KAAa,EAAE,MAAuB,EAAE,UAAU,GAAG,GAAG;QACrE,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;IACnE,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAa;QACnC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAA;IAChD,CAAC;IAED,iBAAiB;IACjB,OAAO,CAAC,GAAW;QACjB,OAAO,IAAI,CAAC,OAAO,CAAa,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IACxD,CAAC;IAED,OAAO,CAAC,GAAW,EAAE,IAAgB,EAAE,UAAU,GAAG,EAAE;QACpD,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,CAAA;IAC9D,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,GAAW;QAC1B,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAA;IAC7C,CAAC;CACF"}

package/dist/tokens.d.ts

@@ -0,0 +1,18 @@
+import type { UserClaims } from './types.js';
+/**
+ * Copy only the whitelisted keys out of the claims set. `sub` is always kept.
+ * Normalizes `role` (scalar or array) into `roles: string[]`.
+ */
+export declare function pickUserClaims(claims: Record<string, unknown>, whitelist?: string[]): UserClaims;
+/** Throw unless the id_token issuer is exactly the resolved per-tenant issuer string. */
+export declare function assertHuiaIssuer(iss: unknown, expected: string): void;
+/** Check if token needs refresh given expiration time and buffer (default 30 seconds). */
+export declare function needsRefresh(accessTokenExpiresAt: number, earlyRefreshSeconds?: number): boolean;
+/** True when a JWT's `exp` is in the past (with a small negative skew tolerance). */
+export declare function isJwtExpired(jwt: string, skewSeconds?: number): boolean;
+/**
+ * Accept only a same-origin relative path. Rejects absolute URLs, protocol-relative `//host`,
+ * backslash tricks, whitespace and control characters. Returns `/` on rejection.
+ */
+export declare function sanitizeReturnTo(value: string | undefined | null): string;
+//# sourceMappingURL=tokens.d.ts.map

package/dist/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAA;AAE5C;;;GAGG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,CAAC,EAAE,MAAM,EAAE,GAAG,UAAU,CAmBhG;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAIrE;AAED,0FAA0F;AAC1F,wBAAgB,YAAY,CAAC,oBAAoB,EAAE,MAAM,EAAE,mBAAmB,SAAK,GAAG,OAAO,CAE5F;AAED,qFAAqF;AACrF,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,OAAO,CAcnE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,CASzE"}

package/dist/tokens.js

@@ -0,0 +1,69 @@
+/**
+ * Copy only the whitelisted keys out of the claims set. `sub` is always kept.
+ * Normalizes `role` (scalar or array) into `roles: string[]`.
+ */
+export function pickUserClaims(claims, whitelist) {
+    const out = { sub: String(claims.sub ?? '') };
+    const keys = whitelist && whitelist.length > 0 ? whitelist : Object.keys(claims);
+    for (const key of keys) {
+        if (key === 'sub')
+            continue;
+        if (key === 'roles' || key === 'role') {
+            const roleVal = claims.roles ?? claims.role;
+            if (roleVal !== undefined) {
+                out.roles = Array.isArray(roleVal) ? roleVal.map(String) : [String(roleVal)];
+            }
+            continue;
+        }
+        if (claims[key] !== undefined) {
+            out[key] = claims[key];
+        }
+    }
+    return out;
+}
+/** Throw unless the id_token issuer is exactly the resolved per-tenant issuer string. */
+export function assertHuiaIssuer(iss, expected) {
+    if (iss !== expected) {
+        throw new Error(`issuer_mismatch: id_token iss "${String(iss)}" !== "${expected}"`);
+    }
+}
+/** Check if token needs refresh given expiration time and buffer (default 30 seconds). */
+export function needsRefresh(accessTokenExpiresAt, earlyRefreshSeconds = 30) {
+    return accessTokenExpiresAt - Date.now() < earlyRefreshSeconds * 1000;
+}
+/** True when a JWT's `exp` is in the past (with a small negative skew tolerance). */
+export function isJwtExpired(jwt, skewSeconds = 30) {
+    try {
+        const payload = jwt.split('.')[1];
+        if (!payload)
+            return true;
+        const base64 = payload.replace(/-/g, '+').replace(/_/g, '/');
+        const decoded = typeof atob === 'function'
+            ? atob(base64)
+            : Buffer.from(base64, 'base64').toString('utf8');
+        const json = JSON.parse(decoded);
+        return typeof json.exp === 'number' && json.exp * 1000 < Date.now() - skewSeconds * 1000;
+    }
+    catch {
+        return true;
+    }
+}
+/**
+ * Accept only a same-origin relative path. Rejects absolute URLs, protocol-relative `//host`,
+ * backslash tricks, whitespace and control characters. Returns `/` on rejection.
+ */
+export function sanitizeReturnTo(value) {
+    if (typeof value !== 'string' || value.length === 0)
+        return '/';
+    if (value[0] !== '/')
+        return '/';
+    if (value[1] === '/' || value[1] === '\\')
+        return '/';
+    for (let i = 0; i < value.length; i++) {
+        const c = value.charCodeAt(i);
+        if (c <= 0x20 || c === 0x7f)
+            return '/';
+    }
+    return value;
+}
+//# sourceMappingURL=tokens.js.map

package/dist/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../src/tokens.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,MAA+B,EAAE,SAAoB;IAClF,MAAM,GAAG,GAA4B,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,CAAA;IACtE,MAAM,IAAI,GAAG,SAAS,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;IAEhF,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,KAAK;YAAE,SAAQ;QAC3B,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAA;YAC3C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC1B,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAA;YAC9E,CAAC;YACD,SAAQ;QACV,CAAC;QACD,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,OAAO,GAAiB,CAAA;AAC1B,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,gBAAgB,CAAC,GAAY,EAAE,QAAgB;IAC7D,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,kCAAkC,MAAM,CAAC,GAAG,CAAC,UAAU,QAAQ,GAAG,CAAC,CAAA;IACrF,CAAC;AACH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,YAAY,CAAC,oBAA4B,EAAE,mBAAmB,GAAG,EAAE;IACjF,OAAO,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,mBAAmB,GAAG,IAAI,CAAA;AACvE,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,WAAW,GAAG,EAAE;IACxD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAA;QACjC,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAA;QACzB,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;QAC5D,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,UAAU;YACxC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;YACd,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAA;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAqB,CAAA;QACpD,OAAO,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,GAAG,IAAI,CAAA;IAC1F,CAAC;IACD,MAAM,CAAC;QACL,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAgC;IAC/D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAA;IAC/D,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG;QAAE,OAAO,GAAG,CAAA;IAChC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,GAAG,CAAA;IACrD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,CAAC,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,GAAG,CAAA;IACzC,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,154 @@
+/**
+ * Shared type definitions for Huia authentication libraries.
+ */
+export interface UserClaims {
+    sub?: string;
+    name?: string;
+    email?: string;
+    email_verified?: boolean;
+    preferred_username?: string;
+    given_name?: string;
+    family_name?: string;
+    phone_number?: string;
+    phone_number_verified?: boolean;
+    roles?: string[];
+    [key: string]: unknown;
+}
+export interface UserSession {
+    user?: UserClaims | null;
+    loggedIn?: boolean;
+    expiresAt?: number;
+}
+export interface TokenRecord {
+    sid: string;
+    accessToken: string;
+    refreshToken?: string;
+    idToken?: string;
+    claims: UserClaims;
+    scope?: string;
+    accessTokenExpiresAt: number;
+    refreshTokenExpiresAt?: number;
+    updatedAt: number;
+}
+export interface AuthStateRecord {
+    state: string;
+    codeVerifier: string;
+    nonce: string;
+    returnTo?: string;
+    createdAt: number;
+}
+export interface LockRecord {
+    lockId: string;
+    acquiredAt: number;
+}
+export interface CookiePayload {
+    sid: string;
+    user: UserClaims;
+    expiresAt: number;
+}
+export interface SessionOptions {
+    name?: string;
+    password: string;
+    maxAge?: number;
+    userClaims?: string[];
+}
+export interface CookieOptions {
+    chunkSize?: number;
+    maxChunks?: number;
+    secure?: boolean;
+    sameSite?: 'lax' | 'strict' | 'none';
+    path?: string;
+}
+export interface HuiaStorageAdapter {
+    getTokenRecord(sid: string): Promise<TokenRecord | null>;
+    setTokenRecord(sid: string, record: TokenRecord, ttlSeconds?: number): Promise<void>;
+    deleteTokenRecord(sid: string): Promise<void>;
+    getStateRecord?(state: string): Promise<AuthStateRecord | null>;
+    setStateRecord?(state: string, record: AuthStateRecord, ttlSeconds?: number): Promise<void>;
+    deleteStateRecord?(state: string): Promise<void>;
+    getLock(sid: string): Promise<LockRecord | null>;
+    setLock(sid: string, lock: LockRecord, ttlSeconds?: number): Promise<void>;
+    deleteLock(sid: string): Promise<void>;
+}
+export interface BackendTokenResponse {
+    tokenType: string;
+    accessToken: string;
+    expiresIn: number;
+    refreshToken: string;
+}
+export interface BackendMeResponse {
+    email: string;
+    isEmailConfirmed: boolean;
+    roles?: string[];
+    firstName?: string;
+    lastName?: string;
+    phoneNumber?: string;
+    isPhoneNumberConfirmed?: boolean;
+    [key: string]: unknown;
+}
+export interface BackendPhoneStartResponse {
+    flowId: string;
+    expiresInSeconds: number;
+    status?: string;
+}
+export interface BackendPhoneVerifyResponse {
+    accessToken?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    requiresProfile?: boolean;
+    flowId?: string;
+    firstName?: string | null;
+    lastName?: string | null;
+}
+export interface BackendExternalExchangeResponse {
+    accessToken?: string;
+    refreshToken?: string;
+    expiresIn?: number;
+    requiresProfile?: boolean;
+    code?: string;
+    email?: string | null;
+    firstName?: string | null;
+    lastName?: string | null;
+}
+export interface HeadlessAdminUser {
+    id: string;
+    userName?: string | null;
+    email?: string | null;
+    emailConfirmed: boolean;
+    phoneNumber?: string | null;
+    phoneNumberConfirmed: boolean;
+    firstName: string;
+    lastName: string;
+    lockoutEnabled: boolean;
+    lockoutEnd?: string | null;
+    roles: string[];
+}
+export interface HeadlessAdminRole {
+    id: string;
+    name: string;
+    origin: string;
+}
+export interface HeadlessAdminUsersPage {
+    data: HeadlessAdminUser[];
+    totalCount: number;
+    page: number;
+    pageSize: number;
+    hasNext: boolean;
+    hasPrevious: boolean;
+}
+export interface CreateHeadlessAdminUserRequest {
+    email?: string;
+    password?: string;
+    phoneNumber?: string;
+    firstName?: string;
+    lastName?: string;
+    emailConfirmed?: boolean;
+    roles?: string[];
+}
+export interface UpdateHeadlessAdminUserRequest {
+    firstName?: string;
+    lastName?: string;
+    email?: string;
+    phoneNumber?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,qBAAqB,CAAC,EAAE,OAAO,CAAA;IAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,CAAC,EAAE,UAAU,GAAG,IAAI,CAAA;IACxB,QAAQ,CAAC,EAAE,OAAO,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAA;IACX,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,UAAU,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,oBAAoB,EAAE,MAAM,CAAA;IAC5B,qBAAqB,CAAC,EAAE,MAAM,CAAA;IAC9B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,YAAY,EAAE,MAAM,CAAA;IACpB,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,UAAU,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,UAAU,CAAC,EAAE,MAAM,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,OAAO,CAAA;IAChB,QAAQ,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACpC,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,kBAAkB;IACjC,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;IACxD,cAAc,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACpF,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAE7C,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAA;IAC/D,cAAc,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3F,iBAAiB,CAAC,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAEhD,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;IAChD,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC1E,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACvC;AAID,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,CAAA;IACb,gBAAgB,EAAE,OAAO,CAAA;IACzB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,sBAAsB,CAAC,EAAE,OAAO,CAAA;IAChC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAA;IACd,gBAAgB,EAAE,MAAM,CAAA;IACxB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,+BAA+B;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,eAAe,CAAC,EAAE,OAAO,CAAA;IACzB,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,cAAc,EAAE,OAAO,CAAA;IACvB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,oBAAoB,EAAE,OAAO,CAAA;IAC7B,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,OAAO,CAAA;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC1B,KAAK,EAAE,MAAM,EAAE,CAAA;CAChB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,iBAAiB,EAAE,CAAA;IACzB,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,OAAO,CAAA;IAChB,WAAW,EAAE,OAAO,CAAA;CACrB;AAED,MAAM,WAAW,8BAA8B;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,cAAc,CAAC,EAAE,OAAO,CAAA;IACxB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;CACjB;AAED,MAAM,WAAW,8BAA8B;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB"}

package/dist/types.js

@@ -0,0 +1,5 @@
+/**
+ * Shared type definitions for Huia authentication libraries.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/package.json

@@ -0,0 +1,43 @@
+{
+  "name": "huia-auth-core",
+  "version": "1.0.0-alpha.5",
+  "description": "Shared authentication primitives for Huia client modules (Next.js & Nuxt 4)",
+  "license": "MIT",
+  "type": "module",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ayman-Elfaki/Huia.git",
+    "directory": "src/javascript/shared/huia-auth-core"
+  },
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "dev": "tsc --watch",
+    "test": "vitest run",
+    "test:watch": "vitest watch"
+  },
+  "dependencies": {
+    "ioredis": "^5.4.1",
+    "iron-webcrypto": "^1.2.1",
+    "openid-client": "^6.1.0",
+    "uncrypto": "^0.1.3"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.0",
+    "typescript": "~5.9.3",
+    "vitest": "^4.0.2"
+  },
+  "engines": {
+    "node": ">=20.11.0"
+  }
+}