login-hub-sdk 0.1.0

package/README.md

@@ -0,0 +1,52 @@
+# login-hub-sdk
+
+Thin, framework-agnostic TypeScript client for the login-hub OAuth2
+authorization server. Implements `docs/api-contract.md` exactly — no OAuth
+flow code to write, no 3rd-party provider SDKs to touch.
+
+## Install
+
+Published as a **private** package on GitHub Packages. See `PUBLISHING.md`
+for the `.npmrc`/auth setup a consuming app needs.
+
+```json
+{ "dependencies": { "login-hub-sdk": "^0.1.0" } }
+```
+
+For local development against this monorepo you can still use a file
+reference instead: `"file:../path/to/packages/sdk"`.
+
+## Core API (`login-hub-sdk`)
+
+```ts
+import { createLoginUrl, exchangeCodeForToken, verifyAccessToken, getUserInfo, refreshAccessToken, logout, LoginHubClient } from "login-hub-sdk";
+```
+
+- `createLoginUrl(config, { redirectUri, state, appName? })` — pure URL builder for `GET /authorize`.
+- `exchangeCodeForToken(config, { code, redirectUri })` — `POST /token` (authorization_code). **Server-only** (needs `clientSecret`).
+- `refreshAccessToken(config, refreshToken)` — `POST /token` (refresh_token, rotates).
+- `verifyAccessToken(config, accessToken)` — stateless JWKS verification (`jose`), no network call to hub beyond a cached JWKS fetch.
+- `getUserInfo(config, accessToken)` — `GET /userinfo` (always-fresh DB values).
+- `logout(config, refreshToken)` — `POST /logout`.
+- `LoginHubClient` — class wrapping all of the above under one configured instance.
+
+## Next.js helpers (`login-hub-sdk/next`)
+
+Built on Web-standard `Request`/`Response`/`Headers` — works in Node and Edge
+runtimes, no hard dependency on the `next` package.
+
+- `loginRedirect(config, { redirectUri, appName? })` → `Response` (302 + state cookie).
+- `handleCallback(config, request, { redirectUri, successPath? })` → `Response` (verifies state, exchanges code, sets session cookies).
+- `getSession(config, cookieStore)` → `{ claims, accessToken } | null` (works with Next's `cookies()`).
+- `refreshSession(config, request)` → new tokens + `Response` carrying updated `Set-Cookie` headers.
+- `logoutResponse(config, request, { redirectTo? })` → revokes + clears cookies.
+
+See `examples/next` for full wiring (3 route files + a page reading the session).
+
+## Test
+
+```bash
+npm install
+npm test        # vitest: URL building, token exchange (mocked fetch), JWKS verification, cookies
+npm run build    # tsc -> dist/
+```

package/dist/client.d.ts

@@ -0,0 +1,24 @@
+import { type CreateLoginUrlOptions } from "./url.js";
+import { type VerifyAccessTokenOptions } from "./verify.js";
+import type { HubTokenClaims, HubUser, LoginHubConfig, TokenResponse } from "./types.js";
+/**
+ * Convenience wrapper bundling every SDK call under one configured instance.
+ * Equivalent to calling the standalone functions with `config` each time —
+ * use whichever style fits your codebase.
+ */
+export declare class LoginHubClient {
+    private readonly config;
+    constructor(config: LoginHubConfig);
+    createLoginUrl(options: CreateLoginUrlOptions): string;
+    exchangeCodeForToken(params: {
+        code: string;
+        redirectUri: string;
+    }): Promise<TokenResponse>;
+    refreshAccessToken(refreshToken: string): Promise<TokenResponse>;
+    logout(refreshToken: string): Promise<{
+        ok: true;
+    }>;
+    getUserInfo(accessToken: string): Promise<HubUser>;
+    verifyAccessToken(accessToken: string, options?: VerifyAccessTokenOptions): Promise<HubTokenClaims>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAkB,KAAK,qBAAqB,EAAE,MAAM,UAAU,CAAC;AAGtE,OAAO,EAAqB,KAAK,wBAAwB,EAAE,MAAM,aAAa,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEzF;;;;GAIG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,cAAc;IAEnD,cAAc,CAAC,OAAO,EAAE,qBAAqB,GAAG,MAAM;IAItD,oBAAoB,CAAC,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC;IAI3F,kBAAkB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC;IAIhE,MAAM,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IAInD,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAIlD,iBAAiB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,OAAO,CAAC,cAAc,CAAC;CAGpG"}

package/dist/client.js

@@ -0,0 +1,34 @@
+import { createLoginUrl } from "./url.js";
+import { exchangeCodeForToken, logout, refreshAccessToken } from "./token.js";
+import { getUserInfo } from "./userinfo.js";
+import { verifyAccessToken } from "./verify.js";
+/**
+ * Convenience wrapper bundling every SDK call under one configured instance.
+ * Equivalent to calling the standalone functions with `config` each time —
+ * use whichever style fits your codebase.
+ */
+export class LoginHubClient {
+    config;
+    constructor(config) {
+        this.config = config;
+    }
+    createLoginUrl(options) {
+        return createLoginUrl(this.config, options);
+    }
+    exchangeCodeForToken(params) {
+        return exchangeCodeForToken(this.config, params);
+    }
+    refreshAccessToken(refreshToken) {
+        return refreshAccessToken(this.config, refreshToken);
+    }
+    logout(refreshToken) {
+        return logout(this.config, refreshToken);
+    }
+    getUserInfo(accessToken) {
+        return getUserInfo(this.config, accessToken);
+    }
+    verifyAccessToken(accessToken, options) {
+        return verifyAccessToken(this.config, accessToken, options);
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAA8B,MAAM,UAAU,CAAC;AACtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAiC,MAAM,aAAa,CAAC;AAG/E;;;;GAIG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAsB;QAAtB,WAAM,GAAN,MAAM,CAAgB;IAAG,CAAC;IAEvD,cAAc,CAAC,OAA8B;QAC3C,OAAO,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,oBAAoB,CAAC,MAA6C;QAChE,OAAO,oBAAoB,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,CAAC;IAED,kBAAkB,CAAC,YAAoB;QACrC,OAAO,kBAAkB,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,CAAC,YAAoB;QACzB,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC3C,CAAC;IAED,WAAW,CAAC,WAAmB;QAC7B,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC/C,CAAC;IAED,iBAAiB,CAAC,WAAmB,EAAE,OAAkC;QACvE,OAAO,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;CACF"}

package/dist/cookies.d.ts

@@ -0,0 +1,13 @@
+export interface CookieOptions {
+    maxAge?: number;
+    path?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: "Strict" | "Lax" | "None";
+}
+/** Minimal `Set-Cookie` serializer — kept dependency-free so the SDK doesn't
+ * force consumers onto a specific `cookie` package version. */
+export declare function serializeCookie(name: string, value: string, options?: CookieOptions): string;
+/** Parses a raw `Cookie` request header into a name→value map. */
+export declare function parseCookieHeader(header: string | null | undefined): Record<string, string>;
+//# sourceMappingURL=cookies.d.ts.map

package/dist/cookies.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.d.ts","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,aAAa;IAC5B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,QAAQ,CAAC,EAAE,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;CACtC;AAED;+DAC+D;AAC/D,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,aAAkB,GAAG,MAAM,CAQhG;AAED,kEAAkE;AAClE,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAW3F"}

package/dist/cookies.js

@@ -0,0 +1,31 @@
+/** Minimal `Set-Cookie` serializer — kept dependency-free so the SDK doesn't
+ * force consumers onto a specific `cookie` package version. */
+export function serializeCookie(name, value, options = {}) {
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    if (options.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.floor(options.maxAge)}`);
+    parts.push(`Path=${options.path ?? "/"}`);
+    if (options.httpOnly !== false)
+        parts.push("HttpOnly");
+    if (options.secure)
+        parts.push("Secure");
+    parts.push(`SameSite=${options.sameSite ?? "Lax"}`);
+    return parts.join("; ");
+}
+/** Parses a raw `Cookie` request header into a name→value map. */
+export function parseCookieHeader(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const pair of header.split(";")) {
+        const idx = pair.indexOf("=");
+        if (idx === -1)
+            continue;
+        const key = pair.slice(0, idx).trim();
+        const value = pair.slice(idx + 1).trim();
+        if (key)
+            out[key] = decodeURIComponent(value);
+    }
+    return out;
+}
+//# sourceMappingURL=cookies.js.map

package/dist/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../src/cookies.ts"],"names":[],"mappings":"AAQA;+DAC+D;AAC/D,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,UAAyB,EAAE;IACtF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACtF,KAAK,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IAC1C,IAAI,OAAO,CAAC,QAAQ,KAAK,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,OAAO,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,KAAK,CAAC,IAAI,CAAC,YAAY,OAAO,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACpD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,iBAAiB,CAAC,MAAiC;IACjE,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,SAAS;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/errors.d.ts

@@ -0,0 +1,10 @@
+import type { HubErrorBody } from "./types.js";
+/** Thrown for any non-2xx response from the hub, and for JWT verification
+ * failures. `error`/`errorDescription` mirror api-contract.md §5's enum. */
+export declare class LoginHubError extends Error {
+    readonly error: string;
+    readonly errorDescription?: string;
+    readonly status?: number;
+    constructor(body: HubErrorBody, status?: number);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;4EAC4E;AAC5E,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBAEb,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,EAAE,MAAM;CAOhD"}

package/dist/errors.js

@@ -0,0 +1,15 @@
+/** Thrown for any non-2xx response from the hub, and for JWT verification
+ * failures. `error`/`errorDescription` mirror api-contract.md §5's enum. */
+export class LoginHubError extends Error {
+    error;
+    errorDescription;
+    status;
+    constructor(body, status) {
+        super(body.errorDescription ?? body.error);
+        this.name = "LoginHubError";
+        this.error = body.error;
+        this.errorDescription = body.errorDescription;
+        this.status = status;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../src/errors.ts"],"names":[],"mappings":"AAEA;4EAC4E;AAC5E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,KAAK,CAAS;IACd,gBAAgB,CAAU;IAC1B,MAAM,CAAU;IAEzB,YAAY,IAAkB,EAAE,MAAe;QAC7C,KAAK,CAAC,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,gBAAgB,CAAC;QAC9C,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF"}

package/dist/http.d.ts

@@ -0,0 +1,3 @@
+export declare function postJson<T>(fetchImpl: typeof fetch, url: string, body: Record<string, unknown>, headers?: Record<string, string>): Promise<T>;
+export declare function getJson<T>(fetchImpl: typeof fetch, url: string, headers?: Record<string, string>): Promise<T>;
+//# sourceMappingURL=http.d.ts.map

package/dist/http.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.d.ts","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAGA,wBAAsB,QAAQ,CAAC,CAAC,EAC9B,SAAS,EAAE,OAAO,KAAK,EACvB,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC7B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC/B,OAAO,CAAC,CAAC,CAAC,CAWZ;AAED,wBAAsB,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAOnH"}

package/dist/http.js

@@ -0,0 +1,22 @@
+import { LoginHubError } from "./errors.js";
+export async function postJson(fetchImpl, url, body, headers) {
+    const res = await fetchImpl(url, {
+        method: "POST",
+        headers: { "content-type": "application/json", ...headers },
+        body: JSON.stringify(body),
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new LoginHubError(json ?? { error: "server_error" }, res.status);
+    }
+    return json;
+}
+export async function getJson(fetchImpl, url, headers) {
+    const res = await fetchImpl(url, { method: "GET", headers });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new LoginHubError(json ?? { error: "server_error" }, res.status);
+    }
+    return json;
+}
+//# sourceMappingURL=http.js.map

package/dist/http.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../src/http.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,SAAuB,EACvB,GAAW,EACX,IAA6B,EAC7B,OAAgC;IAEhC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;QAC/B,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,GAAG,OAAO,EAAE;QAC3D,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAY,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CAAE,IAAqB,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAI,SAAuB,EAAE,GAAW,EAAE,OAAgC;IACrG,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAY,CAAC;IAC7D,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,aAAa,CAAE,IAAqB,IAAI,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC3F,CAAC;IACD,OAAO,IAAS,CAAC;AACnB,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./url.js";
+export * from "./token.js";
+export * from "./userinfo.js";
+export * from "./verify.js";
+export * from "./client.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,8 @@
+export * from "./types.js";
+export * from "./errors.js";
+export * from "./url.js";
+export * from "./token.js";
+export * from "./userinfo.js";
+export * from "./verify.js";
+export * from "./client.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,YAAY,CAAC;AAC3B,cAAc,eAAe,CAAC;AAC9B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/next.d.ts

@@ -0,0 +1,57 @@
+import type { HubTokenClaims, LoginHubConfig } from "./types.js";
+export declare const SESSION_COOKIE = "hub_session";
+export declare const REFRESH_COOKIE = "hub_refresh";
+export declare const STATE_COOKIE = "hub_state";
+/**
+ * Builds the redirect response for your login route (e.g. `app/login/route.ts`):
+ * sets a short-lived CSRF `state` cookie and 302s to the hub's `/authorize`.
+ */
+export declare function loginRedirect(config: Pick<LoginHubConfig, "hubUrl" | "clientId">, options: {
+    redirectUri: string;
+    appName?: string;
+    secure?: boolean;
+}): Response;
+/**
+ * Handles the callback route (e.g. `app/auth/callback/route.ts`): verifies
+ * `state`, exchanges `code` for tokens, sets session cookies, and 302s to
+ * `successPath`. Throws on missing/mismatched state or a hub error - wrap in
+ * try/catch and redirect to an error page.
+ */
+export declare function handleCallback(config: LoginHubConfig, request: Request, options: {
+    redirectUri: string;
+    successPath?: string;
+    secure?: boolean;
+}): Promise<Response>;
+export interface CookieReader {
+    get(name: string): {
+        value: string;
+    } | undefined;
+}
+/**
+ * Reads + verifies the session from cookies (works with Next's `cookies()`
+ * from `next/headers`, or any object shaped `{ get(name) => {value} }`).
+ * Returns `null` if there's no valid session - does *not* attempt refresh
+ * (call `refreshSession` explicitly, since that needs to write cookies).
+ */
+export declare function getSession(config: Pick<LoginHubConfig, "hubUrl" | "clientId">, cookies: CookieReader): Promise<{
+    claims: HubTokenClaims;
+    accessToken: string;
+} | null>;
+/**
+ * Uses the refresh cookie to mint a new access token and returns a Response
+ * with updated `Set-Cookie` headers (rotation - api-contract §6). Call this
+ * from middleware/a route handler when `getSession` returns null but a
+ * refresh cookie is present.
+ */
+export declare function refreshSession(config: LoginHubConfig, request: Request, options?: {
+    secure?: boolean;
+}): Promise<{
+    accessToken: string;
+    response: Response;
+} | null>;
+/** Revokes the refresh token at the hub and clears session cookies. */
+export declare function logoutResponse(config: LoginHubConfig, request: Request, options?: {
+    redirectTo?: string;
+    secure?: boolean;
+}): Promise<Response>;
+//# sourceMappingURL=next.d.ts.map

package/dist/next.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.d.ts","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAUA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjE,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,cAAc,gBAAgB,CAAC;AAC5C,eAAO,MAAM,YAAY,cAAc,CAAC;AAUxC;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC,EACnD,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACnE,QAAQ,CASV;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,OAAO,EAChB,OAAO,EAAE;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAE,GACvE,OAAO,CAAC,QAAQ,CAAC,CAmCnB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,SAAS,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAC9B,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC,EACnD,OAAO,EAAE,YAAY,GACpB,OAAO,CAAC;IAAE,MAAM,EAAE,cAAc,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAAC,CASjE;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACjC,OAAO,CAAC;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,GAAG,IAAI,CAAC,CAwB7D;AAED,uEAAuE;AACvE,wBAAsB,cAAc,CAClC,MAAM,EAAE,cAAc,EACtB,OAAO,EAAE,OAAO,EAChB,OAAO,GAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACtD,OAAO,CAAC,QAAQ,CAAC,CAUnB"}

package/dist/next.js

@@ -0,0 +1,119 @@
+/**
+ * Next.js integration helpers. Built on the Web-standard Request/Response/
+ * Headers APIs so they work in both App Router Route Handlers (Node + Edge
+ * runtime) without importing `next` directly - keeps `next` an optional
+ * peer dependency (see package.json).
+ */
+import { createLoginUrl } from "./url.js";
+import { exchangeCodeForToken, logout as hubLogout, refreshAccessToken } from "./token.js";
+import { verifyAccessToken } from "./verify.js";
+import { parseCookieHeader, serializeCookie } from "./cookies.js";
+export const SESSION_COOKIE = "hub_session";
+export const REFRESH_COOKIE = "hub_refresh";
+export const STATE_COOKIE = "hub_state";
+const THIRTY_DAYS_SECONDS = 30 * 24 * 60 * 60;
+function randomState() {
+    const bytes = new Uint8Array(24);
+    crypto.getRandomValues(bytes);
+    return Array.from(bytes, (b) => b.toString(16).padStart(2, "0")).join("");
+}
+/**
+ * Builds the redirect response for your login route (e.g. `app/login/route.ts`):
+ * sets a short-lived CSRF `state` cookie and 302s to the hub's `/authorize`.
+ */
+export function loginRedirect(config, options) {
+    const state = randomState();
+    const url = createLoginUrl(config, { redirectUri: options.redirectUri, state, appName: options.appName });
+    const headers = new Headers({ Location: url });
+    headers.append("Set-Cookie", serializeCookie(STATE_COOKIE, state, { maxAge: 600, httpOnly: true, secure: options.secure }));
+    return new Response(null, { status: 302, headers });
+}
+/**
+ * Handles the callback route (e.g. `app/auth/callback/route.ts`): verifies
+ * `state`, exchanges `code` for tokens, sets session cookies, and 302s to
+ * `successPath`. Throws on missing/mismatched state or a hub error - wrap in
+ * try/catch and redirect to an error page.
+ */
+export async function handleCallback(config, request, options) {
+    const reqUrl = new URL(request.url);
+    const code = reqUrl.searchParams.get("code");
+    const state = reqUrl.searchParams.get("state");
+    const error = reqUrl.searchParams.get("error");
+    const cookies = parseCookieHeader(request.headers.get("cookie"));
+    if (error) {
+        throw new Error(`login failed: ${error}`);
+    }
+    if (!code || !state || state !== cookies[STATE_COOKIE]) {
+        throw new Error("invalid or missing OAuth state (possible CSRF or expired session)");
+    }
+    const tokens = await exchangeCodeForToken(config, { code, redirectUri: options.redirectUri });
+    const headers = new Headers({ Location: options.successPath ?? "/" });
+    headers.append("Set-Cookie", serializeCookie(SESSION_COOKIE, tokens.accessToken, {
+        maxAge: tokens.expiresIn,
+        httpOnly: true,
+        secure: options.secure,
+    }));
+    headers.append("Set-Cookie", serializeCookie(REFRESH_COOKIE, tokens.refreshToken, {
+        maxAge: THIRTY_DAYS_SECONDS,
+        httpOnly: true,
+        secure: options.secure,
+    }));
+    headers.append("Set-Cookie", serializeCookie(STATE_COOKIE, "", { maxAge: 0, secure: options.secure }));
+    return new Response(null, { status: 302, headers });
+}
+/**
+ * Reads + verifies the session from cookies (works with Next's `cookies()`
+ * from `next/headers`, or any object shaped `{ get(name) => {value} }`).
+ * Returns `null` if there's no valid session - does *not* attempt refresh
+ * (call `refreshSession` explicitly, since that needs to write cookies).
+ */
+export async function getSession(config, cookies) {
+    const accessToken = cookies.get(SESSION_COOKIE)?.value;
+    if (!accessToken)
+        return null;
+    try {
+        const claims = await verifyAccessToken(config, accessToken);
+        return { claims, accessToken };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Uses the refresh cookie to mint a new access token and returns a Response
+ * with updated `Set-Cookie` headers (rotation - api-contract §6). Call this
+ * from middleware/a route handler when `getSession` returns null but a
+ * refresh cookie is present.
+ */
+export async function refreshSession(config, request, options = {}) {
+    const cookies = parseCookieHeader(request.headers.get("cookie"));
+    const refreshToken = cookies[REFRESH_COOKIE];
+    if (!refreshToken)
+        return null;
+    const tokens = await refreshAccessToken(config, refreshToken);
+    const headers = new Headers();
+    headers.append("Set-Cookie", serializeCookie(SESSION_COOKIE, tokens.accessToken, {
+        maxAge: tokens.expiresIn,
+        httpOnly: true,
+        secure: options.secure,
+    }));
+    headers.append("Set-Cookie", serializeCookie(REFRESH_COOKIE, tokens.refreshToken, {
+        maxAge: THIRTY_DAYS_SECONDS,
+        httpOnly: true,
+        secure: options.secure,
+    }));
+    return { accessToken: tokens.accessToken, response: new Response(null, { headers }) };
+}
+/** Revokes the refresh token at the hub and clears session cookies. */
+export async function logoutResponse(config, request, options = {}) {
+    const cookies = parseCookieHeader(request.headers.get("cookie"));
+    const refreshToken = cookies[REFRESH_COOKIE];
+    if (refreshToken) {
+        await hubLogout(config, refreshToken).catch(() => undefined);
+    }
+    const headers = new Headers(options.redirectTo ? { Location: options.redirectTo } : undefined);
+    headers.append("Set-Cookie", serializeCookie(SESSION_COOKIE, "", { maxAge: 0, secure: options.secure }));
+    headers.append("Set-Cookie", serializeCookie(REFRESH_COOKIE, "", { maxAge: 0, secure: options.secure }));
+    return new Response(null, { status: options.redirectTo ? 302 : 200, headers });
+}
+//# sourceMappingURL=next.js.map

package/dist/next.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"next.js","sourceRoot":"","sources":["../src/next.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAC1C,OAAO,EAAE,oBAAoB,EAAE,MAAM,IAAI,SAAS,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAC3F,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGlE,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAC5C,MAAM,CAAC,MAAM,cAAc,GAAG,aAAa,CAAC;AAC5C,MAAM,CAAC,MAAM,YAAY,GAAG,WAAW,CAAC;AAExC,MAAM,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;AAE9C,SAAS,WAAW;IAClB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC;IACjC,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IAC9B,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC5E,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAC3B,MAAmD,EACnD,OAAoE;IAEpE,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;IAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC;IAC1G,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC;IAC/C,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,YAAY,EAAE,KAAK,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAC9F,CAAC;IACF,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAAgB,EAChB,OAAwE;IAExE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAEjE,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,iBAAiB,KAAK,EAAE,CAAC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,IAAI,KAAK,KAAK,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC;IAE9F,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,WAAW,IAAI,GAAG,EAAE,CAAC,CAAC;IACtE,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE;QAClD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;IACF,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;QACnD,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,YAAY,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACvG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACtD,CAAC;AAMD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAmD,EACnD,OAAqB;IAErB,MAAM,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,KAAK,CAAC;IACvD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC5D,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAAgB,EAChB,UAAgC,EAAE;IAElC,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAE/B,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;IAC9B,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE;QAClD,MAAM,EAAE,MAAM,CAAC,SAAS;QACxB,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;IACF,OAAO,CAAC,MAAM,CACZ,YAAY,EACZ,eAAe,CAAC,cAAc,EAAE,MAAM,CAAC,YAAY,EAAE;QACnD,MAAM,EAAE,mBAAmB;QAC3B,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;KACvB,CAAC,CACH,CAAC;IACF,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;AACxF,CAAC;AAED,uEAAuE;AACvE,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAsB,EACtB,OAAgB,EAChB,UAAqD,EAAE;IAEvD,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjE,MAAM,YAAY,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7C,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,SAAS,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/F,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzG,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,eAAe,CAAC,cAAc,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IACzG,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;AACjF,CAAC"}

package/dist/token.d.ts

@@ -0,0 +1,22 @@
+import type { LoginHubConfig, TokenResponse } from "./types.js";
+/**
+ * `POST /token` grant_type=authorization_code — exchanges the code from the
+ * hub's redirect for tokens (api-contract §2). Call this from your callback
+ * route handler, server-side only.
+ */
+export declare function exchangeCodeForToken(config: LoginHubConfig, params: {
+    code: string;
+    redirectUri: string;
+}): Promise<TokenResponse>;
+/**
+ * `POST /token` grant_type=refresh_token — rotates the refresh token and
+ * issues a fresh access token (api-contract §2, §6 rotation). The returned
+ * `refreshToken` replaces the old one; the old one is revoked server-side.
+ */
+export declare function refreshAccessToken(config: LoginHubConfig, refreshToken: string): Promise<TokenResponse>;
+/** `POST /logout` — revokes a refresh token (api-contract §2). Access tokens
+ * are not revocable; the caller should also clear its own session cookie. */
+export declare function logout(config: LoginHubConfig, refreshToken: string): Promise<{
+    ok: true;
+}>;
+//# sourceMappingURL=token.d.ts.map

package/dist/token.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.d.ts","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAWhE;;;;GAIG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GAC5C,OAAO,CAAC,aAAa,CAAC,CAUxB;AAED;;;;GAIG;AACH,wBAAsB,kBAAkB,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAS7G;AAED;6EAC6E;AAC7E,wBAAsB,MAAM,CAAC,MAAM,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,CAAC,CAQhG"}

package/dist/token.js

@@ -0,0 +1,50 @@
+import { postJson } from "./http.js";
+function requireSecret(config) {
+    if (!config.clientSecret) {
+        throw new Error("clientSecret is required for this call - keep it server-side only (BFF model, api-contract.md §0)");
+    }
+    return config.clientSecret;
+}
+/**
+ * `POST /token` grant_type=authorization_code — exchanges the code from the
+ * hub's redirect for tokens (api-contract §2). Call this from your callback
+ * route handler, server-side only.
+ */
+export async function exchangeCodeForToken(config, params) {
+    const fetchImpl = config.fetch ?? fetch;
+    const url = new URL("/token", config.hubUrl).toString();
+    return postJson(fetchImpl, url, {
+        grant_type: "authorization_code",
+        client_id: config.clientId,
+        client_secret: requireSecret(config),
+        code: params.code,
+        redirect_uri: params.redirectUri,
+    });
+}
+/**
+ * `POST /token` grant_type=refresh_token — rotates the refresh token and
+ * issues a fresh access token (api-contract §2, §6 rotation). The returned
+ * `refreshToken` replaces the old one; the old one is revoked server-side.
+ */
+export async function refreshAccessToken(config, refreshToken) {
+    const fetchImpl = config.fetch ?? fetch;
+    const url = new URL("/token", config.hubUrl).toString();
+    return postJson(fetchImpl, url, {
+        grant_type: "refresh_token",
+        client_id: config.clientId,
+        client_secret: requireSecret(config),
+        refresh_token: refreshToken,
+    });
+}
+/** `POST /logout` — revokes a refresh token (api-contract §2). Access tokens
+ * are not revocable; the caller should also clear its own session cookie. */
+export async function logout(config, refreshToken) {
+    const fetchImpl = config.fetch ?? fetch;
+    const url = new URL("/logout", config.hubUrl).toString();
+    return postJson(fetchImpl, url, {
+        clientId: config.clientId,
+        clientSecret: requireSecret(config),
+        refreshToken,
+    });
+}
+//# sourceMappingURL=token.js.map

package/dist/token.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token.js","sourceRoot":"","sources":["../src/token.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAGrC,SAAS,aAAa,CAAC,MAAsB;IAC3C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,mGAAmG,CACpG,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,YAAY,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAsB,EACtB,MAA6C;IAE7C,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAgB,SAAS,EAAE,GAAG,EAAE;QAC7C,UAAU,EAAE,oBAAoB;QAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC;QACpC,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,YAAY,EAAE,MAAM,CAAC,WAAW;KACjC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAAsB,EAAE,YAAoB;IACnF,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACxD,OAAO,QAAQ,CAAgB,SAAS,EAAE,GAAG,EAAE;QAC7C,UAAU,EAAE,eAAe;QAC3B,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,aAAa,EAAE,aAAa,CAAC,MAAM,CAAC;QACpC,aAAa,EAAE,YAAY;KAC5B,CAAC,CAAC;AACL,CAAC;AAED;6EAC6E;AAC7E,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,MAAsB,EAAE,YAAoB;IACvE,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IACzD,OAAO,QAAQ,CAAe,SAAS,EAAE,GAAG,EAAE;QAC5C,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,YAAY,EAAE,aAAa,CAAC,MAAM,CAAC;QACnC,YAAY;KACb,CAAC,CAAC;AACL,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,48 @@
+/** Config shared by every SDK call. Mirrors docs/api-contract.md §1 step 2. */
+export interface LoginHubConfig {
+    /** Hub base URL, e.g. "https://login.example.com" (no trailing slash). */
+    hubUrl: string;
+    /** Client ID issued by `POST /clients`. */
+    clientId: string;
+    /**
+     * Client secret issued by `POST /clients`. Required for /token and /logout
+     * calls. **Server-side only** — never ship this to a browser bundle
+     * (BFF model, api-contract.md §0).
+     */
+    clientSecret?: string;
+    /** Optional custom fetch implementation (tests, non-global-fetch runtimes). */
+    fetch?: typeof fetch;
+}
+/** Normalized user object — identical shape for all 3 providers (api-contract §3). */
+export interface HubUser {
+    id: string;
+    provider: "google" | "naver" | "kakao";
+    email: string | null;
+    nickname: string;
+    avatarUrl: string | null;
+}
+/** `POST /token` response (both grant types), api-contract §2. */
+export interface TokenResponse {
+    tokenType: "Bearer";
+    accessToken: string;
+    expiresIn: number;
+    refreshToken: string;
+    user: HubUser;
+}
+/** Decoded access-token JWT claims, api-contract §4. */
+export interface HubTokenClaims {
+    sub: string;
+    iss: string;
+    aud: string;
+    iat: number;
+    exp: number;
+    email: string | null;
+    nickname: string;
+    avatarUrl: string | null;
+    provider: "google" | "naver" | "kakao";
+}
+export interface HubErrorBody {
+    error: string;
+    errorDescription?: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,MAAM,WAAW,cAAc;IAC7B,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,QAAQ,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB;AAED,sFAAsF;AACtF,MAAM,WAAW,OAAO;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;IACvC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,kEAAkE;AAClE,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,QAAQ,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,OAAO,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,QAAQ,EAAE,QAAQ,GAAG,OAAO,GAAG,OAAO,CAAC;CACxC;AAED,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B"}

package/dist/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":""}

package/dist/url.d.ts

@@ -0,0 +1,22 @@
+import type { LoginHubConfig } from "./types.js";
+export interface CreateLoginUrlOptions {
+    /** Consumer's own callback route (must be registered in `redirectUris`). */
+    redirectUri: string;
+    /** CSRF-protection value — generate per-session, store, and compare on callback. */
+    state: string;
+    /** Optional display name shown as "{appName}에 로그인" on the hub's login screen. */
+    appName?: string;
+}
+/**
+ * Builds the `GET /authorize` URL to send the browser to (api-contract §1
+ * step 3 / §2). This does not make a network call — it's a pure URL builder
+ * so callers can `redirect()` or render an `<a href>` with it.
+ */
+export declare function createLoginUrl(config: Pick<LoginHubConfig, "hubUrl" | "clientId">, options: CreateLoginUrlOptions): string;
+/**
+ * Generates a cryptographically random opaque string suitable for the OAuth
+ * `state` param. Works in both Node (>=19, webcrypto global) and edge
+ * runtimes (Next.js middleware/edge routes).
+ */
+export declare function generateState(byteLength?: number): string;
+//# sourceMappingURL=url.d.ts.map

package/dist/url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.d.ts","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,MAAM,WAAW,qBAAqB;IACpC,4EAA4E;IAC5E,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC,EAAE,OAAO,EAAE,qBAAqB,GAAG,MAAM,CAO1H;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,UAAU,SAAK,GAAG,MAAM,CAUrD"}

package/dist/url.js

@@ -0,0 +1,32 @@
+/**
+ * Builds the `GET /authorize` URL to send the browser to (api-contract §1
+ * step 3 / §2). This does not make a network call — it's a pure URL builder
+ * so callers can `redirect()` or render an `<a href>` with it.
+ */
+export function createLoginUrl(config, options) {
+    const url = new URL("/authorize", config.hubUrl);
+    url.searchParams.set("client_id", config.clientId);
+    url.searchParams.set("redirect_uri", options.redirectUri);
+    url.searchParams.set("state", options.state);
+    if (options.appName)
+        url.searchParams.set("app_name", options.appName);
+    return url.toString();
+}
+/**
+ * Generates a cryptographically random opaque string suitable for the OAuth
+ * `state` param. Works in both Node (>=19, webcrypto global) and edge
+ * runtimes (Next.js middleware/edge routes).
+ */
+export function generateState(byteLength = 24) {
+    const bytes = new Uint8Array(byteLength);
+    const cryptoObj = globalThis.crypto;
+    if (!cryptoObj) {
+        throw new Error("global crypto is unavailable in this runtime - pass a pre-generated state instead");
+    }
+    cryptoObj.getRandomValues(bytes);
+    let out = "";
+    for (const b of bytes)
+        out += b.toString(16).padStart(2, "0");
+    return out;
+}
+//# sourceMappingURL=url.js.map

package/dist/url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"url.js","sourceRoot":"","sources":["../src/url.ts"],"names":[],"mappings":"AAWA;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,MAAmD,EAAE,OAA8B;IAChH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACjD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACnD,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAC1D,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,CAAC,OAAO;QAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;IACvE,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,UAAU,GAAG,EAAE;IAC3C,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,UAAU,CAAC,CAAC;IACzC,MAAM,SAAS,GAAI,UAAoD,CAAC,MAAM,CAAC;IAC/E,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,mFAAmF,CAAC,CAAC;IACvG,CAAC;IACD,SAAS,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,GAAG,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/userinfo.d.ts

@@ -0,0 +1,5 @@
+import type { HubUser, LoginHubConfig } from "./types.js";
+/** `GET /userinfo` — always-fresh user data from the hub DB (api-contract §2),
+ * unlike the JWT claims which are a snapshot from token-issue time. */
+export declare function getUserInfo(config: Pick<LoginHubConfig, "hubUrl" | "fetch">, accessToken: string): Promise<HubUser>;
+//# sourceMappingURL=userinfo.d.ts.map

package/dist/userinfo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.d.ts","sourceRoot":"","sources":["../src/userinfo.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE1D;uEACuE;AACvE,wBAAsB,WAAW,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,OAAO,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAIzH"}

package/dist/userinfo.js

@@ -0,0 +1,9 @@
+import { getJson } from "./http.js";
+/** `GET /userinfo` — always-fresh user data from the hub DB (api-contract §2),
+ * unlike the JWT claims which are a snapshot from token-issue time. */
+export async function getUserInfo(config, accessToken) {
+    const fetchImpl = config.fetch ?? fetch;
+    const url = new URL("/userinfo", config.hubUrl).toString();
+    return getJson(fetchImpl, url, { authorization: `Bearer ${accessToken}` });
+}
+//# sourceMappingURL=userinfo.js.map

package/dist/userinfo.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"userinfo.js","sourceRoot":"","sources":["../src/userinfo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC;uEACuE;AACvE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,MAAgD,EAAE,WAAmB;IACrG,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3D,OAAO,OAAO,CAAU,SAAS,EAAE,GAAG,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,EAAE,EAAE,CAAC,CAAC;AACtF,CAAC"}

package/dist/verify.d.ts

@@ -0,0 +1,12 @@
+import type { HubTokenClaims, LoginHubConfig } from "./types.js";
+export interface VerifyAccessTokenOptions {
+    /** Override the expected `iss` claim. Defaults to "login-hub" (api-contract §4). */
+    issuer?: string;
+}
+/**
+ * Stateless JWKS verification of a hub-issued access token (api-contract §4).
+ * No network call to the hub beyond the (cached) JWKS fetch — safe to call on
+ * every request in a middleware/edge function.
+ */
+export declare function verifyAccessToken(config: Pick<LoginHubConfig, "hubUrl" | "clientId">, accessToken: string, options?: VerifyAccessTokenOptions): Promise<HubTokenClaims>;
+//# sourceMappingURL=verify.d.ts.map

package/dist/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAiBjE,MAAM,WAAW,wBAAwB;IACvC,oFAAoF;IACpF,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,CACrC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,UAAU,CAAC,EACnD,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,wBAA6B,GACrC,OAAO,CAAC,cAAc,CAAC,CAczB"}

package/dist/verify.js

@@ -0,0 +1,33 @@
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { LoginHubError } from "./errors.js";
+const DEFAULT_ISSUER = "login-hub";
+// One JWKS fetcher per hubUrl, reused across calls (jose caches keys +
+// handles `kid` rotation internally - api-contract §2 jwks.json note).
+const jwksCache = new Map();
+function getJwks(hubUrl) {
+    let jwks = jwksCache.get(hubUrl);
+    if (!jwks) {
+        jwks = createRemoteJWKSet(new URL("/.well-known/jwks.json", hubUrl));
+        jwksCache.set(hubUrl, jwks);
+    }
+    return jwks;
+}
+/**
+ * Stateless JWKS verification of a hub-issued access token (api-contract §4).
+ * No network call to the hub beyond the (cached) JWKS fetch — safe to call on
+ * every request in a middleware/edge function.
+ */
+export async function verifyAccessToken(config, accessToken, options = {}) {
+    const jwks = getJwks(config.hubUrl);
+    try {
+        const { payload } = await jwtVerify(accessToken, jwks, {
+            issuer: options.issuer ?? DEFAULT_ISSUER,
+            audience: config.clientId,
+        });
+        return payload;
+    }
+    catch (err) {
+        throw new LoginHubError({ error: "invalid_token", errorDescription: err instanceof Error ? err.message : String(err) }, 401);
+    }
+}
+//# sourceMappingURL=verify.js.map

package/dist/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../src/verify.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAwB,MAAM,MAAM,CAAC;AAC3E,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,MAAM,cAAc,GAAG,WAAW,CAAC;AAEnC,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,SAAS,GAAG,IAAI,GAAG,EAA2B,CAAC;AAErD,SAAS,OAAO,CAAC,MAAc;IAC7B,IAAI,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC;QACrE,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAOD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,MAAmD,EACnD,WAAmB,EACnB,UAAoC,EAAE;IAEtC,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE;YACrD,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,cAAc;YACxC,QAAQ,EAAE,MAAM,CAAC,QAAQ;SAC1B,CAAC,CAAC;QACH,OAAO,OAAoC,CAAC;IAC9C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,aAAa,CACrB,EAAE,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAC9F,GAAG,CACJ,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "login-hub-sdk",
+  "version": "0.1.0",
+  "description": "Thin framework-agnostic client for the login-hub OAuth2 authorization server (see docs/api-contract.md).",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./next": {
+      "types": "./dist/next.d.ts",
+      "import": "./dist/next.js"
+    }
+  },
+  "files": [
+    "dist"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ngsk2784-lab/login.git",
+    "directory": "packages/sdk"
+  },
+  "publishConfig": {
+    "registry": "https://registry.npmjs.org",
+    "access": "public"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run",
+    "test:watch": "vitest"
+  },
+  "peerDependencies": {
+    "next": ">=13"
+  },
+  "peerDependenciesMeta": {
+    "next": {
+      "optional": true
+    }
+  },
+  "dependencies": {
+    "jose": "^6.2.3",
+    "qrcode": "^1.5.4",
+    "speakeasy": "^2.0.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.10.5",
+    "typescript": "^5.7.3",
+    "vitest": "^4.1.10"
+  }
+}