najm-auth 2.0.15 → 3.1.0

package/dist/getSession-BthP85UA.d.ts

@@ -0,0 +1,68 @@
+import { A as AuthUser } from './types-BaSfgxqE.js';
+import { S as SessionRecoveryFailure } from './sessionRecovery-D5Fa0yZ1.js';
+
+interface ServerSession {
+    user: AuthUser;
+    roles?: string[];
+    permissions?: string[];
+}
+interface GetSessionConfig {
+    /**
+     * Base URL for auth endpoints.
+     * Defaults to `NEXT_PUBLIC_API_URL` or the same-origin `/api` path.
+     */
+    baseURL?: string;
+    /** Auth route prefix appended to baseURL (default: '/auth'). */
+    authPrefix?: string;
+    /** Refresh token cookie name (default: 'refreshToken'). */
+    cookieName?: string;
+    /** Signed session cookie name (default: 'najm.session'). */
+    sessionCookieName?: string;
+    /**
+     * Secret used to verify the session cookie HMAC signature.
+     * Falls back to NAJM_SESSION_SECRET or JWT_ACCESS_SECRET env vars.
+     */
+    sessionSecret?: string;
+    /**
+     * Maximum accepted session-cookie age in seconds.
+     * Must match the auth plugin's `session.maxAge`. Default: 300.
+     */
+    sessionMaxAge?: number;
+    /**
+     * Session-recovery endpoint. Defaults to
+     * `${baseURL}${authPrefix}/session/recover`. Set to false to disable fallback.
+     */
+    recoveryURL?: string | false;
+    /** Loopback-only recovery endpoint for self-hosted reverse-proxy setups. */
+    internalRecoveryURL?: string;
+    /**
+     * Error handling mode:
+     * - 'nullable' (default): returns null on any failure
+     * - 'strict': throws typed errors for debugging
+     */
+    mode?: 'nullable' | 'strict';
+    /** Secret-free diagnostic hook for failed recovery attempts. */
+    onRecoveryFailure?: (failure: SessionRecoveryFailure) => void;
+}
+declare class NoSessionError extends Error {
+    readonly code = "NO_SESSION";
+    constructor(message?: string);
+}
+declare class AuthConfigError extends Error {
+    readonly code = "AUTH_CONFIG_ERROR";
+    constructor(message: string);
+}
+declare class AuthTransportError extends Error {
+    readonly status?: number;
+    readonly code = "AUTH_TRANSPORT_ERROR";
+    constructor(message: string, status?: number);
+}
+/**
+ * Resolve a session in a Next.js Server Component, Route Handler, or Server
+ * Action. Recovery returns claims for the current render but cannot persist
+ * response cookies during Server Component rendering; middleware performs that
+ * persistence for protected navigation.
+ */
+declare function getSession(config?: GetSessionConfig): Promise<ServerSession | null>;
+
+export { AuthConfigError as A, type GetSessionConfig as G, NoSessionError as N, type ServerSession as S, AuthTransportError as a, getSession as g };

package/dist/identity/ma.d.ts

@@ -0,0 +1 @@
+export { M as MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, e as TemporaryCredential, T as TemporaryCredentialInput, i as isMoroccanCin, m as moroccanCinTemporaryCredential, j as moroccoIdentityPreset, n as normalizeMoroccanCin, k as normalizeMoroccanPhone } from '../ma-sNHnUGLO.js';

package/dist/identity/ma.js

@@ -0,0 +1,64 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/identity/presets.ts
+var compactPhone = /* @__PURE__ */ __name((value) => value.trim().replace(/[\s().-]+/g, ""), "compactPhone");
+var MOROCCO_LOCAL = /^0\d{9}$/;
+var MOROCCO_NATIONAL = /^212\d{9}$/;
+var MOROCCO_E164 = /^\+212\d{9}$/;
+var normalizeMoroccanPhone = /* @__PURE__ */ __name((value) => {
+  const compact = compactPhone(value);
+  if (MOROCCO_LOCAL.test(compact))
+    return `+212${compact.slice(1)}`;
+  if (MOROCCO_NATIONAL.test(compact))
+    return `+${compact}`;
+  if (MOROCCO_E164.test(compact))
+    return compact;
+  return null;
+}, "normalizeMoroccanPhone");
+var moroccoIdentityPreset = {
+  name: "ma",
+  normalize: normalizeMoroccanPhone
+};
+
+// src/identity/temporaryCredential.ts
+var EXACT_TEMPORARY_CREDENTIAL_KIND = "exact";
+var exactKind = {
+  name: EXACT_TEMPORARY_CREDENTIAL_KIND,
+  normalize: /* @__PURE__ */ __name((value) => value, "normalize")
+};
+var MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND = "ma-cin";
+var MOROCCAN_CIN = /^[a-z]{1,3}\d{5,17}$/i;
+function isMoroccanCin(value) {
+  const trimmed = value.trim();
+  return trimmed.length >= 8 && trimmed.length <= 20 && MOROCCAN_CIN.test(trimmed);
+}
+__name(isMoroccanCin, "isMoroccanCin");
+function normalizeMoroccanCin(value) {
+  return isMoroccanCin(value) ? value.trim().toLowerCase() : value;
+}
+__name(normalizeMoroccanCin, "normalizeMoroccanCin");
+var moroccanCinKind = {
+  name: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
+  normalize: normalizeMoroccanCin,
+  isTemporaryShape: isMoroccanCin
+};
+var KINDS = /* @__PURE__ */ new Map([
+  [exactKind.name, exactKind],
+  [moroccanCinKind.name, moroccanCinKind]
+]);
+function moroccanCinTemporaryCredential(value) {
+  if (!isMoroccanCin(value)) {
+    throw new Error("moroccanCinTemporaryCredential requires a valid Moroccan CIN");
+  }
+  return { kind: MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND, value };
+}
+__name(moroccanCinTemporaryCredential, "moroccanCinTemporaryCredential");
+export {
+  MOROCCAN_CIN_TEMPORARY_CREDENTIAL_KIND,
+  isMoroccanCin,
+  moroccanCinTemporaryCredential,
+  moroccoIdentityPreset,
+  normalizeMoroccanCin,
+  normalizeMoroccanPhone
+};