trustline 0.0.1 → 0.1.0

package/dist/chunk-CTPFKR4O.js

@@ -0,0 +1,157 @@
+// src/storage/sql.ts
+import { sql } from "kysely";
+function createSqlStorage(database, dialect, options) {
+  const tables = resolveTables(options);
+  let schemaPromise = null;
+  async function ensureSchema() {
+    if (!schemaPromise) {
+      schemaPromise = createSchema(database, dialect, tables);
+    }
+    await schemaPromise;
+  }
+  return {
+    async findClient(clientId) {
+      await ensureSchema();
+      const row = await database.selectFrom(tables.clients).selectAll().where("client_id", "=", clientId).executeTakeFirst();
+      return row ? mapClientRow(row) : null;
+    },
+    async createClient(client) {
+      await ensureSchema();
+      await database.insertInto(tables.clients).values({
+        id: client.id,
+        client_id: client.clientId,
+        client_secret: client.clientSecret,
+        name: client.name,
+        scopes: JSON.stringify(client.scopes),
+        created_at: client.createdAt.toISOString(),
+        last_seen_at: client.lastSeenAt?.toISOString() ?? null
+      }).execute();
+    },
+    async deleteClient(clientId) {
+      await ensureSchema();
+      await database.deleteFrom(tables.clients).where("client_id", "=", clientId).execute();
+    },
+    async listClients() {
+      await ensureSchema();
+      const rows = await database.selectFrom(tables.clients).selectAll().orderBy("created_at", "asc").execute();
+      return rows.map(mapClientRow);
+    },
+    async touchClient(clientId, lastSeenAt) {
+      await ensureSchema();
+      await database.updateTable(tables.clients).set({
+        last_seen_at: lastSeenAt.toISOString()
+      }).where("client_id", "=", clientId).execute();
+    },
+    async getSigningKeys() {
+      await ensureSchema();
+      const rows = await database.selectFrom(tables.signingKeys).selectAll().orderBy("created_at", "asc").execute();
+      return rows.map(mapSigningKeyRow);
+    },
+    async addSigningKey(key) {
+      await ensureSchema();
+      await database.insertInto(tables.signingKeys).values({
+        key_id: key.keyId,
+        algorithm: key.algorithm,
+        private_key: key.privateKey,
+        public_key: key.publicKey,
+        created_at: key.createdAt.toISOString(),
+        retired_at: key.retiredAt?.toISOString() ?? null
+      }).execute();
+    },
+    async retireKey(keyId) {
+      await ensureSchema();
+      await database.updateTable(tables.signingKeys).set({
+        retired_at: (/* @__PURE__ */ new Date()).toISOString()
+      }).where("key_id", "=", keyId).execute();
+    }
+  };
+}
+function resolveTables(options) {
+  const prefix = options?.tablePrefix ?? "trustline_";
+  return {
+    clients: options?.tables?.clients ?? `${prefix}clients`,
+    signingKeys: options?.tables?.signingKeys ?? `${prefix}signing_keys`
+  };
+}
+async function createSchema(database, dialect, tables) {
+  await createClientsTable(database, dialect, tables.clients);
+  await createSigningKeysTable(database, dialect, tables.signingKeys);
+}
+async function createClientsTable(database, dialect, tableName) {
+  if (dialect === "mysql") {
+    await sql`
+      create table if not exists ${sql.table(tableName)} (
+        id varchar(255) not null,
+        client_id varchar(255) not null primary key,
+        client_secret text not null,
+        name varchar(255) not null,
+        scopes text not null,
+        created_at varchar(64) not null,
+        last_seen_at varchar(64) null
+      )
+    `.execute(database);
+    return;
+  }
+  await sql`
+    create table if not exists ${sql.table(tableName)} (
+      id varchar(255) not null,
+      client_id varchar(255) not null primary key,
+      client_secret text not null,
+      name varchar(255) not null,
+      scopes text not null,
+      created_at varchar(64) not null,
+      last_seen_at varchar(64)
+    )
+  `.execute(database);
+}
+async function createSigningKeysTable(database, dialect, tableName) {
+  if (dialect === "mysql") {
+    await sql`
+      create table if not exists ${sql.table(tableName)} (
+        key_id varchar(255) not null primary key,
+        algorithm varchar(32) not null,
+        private_key text not null,
+        public_key text not null,
+        created_at varchar(64) not null,
+        retired_at varchar(64) null
+      )
+    `.execute(database);
+    return;
+  }
+  await sql`
+    create table if not exists ${sql.table(tableName)} (
+      key_id varchar(255) not null primary key,
+      algorithm varchar(32) not null,
+      private_key text not null,
+      public_key text not null,
+      created_at varchar(64) not null,
+      retired_at varchar(64)
+    )
+  `.execute(database);
+}
+function mapClientRow(row) {
+  return {
+    id: row.id,
+    clientId: row.client_id,
+    clientSecret: row.client_secret,
+    name: row.name,
+    scopes: JSON.parse(row.scopes),
+    createdAt: new Date(row.created_at),
+    lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : null
+  };
+}
+function mapSigningKeyRow(row) {
+  return {
+    keyId: row.key_id,
+    algorithm: row.algorithm,
+    privateKey: row.private_key,
+    publicKey: row.public_key,
+    createdAt: new Date(row.created_at),
+    retiredAt: row.retired_at ? new Date(row.retired_at) : null
+  };
+}
+
+export {
+  createSqlStorage
+};
+//# sourceMappingURL=chunk-CTPFKR4O.js.map

package/dist/chunk-CTPFKR4O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/storage/sql.ts"],"sourcesContent":["import { type Kysely, sql } from \"kysely\";\n\nimport type {\n  ServiceClient,\n  SigningKey,\n  SqlStorageOptions,\n  StorageAdapter,\n} from \"./interface\";\n\ntype SqlDialect = \"mysql\" | \"postgres\" | \"sqlite\";\n\ninterface SqlTables {\n  clients: string;\n  signingKeys: string;\n}\n\ninterface SqlDatabase {\n  [tableName: string]: SqlRow;\n}\n\ninterface SqlRow {\n  algorithm?: SigningKey[\"algorithm\"];\n  client_id?: string;\n  client_secret?: string;\n  created_at: string;\n  id?: string;\n  key_id?: string;\n  last_seen_at?: string | null;\n  name?: string;\n  private_key?: string;\n  public_key?: string;\n  retired_at?: string | null;\n  scopes?: string;\n}\n\ninterface ClientRow {\n  id: string;\n  client_id: string;\n  client_secret: string;\n  name: string;\n  scopes: string;\n  created_at: string;\n  last_seen_at: string | null;\n}\n\ninterface SigningKeyRow {\n  key_id: string;\n  algorithm: SigningKey[\"algorithm\"];\n  private_key: string;\n  public_key: string;\n  created_at: string;\n  retired_at: string | null;\n}\n\nexport function createSqlStorage(\n  database: Kysely<SqlDatabase>,\n  dialect: SqlDialect,\n  options?: SqlStorageOptions,\n): StorageAdapter {\n  const tables = resolveTables(options);\n  let schemaPromise: Promise<void> | null = null;\n\n  async function ensureSchema(): Promise<void> {\n    if (!schemaPromise) {\n      schemaPromise = createSchema(database, dialect, tables);\n    }\n\n    await schemaPromise;\n  }\n\n  return {\n    async findClient(clientId) {\n      await ensureSchema();\n\n      const row = (await database\n        .selectFrom(tables.clients)\n        .selectAll()\n        .where(\"client_id\", \"=\", clientId)\n        .executeTakeFirst()) as ClientRow | undefined;\n\n      return row ? mapClientRow(row) : null;\n    },\n    async createClient(client) {\n      await ensureSchema();\n\n      await database\n        .insertInto(tables.clients)\n        .values({\n          id: client.id,\n          client_id: client.clientId,\n          client_secret: client.clientSecret,\n          name: client.name,\n          scopes: JSON.stringify(client.scopes),\n          created_at: client.createdAt.toISOString(),\n          last_seen_at: client.lastSeenAt?.toISOString() ?? null,\n        })\n        .execute();\n    },\n    async deleteClient(clientId) {\n      await ensureSchema();\n\n      await database\n        .deleteFrom(tables.clients)\n        .where(\"client_id\", \"=\", clientId)\n        .execute();\n    },\n    async listClients() {\n      await ensureSchema();\n\n      const rows = (await database\n        .selectFrom(tables.clients)\n        .selectAll()\n        .orderBy(\"created_at\", \"asc\")\n        .execute()) as ClientRow[];\n\n      return rows.map(mapClientRow);\n    },\n    async touchClient(clientId, lastSeenAt) {\n      await ensureSchema();\n\n      await database\n        .updateTable(tables.clients)\n        .set({\n          last_seen_at: lastSeenAt.toISOString(),\n        })\n        .where(\"client_id\", \"=\", clientId)\n        .execute();\n    },\n    async getSigningKeys() {\n      await ensureSchema();\n\n      const rows = (await database\n        .selectFrom(tables.signingKeys)\n        .selectAll()\n        .orderBy(\"created_at\", \"asc\")\n        .execute()) as SigningKeyRow[];\n\n      return rows.map(mapSigningKeyRow);\n    },\n    async addSigningKey(key) {\n      await ensureSchema();\n\n      await database\n        .insertInto(tables.signingKeys)\n        .values({\n          key_id: key.keyId,\n          algorithm: key.algorithm,\n          private_key: key.privateKey,\n          public_key: key.publicKey,\n          created_at: key.createdAt.toISOString(),\n          retired_at: key.retiredAt?.toISOString() ?? null,\n        })\n        .execute();\n    },\n    async retireKey(keyId) {\n      await ensureSchema();\n\n      await database\n        .updateTable(tables.signingKeys)\n        .set({\n          retired_at: new Date().toISOString(),\n        })\n        .where(\"key_id\", \"=\", keyId)\n        .execute();\n    },\n  };\n}\n\nfunction resolveTables(options?: SqlStorageOptions): SqlTables {\n  const prefix = options?.tablePrefix ?? \"trustline_\";\n\n  return {\n    clients: options?.tables?.clients ?? `${prefix}clients`,\n    signingKeys: options?.tables?.signingKeys ?? `${prefix}signing_keys`,\n  };\n}\n\nasync function createSchema(\n  database: Kysely<SqlDatabase>,\n  dialect: SqlDialect,\n  tables: SqlTables,\n): Promise<void> {\n  await createClientsTable(database, dialect, tables.clients);\n  await createSigningKeysTable(database, dialect, tables.signingKeys);\n}\n\nasync function createClientsTable(\n  database: Kysely<SqlDatabase>,\n  dialect: SqlDialect,\n  tableName: string,\n): Promise<void> {\n  if (dialect === \"mysql\") {\n    await sql`\n      create table if not exists ${sql.table(tableName)} (\n        id varchar(255) not null,\n        client_id varchar(255) not null primary key,\n        client_secret text not null,\n        name varchar(255) not null,\n        scopes text not null,\n        created_at varchar(64) not null,\n        last_seen_at varchar(64) null\n      )\n    `.execute(database);\n    return;\n  }\n\n  await sql`\n    create table if not exists ${sql.table(tableName)} (\n      id varchar(255) not null,\n      client_id varchar(255) not null primary key,\n      client_secret text not null,\n      name varchar(255) not null,\n      scopes text not null,\n      created_at varchar(64) not null,\n      last_seen_at varchar(64)\n    )\n  `.execute(database);\n}\n\nasync function createSigningKeysTable(\n  database: Kysely<SqlDatabase>,\n  dialect: SqlDialect,\n  tableName: string,\n): Promise<void> {\n  if (dialect === \"mysql\") {\n    await sql`\n      create table if not exists ${sql.table(tableName)} (\n        key_id varchar(255) not null primary key,\n        algorithm varchar(32) not null,\n        private_key text not null,\n        public_key text not null,\n        created_at varchar(64) not null,\n        retired_at varchar(64) null\n      )\n    `.execute(database);\n    return;\n  }\n\n  await sql`\n    create table if not exists ${sql.table(tableName)} (\n      key_id varchar(255) not null primary key,\n      algorithm varchar(32) not null,\n      private_key text not null,\n      public_key text not null,\n      created_at varchar(64) not null,\n      retired_at varchar(64)\n    )\n  `.execute(database);\n}\n\nfunction mapClientRow(row: ClientRow): ServiceClient {\n  return {\n    id: row.id,\n    clientId: row.client_id,\n    clientSecret: row.client_secret,\n    name: row.name,\n    scopes: JSON.parse(row.scopes) as string[],\n    createdAt: new Date(row.created_at),\n    lastSeenAt: row.last_seen_at ? new Date(row.last_seen_at) : null,\n  };\n}\n\nfunction mapSigningKeyRow(row: SigningKeyRow): SigningKey {\n  return {\n    keyId: row.key_id,\n    algorithm: row.algorithm,\n    privateKey: row.private_key,\n    publicKey: row.public_key,\n    createdAt: new Date(row.created_at),\n    retiredAt: row.retired_at ? new Date(row.retired_at) : null,\n  };\n}\n"],"mappings":";AAAA,SAAsB,WAAW;AAsD1B,SAAS,iBACd,UACA,SACA,SACgB;AAChB,QAAM,SAAS,cAAc,OAAO;AACpC,MAAI,gBAAsC;AAE1C,iBAAe,eAA8B;AAC3C,QAAI,CAAC,eAAe;AAClB,sBAAgB,aAAa,UAAU,SAAS,MAAM;AAAA,IACxD;AAEA,UAAM;AAAA,EACR;AAEA,SAAO;AAAA,IACL,MAAM,WAAW,UAAU;AACzB,YAAM,aAAa;AAEnB,YAAM,MAAO,MAAM,SAChB,WAAW,OAAO,OAAO,EACzB,UAAU,EACV,MAAM,aAAa,KAAK,QAAQ,EAChC,iBAAiB;AAEpB,aAAO,MAAM,aAAa,GAAG,IAAI;AAAA,IACnC;AAAA,IACA,MAAM,aAAa,QAAQ;AACzB,YAAM,aAAa;AAEnB,YAAM,SACH,WAAW,OAAO,OAAO,EACzB,OAAO;AAAA,QACN,IAAI,OAAO;AAAA,QACX,WAAW,OAAO;AAAA,QAClB,eAAe,OAAO;AAAA,QACtB,MAAM,OAAO;AAAA,QACb,QAAQ,KAAK,UAAU,OAAO,MAAM;AAAA,QACpC,YAAY,OAAO,UAAU,YAAY;AAAA,QACzC,cAAc,OAAO,YAAY,YAAY,KAAK;AAAA,MACpD,CAAC,EACA,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,aAAa,UAAU;AAC3B,YAAM,aAAa;AAEnB,YAAM,SACH,WAAW,OAAO,OAAO,EACzB,MAAM,aAAa,KAAK,QAAQ,EAChC,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,cAAc;AAClB,YAAM,aAAa;AAEnB,YAAM,OAAQ,MAAM,SACjB,WAAW,OAAO,OAAO,EACzB,UAAU,EACV,QAAQ,cAAc,KAAK,EAC3B,QAAQ;AAEX,aAAO,KAAK,IAAI,YAAY;AAAA,IAC9B;AAAA,IACA,MAAM,YAAY,UAAU,YAAY;AACtC,YAAM,aAAa;AAEnB,YAAM,SACH,YAAY,OAAO,OAAO,EAC1B,IAAI;AAAA,QACH,cAAc,WAAW,YAAY;AAAA,MACvC,CAAC,EACA,MAAM,aAAa,KAAK,QAAQ,EAChC,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,iBAAiB;AACrB,YAAM,aAAa;AAEnB,YAAM,OAAQ,MAAM,SACjB,WAAW,OAAO,WAAW,EAC7B,UAAU,EACV,QAAQ,cAAc,KAAK,EAC3B,QAAQ;AAEX,aAAO,KAAK,IAAI,gBAAgB;AAAA,IAClC;AAAA,IACA,MAAM,cAAc,KAAK;AACvB,YAAM,aAAa;AAEnB,YAAM,SACH,WAAW,OAAO,WAAW,EAC7B,OAAO;AAAA,QACN,QAAQ,IAAI;AAAA,QACZ,WAAW,IAAI;AAAA,QACf,aAAa,IAAI;AAAA,QACjB,YAAY,IAAI;AAAA,QAChB,YAAY,IAAI,UAAU,YAAY;AAAA,QACtC,YAAY,IAAI,WAAW,YAAY,KAAK;AAAA,MAC9C,CAAC,EACA,QAAQ;AAAA,IACb;AAAA,IACA,MAAM,UAAU,OAAO;AACrB,YAAM,aAAa;AAEnB,YAAM,SACH,YAAY,OAAO,WAAW,EAC9B,IAAI;AAAA,QACH,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,MACrC,CAAC,EACA,MAAM,UAAU,KAAK,KAAK,EAC1B,QAAQ;AAAA,IACb;AAAA,EACF;AACF;AAEA,SAAS,cAAc,SAAwC;AAC7D,QAAM,SAAS,SAAS,eAAe;AAEvC,SAAO;AAAA,IACL,SAAS,SAAS,QAAQ,WAAW,GAAG,MAAM;AAAA,IAC9C,aAAa,SAAS,QAAQ,eAAe,GAAG,MAAM;AAAA,EACxD;AACF;AAEA,eAAe,aACb,UACA,SACA,QACe;AACf,QAAM,mBAAmB,UAAU,SAAS,OAAO,OAAO;AAC1D,QAAM,uBAAuB,UAAU,SAAS,OAAO,WAAW;AACpE;AAEA,eAAe,mBACb,UACA,SACA,WACe;AACf,MAAI,YAAY,SAAS;AACvB,UAAM;AAAA,mCACyB,IAAI,MAAM,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MASjD,QAAQ,QAAQ;AAClB;AAAA,EACF;AAEA,QAAM;AAAA,iCACyB,IAAI,MAAM,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASjD,QAAQ,QAAQ;AACpB;AAEA,eAAe,uBACb,UACA,SACA,WACe;AACf,MAAI,YAAY,SAAS;AACvB,UAAM;AAAA,mCACyB,IAAI,MAAM,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQjD,QAAQ,QAAQ;AAClB;AAAA,EACF;AAEA,QAAM;AAAA,iCACyB,IAAI,MAAM,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAQjD,QAAQ,QAAQ;AACpB;AAEA,SAAS,aAAa,KAA+B;AACnD,SAAO;AAAA,IACL,IAAI,IAAI;AAAA,IACR,UAAU,IAAI;AAAA,IACd,cAAc,IAAI;AAAA,IAClB,MAAM,IAAI;AAAA,IACV,QAAQ,KAAK,MAAM,IAAI,MAAM;AAAA,IAC7B,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,IAClC,YAAY,IAAI,eAAe,IAAI,KAAK,IAAI,YAAY,IAAI;AAAA,EAC9D;AACF;AAEA,SAAS,iBAAiB,KAAgC;AACxD,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX,WAAW,IAAI;AAAA,IACf,YAAY,IAAI;AAAA,IAChB,WAAW,IAAI;AAAA,IACf,WAAW,IAAI,KAAK,IAAI,UAAU;AAAA,IAClC,WAAW,IAAI,aAAa,IAAI,KAAK,IAAI,UAAU,IAAI;AAAA,EACzD;AACF;","names":[]}

package/dist/chunk-GF3NKEEK.js

@@ -0,0 +1,18 @@
+// src/core/errors.ts
+var AuthError = class extends Error {
+  code;
+  status;
+  cause;
+  constructor(code, message, status, cause) {
+    super(message);
+    this.name = "AuthError";
+    this.code = code;
+    this.status = status;
+    this.cause = cause;
+  }
+};
+
+export {
+  AuthError
+};
+//# sourceMappingURL=chunk-GF3NKEEK.js.map

package/dist/chunk-GF3NKEEK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/core/errors.ts"],"sourcesContent":["export type AuthErrorCode =\n  | \"missing_token\"\n  | \"invalid_token\"\n  | \"invalid_issuer\"\n  | \"invalid_audience\"\n  | \"invalid_scope\"\n  | \"invalid_env\"\n  | \"jwks_fetch_failed\";\n\nexport class AuthError extends Error {\n  public readonly code: AuthErrorCode;\n  public readonly status: number;\n  public readonly cause?: unknown;\n\n  constructor(\n    code: AuthErrorCode,\n    message: string,\n    status: number,\n    cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n    this.code = code;\n    this.status = status;\n    this.cause = cause;\n  }\n}\n"],"mappings":";AASO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,SACA,QACA,OACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AAAA,EACf;AACF;","names":[]}

package/dist/client/index.cjs

@@ -0,0 +1,141 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/client/index.ts
+var client_exports = {};
+__export(client_exports, {
+  createClient: () => createClient
+});
+module.exports = __toCommonJS(client_exports);
+
+// src/core/errors.ts
+var AuthError = class extends Error {
+  code;
+  status;
+  cause;
+  constructor(code, message, status, cause) {
+    super(message);
+    this.name = "AuthError";
+    this.code = code;
+    this.status = status;
+    this.cause = cause;
+  }
+};
+
+// src/client/index.ts
+var DEFAULT_REFRESH_SKEW_SECONDS = 30;
+function createClient(options) {
+  let cachedToken = null;
+  let inflight = null;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  return {
+    async getToken() {
+      const now = Date.now();
+      if (cachedToken && cachedToken.refreshAt > now) {
+        return cachedToken.token;
+      }
+      if (inflight) {
+        return inflight;
+      }
+      inflight = fetchToken(options, fetchImpl).then((result) => {
+        cachedToken = result;
+        return result.token;
+      }).finally(() => {
+        inflight = null;
+      });
+      return inflight;
+    },
+    async getHeaders() {
+      return {
+        Authorization: `Bearer ${await this.getToken()}`
+      };
+    },
+    async fetch(input, init) {
+      const headers = new Headers(init?.headers);
+      headers.set("authorization", `Bearer ${await this.getToken()}`);
+      return fetchImpl(input, {
+        ...init,
+        headers
+      });
+    }
+  };
+}
+async function fetchToken(options, fetchImpl) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials"
+  });
+  if (options.audience) {
+    body.set("audience", options.audience);
+  }
+  const response = await fetchImpl(options.tokenUrl, {
+    method: "POST",
+    headers: {
+      authorization: createBasicAuthHeader(
+        options.clientId,
+        options.clientSecret
+      ),
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    throw new AuthError(
+      "invalid_token",
+      `Token request failed with ${response.status}`,
+      response.status
+    );
+  }
+  const payload = await response.json();
+  if (!payload.access_token) {
+    throw new AuthError(
+      "invalid_token",
+      "Token response is missing access_token",
+      500
+    );
+  }
+  const exp = getTokenExpiration(payload.access_token);
+  const refreshSkewSeconds = options.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS;
+  const refreshAt = exp ? (exp - refreshSkewSeconds) * 1e3 : Date.now() + Math.max((payload.expires_in ?? 60) - refreshSkewSeconds, 1) * 1e3;
+  return {
+    token: payload.access_token,
+    refreshAt
+  };
+}
+function createBasicAuthHeader(clientId, clientSecret) {
+  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
+}
+function getTokenExpiration(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) {
+    return null;
+  }
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createClient
+});
+//# sourceMappingURL=index.cjs.map

package/dist/client/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/client/index.ts","../../src/core/errors.ts"],"sourcesContent":["import { AuthError } from \"../core/errors\";\n\nexport interface ClientOptions {\n  tokenUrl: string;\n  clientId: string;\n  clientSecret: string;\n  audience?: string;\n  fetch?: typeof globalThis.fetch;\n  refreshSkewSeconds?: number;\n}\n\nexport interface TrustlineClient {\n  getToken(): Promise<string>;\n  getHeaders(): Promise<{ Authorization: string }>;\n  fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;\n}\n\ninterface CachedToken {\n  token: string;\n  refreshAt: number;\n}\n\nconst DEFAULT_REFRESH_SKEW_SECONDS = 30;\n\nexport function createClient(options: ClientOptions): TrustlineClient {\n  let cachedToken: CachedToken | null = null;\n  let inflight: Promise<string> | null = null;\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n\n  return {\n    async getToken() {\n      const now = Date.now();\n      if (cachedToken && cachedToken.refreshAt > now) {\n        return cachedToken.token;\n      }\n\n      if (inflight) {\n        return inflight;\n      }\n\n      inflight = fetchToken(options, fetchImpl)\n        .then((result) => {\n          cachedToken = result;\n          return result.token;\n        })\n        .finally(() => {\n          inflight = null;\n        });\n\n      return inflight;\n    },\n    async getHeaders() {\n      return {\n        Authorization: `Bearer ${await this.getToken()}`,\n      };\n    },\n    async fetch(input, init) {\n      const headers = new Headers(init?.headers);\n      headers.set(\"authorization\", `Bearer ${await this.getToken()}`);\n\n      return fetchImpl(input, {\n        ...init,\n        headers,\n      });\n    },\n  };\n}\n\nasync function fetchToken(\n  options: ClientOptions,\n  fetchImpl: typeof globalThis.fetch,\n): Promise<CachedToken> {\n  const body = new URLSearchParams({\n    grant_type: \"client_credentials\",\n  });\n\n  if (options.audience) {\n    body.set(\"audience\", options.audience);\n  }\n\n  const response = await fetchImpl(options.tokenUrl, {\n    method: \"POST\",\n    headers: {\n      authorization: createBasicAuthHeader(\n        options.clientId,\n        options.clientSecret,\n      ),\n      \"content-type\": \"application/x-www-form-urlencoded\",\n    },\n    body: body.toString(),\n  });\n\n  if (!response.ok) {\n    throw new AuthError(\n      \"invalid_token\",\n      `Token request failed with ${response.status}`,\n      response.status,\n    );\n  }\n\n  const payload = (await response.json()) as {\n    access_token?: string;\n    expires_in?: number;\n  };\n\n  if (!payload.access_token) {\n    throw new AuthError(\n      \"invalid_token\",\n      \"Token response is missing access_token\",\n      500,\n    );\n  }\n\n  const exp = getTokenExpiration(payload.access_token);\n  const refreshSkewSeconds =\n    options.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS;\n  const refreshAt = exp\n    ? (exp - refreshSkewSeconds) * 1000\n    : Date.now() +\n      Math.max((payload.expires_in ?? 60) - refreshSkewSeconds, 1) * 1000;\n\n  return {\n    token: payload.access_token,\n    refreshAt,\n  };\n}\n\nfunction createBasicAuthHeader(clientId: string, clientSecret: string): string {\n  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\")}`;\n}\n\nfunction getTokenExpiration(token: string): number | null {\n  const parts = token.split(\".\");\n  if (parts.length < 2) {\n    return null;\n  }\n\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString(\"utf8\"),\n    ) as { exp?: number };\n    return typeof payload.exp === \"number\" ? payload.exp : null;\n  } catch {\n    return null;\n  }\n}\n","export type AuthErrorCode =\n  | \"missing_token\"\n  | \"invalid_token\"\n  | \"invalid_issuer\"\n  | \"invalid_audience\"\n  | \"invalid_scope\"\n  | \"invalid_env\"\n  | \"jwks_fetch_failed\";\n\nexport class AuthError extends Error {\n  public readonly code: AuthErrorCode;\n  public readonly status: number;\n  public readonly cause?: unknown;\n\n  constructor(\n    code: AuthErrorCode,\n    message: string,\n    status: number,\n    cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n    this.code = code;\n    this.status = status;\n    this.cause = cause;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACSO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,SACA,QACA,OACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AAAA,EACf;AACF;;;ADJA,IAAM,+BAA+B;AAE9B,SAAS,aAAa,SAAyC;AACpE,MAAI,cAAkC;AACtC,MAAI,WAAmC;AACvC,QAAM,YAAY,QAAQ,SAAS,WAAW;AAE9C,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,MAAM,KAAK,IAAI;AACrB,UAAI,eAAe,YAAY,YAAY,KAAK;AAC9C,eAAO,YAAY;AAAA,MACrB;AAEA,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAEA,iBAAW,WAAW,SAAS,SAAS,EACrC,KAAK,CAAC,WAAW;AAChB,sBAAc;AACd,eAAO,OAAO;AAAA,MAChB,CAAC,EACA,QAAQ,MAAM;AACb,mBAAW;AAAA,MACb,CAAC;AAEH,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa;AACjB,aAAO;AAAA,QACL,eAAe,UAAU,MAAM,KAAK,SAAS,CAAC;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,MAAM,OAAO,MAAM;AACvB,YAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;AACzC,cAAQ,IAAI,iBAAiB,UAAU,MAAM,KAAK,SAAS,CAAC,EAAE;AAE9D,aAAO,UAAU,OAAO;AAAA,QACtB,GAAG;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,WACb,SACA,WACsB;AACtB,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,EACd,CAAC;AAED,MAAI,QAAQ,UAAU;AACpB,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,UAAU,QAAQ,UAAU;AAAA,IACjD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6BAA6B,SAAS,MAAM;AAAA,MAC5C,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAW,MAAM,SAAS,KAAK;AAKrC,MAAI,CAAC,QAAQ,cAAc;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,mBAAmB,QAAQ,YAAY;AACnD,QAAM,qBACJ,QAAQ,sBAAsB;AAChC,QAAM,YAAY,OACb,MAAM,sBAAsB,MAC7B,KAAK,IAAI,IACT,KAAK,KAAK,QAAQ,cAAc,MAAM,oBAAoB,CAAC,IAAI;AAEnE,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAAkB,cAA8B;AAC7E,SAAO,SAAS,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ,CAAC;AAC/E;AAEA,SAAS,mBAAmB,OAA8B;AACxD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS,MAAM;AAAA,IACpD;AACA,WAAO,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/client/index.d.cts

@@ -0,0 +1,18 @@
+interface ClientOptions {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+    audience?: string;
+    fetch?: typeof globalThis.fetch;
+    refreshSkewSeconds?: number;
+}
+interface TrustlineClient {
+    getToken(): Promise<string>;
+    getHeaders(): Promise<{
+        Authorization: string;
+    }>;
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+declare function createClient(options: ClientOptions): TrustlineClient;
+
+export { type ClientOptions, type TrustlineClient, createClient };

package/dist/client/index.d.ts

@@ -0,0 +1,18 @@
+interface ClientOptions {
+    tokenUrl: string;
+    clientId: string;
+    clientSecret: string;
+    audience?: string;
+    fetch?: typeof globalThis.fetch;
+    refreshSkewSeconds?: number;
+}
+interface TrustlineClient {
+    getToken(): Promise<string>;
+    getHeaders(): Promise<{
+        Authorization: string;
+    }>;
+    fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;
+}
+declare function createClient(options: ClientOptions): TrustlineClient;
+
+export { type ClientOptions, type TrustlineClient, createClient };

package/dist/client/index.js

@@ -0,0 +1,104 @@
+import {
+  AuthError
+} from "../chunk-GF3NKEEK.js";
+
+// src/client/index.ts
+var DEFAULT_REFRESH_SKEW_SECONDS = 30;
+function createClient(options) {
+  let cachedToken = null;
+  let inflight = null;
+  const fetchImpl = options.fetch ?? globalThis.fetch;
+  return {
+    async getToken() {
+      const now = Date.now();
+      if (cachedToken && cachedToken.refreshAt > now) {
+        return cachedToken.token;
+      }
+      if (inflight) {
+        return inflight;
+      }
+      inflight = fetchToken(options, fetchImpl).then((result) => {
+        cachedToken = result;
+        return result.token;
+      }).finally(() => {
+        inflight = null;
+      });
+      return inflight;
+    },
+    async getHeaders() {
+      return {
+        Authorization: `Bearer ${await this.getToken()}`
+      };
+    },
+    async fetch(input, init) {
+      const headers = new Headers(init?.headers);
+      headers.set("authorization", `Bearer ${await this.getToken()}`);
+      return fetchImpl(input, {
+        ...init,
+        headers
+      });
+    }
+  };
+}
+async function fetchToken(options, fetchImpl) {
+  const body = new URLSearchParams({
+    grant_type: "client_credentials"
+  });
+  if (options.audience) {
+    body.set("audience", options.audience);
+  }
+  const response = await fetchImpl(options.tokenUrl, {
+    method: "POST",
+    headers: {
+      authorization: createBasicAuthHeader(
+        options.clientId,
+        options.clientSecret
+      ),
+      "content-type": "application/x-www-form-urlencoded"
+    },
+    body: body.toString()
+  });
+  if (!response.ok) {
+    throw new AuthError(
+      "invalid_token",
+      `Token request failed with ${response.status}`,
+      response.status
+    );
+  }
+  const payload = await response.json();
+  if (!payload.access_token) {
+    throw new AuthError(
+      "invalid_token",
+      "Token response is missing access_token",
+      500
+    );
+  }
+  const exp = getTokenExpiration(payload.access_token);
+  const refreshSkewSeconds = options.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS;
+  const refreshAt = exp ? (exp - refreshSkewSeconds) * 1e3 : Date.now() + Math.max((payload.expires_in ?? 60) - refreshSkewSeconds, 1) * 1e3;
+  return {
+    token: payload.access_token,
+    refreshAt
+  };
+}
+function createBasicAuthHeader(clientId, clientSecret) {
+  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString("base64")}`;
+}
+function getTokenExpiration(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) {
+    return null;
+  }
+  try {
+    const payload = JSON.parse(
+      Buffer.from(parts[1], "base64url").toString("utf8")
+    );
+    return typeof payload.exp === "number" ? payload.exp : null;
+  } catch {
+    return null;
+  }
+}
+export {
+  createClient
+};
+//# sourceMappingURL=index.js.map

package/dist/client/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/client/index.ts"],"sourcesContent":["import { AuthError } from \"../core/errors\";\n\nexport interface ClientOptions {\n  tokenUrl: string;\n  clientId: string;\n  clientSecret: string;\n  audience?: string;\n  fetch?: typeof globalThis.fetch;\n  refreshSkewSeconds?: number;\n}\n\nexport interface TrustlineClient {\n  getToken(): Promise<string>;\n  getHeaders(): Promise<{ Authorization: string }>;\n  fetch(input: RequestInfo | URL, init?: RequestInit): Promise<Response>;\n}\n\ninterface CachedToken {\n  token: string;\n  refreshAt: number;\n}\n\nconst DEFAULT_REFRESH_SKEW_SECONDS = 30;\n\nexport function createClient(options: ClientOptions): TrustlineClient {\n  let cachedToken: CachedToken | null = null;\n  let inflight: Promise<string> | null = null;\n  const fetchImpl = options.fetch ?? globalThis.fetch;\n\n  return {\n    async getToken() {\n      const now = Date.now();\n      if (cachedToken && cachedToken.refreshAt > now) {\n        return cachedToken.token;\n      }\n\n      if (inflight) {\n        return inflight;\n      }\n\n      inflight = fetchToken(options, fetchImpl)\n        .then((result) => {\n          cachedToken = result;\n          return result.token;\n        })\n        .finally(() => {\n          inflight = null;\n        });\n\n      return inflight;\n    },\n    async getHeaders() {\n      return {\n        Authorization: `Bearer ${await this.getToken()}`,\n      };\n    },\n    async fetch(input, init) {\n      const headers = new Headers(init?.headers);\n      headers.set(\"authorization\", `Bearer ${await this.getToken()}`);\n\n      return fetchImpl(input, {\n        ...init,\n        headers,\n      });\n    },\n  };\n}\n\nasync function fetchToken(\n  options: ClientOptions,\n  fetchImpl: typeof globalThis.fetch,\n): Promise<CachedToken> {\n  const body = new URLSearchParams({\n    grant_type: \"client_credentials\",\n  });\n\n  if (options.audience) {\n    body.set(\"audience\", options.audience);\n  }\n\n  const response = await fetchImpl(options.tokenUrl, {\n    method: \"POST\",\n    headers: {\n      authorization: createBasicAuthHeader(\n        options.clientId,\n        options.clientSecret,\n      ),\n      \"content-type\": \"application/x-www-form-urlencoded\",\n    },\n    body: body.toString(),\n  });\n\n  if (!response.ok) {\n    throw new AuthError(\n      \"invalid_token\",\n      `Token request failed with ${response.status}`,\n      response.status,\n    );\n  }\n\n  const payload = (await response.json()) as {\n    access_token?: string;\n    expires_in?: number;\n  };\n\n  if (!payload.access_token) {\n    throw new AuthError(\n      \"invalid_token\",\n      \"Token response is missing access_token\",\n      500,\n    );\n  }\n\n  const exp = getTokenExpiration(payload.access_token);\n  const refreshSkewSeconds =\n    options.refreshSkewSeconds ?? DEFAULT_REFRESH_SKEW_SECONDS;\n  const refreshAt = exp\n    ? (exp - refreshSkewSeconds) * 1000\n    : Date.now() +\n      Math.max((payload.expires_in ?? 60) - refreshSkewSeconds, 1) * 1000;\n\n  return {\n    token: payload.access_token,\n    refreshAt,\n  };\n}\n\nfunction createBasicAuthHeader(clientId: string, clientSecret: string): string {\n  return `Basic ${Buffer.from(`${clientId}:${clientSecret}`).toString(\"base64\")}`;\n}\n\nfunction getTokenExpiration(token: string): number | null {\n  const parts = token.split(\".\");\n  if (parts.length < 2) {\n    return null;\n  }\n\n  try {\n    const payload = JSON.parse(\n      Buffer.from(parts[1], \"base64url\").toString(\"utf8\"),\n    ) as { exp?: number };\n    return typeof payload.exp === \"number\" ? payload.exp : null;\n  } catch {\n    return null;\n  }\n}\n"],"mappings":";;;;;AAsBA,IAAM,+BAA+B;AAE9B,SAAS,aAAa,SAAyC;AACpE,MAAI,cAAkC;AACtC,MAAI,WAAmC;AACvC,QAAM,YAAY,QAAQ,SAAS,WAAW;AAE9C,SAAO;AAAA,IACL,MAAM,WAAW;AACf,YAAM,MAAM,KAAK,IAAI;AACrB,UAAI,eAAe,YAAY,YAAY,KAAK;AAC9C,eAAO,YAAY;AAAA,MACrB;AAEA,UAAI,UAAU;AACZ,eAAO;AAAA,MACT;AAEA,iBAAW,WAAW,SAAS,SAAS,EACrC,KAAK,CAAC,WAAW;AAChB,sBAAc;AACd,eAAO,OAAO;AAAA,MAChB,CAAC,EACA,QAAQ,MAAM;AACb,mBAAW;AAAA,MACb,CAAC;AAEH,aAAO;AAAA,IACT;AAAA,IACA,MAAM,aAAa;AACjB,aAAO;AAAA,QACL,eAAe,UAAU,MAAM,KAAK,SAAS,CAAC;AAAA,MAChD;AAAA,IACF;AAAA,IACA,MAAM,MAAM,OAAO,MAAM;AACvB,YAAM,UAAU,IAAI,QAAQ,MAAM,OAAO;AACzC,cAAQ,IAAI,iBAAiB,UAAU,MAAM,KAAK,SAAS,CAAC,EAAE;AAE9D,aAAO,UAAU,OAAO;AAAA,QACtB,GAAG;AAAA,QACH;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,eAAe,WACb,SACA,WACsB;AACtB,QAAM,OAAO,IAAI,gBAAgB;AAAA,IAC/B,YAAY;AAAA,EACd,CAAC;AAED,MAAI,QAAQ,UAAU;AACpB,SAAK,IAAI,YAAY,QAAQ,QAAQ;AAAA,EACvC;AAEA,QAAM,WAAW,MAAM,UAAU,QAAQ,UAAU;AAAA,IACjD,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe;AAAA,QACb,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,MACA,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,KAAK,SAAS;AAAA,EACtB,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI;AAAA,MACR;AAAA,MACA,6BAA6B,SAAS,MAAM;AAAA,MAC5C,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,UAAW,MAAM,SAAS,KAAK;AAKrC,MAAI,CAAC,QAAQ,cAAc;AACzB,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,mBAAmB,QAAQ,YAAY;AACnD,QAAM,qBACJ,QAAQ,sBAAsB;AAChC,QAAM,YAAY,OACb,MAAM,sBAAsB,MAC7B,KAAK,IAAI,IACT,KAAK,KAAK,QAAQ,cAAc,MAAM,oBAAoB,CAAC,IAAI;AAEnE,SAAO;AAAA,IACL,OAAO,QAAQ;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,sBAAsB,UAAkB,cAA8B;AAC7E,SAAO,SAAS,OAAO,KAAK,GAAG,QAAQ,IAAI,YAAY,EAAE,EAAE,SAAS,QAAQ,CAAC;AAC/E;AAEA,SAAS,mBAAmB,OAA8B;AACxD,QAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,MAAI,MAAM,SAAS,GAAG;AACpB,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,UAAU,KAAK;AAAA,MACnB,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW,EAAE,SAAS,MAAM;AAAA,IACpD;AACA,WAAO,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAAA,EACzD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/frameworks/express/index.cjs

@@ -0,0 +1,121 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/frameworks/express/index.ts
+var express_exports = {};
+__export(express_exports, {
+  createExpressGuard: () => createExpressGuard,
+  createExpressProvider: () => createExpressProvider
+});
+module.exports = __toCommonJS(express_exports);
+
+// src/provider/express.ts
+function createExpressProvider(provider) {
+  return async function trustlineProvider(request, response) {
+    const origin = `${request.protocol}://${request.get("host") ?? "localhost"}`;
+    const url = new URL(request.originalUrl || request.url, origin);
+    const body = request.method === "GET" || request.method === "HEAD" ? void 0 : await readBody(request);
+    const providerResponse = await provider.handle(
+      new Request(url.toString(), {
+        method: request.method,
+        headers: request.headers,
+        body
+      })
+    );
+    response.status(providerResponse.status);
+    providerResponse.headers.forEach((value, key) => {
+      response.setHeader(key, value);
+    });
+    response.send(await providerResponse.text());
+  };
+}
+function readBody(request) {
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    request.on("data", (chunk) => {
+      chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+    });
+    request.on("end", () => {
+      resolve(
+        chunks.length > 0 ? Buffer.concat(chunks).toString("utf8") : void 0
+      );
+    });
+    request.on("error", reject);
+  });
+}
+
+// src/core/errors.ts
+var AuthError = class extends Error {
+  code;
+  status;
+  cause;
+  constructor(code, message, status, cause) {
+    super(message);
+    this.name = "AuthError";
+    this.code = code;
+    this.status = status;
+    this.cause = cause;
+  }
+};
+
+// src/middleware/express.ts
+function createExpressGuard(guard) {
+  return async function trustlineGuard(request, response, next) {
+    const token = getBearerToken(request.headers.authorization);
+    if (!token) {
+      response.status(401).json({
+        error: "missing_token",
+        message: "Missing bearer token"
+      });
+      return;
+    }
+    try {
+      const identity = await guard.verify(token);
+      request.trustline = identity;
+      next();
+    } catch (error) {
+      const authError = error instanceof AuthError ? error : new AuthError(
+        "invalid_token",
+        "Token verification failed",
+        401,
+        error
+      );
+      response.status(authError.status).json({
+        error: authError.code,
+        message: authError.message
+      });
+    }
+  };
+}
+function getBearerToken(header) {
+  if (!header) {
+    return null;
+  }
+  const [scheme, value] = header.split(/\s+/, 2);
+  if (scheme?.toLowerCase() !== "bearer" || !value) {
+    return null;
+  }
+  return value;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  createExpressGuard,
+  createExpressProvider
+});
+//# sourceMappingURL=index.cjs.map

package/dist/frameworks/express/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../src/frameworks/express/index.ts","../../../src/provider/express.ts","../../../src/core/errors.ts","../../../src/middleware/express.ts"],"sourcesContent":["export {\n  createExpressProvider,\n  type WebHandler,\n} from \"../../provider/express\";\nexport {\n  createExpressGuard,\n  type TrustlineRequest,\n} from \"../../middleware/express\";\n","import type {\n  Request as ExpressRequest,\n  Response as ExpressResponse,\n  RequestHandler,\n} from \"express\";\n\nexport interface WebHandler {\n  handle(request: Request): Promise<Response>;\n}\n\nexport function createExpressProvider(provider: WebHandler): RequestHandler {\n  return async function trustlineProvider(\n    request: ExpressRequest,\n    response: ExpressResponse,\n  ) {\n    const origin = `${request.protocol}://${request.get(\"host\") ?? \"localhost\"}`;\n    const url = new URL(request.originalUrl || request.url, origin);\n    const body =\n      request.method === \"GET\" || request.method === \"HEAD\"\n        ? undefined\n        : await readBody(request);\n\n    const providerResponse = await provider.handle(\n      new Request(url.toString(), {\n        method: request.method,\n        headers: request.headers as HeadersInit,\n        body,\n      }),\n    );\n\n    response.status(providerResponse.status);\n    providerResponse.headers.forEach((value, key) => {\n      response.setHeader(key, value);\n    });\n    response.send(await providerResponse.text());\n  };\n}\n\nfunction readBody(request: ExpressRequest): Promise<string | undefined> {\n  return new Promise((resolve, reject) => {\n    const chunks: Uint8Array[] = [];\n    request.on(\"data\", (chunk) => {\n      chunks.push(typeof chunk === \"string\" ? Buffer.from(chunk) : chunk);\n    });\n    request.on(\"end\", () => {\n      resolve(\n        chunks.length > 0 ? Buffer.concat(chunks).toString(\"utf8\") : undefined,\n      );\n    });\n    request.on(\"error\", reject);\n  });\n}\n","export type AuthErrorCode =\n  | \"missing_token\"\n  | \"invalid_token\"\n  | \"invalid_issuer\"\n  | \"invalid_audience\"\n  | \"invalid_scope\"\n  | \"invalid_env\"\n  | \"jwks_fetch_failed\";\n\nexport class AuthError extends Error {\n  public readonly code: AuthErrorCode;\n  public readonly status: number;\n  public readonly cause?: unknown;\n\n  constructor(\n    code: AuthErrorCode,\n    message: string,\n    status: number,\n    cause?: unknown,\n  ) {\n    super(message);\n    this.name = \"AuthError\";\n    this.code = code;\n    this.status = status;\n    this.cause = cause;\n  }\n}\n","import type { Request, RequestHandler, Response } from \"express\";\n\nimport { AuthError } from \"../core/errors\";\nimport type { ServiceIdentity } from \"../core/token\";\n\nexport interface GuardVerifier {\n  verify(token: string): Promise<ServiceIdentity>;\n}\n\nexport interface TrustlineRequest extends Request {\n  trustline?: ServiceIdentity;\n}\n\nexport function createExpressGuard(guard: GuardVerifier): RequestHandler {\n  return async function trustlineGuard(\n    request: Request,\n    response: Response,\n    next,\n  ) {\n    const token = getBearerToken(request.headers.authorization);\n\n    if (!token) {\n      response.status(401).json({\n        error: \"missing_token\",\n        message: \"Missing bearer token\",\n      });\n      return;\n    }\n\n    try {\n      const identity = await guard.verify(token);\n      (request as TrustlineRequest).trustline = identity;\n      next();\n    } catch (error) {\n      const authError =\n        error instanceof AuthError\n          ? error\n          : new AuthError(\n              \"invalid_token\",\n              \"Token verification failed\",\n              401,\n              error,\n            );\n      response.status(authError.status).json({\n        error: authError.code,\n        message: authError.message,\n      });\n    }\n  };\n}\n\nfunction getBearerToken(header: string | undefined): string | null {\n  if (!header) {\n    return null;\n  }\n\n  const [scheme, value] = header.split(/\\s+/, 2);\n  if (scheme?.toLowerCase() !== \"bearer\" || !value) {\n    return null;\n  }\n\n  return value;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACUO,SAAS,sBAAsB,UAAsC;AAC1E,SAAO,eAAe,kBACpB,SACA,UACA;AACA,UAAM,SAAS,GAAG,QAAQ,QAAQ,MAAM,QAAQ,IAAI,MAAM,KAAK,WAAW;AAC1E,UAAM,MAAM,IAAI,IAAI,QAAQ,eAAe,QAAQ,KAAK,MAAM;AAC9D,UAAM,OACJ,QAAQ,WAAW,SAAS,QAAQ,WAAW,SAC3C,SACA,MAAM,SAAS,OAAO;AAE5B,UAAM,mBAAmB,MAAM,SAAS;AAAA,MACtC,IAAI,QAAQ,IAAI,SAAS,GAAG;AAAA,QAC1B,QAAQ,QAAQ;AAAA,QAChB,SAAS,QAAQ;AAAA,QACjB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,aAAS,OAAO,iBAAiB,MAAM;AACvC,qBAAiB,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAC/C,eAAS,UAAU,KAAK,KAAK;AAAA,IAC/B,CAAC;AACD,aAAS,KAAK,MAAM,iBAAiB,KAAK,CAAC;AAAA,EAC7C;AACF;AAEA,SAAS,SAAS,SAAsD;AACtE,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AACtC,UAAM,SAAuB,CAAC;AAC9B,YAAQ,GAAG,QAAQ,CAAC,UAAU;AAC5B,aAAO,KAAK,OAAO,UAAU,WAAW,OAAO,KAAK,KAAK,IAAI,KAAK;AAAA,IACpE,CAAC;AACD,YAAQ,GAAG,OAAO,MAAM;AACtB;AAAA,QACE,OAAO,SAAS,IAAI,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,IAAI;AAAA,MAC/D;AAAA,IACF,CAAC;AACD,YAAQ,GAAG,SAAS,MAAM;AAAA,EAC5B,CAAC;AACH;;;AC1CO,IAAM,YAAN,cAAwB,MAAM;AAAA,EACnB;AAAA,EACA;AAAA,EACA;AAAA,EAEhB,YACE,MACA,SACA,QACA,OACA;AACA,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,QAAQ;AAAA,EACf;AACF;;;ACbO,SAAS,mBAAmB,OAAsC;AACvE,SAAO,eAAe,eACpB,SACA,UACA,MACA;AACA,UAAM,QAAQ,eAAe,QAAQ,QAAQ,aAAa;AAE1D,QAAI,CAAC,OAAO;AACV,eAAS,OAAO,GAAG,EAAE,KAAK;AAAA,QACxB,OAAO;AAAA,QACP,SAAS;AAAA,MACX,CAAC;AACD;AAAA,IACF;AAEA,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,OAAO,KAAK;AACzC,MAAC,QAA6B,YAAY;AAC1C,WAAK;AAAA,IACP,SAAS,OAAO;AACd,YAAM,YACJ,iBAAiB,YACb,QACA,IAAI;AAAA,QACF;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACN,eAAS,OAAO,UAAU,MAAM,EAAE,KAAK;AAAA,QACrC,OAAO,UAAU;AAAA,QACjB,SAAS,UAAU;AAAA,MACrB,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEA,SAAS,eAAe,QAA2C;AACjE,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,QAAM,CAAC,QAAQ,KAAK,IAAI,OAAO,MAAM,OAAO,CAAC;AAC7C,MAAI,QAAQ,YAAY,MAAM,YAAY,CAAC,OAAO;AAChD,WAAO;AAAA,EACT;AAEA,SAAO;AACT;","names":[]}

package/dist/frameworks/express/index.d.cts

@@ -0,0 +1,18 @@
+import { RequestHandler, Request as Request$1 } from 'express';
+import { S as ServiceIdentity } from '../../token-BtfYGd9K.cjs';
+import 'jose';
+
+interface WebHandler {
+    handle(request: Request): Promise<Response>;
+}
+declare function createExpressProvider(provider: WebHandler): RequestHandler;
+
+interface GuardVerifier {
+    verify(token: string): Promise<ServiceIdentity>;
+}
+interface TrustlineRequest extends Request$1 {
+    trustline?: ServiceIdentity;
+}
+declare function createExpressGuard(guard: GuardVerifier): RequestHandler;
+
+export { type TrustlineRequest, type WebHandler, createExpressGuard, createExpressProvider };