typeferry 0.6.0

package/dist/auth/server/cookie-utils.js

@@ -0,0 +1,91 @@
+/**
+ * Set an HttpOnly refresh token cookie.
+ *
+ * @param res - Response object with setHeader method
+ * @param token - Refresh token value
+ * @param options - Cookie configuration
+ */
+export function setRefreshTokenCookie(res, token, options) {
+    const maxAge = options.maxAgeDays * 24 * 60 * 60;
+    const secure = options.secure ?? process.env.NODE_ENV === 'production';
+    /**
+     * Lax prevents CSRF on cross-site POST while still sending the cookie
+     * on same-site navigations and Vite HMR reloads. Strict caused the
+     * refresh cookie to be dropped during dev hot reloads.
+     */
+    const sameSite = options.sameSite ?? 'Lax';
+    const path = options.path ?? '/';
+    // URL-encode token to handle special characters (;, =, etc.)
+    const encodedToken = encodeURIComponent(token);
+    const parts = [
+        `${options.name}=${encodedToken}`,
+        'HttpOnly',
+        `Path=${path}`,
+        `Max-Age=${maxAge}`,
+        `SameSite=${sameSite}`,
+    ];
+    if (secure) {
+        parts.push('Secure');
+    }
+    res.setHeader('Set-Cookie', parts.join('; '));
+}
+/**
+ * Clear a refresh token cookie by setting it to expire immediately.
+ *
+ * @param res - Response object with setHeader method
+ * @param options - Cookie configuration (name, secure, path)
+ */
+export function clearRefreshTokenCookie(res, options) {
+    const secure = options.secure ?? process.env.NODE_ENV === 'production';
+    const sameSite = options.sameSite ?? 'Lax';
+    const path = options.path ?? '/';
+    const parts = [
+        `${options.name}=`,
+        'HttpOnly',
+        `Path=${path}`,
+        'Max-Age=0',
+        `SameSite=${sameSite}`,
+    ];
+    if (secure) {
+        parts.push('Secure');
+    }
+    res.setHeader('Set-Cookie', parts.join('; '));
+}
+/**
+ * Extract refresh token from a request.
+ * Checks parsed cookies first, then falls back to manual cookie header parsing.
+ * Automatically URL-decodes the cookie value.
+ *
+ * @param req - Request object with optional cookies or cookie header
+ * @param cookieName - Name of the cookie to extract
+ * @returns Cookie value if found, undefined otherwise
+ */
+export function getRefreshTokenFromRequest(req, cookieName) {
+    // Check parsed cookies first (if cookie-parser middleware was used)
+    // cookie-parser auto-decodes, so no need to decode again
+    if (req.cookies?.[cookieName]) {
+        return req.cookies[cookieName];
+    }
+    // Fall back to manual parsing from cookie header
+    const cookieHeader = req.headers?.cookie;
+    if (!cookieHeader) {
+        return undefined;
+    }
+    // Escape regex special characters in cookie name to prevent injection
+    const escapedName = cookieName.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const match = cookieHeader.match(
+    // eslint-disable-next-line security/detect-non-literal-regexp -- pattern is escaped above
+    new RegExp(`(?:^|;\\s*)${escapedName}=([^;]*)`));
+    if (!match) {
+        return undefined;
+    }
+    // URL-decode the cookie value (matches our encoding in setRefreshTokenCookie)
+    try {
+        return decodeURIComponent(match[1]);
+    }
+    catch {
+        // If decode fails, return raw value (backwards compatibility)
+        return match[1];
+    }
+}
+//# sourceMappingURL=cookie-utils.js.map

package/dist/auth/server/cookie-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookie-utils.js","sourceRoot":"","sources":["../../../src/auth/server/cookie-utils.ts"],"names":[],"mappings":"AAiBA;;;;;;GAMG;AACH,MAAM,UAAU,qBAAqB,CACnC,GAAiB,EACjB,KAAa,EACb,OAAsB;IAEtB,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IAChD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;IACtE;;;;OAIG;IACH,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAA;IAEhC,6DAA6D;IAC7D,MAAM,YAAY,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAA;IAE9C,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,CAAC,IAAI,IAAI,YAAY,EAAE;QACjC,UAAU;QACV,QAAQ,IAAI,EAAE;QACd,WAAW,MAAM,EAAE;QACnB,YAAY,QAAQ,EAAE;KACvB,CAAA;IAED,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CACrC,GAAiB,EACjB,OAAqE;IAErE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAA;IACtE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,KAAK,CAAA;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,GAAG,CAAA;IAEhC,MAAM,KAAK,GAAG;QACZ,GAAG,OAAO,CAAC,IAAI,GAAG;QAClB,UAAU;QACV,QAAQ,IAAI,EAAE;QACd,WAAW;QACX,YAAY,QAAQ,EAAE;KACvB,CAAA;IAED,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;IACtB,CAAC;IAED,GAAG,CAAC,SAAS,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAA;AAC/C,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAgB,EAChB,UAAkB;IAElB,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAA;IAChC,CAAC;IAED,iDAAiD;IACjD,MAAM,YAAY,GAAG,GAAG,CAAC,OAAO,EAAE,MAAM,CAAA;IACxC,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,sEAAsE;IACtE,MAAM,WAAW,GAAG,UAAU,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IACrE,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK;IAC9B,0FAA0F;IAC1F,IAAI,MAAM,CAAC,cAAc,WAAW,UAAU,CAAC,CAChD,CAAA;IAED,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,SAAS,CAAA;IAClB,CAAC;IAED,8EAA8E;IAC9E,IAAI,CAAC;QACH,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;QAC9D,OAAO,KAAK,CAAC,CAAC,CAAC,CAAA;IACjB,CAAC;AACH,CAAC"}

package/dist/auth/server/device-info.d.ts

@@ -0,0 +1,23 @@
+import type { DeviceInfo } from '../types.js';
+/**
+ * Request-like object for extracting device information.
+ */
+interface RequestLike {
+    headers?: {
+        'user-agent'?: string;
+        'x-forwarded-for'?: string;
+    };
+    socket?: {
+        remoteAddress?: string;
+    };
+    ip?: string;
+}
+/**
+ * Parse device information from an HTTP request.
+ * Extracts IP address, user agent, browser, OS, and device type.
+ *
+ * @param req - Request object with headers and socket info
+ * @returns Parsed device information
+ */
+export declare function parseDeviceInfo(req: RequestLike): DeviceInfo;
+export {};

package/dist/auth/server/device-info.js

@@ -0,0 +1,52 @@
+import { UAParser } from 'ua-parser-js';
+/**
+ * Parse device information from an HTTP request.
+ * Extracts IP address, user agent, browser, OS, and device type.
+ *
+ * @param req - Request object with headers and socket info
+ * @returns Parsed device information
+ */
+export function parseDeviceInfo(req) {
+    if (!req) {
+        return {};
+    }
+    const uaString = req.headers?.['user-agent'];
+    const ip = getIpFromRequest(req);
+    if (!uaString) {
+        return { ip };
+    }
+    const parser = new UAParser(uaString);
+    const result = parser.getResult();
+    return {
+        ip,
+        userAgent: uaString,
+        browser: result.browser.name
+            ? `${result.browser.name} ${result.browser.version || ''}`.trim()
+            : undefined,
+        os: result.os.name
+            ? `${result.os.name} ${result.os.version || ''}`.trim()
+            : undefined,
+        deviceType: mapDeviceType(result.device.type),
+    };
+}
+/**
+ * Extract client IP address from request.
+ * Checks x-forwarded-for header first (for proxied requests),
+ * then falls back to the socket address or adapter-provided IP.
+ */
+function getIpFromRequest(req) {
+    return req.headers?.['x-forwarded-for'] || req.socket?.remoteAddress || req.ip;
+}
+/**
+ * Map UA parser device type to our DeviceInfo type.
+ */
+function mapDeviceType(type) {
+    if (!type)
+        return 'desktop';
+    if (type === 'mobile')
+        return 'mobile';
+    if (type === 'tablet')
+        return 'tablet';
+    return 'unknown';
+}
+//# sourceMappingURL=device-info.js.map

package/dist/auth/server/device-info.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"device-info.js","sourceRoot":"","sources":["../../../src/auth/server/device-info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAA;AAgBvC;;;;;;GAMG;AACH,MAAM,UAAU,eAAe,CAAC,GAAgB;IAC9C,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,CAAA;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,YAAY,CAAC,CAAA;IAC5C,MAAM,EAAE,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAA;IAEhC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,EAAE,EAAE,EAAE,CAAA;IACf,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,QAAQ,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,EAAE,CAAA;IAEjC,OAAO;QACL,EAAE;QACF,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI;YAC1B,CAAC,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YACjE,CAAC,CAAC,SAAS;QACb,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,IAAI;YAChB,CAAC,CAAC,GAAG,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,MAAM,CAAC,EAAE,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE;YACvD,CAAC,CAAC,SAAS;QACb,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC;KAC9C,CAAA;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,gBAAgB,CAAC,GAAgB;IACxC,OAAO,GAAG,CAAC,OAAO,EAAE,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,MAAM,EAAE,aAAa,IAAI,GAAG,CAAC,EAAE,CAAA;AAChF,CAAC;AAED;;GAEG;AACH,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,CAAC,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3B,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACtC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAA;IACtC,OAAO,SAAS,CAAA;AAClB,CAAC"}

package/dist/auth/server/index.d.ts

@@ -0,0 +1,4 @@
+export { clearRefreshTokenCookie, getRefreshTokenFromRequest, setRefreshTokenCookie, } from './cookie-utils.js';
+export { parseDeviceInfo } from './device-info.js';
+export { decodeToken, signAccessToken, verifyAccessToken } from './jwt-utils.js';
+export { InMemorySessionManager } from './session-manager.js';

package/dist/auth/server/index.js

@@ -0,0 +1,5 @@
+export { clearRefreshTokenCookie, getRefreshTokenFromRequest, setRefreshTokenCookie, } from './cookie-utils.js';
+export { parseDeviceInfo } from './device-info.js';
+export { decodeToken, signAccessToken, verifyAccessToken } from './jwt-utils.js';
+export { InMemorySessionManager } from './session-manager.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/server/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/auth/server/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,uBAAuB,EACvB,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,gBAAgB,CAAA;AACvB,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAA;AAC/C,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC7E,OAAO,EAAE,sBAAsB,EAAE,MAAM,mBAAmB,CAAA"}

package/dist/auth/server/jwt-utils.d.ts

@@ -0,0 +1,29 @@
+import type { AccessTokenPayload, AuthConfig } from '../types.js';
+/**
+ * Sign an access token with the configured algorithm.
+ * Always uses explicit algorithm specification to prevent algorithm confusion attacks.
+ *
+ * @param payload - Token payload to sign
+ * @param config - Auth configuration with secret and algorithm
+ * @returns Signed JWT string
+ */
+export declare function signAccessToken(payload: AccessTokenPayload, config: AuthConfig): string;
+/**
+ * Verify and decode an access token.
+ * Uses explicit algorithm whitelist to prevent algorithm confusion attacks.
+ *
+ * @param token - JWT to verify (may include 'Bearer ' prefix)
+ * @param config - Auth configuration with secret and algorithm
+ * @returns Decoded payload if valid, null otherwise
+ */
+export declare function verifyAccessToken(token: string, config: AuthConfig): AccessTokenPayload | null;
+/**
+ * Decode a token without verification.
+ * Useful for reading claims from expired tokens or tokens signed by other parties.
+ *
+ * WARNING: Do not trust the contents without verification.
+ *
+ * @param token - JWT to decode
+ * @returns Decoded payload if parseable, null otherwise
+ */
+export declare function decodeToken(token: string): AccessTokenPayload | null;

package/dist/auth/server/jwt-utils.js

@@ -0,0 +1,53 @@
+import jwt from 'jsonwebtoken';
+/**
+ * Sign an access token with the configured algorithm.
+ * Always uses explicit algorithm specification to prevent algorithm confusion attacks.
+ *
+ * @param payload - Token payload to sign
+ * @param config - Auth configuration with secret and algorithm
+ * @returns Signed JWT string
+ */
+export function signAccessToken(payload, config) {
+    const algorithm = config.algorithm ?? 'HS256';
+    return jwt.sign(payload, config.secret, { algorithm });
+}
+/**
+ * Verify and decode an access token.
+ * Uses explicit algorithm whitelist to prevent algorithm confusion attacks.
+ *
+ * @param token - JWT to verify (may include 'Bearer ' prefix)
+ * @param config - Auth configuration with secret and algorithm
+ * @returns Decoded payload if valid, null otherwise
+ */
+export function verifyAccessToken(token, config) {
+    try {
+        const algorithm = config.algorithm ?? 'HS256';
+        const cleanToken = token.replace(/^Bearer\s+/i, '');
+        return jwt.verify(cleanToken, config.secret, {
+            algorithms: [algorithm],
+            maxAge: `${config.accessTokenExpiryMinutes ?? 15}m`,
+        });
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode a token without verification.
+ * Useful for reading claims from expired tokens or tokens signed by other parties.
+ *
+ * WARNING: Do not trust the contents without verification.
+ *
+ * @param token - JWT to decode
+ * @returns Decoded payload if parseable, null otherwise
+ */
+export function decodeToken(token) {
+    try {
+        const cleanToken = token.replace(/^Bearer\s+/i, '');
+        return jwt.decode(cleanToken);
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=jwt-utils.js.map

package/dist/auth/server/jwt-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"jwt-utils.js","sourceRoot":"","sources":["../../../src/auth/server/jwt-utils.ts"],"names":[],"mappings":"AAAA,OAAO,GAAG,MAAM,cAAc,CAAA;AAI9B;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,OAA2B,EAC3B,MAAkB;IAElB,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAA;IAC7C,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,CAAC,CAAA;AACxD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,KAAa,EACb,MAAkB;IAElB,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,MAAM,CAAC,SAAS,IAAI,OAAO,CAAA;QAC7C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QAEnD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE;YAC3C,UAAU,EAAE,CAAC,SAAS,CAAC;YACvB,MAAM,EAAE,GAAG,MAAM,CAAC,wBAAwB,IAAI,EAAE,GAAG;SACpD,CAAuB,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACvC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAA;QACnD,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,CAAuB,CAAA;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;AACH,CAAC"}

package/dist/auth/server/oauth/google.d.ts

@@ -0,0 +1,31 @@
+import type { OAuthProvider, OAuthUserProfile } from './types.js';
+export interface GoogleOAuthConfig {
+    clientId: string;
+    clientSecret: string;
+    /**
+     * Redirect URI for the OAuth flow.
+     * Defaults to `'postmessage'` for popup-based flows.
+     */
+    redirectUri?: string;
+}
+/**
+ * Google OAuth provider that exchanges authorization codes for
+ * verified user profiles via the Google Identity Platform.
+ *
+ * @example
+ * ```ts
+ * const google = new GoogleOAuthProvider({
+ *   clientId: process.env.GOOGLE_CLIENT_ID,
+ *   clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+ * })
+ *
+ * const profile = await google.exchangeCode(code)
+ * // → { providerId, provider: 'google', email, name, picture, ... }
+ * ```
+ */
+export declare class GoogleOAuthProvider implements OAuthProvider {
+    readonly name: "google";
+    private readonly client;
+    constructor(config: GoogleOAuthConfig);
+    exchangeCode(code: string): Promise<OAuthUserProfile>;
+}

package/dist/auth/server/oauth/google.js

@@ -0,0 +1,40 @@
+import { OAuth2Client } from 'google-auth-library';
+/**
+ * Google OAuth provider that exchanges authorization codes for
+ * verified user profiles via the Google Identity Platform.
+ *
+ * @example
+ * ```ts
+ * const google = new GoogleOAuthProvider({
+ *   clientId: process.env.GOOGLE_CLIENT_ID,
+ *   clientSecret: process.env.GOOGLE_CLIENT_SECRET,
+ * })
+ *
+ * const profile = await google.exchangeCode(code)
+ * // → { providerId, provider: 'google', email, name, picture, ... }
+ * ```
+ */
+export class GoogleOAuthProvider {
+    name = 'google';
+    client;
+    constructor(config) {
+        this.client = new OAuth2Client(config.clientId, config.clientSecret, config.redirectUri ?? 'postmessage');
+    }
+    async exchangeCode(code) {
+        const { tokens } = await this.client.getToken(code);
+        const ticket = await this.client.verifyIdToken({
+            idToken: tokens.id_token,
+        });
+        const payload = ticket.getPayload();
+        return {
+            providerId: payload.sub,
+            provider: this.name,
+            email: payload.email,
+            emailVerified: payload.email_verified,
+            name: payload.name,
+            picture: payload.picture,
+            raw: payload,
+        };
+    }
+}
+//# sourceMappingURL=google.js.map

package/dist/auth/server/oauth/google.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../../../src/auth/server/oauth/google.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAA;AAclD;;;;;;;;;;;;;;GAcG;AACH,MAAM,OAAO,mBAAmB;IACrB,IAAI,GAAG,QAAiB,CAAA;IAChB,MAAM,CAAc;IAErC,YAAY,MAAyB;QACnC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAC5B,MAAM,CAAC,QAAQ,EACf,MAAM,CAAC,YAAY,EACnB,MAAM,CAAC,WAAW,IAAI,aAAa,CACpC,CAAA;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,IAAY;QAC7B,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAA;QAEnD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC;YAC7C,OAAO,EAAE,MAAM,CAAC,QAAS;SAC1B,CAAC,CAAA;QAEF,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAG,CAAA;QAEpC,OAAO;YACL,UAAU,EAAE,OAAO,CAAC,GAAG;YACvB,QAAQ,EAAE,IAAI,CAAC,IAAI;YACnB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,aAAa,EAAE,OAAO,CAAC,cAAc;YACrC,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,EAAE,OAA6C;SACnD,CAAA;IACH,CAAC;CACF"}

package/dist/auth/server/oauth/index.d.ts

@@ -0,0 +1,3 @@
+export type { GoogleOAuthConfig } from './google.js';
+export { GoogleOAuthProvider } from './google.js';
+export type { OAuthProvider, OAuthUserProfile } from './types.js';

package/dist/auth/server/oauth/index.js

@@ -0,0 +1,2 @@
+export { GoogleOAuthProvider } from './google.js';
+//# sourceMappingURL=index.js.map

package/dist/auth/server/oauth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/auth/server/oauth/index.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAA"}

package/dist/auth/server/oauth/types.d.ts

@@ -0,0 +1,37 @@
+/**
+ * Normalized user profile returned by any OAuth provider.
+ *
+ * Each provider populates the subset of fields it supports.
+ * The `raw` field carries the full provider-specific payload
+ * for app-level access when the normalized fields aren't enough.
+ */
+export interface OAuthUserProfile {
+    /** Provider-specific unique user identifier (e.g. Google `sub`). */
+    providerId: string;
+    /** Provider name for discrimination (e.g. `'google'`, `'github'`). */
+    provider: string;
+    email?: string;
+    emailVerified?: boolean;
+    name?: string;
+    picture?: string;
+    /** Raw identity payload from the provider. */
+    raw?: Record<string, unknown>;
+}
+/**
+ * Server-side OAuth provider contract.
+ *
+ * Implementations handle the provider-specific authorization-code
+ * exchange and ID-token verification, returning a normalized profile.
+ */
+export interface OAuthProvider {
+    /** Provider identifier (e.g. `'google'`). */
+    readonly name: string;
+    /**
+     * Exchange an authorization code for a verified user profile.
+     *
+     * @param code - Authorization code from the OAuth redirect/popup
+     * @returns Normalized user profile
+     * @throws On invalid code, network errors, or verification failure
+     */
+    exchangeCode(code: string): Promise<OAuthUserProfile>;
+}

package/dist/auth/server/oauth/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/auth/server/oauth/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/auth/server/oauth/types.ts"],"names":[],"mappings":""}

package/dist/auth/server/session-manager.d.ts

@@ -0,0 +1,46 @@
+import type { AuthConfig, DeviceInfo, Session, SessionManager, TokenPair } from '../types.js';
+/**
+ * In-memory session manager implementation.
+ * Useful for testing, development, or single-instance deployments.
+ *
+ * For production multi-instance deployments, implement SessionManager
+ * with a shared storage backend (MongoDB, Redis, etc.)
+ */
+export declare class InMemorySessionManager implements SessionManager {
+    private sessions;
+    private config;
+    private cleanupInterval;
+    constructor(config: AuthConfig);
+    createSession(userId: string, deviceInfo?: DeviceInfo): Promise<TokenPair>;
+    refreshSession(refreshToken: string, deviceInfo?: DeviceInfo): Promise<TokenPair | null>;
+    revokeSession(sessionId: string): Promise<boolean>;
+    revokeFamily(familyId: string): Promise<number>;
+    getUserSessions(userId: string): Promise<Session[]>;
+    revokeAllUserSessions(userId: string, exceptFamilyId?: string): Promise<number>;
+    /**
+     * Handle a token that has already been rotated.
+     * Implements grace period for concurrent requests,
+     * but revokes entire family if reuse is detected outside grace period.
+     */
+    private handleReusedToken;
+    /**
+     * Rotate a session by creating a new token and marking the old one as replaced.
+     */
+    private rotateSession;
+    /**
+     * Build a token pair with a signed access token.
+     */
+    private buildTokenPair;
+    /**
+     * Clean up expired and revoked sessions.
+     */
+    private cleanup;
+    /**
+     * Stop the cleanup interval and clear sessions.
+     */
+    destroy(): void;
+    /**
+     * Get the current session count (for monitoring).
+     */
+    get size(): number;
+}

package/dist/auth/server/session-manager.js

@@ -0,0 +1,167 @@
+import { v4 as uuid } from '@lukeed/uuid';
+import { signAccessToken } from './jwt-utils.js';
+/**
+ * In-memory session manager implementation.
+ * Useful for testing, development, or single-instance deployments.
+ *
+ * For production multi-instance deployments, implement SessionManager
+ * with a shared storage backend (MongoDB, Redis, etc.)
+ */
+export class InMemorySessionManager {
+    sessions = new Map();
+    config;
+    cleanupInterval;
+    constructor(config) {
+        this.config = config;
+        // Clean up expired and revoked sessions every minute
+        this.cleanupInterval = setInterval(() => this.cleanup(), 60_000);
+    }
+    async createSession(userId, deviceInfo) {
+        const familyId = uuid();
+        const token = uuid();
+        const sessionId = uuid();
+        const expiryDays = this.config.refreshTokenExpiryDays ?? 14;
+        const expiration = Math.floor(Date.now() / 1000) + expiryDays * 24 * 60 * 60;
+        const session = {
+            id: sessionId,
+            userId,
+            familyId,
+            token,
+            expiration,
+            deviceInfo,
+        };
+        this.sessions.set(token, session);
+        return this.buildTokenPair(token, userId, sessionId);
+    }
+    async refreshSession(refreshToken, deviceInfo) {
+        const session = this.sessions.get(refreshToken);
+        if (!session || session.isRevoked) {
+            return null;
+        }
+        if (Date.now() / 1000 > session.expiration) {
+            return null;
+        }
+        // Token has already been used - check for theft
+        if (session.replacedBy) {
+            return this.handleReusedToken(session);
+        }
+        return this.rotateSession(session, deviceInfo);
+    }
+    async revokeSession(sessionId) {
+        for (const session of this.sessions.values()) {
+            if (session.id === sessionId) {
+                session.isRevoked = true;
+                return true;
+            }
+        }
+        return false;
+    }
+    async revokeFamily(familyId) {
+        let count = 0;
+        for (const session of this.sessions.values()) {
+            if (session.familyId === familyId && !session.isRevoked) {
+                session.isRevoked = true;
+                count++;
+            }
+        }
+        return count;
+    }
+    async getUserSessions(userId) {
+        const now = Date.now() / 1000;
+        return Array.from(this.sessions.values()).filter(s => s.userId === userId &&
+            !s.isRevoked &&
+            !s.replacedBy &&
+            s.expiration > now);
+    }
+    async revokeAllUserSessions(userId, exceptFamilyId) {
+        let count = 0;
+        for (const session of this.sessions.values()) {
+            if (session.userId === userId &&
+                !session.isRevoked &&
+                (!exceptFamilyId || session.familyId !== exceptFamilyId)) {
+                session.isRevoked = true;
+                count++;
+            }
+        }
+        return count;
+    }
+    /**
+     * Handle a token that has already been rotated.
+     * Implements grace period for concurrent requests,
+     * but revokes entire family if reuse is detected outside grace period.
+     */
+    handleReusedToken(session) {
+        const graceSeconds = this.config.rotationGracePeriodSeconds ?? 15;
+        const now = Date.now();
+        // Check if reuse is within grace period from when token was rotated
+        if (!session.usedAt || now - session.usedAt > graceSeconds * 1000) {
+            // Token reuse outside grace period indicates theft - revoke entire family
+            this.revokeFamily(session.familyId);
+            return null;
+        }
+        // Within grace period - return the new token pair
+        const nextSession = this.sessions.get(session.replacedBy);
+        if (!nextSession || nextSession.isRevoked) {
+            return null;
+        }
+        return this.buildTokenPair(nextSession.token, nextSession.userId, nextSession.id);
+    }
+    /**
+     * Rotate a session by creating a new token and marking the old one as replaced.
+     */
+    async rotateSession(session, deviceInfo) {
+        const newToken = uuid();
+        const newSessionId = uuid();
+        const expiryDays = this.config.refreshTokenExpiryDays ?? 14;
+        const expiration = Math.floor(Date.now() / 1000) + expiryDays * 24 * 60 * 60;
+        const newSession = {
+            id: newSessionId,
+            userId: session.userId,
+            familyId: session.familyId,
+            token: newToken,
+            expiration,
+            deviceInfo,
+        };
+        // Mark old token as replaced and record when
+        session.replacedBy = newToken;
+        session.usedAt = Date.now();
+        this.sessions.set(newToken, newSession);
+        return this.buildTokenPair(newToken, session.userId, newSessionId);
+    }
+    /**
+     * Build a token pair with a signed access token.
+     */
+    buildTokenPair(refreshToken, userId, sessionId) {
+        const expiryMinutes = this.config.accessTokenExpiryMinutes ?? 15;
+        const iat = Math.floor(Date.now() / 1000);
+        const exp = iat + expiryMinutes * 60;
+        const payload = { userId, sessionId, iat, exp };
+        const accessToken = signAccessToken(payload, this.config);
+        return { accessToken, refreshToken, exp };
+    }
+    /**
+     * Clean up expired and revoked sessions.
+     */
+    cleanup() {
+        const now = Date.now() / 1000;
+        for (const [key, session] of this.sessions) {
+            if (session.isRevoked || session.expiration <= now) {
+                this.sessions.delete(key);
+            }
+        }
+    }
+    /**
+     * Stop the cleanup interval and clear sessions.
+     */
+    destroy() {
+        clearInterval(this.cleanupInterval);
+        this.sessions.clear();
+    }
+    /**
+     * Get the current session count (for monitoring).
+     */
+    get size() {
+        return this.sessions.size;
+    }
+}
+//# sourceMappingURL=session-manager.js.map

package/dist/auth/server/session-manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-manager.js","sourceRoot":"","sources":["../../../src/auth/server/session-manager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,IAAI,IAAI,EAAE,MAAM,cAAc,CAAA;AAUzC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAA;AAE7C;;;;;;GAMG;AACH,MAAM,OAAO,sBAAsB;IACzB,QAAQ,GAAG,IAAI,GAAG,EAAmB,CAAA;IACrC,MAAM,CAAY;IAClB,eAAe,CAAgB;IAEvC,YAAY,MAAkB;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAA;QACpB,qDAAqD;QACrD,IAAI,CAAC,eAAe,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,CAAA;IAClE,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,UAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAA;QACvB,MAAM,KAAK,GAAG,IAAI,EAAE,CAAA;QACpB,MAAM,SAAS,GAAG,IAAI,EAAE,CAAA;QAExB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAA;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QAE5E,MAAM,OAAO,GAAY;YACvB,EAAE,EAAE,SAAS;YACb,MAAM;YACN,QAAQ;YACR,KAAK;YACL,UAAU;YACV,UAAU;SACX,CAAA;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,OAAO,CAAC,CAAA;QAEjC,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,CAAC,CAAA;IACtD,CAAC;IAED,KAAK,CAAC,cAAc,CAClB,YAAoB,EACpB,UAAuB;QAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;QAE/C,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;YAClC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,gDAAgD;QAChD,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAA;QACxC,CAAC;QAED,OAAO,IAAI,CAAC,aAAa,CAAC,OAAO,EAAE,UAAU,CAAC,CAAA;IAChD,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,EAAE,KAAK,SAAS,EAAE,CAAC;gBAC7B,OAAO,CAAC,SAAS,GAAG,IAAI,CAAA;gBACxB,OAAO,IAAI,CAAA;YACb,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAgB;QACjC,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;gBACxD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAA;gBACxB,KAAK,EAAE,CAAA;YACT,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,MAAc;QAClC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QAE7B,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,MAAM,CAC9C,CAAC,CAAC,EAAE,CACF,CAAC,CAAC,MAAM,KAAK,MAAM;YACnB,CAAC,CAAC,CAAC,SAAS;YACZ,CAAC,CAAC,CAAC,UAAU;YACb,CAAC,CAAC,UAAU,GAAG,GAAG,CACrB,CAAA;IACH,CAAC;IAED,KAAK,CAAC,qBAAqB,CACzB,MAAc,EACd,cAAuB;QAEvB,IAAI,KAAK,GAAG,CAAC,CAAA;QAEb,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YAC7C,IACE,OAAO,CAAC,MAAM,KAAK,MAAM;gBACzB,CAAC,OAAO,CAAC,SAAS;gBAClB,CAAC,CAAC,cAAc,IAAI,OAAO,CAAC,QAAQ,KAAK,cAAc,CAAC,EACxD,CAAC;gBACD,OAAO,CAAC,SAAS,GAAG,IAAI,CAAA;gBACxB,KAAK,EAAE,CAAA;YACT,CAAC;QACH,CAAC;QAED,OAAO,KAAK,CAAA;IACd,CAAC;IAED;;;;OAIG;IACK,iBAAiB,CAAC,OAAgB;QACxC,MAAM,YAAY,GAAG,IAAI,CAAC,MAAM,CAAC,0BAA0B,IAAI,EAAE,CAAA;QACjE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAEtB,oEAAoE;QACpE,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,GAAG,YAAY,GAAG,IAAI,EAAE,CAAC;YAClE,0EAA0E;YAC1E,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;YACnC,OAAO,IAAI,CAAA;QACb,CAAC;QAED,kDAAkD;QAClD,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,UAAW,CAAC,CAAA;QAC1D,IAAI,CAAC,WAAW,IAAI,WAAW,CAAC,SAAS,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAA;QACb,CAAC;QAED,OAAO,IAAI,CAAC,cAAc,CACxB,WAAW,CAAC,KAAK,EACjB,WAAW,CAAC,MAAM,EAClB,WAAW,CAAC,EAAE,CACf,CAAA;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,aAAa,CACzB,OAAgB,EAChB,UAAuB;QAEvB,MAAM,QAAQ,GAAG,IAAI,EAAE,CAAA;QACvB,MAAM,YAAY,GAAG,IAAI,EAAE,CAAA;QAE3B,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,sBAAsB,IAAI,EAAE,CAAA;QAC3D,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,UAAU,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QAE5E,MAAM,UAAU,GAAY;YAC1B,EAAE,EAAE,YAAY;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,KAAK,EAAE,QAAQ;YACf,UAAU;YACV,UAAU;SACX,CAAA;QAED,6CAA6C;QAC7C,OAAO,CAAC,UAAU,GAAG,QAAQ,CAAA;QAC7B,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;QAC3B,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAA;QAEvC,OAAO,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,CAAA;IACpE,CAAC;IAED;;OAEG;IACK,cAAc,CACpB,YAAoB,EACpB,MAAc,EACd,SAAiB;QAEjB,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAA;QACzC,MAAM,GAAG,GAAG,GAAG,GAAG,aAAa,GAAG,EAAE,CAAA;QAEpC,MAAM,OAAO,GAAuB,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;QACnE,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAA;QAEzD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,GAAG,EAAE,CAAA;IAC3C,CAAC;IAED;;OAEG;IACK,OAAO;QACb,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAA;QAE7B,KAAK,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC3C,IAAI,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,UAAU,IAAI,GAAG,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;YAC3B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,OAAO;QACL,aAAa,CAAC,IAAI,CAAC,eAAe,CAAC,CAAA;QACnC,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAA;IACvB,CAAC;IAED;;OAEG;IACH,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAA;IAC3B,CAAC;CACF"}