@agenticprimitives/connect-auth 0.1.0-alpha.3 → 1.0.0-alpha.11

package/README.md

@@ -1,15 +1,12 @@
 # @agenticprimitives/connect-auth
 
-**Credential connection** for Smart Agents — passkey, SIWE, and OAuth ceremonies,
-JWT sessions, and pluggable `Signer` interfaces.
+**Credential ceremonies that resolve to a canonical identity — not the other way around.**
 
-This package resolves **how a user proves control** (passkey, EOA, OAuth). The
-**canonical identity** is the Smart Agent address (`agent-account`). Session JWTs
-use the SA as primary subject; credentials appear as signer claims only
-([ADR-0010](../../docs/architecture/decisions/0010-smart-agent-canonical-identifier.md)).
+Most auth SDKs make the credential the identity: lose the passkey, lose the account. `connect-auth` inverts that. Passkey, SIWE, and OAuth are **ceremonies that prove control**; the identity they resolve to is the Smart Agent address ([ADR-0010](../../docs/architecture/decisions/0010-smart-agent-canonical-identifier.md)). Session JWTs carry the SA address as primary subject — the credential is a signer claim only. So when a credential rotates ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)), the user signs back in as the same agent, with the same delegations, the same name, the same reputation. Identity persists; credentials rotate.
 
-Identity persists. Credentials rotate ([ADR-0011](../../docs/architecture/decisions/0011-credential-recovery-and-re-association.md)).
-Custodian add/remove belongs to `custody`, not here.
+This package also defines the `Signer` interfaces (`Signer`, `PasskeySigner`, `EOASigner`, `KMSSigner`) that `agent-account` and `delegation` consume — the architectural contract that lets the whole stack swap signing backends without touching account or delegation code. Custodian add/remove belongs to `custody`, not here: this package never mutates a credential set, only resolves credential → SA.
+
+> Part of [agenticprimitives](../../README.md) — the trust substrate for the agent economy: one canonical Smart Agent identity with custody, delegation, naming, credentials, and audit evidence designed as one system.
 
 ## Use This When
 
@@ -69,6 +66,14 @@ See [`docs/concepts.md`](docs/concepts.md).
 - `@agenticprimitives/connect-auth/siwe`
 - `@agenticprimitives/connect-auth/google`
 
+## How it's different from Privy, Dynamic, and Web3Auth
+
+Hosted auth vendors give you login plus an embedded key, and the identity lives in their database — your users exist because the vendor's account table says so. Here the identity is an on-chain address that no auth provider can revoke, and this package is one composable layer over it:
+
+- **Framework-agnostic and stateless.** No hosted dashboard, no database, no cookie I/O — your app wires HTTP routes and storage; this package handles the cryptographic ceremonies and JWT mint/verify.
+- **No key custody.** It defines the `KMSSigner` interface; concrete signing backends live in `key-custody`. The auth layer never holds material it could lose.
+- **Login is not authority.** A session JWT proves who signed in. What the agent may *do* is the delegation layer's job — scoped, revocable, on-chain-enforceable — not a side effect of holding a session.
+
 ## Security Invariants
 
 - JWT secrets never logged; CSRF origin exact-match.
@@ -88,6 +93,10 @@ See [`docs/security.md`](docs/security.md) and [`AUDIT.md`](AUDIT.md).
 - [`CLAUDE.md`](CLAUDE.md) — agent routing.
 - [`spec.md`](spec.md) — spec pointer.
 
+## Status
+
+Testnet/pilot-ready. Production launch is gated on the public checklist in the root README — including third-party contract audit and governance key rotation. Track every security finding live in [`docs/audits/findings.yaml`](../../docs/audits/findings.yaml).
+
 ## Validation
 
 ```bash

package/dist/csrf.d.ts

@@ -1,13 +1,77 @@
 /**
- * Produce a CSRF token bound to the given origin and the current timestamp.
+ * R5.11 — Optional bindings stamped into the CSRF token.
+ *
+ *   `method`     HTTP method (POST, PUT, ...) the token is bound to.
+ *   `path`       Request path the token is bound to. Use the URL pathname
+ *                (not the full URL); query string is excluded.
+ *   `sessionSid` Session id (typically `JwtClaims.sid` from the session
+ *                cookie) so a CSRF token is unusable with a different
+ *                session — defends against an attacker stealing the
+ *                CSRF token alone.
+ *
+ * Empty/undefined bindings on both sides match (legacy callers see no
+ * behavior change at the wire format level). When mint supplies a
+ * binding, verify MUST supply the same value or the token is rejected.
  */
-export declare function csrfTokenFor(origin: string): string;
+export interface CsrfBindings {
+    method?: string;
+    path?: string;
+    sessionSid?: string;
+}
+export interface CsrfMintOpts extends CsrfBindings {
+    origin: string;
+}
+export interface CsrfVerifyOpts extends CsrfBindings {
+    /**
+     * The ACTUAL request origin (from the inbound `Origin` header or the
+     * verified `Referer`). The verifier rejects unless
+     * `stamp.origin === actualOrigin AND actualOrigin ∈ allowedOrigins`.
+     * Pass an empty string only when the caller has explicitly chosen
+     * not to bind to the request origin (e.g. a server-to-server
+     * verifier in a test); in production that path THROWS unless
+     * `developmentMode: true` is set.
+     */
+    actualOrigin: string;
+    /** Exact-match allowlist of acceptable origins (defense in depth). */
+    allowedOrigins: string[];
+    /** Opt-out for tests / dev paths that intentionally lack an origin. */
+    developmentMode?: boolean;
+}
 /**
- * Verify a CSRF token.
- *   - origin (parsed exactly from the token) MUST be in allowedOrigins (exact-match).
- *   - HMAC must match.
- *   - Timestamp must be within the last CSRF_VALIDITY_SECONDS window.
- * Returns true iff all three hold.
+ * Mint a CSRF token bound to the supplied origin (and optionally to a
+ * method / path / session id). The HMAC covers all stamped fields, so
+ * any field tampering invalidates the token.
+ *
+ * R5.11 breaking change: the function signature now takes an opts
+ * object instead of a single `origin` positional arg. Pass
+ * `{ origin }` for the legacy origin-only behavior.
  */
-export declare function verifyCsrf(token: string, allowedOrigins: string[]): boolean;
+export declare function csrfTokenFor(opts: CsrfMintOpts): string;
+/**
+ * Verify a CSRF token. R5.11 breaking change: signature is now
+ * `verifyCsrf(token, opts: CsrfVerifyOpts)`.
+ *
+ *   1. HMAC must verify under `CSRF_SECRET`.
+ *   2. `stamp.ts` must be within the last `CSRF_VALIDITY_SECONDS` window
+ *      (with a small skew for future-ts).
+ *   3. `stamp.origin === opts.actualOrigin` (R5.11 / P1-2).
+ *   4. `opts.actualOrigin ∈ opts.allowedOrigins` (defense in depth).
+ *   5. When the mint side stamped a binding, the verify side MUST
+ *      supply the same value:
+ *        - `stamp.method === opts.method`
+ *        - `stamp.path === opts.path`
+ *        - `stamp.sessionSid === opts.sessionSid`
+ *      Empty / undefined matches empty / undefined. A token minted
+ *      WITHOUT bindings cannot be verified WITH bindings (and vice
+ *      versa) — the comparison is exact.
+ *
+ * Returns true iff all checks pass.
+ *
+ * **Production guard:** when `NODE_ENV=production` AND
+ * `developmentMode !== true`, the function THROWS if `actualOrigin`
+ * is an empty string. A silently-permissive `''` would re-open the
+ * audit finding; failing fast keeps production deploys honest. Tests
+ * / dev opt out via `developmentMode: true`.
+ */
+export declare function verifyCsrf(token: string, opts: CsrfVerifyOpts): boolean;
 //# sourceMappingURL=csrf.d.ts.map

package/dist/csrf.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AA0CA;;GAEG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,GAAG,OAAO,CAyB3E"}
+{"version":3,"file":"csrf.d.ts","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AA2EA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAa,SAAQ,YAAY;IAChD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,cAAe,SAAQ,YAAY;IAClD;;;;;;;;OAQG;IACH,YAAY,EAAE,MAAM,CAAC;IACrB,sEAAsE;IACtE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,uEAAuE;IACvE,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAUD;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAavD;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAkDvE"}

package/dist/csrf.js

@@ -1,9 +1,33 @@
-// CSRF tokens: HMAC-stamped origin + timestamp.
-// Token format: base64url(JSON.stringify({origin, ts})).base64url(hmac).
-// verifyCsrf checks: origin ∈ allowlist (exact match), ts ∈ recent window,
-// HMAC valid. Constant-time compare.
-import { hmac } from '@noble/hashes/hmac';
-import { sha256 } from '@noble/hashes/sha256';
+// CSRF tokens: HMAC-stamped origin (+ optional method / path / session) +
+// timestamp.
+//
+// R5.11 / PKG-CONNECT-AUTH-004 (external audit P1-2):
+//
+//   Pre-R5.11 the verifier only checked the token's SIGNED origin
+//   against an allowlist. It never compared to the request's ACTUAL
+//   origin — so a token legitimately minted for `https://app.com`
+//   (signed, in allowlist) would pass even when the request itself
+//   came from `https://evil.com`. The double-submit cookie pattern
+//   helps but doesn't bind the verifier to the request origin.
+//
+//   Post-R5.11 `verifyCsrf` takes an explicit `actualOrigin` opt and
+//   rejects unless `stamp.origin === actualOrigin AND actualOrigin
+//   ∈ allowedOrigins`. The actual request origin is the load-bearing
+//   check; the allowlist is defense in depth.
+//
+//   Additionally, the audit row PKG-CONNECT-AUTH-004 also flagged
+//   that a token usable on `POST /transfer` is also usable on
+//   `POST /grant-admin` — no method/path/session binding. R5.11 adds
+//   optional `method` / `path` / `sessionSid` bindings: both mint
+//   and verify must agree on them, and when supplied they're stamped
+//   into the HMAC. Empty matches empty so legacy "origin only"
+//   callers keep working at the wire level.
+//
+// Token format (unchanged shape; new fields nullable):
+//   base64url(JSON.stringify({origin, ts, method?, path?, sessionSid?}))
+//     . base64url(hmac)
+import { hmac } from '@noble/hashes/hmac.js';
+import { sha256 } from '@noble/hashes/sha2.js';
 import { hexToBytes } from 'viem';
 const CSRF_VALIDITY_SECONDS = 60 * 60; // 1 hour
 function loadCsrfSecret() {
@@ -36,25 +60,76 @@ function constantTimeEqual(a, b) {
         diff |= (a[i] ?? 0) ^ (b[i] ?? 0);
     return diff === 0;
 }
+function isProduction(opts) {
+    if (opts?.developmentMode === true)
+        return false;
+    try {
+        return typeof process !== 'undefined' && process.env?.NODE_ENV === 'production';
+    }
+    catch {
+        return false;
+    }
+}
 /**
- * Produce a CSRF token bound to the given origin and the current timestamp.
+ * Mint a CSRF token bound to the supplied origin (and optionally to a
+ * method / path / session id). The HMAC covers all stamped fields, so
+ * any field tampering invalidates the token.
+ *
+ * R5.11 breaking change: the function signature now takes an opts
+ * object instead of a single `origin` positional arg. Pass
+ * `{ origin }` for the legacy origin-only behavior.
  */
-export function csrfTokenFor(origin) {
+export function csrfTokenFor(opts) {
     const secret = loadCsrfSecret();
     const ts = Math.floor(Date.now() / 1000);
-    const stamp = JSON.stringify({ origin, ts });
-    const stampEnc = base64urlEncode(stamp);
+    const stamp = { origin: opts.origin, ts };
+    // Only include binding fields when supplied — keeps the wire format
+    // tight for legacy callers + makes intent visible in audit logs.
+    if (opts.method !== undefined)
+        stamp.method = opts.method;
+    if (opts.path !== undefined)
+        stamp.path = opts.path;
+    if (opts.sessionSid !== undefined)
+        stamp.sessionSid = opts.sessionSid;
+    const stampEnc = base64urlEncode(JSON.stringify(stamp));
     const sig = hmac(sha256, secret, new TextEncoder().encode(stampEnc));
     return `${stampEnc}.${base64urlEncode(sig)}`;
 }
 /**
- * Verify a CSRF token.
- *   - origin (parsed exactly from the token) MUST be in allowedOrigins (exact-match).
- *   - HMAC must match.
- *   - Timestamp must be within the last CSRF_VALIDITY_SECONDS window.
- * Returns true iff all three hold.
+ * Verify a CSRF token. R5.11 breaking change: signature is now
+ * `verifyCsrf(token, opts: CsrfVerifyOpts)`.
+ *
+ *   1. HMAC must verify under `CSRF_SECRET`.
+ *   2. `stamp.ts` must be within the last `CSRF_VALIDITY_SECONDS` window
+ *      (with a small skew for future-ts).
+ *   3. `stamp.origin === opts.actualOrigin` (R5.11 / P1-2).
+ *   4. `opts.actualOrigin ∈ opts.allowedOrigins` (defense in depth).
+ *   5. When the mint side stamped a binding, the verify side MUST
+ *      supply the same value:
+ *        - `stamp.method === opts.method`
+ *        - `stamp.path === opts.path`
+ *        - `stamp.sessionSid === opts.sessionSid`
+ *      Empty / undefined matches empty / undefined. A token minted
+ *      WITHOUT bindings cannot be verified WITH bindings (and vice
+ *      versa) — the comparison is exact.
+ *
+ * Returns true iff all checks pass.
+ *
+ * **Production guard:** when `NODE_ENV=production` AND
+ * `developmentMode !== true`, the function THROWS if `actualOrigin`
+ * is an empty string. A silently-permissive `''` would re-open the
+ * audit finding; failing fast keeps production deploys honest. Tests
+ * / dev opt out via `developmentMode: true`.
  */
-export function verifyCsrf(token, allowedOrigins) {
+export function verifyCsrf(token, opts) {
+    if (isProduction(opts)) {
+        if (!opts.actualOrigin || opts.actualOrigin.length === 0) {
+            throw new Error('[connect-auth] verifyCsrf requires a non-empty `actualOrigin` in production. ' +
+                'Without it the request-origin binding is bypassed, re-opening the R5.11 / P1-2 ' +
+                'finding. Pass the inbound `Origin` header (or parsed `Referer`) as ' +
+                'opts.actualOrigin; for tests, pass `developmentMode: true`.');
+        }
+    }
     if (!token)
         return false;
     const parts = token.split('.');
@@ -70,9 +145,25 @@ export function verifyCsrf(token, allowedOrigins) {
     }
     if (typeof stamp.origin !== 'string' || typeof stamp.ts !== 'number')
         return false;
-    // Exact-match parsed URL allowlist (per spec §6) — origins are compared verbatim,
-    // never substring.
-    if (!allowedOrigins.includes(stamp.origin))
+    // R5.11 / P1-2: bind the verifier to the ACTUAL request origin.
+    // The verifier MUST be told the actual origin (we don't reach into
+    // an HTTP request here — that's the caller's concern). If actualOrigin
+    // is empty / missing, the check rejects (production gate above throws).
+    if (!opts.actualOrigin || stamp.origin !== opts.actualOrigin)
+        return false;
+    // Defense in depth: even when actualOrigin matches, it must be in
+    // the operator-curated allowlist. Catches a misconfigured caller
+    // that wires the wrong header into `actualOrigin`.
+    if (!opts.allowedOrigins.includes(opts.actualOrigin))
+        return false;
+    // R5.11: method / path / sessionSid bindings. Empty matches empty.
+    // The stamp has the value iff mint supplied it; the same applies to
+    // opts. A mismatched declaration on either side rejects.
+    if ((stamp.method ?? undefined) !== (opts.method ?? undefined))
+        return false;
+    if ((stamp.path ?? undefined) !== (opts.path ?? undefined))
+        return false;
+    if ((stamp.sessionSid ?? undefined) !== (opts.sessionSid ?? undefined))
         return false;
     const now = Math.floor(Date.now() / 1000);
     if (now - stamp.ts > CSRF_VALIDITY_SECONDS || now < stamp.ts)

package/dist/csrf.js.map

@@ -1 +1 @@
-{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,gDAAgD;AAChD,yEAAyE;AACzE,2EAA2E;AAC3E,qCAAqC;AAErC,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAEhD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAsB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,MAAc;IACzC,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,cAAwB;IAChE,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAyB,CAAC;IAErD,IAAI,KAAuC,CAAC;IAC5C,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnF,kFAAkF;IAClF,mBAAmB;IACnB,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,OAAO,KAAK,CAAC;IAEzD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,qBAAqB,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC"}
+{"version":3,"file":"csrf.js","sourceRoot":"","sources":["../src/csrf.ts"],"names":[],"mappings":"AAAA,0EAA0E;AAC1E,aAAa;AACb,EAAE;AACF,sDAAsD;AACtD,EAAE;AACF,kEAAkE;AAClE,oEAAoE;AACpE,kEAAkE;AAClE,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,qEAAqE;AACrE,mEAAmE;AACnE,qEAAqE;AACrE,8CAA8C;AAC9C,EAAE;AACF,kEAAkE;AAClE,8DAA8D;AAC9D,qEAAqE;AACrE,kEAAkE;AAClE,qEAAqE;AACrE,+DAA+D;AAC/D,4CAA4C;AAC5C,EAAE;AACF,uDAAuD;AACvD,yEAAyE;AACzE,wBAAwB;AAExB,OAAO,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAC7C,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AAElC,MAAM,qBAAqB,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,SAAS;AAEhD,SAAS,cAAc;IACrB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACpC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACrG,CAAC;IACD,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,GAAqB,CAAC,CAAC,CAAE,KAAK,GAAG,EAAoB,CAAC,CAAC;IACxG,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC3E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,eAAe,CAAC,CAAsB;IAC7C,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACxE,CAAC;AAED,SAAS,eAAe,CAAC,CAAS;IAChC,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAa,EAAE,CAAa;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IACxC,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACrE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,YAAY,CAAC,IAAoC;IACxD,IAAI,IAAI,EAAE,eAAe,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC;QACH,OAAO,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,QAAQ,KAAK,YAAY,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAoDD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,IAAkB;IAC7C,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IACzC,MAAM,KAAK,GAAU,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,CAAC;IACjD,oEAAoE;IACpE,iEAAiE;IACjE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC1D,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;IACpD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;QAAE,KAAK,CAAC,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC;IAEtE,MAAM,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrE,OAAO,GAAG,QAAQ,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,IAAoB;IAC5D,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzD,MAAM,IAAI,KAAK,CACb,+EAA+E;gBAC7E,iFAAiF;gBACjF,qEAAqE;gBACrE,6DAA6D,CAChE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACrC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,KAAyB,CAAC;IAErD,IAAI,KAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAEnF,gEAAgE;IAChE,mEAAmE;IACnE,uEAAuE;IACvE,wEAAwE;IACxE,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IAE3E,kEAAkE;IAClE,iEAAiE;IACjE,mDAAmD;IACnD,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC;QAAE,OAAO,KAAK,CAAC;IAEnE,mEAAmE;IACnE,oEAAoE;IACpE,yDAAyD;IACzD,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7E,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IACzE,IAAI,CAAC,KAAK,CAAC,UAAU,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,IAAI,SAAS,CAAC;QAAE,OAAO,KAAK,CAAC;IAErF,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE,GAAG,qBAAqB,IAAI,GAAG,GAAG,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IAE3E,MAAM,MAAM,GAAG,cAAc,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1E,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IAC1C,OAAO,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;AAChD,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,9 @@
-export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS } from './sessions';
-export { csrfTokenFor, verifyCsrf } from './csrf';
-export { deriveSaltFromLabel, deriveSaltFromEmail, type DeriveSaltFromEmailOpts } from './salt';
-export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature';
-export type { SignatureVerifyResult, VerifyUserSignatureArgs, UniversalValidatorClient, } from './verify-signature';
-export { P256_N, base64urlEncode, base64urlDecode, parseDerSignature, normaliseLowS, buildWebAuthnAssertion, hashToWebAuthnChallenge, parseAttestationObject, parseAuthData, } from './methods/passkey';
-export type { WebAuthnAssertion, ParsedAttestation } from './methods/passkey';
-export type { Address, Hex, AuthMethod, JwtClaims, AuthenticatedUser, TypedDataDomain, TypedDataTypes, Signer, PasskeyAssertion, PasskeySigner, EOASigner, KMSSigner, } from './types';
+export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS, DEFAULT_SESSION_CLOCK_SKEW_SEC, type VerifySessionOpts, } from './sessions.js';
+export { csrfTokenFor, verifyCsrf, type CsrfBindings, type CsrfMintOpts, type CsrfVerifyOpts, } from './csrf.js';
+export { deriveSaltFromLabel, deriveSaltFromEmail, type DeriveSaltFromEmailOpts } from './salt.js';
+export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature.js';
+export type { SignatureVerifyResult, VerifyUserSignatureArgs, UniversalValidatorClient, } from './verify-signature.js';
+export { P256_N, base64urlEncode, base64urlDecode, parseDerSignature, normaliseLowS, buildWebAuthnAssertion, hashToWebAuthnChallenge, parseAttestationObject, parseAuthData, } from './methods/passkey.js';
+export type { WebAuthnAssertion, ParsedAttestation } from './methods/passkey.js';
+export type { Address, Hex, AuthMethod, JwtClaims, AuthenticatedUser, TypedDataDomain, TypedDataTypes, Signer, PasskeyAssertion, PasskeySigner, EOASigner, KMSSigner, } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,QAAQ,CAAC;AAChG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,oBAAoB,CAAC;AAK5B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE9E,YAAY,EACV,OAAO,EACP,GAAG,EACH,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,SAAS,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,8BAA8B,EAC9B,KAAK,iBAAiB,GACvB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,UAAU,EACV,KAAK,YAAY,EACjB,KAAK,YAAY,EACjB,KAAK,cAAc,GACpB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,KAAK,uBAAuB,EAAE,MAAM,WAAW,CAAC;AACnG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAC/B,YAAY,EACV,qBAAqB,EACrB,uBAAuB,EACvB,wBAAwB,GACzB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,sBAAsB,CAAC;AAC9B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAEjF,YAAY,EACV,OAAO,EACP,GAAG,EACH,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,MAAM,EACN,gBAAgB,EAChB,aAAa,EACb,SAAS,EACT,SAAS,GACV,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,12 +1,12 @@
 // @agenticprimitives/connect-auth — public API
 //
 // See ../../specs/200-connect-auth.md for the full contract.
-export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS } from './sessions';
-export { csrfTokenFor, verifyCsrf } from './csrf';
-export { deriveSaltFromLabel, deriveSaltFromEmail } from './salt';
-export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature';
+export { mintSession, verifySession, SESSION_COOKIE, SESSION_TTL_SECONDS, DEFAULT_SESSION_CLOCK_SKEW_SEC, } from './sessions.js';
+export { csrfTokenFor, verifyCsrf, } from './csrf.js';
+export { deriveSaltFromLabel, deriveSaltFromEmail } from './salt.js';
+export { ERC1271_MAGIC, ERC6492_MAGIC, universalSignatureValidatorAbi, verifyUserSignature, verifyUserSignatureView, isErc6492Wrapped, } from './verify-signature.js';
 // WebAuthn ceremony helpers (preferred deep import:
 // `@agenticprimitives/connect-auth/passkey` for tree-shaking — re-exported
 // here for discoverability).
-export { P256_N, base64urlEncode, base64urlDecode, parseDerSignature, normaliseLowS, buildWebAuthnAssertion, hashToWebAuthnChallenge, parseAttestationObject, parseAuthData, } from './methods/passkey';
+export { P256_N, base64urlEncode, base64urlDecode, parseDerSignature, normaliseLowS, buildWebAuthnAssertion, hashToWebAuthnChallenge, parseAttestationObject, parseAuthData, } from './methods/passkey.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAE7D,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC7F,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAgC,MAAM,QAAQ,CAAC;AAChG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,oBAAoB,CAAC;AAO5B,oDAAoD;AACpD,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,mBAAmB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,+CAA+C;AAC/C,EAAE;AACF,6DAA6D;AAE7D,OAAO,EACL,WAAW,EACX,aAAa,EACb,cAAc,EACd,mBAAmB,EACnB,8BAA8B,GAE/B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,YAAY,EACZ,UAAU,GAIX,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAgC,MAAM,WAAW,CAAC;AACnG,OAAO,EACL,aAAa,EACb,aAAa,EACb,8BAA8B,EAC9B,mBAAmB,EACnB,uBAAuB,EACvB,gBAAgB,GACjB,MAAM,uBAAuB,CAAC;AAO/B,oDAAoD;AACpD,2EAA2E;AAC3E,6BAA6B;AAC7B,OAAO,EACL,MAAM,EACN,eAAe,EACf,eAAe,EACf,iBAAiB,EACjB,aAAa,EACb,sBAAsB,EACtB,uBAAuB,EACvB,sBAAsB,EACtB,aAAa,GACd,MAAM,sBAAsB,CAAC"}

package/dist/methods/google.d.ts

@@ -7,6 +7,12 @@ export interface OidcProviderConfig {
 }
 /** Google's stable OIDC endpoints (discovery doc values, pinned). */
 export declare const GOOGLE_OIDC: OidcProviderConfig;
+/** YouVersion Platform OIDC endpoints (developers.youversion.com/sign-in-apis, pinned). A PUBLIC PKCE
+ *  client: the token exchange carries NO `client_secret` (pass `clientSecret: undefined` to completeLogin).
+ *  YouVersion does not document an `email_verified` claim, so the consumer sets `requireEmailVerified:
+ *  false` — the credential is keyed on (iss, sub), never on email, so this does not weaken takeover
+ *  resistance. */
+export declare const YOUVERSION_OIDC: OidcProviderConfig;
 export interface BeginLoginInput {
     clientId: string;
     redirectUri: string;
@@ -52,16 +58,39 @@ export interface CompleteLoginInput {
     /** Must match the value used in beginLogin. */
     redirectUri: string;
     clientId: string;
-    clientSecret: string;
+    /** Confidential-client secret. OMIT for a PUBLIC PKCE client (e.g. YouVersion) — the token request
+     *  then carries only `client_id` + `code_verifier`, never an (empty) `client_secret`. */
+    clientSecret?: string;
+    /** Require `email_verified === true` (default true — Google). Set false for providers that don't
+     *  assert it (YouVersion); the facet is keyed on (iss, sub), not email, so this is safe. */
+    requireEmailVerified?: boolean;
+    /** Require the id_token `nonce` to match (default true — Google). Set false for providers whose
+     *  non-standard multi-leg flow doesn't round-trip the authorize `nonce` into the id_token
+     *  (YouVersion). PKCE (the code_verifier only we hold) already binds the code exchange, so this is
+     *  safe — replay/injection of a stolen id_token still fails without the verifier. */
+    requireNonce?: boolean;
     config?: OidcProviderConfig;
     /** Injectable for tests (defaults to global fetch). */
     fetchImpl?: typeof fetch;
     /** Injectable clock in ms (defaults to Date.now). */
     now?: () => number;
 }
+/** The provider OAuth tokens from the `/token` exchange. Returned so a consumer can custody the
+ *  `accessToken` (+ `refreshToken`) to later call the provider's user-data APIs (spec 265). The broker
+ *  uses ONLY the id_token for identity; these are additive and ignored unless a consumer opts to keep
+ *  them (Google identity-only flows pass through untouched). */
+export interface OidcTokens {
+    accessToken: string | null;
+    refreshToken: string | null;
+    /** Seconds until `accessToken` expires (provider `expires_in`). */
+    expiresIn: number | null;
+    /** Space-delimited granted scopes (provider `scope`). */
+    scope: string | null;
+}
 export type CompleteLoginResult = {
     ok: true;
     principal: OidcPrincipal;
+    tokens: OidcTokens;
 } | {
     ok: false;
     reason: string;

package/dist/methods/google.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/methods/google.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qEAAqE;AACrE,eAAO,MAAM,WAAW,EAAE,kBAKzB,CAAC;AA0DF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAqBnE;AAID,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,aAAa,CAAA;CAAE,GACtC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAclC,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAgE3F"}
+{"version":3,"file":"google.d.ts","sourceRoot":"","sources":["../../src/methods/google.ts"],"names":[],"mappings":"AAwBA,MAAM,WAAW,kBAAkB;IACjC,iFAAiF;IACjF,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,qBAAqB,EAAE,MAAM,CAAC;IAC9B,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qEAAqE;AACrE,eAAO,MAAM,WAAW,EAAE,kBAKzB,CAAC;AAEF;;;;kBAIkB;AAClB,eAAO,MAAM,eAAe,EAAE,kBAO7B,CAAC;AA0DF,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,yCAAyC;IACzC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,kBAAkB,CAAC;CAC7B;AAED,MAAM,WAAW,gBAAgB;IAC/B,oCAAoC;IACpC,OAAO,EAAE,MAAM,CAAC;IAChB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,eAAe,GAAG,gBAAgB,CAqBnE;AAID,MAAM,WAAW,aAAa;IAC5B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,qFAAqF;IACrF,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,iFAAiF;IACjF,aAAa,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,aAAa,EAAE,MAAM,CAAC;IACtB,4DAA4D;IAC5D,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB;6FACyF;IACzF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB;gGAC4F;IAC5F,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B;;;yFAGqF;IACrF,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,kBAAkB,CAAC;IAC5B,uDAAuD;IACvD,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;IACzB,qDAAqD;IACrD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED;;;gEAGgE;AAChE,MAAM,WAAW,UAAU;IACzB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,mEAAmE;IACnE,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yDAAyD;IACzD,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,UAAU,CAAA;CAAE,GAC1D;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAclC,+EAA+E;AAC/E,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,wBAAsB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC,CAkF3F"}

package/dist/methods/google.js

@@ -17,7 +17,7 @@
 // This method returns a *verified OIDC principal* (iss/sub/email). It does NOT
 // resolve to a canonical Smart Agent — that binding is the directory's job
 // (spec 223) and the broker's (spec 224); connect-auth must not import them.
-import { sha256 } from '@noble/hashes/sha256';
+import { sha256 } from '@noble/hashes/sha2.js';
 /** Google's stable OIDC endpoints (discovery doc values, pinned). */
 export const GOOGLE_OIDC = {
     issuers: ['https://accounts.google.com', 'accounts.google.com'],
@@ -25,6 +25,19 @@ export const GOOGLE_OIDC = {
     tokenEndpoint: 'https://oauth2.googleapis.com/token',
     jwksUri: 'https://www.googleapis.com/oauth2/v3/certs',
 };
+/** YouVersion Platform OIDC endpoints (developers.youversion.com/sign-in-apis, pinned). A PUBLIC PKCE
+ *  client: the token exchange carries NO `client_secret` (pass `clientSecret: undefined` to completeLogin).
+ *  YouVersion does not document an `email_verified` claim, so the consumer sets `requireEmailVerified:
+ *  false` — the credential is keyed on (iss, sub), never on email, so this does not weaken takeover
+ *  resistance. */
+export const YOUVERSION_OIDC = {
+    // YouVersion's id_token sets `iss` to the TOKEN ENDPOINT URL (observed live), not the base origin the
+    // docs state — accept both so we're robust to either.
+    issuers: ['https://api.youversion.com/auth/token', 'https://api.youversion.com'],
+    authorizationEndpoint: 'https://api.youversion.com/auth/authorize',
+    tokenEndpoint: 'https://api.youversion.com/auth/token',
+    jwksUri: 'https://api.youversion.com/.well-known/jwks.json',
+};
 // ─── base64url + random helpers ───────────────────────────────────────
 function b64urlEncode(bytes) {
     let s;
@@ -124,15 +137,19 @@ export async function completeLogin(input) {
     }
     // 2. Authorization-code → tokens (with PKCE code_verifier).
     let idToken;
+    let tokens = { accessToken: null, refreshToken: null, expiresIn: null, scope: null };
     try {
         const body = new URLSearchParams({
             grant_type: 'authorization_code',
             code: input.code,
             redirect_uri: input.redirectUri,
             client_id: input.clientId,
-            client_secret: input.clientSecret,
             code_verifier: input.codeVerifier,
         });
+        // Confidential clients (Google) include the secret; public PKCE clients (YouVersion) MUST NOT send
+        // one — an empty `client_secret` makes some providers reject the exchange.
+        if (input.clientSecret)
+            body.set('client_secret', input.clientSecret);
         const res = await doFetch(config.tokenEndpoint, {
             method: 'POST',
             headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
@@ -144,6 +161,14 @@ export async function completeLogin(input) {
         if (!json.id_token)
             return { ok: false, reason: 'token response missing id_token' };
         idToken = json.id_token;
+        // Preserve the OAuth tokens (spec 265 — federated user-data access). Identity-only consumers ignore
+        // `tokens`; a consumer that wants to call the provider's user APIs custodies the access/refresh token.
+        tokens = {
+            accessToken: json.access_token ?? null,
+            refreshToken: json.refresh_token ?? null,
+            expiresIn: json.expires_in != null ? Number(json.expires_in) : null,
+            scope: json.scope ?? null,
+        };
     }
     catch (e) {
         return { ok: false, reason: e instanceof Error ? `token exchange failed: ${e.message}` : 'token exchange failed' };
@@ -153,25 +178,29 @@ export async function completeLogin(input) {
         config,
         clientId: input.clientId,
         expectedNonce: input.expectedNonce,
+        requireNonce: input.requireNonce !== false,
         nowMs,
         fetchImpl: doFetch,
     });
     if (!verified.ok)
         return verified;
-    // 4. email_verified is mandatory (audit CN-3 / P0-3).
+    // 4. email_verified is mandatory by default (audit CN-3 / P0-3). Providers that don't assert the claim
+    //    (YouVersion) opt out via `requireEmailVerified: false` — safe because the facet keys on (iss, sub).
     const ev = verified.claims.email_verified;
     const emailVerified = ev === true || ev === 'true';
-    if (!emailVerified)
+    if (input.requireEmailVerified !== false && !emailVerified) {
         return { ok: false, reason: 'email_verified is not true' };
+    }
     return {
         ok: true,
         principal: {
             iss: verified.claims.iss,
             sub: verified.claims.sub,
             email: verified.claims.email ?? null,
-            emailVerified: true,
+            emailVerified,
             name: verified.claims.name ?? null,
         },
+        tokens,
     };
 }
 async function verifyIdToken(idToken, ctx) {
@@ -229,7 +258,7 @@ async function verifyIdToken(idToken, ctx) {
     if (typeof claims.exp !== 'number' || claims.exp * 1000 <= ctx.nowMs) {
         return { ok: false, reason: 'id_token expired' };
     }
-    if (!claims.nonce || !constantTimeEqualStr(claims.nonce, ctx.expectedNonce)) {
+    if (ctx.requireNonce && (!claims.nonce || !constantTimeEqualStr(claims.nonce, ctx.expectedNonce))) {
         return { ok: false, reason: 'id_token nonce mismatch' };
     }
     if (!claims.sub)

package/dist/methods/google.js.map

@@ -1 +1 @@
-{"version":3,"file":"google.js","sourceRoot":"","sources":["../../src/methods/google.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,8EAA8E;AAC9E,gFAAgF;AAChF,qCAAqC;AACrC,EAAE;AACF,0CAA0C;AAC1C,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAE7E,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAY9C,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAuB;IAC7C,OAAO,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;IAC/D,qBAAqB,EAAE,8CAA8C;IACrE,aAAa,EAAE,qCAAqC;IACpD,OAAO,EAAE,4CAA4C;CACtD,CAAC;AAEF,yEAAyE;AAEzE,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,CAAS,CAAC;IACd,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC;IAC3C,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC;IAC9E,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE;QAC3D,KAAK;QACL,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAErD,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzG,CAAC;AAmDD,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC;IAC3C,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAExC,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,aAAa,EAAE,KAAK,CAAC,YAAY;YACjC,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;QACzD,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACpF,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;IACrH,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;QAC5C,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,KAAK;QACL,SAAS,EAAE,OAAO;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,sDAAsD;IACtD,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1C,MAAM,aAAa,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,MAAM,CAAC;IACnD,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAE/E,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE;YACT,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAI;YACzB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAI;YACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;YACpC,aAAa,EAAE,IAAI;YACnB,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;SACnC;KACF,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,GAAoH;IAEpH,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACrF,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEtE,uCAAuC;IACvC,IAAI,GAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAC;QAClF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACpF,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC7G,CAAC;IAED,qDAAqD;IACrD,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAG,GAAsB,CAAC,CAAC,EAAE,CAAC,EAAG,GAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EACrG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,cAAc,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EACjC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC;IACnI,CAAC;IACD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAEhF,oBAAoB;IACpB,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACjF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}
+{"version":3,"file":"google.js","sourceRoot":"","sources":["../../src/methods/google.ts"],"names":[],"mappings":"AAAA,iDAAiD;AACjD,EAAE;AACF,+EAA+E;AAC/E,wEAAwE;AACxE,8EAA8E;AAC9E,gFAAgF;AAChF,qCAAqC;AACrC,EAAE;AACF,0CAA0C;AAC1C,6EAA6E;AAC7E,+EAA+E;AAC/E,+EAA+E;AAC/E,sEAAsE;AACtE,+EAA+E;AAC/E,qDAAqD;AACrD,EAAE;AACF,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAE7E,OAAO,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAY/C,qEAAqE;AACrE,MAAM,CAAC,MAAM,WAAW,GAAuB;IAC7C,OAAO,EAAE,CAAC,6BAA6B,EAAE,qBAAqB,CAAC;IAC/D,qBAAqB,EAAE,8CAA8C;IACrE,aAAa,EAAE,qCAAqC;IACpD,OAAO,EAAE,4CAA4C;CACtD,CAAC;AAEF;;;;kBAIkB;AAClB,MAAM,CAAC,MAAM,eAAe,GAAuB;IACjD,sGAAsG;IACtG,sDAAsD;IACtD,OAAO,EAAE,CAAC,uCAAuC,EAAE,4BAA4B,CAAC;IAChF,qBAAqB,EAAE,2CAA2C;IAClE,aAAa,EAAE,uCAAuC;IACtD,OAAO,EAAE,kDAAkD;CAC5D,CAAC;AAEF,yEAAyE;AAEzE,SAAS,YAAY,CAAC,KAAiB;IACrC,IAAI,CAAS,CAAC;IACd,IAAI,OAAO,MAAM,KAAK,WAAW,EAAE,CAAC;QAClC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC5C,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,GAAG,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACrD,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IAChB,CAAC;IACD,OAAO,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,MAAM,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACrD,OAAO,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,IAAI,GAAG,CAAC;IACxC,IAAI,OAAO,MAAM,KAAK,WAAW;QAAE,OAAO,IAAI,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;IACzB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,CAAS;IAC/B,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,CAAa;IAC/B,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;IACzC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACX,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;IACpC,UAAU,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,YAAY,CAAC,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS,EAAE,CAAS;IAChD,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,EAAE,GAAG,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACvC,IAAI,EAAE,CAAC,MAAM,KAAK,EAAE,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACxE,OAAO,IAAI,KAAK,CAAC,CAAC;AACpB,CAAC;AAuBD;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,KAAsB;IAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC;IAC3C,MAAM,YAAY,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC,CAAC,uCAAuC;IAC9E,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,sBAAsB,CAAC;IACpD,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,KAAK,CAAC,QAAQ;QACzB,YAAY,EAAE,KAAK,CAAC,WAAW;QAC/B,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,KAAK,EAAE;QAC3D,KAAK;QACL,KAAK;QACL,cAAc,EAAE,aAAa;QAC7B,qBAAqB,EAAE,MAAM;KAC9B,CAAC,CAAC;IACH,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAErD,OAAO,EAAE,OAAO,EAAE,GAAG,MAAM,CAAC,qBAAqB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzG,CAAC;AA0ED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IAClD,OAAO,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;AACzB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,KAAyB;IAC3D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,WAAW,CAAC;IAC3C,6EAA6E;IAC7E,4EAA4E;IAC5E,+EAA+E;IAC/E,8EAA8E;IAC9E,gEAAgE;IAChE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IAExC,6EAA6E;IAC7E,IAAI,CAAC,KAAK,CAAC,aAAa,IAAI,CAAC,oBAAoB,CAAC,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC;QAC5F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IAED,4DAA4D;IAC5D,IAAI,OAAe,CAAC;IACpB,IAAI,MAAM,GAAe,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAC/B,UAAU,EAAE,oBAAoB;YAChC,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,YAAY,EAAE,KAAK,CAAC,WAAW;YAC/B,SAAS,EAAE,KAAK,CAAC,QAAQ;YACzB,aAAa,EAAE,KAAK,CAAC,YAAY;SAClC,CAAC,CAAC;QACH,mGAAmG;QACnG,2EAA2E;QAC3E,IAAI,KAAK,CAAC,YAAY;YAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACtE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE;YAC9C,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;YAC5F,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;SACtB,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QACnF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAE7B,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iCAAiC,EAAE,CAAC;QACpF,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC;QACxB,oGAAoG;QACpG,uGAAuG;QACvG,MAAM,GAAG;YACP,WAAW,EAAE,IAAI,CAAC,YAAY,IAAI,IAAI;YACtC,YAAY,EAAE,IAAI,CAAC,aAAa,IAAI,IAAI;YACxC,SAAS,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI;YACnE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI;SAC1B,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,0BAA0B,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,uBAAuB,EAAE,CAAC;IACrH,CAAC;IAED,0BAA0B;IAC1B,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,OAAO,EAAE;QAC5C,MAAM;QACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,aAAa,EAAE,KAAK,CAAC,aAAa;QAClC,YAAY,EAAE,KAAK,CAAC,YAAY,KAAK,KAAK;QAC1C,KAAK;QACL,SAAS,EAAE,OAAO;KACnB,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAElC,uGAAuG;IACvG,yGAAyG;IACzG,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IAC1C,MAAM,aAAa,GAAG,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,MAAM,CAAC;IACnD,IAAI,KAAK,CAAC,oBAAoB,KAAK,KAAK,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAC7D,CAAC;IAED,OAAO;QACL,EAAE,EAAE,IAAI;QACR,SAAS,EAAE;YACT,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAI;YACzB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAI;YACzB,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI;YACpC,aAAa;YACb,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,IAAI,IAAI;SACnC;QACD,MAAM;KACP,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa,CAC1B,OAAe,EACf,GAA2I;IAE3I,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,EAAE,CAAC;IACrF,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,KAAiC,CAAC;IAE1E,IAAI,MAAsC,CAAC;IAC3C,IAAI,MAAqB,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,SAAS,CAAC,CAAC,CAAC;QAC/C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IACzE,CAAC;IAED,0EAA0E;IAC1E,IAAI,MAAM,CAAC,GAAG,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oCAAoC,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;IAC5G,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEtE,uCAAuC;IACvC,IAAI,GAAkC,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,0BAA0B,GAAG,CAAC,MAAM,EAAE,EAAE,CAAC;QAClF,MAAM,GAAG,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAoD,CAAC;QAClF,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC7E,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,MAAM,CAAC,GAAG,GAAG,EAAE,CAAC;QACpF,GAAG,GAAG,KAAK,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,sBAAsB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;IAC7G,CAAC;IAED,qDAAqD;IACrD,IAAI,cAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAClD,KAAK,EACL,EAAE,GAAG,EAAE,GAAG,CAAC,GAAG,EAAE,CAAC,EAAG,GAAsB,CAAC,CAAC,EAAE,CAAC,EAAG,GAAsB,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,EACrG,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,EAC9C,KAAK,EACL,CAAC,QAAQ,CAAC,CACX,CAAC;QACF,cAAc,GAAG,MAAM,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CACpD,EAAE,IAAI,EAAE,mBAAmB,EAAE,EAC7B,GAAG,EACH,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EACjC,UAAU,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,SAAS,IAAI,UAAU,EAAE,CAAC,CAAC,CACnE,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,iCAAiC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,8BAA8B,EAAE,CAAC;IACnI,CAAC;IACD,IAAI,CAAC,cAAc;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC;IAEhF,oBAAoB;IACpB,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,MAAM,CAAC,GAAG,gBAAgB,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,GAAG,CAAC,QAAQ,CAAC;IAC1G,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IACjF,IAAI,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ,IAAI,MAAM,CAAC,GAAG,GAAG,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;QACrE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC;IACnD,CAAC;IACD,IAAI,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,GAAG;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,sBAAsB,EAAE,CAAC;IAEtE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC9B,CAAC"}

package/dist/methods/passkey.d.ts

@@ -20,7 +20,7 @@
  * (branch 003-intent-marketplace-proposal) — adapted to agenticprimitives
  * package boundaries.
  */
-import type { Hex } from '../types';
+import type { Hex } from '../types.js';
 /** secp256r1 (P-256) group order. */
 export declare const P256_N = 115792089210356248762697446949407573529996955224135760342422259061068512044369n;
 export declare function base64urlEncode(bytes: Uint8Array): string;
@@ -91,16 +91,4 @@ export interface ParsedAttestation {
  */
 export declare function parseAttestationObject(attestationObject: Uint8Array): ParsedAttestation;
 export declare function parseAuthData(authData: Uint8Array): ParsedAttestation;
-export interface PasskeySignupInput {
-    label: string;
-    challenge: Hex;
-}
-export declare function beginSignup(_input: {
-    label: string;
-}): Promise<never>;
-export declare function completeSignup(_req: unknown): Promise<never>;
-export declare function beginLogin(_input: {
-    credentialId: string;
-}): Promise<never>;
-export declare function completeLogin(_req: unknown): Promise<never>;
 //# sourceMappingURL=passkey.d.ts.map