@bkazemi/verily 0.1.0

package/dist/core/signed.js

@@ -0,0 +1,113 @@
+/** A signed record is a few kilobytes. Anything far past that is not one. */
+const maxSignedLength = 262144;
+let loaded;
+async function load() {
+    const pgp = await import('openpgp');
+    const weak = [pgp.enums.hash.sha1, pgp.enums.hash.md5, pgp.enums.hash.ripemd];
+    return {
+        pgp,
+        // SHA-1 and older are refused under a key's own signatures as well as under a record.
+        config: {
+            ...pgp.config,
+            rejectHashAlgorithms: new Set([...pgp.config.rejectHashAlgorithms, ...weak]),
+            rejectMessageHashAlgorithms: new Set([...pgp.config.rejectMessageHashAlgorithms, ...weak]),
+        },
+    };
+}
+/**
+ * OpenPGP.js and how it is set, brought in when a record is first checked and not before.
+ * On a page it will not start without WebCrypto, which an insecure page lacks, and a page
+ * with no signed record on it has no use for it: neither should cost the badge anything.
+ */
+const library = () => (loaded ??= load());
+/** The signatures under a message, which the library keeps and its types leave out. */
+const marks = (message) => message.signature.packets;
+/** A signed record as OpenPGP.js reads it, where it is one message under one signature. */
+async function read(signed) {
+    if (typeof signed !== 'string' || signed.length > maxSignedLength)
+        return undefined;
+    const text = signed.trim();
+    const lines = text.split(/\r?\n/);
+    const only = (line) => lines.indexOf(line) === lines.lastIndexOf(line);
+    // The message and nothing around it: what stands outside one is signed by nobody. Each
+    // marker is a whole line, met once, with the last of them the last line there is. A line
+    // of the text that begins with a dash is written with "- " before it, so none of the
+    // text can be one of these.
+    if (lines[0] !== '-----BEGIN PGP SIGNED MESSAGE-----' ||
+        lines.at(-1) !== '-----END PGP SIGNATURE-----' ||
+        !lines.includes('-----BEGIN PGP SIGNATURE-----') ||
+        ![lines[0], lines.at(-1), '-----BEGIN PGP SIGNATURE-----'].every(only))
+        return undefined;
+    try {
+        const { pgp, config } = await library();
+        const message = await pgp.readCleartextMessage({ cleartextMessage: text, config });
+        return marks(message).length === 1 ? message : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+const fingerprint = (bytes) => [...bytes].map((byte) => byte.toString(16).padStart(2, '0').toUpperCase()).join('');
+/**
+ * The fingerprint of the key a signed record says signed it, checked or not: which key to
+ * look for, and no reason by itself to believe anything.
+ */
+export async function signedBy(signed) {
+    const message = await read(signed);
+    const by = message && marks(message)[0].issuerFingerprint;
+    return by ? fingerprint(by) : undefined;
+}
+/**
+ * The document a signed record carries, if one of the keys given signed it, and nothing
+ * otherwise. The keys are the caller's to choose: a record is only as good as the reason
+ * to believe each key is the verifier's. It says what stood when it was signed, never
+ * that it stands now.
+ *
+ * Whether a signature counts is OpenPGP.js's to say, by the format's own rules: a key is
+ * judged as it stood when the record was signed, so one that has since run out, or been
+ * retired, still answers for what it signed before, and one revoked as compromised signs
+ * nothing at all. Only a record signed by the listed key itself is taken, not by a subkey
+ * of it, so the fingerprint a record names is the one a list holds.
+ */
+export async function verifySigned(signed, keys) {
+    const message = await read(signed);
+    const by = await signedBy(signed);
+    if (!message || !by || !Array.isArray(keys))
+        return undefined;
+    for (const key of keys) {
+        if (key === null ||
+            typeof key !== 'object' ||
+            key.alg !== 'OpenPGP' ||
+            key.id !== by ||
+            typeof key.publicKey !== 'string' ||
+            key.publicKey.length > maxSignedLength)
+            continue;
+        try {
+            const { pgp, config } = await library();
+            const published = await pgp.readKey({ armoredKey: key.publicKey, config });
+            // The id is recomputed, so a key listed under another's id signs nothing in its name.
+            if (published.getFingerprint().toUpperCase() !== key.id)
+                continue;
+            // Checked against the key itself with its subkeys taken off, so a subkey's signature
+            // cannot pass under the key's name whatever the signature says of who made it.
+            published.subkeys = [];
+            const { signatures, data } = await pgp.verify({
+                message,
+                verificationKeys: published,
+                config,
+            });
+            // Throws where the signature is not this key's, or the key was not fit to make it.
+            await signatures[0].verified;
+            const document = JSON.parse(data);
+            return document?.type === 'verily-evidence' &&
+                document.version === 1 &&
+                typeof document.issuedAt === 'number'
+                ? document
+                : undefined;
+        }
+        catch {
+            continue;
+        }
+    }
+    return undefined;
+}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+/** Node entry point. The package export map selects browser.ts for frontend builds. */
+export * from './core/index.js';
+export * from './server/index.js';
+export * from './postgres/index.js';
+export { init, type Result } from './browser/index.js';

package/dist/index.js

@@ -0,0 +1,5 @@
+/** Node entry point. The package export map selects browser.ts for frontend builds. */
+export * from './core/index.js';
+export * from './server/index.js';
+export * from './postgres/index.js';
+export { init } from './browser/index.js';

package/dist/logo.d.ts

@@ -0,0 +1,21 @@
+/**
+ * The Verily logotype, from docs/design/verily-logo.svg. The word is Rubik reduced to
+ * outlines, so nothing here asks a font host for anything. As parts it is drawn in
+ * currentColor, so in a dialog it takes the ink of whatever it sits in.
+ *
+ * Kept as the parts rather than one blob because the two sides draw it differently: a page
+ * assembled as a string wants markup, and the badge builds DOM and never sets innerHTML.
+ *
+ * Regenerate the SVG with docs/design/build-logo.py. Rubik is OFL: docs/licenses/rubik.txt.
+ */
+export declare const logoViewBox = "0 -26 2637 916";
+export declare const logoPaths: readonly {
+    d: string;
+    fill: string;
+}[];
+/**
+ * The logotype as markup, for the pages this library serves as strings. Here the word is
+ * always white, on a dark plate of its own, so it is one colour whichever scheme the page
+ * is in. This is docs/design/verily-logo-plate.svg, and the README shows the same.
+ */
+export declare const logo: string;

package/dist/logo.js

@@ -0,0 +1,38 @@
+/**
+ * The Verily logotype, from docs/design/verily-logo.svg. The word is Rubik reduced to
+ * outlines, so nothing here asks a font host for anything. As parts it is drawn in
+ * currentColor, so in a dialog it takes the ink of whatever it sits in.
+ *
+ * Kept as the parts rather than one blob because the two sides draw it differently: a page
+ * assembled as a string wants markup, and the badge builds DOM and never sets innerHTML.
+ *
+ * Regenerate the SVG with docs/design/build-logo.py. Rubik is OFL: docs/licenses/rubik.txt.
+ */
+export const logoViewBox = '0 -26 2637 916';
+export const logoPaths = [
+    {
+        d: 'M36.76 22.11 364.79 708 692.83 22.11 600.38 -22.11 364.79 470.49 129.21 -22.11Z',
+        fill: '#D3444C',
+    },
+    {
+        d: 'M209.69 383.69 364.79 708 648 115.85 555.55 71.64 364.79 470.49 302.14 339.47Z',
+        fill: '#149766',
+    },
+    {
+        d: 'M942 710Q838 710 777 646.5Q716 583 710 473Q709 460 709 439.5Q709 419 710 406Q714 335 743 281.5Q772 228 822.5 199Q873 170 941 170Q1017 170 1068.5 202Q1120 234 1147 293Q1174 352 1174 431V448Q1174 459 1167.5 465Q1161 471 1151 471H805Q805 472 805 475Q805 478 805 480Q807 521 823 556.5Q839 592 869.5 614Q900 636 941 636Q977 636 1001 625Q1025 614 1040 600.5Q1055 587 1060 579Q1069 567 1074 564.5Q1079 562 1090 562H1139Q1148 562 1154.5 567.5Q1161 573 1160 583Q1159 598 1144 619.5Q1129 641 1101.5 662Q1074 683 1033.5 696.5Q993 710 942 710ZM805 402H1079V399Q1079 354 1062.5 319Q1046 284 1015 263.5Q984 243 941 243Q898 243 867.5 263.5Q837 284 821 319Q805 354 805 399ZM1317 700Q1307 700 1300.5 693.5Q1294 687 1294 677V204Q1294 194 1300.5 187Q1307 180 1317 180H1363Q1373 180 1380 187Q1387 194 1387 204V248Q1407 214 1442 197Q1477 180 1527 180H1566Q1576 180 1582.5 186.5Q1589 193 1589 203V244Q1589 254 1582.5 260Q1576 266 1566 266H1506Q1452 266 1421 297.5Q1390 329 1390 383V677Q1390 687 1383 693.5Q1376 700 1366 700ZM1697 700Q1687 700 1680.5 693.5Q1674 687 1674 677V203Q1674 193 1680.5 186.5Q1687 180 1697 180H1745Q1755 180 1761.5 186.5Q1768 193 1768 203V677Q1768 687 1761.5 693.5Q1755 700 1745 700ZM1689 83Q1679 83 1672.5 76.5Q1666 70 1666 60V6Q1666 -4 1672.5 -11Q1679 -18 1689 -18H1752Q1762 -18 1769 -11Q1776 -4 1776 6V60Q1776 70 1769 76.5Q1762 83 1752 83ZM1940 700Q1930 700 1923.5 693.5Q1917 687 1917 677V13Q1917 3 1923.5 -3.5Q1930 -10 1940 -10H1987Q1998 -10 2004 -3.5Q2010 3 2010 13V677Q2010 687 2004 693.5Q1998 700 1987 700ZM2250 890Q2242 890 2236 884Q2230 878 2230 870Q2230 866 2231 862Q2232 858 2235 852L2312 669L2121 218Q2116 206 2116 201Q2116 192 2122 186Q2128 180 2137 180H2186Q2197 180 2202.5 185Q2208 190 2210 197L2362 561L2518 197Q2521 190 2526.5 185Q2532 180 2543 180H2590Q2599 180 2605 186Q2611 192 2611 200Q2611 205 2606 218L2322 873Q2319 880 2313.5 885Q2308 890 2297 890Z',
+        fill: 'currentColor',
+    },
+];
+/** Room around the logotype inside its plate, as docs/design/verily-logo-plate.svg has it. */
+const pad = 185;
+/**
+ * The logotype as markup, for the pages this library serves as strings. Here the word is
+ * always white, on a dark plate of its own, so it is one colour whichever scheme the page
+ * is in. This is docs/design/verily-logo-plate.svg, and the README shows the same.
+ */
+export const logo = `<svg xmlns="http://www.w3.org/2000/svg" viewBox="${-pad} ${-26 - pad} ${2637 + 2 * pad} ${916 + 2 * pad}" class="logo" role="img" aria-label="Verily">` +
+    `<rect x="${-pad}" y="${-26 - pad}" width="${2637 + 2 * pad}" height="${916 + 2 * pad}" rx="166" fill="#0d1117"/>` +
+    logoPaths
+        .map(({ d, fill }) => `<path d="${d}" fill="${fill === 'currentColor' ? '#ffffff' : fill}"/>`)
+        .join('') +
+    '</svg>';

package/dist/postgres/index.d.ts

@@ -0,0 +1,12 @@
+import { Pool } from 'pg';
+import type { Storage, Transaction } from '../core/index.js';
+export { Pool } from 'pg';
+/** One namespace per installation; account tables remain entirely application-owned. */
+export declare class PostgresStorage implements Storage {
+    readonly pool: Pool;
+    readonly namespace: string;
+    constructor(pool: Pool, namespace?: string);
+    migrate(): Promise<void>;
+    transaction<T>(work: (tx: Transaction) => Promise<T>): Promise<T>;
+    private operations;
+}

package/dist/postgres/index.js

@@ -0,0 +1,76 @@
+export { Pool } from 'pg';
+/** One namespace per installation; account tables remain entirely application-owned. */
+export class PostgresStorage {
+    pool;
+    namespace;
+    constructor(pool, namespace = 'verily') {
+        this.pool = pool;
+        this.namespace = namespace;
+        if (!namespace)
+            throw new Error('Storage namespace required');
+    }
+    async migrate() {
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            // IF NOT EXISTS does not make CREATE TABLE safe to race: two workers starting on a new
+            // database both create the table's row type, and one fails. The table is shared by
+            // every namespace, so the lock is one of its own rather than the namespace's.
+            await client.query("SELECT pg_advisory_xact_lock(hashtextextended('verily migrate', 0))");
+            await client.query(`CREATE TABLE IF NOT EXISTS verily_records (
+        namespace text NOT NULL, kind text NOT NULL, id text NOT NULL, value jsonb NOT NULL,
+        PRIMARY KEY (namespace, kind, id)
+      )`);
+            await client.query('COMMIT');
+        }
+        catch (error) {
+            await client.query('ROLLBACK');
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    async transaction(work) {
+        const client = await this.pool.connect();
+        try {
+            await client.query('BEGIN');
+            // Serialize installation writes, including callback claims and share rotation across workers.
+            await client.query('SELECT pg_advisory_xact_lock(hashtextextended($1, 0))', [this.namespace]);
+            const result = await work(this.operations(client));
+            await client.query('COMMIT');
+            return result;
+        }
+        catch (error) {
+            await client.query('ROLLBACK');
+            throw error;
+        }
+        finally {
+            client.release();
+        }
+    }
+    operations(client) {
+        const namespace = this.namespace;
+        return {
+            async get(kind, id) {
+                const result = await client.query('SELECT value FROM verily_records WHERE namespace=$1 AND kind=$2 AND id=$3', [namespace, kind, id]);
+                return result.rows[0]?.value;
+            },
+            async put(kind, id, value) {
+                await client.query(`INSERT INTO verily_records(namespace,kind,id,value) VALUES($1,$2,$3,$4)
+          ON CONFLICT(namespace,kind,id) DO UPDATE SET value=EXCLUDED.value`, [namespace, kind, id, JSON.stringify(value)]);
+            },
+            async delete(kind, id) {
+                await client.query('DELETE FROM verily_records WHERE namespace=$1 AND kind=$2 AND id=$3', [
+                    namespace,
+                    kind,
+                    id,
+                ]);
+            },
+            async list(kind) {
+                const result = await client.query('SELECT value FROM verily_records WHERE namespace=$1 AND kind=$2', [namespace, kind]);
+                return result.rows.map((row) => row.value);
+            },
+        };
+    }
+}

package/dist/server/addresses.d.ts

@@ -0,0 +1,2 @@
+/** Whether an address is somewhere on the public internet, as opposed to inside a network. */
+export declare function publicAddress(address: string): boolean;

package/dist/server/addresses.js

@@ -0,0 +1,61 @@
+import { BlockList, isIPv4, isIPv6 } from 'node:net';
+// Everything that is not a unicast address on the public internet: this network, private
+// and shared address space, loopback, link-local, protocol assignments, documentation and
+// benchmarking ranges, multicast and the reserved block.
+const reservedV4 = [
+    '0.0.0.0/8',
+    '10.0.0.0/8',
+    '100.64.0.0/10',
+    '127.0.0.0/8',
+    '169.254.0.0/16',
+    '172.16.0.0/12',
+    '192.0.0.0/24',
+    '192.0.2.0/24',
+    '192.88.99.0/24',
+    '192.168.0.0/16',
+    '198.18.0.0/15',
+    '198.51.100.0/24',
+    '203.0.113.0/24',
+    '224.0.0.0/4',
+    '240.0.0.0/4',
+];
+// IPv6 is allowed only inside global unicast, less the parts of it that are protocol
+// assignments (Teredo among them), documentation, 6to4 relays that tunnel to any IPv4
+// address, and segment routing.
+const reservedV6 = ['2001::/23', '2001:db8::/32', '2002::/16', '3fff::/20', '5f00::/16'];
+const reserved = blocks([...reservedV4.map((cidr) => [cidr, 'ipv4'])]);
+const global = blocks([['2000::/3', 'ipv6']]);
+const reservedGlobal = blocks(reservedV6.map((cidr) => [cidr, 'ipv6']));
+// These carry an IPv4 address in their low 32 bits, and are judged by it.
+const embedding = blocks([
+    ['::ffff:0:0/96', 'ipv6'],
+    ['64:ff9b::/96', 'ipv6'],
+]);
+/** Whether an address is somewhere on the public internet, as opposed to inside a network. */
+export function publicAddress(address) {
+    if (isIPv4(address))
+        return !reserved.check(address, 'ipv4');
+    // A zone only ever scopes a link-local address.
+    if (!isIPv6(address) || address.includes('%'))
+        return false;
+    if (embedding.check(address, 'ipv6'))
+        return publicAddress(embedded(address));
+    return global.check(address, 'ipv6') && !reservedGlobal.check(address, 'ipv6');
+}
+function blocks(ranges) {
+    const list = new BlockList();
+    for (const [cidr, family] of ranges) {
+        const [base, prefix] = cidr.split('/');
+        list.addSubnet(base, Number(prefix), family);
+    }
+    return list;
+}
+/**
+ * The IPv4 address in an IPv6 address's low 32 bits. `URL` writes an IPv6 address in its
+ * canonical form, where those are always the last two groups, and an empty group is zero.
+ */
+function embedded(address) {
+    const groups = new URL(`http://[${address}]`).hostname.slice(1, -1).split(':').slice(-2);
+    const value = groups.reduce((value, group) => value * 65536 + parseInt(group || '0', 16), 0);
+    return [24, 16, 8, 0].map((shift) => Math.floor(value / 2 ** shift) % 256).join('.');
+}

package/dist/server/body.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Reads at most `maxBytes` of a response, and says whether it stopped early. A body is
+ * whatever the far side chooses to send, so it is never read to the end on trust: the rest
+ * is cancelled, which lets go of the connection instead of holding it to the deadline.
+ */
+export declare function readBounded(response: Response, maxBytes: number): Promise<{
+    bytes: Uint8Array;
+    truncated: boolean;
+}>;
+/** Lets go of a body nobody started reading. One already read has been let go of. */
+export declare function discard(response: Response): Promise<void>;

package/dist/server/body.js

@@ -0,0 +1,49 @@
+/**
+ * Reads at most `maxBytes` of a response, and says whether it stopped early. A body is
+ * whatever the far side chooses to send, so it is never read to the end on trust: the rest
+ * is cancelled, which lets go of the connection instead of holding it to the deadline.
+ */
+export async function readBounded(response, maxBytes) {
+    if (!response.body)
+        return { bytes: new Uint8Array(0), truncated: false };
+    const reader = response.body.getReader();
+    const chunks = [];
+    let size = 0;
+    let truncated = false;
+    try {
+        for (;;) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            if (!value?.byteLength)
+                continue;
+            // Reaching the limit exactly says nothing about whether the body ends there, so
+            // only the end of the stream, read after it, says the whole thing was read.
+            if (size >= maxBytes) {
+                truncated = true;
+                break;
+            }
+            chunks.push(value.subarray(0, maxBytes - size));
+            size += value.byteLength;
+            if (size > maxBytes) {
+                truncated = true;
+                break;
+            }
+        }
+    }
+    finally {
+        await reader.cancel().catch(() => { });
+    }
+    const bytes = new Uint8Array(Math.min(size, maxBytes));
+    let at = 0;
+    for (const chunk of chunks) {
+        bytes.set(chunk, at);
+        at += chunk.byteLength;
+    }
+    return { bytes, truncated };
+}
+/** Lets go of a body nobody started reading. One already read has been let go of. */
+export async function discard(response) {
+    if (response.body && !response.body.locked)
+        await response.body.cancel().catch(() => { });
+}

package/dist/server/copy.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Puts a copy button on every block the page asks the holder to reproduce exactly. The
+ * button is made here rather than written into the page, so a reader with no scripting is
+ * never shown a control that does nothing: without this the block is still selectable text.
+ *
+ * Served as a file because these pages allow no inline scripts.
+ */
+export declare const copyScript = "for (const block of document.querySelectorAll('pre')) {\n  const code = block.querySelector('code');\n\n  if (!code) continue;\n\n  const button = document.createElement('button');\n\n  button.type = 'button';\n  button.className = 'copy';\n  button.textContent = 'Copy';\n  button.setAttribute('aria-live', 'polite');\n\n  button.addEventListener('click', async () => {\n    try {\n      await navigator.clipboard.writeText(code.textContent);\n      button.textContent = 'Copied';\n    } catch {\n      // No clipboard permission, or an insecure origin. Select it instead, which leaves\n      // the holder one keystroke away rather than telling them it worked when it did not.\n      // The label stays short so the button never grows over the line it sits on.\n      const range = document.createRange();\n      const selection = getSelection();\n\n      range.selectNodeContents(code);\n      selection.removeAllRanges();\n      selection.addRange(range);\n      button.textContent = 'Selected';\n    }\n\n    setTimeout(() => (button.textContent = 'Copy'), 2000);\n  });\n\n  block.prepend(button);\n}\n";

package/dist/server/copy.js

@@ -0,0 +1,42 @@
+/**
+ * Puts a copy button on every block the page asks the holder to reproduce exactly. The
+ * button is made here rather than written into the page, so a reader with no scripting is
+ * never shown a control that does nothing: without this the block is still selectable text.
+ *
+ * Served as a file because these pages allow no inline scripts.
+ */
+export const copyScript = `for (const block of document.querySelectorAll('pre')) {
+  const code = block.querySelector('code');
+
+  if (!code) continue;
+
+  const button = document.createElement('button');
+
+  button.type = 'button';
+  button.className = 'copy';
+  button.textContent = 'Copy';
+  button.setAttribute('aria-live', 'polite');
+
+  button.addEventListener('click', async () => {
+    try {
+      await navigator.clipboard.writeText(code.textContent);
+      button.textContent = 'Copied';
+    } catch {
+      // No clipboard permission, or an insecure origin. Select it instead, which leaves
+      // the holder one keystroke away rather than telling them it worked when it did not.
+      // The label stays short so the button never grows over the line it sits on.
+      const range = document.createRange();
+      const selection = getSelection();
+
+      range.selectNodeContents(code);
+      selection.removeAllRanges();
+      selection.addRange(range);
+      button.textContent = 'Selected';
+    }
+
+    setTimeout(() => (button.textContent = 'Copy'), 2000);
+  });
+
+  block.prepend(button);
+}
+`;

package/dist/server/discord.d.ts

@@ -0,0 +1,7 @@
+import type { RedirectProvider } from '../core/index.js';
+/** Discord OAuth2 app, PKCE S256, `identify` scope only. Tokens are never persisted. */
+export declare function discordProvider(options: {
+    clientId: string;
+    clientSecret: string;
+    fetch?: typeof fetch;
+}): RedirectProvider;

package/dist/server/discord.js

@@ -0,0 +1,69 @@
+/** Discord OAuth2 app, PKCE S256, `identify` scope only. Tokens are never persisted. */
+export function discordProvider(options) {
+    if (!options.clientId || !options.clientSecret)
+        throw new Error('Discord credentials required');
+    const request = options.fetch ?? fetch;
+    return {
+        id: 'discord',
+        name: 'Discord',
+        method: 'oauth',
+        authorizationUrl({ state, challenge, redirectUri }) {
+            const url = new URL('https://discord.com/oauth2/authorize');
+            // Discord has no account chooser. Forcing the consent screen at least shows the holder
+            // which account they are signed in as before it is linked.
+            url.search = new URLSearchParams({
+                response_type: 'code',
+                client_id: options.clientId,
+                redirect_uri: redirectUri,
+                state,
+                code_challenge: challenge,
+                code_challenge_method: 'S256',
+                scope: 'identify',
+                prompt: 'consent',
+            }).toString();
+            return url.href;
+        },
+        async authenticate({ code, verifier, redirectUri }) {
+            const response = await request('https://discord.com/api/oauth2/token', {
+                method: 'POST',
+                headers: { Accept: 'application/json' },
+                signal: AbortSignal.timeout(15000),
+                body: new URLSearchParams({
+                    grant_type: 'authorization_code',
+                    client_id: options.clientId,
+                    client_secret: options.clientSecret,
+                    code,
+                    code_verifier: verifier,
+                    redirect_uri: redirectUri,
+                }),
+            });
+            const token = await response.json();
+            if (!response.ok || !isRecord(token) || typeof token.access_token !== 'string' || token.error)
+                throw new Error('Provider authentication failed');
+            const identity = await request('https://discord.com/api/v10/users/@me', {
+                headers: { Authorization: `Bearer ${token.access_token}`, Accept: 'application/json' },
+                signal: AbortSignal.timeout(15000),
+            });
+            const user = await identity.json();
+            // The snowflake is the stable id; usernames can be changed and then taken by someone
+            // else. Only the current unique usernames are accepted: an account still on a legacy
+            // name#1234 has a name that is not unique by itself and cannot be written as a handle.
+            if (!identity.ok ||
+                !isRecord(user) ||
+                typeof user.id !== 'string' ||
+                !/^[1-9][0-9]{0,19}$/.test(user.id) ||
+                typeof user.username !== 'string' ||
+                !/^[a-z0-9_.]{2,32}$/.test(user.username) ||
+                (user.discriminator !== undefined && user.discriminator !== '0'))
+                throw new Error('Invalid provider identity');
+            return {
+                id: user.id,
+                handle: user.username,
+                profileUrl: `https://discord.com/users/${user.id}`,
+            };
+        },
+    };
+}
+function isRecord(value) {
+    return typeof value === 'object' && value !== null;
+}

package/dist/server/email-logo.d.ts

@@ -0,0 +1,11 @@
+/**
+ * The Verily logotype on its plate, as a PNG, for mail. A message cannot draw the logotype
+ * the way a page does: the clients most people read mail in strip an inline SVG. So it
+ * travels inside the message as an image of its own, which is shown without anything
+ * being fetched.
+ *
+ * This is docs/design/verily-logo-plate.svg drawn at 281 by 120, three times the 94 by 40
+ * it is shown at, with the plate's corners left transparent. Regenerate it from that file
+ * if the logotype changes.
+ */
+export declare const emailLogo: string;