@c9up/transit 0.1.0

package/dist/Oauth2Driver.js

@@ -0,0 +1,196 @@
+/**
+ * The half of an OAuth2 sign-in every provider shares.
+ *
+ * Each provider differs in three places — where you send the user, where the
+ * code is exchanged, and what the profile payload is called — and agrees on
+ * everything else. This holds the everything else, so a driver is the three
+ * URLs, the default scopes, and the mapping from that provider's payload to
+ * {@link TransitUser}.
+ *
+ * Nothing here is stateful: the `state` and, where a provider requires it, the
+ * PKCE verifier are passed in and handed back by the caller. Warden does not
+ * own your session, so it cannot store them for you — and that is also what
+ * lets one driver serve several concurrent sign-ins.
+ */
+import { createHash, randomBytes, randomUUID } from "node:crypto";
+import { assertOAuthState } from "./types.js";
+/**
+ * Mint a PKCE code verifier.
+ *
+ * Store it next to the `state` — the same place, with the same lifetime — and
+ * hand it back to `callback()`. A provider that requires PKCE binds the
+ * authorization code to this value, so a code intercepted on its way back is
+ * useless to whoever intercepted it.
+ */
+export function createCodeVerifier() {
+    // 32 bytes of entropy, base64url — 43 characters, the shortest length
+    // RFC 7636 allows, and the length every provider accepts.
+    return randomBytes(32).toString("base64url");
+}
+export class Oauth2Driver {
+    config;
+    /**
+     * Providers that require PKCE. The redirect then refuses to build without
+     * a verifier rather than sending the user to a URL the provider rejects.
+     */
+    requiresPkce = false;
+    /**
+     * Send the client credentials as HTTP Basic on the token request instead of
+     * in the body. A handful of providers accept nothing else.
+     */
+    tokenAuth = "body";
+    constructor(config) {
+        this.config = config;
+    }
+    /** Extra parameters this provider wants on the authorize URL. */
+    authorizeParams() {
+        return {};
+    }
+    /** Extra query parameters this provider wants on the profile request. */
+    userInfoParams() {
+        return {};
+    }
+    scopes() {
+        return [...(this.config.scopes ?? this.defaultScopes)];
+    }
+    redirectUrl(state, secret) {
+        const params = new URLSearchParams({
+            client_id: this.config.clientId,
+            redirect_uri: this.config.callbackUrl,
+            response_type: "code",
+            scope: this.scopes().join(" "),
+            ...this.authorizeParams(),
+            ...this.config.authorizeParams,
+            ...(state ? { state } : {}),
+        });
+        if (this.requiresPkce) {
+            if (!secret) {
+                throw new Error(`[transit] ${this.provider} requires PKCE: pass the code verifier from createCodeVerifier() to redirectUrl(), store it with the state, and hand it back to callback().`);
+            }
+            params.set("code_challenge", challengeFor(secret));
+            params.set("code_challenge_method", "S256");
+        }
+        return `${this.authorizeUrl}?${params}`;
+    }
+    /**
+     * Where to send the user, plus what has to be kept until they come back.
+     * The state is minted here when the caller has no reason to choose one,
+     * and a provider requiring PKCE gets its verifier without the caller
+     * having to know it needed one.
+     */
+    async begin(state = randomUUID()) {
+        if (!this.requiresPkce)
+            return { url: this.redirectUrl(state), state };
+        const secret = createCodeVerifier();
+        return { url: this.redirectUrl(state, secret), state, secret };
+    }
+    async callback(code, state, expectedState, secret) {
+        assertOAuthState(state, expectedState);
+        if (this.requiresPkce && !secret) {
+            throw new Error(`[transit] ${this.provider} requires PKCE: pass back the code verifier you stored at redirect time.`);
+        }
+        const tokens = await this.exchange(code, secret);
+        const accessToken = String(tokens.access_token);
+        const user = await this.fetchUser(accessToken);
+        return { user, token: readToken(tokens, accessToken) };
+    }
+    /**
+     * Read the profile behind a token you already hold, with no code to
+     * exchange — a refreshed token, or one a mobile client obtained itself.
+     */
+    async userFromToken(accessToken) {
+        return this.fetchUser(accessToken);
+    }
+    /** Trade the authorization code for an access token. */
+    async exchange(code, secret) {
+        const body = new URLSearchParams({
+            code,
+            redirect_uri: this.config.callbackUrl,
+            grant_type: "authorization_code",
+            ...(secret ? { code_verifier: secret } : {}),
+        });
+        const headers = {
+            Accept: "application/json",
+            "Content-Type": "application/x-www-form-urlencoded",
+        };
+        if (this.tokenAuth === "basic") {
+            const credentials = Buffer.from(`${this.config.clientId}:${this.config.clientSecret}`).toString("base64");
+            headers.Authorization = `Basic ${credentials}`;
+            // Sending them twice is what makes some providers reject the request
+            // outright, so the body carries them only in the other mode.
+            body.set("client_id", this.config.clientId);
+        }
+        else {
+            body.set("client_id", this.config.clientId);
+            body.set("client_secret", this.config.clientSecret);
+        }
+        const response = await fetch(this.accessTokenUrl, {
+            method: "POST",
+            headers,
+            body,
+        });
+        if (!response.ok) {
+            throw new Error(`${this.provider} OAuth token exchange failed (HTTP ${response.status})`);
+        }
+        const tokens = (await response.json());
+        if (!tokens.access_token) {
+            throw new Error(`${this.provider} OAuth: no access_token in response`);
+        }
+        return tokens;
+    }
+    /** Read the profile. Providers needing a second call override this. */
+    async fetchUser(accessToken) {
+        const raw = await this.get(this.userInfoUrl, accessToken, {
+            ...this.userInfoParams(),
+        });
+        return this.mapUser(raw);
+    }
+    /** An authenticated GET returning a JSON array — some endpoints answer one. */
+    async getList(url, accessToken, params = {}) {
+        const body = await this.#requestJson(url, accessToken, params);
+        return Array.isArray(body) ? body : [];
+    }
+    /** An authenticated GET returning the decoded JSON body. */
+    async get(url, accessToken, params = {}) {
+        const body = await this.#requestJson(url, accessToken, params);
+        return typeof body === "object" && body !== null && !Array.isArray(body)
+            ? body
+            : {};
+    }
+    /** The authenticated GET itself, before anything is assumed of the body. */
+    async #requestJson(url, accessToken, params = {}) {
+        const query = new URLSearchParams(params).toString();
+        const response = await fetch(query ? `${url}?${query}` : url, {
+            headers: {
+                Authorization: `Bearer ${accessToken}`,
+                Accept: "application/json",
+            },
+        });
+        if (!response.ok) {
+            throw new Error(`${this.provider} profile request failed (HTTP ${response.status})`);
+        }
+        return await response.json();
+    }
+}
+/** The S256 challenge a provider compares the verifier against. */
+export function challengeFor(secret) {
+    return createHash("sha256").update(secret).digest("base64url");
+}
+/** Narrow a provider's token payload to the fields Warden promises. */
+function readToken(tokens, accessToken) {
+    return {
+        accessToken,
+        ...(typeof tokens.refresh_token === "string"
+            ? { refreshToken: tokens.refresh_token }
+            : {}),
+        ...(typeof tokens.expires_in === "number"
+            ? { expiresIn: tokens.expires_in }
+            : {}),
+    };
+}
+/** Read a string field, or `undefined` when it is absent or not a string. */
+export function str(raw, key) {
+    const value = raw[key];
+    return typeof value === "string" && value !== "" ? value : undefined;
+}
+//# sourceMappingURL=Oauth2Driver.js.map

package/dist/Oauth2Driver.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Oauth2Driver.js","sourceRoot":"","sources":["../src/Oauth2Driver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAQlE,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAK9C;;;;;;;GAOG;AACH,MAAM,UAAU,kBAAkB;IACjC,sEAAsE;IACtE,0DAA0D;IAC1D,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,OAAgB,YAAY;IAwBF;IAZ/B;;;OAGG;IACgB,YAAY,GAAY,KAAK,CAAC;IAEjD;;;OAGG;IACgB,SAAS,GAAqB,MAAM,CAAC;IAExD,YAA+B,MAAmB;QAAnB,WAAM,GAAN,MAAM,CAAa;IAAG,CAAC;IAEtD,iEAAiE;IACvD,eAAe;QACxB,OAAO,EAAE,CAAC;IACX,CAAC;IAED,yEAAyE;IAC/D,cAAc;QACvB,OAAO,EAAE,CAAC;IACX,CAAC;IAKD,MAAM;QACL,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;IACxD,CAAC;IAED,WAAW,CAAC,KAAc,EAAE,MAAe;QAC1C,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ;YAC/B,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC;YAC9B,GAAG,IAAI,CAAC,eAAe,EAAE;YACzB,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe;YAC9B,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3B,CAAC,CAAC;QAEH,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,6IAA6I,CACvK,CAAC;YACH,CAAC;YACD,MAAM,CAAC,GAAG,CAAC,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACnD,MAAM,CAAC,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,CAAC;QAC7C,CAAC;QAED,OAAO,GAAG,IAAI,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;IACzC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,KAAK,CAAC,QAAgB,UAAU,EAAE;QACvC,IAAI,CAAC,IAAI,CAAC,YAAY;YAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;QACvE,MAAM,MAAM,GAAG,kBAAkB,EAAE,CAAC;QACpC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChE,CAAC;IAED,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,gBAAgB,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QACvC,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC;YAClC,MAAM,IAAI,KAAK,CACd,aAAa,IAAI,CAAC,QAAQ,0EAA0E,CACpG,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAChD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,CAAC;IACxD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAC,WAAmB;QACtC,OAAO,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;IACpC,CAAC;IAED,wDAAwD;IAC9C,KAAK,CAAC,QAAQ,CACvB,IAAY,EACZ,MAAe;QAEf,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;YAChC,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YACrC,UAAU,EAAE,oBAAoB;YAChC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5C,CAAC,CAAC;QACH,MAAM,OAAO,GAA2B;YACvC,MAAM,EAAE,kBAAkB;YAC1B,cAAc,EAAE,mCAAmC;SACnD,CAAC;QAEF,IAAI,IAAI,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;YAChC,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAC9B,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CACrD,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACrB,OAAO,CAAC,aAAa,GAAG,SAAS,WAAW,EAAE,CAAC;YAC/C,qEAAqE;YACrE,6DAA6D;YAC7D,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,cAAc,EAAE;YACjD,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI;SACJ,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,sCAAsC,QAAQ,CAAC,MAAM,GAAG,CACxE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAkB,CAAC;QACxD,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,MAAM,CAAC;IACf,CAAC;IAED,uEAAuE;IAC7D,KAAK,CAAC,SAAS,CAAC,WAAmB;QAC5C,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,EAAE;YACzD,GAAG,IAAI,CAAC,cAAc,EAAE;SACxB,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED,+EAA+E;IACrE,KAAK,CAAC,OAAO,CACtB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACxC,CAAC;IAED,4DAA4D;IAClD,KAAK,CAAC,GAAG,CAClB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACvE,CAAC,CAAE,IAAgC;YACnC,CAAC,CAAC,EAAE,CAAC;IACP,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,YAAY,CACjB,GAAW,EACX,WAAmB,EACnB,SAAiC,EAAE;QAEnC,MAAM,KAAK,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE,CAAC;QACrD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;YAC7D,OAAO,EAAE;gBACR,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC1B;SACD,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,KAAK,CACd,GAAG,IAAI,CAAC,QAAQ,iCAAiC,QAAQ,CAAC,MAAM,GAAG,CACnE,CAAC;QACH,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9B,CAAC;CACD;AAED,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,MAAc;IAC1C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AAChE,CAAC;AAED,uEAAuE;AACvE,SAAS,SAAS,CAAC,MAAqB,EAAE,WAAmB;IAC5D,OAAO;QACN,WAAW;QACX,GAAG,CAAC,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ;YAC3C,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE;YACxC,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;YACxC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,UAAU,EAAE;YAClC,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,GAAG,CAClB,GAA4B,EAC5B,GAAW;IAEX,MAAM,KAAK,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC"}

package/dist/TransitManager.d.ts

@@ -0,0 +1,59 @@
+/**
+ * The providers an application signs people in through, keyed by the names its
+ * config chose.
+ *
+ *   const { url, state, secret } = await transit.begin('google')
+ *   const { user } = await transit.callback('google', code, state, expected, secret)
+ *
+ * The key is the caller's: two entries may speak to the same provider with
+ * different credentials, and `use(name)` asks for the key, not the protocol.
+ */
+import type { DirectoryDriver, OAuthToken, RedirectRequest, TransitDriver, TransitEntry, TransitUser } from "./types.js";
+export declare class TransitManager {
+    #private;
+    /** The provider a browser is sent to, under `name`. */
+    use(name: string): TransitDriver;
+    /** The directory under `name`. */
+    directory(name: string): DirectoryDriver;
+    /**
+     * Verify a login against the directory under `name`.
+     *
+     * No redirect and no state: the application already holds the credentials,
+     * and the directory is the authority that says whether they are right.
+     */
+    authenticate(name: string, username: string, password: string): Promise<TransitUser>;
+    register(name: string, driver: TransitEntry): void;
+    /**
+     * Where to send the user, plus what to keep until they come back.
+     *
+     * This is the path that works for every provider: it mints the state,
+     * fetches a request token where the protocol needs one, and returns the
+     * secret to store when there is one.
+     */
+    begin(name: string, state?: string): Promise<RedirectRequest>;
+    /**
+     * Where to send the user, when the provider can say so offline. `secret`
+     * is only read by providers that require PKCE — mint one with
+     * `createCodeVerifier()` and store it beside the state.
+     *
+     * An OAuth1 provider cannot answer here; call {@link begin} instead.
+     */
+    redirect(name: string, state?: string, secret?: string): string;
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    callback(name: string, code: string, state?: string, expectedState?: string, secret?: string): Promise<{
+        user: TransitUser;
+        token: OAuthToken;
+    }>;
+    /**
+     * Read the profile behind a token already held, through the named provider.
+     * Throws when that driver has no way to — rather than answering with a
+     * profile it did not fetch.
+     */
+    userFromToken(name: string, accessToken: string, tokenSecret?: string): Promise<TransitUser>;
+    get registeredDrivers(): string[];
+}
+//# sourceMappingURL=TransitManager.d.ts.map

package/dist/TransitManager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TransitManager.d.ts","sourceRoot":"","sources":["../src/TransitManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EACX,eAAe,EACf,UAAU,EACV,eAAe,EACf,aAAa,EACb,YAAY,EACZ,WAAW,EACX,MAAM,YAAY,CAAC;AAGpB,qBAAa,cAAc;;IAG1B,uDAAuD;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa;IAUhC,kCAAkC;IAClC,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe;IAUxC;;;;;OAKG;IACG,YAAY,CACjB,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,CAAC;IAavB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,IAAI;IAIlD;;;;;;OAMG;IACG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC;IAUnE;;;;;;OAMG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM;IAI/D;;;;OAIG;IACG,QAAQ,CACb,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,EACZ,KAAK,CAAC,EAAE,MAAM,EACd,aAAa,CAAC,EAAE,MAAM,EACtB,MAAM,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,IAAI,EAAE,WAAW,CAAC;QAAC,KAAK,EAAE,UAAU,CAAA;KAAE,CAAC;IAUpD;;;;OAIG;IACG,aAAa,CAClB,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,WAAW,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,WAAW,CAAC;IAUvB,IAAI,iBAAiB,IAAI,MAAM,EAAE,CAEhC;CACD"}

package/dist/TransitManager.js

@@ -0,0 +1,100 @@
+/**
+ * The providers an application signs people in through, keyed by the names its
+ * config chose.
+ *
+ *   const { url, state, secret } = await transit.begin('google')
+ *   const { user } = await transit.callback('google', code, state, expected, secret)
+ *
+ * The key is the caller's: two entries may speak to the same provider with
+ * different credentials, and `use(name)` asks for the key, not the protocol.
+ */
+import { isDirectory } from "./types.js";
+export class TransitManager {
+    #drivers = new Map();
+    /** The provider a browser is sent to, under `name`. */
+    use(name) {
+        const entry = this.#entry(name);
+        if (isDirectory(entry)) {
+            throw new Error(`[transit] '${name}' is a directory: it verifies credentials rather than redirecting. Use authenticate('${name}', …).`);
+        }
+        return entry;
+    }
+    /** The directory under `name`. */
+    directory(name) {
+        const entry = this.#entry(name);
+        if (!isDirectory(entry)) {
+            throw new Error(`[transit] '${name}' is a redirect provider, not a directory. Use begin('${name}').`);
+        }
+        return entry;
+    }
+    /**
+     * Verify a login against the directory under `name`.
+     *
+     * No redirect and no state: the application already holds the credentials,
+     * and the directory is the authority that says whether they are right.
+     */
+    async authenticate(name, username, password) {
+        return this.directory(name).authenticate(username, password);
+    }
+    #entry(name) {
+        const driver = this.#drivers.get(name);
+        if (!driver)
+            throw new Error(`OAuth driver '${name}' not registered. Available: ${[...this.#drivers.keys()].join(", ")}`);
+        return driver;
+    }
+    register(name, driver) {
+        this.#drivers.set(name, driver);
+    }
+    /**
+     * Where to send the user, plus what to keep until they come back.
+     *
+     * This is the path that works for every provider: it mints the state,
+     * fetches a request token where the protocol needs one, and returns the
+     * secret to store when there is one.
+     */
+    async begin(name, state) {
+        const driver = this.use(name);
+        if (typeof driver.begin !== "function") {
+            throw new Error(`[transit] The '${name}' driver does not support begin(); use redirect().`);
+        }
+        return driver.begin(state);
+    }
+    /**
+     * Where to send the user, when the provider can say so offline. `secret`
+     * is only read by providers that require PKCE — mint one with
+     * `createCodeVerifier()` and store it beside the state.
+     *
+     * An OAuth1 provider cannot answer here; call {@link begin} instead.
+     */
+    redirect(name, state, secret) {
+        return this.use(name).redirectUrl(state, secret);
+    }
+    /**
+     * Handle the OAuth callback. Pass `state` (from the query string) and
+     * `expectedState` (from the session, stored at redirect time) for CSRF
+     * protection. Omitting `expectedState` logs a security warning.
+     */
+    async callback(name, code, state, expectedState, secret) {
+        if (!expectedState) {
+            throw new Error(`[transit] OAuth callback for '${name}' requires expectedState for CSRF protection. ` +
+                `Store the state from redirect() in the session and pass it here.`);
+        }
+        return this.use(name).callback(code, state, expectedState, secret);
+    }
+    /**
+     * Read the profile behind a token already held, through the named provider.
+     * Throws when that driver has no way to — rather than answering with a
+     * profile it did not fetch.
+     */
+    async userFromToken(name, accessToken, tokenSecret) {
+        const driver = this.use(name);
+        if (typeof driver.userFromToken !== "function") {
+            throw new Error(`[transit] The '${name}' driver cannot read a profile from an existing token.`);
+        }
+        return driver.userFromToken(accessToken, tokenSecret);
+    }
+    get registeredDrivers() {
+        return [...this.#drivers.keys()];
+    }
+}
+//# sourceMappingURL=TransitManager.js.map

package/dist/TransitManager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TransitManager.js","sourceRoot":"","sources":["../src/TransitManager.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAUH,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEzC,MAAM,OAAO,cAAc;IAC1B,QAAQ,GAA8B,IAAI,GAAG,EAAE,CAAC;IAEhD,uDAAuD;IACvD,GAAG,CAAC,IAAY;QACf,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,wFAAwF,IAAI,QAAQ,CACtH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED,kCAAkC;IAClC,SAAS,CAAC,IAAY;QACrB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,KAAK,CACd,cAAc,IAAI,yDAAyD,IAAI,KAAK,CACpF,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CACjB,IAAY,EACZ,QAAgB,EAChB,QAAgB;QAEhB,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC9D,CAAC;IAED,MAAM,CAAC,IAAY;QAClB,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,MAAM;YACV,MAAM,IAAI,KAAK,CACd,iBAAiB,IAAI,gCAAgC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;QACH,OAAO,MAAM,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,IAAY,EAAE,MAAoB;QAC1C,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,KAAK,CAAC,IAAY,EAAE,KAAc;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CACd,kBAAkB,IAAI,oDAAoD,CAC1E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAED;;;;;;OAMG;IACH,QAAQ,CAAC,IAAY,EAAE,KAAc,EAAE,MAAe;QACrD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CACb,IAAY,EACZ,IAAY,EACZ,KAAc,EACd,aAAsB,EACtB,MAAe;QAEf,IAAI,CAAC,aAAa,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,iCAAiC,IAAI,gDAAgD;gBACpF,kEAAkE,CACnE,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAClB,IAAY,EACZ,WAAmB,EACnB,WAAoB;QAEpB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC9B,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,UAAU,EAAE,CAAC;YAChD,MAAM,IAAI,KAAK,CACd,kBAAkB,IAAI,wDAAwD,CAC9E,CAAC;QACH,CAAC;QACD,OAAO,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,iBAAiB;QACpB,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;CACD"}

package/dist/TransitProvider.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Wires `config/transit.ts` into the container.
+ *
+ * Transit does not import `@c9up/ream`: the slice of the host it needs is
+ * duck-typed below, which is what keeps the package publishable on its own and
+ * usable from a host that is not Ream.
+ */
+interface TransitContainer {
+    singleton(token: unknown, factory: () => unknown): void;
+    resolve<T = unknown>(token: unknown): Promise<T>;
+}
+interface TransitConfigStore {
+    get<T = unknown>(key: string): T | undefined;
+}
+export interface TransitAppContext {
+    container: TransitContainer;
+    config: TransitConfigStore;
+}
+export default class TransitProvider {
+    protected app: TransitAppContext;
+    constructor(app: TransitAppContext);
+    register(): void;
+    boot(): Promise<void>;
+}
+export {};
+//# sourceMappingURL=TransitProvider.d.ts.map

package/dist/TransitProvider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TransitProvider.d.ts","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,UAAU,gBAAgB;IACzB,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC;IACxD,OAAO,CAAC,CAAC,GAAG,OAAO,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CACjD;AAED,UAAU,kBAAkB;IAC3B,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,EAAE,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC;CAC7C;AAED,MAAM,WAAW,iBAAiB;IACjC,SAAS,EAAE,gBAAgB,CAAC;IAC5B,MAAM,EAAE,kBAAkB,CAAC;CAC3B;AAED,MAAM,CAAC,OAAO,OAAO,eAAe;IACvB,SAAS,CAAC,GAAG,EAAE,iBAAiB;gBAAtB,GAAG,EAAE,iBAAiB;IAE5C,QAAQ,IAAI,IAAI;IAgBV,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC;CAK3B"}

package/dist/TransitProvider.js

@@ -0,0 +1,32 @@
+/**
+ * Wires `config/transit.ts` into the container.
+ *
+ * Transit does not import `@c9up/ream`: the slice of the host it needs is
+ * duck-typed below, which is what keeps the package publishable on its own and
+ * usable from a host that is not Ream.
+ */
+import { setTransit } from "./services/main.js";
+import { TransitManager } from "./TransitManager.js";
+export default class TransitProvider {
+    app;
+    constructor(app) {
+        this.app = app;
+    }
+    register() {
+        this.app.container.singleton(TransitManager, () => {
+            const config = this.app.config.get("transit") ?? {};
+            const manager = new TransitManager();
+            for (const [name, entry] of Object.entries(config)) {
+                manager.register(name, typeof entry === "function" ? entry() : entry);
+            }
+            return manager;
+        });
+        // String alias, so a consumer that cannot import Transit still resolves
+        // it — the same convention the other providers follow.
+        this.app.container.singleton("transit", () => this.app.container.resolve(TransitManager));
+    }
+    async boot() {
+        setTransit(await this.app.container.resolve(TransitManager));
+    }
+}
+//# sourceMappingURL=TransitProvider.js.map

package/dist/TransitProvider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TransitProvider.js","sourceRoot":"","sources":["../src/TransitProvider.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAChD,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAgBrD,MAAM,CAAC,OAAO,OAAO,eAAe;IACb;IAAtB,YAAsB,GAAsB;QAAtB,QAAG,GAAH,GAAG,CAAmB;IAAG,CAAC;IAEhD,QAAQ;QACP,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,cAAc,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAgB,SAAS,CAAC,IAAI,EAAE,CAAC;YACnE,MAAM,OAAO,GAAG,IAAI,cAAc,EAAE,CAAC;YACrC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;gBACpD,OAAO,CAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,OAAO,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,wEAAwE;QACxE,uDAAuD;QACvD,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,SAAS,EAAE,GAAG,EAAE,CAC5C,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAiB,cAAc,CAAC,CAC1D,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACT,UAAU,CACT,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAiB,cAAc,CAAC,CAChE,CAAC;IACH,CAAC;CACD"}

package/dist/apple.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The two things Sign in with Apple does differently from every other OpenID
+ * Connect provider.
+ *
+ * Apple has no client secret. It has a private key, and expects a short-lived
+ * JWT minted from it on every token request — which is why `clientSecret` is
+ * allowed to be a function.
+ *
+ * And it sends the user's name exactly ONCE, in the body of the first consent
+ * callback, never in a token and never again. An application that does not
+ * store it then has no way to ask for it later.
+ */
+export interface AppleKey {
+    /** The Services ID (web) or App ID this signs for. */
+    clientId: string;
+    /** The ten-character Team ID from the developer account. */
+    teamId: string;
+    /** The Key ID of the .p8 this signs with. */
+    keyId: string;
+    /** The contents of the .p8 file, PEM as Apple issues it. */
+    privateKey: string;
+}
+/**
+ * Mint the JWT Apple takes in place of a client secret.
+ *
+ * Signed ES256 with the .p8, naming the team as issuer and the client as
+ * subject. Minted per request rather than cached: it costs one signature, and
+ * a long-lived one is a credential sitting in memory for no reason.
+ */
+export declare function appleClientSecret(key: AppleKey, now?: number): string;
+/**
+ * Read the `user` field of Apple's first consent callback.
+ *
+ * It arrives as JSON in the POST body, on that one request only. Store what
+ * comes out — the id_token never carries a name, and a second sign-in by the
+ * same person will not carry one either.
+ *
+ * Returns `undefined` for anything unreadable rather than throwing: a returning
+ * user simply has no `user` field, and that is the normal case.
+ */
+export declare function parseAppleUser(value: unknown): {
+    name?: string;
+    email?: string;
+} | undefined;
+//# sourceMappingURL=apple.d.ts.map

package/dist/apple.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.d.ts","sourceRoot":"","sources":["../src/apple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,MAAM,WAAW,QAAQ;IACxB,sDAAsD;IACtD,QAAQ,EAAE,MAAM,CAAC;IACjB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAC;IACf,6CAA6C;IAC7C,KAAK,EAAE,MAAM,CAAC;IACd,4DAA4D;IAC5D,UAAU,EAAE,MAAM,CAAC;CACnB;AAKD;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAChC,GAAG,EAAE,QAAQ,EACb,GAAG,GAAE,MAAsC,GACzC,MAAM,CAkBR;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC7B,KAAK,EAAE,OAAO,GACZ;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAyB/C"}

package/dist/apple.js

@@ -0,0 +1,80 @@
+/**
+ * The two things Sign in with Apple does differently from every other OpenID
+ * Connect provider.
+ *
+ * Apple has no client secret. It has a private key, and expects a short-lived
+ * JWT minted from it on every token request — which is why `clientSecret` is
+ * allowed to be a function.
+ *
+ * And it sends the user's name exactly ONCE, in the body of the first consent
+ * callback, never in a token and never again. An application that does not
+ * store it then has no way to ask for it later.
+ */
+import { createPrivateKey, sign as signData } from "node:crypto";
+/** Apple rejects a secret valid for more than six months; minutes are plenty. */
+const LIFETIME_SECONDS = 300;
+/**
+ * Mint the JWT Apple takes in place of a client secret.
+ *
+ * Signed ES256 with the .p8, naming the team as issuer and the client as
+ * subject. Minted per request rather than cached: it costs one signature, and
+ * a long-lived one is a credential sitting in memory for no reason.
+ */
+export function appleClientSecret(key, now = Math.floor(Date.now() / 1000)) {
+    const header = { alg: "ES256", kid: key.keyId, typ: "JWT" };
+    const claims = {
+        iss: key.teamId,
+        iat: now,
+        exp: now + LIFETIME_SECONDS,
+        aud: "https://appleid.apple.com",
+        sub: key.clientId,
+    };
+    const signingInput = `${b64(header)}.${b64(claims)}`;
+    // JOSE wants R concatenated with S; node emits DER unless told, and Apple
+    // rejects DER.
+    const signature = signData("sha256", Buffer.from(signingInput, "ascii"), {
+        key: createPrivateKey(key.privateKey),
+        dsaEncoding: "ieee-p1363",
+    });
+    return `${signingInput}.${signature.toString("base64url")}`;
+}
+/**
+ * Read the `user` field of Apple's first consent callback.
+ *
+ * It arrives as JSON in the POST body, on that one request only. Store what
+ * comes out — the id_token never carries a name, and a second sign-in by the
+ * same person will not carry one either.
+ *
+ * Returns `undefined` for anything unreadable rather than throwing: a returning
+ * user simply has no `user` field, and that is the normal case.
+ */
+export function parseAppleUser(value) {
+    if (typeof value !== "string" || value === "")
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(value);
+    }
+    catch {
+        return undefined;
+    }
+    if (typeof parsed !== "object" || parsed === null)
+        return undefined;
+    const email = Reflect.get(parsed, "email");
+    const rawName = Reflect.get(parsed, "name");
+    const name = typeof rawName === "object" && rawName !== null
+        ? [Reflect.get(rawName, "firstName"), Reflect.get(rawName, "lastName")]
+            .filter((part) => typeof part === "string" && part !== "")
+            .join(" ")
+        : undefined;
+    const out = {};
+    if (name)
+        out.name = name;
+    if (typeof email === "string" && email !== "")
+        out.email = email;
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+function b64(value) {
+    return Buffer.from(JSON.stringify(value)).toString("base64url");
+}
+//# sourceMappingURL=apple.js.map

package/dist/apple.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"apple.js","sourceRoot":"","sources":["../src/apple.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,gBAAgB,EAAE,IAAI,IAAI,QAAQ,EAAE,MAAM,aAAa,CAAC;AAajE,iFAAiF;AACjF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAChC,GAAa,EACb,MAAc,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAE3C,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC5D,MAAM,MAAM,GAAG;QACd,GAAG,EAAE,GAAG,CAAC,MAAM;QACf,GAAG,EAAE,GAAG;QACR,GAAG,EAAE,GAAG,GAAG,gBAAgB;QAC3B,GAAG,EAAE,2BAA2B;QAChC,GAAG,EAAE,GAAG,CAAC,QAAQ;KACjB,CAAC;IAEF,MAAM,YAAY,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IACrD,0EAA0E;IAC1E,eAAe;IACf,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,EAAE;QACxE,GAAG,EAAE,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC;QACrC,WAAW,EAAE,YAAY;KACzB,CAAC,CAAC;IACH,OAAO,GAAG,YAAY,IAAI,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,cAAc,CAC7B,KAAc;IAEd,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAChE,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACJ,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAEpE,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,MAAM,IAAI,GACT,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAC9C,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,WAAW,CAAC,EAAE,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;aACpE,MAAM,CACN,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,EAAE,CACjE;aACA,IAAI,CAAC,GAAG,CAAC;QACZ,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,IAAI,IAAI;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE;QAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;IACjE,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACtD,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IAC1B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACjE,CAAC"}

package/dist/ber.d.ts

@@ -0,0 +1,50 @@
+/**
+ * The encoding LDAP speaks: BER, the subset of it LDAP actually uses.
+ *
+ * This exists so that nothing an application passes ever becomes part of a
+ * string that a server then parses. A search filter here is a structure, not
+ * text — its values are written as length-prefixed octets, so a username
+ * containing `)(uid=*` is a username containing those characters and cannot
+ * become syntax. LDAP injection is not escaped away here; it is unrepresentable.
+ */
+/** Universal tags, and the two LDAP builds everything else from. */
+export declare const BOOLEAN = 1;
+export declare const INTEGER = 2;
+export declare const OCTET_STRING = 4;
+export declare const ENUMERATED = 10;
+export declare const SEQUENCE = 48;
+/** `[APPLICATION n]`, constructed. */
+export declare const application: (n: number) => number;
+/** `[APPLICATION n]`, primitive — which a couple of LDAP operations are. */
+export declare const applicationPrimitive: (n: number) => number;
+/** `[n]` context-specific, constructed. */
+export declare const context: (n: number) => number;
+/** `[n]` context-specific, primitive. */
+export declare const contextPrimitive: (n: number) => number;
+export declare class BerError extends Error {
+    constructor(message: string);
+}
+/** One tag-length-value element. */
+export declare function encode(tag: number, value: Buffer): Buffer;
+export declare function encodeInteger(value: number, tag?: number): Buffer;
+export declare function encodeString(value: string, tag?: number): Buffer;
+export declare function encodeBoolean(value: boolean, tag?: number): Buffer;
+export declare function encodeSequence(parts: Buffer[], tag?: number): Buffer;
+/** A decoded element: its tag, its contents, and where it ended. */
+export interface BerElement {
+    tag: number;
+    value: Buffer;
+    end: number;
+}
+/** Read one element at `offset`. */
+export declare function decode(buffer: Buffer, offset?: number): BerElement;
+/** Every element inside a constructed one. */
+export declare function decodeSequence(value: Buffer): BerElement[];
+export declare function decodeInteger(value: Buffer): number;
+export declare function decodeString(value: Buffer): string;
+/**
+ * How many bytes a whole message occupies, or `undefined` while it is still
+ * arriving. LDAP runs over a stream, so a read can stop anywhere.
+ */
+export declare function messageLength(buffer: Buffer): number | undefined;
+//# sourceMappingURL=ber.d.ts.map

package/dist/ber.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ber.d.ts","sourceRoot":"","sources":["../src/ber.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oEAAoE;AACpE,eAAO,MAAM,OAAO,IAAO,CAAC;AAC5B,eAAO,MAAM,OAAO,IAAO,CAAC;AAC5B,eAAO,MAAM,YAAY,IAAO,CAAC;AACjC,eAAO,MAAM,UAAU,KAAO,CAAC;AAC/B,eAAO,MAAM,QAAQ,KAAO,CAAC;AAE7B,sCAAsC;AACtC,eAAO,MAAM,WAAW,GAAI,GAAG,MAAM,KAAG,MAAkB,CAAC;AAC3D,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,GAAI,GAAG,MAAM,KAAG,MAAkB,CAAC;AACpE,2CAA2C;AAC3C,eAAO,MAAM,OAAO,GAAI,GAAG,MAAM,KAAG,MAAkB,CAAC;AACvD,yCAAyC;AACzC,eAAO,MAAM,gBAAgB,GAAI,GAAG,MAAM,KAAG,MAAkB,CAAC;AAEhE,qBAAa,QAAS,SAAQ,KAAK;gBACtB,OAAO,EAAE,MAAM;CAI3B;AAED,oCAAoC;AACpC,wBAAgB,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAEzD;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAU,GAAG,MAAM,CAclE;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAe,GAAG,MAAM,CAItE;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,SAAU,GAAG,MAAM,CAEnE;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,SAAW,GAAG,MAAM,CAEtE;AAED,oEAAoE;AACpE,MAAM,WAAW,UAAU;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;CACZ;AAED,oCAAoC;AACpC,wBAAgB,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,SAAI,GAAG,UAAU,CAa7D;AAED,8CAA8C;AAC9C,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,EAAE,CAS1D;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CASnD;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAElD;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAchE"}