@c9up/transit 0.1.0

package/dist/ber.js

@@ -0,0 +1,156 @@
+/**
+ * The encoding LDAP speaks: BER, the subset of it LDAP actually uses.
+ *
+ * This exists so that nothing an application passes ever becomes part of a
+ * string that a server then parses. A search filter here is a structure, not
+ * text — its values are written as length-prefixed octets, so a username
+ * containing `)(uid=*` is a username containing those characters and cannot
+ * become syntax. LDAP injection is not escaped away here; it is unrepresentable.
+ */
+/** Universal tags, and the two LDAP builds everything else from. */
+export const BOOLEAN = 0x01;
+export const INTEGER = 0x02;
+export const OCTET_STRING = 0x04;
+export const ENUMERATED = 0x0a;
+export const SEQUENCE = 0x30;
+/** `[APPLICATION n]`, constructed. */
+export const application = (n) => 0x60 | n;
+/** `[APPLICATION n]`, primitive — which a couple of LDAP operations are. */
+export const applicationPrimitive = (n) => 0x40 | n;
+/** `[n]` context-specific, constructed. */
+export const context = (n) => 0xa0 | n;
+/** `[n]` context-specific, primitive. */
+export const contextPrimitive = (n) => 0x80 | n;
+export class BerError extends Error {
+    constructor(message) {
+        super(`[transit] ${message}`);
+        this.name = "BerError";
+    }
+}
+/** One tag-length-value element. */
+export function encode(tag, value) {
+    return Buffer.concat([Buffer.from([tag]), encodeLength(value.length), value]);
+}
+export function encodeInteger(value, tag = INTEGER) {
+    if (!Number.isSafeInteger(value)) {
+        throw new BerError(`cannot encode ${value} as an integer`);
+    }
+    const bytes = [];
+    let remaining = value;
+    do {
+        bytes.unshift(remaining & 0xff);
+        remaining >>= 8;
+    } while (remaining !== 0 && remaining !== -1);
+    // A leading bit set on a positive number would read as negative.
+    if (value >= 0 && bytes[0] & 0x80)
+        bytes.unshift(0);
+    if (value < 0 && !(bytes[0] & 0x80))
+        bytes.unshift(0xff);
+    return encode(tag, Buffer.from(bytes));
+}
+export function encodeString(value, tag = OCTET_STRING) {
+    // The value is written as length-prefixed bytes, never interpolated. That
+    // is what makes injection impossible rather than merely escaped.
+    return encode(tag, Buffer.from(value, "utf8"));
+}
+export function encodeBoolean(value, tag = BOOLEAN) {
+    return encode(tag, Buffer.from([value ? 0xff : 0x00]));
+}
+export function encodeSequence(parts, tag = SEQUENCE) {
+    return encode(tag, Buffer.concat(parts));
+}
+/** Read one element at `offset`. */
+export function decode(buffer, offset = 0) {
+    if (offset >= buffer.length) {
+        throw new BerError("the message ends where an element was expected");
+    }
+    const tag = buffer[offset];
+    const { length, at } = decodeLength(buffer, offset + 1);
+    const end = at + length;
+    if (end > buffer.length) {
+        throw new BerError(`an element claims ${length} bytes and the message holds ${buffer.length - at}`);
+    }
+    return { tag, value: buffer.subarray(at, end), end };
+}
+/** Every element inside a constructed one. */
+export function decodeSequence(value) {
+    const out = [];
+    let offset = 0;
+    while (offset < value.length) {
+        const element = decode(value, offset);
+        out.push(element);
+        offset = element.end;
+    }
+    return out;
+}
+export function decodeInteger(value) {
+    if (value.length === 0)
+        throw new BerError("an integer has no bytes");
+    if (value.length > 6) {
+        // Beyond this a result code or message id is not something this reads.
+        throw new BerError(`an integer of ${value.length} bytes is out of range`);
+    }
+    let out = value[0] & 0x80 ? -1 : 0;
+    for (const byte of value)
+        out = out * 256 + byte;
+    return out;
+}
+export function decodeString(value) {
+    return value.toString("utf8");
+}
+/**
+ * How many bytes a whole message occupies, or `undefined` while it is still
+ * arriving. LDAP runs over a stream, so a read can stop anywhere.
+ */
+export function messageLength(buffer) {
+    if (buffer.length < 2)
+        return undefined;
+    const first = buffer[1];
+    if (first < 0x80)
+        return 2 + first;
+    const count = first & 0x7f;
+    if (count === 0 || count > 4) {
+        throw new BerError("a message declares a length this refuses to read");
+    }
+    if (buffer.length < 2 + count)
+        return undefined;
+    let length = 0;
+    for (let i = 0; i < count; i += 1) {
+        length = length * 256 + buffer[2 + i];
+    }
+    return 2 + count + length;
+}
+function encodeLength(length) {
+    if (length < 0x80)
+        return Buffer.from([length]);
+    const bytes = [];
+    let remaining = length;
+    while (remaining > 0) {
+        bytes.unshift(remaining & 0xff);
+        remaining = Math.floor(remaining / 256);
+    }
+    return Buffer.from([0x80 | bytes.length, ...bytes]);
+}
+function decodeLength(buffer, offset) {
+    if (offset >= buffer.length) {
+        throw new BerError("an element has no length");
+    }
+    const first = buffer[offset];
+    if (first < 0x80)
+        return { length: first, at: offset + 1 };
+    const count = first & 0x7f;
+    if (count === 0) {
+        // Indefinite length is legal BER and not legal LDAP; accepting it would
+        // mean scanning for a terminator supplied by the other side.
+        throw new BerError("an element uses an indefinite length, which LDAP does not");
+    }
+    if (count > 4 || offset + 1 + count > buffer.length) {
+        throw new BerError("an element declares a length this refuses to read");
+    }
+    let length = 0;
+    for (let i = 0; i < count; i += 1) {
+        length = length * 256 + buffer[offset + 1 + i];
+    }
+    return { length, at: offset + 1 + count };
+}
+//# sourceMappingURL=ber.js.map

package/dist/ber.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ber.js","sourceRoot":"","sources":["../src/ber.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC;AAC5B,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAC/B,MAAM,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC;AAE7B,sCAAsC;AACtC,MAAM,CAAC,MAAM,WAAW,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;AAC3D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;AACpE,2CAA2C;AAC3C,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;AACvD,yCAAyC;AACzC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC;AAEhE,MAAM,OAAO,QAAS,SAAQ,KAAK;IAClC,YAAY,OAAe;QAC1B,KAAK,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACxB,CAAC;CACD;AAED,oCAAoC;AACpC,MAAM,UAAU,MAAM,CAAC,GAAW,EAAE,KAAa;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,OAAO;IACzD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,iBAAiB,KAAK,gBAAgB,CAAC,CAAC;IAC5D,CAAC;IACD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,GAAG,CAAC;QACH,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAChC,SAAS,KAAK,CAAC,CAAC;IACjB,CAAC,QAAQ,SAAS,KAAK,CAAC,IAAI,SAAS,KAAK,CAAC,CAAC,EAAE;IAC9C,iEAAiE;IACjE,IAAI,KAAK,IAAI,CAAC,IAAK,KAAK,CAAC,CAAC,CAAY,GAAG,IAAI;QAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAChE,IAAI,KAAK,GAAG,CAAC,IAAI,CAAC,CAAE,KAAK,CAAC,CAAC,CAAY,GAAG,IAAI,CAAC;QAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,GAAG,GAAG,YAAY;IAC7D,0EAA0E;IAC1E,iEAAiE;IACjE,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAc,EAAE,GAAG,GAAG,OAAO;IAC1D,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAAe,EAAE,GAAG,GAAG,QAAQ;IAC7D,OAAO,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAC1C,CAAC;AASD,oCAAoC;AACpC,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,MAAM,GAAG,CAAC;IAChD,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,gDAAgD,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAW,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC;IACxB,IAAI,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CACjB,qBAAqB,MAAM,gCAAgC,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAC/E,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,cAAc,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;IAC7B,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACtC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAClB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa;IAC1C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,QAAQ,CAAC,yBAAyB,CAAC,CAAC;IACtE,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,uEAAuE;QACvE,MAAM,IAAI,QAAQ,CAAC,iBAAiB,KAAK,CAAC,MAAM,wBAAwB,CAAC,CAAC;IAC3E,CAAC;IACD,IAAI,GAAG,GAAI,KAAK,CAAC,CAAC,CAAY,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC;IACjD,OAAO,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,KAAa;IACzC,OAAO,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAW,CAAC;IAClC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,CAAC,GAAG,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,QAAQ,CAAC,kDAAkD,CAAC,CAAC;IACxE,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,KAAK;QAAE,OAAO,SAAS,CAAC;IAChD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,MAAM,GAAG,GAAG,GAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC;IACnD,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC;AAC3B,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IACnC,IAAI,MAAM,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAChD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,SAAS,GAAG,MAAM,CAAC;IACvB,OAAO,SAAS,GAAG,CAAC,EAAE,CAAC;QACtB,KAAK,CAAC,OAAO,CAAC,SAAS,GAAG,IAAI,CAAC,CAAC;QAChC,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CACpB,MAAc,EACd,MAAc;IAEd,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,IAAI,QAAQ,CAAC,0BAA0B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAW,CAAC;IACvC,IAAI,KAAK,GAAG,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,EAAE,CAAC;IAC3D,MAAM,KAAK,GAAG,KAAK,GAAG,IAAI,CAAC;IAC3B,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;QACjB,wEAAwE;QACxE,6DAA6D;QAC7D,MAAM,IAAI,QAAQ,CACjB,2DAA2D,CAC3D,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,GAAG,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACrD,MAAM,IAAI,QAAQ,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,GAAG,MAAM,GAAG,GAAG,GAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAY,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,CAAC,GAAG,KAAK,EAAE,CAAC;AAC3C,CAAC"}

package/dist/c14n.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Exclusive XML Canonicalization (`xml-exc-c14n#`).
+ *
+ * A signature is over BYTES, and two parties only agree on which bytes if they
+ * agree on this algorithm exactly. Every rule below comes from the
+ * specification, and the awkward ones are the ones that matter:
+ *
+ *   - Only namespaces an element **visibly utilizes** are written out, and only
+ *     when an output ancestor has not already written the same prefix with the
+ *     same value. That is what makes a signed fragment survive being moved
+ *     between documents — and it is the whole reason exclusive exists.
+ *   - An unprefixed attribute is in NO namespace, so it never makes the default
+ *     namespace visibly utilized.
+ *   - The `xml` prefix is bound by the XML specification and is never declared.
+ *
+ * Getting any of these wrong yields a canonical form that differs from the
+ * signer's by a few bytes, and every signature then fails — or, worse, one is
+ * accepted over a document that is not the one that was signed.
+ */
+import { XML_NS, type XmlElement, type XmlNode } from "./xml.js";
+export interface CanonicalizeOptions {
+    /**
+     * Prefixes to treat the inclusive way, from a `<InclusiveNamespaces
+     * PrefixList="…">` transform parameter.
+     */
+    inclusivePrefixes?: string[];
+    /** Comments are excluded unless the algorithm says otherwise. */
+    withComments?: boolean;
+    /**
+     * Nodes to leave out of the output — what the enveloped-signature transform
+     * needs, since an element cannot carry a digest of itself.
+     */
+    omit?: ReadonlySet<XmlNode>;
+}
+/** The canonical form of an element and everything under it. */
+export declare function canonicalize(element: XmlElement, options?: CanonicalizeOptions): string;
+export { XML_NS };
+//# sourceMappingURL=c14n.d.ts.map

package/dist/c14n.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"c14n.d.ts","sourceRoot":"","sources":["../src/c14n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAEN,MAAM,EAEN,KAAK,UAAU,EACf,KAAK,OAAO,EACZ,MAAM,UAAU,CAAC;AAElB,MAAM,WAAW,mBAAmB;IACnC;;;OAGG;IACH,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,iEAAiE;IACjE,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,IAAI,CAAC,EAAE,WAAW,CAAC,OAAO,CAAC,CAAC;CAC5B;AAED,gEAAgE;AAChE,wBAAgB,YAAY,CAC3B,OAAO,EAAE,UAAU,EACnB,OAAO,GAAE,mBAAwB,GAC/B,MAAM,CAIR;AAuID,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/c14n.js

@@ -0,0 +1,129 @@
+/**
+ * Exclusive XML Canonicalization (`xml-exc-c14n#`).
+ *
+ * A signature is over BYTES, and two parties only agree on which bytes if they
+ * agree on this algorithm exactly. Every rule below comes from the
+ * specification, and the awkward ones are the ones that matter:
+ *
+ *   - Only namespaces an element **visibly utilizes** are written out, and only
+ *     when an output ancestor has not already written the same prefix with the
+ *     same value. That is what makes a signed fragment survive being moved
+ *     between documents — and it is the whole reason exclusive exists.
+ *   - An unprefixed attribute is in NO namespace, so it never makes the default
+ *     namespace visibly utilized.
+ *   - The `xml` prefix is bound by the XML specification and is never declared.
+ *
+ * Getting any of these wrong yields a canonical form that differs from the
+ * signer's by a few bytes, and every signature then fails — or, worse, one is
+ * accepted over a document that is not the one that was signed.
+ */
+import { resolvePrefix, XML_NS, } from "./xml.js";
+/** The canonical form of an element and everything under it. */
+export function canonicalize(element, options = {}) {
+    const out = [];
+    writeElement(element, out, new Map(), options);
+    return out.join("");
+}
+/**
+ * The prefixes this element makes visible: its own, and those of its
+ * attributes. The default namespace counts only when the element itself has no
+ * prefix.
+ */
+function visiblyUtilized(element, inclusivePrefixes) {
+    const used = new Set([element.prefix]);
+    for (const attribute of element.attributes) {
+        if (attribute.prefix !== "")
+            used.add(attribute.prefix);
+    }
+    // The prefix list is handled inclusively: a listed prefix is rendered
+    // whenever it is in scope, utilized or not.
+    for (const prefix of inclusivePrefixes) {
+        if (resolvePrefix(element, prefix) !== undefined)
+            used.add(prefix);
+    }
+    // Never declared — the specification binds it.
+    used.delete("xml");
+    return used;
+}
+function writeElement(element, out, rendered, options) {
+    const inclusive = options.inclusivePrefixes ?? [];
+    const utilized = [...visiblyUtilized(element, inclusive)].sort(compare);
+    const declarations = [];
+    const childRendered = new Map(rendered);
+    for (const prefix of utilized) {
+        const uri = resolvePrefix(element, prefix) ?? "";
+        if (prefix === "" && uri === "") {
+            // `xmlns=""` is written only to undo a default namespace an output
+            // ancestor put in scope. Writing it otherwise is noise the signer
+            // did not produce.
+            if ((rendered.get("") ?? "") !== "") {
+                declarations.push(["", ""]);
+                childRendered.set("", "");
+            }
+            continue;
+        }
+        if (rendered.get(prefix) !== uri) {
+            declarations.push([prefix, uri]);
+            childRendered.set(prefix, uri);
+        }
+    }
+    out.push("<", element.qname);
+    for (const [prefix, uri] of declarations) {
+        out.push(" ", prefix === "" ? "xmlns" : `xmlns:${prefix}`, '="', escapeAttribute(uri), '"');
+    }
+    for (const attribute of [...element.attributes].sort(byNamespaceThenLocal)) {
+        out.push(" ", attribute.qname, '="', escapeAttribute(attribute.value), '"');
+    }
+    out.push(">");
+    for (const child of element.children) {
+        if (options.omit?.has(child))
+            continue;
+        writeNode(child, out, childRendered, options);
+    }
+    // Empty elements are written as a start/end pair, never self-closed.
+    out.push("</", element.qname, ">");
+}
+function writeNode(node, out, rendered, options) {
+    switch (node.type) {
+        case "element":
+            writeElement(node, out, rendered, options);
+            return;
+        case "text":
+            out.push(escapeText(node.value));
+            return;
+        case "comment":
+            if (options.withComments)
+                out.push("<!--", node.value, "-->");
+            return;
+        case "instruction":
+            out.push("<?", node.target, node.data === "" ? "" : ` ${node.data}`, "?>");
+            return;
+    }
+}
+/** Namespace URI first, then local name; an empty URI sorts least. */
+function byNamespaceThenLocal(a, b) {
+    const uri = compare(a.namespaceUri, b.namespaceUri);
+    return uri !== 0 ? uri : compare(a.local, b.local);
+}
+/** Byte order, which is what the specification means by lexicographic here. */
+function compare(a, b) {
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function escapeText(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/>/g, "&gt;")
+        .replace(/\r/g, "&#xD;");
+}
+function escapeAttribute(value) {
+    return value
+        .replace(/&/g, "&amp;")
+        .replace(/</g, "&lt;")
+        .replace(/"/g, "&quot;")
+        .replace(/\t/g, "&#x9;")
+        .replace(/\n/g, "&#xA;")
+        .replace(/\r/g, "&#xD;");
+}
+export { XML_NS };
+//# sourceMappingURL=c14n.js.map

package/dist/c14n.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"c14n.js","sourceRoot":"","sources":["../src/c14n.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EACN,aAAa,EACb,MAAM,GAIN,MAAM,UAAU,CAAC;AAiBlB,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAC3B,OAAmB,EACnB,UAA+B,EAAE;IAEjC,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,YAAY,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,GAAG,EAAE,EAAE,OAAO,CAAC,CAAC;IAC/C,OAAO,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CACvB,OAAmB,EACnB,iBAA2B;IAE3B,MAAM,IAAI,GAAG,IAAI,GAAG,CAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC/C,KAAK,MAAM,SAAS,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5C,IAAI,SAAS,CAAC,MAAM,KAAK,EAAE;YAAE,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IACzD,CAAC;IACD,sEAAsE;IACtE,4CAA4C;IAC5C,KAAK,MAAM,MAAM,IAAI,iBAAiB,EAAE,CAAC;QACxC,IAAI,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,SAAS;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpE,CAAC;IACD,+CAA+C;IAC/C,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACnB,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CACpB,OAAmB,EACnB,GAAa,EACb,QAA6B,EAC7B,OAA4B;IAE5B,MAAM,SAAS,GAAG,OAAO,CAAC,iBAAiB,IAAI,EAAE,CAAC;IAClD,MAAM,QAAQ,GAAG,CAAC,GAAG,eAAe,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAExE,MAAM,YAAY,GAAyC,EAAE,CAAC;IAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAExC,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,GAAG,GAAG,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACjD,IAAI,MAAM,KAAK,EAAE,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;YACjC,mEAAmE;YACnE,kEAAkE;YAClE,mBAAmB;YACnB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC;gBACrC,YAAY,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5B,aAAa,CAAC,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3B,CAAC;YACD,SAAS;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,YAAY,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC;YACjC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAED,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAC7B,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;QAC1C,GAAG,CAAC,IAAI,CACP,GAAG,EACH,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,MAAM,EAAE,EAC3C,IAAI,EACJ,eAAe,CAAC,GAAG,CAAC,EACpB,GAAG,CACH,CAAC;IACH,CAAC;IACD,KAAK,MAAM,SAAS,IAAI,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5E,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC;IAC7E,CAAC;IACD,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEd,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC;YAAE,SAAS;QACvC,SAAS,CAAC,KAAK,EAAE,GAAG,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,qEAAqE;IACrE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,SAAS,CACjB,IAAa,EACb,GAAa,EACb,QAA6B,EAC7B,OAA4B;IAE5B,QAAQ,IAAI,CAAC,IAAI,EAAE,CAAC;QACnB,KAAK,SAAS;YACb,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO;QACR,KAAK,MAAM;YACV,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;YACjC,OAAO;QACR,KAAK,SAAS;YACb,IAAI,OAAO,CAAC,YAAY;gBAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC9D,OAAO;QACR,KAAK,aAAa;YACjB,GAAG,CAAC,IAAI,CACP,IAAI,EACJ,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,EACvC,IAAI,CACJ,CAAC;YACF,OAAO;IACT,CAAC;AACF,CAAC;AAED,sEAAsE;AACtE,SAAS,oBAAoB,CAAC,CAAe,EAAE,CAAe;IAC7D,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC;IACpD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CAAC,CAAS,EAAE,CAAS;IACpC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,OAAO,KAAK;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,SAAS,eAAe,CAAC,KAAa;IACrC,OAAO,KAAK;SACV,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC;SACvB,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC3B,CAAC;AAED,OAAO,EAAE,MAAM,EAAE,CAAC"}

package/dist/config.d.ts

@@ -0,0 +1,115 @@
+/**
+ * Author-time config for `config/transit.ts`.
+ *
+ *   import { defineConfig, socials } from '@c9up/transit'
+ *
+ *   export default defineConfig({
+ *     google: socials.google({
+ *       clientId: env.get('GOOGLE_CLIENT_ID'),
+ *       clientSecret: env.get('GOOGLE_CLIENT_SECRET'),
+ *       callbackUrl: 'https://acme.test/auth/google/callback',
+ *     }),
+ *   })
+ *
+ * The keys are yours. Two entries may reach the same provider with different
+ * credentials — a `staff` sign-in and a `customers` one, both on Google — and
+ * `use(name)` asks for the key, not for the provider.
+ */
+import { type AppleConfig } from "./drivers/AppleDriver.js";
+import { type LdapConfig } from "./drivers/LdapDirectory.js";
+import { type OidcConfig } from "./drivers/OidcDriver.js";
+import { type SamlConfig } from "./drivers/SamlDriver.js";
+import type { OAuthConfig, TransitEntry } from "./types.js";
+/** A provider, built when the manager is. */
+export type TransitDriverFactory = () => TransitEntry;
+/** One declared provider: the driver itself, or a factory answering one. */
+export type TransitProviderEntry = TransitEntry | TransitDriverFactory;
+export type TransitConfig = Record<string, TransitProviderEntry>;
+export declare function defineConfig<T extends TransitConfig>(config: T): T;
+/**
+ * The social providers Transit speaks to.
+ *
+ * Factories are lazy, so a config naming a provider this environment never
+ * selects costs nothing to declare.
+ */
+/**
+ * Any provider that speaks OpenID Connect, from its issuer alone — Keycloak,
+ * Auth0, Okta, Entra ID, Authentik, Zitadel, and the rest.
+ *
+ *   work: oidc({
+ *     issuer: 'https://id.acme.com',
+ *     clientId: env.get('OIDC_CLIENT_ID'),
+ *     clientSecret: env.get('OIDC_CLIENT_SECRET'),
+ *     callbackUrl: 'https://acme.test/auth/work/callback',
+ *   })
+ *
+ * The endpoints, the signing keys and the algorithms come from what the
+ * provider publishes, so there is nothing else to configure and nothing to
+ * update when it rotates a key.
+ */
+export declare function oidc(config: OidcConfig): TransitDriverFactory;
+/**
+ * A SAML 2.0 identity provider — the enterprise directories that speak it:
+ * Okta, Entra ID, ADFS, OneLogin, Shibboleth.
+ *
+ *   corp: saml({
+ *     entityId: 'https://acme.test/saml',
+ *     callbackUrl: 'https://acme.test/saml/acs',
+ *     issuer: 'https://idp.acme.test/metadata',
+ *     signOnUrl: 'https://idp.acme.test/sso',
+ *     certificates: [env.get('IDP_CERTIFICATE')],
+ *   })
+ *
+ * The certificates come from the provider's metadata and nowhere else: a
+ * response is never verified against a key it carries itself.
+ */
+export declare function saml(config: SamlConfig): TransitDriverFactory;
+/**
+ * An LDAP or Active Directory directory.
+ *
+ *   staff: ldap({
+ *     url: 'ldaps://directory.acme.test',
+ *     baseDn: 'dc=acme,dc=test',
+ *     loginAttribute: 'uid',
+ *     bindDn: 'cn=reader,dc=acme,dc=test',
+ *     bindPassword: env.get('LDAP_PASSWORD'),
+ *   })
+ *
+ * Reached with `transit.authenticate(name, username, password)`: nothing is
+ * redirected, so there is no `begin()` for it.
+ */
+export declare function ldap(config: LdapConfig): TransitDriverFactory;
+export declare const socials: {
+    /**
+     * Sign in with Apple. Required on iOS as soon as another social sign-in is
+     * offered.
+     *
+     * It takes a key rather than a secret — the Services ID, the Team ID, the
+     * Key ID and the contents of the `.p8` — and its callback arrives as a
+     * POST, because asking for a name forces `response_mode=form_post`. The
+     * name comes once, in that POST: read it with `parseAppleUser` and store
+     * it, because Apple never sends it again.
+     */
+    apple(config: AppleConfig): TransitDriverFactory;
+    discord(config: OAuthConfig): TransitDriverFactory;
+    facebook(config: OAuthConfig): TransitDriverFactory;
+    github(config: OAuthConfig): TransitDriverFactory;
+    google(config: OAuthConfig): TransitDriverFactory;
+    /**
+     * LinkedIn through the member API, for an application whose LinkedIn app
+     * holds `r_liteprofile` / `r_emailaddress`.
+     */
+    linkedin(config: OAuthConfig): TransitDriverFactory;
+    /** LinkedIn through OpenID Connect — what a new application is issued. */
+    linkedinOpenidConnect(config: OAuthConfig): TransitDriverFactory;
+    spotify(config: OAuthConfig): TransitDriverFactory;
+    /**
+     * X through OAuth1 — the older flow, and the one whose profile call returns
+     * the address. Its redirect needs a request token from X, so it is reached
+     * through `begin()` rather than `redirect()`.
+     */
+    twitter(config: OAuthConfig): TransitDriverFactory;
+    /** X through OAuth2. It requires PKCE, which `begin()` handles. */
+    twitterX(config: OAuthConfig): TransitDriverFactory;
+};
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,0BAA0B,CAAC;AAKzE,OAAO,EAAE,KAAK,UAAU,EAAiB,MAAM,4BAA4B,CAAC;AAG5E,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,yBAAyB,CAAC;AAItE,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE5D,6CAA6C;AAC7C,MAAM,MAAM,oBAAoB,GAAG,MAAM,YAAY,CAAC;AAEtD,4EAA4E;AAC5E,MAAM,MAAM,oBAAoB,GAAG,YAAY,GAAG,oBAAoB,CAAC;AAEvE,MAAM,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;AAEjE,wBAAgB,YAAY,CAAC,CAAC,SAAS,aAAa,EAAE,MAAM,EAAE,CAAC,GAAG,CAAC,CAElE;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAE7D;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAE7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,IAAI,CAAC,MAAM,EAAE,UAAU,GAAG,oBAAoB,CAE7D;AAED,eAAO,MAAM,OAAO;IACnB;;;;;;;;;OASG;kBACW,WAAW,GAAG,oBAAoB;oBAGhC,WAAW,GAAG,oBAAoB;qBAGjC,WAAW,GAAG,oBAAoB;mBAGpC,WAAW,GAAG,oBAAoB;mBAGlC,WAAW,GAAG,oBAAoB;IAGjD;;;OAGG;qBACc,WAAW,GAAG,oBAAoB;IAGnD,0EAA0E;kCAC5C,WAAW,GAAG,oBAAoB;oBAGhD,WAAW,GAAG,oBAAoB;IAGlD;;;;OAIG;oBACa,WAAW,GAAG,oBAAoB;IAGlD,mEAAmE;qBAClD,WAAW,GAAG,oBAAoB;CAGnD,CAAC"}

package/dist/config.js

@@ -0,0 +1,146 @@
+/**
+ * Author-time config for `config/transit.ts`.
+ *
+ *   import { defineConfig, socials } from '@c9up/transit'
+ *
+ *   export default defineConfig({
+ *     google: socials.google({
+ *       clientId: env.get('GOOGLE_CLIENT_ID'),
+ *       clientSecret: env.get('GOOGLE_CLIENT_SECRET'),
+ *       callbackUrl: 'https://acme.test/auth/google/callback',
+ *     }),
+ *   })
+ *
+ * The keys are yours. Two entries may reach the same provider with different
+ * credentials — a `staff` sign-in and a `customers` one, both on Google — and
+ * `use(name)` asks for the key, not for the provider.
+ */
+import { AppleDriver } from "./drivers/AppleDriver.js";
+import { DiscordDriver } from "./drivers/DiscordDriver.js";
+import { FacebookDriver } from "./drivers/FacebookDriver.js";
+import { GitHubDriver } from "./drivers/GitHubDriver.js";
+import { GoogleDriver } from "./drivers/GoogleDriver.js";
+import { LdapDirectory } from "./drivers/LdapDirectory.js";
+import { LinkedInDriver } from "./drivers/LinkedInDriver.js";
+import { LinkedInOpenidConnectDriver } from "./drivers/LinkedInOpenidConnectDriver.js";
+import { OidcDriver } from "./drivers/OidcDriver.js";
+import { SamlDriver } from "./drivers/SamlDriver.js";
+import { SpotifyDriver } from "./drivers/SpotifyDriver.js";
+import { TwitterDriver } from "./drivers/TwitterDriver.js";
+import { TwitterXDriver } from "./drivers/TwitterXDriver.js";
+export function defineConfig(config) {
+    return config;
+}
+/**
+ * The social providers Transit speaks to.
+ *
+ * Factories are lazy, so a config naming a provider this environment never
+ * selects costs nothing to declare.
+ */
+/**
+ * Any provider that speaks OpenID Connect, from its issuer alone — Keycloak,
+ * Auth0, Okta, Entra ID, Authentik, Zitadel, and the rest.
+ *
+ *   work: oidc({
+ *     issuer: 'https://id.acme.com',
+ *     clientId: env.get('OIDC_CLIENT_ID'),
+ *     clientSecret: env.get('OIDC_CLIENT_SECRET'),
+ *     callbackUrl: 'https://acme.test/auth/work/callback',
+ *   })
+ *
+ * The endpoints, the signing keys and the algorithms come from what the
+ * provider publishes, so there is nothing else to configure and nothing to
+ * update when it rotates a key.
+ */
+export function oidc(config) {
+    return () => new OidcDriver(config);
+}
+/**
+ * A SAML 2.0 identity provider — the enterprise directories that speak it:
+ * Okta, Entra ID, ADFS, OneLogin, Shibboleth.
+ *
+ *   corp: saml({
+ *     entityId: 'https://acme.test/saml',
+ *     callbackUrl: 'https://acme.test/saml/acs',
+ *     issuer: 'https://idp.acme.test/metadata',
+ *     signOnUrl: 'https://idp.acme.test/sso',
+ *     certificates: [env.get('IDP_CERTIFICATE')],
+ *   })
+ *
+ * The certificates come from the provider's metadata and nowhere else: a
+ * response is never verified against a key it carries itself.
+ */
+export function saml(config) {
+    return () => new SamlDriver(config);
+}
+/**
+ * An LDAP or Active Directory directory.
+ *
+ *   staff: ldap({
+ *     url: 'ldaps://directory.acme.test',
+ *     baseDn: 'dc=acme,dc=test',
+ *     loginAttribute: 'uid',
+ *     bindDn: 'cn=reader,dc=acme,dc=test',
+ *     bindPassword: env.get('LDAP_PASSWORD'),
+ *   })
+ *
+ * Reached with `transit.authenticate(name, username, password)`: nothing is
+ * redirected, so there is no `begin()` for it.
+ */
+export function ldap(config) {
+    return () => new LdapDirectory(config);
+}
+export const socials = {
+    /**
+     * Sign in with Apple. Required on iOS as soon as another social sign-in is
+     * offered.
+     *
+     * It takes a key rather than a secret — the Services ID, the Team ID, the
+     * Key ID and the contents of the `.p8` — and its callback arrives as a
+     * POST, because asking for a name forces `response_mode=form_post`. The
+     * name comes once, in that POST: read it with `parseAppleUser` and store
+     * it, because Apple never sends it again.
+     */
+    apple(config) {
+        return () => new AppleDriver(config);
+    },
+    discord(config) {
+        return () => new DiscordDriver(config);
+    },
+    facebook(config) {
+        return () => new FacebookDriver(config);
+    },
+    github(config) {
+        return () => new GitHubDriver(config);
+    },
+    google(config) {
+        return () => new GoogleDriver(config);
+    },
+    /**
+     * LinkedIn through the member API, for an application whose LinkedIn app
+     * holds `r_liteprofile` / `r_emailaddress`.
+     */
+    linkedin(config) {
+        return () => new LinkedInDriver(config);
+    },
+    /** LinkedIn through OpenID Connect — what a new application is issued. */
+    linkedinOpenidConnect(config) {
+        return () => new LinkedInOpenidConnectDriver(config);
+    },
+    spotify(config) {
+        return () => new SpotifyDriver(config);
+    },
+    /**
+     * X through OAuth1 — the older flow, and the one whose profile call returns
+     * the address. Its redirect needs a request token from X, so it is reached
+     * through `begin()` rather than `redirect()`.
+     */
+    twitter(config) {
+        return () => new TwitterDriver(config);
+    },
+    /** X through OAuth2. It requires PKCE, which `begin()` handles. */
+    twitterX(config) {
+        return () => new TwitterXDriver(config);
+    },
+};
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAoB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAmB,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAC7D,OAAO,EAAE,2BAA2B,EAAE,MAAM,0CAA0C,CAAC;AACvF,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAmB,UAAU,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,6BAA6B,CAAC;AAW7D,MAAM,UAAU,YAAY,CAA0B,MAAS;IAC9D,OAAO,MAAM,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACtC,OAAO,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACtC,OAAO,GAAG,EAAE,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,IAAI,CAAC,MAAkB;IACtC,OAAO,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,OAAO,GAAG;IACtB;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAmB;QACxB,OAAO,GAAG,EAAE,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,CAAC;IACD,OAAO,CAAC,MAAmB;QAC1B,OAAO,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,QAAQ,CAAC,MAAmB;QAC3B,OAAO,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,CAAC,MAAmB;QACzB,OAAO,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD,MAAM,CAAC,MAAmB;QACzB,OAAO,GAAG,EAAE,CAAC,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IACD;;;OAGG;IACH,QAAQ,CAAC,MAAmB;QAC3B,OAAO,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;IACD,0EAA0E;IAC1E,qBAAqB,CAAC,MAAmB;QACxC,OAAO,GAAG,EAAE,CAAC,IAAI,2BAA2B,CAAC,MAAM,CAAC,CAAC;IACtD,CAAC;IACD,OAAO,CAAC,MAAmB;QAC1B,OAAO,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD;;;;OAIG;IACH,OAAO,CAAC,MAAmB;QAC1B,OAAO,GAAG,EAAE,CAAC,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IACxC,CAAC;IACD,mEAAmE;IACnE,QAAQ,CAAC,MAAmB;QAC3B,OAAO,GAAG,EAAE,CAAC,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;IACzC,CAAC;CACD,CAAC"}

package/dist/configure.d.ts

@@ -0,0 +1,18 @@
+/**
+ * `ream configure @c9up/transit` — wire federated sign-in in one command.
+ *
+ * The provider alone is not enough: it reads `config/transit.ts`, and a package
+ * registered without one falls back to a default that is rarely the one an
+ * application wants. Writing both together is what makes `ream add` mean
+ * installed AND working.
+ */
+interface Codemods {
+    addProvider(importPath: string): Promise<void>;
+    addEnvVars(vars: Record<string, string>): Promise<void>;
+    writeFile(filePath: string, content: string, options?: {
+        force?: boolean;
+    }): Promise<void>;
+}
+export declare function configure(codemods: Codemods): Promise<void>;
+export {};
+//# sourceMappingURL=configure.d.ts.map

package/dist/configure.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.d.ts","sourceRoot":"","sources":["../src/configure.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,UAAU,QAAQ;IACjB,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,SAAS,CACR,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,MAAM,EACf,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,GAC3B,OAAO,CAAC,IAAI,CAAC,CAAC;CACjB;AAED,wBAAsB,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CA2BjE"}