@coffre/core 0.0.0 → 0.1.1

package/dist/identity.js

@@ -0,0 +1,691 @@
+import { createCipheriv, createDecipheriv, createHash, hkdfSync, randomBytes } from "node:crypto";
+import * as oauth from "oauth4webapi";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+//#region src/identity/signin/types.ts
+var SigninError = class extends Error {
+	code;
+	constructor(code, message) {
+		super(message);
+		this.code = code;
+	}
+};
+//#endregion
+//#region src/identity/signin/github.ts
+/**
+* GitHub's OAuth web flow, which is OAuth 2.0 without OpenID Connect: no ID
+* token, so the profile comes from the REST API with the access token the
+* code is exchanged for. That token is used for these two or three calls and
+* then dropped; coffre never stores it.
+*
+* Works with an OAuth App or a GitHub App's user authorization, on github.com
+* or GitHub Enterprise Server.
+*/
+var GitHubSigninProvider = class {
+	id;
+	issuer;
+	label;
+	brand;
+	/** What it was made from, as checked. */
+	config;
+	#fetch;
+	constructor(config, options = {}) {
+		this.id = config.id;
+		this.issuer = config.apiUrl;
+		this.label = config.label;
+		this.brand = config.brand;
+		this.config = config;
+		this.#fetch = options.fetch ?? ((input, init) => fetch(input, init));
+	}
+	async start(redirectUri, options = {}) {
+		const pending = {
+			state: oauth.generateRandomState(),
+			codeVerifier: oauth.generateRandomCodeVerifier(),
+			nonce: null
+		};
+		const url = new URL(`${this.config.webUrl}/login/oauth/authorize`);
+		const params = url.searchParams;
+		params.set("client_id", this.config.clientId);
+		params.set("redirect_uri", redirectUri);
+		params.set("scope", this.config.organization ? "read:user user:email read:org" : "read:user user:email");
+		params.set("state", pending.state);
+		params.set("code_challenge", await oauth.calculatePKCECodeChallenge(pending.codeVerifier));
+		params.set("code_challenge_method", "S256");
+		params.set("allow_signup", "false");
+		if (options.loginHint !== void 0) params.set("login", options.loginHint);
+		return {
+			url,
+			pending
+		};
+	}
+	async finish(callbackUrl, redirectUri, pending) {
+		const label = this.config.label;
+		const query = callbackUrl.searchParams;
+		if (query.get("state") !== pending.state) throw new SigninError("state_mismatch", `the ${label} callback does not match this sign-in`);
+		const refused = query.get("error");
+		if (refused !== null) throw new SigninError("provider_denied", `${label} refused the sign-in: ${refused}`);
+		const code = query.get("code");
+		if (code === null || code === "") throw new SigninError("invalid_response", `the ${label} callback carries no code`);
+		const token = await this.#exchange(code, redirectUri, pending.codeVerifier);
+		const user = await this.#api(token, "/user");
+		if (typeof user?.id !== "number") throw new SigninError("invalid_response", `${label} did not say who signed in`);
+		const organization = this.config.organization;
+		if (organization !== null && !await this.#isMember(token, organization)) throw new SigninError("not_in_organization", `only members of the ${organization} organization may sign in with ${label}`);
+		const listed = await this.#api(token, "/user/emails");
+		const emails = (Array.isArray(listed) ? listed : []).filter((entry) => entry.verified && typeof entry.email === "string").sort((a, b) => Number(b.primary) - Number(a.primary)).map((entry) => entry.email.trim().toLowerCase());
+		return {
+			subject: String(user.id),
+			emails: [...new Set(emails)],
+			name: user.name ?? user.login
+		};
+	}
+	async #exchange(code, redirectUri, codeVerifier) {
+		const label = this.config.label;
+		const response = await this.#send(`${this.config.webUrl}/login/oauth/access_token`, {
+			method: "POST",
+			headers: {
+				accept: "application/json",
+				"content-type": "application/x-www-form-urlencoded"
+			},
+			body: new URLSearchParams({
+				client_id: this.config.clientId,
+				client_secret: this.config.clientSecret,
+				code,
+				redirect_uri: redirectUri,
+				code_verifier: codeVerifier
+			})
+		});
+		const body = await readJson(response);
+		if (!response.ok || body === null) throw new SigninError("invalid_response", `${label} answered the code exchange with ${response.status}`);
+		if (typeof body.error === "string") throw new SigninError("provider_denied", `${label} refused the code: ${body.error}`);
+		if (typeof body.access_token !== "string" || body.access_token === "") throw new SigninError("invalid_response", `${label} returned no access token`);
+		return body.access_token;
+	}
+	async #isMember(token, organization) {
+		const response = await this.#send(`${this.config.apiUrl}/user/memberships/orgs/${encodeURIComponent(organization)}`, { headers: apiHeaders(token) });
+		if (response.status === 404 || response.status === 403) return false;
+		const body = await readJson(response);
+		if (!response.ok || body === null) throw new SigninError("invalid_response", `${this.config.label} answered the membership check with ${response.status}`);
+		return body.state === "active";
+	}
+	async #api(token, path) {
+		const response = await this.#send(`${this.config.apiUrl}${path}`, { headers: apiHeaders(token) });
+		if (!response.ok) throw new SigninError("invalid_response", `${this.config.label} answered ${path} with ${response.status}`);
+		return await readJson(response);
+	}
+	async #send(url, init) {
+		try {
+			return await this.#fetch(url, {
+				...init,
+				redirect: "manual",
+				signal: AbortSignal.timeout(1e4)
+			});
+		} catch (cause) {
+			const error = new SigninError("provider_unavailable", `${this.config.label} could not be reached`);
+			error.cause = cause;
+			throw error;
+		}
+	}
+};
+function apiHeaders(token) {
+	return {
+		accept: "application/vnd.github+json",
+		authorization: `Bearer ${token}`,
+		"user-agent": "coffre",
+		"x-github-api-version": "2022-11-28"
+	};
+}
+async function readJson(response) {
+	try {
+		return await response.json();
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/identity/signin/oidc.ts
+/** Discovery documents change rarely; an hour keeps one fetch off every sign-in. */
+const DISCOVERY_TTL_MS = 36e5;
+/**
+* The authorization code flow with PKCE, against any OpenID Connect issuer.
+*
+* Protocol work is delegated to oauth4webapi: discovery with issuer
+* validation, the RFC 9207 `iss` check on the callback, the token request and
+* ID token claim validation (issuer, audience, expiry, nonce). The ID token is
+* received straight from the token endpoint over TLS with client
+* authentication, which OpenID Connect Core 3.1.3.7 accepts in place of
+* checking its signature.
+*/
+var OidcSigninProvider = class {
+	id;
+	issuer;
+	label;
+	brand;
+	/** What it was made from, as checked. */
+	config;
+	#fetch;
+	#insecure;
+	#discovered = null;
+	constructor(config, options = {}) {
+		this.id = config.id;
+		this.issuer = config.issuer;
+		this.label = config.label;
+		this.brand = config.brand;
+		this.config = config;
+		this.#fetch = options.fetch;
+		this.#insecure = new URL(config.issuer).protocol === "http:";
+	}
+	#http() {
+		const options = { signal: () => AbortSignal.timeout(1e4) };
+		if (this.#fetch !== void 0) {
+			const fetchImpl = this.#fetch;
+			options[oauth.customFetch] = (url, init) => fetchImpl(url, init);
+		}
+		if (this.#insecure) options[oauth.allowInsecureRequests] = true;
+		return options;
+	}
+	get #client() {
+		return { client_id: this.config.clientId };
+	}
+	async #server() {
+		if (this.#discovered !== null && Date.now() - this.#discovered.fetchedAt < DISCOVERY_TTL_MS) return this.#discovered.server;
+		const issuer = new URL(this.config.issuer);
+		let server;
+		try {
+			const response = await oauth.discoveryRequest(issuer, {
+				...this.#http(),
+				algorithm: "oidc"
+			});
+			server = await oauth.processDiscoveryResponse(issuer, response);
+		} catch (error) {
+			throw unavailable(this.config.label, error);
+		}
+		this.#discovered = {
+			server,
+			fetchedAt: Date.now()
+		};
+		return server;
+	}
+	async start(redirectUri, options = {}) {
+		const server = await this.#server();
+		if (server.authorization_endpoint === void 0) throw new SigninError("invalid_response", `${this.config.label} publishes no authorization endpoint`);
+		const pending = {
+			state: oauth.generateRandomState(),
+			codeVerifier: oauth.generateRandomCodeVerifier(),
+			nonce: oauth.generateRandomNonce()
+		};
+		const url = new URL(server.authorization_endpoint);
+		const params = url.searchParams;
+		params.set("client_id", this.config.clientId);
+		params.set("redirect_uri", redirectUri);
+		params.set("response_type", "code");
+		params.set("scope", this.config.scopes.join(" "));
+		params.set("state", pending.state);
+		params.set("nonce", pending.nonce);
+		params.set("code_challenge", await oauth.calculatePKCECodeChallenge(pending.codeVerifier));
+		params.set("code_challenge_method", "S256");
+		for (const [name, value] of Object.entries(this.config.authorizationParams)) params.set(name, value);
+		if (options.loginHint !== void 0) params.set("login_hint", options.loginHint);
+		return {
+			url,
+			pending
+		};
+	}
+	async finish(callbackUrl, redirectUri, pending) {
+		const server = await this.#server();
+		const label = this.config.label;
+		let params;
+		try {
+			params = oauth.validateAuthResponse(server, this.#client, callbackUrl, pending.state);
+		} catch (error) {
+			if (error instanceof oauth.AuthorizationResponseError) throw new SigninError("provider_denied", `${label} refused the sign-in: ${error.error}`);
+			throw new SigninError("state_mismatch", `the ${label} callback does not match this sign-in`);
+		}
+		let claims;
+		try {
+			const response = await oauth.authorizationCodeGrantRequest(server, this.#client, oauth.ClientSecretPost(this.config.clientSecret), params, redirectUri, pending.codeVerifier, this.#http());
+			const result = await oauth.processAuthorizationCodeResponse(server, this.#client, response, {
+				expectedNonce: pending.nonce ?? oauth.expectNoNonce,
+				requireIdToken: true
+			});
+			claims = oauth.getValidatedIdTokenClaims(result);
+		} catch (error) {
+			if (error instanceof SigninError) throw error;
+			if (error instanceof oauth.ResponseBodyError) throw new SigninError("provider_denied", `${label} refused the code: ${error.error}`);
+			if (isNetworkError(error)) throw unavailable(label, error);
+			throw new SigninError("invalid_response", `${label} returned a token coffre cannot trust`);
+		}
+		return this.#profile(claims);
+	}
+	#profile(claims) {
+		const label = this.config.label;
+		if (this.config.hostedDomain !== null && claims.hd !== this.config.hostedDomain) throw new SigninError("wrong_domain", `only ${this.config.hostedDomain} accounts may sign in with ${label}`);
+		const email = typeof claims.email === "string" ? claims.email.trim().toLowerCase() : "";
+		const authoritative = this.config.brand !== "google" || email.endsWith("@gmail.com") || typeof claims.hd === "string" && claims.hd !== "";
+		const emails = email !== "" && claims.email_verified === true && authoritative && this.config.brand !== "microsoft" ? [email] : [];
+		return {
+			subject: claims.sub,
+			emails,
+			name: typeof claims.name === "string" ? claims.name : null
+		};
+	}
+};
+function isNetworkError(error) {
+	return error instanceof TypeError || error instanceof Error && (error.name === "TimeoutError" || error.name === "AbortError");
+}
+function unavailable(label, cause) {
+	const error = new SigninError("provider_unavailable", `${label} could not be reached`);
+	error.cause = cause;
+	return error;
+}
+//#endregion
+//#region src/identity/signin/config.ts
+/**
+* Sign-in providers, and the sign-in they make up.
+*
+* coffre speaks two protocols: OpenID Connect, which covers Google, Microsoft,
+* Okta, Auth0, Keycloak, Authentik, Clerk, WorkOS and nearly everyone else,
+* and GitHub's own OAuth, because GitHub is the one provider people want that
+* does not speak OIDC. Everything named here is a preset of one of those two:
+* `google()` is OIDC with Google's issuer and a Workspace-domain check,
+* `microsoft()` is OIDC with a tenant's issuer. A provider that is not listed
+* needs no code, only `oidc()` and its issuer URL.
+*
+* A deployment writes them in its own code, where a misspelt option fails
+* the typecheck:
+*
+*   signin({ providers: [github({ clientId, clientSecret: env.GITHUB_SECRET, organization: 'acme' })] })
+*
+* Each returns a `SigninProvider`, and a provider that speaks neither can be
+* one of the deployment's own, in the same list.
+*/
+const PROVIDER_ID = /^[a-z0-9][a-z0-9-]{0,31}$/;
+const BRANDS = [
+	"github",
+	"google",
+	"microsoft",
+	"oidc"
+];
+function checkId(id) {
+	if (typeof id !== "string" || !PROVIDER_ID.test(id)) throw new Error(`sign-in provider id "${id}" must be 1-32 lowercase letters, digits or dashes`);
+	return id;
+}
+function credentials(id, options) {
+	if (!options.clientId || !options.clientSecret) throw new Error(`sign-in provider ${id} needs a client id and a client secret`);
+	return {
+		clientId: options.clientId,
+		clientSecret: options.clientSecret
+	};
+}
+/**
+* Any OpenID Connect provider, by issuer URL.
+*
+* Okta, Auth0, Keycloak, Authentik, Zitadel, Clerk, WorkOS, Dex and the like
+* all live here; so does a broker, for providers that only speak SAML or LDAP.
+*/
+function oidc(options) {
+	return new OidcSigninProvider(oidcConfig(options));
+}
+function oidcConfig(options) {
+	const id = checkId(options.id);
+	return {
+		id,
+		label: options.label,
+		brand: "oidc",
+		...credentials(id, options),
+		issuer: issuerUrl(options.issuer, `sign-in provider ${id}`),
+		scopes: options.scopes ?? [
+			"openid",
+			"email",
+			"profile"
+		],
+		authorizationParams: options.authorizationParams ?? {},
+		hostedDomain: null
+	};
+}
+/** Google accounts; with `domain`, only that Google Workspace's accounts. */
+function google(options) {
+	const domain = options.domain?.trim().toLowerCase() || null;
+	return new OidcSigninProvider({
+		...oidcConfig({
+			id: options.id ?? "google",
+			label: options.label ?? "Google",
+			issuer: "https://accounts.google.com",
+			clientId: options.clientId,
+			clientSecret: options.clientSecret,
+			authorizationParams: domain ? {
+				hd: domain,
+				prompt: "select_account"
+			} : { prompt: "select_account" }
+		}),
+		brand: "google",
+		hostedDomain: domain
+	});
+}
+const TENANT_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/**
+* Microsoft Entra ID, for one tenant.
+*
+* The tenant must be its GUID. Entra's multi-tenant endpoints (`common`,
+* `organizations`) publish an issuer template rather than an issuer, which
+* standard OIDC validation rejects, and "any work account in the world" is not
+* an audience a secrets manager wants anyway.
+*
+* Entra email claims do not prove address ownership. Sign in through another
+* provider and link the Microsoft account first; later sign-ins use its subject.
+*/
+function microsoft(options) {
+	const tenant = options.tenant.trim();
+	if (!TENANT_ID.test(tenant)) throw new Error("the Microsoft sign-in tenant must be the directory (tenant) ID, a GUID, not a domain or \"common\"");
+	return new OidcSigninProvider({
+		...oidcConfig({
+			id: options.id ?? "microsoft",
+			label: options.label ?? "Microsoft",
+			issuer: `https://login.microsoftonline.com/${tenant.toLowerCase()}/v2.0`,
+			clientId: options.clientId,
+			clientSecret: options.clientSecret,
+			authorizationParams: { prompt: "select_account" }
+		}),
+		brand: "microsoft"
+	});
+}
+/** GitHub accounts; with `organization`, only that organization's members. */
+function github(options) {
+	const id = checkId(options.id ?? "github");
+	return new GitHubSigninProvider({
+		id,
+		label: options.label ?? "GitHub",
+		brand: "github",
+		...credentials(id, options),
+		webUrl: baseUrl(options.webUrl ?? "https://github.com", `sign-in provider ${id} web URL`),
+		apiUrl: baseUrl(options.apiUrl ?? "https://api.github.com", `sign-in provider ${id} API URL`),
+		organization: options.organization?.trim() || null
+	});
+}
+function isLoopback(url) {
+	return url.hostname === "127.0.0.1" || url.hostname === "localhost" || url.hostname === "[::1]";
+}
+/** HTTPS, except on loopback, where the dev IdP runs. */
+function checkedUrl(value, what) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${what} must be an absolute URL`);
+	}
+	if (url.protocol !== "https:" && !(url.protocol === "http:" && isLoopback(url))) throw new Error(`${what} must use HTTPS`);
+	if (url.username !== "" || url.password !== "" || url.search !== "" || url.hash !== "") throw new Error(`${what} must not carry credentials, a query or a fragment`);
+	return url;
+}
+/**
+* Issuers are compared byte for byte with the `iss` of every token, so the
+* configured value is kept as written, less a trailing slash nobody means.
+*/
+function issuerUrl(value, what) {
+	checkedUrl(value, `${what} issuer`);
+	return value.endsWith("/") ? value.slice(0, -1) : value;
+}
+function baseUrl(value, what) {
+	const url = checkedUrl(value, what);
+	return url.href.endsWith("/") ? url.href.slice(0, -1) : url.href;
+}
+function publicOrigin(value) {
+	const url = checkedUrl(value, "the public URL");
+	if (url.pathname !== "/") throw new Error("the public URL must be an origin, with no path");
+	return url.origin;
+}
+/** Sign-in configuration, checked: at least one provider, each whole, ids unique, lifetimes sane. */
+function defineSignin(options) {
+	if (options.providers.length === 0) throw new Error("sign-in needs at least one provider");
+	const seen = /* @__PURE__ */ new Set();
+	for (const provider of options.providers) {
+		checkProvider(provider);
+		if (seen.has(provider.id)) throw new Error(`sign-in provider id "${provider.id}" is used twice`);
+		seen.add(provider.id);
+	}
+	return {
+		publicUrl: publicOrigin(options.publicUrl),
+		providers: options.providers,
+		page: {
+			title: options.page?.title ?? "Sign in to coffre",
+			note: options.page?.note ?? null
+		},
+		browserSessionHours: lifetime(options.browserSessionHours, "browserSessionHours", 12, 168),
+		cliSessionDays: lifetime(options.cliSessionDays, "cliSessionDays", 30, 365)
+	};
+}
+/** A deployment's own provider is checked like coffre's: it is only typed, not trusted. */
+function checkProvider(provider) {
+	checkId(provider?.id);
+	if (typeof provider.issuer !== "string" || provider.issuer.trim() === "") throw new Error(`sign-in provider ${provider.id} needs a stable issuer`);
+	if (typeof provider.label !== "string" || provider.label.trim() === "") throw new Error(`sign-in provider ${provider.id} needs a label`);
+	if (!BRANDS.includes(provider.brand)) throw new Error(`sign-in provider ${provider.id}'s brand must be one of ${BRANDS.join(", ")}`);
+	if (typeof provider.start !== "function" || typeof provider.finish !== "function") throw new Error(`sign-in provider ${provider.id} needs start() and finish()`);
+}
+function lifetime(value, name, fallback, max) {
+	if (value === void 0) return fallback;
+	if (!Number.isFinite(value) || value <= 0 || value > max) throw new Error(`${name} must be a number above 0 and at most ${max}`);
+	return value;
+}
+//#endregion
+//#region src/identity/auth.ts
+function httpsOrigin(what, value) {
+	let url;
+	try {
+		url = new URL(value);
+	} catch {
+		throw new Error(`${what} must be an absolute URL`);
+	}
+	if (url.protocol !== "https:" || url.username !== "" || url.password !== "" || url.pathname !== "/" || url.search !== "" || url.hash !== "") throw new Error(`${what} must be an HTTPS origin, with no path, query or credentials`);
+	return url;
+}
+function checkAudience(audience) {
+	if (audience.length === 0 || audience.length > 64 || /\s/.test(audience)) throw new Error("the Access audience must be a non-whitespace Access AUD tag of at most 64 characters");
+	return audience;
+}
+/**
+* Cloudflare Access in front of coffre: every request carries Access's
+* signed assertion, checked against the team's keys and the application's
+* AUD tag.
+*
+*   cloudflareAccess({ teamDomain: 'acme.cloudflareaccess.com', audience: env.ACCESS_AUD })
+*/
+function cloudflareAccess(options) {
+	const domain = options.teamDomain.trim();
+	const issuerUrl = httpsOrigin("the Access team domain", domain.includes("://") ? domain : `https://${domain}`);
+	if (issuerUrl.port !== "" || !issuerUrl.hostname.endsWith(".cloudflareaccess.com") || issuerUrl.hostname === "cloudflareaccess.com") throw new Error("the Access team domain must be <team>.cloudflareaccess.com");
+	const issuer = issuerUrl.origin;
+	const config = {
+		mode: "cloudflare",
+		access: {
+			issuer,
+			jwksUrl: `${issuer}/cdn-cgi/access/certs`,
+			audience: checkAudience(options.audience.trim())
+		}
+	};
+	return { resolve: () => config };
+}
+/**
+* coffre's own sign-in page, with these providers:
+*
+*   signin({ providers: [github({ clientId, clientSecret, organization: 'acme' })] })
+*/
+function signin(options) {
+	defineSignin({
+		...toSignin(options),
+		publicUrl: "https://coffre.invalid"
+	});
+	return { resolve: (publicUrl) => ({
+		mode: "signin",
+		signin: defineSignin({
+			...toSignin(options),
+			publicUrl
+		})
+	}) };
+}
+function toSignin(options) {
+	return {
+		providers: options.providers,
+		page: {
+			title: options.title,
+			note: options.note
+		},
+		browserSessionHours: options.browserSessionHours,
+		cliSessionDays: options.cliSessionDays
+	};
+}
+//#endregion
+//#region src/identity/signin/sealed.ts
+const IV_BYTES = 12;
+const VERSION = "v1";
+/**
+* Derive a purpose-bound key from one of coffre's existing 32-byte secrets.
+*
+* HKDF with a distinct `info` string gives a key that is independent of the
+* source for every practical purpose, so the sign-in cookie needs no new
+* secret to provision and a leak of one derived key says nothing about the
+* others.
+*/
+function deriveKey(secret, purpose) {
+	return Buffer.from(hkdfSync("sha256", secret, Buffer.alloc(0), `coffre/${purpose}`, 32));
+}
+/**
+* Encrypt a small JSON value for a round trip through the browser.
+*
+* AES-256-GCM authenticates as well as hides, so a tampered or forged value
+* fails to open rather than decoding into something else. The expiry sits
+* inside the ciphertext, which keeps an old cookie from being replayed past
+* it even by a client that ignores Max-Age.
+*/
+function seal(key, value, ttlSeconds, now = Date.now()) {
+	const iv = randomBytes(IV_BYTES);
+	const cipher = createCipheriv("aes-256-gcm", key, iv);
+	cipher.setAAD(Buffer.from(VERSION));
+	const plaintext = Buffer.from(JSON.stringify({
+		exp: now + ttlSeconds * 1e3,
+		value
+	}));
+	const ciphertext = Buffer.concat([cipher.update(plaintext), cipher.final()]);
+	return `${VERSION}.${Buffer.concat([
+		iv,
+		cipher.getAuthTag(),
+		ciphertext
+	]).toString("base64url")}`;
+}
+/** The sealed value, or null when it is malformed, forged, tampered with or expired. */
+function unseal(key, sealed, now = Date.now()) {
+	if (!sealed?.startsWith(`${VERSION}.`)) return null;
+	const raw = Buffer.from(sealed.slice(3), "base64url");
+	if (raw.length <= 28) return null;
+	try {
+		const decipher = createDecipheriv("aes-256-gcm", key, raw.subarray(0, IV_BYTES));
+		decipher.setAAD(Buffer.from(VERSION));
+		decipher.setAuthTag(raw.subarray(IV_BYTES, 28));
+		const plaintext = Buffer.concat([decipher.update(raw.subarray(28)), decipher.final()]);
+		const parsed = JSON.parse(plaintext.toString("utf8"));
+		if (typeof parsed.exp !== "number" || parsed.exp <= now) return null;
+		return parsed.value;
+	} catch {
+		return null;
+	}
+}
+//#endregion
+//#region src/identity/tokens.ts
+const PREFIX = {
+	browser: "coffre_web_",
+	cli: "coffre_cli_",
+	service: "coffre_svc_"
+};
+const TOKEN = /^coffre_(web|cli|svc)_[A-Za-z0-9_-]{43}$/;
+function generateToken(kind) {
+	return PREFIX[kind] + randomBytes(32).toString("base64url");
+}
+/** Whether a string has the shape of a coffre token, before any lookup. */
+function isCoffreToken(value) {
+	return TOKEN.test(value);
+}
+function hashToken(token) {
+	return createHash("sha256").update(token, "utf8").digest();
+}
+/**
+* Enough of a token to recognize it in a list, never enough to use it: the
+* kind prefix and the last four characters. The prefix is matched rather than
+* cut at the last underscore, because base64url uses `_` too.
+*/
+function tokenHint(token) {
+	return `${Object.values(PREFIX).find((candidate) => token.startsWith(candidate)) ?? ""}…${token.slice(-4)}`;
+}
+//#endregion
+//#region src/identity/types.ts
+/** Access delivers the JWT to the origin in this header. */
+const ACCESS_JWT_HEADER = "cf-access-jwt-assertion";
+//#endregion
+//#region src/identity/verifier.ts
+/**
+* Signature algorithms we accept, as an explicit allowlist.
+*
+* Without this, the algorithm is taken from the attacker-controlled token
+* header, which is how `alg: none` and RS256->HS256 confusion work. jose
+* defaults to permitting whatever the key supports; we do not rely on that.
+*/
+const ALLOWED_ALGORITHMS = ["RS256", "ES256"];
+function asNonEmptyString(value) {
+	return typeof value === "string" && value.length > 0 ? value : null;
+}
+/**
+* Verifies Cloudflare Access JWTs.
+*
+* Signature and claim verification for the TanStack request boundary. The
+* boundary also rejects `x-middleware-subrequest` before calling this verifier.
+*/
+var AccessIdentityVerifier = class {
+	#config;
+	#jwks;
+	constructor(config) {
+		this.#config = config;
+		this.#jwks = createRemoteJWKSet(new URL(config.jwksUrl), {
+			cooldownDuration: 3e4,
+			cacheMaxAge: 6e5
+		});
+	}
+	async verify(token) {
+		if (typeof token !== "string" || token.length === 0) throw new Error("missing or empty Access token");
+		const { payload } = await jwtVerify(token, this.#jwks, {
+			issuer: this.#config.issuer,
+			audience: this.#config.audience,
+			algorithms: [...ALLOWED_ALGORITHMS],
+			clockTolerance: this.#config.clockToleranceSeconds ?? 0
+		});
+		return toPrincipal(payload);
+	}
+};
+/**
+* Derive the caller from verified claims.
+*
+* Order matters. A service token is identified by `common_name` and carries an
+* empty `sub`; an identity token carries both `sub` and `email`. Anything else
+* is rejected rather than being allowed through as an authenticated caller
+* with no name -- an audit row with a null actor answers no question worth
+* asking.
+*/
+function toPrincipal(claims) {
+	const commonName = asNonEmptyString(claims.common_name);
+	if (commonName !== null) return {
+		type: "service",
+		id: commonName,
+		commonName
+	};
+	const email = asNonEmptyString(claims.email);
+	const subject = asNonEmptyString(claims.sub);
+	if (email !== null && subject !== null) {
+		const id = email.toLowerCase();
+		return {
+			type: "user",
+			id,
+			email: id,
+			subject
+		};
+	}
+	throw new Error("token verified but carries no usable identity: expected common_name (service) or sub+email (user)");
+}
+//#endregion
+export { ACCESS_JWT_HEADER, AccessIdentityVerifier, GitHubSigninProvider, OidcSigninProvider, SigninError, cloudflareAccess, defineSignin, deriveKey, generateToken, github, google, hashToken, isCoffreToken, microsoft, oidc, publicOrigin, seal, signin, toPrincipal, tokenHint, unseal };