@ericminassian/platform 0.0.0-stage → 0.1.0

package/dist/app.d.ts

@@ -0,0 +1,10 @@
+export interface AppInfo {
+    name: string;
+    stage: string;
+    host: string;
+    url: string;
+    revision: string;
+    isLocal: boolean;
+}
+/** Facts about the running app stage (lazy: read from bindings on access). */
+export declare const app: AppInfo;

package/dist/app.js

@@ -0,0 +1,23 @@
+import { getBindings } from './bindings.js';
+/** Facts about the running app stage (lazy: read from bindings on access). */
+export const app = {
+    get name() {
+        return getBindings().app;
+    },
+    get stage() {
+        return getBindings().stage;
+    },
+    get host() {
+        return getBindings().host;
+    },
+    get url() {
+        return getBindings().url;
+    },
+    get revision() {
+        return getBindings().revision;
+    },
+    get isLocal() {
+        return process.env.PLATFORM_LOCAL === '1';
+    },
+};
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAW5C,8EAA8E;AAC9E,MAAM,CAAC,MAAM,GAAG,GAAY;IAC1B,IAAI,IAAI;QACN,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,IAAI,KAAK;QACP,OAAO,WAAW,EAAE,CAAC,KAAK,CAAC;IAC7B,CAAC;IACD,IAAI,IAAI;QACN,OAAO,WAAW,EAAE,CAAC,IAAI,CAAC;IAC5B,CAAC;IACD,IAAI,GAAG;QACL,OAAO,WAAW,EAAE,CAAC,GAAG,CAAC;IAC3B,CAAC;IACD,IAAI,QAAQ;QACV,OAAO,WAAW,EAAE,CAAC,QAAQ,CAAC;IAChC,CAAC;IACD,IAAI,OAAO;QACT,OAAO,OAAO,CAAC,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC;IAC5C,CAAC;CACF,CAAC"}

package/dist/auth/cookies.d.ts

@@ -0,0 +1,10 @@
+export declare function parseCookies(header: string | null | undefined): Record<string, string>;
+export interface CookieOptions {
+    maxAge?: number;
+    path?: string;
+    httpOnly?: boolean;
+    secure?: boolean;
+    sameSite?: 'Lax' | 'Strict' | 'None';
+}
+export declare function serializeCookie(name: string, value: string, opts?: CookieOptions): string;
+export declare function clearCookie(name: string, opts?: Omit<CookieOptions, 'maxAge'>): string;

package/dist/auth/cookies.js

@@ -0,0 +1,37 @@
+export function parseCookies(header) {
+    const out = {};
+    if (!header)
+        return out;
+    for (const part of header.split(';')) {
+        const i = part.indexOf('=');
+        if (i <= 0)
+            continue;
+        const name = part.slice(0, i).trim();
+        const raw = part.slice(i + 1).trim();
+        if (!name || name in out)
+            continue;
+        try {
+            out[name] = decodeURIComponent(raw);
+        }
+        catch {
+            out[name] = raw;
+        }
+    }
+    return out;
+}
+export function serializeCookie(name, value, opts = {}) {
+    const parts = [`${name}=${encodeURIComponent(value)}`];
+    parts.push(`Path=${opts.path ?? '/'}`);
+    if (opts.maxAge !== undefined)
+        parts.push(`Max-Age=${Math.floor(opts.maxAge)}`);
+    if (opts.httpOnly ?? true)
+        parts.push('HttpOnly');
+    if (opts.secure)
+        parts.push('Secure');
+    parts.push(`SameSite=${opts.sameSite ?? 'Lax'}`);
+    return parts.join('; ');
+}
+export function clearCookie(name, opts = {}) {
+    return serializeCookie(name, '', { ...opts, maxAge: 0 });
+}
+//# sourceMappingURL=cookies.js.map

package/dist/auth/cookies.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cookies.js","sourceRoot":"","sources":["../../src/auth/cookies.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACxB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,IAAI,IAAI,IAAI,IAAI,GAAG;YAAE,SAAS;QACnC,IAAI,CAAC;YACH,GAAG,CAAC,IAAI,CAAC,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC;QAClB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAUD,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,KAAa,EAAE,IAAI,GAAkB,EAAE;IACnF,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,IAAI,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACvD,KAAK,CAAC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS;QAAE,KAAK,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAChF,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM;QAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACtC,KAAK,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,QAAQ,IAAI,KAAK,EAAE,CAAC,CAAC;IACjD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY,EAAE,IAAI,GAAkC,EAAE;IAChF,OAAO,eAAe,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;AAC3D,CAAC"}

package/dist/auth/index.d.ts

@@ -0,0 +1,22 @@
+import { type Bindings, type PlatformUser } from '@ericminassian/platform-core';
+import { type Tokens } from './tokens.ts';
+export interface Auth {
+    /** The signed-in user for this request, or null. */
+    getUser(request: Request): Promise<PlatformUser | null>;
+    /** Like getUser but throws a 401 Response when signed out. */
+    requireUser(request: Request): Promise<PlatformUser>;
+    /** Path to start sign-in, returning to `redirect` afterwards. */
+    loginUrl(redirect?: string): string;
+    logoutUrl(redirect?: string): string;
+}
+export declare function sessionCookies(b: Bindings, tokens: Tokens): string[];
+export declare function clearSessionCookies(b: Bindings): string[];
+export declare function unauthorized(): Response;
+export declare const auth: Auth;
+/**
+ * `auth.required`: redirect signed-out browsers to sign-in and 401 everything
+ * else. Returns a Response to short-circuit, or null to continue.
+ */
+export declare function authGate(request: Request): Promise<Response | null>;
+/** Handles the auth routes; returns null for other paths. */
+export declare function handleAuthRoute(request: Request): Promise<Response | null>;

package/dist/auth/index.js

@@ -0,0 +1,217 @@
+import { AUTH_COOKIES, AUTH_ROUTES, AUTH_SCOPES, } from '@ericminassian/platform-core';
+import { getBindings } from '../bindings.js';
+import { currentContext } from '../context.js';
+import { log } from '../telemetry.js';
+import { clearCookie, parseCookies, serializeCookie } from './cookies.js';
+import { challengeFor, createVerifier, decodeFlow, encodeFlow, randomState, safeRedirect } from './pkce.js';
+import { exchangeCode, isExpiredError, localSignIn, refreshTokens, verifyToken, } from './tokens.js';
+const SESSION_MAX_AGE = 30 * 24 * 3600;
+const FLOW_MAX_AGE = 600;
+function authBindings() {
+    const a = getBindings().auth;
+    if (!a)
+        throw new Error('Auth is not enabled for this app. Add `"auth": true` to platform.json.');
+    return a;
+}
+function secure(b) {
+    return b.url.startsWith('https:');
+}
+export function sessionCookies(b, tokens) {
+    const opts = { maxAge: SESSION_MAX_AGE, secure: secure(b) };
+    const out = [serializeCookie(AUTH_COOKIES.id, tokens.idToken, opts)];
+    if (tokens.refreshToken)
+        out.push(serializeCookie(AUTH_COOKIES.refresh, tokens.refreshToken, opts));
+    return out;
+}
+export function clearSessionCookies(b) {
+    return [
+        clearCookie(AUTH_COOKIES.id, { secure: secure(b) }),
+        clearCookie(AUTH_COOKIES.refresh, { secure: secure(b) }),
+    ];
+}
+function bearer(request) {
+    const h = request.headers.get('authorization');
+    const m = h ? /^Bearer\s+(.+)$/i.exec(h) : null;
+    return m?.[1];
+}
+async function resolveUser(request) {
+    const ctx = currentContext();
+    if (ctx && ctx.user !== undefined)
+        return ctx.user;
+    const b = getBindings();
+    const a = authBindings();
+    const cookies = parseCookies(request.headers.get('cookie'));
+    const idToken = cookies[AUTH_COOKIES.id] ?? bearer(request);
+    const refresh = cookies[AUTH_COOKIES.refresh];
+    let user = null;
+    let expired = !idToken;
+    if (idToken) {
+        try {
+            user = await verifyToken(a, idToken);
+        }
+        catch (e) {
+            expired = isExpiredError(e);
+            if (!expired)
+                log.debug('auth: rejected session token', { reason: e.message });
+        }
+    }
+    if (!user && expired && refresh) {
+        try {
+            const tokens = await refreshTokens(a, refresh);
+            user = await verifyToken(a, tokens.idToken);
+            ctx?.cookies.push(...sessionCookies(b, tokens));
+        }
+        catch (e) {
+            log.debug('auth: refresh failed', { reason: e.message });
+            ctx?.cookies.push(...clearSessionCookies(b));
+        }
+    }
+    if (ctx)
+        ctx.user = user;
+    return user;
+}
+export function unauthorized() {
+    return Response.json({ error: { code: 'unauthorized', message: 'Sign in required', loginUrl: AUTH_ROUTES.login } }, { status: 401, headers: { 'cache-control': 'no-store' } });
+}
+export const auth = {
+    getUser: (request) => resolveUser(request),
+    async requireUser(request) {
+        const user = await resolveUser(request);
+        if (!user)
+            throw unauthorized();
+        return user;
+    },
+    loginUrl: (redirect = '/') => `${AUTH_ROUTES.login}?redirect=${encodeURIComponent(safeRedirect(redirect))}`,
+    logoutUrl: (redirect = '/') => `${AUTH_ROUTES.logout}?redirect=${encodeURIComponent(safeRedirect(redirect))}`,
+};
+/**
+ * `auth.required`: redirect signed-out browsers to sign-in and 401 everything
+ * else. Returns a Response to short-circuit, or null to continue.
+ */
+export async function authGate(request) {
+    const a = getBindings().auth;
+    if (!a?.required)
+        return null;
+    if (await resolveUser(request))
+        return null;
+    const url = new URL(request.url);
+    const wantsHtml = request.method === 'GET' && (request.headers.get('accept') ?? '').includes('text/html');
+    if (wantsHtml)
+        return redirect(auth.loginUrl(url.pathname + url.search));
+    return unauthorized();
+}
+function redirect(location, cookies = [], status = 302) {
+    const headers = new Headers({ location, 'cache-control': 'no-store' });
+    for (const c of cookies)
+        headers.append('set-cookie', c);
+    return new Response(null, { status, headers });
+}
+// ---------------------------------------------------------------- /__platform/auth/*
+/** Handles the auth routes; returns null for other paths. */
+export async function handleAuthRoute(request) {
+    const url = new URL(request.url);
+    const route = Object.values(AUTH_ROUTES).find((p) => p === url.pathname);
+    if (!route)
+        return null;
+    const b = getBindings();
+    const a = b.auth;
+    if (!a)
+        return Response.json({ error: { code: 'not_found', message: 'Auth is not enabled' } }, { status: 404 });
+    if (route === AUTH_ROUTES.me) {
+        const user = await resolveUser(request);
+        return user ? Response.json(user, { headers: { 'cache-control': 'no-store' } }) : unauthorized();
+    }
+    if (route === AUTH_ROUTES.logout) {
+        const back = safeRedirect(url.searchParams.get('redirect'));
+        if (a.mode === 'local')
+            return redirect(back, clearSessionCookies(b));
+        const target = new URL(`${a.loginUrl.replace(/\/$/, '')}/logout`);
+        target.searchParams.set('client_id', a.clientId);
+        target.searchParams.set('logout_uri', `${b.url}/`);
+        return redirect(target.toString(), clearSessionCookies(b));
+    }
+    if (a.mode === 'local')
+        return localRoute(request, b, a, route);
+    const callbackUrl = `${b.url}${AUTH_ROUTES.callback}`;
+    if (route === AUTH_ROUTES.login) {
+        const verifier = createVerifier();
+        const state = randomState();
+        const flow = encodeFlow({ v: verifier, s: state, r: safeRedirect(url.searchParams.get('redirect')) });
+        const target = new URL(`${a.loginUrl.replace(/\/$/, '')}/oauth2/authorize`);
+        target.search = new URLSearchParams({
+            client_id: a.clientId,
+            response_type: 'code',
+            scope: AUTH_SCOPES.join(' '),
+            redirect_uri: callbackUrl,
+            state,
+            code_challenge: challengeFor(verifier),
+            code_challenge_method: 'S256',
+        }).toString();
+        return redirect(target.toString(), [
+            serializeCookie(AUTH_COOKIES.flow, flow, {
+                maxAge: FLOW_MAX_AGE,
+                secure: secure(b),
+                path: '/__platform/auth',
+            }),
+        ]);
+    }
+    // callback
+    const flow = decodeFlow(parseCookies(request.headers.get('cookie'))[AUTH_COOKIES.flow]);
+    const code = url.searchParams.get('code');
+    const clearFlow = clearCookie(AUTH_COOKIES.flow, { secure: secure(b), path: '/__platform/auth' });
+    if (url.searchParams.get('error')) {
+        return redirect(flow?.r ?? '/', [clearFlow]);
+    }
+    if (!flow || !code || url.searchParams.get('state') !== flow.s) {
+        return new Response('Sign-in expired or was tampered with. Please try again.', {
+            status: 400,
+            headers: { 'set-cookie': clearFlow, 'cache-control': 'no-store' },
+        });
+    }
+    const tokens = await exchangeCode(a, code, flow.v, callbackUrl);
+    return redirect(flow.r, [...sessionCookies(b, tokens), clearFlow]);
+}
+async function localRoute(request, b, a, route) {
+    const url = new URL(request.url);
+    if (route === AUTH_ROUTES.login && request.method === 'POST') {
+        const form = await request.formData();
+        const email = String(form.get('email') ?? '')
+            .trim()
+            .toLowerCase();
+        const name = String(form.get('name') ?? '').trim();
+        const back = safeRedirect(String(form.get('redirect') ?? '/'));
+        if (!/^[^\s@]+@[^\s@]+$/.test(email))
+            return html(loginPage(b, back, 'Enter an email address.'), 400);
+        const tokens = await localSignIn(a, email, name || undefined);
+        return redirect(back, sessionCookies(b, tokens), 303);
+    }
+    if (route === AUTH_ROUTES.login)
+        return html(loginPage(b, safeRedirect(url.searchParams.get('redirect'))));
+    // No hosted UI locally; callback is never used.
+    return redirect('/');
+}
+function html(body, status = 200) {
+    return new Response(body, {
+        status,
+        headers: { 'content-type': 'text/html; charset=utf-8', 'cache-control': 'no-store' },
+    });
+}
+function escapeHtml(s) {
+    return s.replace(/[&<>"']/g, (c) => `&#${c.charCodeAt(0)};`);
+}
+function loginPage(b, back, error) {
+    return `<!doctype html><html><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1">
+<title>Sign in · ${escapeHtml(b.app)} (local)</title>
+<style>body{font:16px system-ui,sans-serif;display:grid;place-items:center;min-height:100vh;margin:0;background:#f6f7f9;color:#111}
+form{background:#fff;padding:2rem;border-radius:12px;box-shadow:0 1px 3px #0002;display:grid;gap:.75rem;min-width:18rem}
+input,button{font:inherit;padding:.6rem .75rem;border-radius:8px;border:1px solid #ccd}button{background:#111;color:#fff;border:0;cursor:pointer}
+small{color:#667}.err{color:#b00}</style></head><body>
+<form method="post" action="${AUTH_ROUTES.login}">
+<strong>Sign in to ${escapeHtml(b.app)}</strong><small>Local development: any email works. Users live in the AWS Emulator.</small>
+${error ? `<span class="err">${escapeHtml(error)}</span>` : ''}
+<input name="email" type="email" placeholder="you@example.com" required autofocus>
+<input name="name" placeholder="Name (optional)">
+<input type="hidden" name="redirect" value="${escapeHtml(back)}">
+<button type="submit">Sign in</button></form></body></html>`;
+}
+//# sourceMappingURL=index.js.map

package/dist/auth/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/auth/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,YAAY,EACZ,WAAW,EACX,WAAW,GAIZ,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,EAAE,GAAG,EAAE,MAAM,iBAAiB,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC1E,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC5G,OAAO,EACL,YAAY,EACZ,cAAc,EACd,WAAW,EACX,aAAa,EAEb,WAAW,GACZ,MAAM,aAAa,CAAC;AAYrB,MAAM,eAAe,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AACvC,MAAM,YAAY,GAAG,GAAG,CAAC;AAEzB,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAClG,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAS,MAAM,CAAC,CAAW;IACzB,OAAO,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAW,EAAE,MAAc;IACxD,MAAM,IAAI,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5D,MAAM,GAAG,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,EAAE,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,YAAY;QAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;IACpG,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAW;IAC7C,OAAO;QACL,WAAW,CAAC,YAAY,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,WAAW,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,MAAM,CAAC,OAAgB;IAC9B,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;IAC/C,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChD,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,OAAgB;IACzC,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IACnD,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,IAAI,GAAwB,IAAI,CAAC;IACrC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC;IACvB,IAAI,OAAO,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,GAAG,CAAC,KAAK,CAAC,8BAA8B,EAAE,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC5F,CAAC;IACH,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,OAAO,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC/C,IAAI,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YAC5C,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,GAAG,CAAC,KAAK,CAAC,sBAAsB,EAAE,EAAE,MAAM,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YACpE,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC;IACzB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,YAAY;IAC1B,OAAO,QAAQ,CAAC,IAAI,CAClB,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,kBAAkB,EAAE,QAAQ,EAAE,WAAW,CAAC,KAAK,EAAE,EAAE,EAC7F,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAC1D,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,IAAI,GAAS;IACxB,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,WAAW,CAAC,OAAO,CAAC;IAC1C,KAAK,CAAC,WAAW,CAAC,OAAO;QACvB,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,CAAC,IAAI;YAAE,MAAM,YAAY,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,QAAQ,EAAE,CAAC,QAAQ,GAAG,GAAG,EAAE,EAAE,CAAC,GAAG,WAAW,CAAC,KAAK,aAAa,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE;IAC3G,SAAS,EAAE,CAAC,QAAQ,GAAG,GAAG,EAAE,EAAE,CAC5B,GAAG,WAAW,CAAC,MAAM,aAAa,kBAAkB,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE;CACjF,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,OAAgB;IAC7C,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC;IAC7B,IAAI,CAAC,CAAC,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,MAAM,WAAW,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC1G,IAAI,SAAS;QAAE,OAAO,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;IACzE,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,QAAQ,CAAC,QAAgB,EAAE,OAAO,GAAa,EAAE,EAAE,MAAM,GAAG,GAAG;IACtE,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,OAAO;QAAE,OAAO,CAAC,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC;IACzD,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACjD,CAAC;AAED,sFAAsF;AAEtF,6DAA6D;AAC7D,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,CAAC,GAAG,WAAW,EAAE,CAAC;IACxB,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,IAAI,CAAC,CAAC;QACJ,OAAO,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,qBAAqB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;IAE1G,IAAI,KAAK,KAAK,WAAW,CAAC,EAAE,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,CAAC;QACxC,OAAO,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACnG,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,CAAC,MAAM,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;QAC5D,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC;QAClE,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC;QACjD,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,mBAAmB,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,CAAC,IAAI,KAAK,OAAO;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,CAAC,CAAC;IAEhE,MAAM,WAAW,GAAG,GAAG,CAAC,CAAC,GAAG,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtD,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,UAAU,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,CAAC;QAC5E,MAAM,CAAC,MAAM,GAAG,IAAI,eAAe,CAAC;YAClC,SAAS,EAAE,CAAC,CAAC,QAAQ;YACrB,aAAa,EAAE,MAAM;YACrB,KAAK,EAAE,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5B,YAAY,EAAE,WAAW;YACzB,KAAK;YACL,cAAc,EAAE,YAAY,CAAC,QAAQ,CAAC;YACtC,qBAAqB,EAAE,MAAM;SAC9B,CAAC,CAAC,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE;YACjC,eAAe,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE;gBACvC,MAAM,EAAE,YAAY;gBACpB,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;gBACjB,IAAI,EAAE,kBAAkB;aACzB,CAAC;SACH,CAAC,CAAC;IACL,CAAC;IACD,WAAW;IACX,MAAM,IAAI,GAAG,UAAU,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,SAAS,GAAG,WAAW,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC;IAClG,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAClC,OAAO,QAAQ,CAAC,IAAI,EAAE,CAAC,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,QAAQ,CAAC,yDAAyD,EAAE;YAC7E,MAAM,EAAE,GAAG;YACX,OAAO,EAAE,EAAE,YAAY,EAAE,SAAS,EAAE,eAAe,EAAE,UAAU,EAAE;SAClE,CAAC,CAAC;IACL,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IAChE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,OAAgB,EAAE,CAAW,EAAE,CAAe,EAAE,KAAa;IACrF,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACjC,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK,IAAI,OAAO,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,QAAQ,EAAE,CAAC;QACtC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;aAC1C,IAAI,EAAE;aACN,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;QAC/D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,yBAAyB,CAAC,EAAE,GAAG,CAAC,CAAC;QACtG,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,IAAI,SAAS,CAAC,CAAC;QAC9D,OAAO,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;IACxD,CAAC;IACD,IAAI,KAAK,KAAK,WAAW,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,EAAE,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3G,gDAAgD;IAChD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,IAAY,EAAE,MAAM,GAAG,GAAG;IACtC,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE;QACxB,MAAM;QACN,OAAO,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,eAAe,EAAE,UAAU,EAAE;KACrF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,CAAW,EAAE,IAAY,EAAE,KAAc;IAC1D,OAAO;mBACU,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;;;;;8BAKN,WAAW,CAAC,KAAK;qBAC1B,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC;EACpC,KAAK,CAAC,CAAC,CAAC,qBAAqB,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;;;8CAGhB,UAAU,CAAC,IAAI,CAAC;4DACF,CAAC;AAC7D,CAAC"}

package/dist/auth/pkce.d.ts

@@ -0,0 +1,16 @@
+/** RFC 7636 code verifier (43-128 chars of unreserved characters). */
+export declare function createVerifier(): string;
+export declare function challengeFor(verifier: string): string;
+export declare function randomState(): string;
+export interface FlowState {
+    /** PKCE verifier. */
+    v: string;
+    /** OAuth state. */
+    s: string;
+    /** Path to return to after sign-in. */
+    r: string;
+}
+export declare function encodeFlow(f: FlowState): string;
+export declare function decodeFlow(raw: string | undefined): FlowState | null;
+/** Only same-origin absolute paths are allowed as post-login destinations. */
+export declare function safeRedirect(target: string | null | undefined): string;

package/dist/auth/pkce.js

@@ -0,0 +1,32 @@
+import { createHash, randomBytes } from 'node:crypto';
+/** RFC 7636 code verifier (43-128 chars of unreserved characters). */
+export function createVerifier() {
+    return randomBytes(32).toString('base64url');
+}
+export function challengeFor(verifier) {
+    return createHash('sha256').update(verifier).digest('base64url');
+}
+export function randomState() {
+    return randomBytes(16).toString('base64url');
+}
+export function encodeFlow(f) {
+    return Buffer.from(JSON.stringify(f)).toString('base64url');
+}
+export function decodeFlow(raw) {
+    if (!raw)
+        return null;
+    try {
+        const f = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+        return typeof f.v === 'string' && typeof f.s === 'string' && typeof f.r === 'string' ? f : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Only same-origin absolute paths are allowed as post-login destinations. */
+export function safeRedirect(target) {
+    if (!target?.startsWith('/') || target.startsWith('//') || target.includes('\\'))
+        return '/';
+    return target;
+}
+//# sourceMappingURL=pkce.js.map

package/dist/auth/pkce.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pkce.js","sourceRoot":"","sources":["../../src/auth/pkce.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAEtD,sEAAsE;AACtE,MAAM,UAAU,cAAc;IAC5B,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB;IAC3C,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC/C,CAAC;AAWD,MAAM,UAAU,UAAU,CAAC,CAAY;IACrC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,GAAuB;IAChD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAc,CAAC;QAClF,OAAO,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,IAAI,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IAC7F,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/auth/tokens.d.ts

@@ -0,0 +1,17 @@
+import type { AuthBindings, PlatformUser } from '@ericminassian/platform-core';
+import { type JWTPayload } from 'jose';
+export interface Tokens {
+    idToken: string;
+    refreshToken?: string;
+}
+/** Verify a Cognito ID (or access) token for this app's client and map it to a user. */
+export declare function verifyToken(auth: AuthBindings, token: string): Promise<PlatformUser>;
+export declare function isExpiredError(e: unknown): boolean;
+export declare function toUser(p: JWTPayload): PlatformUser;
+export declare function exchangeCode(auth: AuthBindings, code: string, verifier: string, redirectUri: string): Promise<Tokens>;
+export declare function refreshTokens(auth: AuthBindings, refreshToken: string): Promise<Tokens>;
+/**
+ * `plat dev` sign-in against the AWS Emulator's Cognito (no hosted UI there):
+ * create the user if needed, set a throwaway password, and authenticate.
+ */
+export declare function localSignIn(auth: AuthBindings, email: string, name?: string): Promise<Tokens>;

package/dist/auth/tokens.js

@@ -0,0 +1,142 @@
+import { randomBytes } from 'node:crypto';
+import { createRemoteJWKSet, errors as joseErrors, jwtVerify } from 'jose';
+import { client } from '../clients.js';
+const jwksCache = new Map();
+function jwks(uri) {
+    let set = jwksCache.get(uri);
+    if (!set) {
+        set = createRemoteJWKSet(new URL(uri), { cooldownDuration: 30_000, cacheMaxAge: 3_600_000 });
+        jwksCache.set(uri, set);
+    }
+    return set;
+}
+/** Verify a Cognito ID (or access) token for this app's client and map it to a user. */
+export async function verifyToken(auth, token) {
+    const { payload } = await jwtVerify(token, jwks(auth.jwksUri), { issuer: auth.issuer });
+    const use = payload.token_use;
+    if (use === 'id') {
+        const aud = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+        if (!aud.includes(auth.clientId))
+            throw new joseErrors.JWTClaimValidationFailed('unexpected "aud" claim value', payload, 'aud');
+    }
+    else if (use === 'access') {
+        if (payload.client_id !== auth.clientId)
+            throw new joseErrors.JWTClaimValidationFailed('unexpected "client_id" claim value', payload, 'client_id');
+    }
+    else {
+        throw new joseErrors.JWTClaimValidationFailed('unexpected "token_use" claim value', payload, 'token_use');
+    }
+    return toUser(payload);
+}
+export function isExpiredError(e) {
+    return e instanceof joseErrors.JWTExpired;
+}
+export function toUser(p) {
+    const str = (k) => (typeof p[k] === 'string' ? p[k] : undefined);
+    const name = str('name') ?? ([str('given_name'), str('family_name')].filter(Boolean).join(' ') || undefined);
+    const groups = Array.isArray(p['cognito:groups']) ? p['cognito:groups'].map(String) : [];
+    const user = { id: String(p.sub), groups };
+    const email = str('email');
+    if (email)
+        user.email = email;
+    if (p.email_verified !== undefined)
+        user.emailVerified = p.email_verified === true || p.email_verified === 'true';
+    if (name)
+        user.name = name;
+    return user;
+}
+// ---------------------------------------------------------------- hosted login (cognito mode)
+async function tokenRequest(auth, params) {
+    const res = await fetch(`${auth.loginUrl.replace(/\/$/, '')}/oauth2/token`, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({ client_id: auth.clientId, ...params }),
+    });
+    if (!res.ok)
+        throw new Error(`Cognito token endpoint returned ${res.status}: ${(await res.text()).slice(0, 200)}`);
+    const json = (await res.json());
+    if (!json.id_token)
+        throw new Error('Cognito token endpoint returned no id_token');
+    return { idToken: json.id_token, ...(json.refresh_token ? { refreshToken: json.refresh_token } : {}) };
+}
+export function exchangeCode(auth, code, verifier, redirectUri) {
+    return tokenRequest(auth, {
+        grant_type: 'authorization_code',
+        code,
+        code_verifier: verifier,
+        redirect_uri: redirectUri,
+    });
+}
+export async function refreshTokens(auth, refreshToken) {
+    if (auth.mode === 'local') {
+        const { InitiateAuthCommand } = await import('@aws-sdk/client-cognito-identity-provider');
+        const out = await (await client('cognito')).send(new InitiateAuthCommand({
+            ClientId: auth.clientId,
+            AuthFlow: 'REFRESH_TOKEN_AUTH',
+            AuthParameters: { REFRESH_TOKEN: refreshToken },
+        }));
+        const id = out.AuthenticationResult?.IdToken;
+        if (!id)
+            throw new Error('refresh returned no id token');
+        return { idToken: id };
+    }
+    return tokenRequest(auth, { grant_type: 'refresh_token', refresh_token: refreshToken });
+}
+// ---------------------------------------------------------------- local sign-in (plat dev)
+function errorName(e) {
+    return e?.name ?? '';
+}
+/**
+ * `plat dev` sign-in against the AWS Emulator's Cognito (no hosted UI there):
+ * create the user if needed, set a throwaway password, and authenticate.
+ */
+export async function localSignIn(auth, email, name) {
+    const cognito = await client('cognito');
+    const { AdminCreateUserCommand, AdminInitiateAuthCommand, AdminSetUserPasswordCommand, InitiateAuthCommand, } = await import('@aws-sdk/client-cognito-identity-provider');
+    try {
+        await cognito.send(new AdminCreateUserCommand({
+            UserPoolId: auth.userPoolId,
+            Username: email,
+            MessageAction: 'SUPPRESS',
+            UserAttributes: [
+                { Name: 'email', Value: email },
+                { Name: 'email_verified', Value: 'true' },
+                ...(name ? [{ Name: 'name', Value: name }] : []),
+            ],
+        }));
+    }
+    catch (e) {
+        if (errorName(e) !== 'UsernameExistsException')
+            throw e;
+    }
+    const password = `Pp1!${randomBytes(18).toString('base64url')}`;
+    await cognito.send(new AdminSetUserPasswordCommand({
+        UserPoolId: auth.userPoolId,
+        Username: email,
+        Password: password,
+        Permanent: true,
+    }));
+    const params = { USERNAME: email, PASSWORD: password };
+    let result;
+    try {
+        const out = await cognito.send(new AdminInitiateAuthCommand({
+            UserPoolId: auth.userPoolId,
+            ClientId: auth.clientId,
+            AuthFlow: 'ADMIN_USER_PASSWORD_AUTH',
+            AuthParameters: params,
+        }));
+        result = out.AuthenticationResult;
+    }
+    catch {
+        const out = await cognito.send(new InitiateAuthCommand({
+            ClientId: auth.clientId,
+            AuthFlow: 'USER_PASSWORD_AUTH',
+            AuthParameters: params,
+        }));
+        result = out.AuthenticationResult;
+    }
+    if (!result?.IdToken)
+        throw new Error('Local sign-in returned no tokens');
+    return { idToken: result.IdToken, ...(result.RefreshToken ? { refreshToken: result.RefreshToken } : {}) };
+}
+//# sourceMappingURL=tokens.js.map

package/dist/auth/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/auth/tokens.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,OAAO,EAAE,kBAAkB,EAAmB,MAAM,IAAI,UAAU,EAAE,SAAS,EAAE,MAAM,MAAM,CAAC;AAC5F,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAOvC,MAAM,SAAS,GAAG,IAAI,GAAG,EAAiD,CAAC;AAE3E,SAAS,IAAI,CAAC,GAAW;IACvB,IAAI,GAAG,GAAG,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,kBAAkB,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7F,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,KAAa;IACjE,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC;IAC9B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrE,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC;YAC9B,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,8BAA8B,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAClG,CAAC;SAAM,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,QAAQ;YACrC,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAC3C,oCAAoC,EACpC,OAAO,EACP,WAAW,CACZ,CAAC;IACN,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,UAAU,CAAC,wBAAwB,CAAC,oCAAoC,EAAE,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5G,CAAC;IACD,OAAO,MAAM,CAAC,OAAO,CAAC,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,CAAC,YAAY,UAAU,CAAC,UAAU,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,CAAa;IAClC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACrF,MAAM,IAAI,GACR,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC,CAAC;IAClG,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,gBAAgB,CAAe,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACxG,MAAM,IAAI,GAAiB,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC;IAC3B,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9B,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS;QAChC,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,cAAc,KAAK,IAAI,IAAI,CAAC,CAAC,cAAc,KAAK,MAAM,CAAC;IAChF,IAAI,IAAI;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IAC3B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+FAA+F;AAE/F,KAAK,UAAU,YAAY,CAAC,IAAkB,EAAE,MAA8B;IAC5E,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,EAAE;QAC1E,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC;KACnE,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QACT,MAAM,IAAI,KAAK,CAAC,mCAAmC,GAAG,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACxG,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAkD,CAAC;IACjF,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;IACnF,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACzG,CAAC;AAED,MAAM,UAAU,YAAY,CAC1B,IAAkB,EAClB,IAAY,EACZ,QAAgB,EAChB,WAAmB;IAEnB,OAAO,YAAY,CAAC,IAAI,EAAE;QACxB,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,aAAa,EAAE,QAAQ;QACvB,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAkB,EAAE,YAAoB;IAC1E,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;QAC1B,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;QAC1F,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAC9C,IAAI,mBAAmB,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,oBAAoB;YAC9B,cAAc,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE;SAChD,CAAC,CACH,CAAC;QACF,MAAM,EAAE,GAAG,GAAG,CAAC,oBAAoB,EAAE,OAAO,CAAC;QAC7C,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;QACzD,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,YAAY,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,eAAe,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,4FAA4F;AAE5F,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAQ,CAAuB,EAAE,IAAI,IAAI,EAAE,CAAC;AAC9C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAkB,EAAE,KAAa,EAAE,IAAa;IAChF,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IACxC,MAAM,EACJ,sBAAsB,EACtB,wBAAwB,EACxB,2BAA2B,EAC3B,mBAAmB,GACpB,GAAG,MAAM,MAAM,CAAC,2CAA2C,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,OAAO,CAAC,IAAI,CAChB,IAAI,sBAAsB,CAAC;YACzB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,KAAK;YACf,aAAa,EAAE,UAAU;YACzB,cAAc,EAAE;gBACd,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;gBAC/B,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE;gBACzC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aACjD;SACF,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,SAAS,CAAC,CAAC,CAAC,KAAK,yBAAyB;YAAE,MAAM,CAAC,CAAC;IAC1D,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;IAChE,MAAM,OAAO,CAAC,IAAI,CAChB,IAAI,2BAA2B,CAAC;QAC9B,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,QAAQ;QAClB,SAAS,EAAE,IAAI;KAChB,CAAC,CACH,CAAC;IACF,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;IACvD,IAAI,MAA+D,CAAC;IACpE,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAC5B,IAAI,wBAAwB,CAAC;YAC3B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,0BAA0B;YACpC,cAAc,EAAE,MAAM;SACvB,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAC5B,IAAI,mBAAmB,CAAC;YACtB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,QAAQ,EAAE,oBAAoB;YAC9B,cAAc,EAAE,MAAM;SACvB,CAAC,CACH,CAAC;QACF,MAAM,GAAG,GAAG,CAAC,oBAAoB,CAAC;IACpC,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IAC1E,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC5G,CAAC"}

package/dist/bindings.d.ts

@@ -0,0 +1,13 @@
+import { type Bindings } from '@ericminassian/platform-core';
+/**
+ * The stage's bindings, decoded lazily from `PLATFORM_BINDINGS` on first use
+ * so importing the SDK never throws; using a resource without bindings does.
+ */
+export declare function getBindings(): Bindings;
+/** Bindings if present, otherwise undefined (telemetry, health). */
+export declare function tryBindings(): Bindings | undefined;
+/** Override bindings (tests). Pass undefined to re-read the environment. */
+export declare function setBindings(b: Bindings | undefined): void;
+export declare function region(): string;
+/** True under `plat dev` / `plat test` (AWS Emulator). */
+export declare function isEmulator(): boolean;

package/dist/bindings.js

@@ -0,0 +1,32 @@
+import { BINDINGS_ENV, decodeBindings } from '@ericminassian/platform-core';
+let cached;
+/**
+ * The stage's bindings, decoded lazily from `PLATFORM_BINDINGS` on first use
+ * so importing the SDK never throws; using a resource without bindings does.
+ */
+export function getBindings() {
+    if (!cached)
+        cached = decodeBindings(process.env[BINDINGS_ENV]);
+    return cached;
+}
+/** Bindings if present, otherwise undefined (telemetry, health). */
+export function tryBindings() {
+    try {
+        return getBindings();
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Override bindings (tests). Pass undefined to re-read the environment. */
+export function setBindings(b) {
+    cached = b;
+}
+export function region() {
+    return tryBindings()?.region ?? process.env.AWS_REGION ?? process.env.AWS_DEFAULT_REGION ?? 'us-east-1';
+}
+/** True under `plat dev` / `plat test` (AWS Emulator). */
+export function isEmulator() {
+    return Boolean(process.env.AWS_ENDPOINT_URL);
+}
+//# sourceMappingURL=bindings.js.map

package/dist/bindings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bindings.js","sourceRoot":"","sources":["../src/bindings.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAiB,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAE3F,IAAI,MAA4B,CAAC;AAEjC;;;GAGG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC,MAAM;QAAE,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;IAChE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,WAAW;IACzB,IAAI,CAAC;QACH,OAAO,WAAW,EAAE,CAAC;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,WAAW,CAAC,CAAuB;IACjD,MAAM,GAAG,CAAC,CAAC;AACb,CAAC;AAED,MAAM,UAAU,MAAM;IACpB,OAAO,WAAW,EAAE,EAAE,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,WAAW,CAAC;AAC1G,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,UAAU;IACxB,OAAO,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;AAC/C,CAAC"}