@fluixi/oauth2 1.0.0-alpha.1

package/dist/service.cjs

@@ -0,0 +1,903 @@
+"use strict";
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/service.ts
+var service_exports = {};
+__export(service_exports, {
+  createAuthService: () => createAuthService,
+  paramsFromUrl: () => paramsFromUrl
+});
+module.exports = __toCommonJS(service_exports);
+var import_session = require("@fluixi/session");
+var import_client = require("@fluixi/auth/client");
+
+// src/pkce.ts
+function base64url(bytes) {
+  let binary = "";
+  for (const byte of bytes) binary += String.fromCharCode(byte);
+  return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomBytes(length) {
+  const bytes = new Uint8Array(length);
+  crypto.getRandomValues(bytes);
+  return bytes;
+}
+function createVerifier() {
+  return base64url(randomBytes(32));
+}
+function createStateValue() {
+  return base64url(randomBytes(16));
+}
+async function createChallenge(verifier) {
+  const digest = await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier));
+  return base64url(new Uint8Array(digest));
+}
+async function createPkcePair() {
+  const verifier = createVerifier();
+  return { verifier, challenge: await createChallenge(verifier) };
+}
+function timingSafeEqual(a, b) {
+  if (a.length !== b.length) return false;
+  let diff = 0;
+  for (let i = 0; i < a.length; i++) diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
+  return diff === 0;
+}
+function expiryFrom(expiresIn, now = Date.now()) {
+  const seconds = typeof expiresIn === "number" ? expiresIn : Number(expiresIn);
+  return Number.isFinite(seconds) && seconds > 0 ? now + seconds * 1e3 : void 0;
+}
+function claimsOf(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    return JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
+  } catch {
+    return null;
+  }
+}
+function expiryFromJwt(token) {
+  const parts = token.split(".");
+  if (parts.length < 2) return null;
+  try {
+    const payload = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const json = JSON.parse(atob(payload.padEnd(Math.ceil(payload.length / 4) * 4, "=")));
+    return typeof json.exp === "number" ? json.exp * 1e3 : null;
+  } catch {
+    return null;
+  }
+}
+
+// src/return-to.ts
+function safeReturnTo(candidate, options = {}) {
+  const fallback = options.fallback ?? "/";
+  if (!candidate || typeof candidate !== "string") return fallback;
+  const value = candidate.trim();
+  if (!value) return fallback;
+  if (/[\u0000-\u001f\u007f]/.test(value)) return fallback;
+  if (/^[/\\]{2}/.test(value)) return fallback;
+  if (value.startsWith("/")) return value;
+  const here = options.origin ?? (typeof location === "undefined" ? void 0 : location.origin);
+  const allowed = [here, ...options.allowedOrigins ?? []].filter(Boolean);
+  if (!allowed.length) return fallback;
+  let url;
+  try {
+    url = new URL(value);
+  } catch {
+    return fallback;
+  }
+  if (!allowed.includes(url.origin)) return fallback;
+  if (url.protocol !== "http:" && url.protocol !== "https:") return fallback;
+  return url.toString();
+}
+
+// src/types.ts
+var OAuthError = class extends Error {
+  constructor(message, code, description) {
+    super(message);
+    this.code = code;
+    this.description = description;
+    this.name = "OAuthError";
+  }
+};
+
+// src/client-auth.ts
+var CANONICAL = {
+  basic: "client_secret_basic",
+  body: "client_secret_post",
+  client_secret_basic: "client_secret_basic",
+  client_secret_post: "client_secret_post",
+  private_key_jwt: "private_key_jwt",
+  none: "none"
+};
+function resolveMethod(auth) {
+  if (auth.method) return CANONICAL[auth.method] ?? "client_secret_basic";
+  if (auth.privateKey) return "private_key_jwt";
+  return auth.clientSecret ? "client_secret_basic" : "none";
+}
+async function loadJose() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "private_key_jwt needs `jose`. Install it: npm i jose. It is an optional peer, so a client using a secret does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function signAssertion(auth, endpoint) {
+  const jose = await loadJose();
+  const alg = auth.assertionAlgorithm ?? "RS256";
+  const key = await jose.importJWK(auth.privateKey, alg);
+  const kid = auth.keyId ?? auth.privateKey.kid;
+  return new jose.SignJWT({}).setProtectedHeader(kid ? { alg, kid } : { alg }).setIssuer(auth.clientId).setSubject(auth.clientId).setAudience(endpoint).setJti(crypto.randomUUID()).setIssuedAt().setExpirationTime("1m").sign(key);
+}
+async function applyClientAuth(auth, endpoint, headers, form) {
+  switch (resolveMethod(auth)) {
+    case "client_secret_basic": {
+      const pair = `${encodeURIComponent(auth.clientId)}:${encodeURIComponent(auth.clientSecret)}`;
+      headers.authorization = `Basic ${btoa(pair)}`;
+      break;
+    }
+    case "client_secret_post":
+      form.set("client_id", auth.clientId);
+      form.set("client_secret", auth.clientSecret);
+      break;
+    case "private_key_jwt":
+      form.set("client_id", auth.clientId);
+      form.set("client_assertion_type", "urn:ietf:params:oauth:client-assertion-type:jwt-bearer");
+      form.set("client_assertion", await signAssertion(auth, endpoint));
+      break;
+    case "none":
+      form.set("client_id", auth.clientId);
+      break;
+  }
+}
+
+// src/dpop.ts
+async function loadJose2() {
+  try {
+    return await import("jose");
+  } catch {
+    throw new OAuthError(
+      "DPoP needs `jose`. Install it: npm i jose. It is an optional peer, so a client not using DPoP does not carry it.",
+      "jose_missing"
+    );
+  }
+}
+async function createDpopKey(alg = "ES256") {
+  const jose = await loadJose2();
+  const { privateKey, publicKey } = await jose.generateKeyPair(alg, { extractable: false });
+  const publicJwk = { ...await jose.exportJWK(publicKey) };
+  return {
+    privateKey,
+    publicJwk,
+    thumbprint: await jose.calculateJwkThumbprint(publicJwk, "sha256"),
+    alg
+  };
+}
+async function proofFor(key, options) {
+  const jose = await loadJose2();
+  const htu = (() => {
+    try {
+      const url = new URL(options.url);
+      url.search = "";
+      url.hash = "";
+      return url.toString();
+    } catch {
+      return options.url;
+    }
+  })();
+  const claims = {
+    htm: options.method.toUpperCase(),
+    htu,
+    jti: crypto.randomUUID()
+  };
+  if (options.accessToken) {
+    const digest = await crypto.subtle.digest(
+      "SHA-256",
+      new TextEncoder().encode(options.accessToken)
+    );
+    let binary = "";
+    for (const byte of new Uint8Array(digest)) binary += String.fromCharCode(byte);
+    claims.ath = btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+  }
+  if (options.nonce) claims.nonce = options.nonce;
+  return new jose.SignJWT(claims).setProtectedHeader({ typ: "dpop+jwt", alg: key.alg, jwk: key.publicJwk }).setIssuedAt().sign(key.privateKey);
+}
+function nonceFrom(response) {
+  return response.headers.get("dpop-nonce");
+}
+
+// src/dpop-store.ts
+var DB = "fluixi-oauth2-dpop";
+var STORE = "keys";
+function available() {
+  return typeof indexedDB !== "undefined";
+}
+function open() {
+  return new Promise((resolve, reject) => {
+    const request = indexedDB.open(DB, 1);
+    request.onupgradeneeded = () => {
+      const db = request.result;
+      if (!db.objectStoreNames.contains(STORE)) db.createObjectStore(STORE);
+    };
+    request.onsuccess = () => resolve(request.result);
+    request.onerror = () => reject(request.error ?? new Error("indexedDB.open failed"));
+  });
+}
+function act(mode, run) {
+  return open().then(
+    (db) => new Promise((resolve, reject) => {
+      const tx = db.transaction(STORE, mode);
+      const request = run(tx.objectStore(STORE));
+      request.onsuccess = () => resolve(request.result);
+      request.onerror = () => reject(request.error ?? new Error("DPoP key request failed"));
+      tx.oncomplete = () => db.close();
+    })
+  );
+}
+function usable(value) {
+  const stored = value;
+  return !!stored && typeof stored.thumbprint === "string" && typeof stored.alg === "string" && !!stored.publicJwk && // A CryptoKey survives the round trip as a CryptoKey. Anything else means the record was
+  // written by something other than this, and binding to it would fail at the provider.
+  typeof stored.privateKey?.type === "string";
+}
+async function keyFor(clientKey, alg = "ES256", onEphemeral) {
+  if (!available()) {
+    onEphemeral?.("This environment has no IndexedDB, so the key lasts only as long as this document.");
+    return createDpopKey(alg);
+  }
+  try {
+    const found = await act("readonly", (store2) => store2.get(clientKey));
+    if (usable(found) && found.alg === alg) {
+      return {
+        privateKey: found.privateKey,
+        publicJwk: found.publicJwk,
+        thumbprint: found.thumbprint,
+        alg: found.alg
+      };
+    }
+  } catch (cause) {
+    onEphemeral?.(
+      `The stored DPoP key could not be read (${cause instanceof Error ? cause.message : String(cause)}), so a new one was made.`
+    );
+  }
+  const key = await createDpopKey(alg);
+  try {
+    await act(
+      "readwrite",
+      (store2) => store2.put(
+        {
+          privateKey: key.privateKey,
+          publicJwk: key.publicJwk,
+          thumbprint: key.thumbprint,
+          alg: key.alg
+        },
+        clientKey
+      )
+    );
+  } catch (cause) {
+    onEphemeral?.(
+      `The DPoP key could not be stored (${cause instanceof Error ? cause.message : String(cause)}), so a refresh after the next navigation will be refused.`
+    );
+  }
+  return key;
+}
+async function forgetKey(clientKey) {
+  if (!available()) return;
+  try {
+    await act("readwrite", (store2) => store2.delete(clientKey));
+  } catch {
+  }
+}
+
+// src/discovery.ts
+var cache = /* @__PURE__ */ new Map();
+function documentUrl(issuer) {
+  return `${issuer.replace(/\/$/, "")}/.well-known/openid-configuration`;
+}
+async function discover(issuer, fetcher = fetch) {
+  const cached = cache.get(issuer);
+  if (cached) return cached;
+  const pending = (async () => {
+    let response;
+    try {
+      response = await fetcher(documentUrl(issuer));
+    } catch (cause) {
+      throw new OAuthError(
+        `Could not read the discovery document at ${documentUrl(issuer)}. In a browser this is usually the provider refusing a cross-origin read: give \`endpoints\` directly, or resolve them on a server. (${cause instanceof Error ? cause.message : String(cause)})`,
+        "discovery_unreachable"
+      );
+    }
+    if (!response.ok) {
+      throw new OAuthError(
+        `Discovery failed for ${issuer}: ${response.status}`,
+        "discovery_failed"
+      );
+    }
+    const doc = await response.json();
+    if (!doc.authorization_endpoint || !doc.token_endpoint) {
+      throw new OAuthError(
+        `${issuer} published a discovery document with no authorization or token endpoint.`,
+        "discovery_incomplete"
+      );
+    }
+    return {
+      authorization: doc.authorization_endpoint,
+      token: doc.token_endpoint,
+      userinfo: doc.userinfo_endpoint,
+      endSession: doc.end_session_endpoint,
+      jwks: doc.jwks_uri,
+      introspection: doc.introspection_endpoint,
+      revocation: doc.revocation_endpoint,
+      issuer: doc.issuer ?? issuer
+    };
+  })();
+  cache.set(issuer, pending);
+  pending.catch(() => cache.delete(issuer));
+  return pending;
+}
+
+// src/browser.ts
+var keysFor = (id) => ({
+  verifier: `fx.oauth2.${id}.verifier`,
+  state: `fx.oauth2.${id}.state`,
+  returnTo: `fx.oauth2.${id}.return`,
+  refresh: `fx.oauth2.${id}.refresh`,
+  /** Names the record in IndexedDB, not a `Storage` entry: a key is never a string here. */
+  dpop: `fx.oauth2.${id}.dpop`
+});
+var DEFAULT_SCOPES = ["openid", "profile", "email"];
+function store(kind) {
+  if (typeof window === "undefined") return null;
+  try {
+    return kind === "local" ? window.localStorage : window.sessionStorage;
+  } catch {
+    return null;
+  }
+}
+function createBrowserClient(config, fetcher = fetch) {
+  const scopes = config.scopes ?? DEFAULT_SCOPES;
+  const KEY = keysFor(config.storageKey ?? config.clientId);
+  const flow = () => store(config.storage ?? "session");
+  const durable = () => store(config.storage ?? "session");
+  let access = null;
+  let dpopKey = null;
+  let dpopPending = null;
+  let dpopNonce = null;
+  const keyForDpop = async () => {
+    if (!config.dpop) return null;
+    if (dpopKey) return dpopKey;
+    dpopPending ??= keyFor(KEY.dpop, config.dpopAlgorithm, (reason) => {
+      console.warn(`[fluixi/oauth2] ${reason}`);
+    }).then((key) => {
+      dpopKey = key;
+      return key;
+    });
+    return dpopPending;
+  };
+  let endpoints = config.endpoints ?? null;
+  async function resolveEndpoints() {
+    if (endpoints) return endpoints;
+    if (!config.issuer) {
+      throw new OAuthError(
+        "Give the client an `issuer` to discover from, or `endpoints` directly.",
+        "missing_issuer"
+      );
+    }
+    endpoints = await discover(config.issuer, fetcher);
+    return endpoints;
+  }
+  async function exchange(body) {
+    const { token } = await resolveEndpoints();
+    const key = await keyForDpop();
+    const headers = {
+      "content-type": "application/x-www-form-urlencoded"
+    };
+    const form = new URLSearchParams(body);
+    form.delete("client_id");
+    await applyClientAuth(
+      { clientId: config.clientId, method: config.tokenAuthMethod ?? "none", clientSecret: "" },
+      token,
+      headers,
+      form
+    );
+    const send = async () => {
+      if (key) {
+        headers.dpop = await proofFor(key, {
+          method: "POST",
+          url: token,
+          nonce: dpopNonce ?? void 0
+        });
+      }
+      return fetcher(token, { method: "POST", headers, body: form.toString() });
+    };
+    let response = await send();
+    if (key && !response.ok) {
+      const offered = nonceFrom(response);
+      if (offered && offered !== dpopNonce) {
+        dpopNonce = offered;
+        response = await send();
+      }
+    }
+    if (key) dpopNonce = nonceFrom(response) ?? dpopNonce;
+    const payload = await response.json().catch(() => ({}));
+    if (!response.ok) {
+      const code = String(payload.error ?? "token_request_failed");
+      const description = typeof payload.error_description === "string" ? payload.error_description : void 0;
+      const hint = (code === "invalid_dpop_proof" || code === "use_dpop_nonce") && !config.dpop ? " This provider requires DPoP (RFC 9449), which binds a token to a key this client holds. Set `dpop: true` on the config." : "";
+      throw new OAuthError(
+        `Token request failed: ${[code, description].filter(Boolean).join(": ")}${hint}`,
+        code,
+        description
+      );
+    }
+    const accessToken = String(payload.access_token ?? "");
+    if (!accessToken) {
+      throw new OAuthError("The token response carried no access_token.", "no_access_token");
+    }
+    const tokens = {
+      accessToken,
+      refreshToken: typeof payload.refresh_token === "string" ? payload.refresh_token : void 0,
+      idToken: typeof payload.id_token === "string" ? payload.id_token : void 0,
+      tokenType: typeof payload.token_type === "string" ? payload.token_type : void 0,
+      scope: typeof payload.scope === "string" ? payload.scope : void 0,
+      // `expires_in` is what the server said; the JWT's own `exp` is the fallback for a
+      // server that omits it.
+      expiresAt: expiryFrom(payload.expires_in) ?? expiryFromJwt(accessToken) ?? void 0
+    };
+    access = tokens;
+    if (tokens.refreshToken) durable()?.setItem(KEY.refresh, tokens.refreshToken);
+    return tokens;
+  }
+  return {
+    async login(options = {}) {
+      const { authorization } = await resolveEndpoints();
+      const { verifier, challenge } = await createPkcePair();
+      const state = createStateValue();
+      const storage = flow();
+      storage?.setItem(KEY.verifier, verifier);
+      storage?.setItem(KEY.state, state);
+      storage?.setItem(
+        KEY.returnTo,
+        safeReturnTo(options.returnTo ?? `${location.pathname}${location.search}`, {
+          fallback: "/",
+          allowedOrigins: config.allowedReturnOrigins
+        })
+      );
+      const url = new URL(authorization);
+      url.searchParams.set("response_type", "code");
+      url.searchParams.set("client_id", config.clientId);
+      url.searchParams.set("redirect_uri", config.redirectUri);
+      url.searchParams.set("scope", scopes.join(" "));
+      url.searchParams.set("state", state);
+      url.searchParams.set("code_challenge", challenge);
+      url.searchParams.set("code_challenge_method", "S256");
+      for (const [key, value] of Object.entries({
+        ...config.extraParams,
+        ...options.params
+      })) {
+        url.searchParams.set(key, value);
+      }
+      location.assign(url.toString());
+    },
+    async handleCallback(params) {
+      if (params.error) {
+        throw new OAuthError(
+          params.errorDescription ?? params.error,
+          params.error,
+          params.errorDescription
+        );
+      }
+      if (!params.code) {
+        throw new OAuthError("The callback carried no authorization code.", "no_code");
+      }
+      const storage = flow();
+      const expected = storage?.getItem(KEY.state) ?? null;
+      const verifier = storage?.getItem(KEY.verifier) ?? null;
+      storage?.removeItem(KEY.state);
+      storage?.removeItem(KEY.verifier);
+      if (!expected || !params.state || !timingSafeEqual(expected, params.state)) {
+        throw new OAuthError(
+          "The callback state did not match the one this client sent.",
+          "state_mismatch"
+        );
+      }
+      if (!verifier) {
+        throw new OAuthError(
+          "No PKCE verifier for this callback. The login was started elsewhere, or storage was cleared.",
+          "missing_verifier"
+        );
+      }
+      return exchange({
+        grant_type: "authorization_code",
+        code: params.code,
+        redirect_uri: config.redirectUri,
+        client_id: config.clientId,
+        code_verifier: verifier
+      });
+    },
+    async refresh() {
+      const token = access?.refreshToken ?? durable()?.getItem(KEY.refresh);
+      if (!token) {
+        throw new OAuthError("No refresh token, so the session cannot be extended.", "no_refresh_token");
+      }
+      try {
+        return await exchange({
+          grant_type: "refresh_token",
+          refresh_token: token,
+          client_id: config.clientId
+        });
+      } catch (error) {
+        if (error instanceof OAuthError && error.code === "invalid_grant") {
+          durable()?.removeItem(KEY.refresh);
+          access = null;
+        }
+        throw error;
+      }
+    },
+    async fetchUser(accessToken) {
+      const custom = config.userInfo;
+      const bearer = accessToken ?? access?.accessToken;
+      if (!bearer) throw new OAuthError("No access token to call userinfo with.", "no_access_token");
+      let endpoint = custom?.url;
+      if (!endpoint) {
+        const { userinfo } = await resolveEndpoints();
+        if (!userinfo) {
+          throw new OAuthError(
+            "The provider published no userinfo endpoint. Give `userInfo.url`, or the service its own `fetchUser`.",
+            "no_userinfo"
+          );
+        }
+        endpoint = userinfo;
+      }
+      const key = await keyForDpop();
+      const headers = {
+        // A bound token is presented with the DPoP scheme, not Bearer: a service checking
+        // binding refuses `Bearer` outright, since that is the word for an unbound token.
+        authorization: `${key ? "DPoP" : "Bearer"} ${bearer}`,
+        accept: "application/json",
+        ...custom?.headers
+      };
+      if (key) {
+        headers.dpop = await proofFor(key, {
+          method: custom?.method ?? "GET",
+          url: endpoint,
+          // `ath` binds the proof to this token, so one captured beside it cannot be
+          // reused with another.
+          accessToken: bearer,
+          nonce: dpopNonce ?? void 0
+        });
+      }
+      const response = await fetcher(endpoint, {
+        method: custom?.method ?? "GET",
+        headers,
+        ...custom?.credentials ? { credentials: custom.credentials } : {}
+      });
+      if (!response.ok) {
+        const reason = response.headers.get("www-authenticate")?.match(/error="([^"]+)"/)?.[1];
+        throw new OAuthError(
+          `The user endpoint refused the token: ${reason ?? response.status}`,
+          reason ?? "userinfo_failed"
+        );
+      }
+      const type = response.headers.get("content-type") ?? "";
+      if (type.includes("application/jwt")) {
+        throw new OAuthError(
+          "This provider returns a signed userinfo response, which needs its own verification. Give the service its own `fetchUser`.",
+          "userinfo_signed"
+        );
+      }
+      const raw = await response.json();
+      if (!custom?.url) {
+        const expected = access?.idToken ? claimsOf(access.idToken)?.sub : void 0;
+        if (expected !== void 0 && raw.sub !== expected) {
+          throw new OAuthError(
+            "The userinfo subject does not match the id token. The response was discarded.",
+            "sub_mismatch"
+          );
+        }
+      }
+      return custom?.map ? await custom.map(raw, bearer) : raw;
+    },
+    /**
+     * Retire a token at the provider, per RFC 7009.
+     *
+     * Defaults to the refresh token, which is the one worth retiring: an access token
+     * expires on its own in minutes, a refresh token does not. A provider with no
+     * revocation endpoint resolves without doing anything, because there is nothing this
+     * can do about that and failing a logout over it helps nobody.
+     */
+    async revoke(token, hint = "refresh_token") {
+      const target = token ?? (hint === "refresh_token" ? access?.refreshToken ?? durable()?.getItem(KEY.refresh) ?? void 0 : access?.accessToken);
+      if (!target) {
+        throw new OAuthError(
+          `No ${hint.replace("_", " ")} held by this client, so there is nothing to revoke. One is stored when the provider issues it, and cleared when the provider rejects it.`,
+          "nothing_to_revoke"
+        );
+      }
+      const { revocation } = await resolveEndpoints();
+      if (!revocation) {
+        throw new OAuthError(
+          "This provider publishes no revocation endpoint, so a token cannot be retired before it expires.",
+          "no_revocation_endpoint"
+        );
+      }
+      const headers = {
+        "content-type": "application/x-www-form-urlencoded"
+      };
+      const form = new URLSearchParams({ token: target, token_type_hint: hint });
+      await applyClientAuth(
+        { clientId: config.clientId, method: config.tokenAuthMethod ?? "none", clientSecret: "" },
+        revocation,
+        headers,
+        form
+      );
+      const response = await fetcher(revocation, {
+        method: "POST",
+        headers,
+        body: form.toString()
+      });
+      if (!response.ok) {
+        const payload = await response.json().catch(() => ({}));
+        throw new OAuthError(
+          `Revocation was refused: ${[payload.error, payload.error_description].filter(Boolean).join(": ") || response.status}`,
+          String(payload.error ?? "revocation_failed")
+        );
+      }
+      if (hint === "refresh_token") {
+        durable()?.removeItem(KEY.refresh);
+        if (access) access = { ...access, refreshToken: void 0 };
+      }
+    },
+    async logout(options = {}) {
+      const idToken = access?.idToken;
+      await this.revoke?.().catch(() => void 0);
+      access = null;
+      durable()?.removeItem(KEY.refresh);
+      dpopKey = null;
+      dpopPending = null;
+      await forgetKey(KEY.dpop);
+      const { endSession } = await resolveEndpoints().catch(() => ({ endSession: void 0 }));
+      const target = options.returnTo ? safeReturnTo(options.returnTo, {
+        fallback: config.postLogoutRedirectUri ?? "/",
+        allowedOrigins: config.allowedReturnOrigins
+      }) : config.postLogoutRedirectUri;
+      if (!endSession) {
+        if (target && typeof location !== "undefined") location.assign(target);
+        return;
+      }
+      const url = new URL(endSession);
+      if (target) url.searchParams.set("post_logout_redirect_uri", target);
+      if (idToken) url.searchParams.set("id_token_hint", idToken);
+      url.searchParams.set("client_id", config.clientId);
+      location.assign(url.toString());
+    },
+    async restore() {
+      if (access) return access;
+      if (!durable()?.getItem(KEY.refresh)) return null;
+      try {
+        return await this.refresh();
+      } catch {
+        return null;
+      }
+    },
+    /**
+     * A proof for a request a caller will send with this client's token.
+     *
+     * Null when the client does not bind its tokens, so a caller can send `Bearer`
+     * unchanged. Only this client holds the key, so nothing else can produce one.
+     */
+    async dpopProof(method, url) {
+      const key = await keyForDpop();
+      if (!key) return null;
+      return proofFor(key, {
+        method,
+        url,
+        accessToken: access?.accessToken,
+        nonce: dpopNonce ?? void 0
+      });
+    },
+    consumeReturnTo() {
+      const storage = flow();
+      const value = storage?.getItem(KEY.returnTo) ?? null;
+      storage?.removeItem(KEY.returnTo);
+      return value === null ? null : safeReturnTo(value, {
+        fallback: "/",
+        allowedOrigins: config.allowedReturnOrigins
+      });
+    }
+  };
+}
+
+// src/server-client.ts
+var COOKIE_SESSION = "cookie";
+function createServerClient(config, fetcher = fetch) {
+  const base = (config.basePath ?? "/auth").replace(/\/$/, "");
+  const url = (path) => `${base}${path}`;
+  const call = (path, init = {}) => fetcher(url(path), { credentials: "same-origin", ...init });
+  return {
+    async login(options = {}) {
+      const target = new URL(url("/login"), location.origin);
+      if (options.returnTo) target.searchParams.set("returnTo", options.returnTo);
+      for (const [key, value] of Object.entries(options.params ?? {})) {
+        target.searchParams.set(key, value);
+      }
+      location.assign(target.toString());
+    },
+    async handleCallback(params) {
+      const response = await call("/callback", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(params)
+      });
+      if (!response.ok) {
+        const body = await response.json().catch(() => ({}));
+        throw new OAuthError(
+          String(body.error ?? `Callback failed: ${response.status}`),
+          String(body.error ?? "callback_failed")
+        );
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async refresh() {
+      const response = await call("/refresh", { method: "POST" });
+      if (!response.ok) {
+        throw new OAuthError("The server could not extend the session.", "refresh_failed");
+      }
+      return { accessToken: COOKIE_SESSION };
+    },
+    async fetchUser() {
+      const custom = config.userInfo;
+      const response = custom?.url ? await fetcher(custom.url, {
+        method: custom.method ?? "GET",
+        credentials: custom.credentials ?? "same-origin",
+        headers: { accept: "application/json", ...custom.headers }
+      }) : await call("/me");
+      if (!response.ok) {
+        throw new OAuthError(`The server refused the user request: ${response.status}`, "me_failed");
+      }
+      const raw = await response.json();
+      return custom?.map ? await custom.map(raw, COOKIE_SESSION) : raw;
+    },
+    /**
+     * Retire the session's tokens, which only the server can do here.
+     *
+     * The browser holds a cookie and no token, so it has nothing to send to a revocation
+     * endpoint. This asks the server's own route, which opens the cookie and revokes what
+     * is inside.
+     */
+    async revoke(_token, hint = "refresh_token") {
+      await call(`/revoke?hint=${hint}`, { method: "POST" }).catch(() => void 0);
+    },
+    async logout(options = {}) {
+      await call("/logout", { method: "POST" }).catch(() => void 0);
+      const target = options.returnTo ? safeReturnTo(options.returnTo, {
+        fallback: config.postLogoutRedirectUri ?? "/",
+        allowedOrigins: config.allowedReturnOrigins
+      }) : config.postLogoutRedirectUri ?? "/";
+      if (typeof location !== "undefined") location.assign(target);
+    },
+    async restore() {
+      const response = await call("/me");
+      return response.ok ? { accessToken: COOKIE_SESSION } : null;
+    }
+  };
+}
+
+// src/service.ts
+function paramsFromUrl(url) {
+  const href = url ?? (typeof location === "undefined" ? null : location.href);
+  if (!href) return {};
+  const { searchParams } = new URL(String(href));
+  return {
+    code: searchParams.get("code") ?? void 0,
+    state: searchParams.get("state") ?? void 0,
+    error: searchParams.get("error") ?? void 0,
+    errorDescription: searchParams.get("error_description") ?? void 0
+  };
+}
+function clientFor(options) {
+  if (options.client) return options.client;
+  return options.config.tokens === "server" ? createServerClient(options.config) : createBrowserClient(options.config);
+}
+function createAuthService(options) {
+  const client = clientFor(options);
+  let latest = null;
+  const session = (0, import_session.createSession)({
+    /** The credential is the callback, so this is the code exchange. */
+    async login(params) {
+      latest = await client.handleCallback(params);
+      return { token: latest.accessToken, expiresAt: latest.expiresAt };
+    },
+    async fetchUser(token) {
+      if (options.fetchUser) return options.fetchUser(token);
+      return client.fetchUser(token === COOKIE_SESSION ? void 0 : token);
+    },
+    async refresh() {
+      latest = await client.refresh();
+      return { token: latest.accessToken, expiresAt: latest.expiresAt };
+    },
+    async logout() {
+      latest = null;
+      await client.logout();
+    },
+    getExpiry(token) {
+      if (token === COOKIE_SESSION) return null;
+      return latest?.expiresAt ?? expiryFromJwt(token);
+    },
+    access: options.access,
+    storageKeys: options.storageKeys,
+    refreshSkewMs: options.refreshSkewMs,
+    onLogin: options.onLogin,
+    onLogout: options.onLogout,
+    onExpired: options.onExpired,
+    onError: options.onError
+  });
+  const hooks = (0, import_client.createAuthHooks)({
+    session,
+    navigate: options.navigate,
+    loginPath: options.loginPath ?? "/login",
+    homePath: options.homePath ?? "/",
+    forbiddenPath: options.forbiddenPath ?? "/403"
+  });
+  return Object.assign(session, {
+    client,
+    protectedRoute: hooks.protectedRoute,
+    Can: hooks.Can,
+    Protect: hooks.Protect,
+    useAuth: hooks.useAuth,
+    useUser: hooks.useUser,
+    useCan: hooks.useCan,
+    signIn(loginOptions = {}) {
+      return client.login(loginOptions);
+    },
+    /**
+     * Finish a login and say where to go.
+     *
+     * The destination is checked before it is handed back, so an app that navigates to it
+     * without looking cannot be turned into an open redirect by a poisoned login link.
+     */
+    async complete(params) {
+      const callback = params ?? paramsFromUrl();
+      if (!callback.code && !callback.error) {
+        throw new OAuthError(
+          "complete() found no callback parameters. It runs in the browser, on the redirect URI, where the code and the PKCE verifier both are.",
+          "no_callback_params"
+        );
+      }
+      await session.login(callback);
+      return safeReturnTo(client.consumeReturnTo?.(), {
+        fallback: "/",
+        allowedOrigins: "allowedReturnOrigins" in options.config ? options.config.allowedReturnOrigins : void 0
+      });
+    }
+  });
+}